@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/src/assurance/.generated/conformance-verdicts.ts

@@ -19,6 +19,8 @@ export const CONFORMANCE_VERDICTS = {
   "ai#chat-sendmessagestream": "supported",
   "ai#chat-startchat": "supported",
   "ai#chat-stream-single-user-turn": "qualified",
+  "ai#contents-role-assistant": "supported",
+  "ai#contents-role-system": "supported",
   "ai#counttokens-deterministic": "supported",
   "ai#counttokens-envelope": "supported",
   "ai#error-aierror-shape": "supported",
@@ -28,6 +30,7 @@ export const CONFORMANCE_VERDICTS = {
   "ai#error-empty-contents": "supported",
   "ai#error-retired-model": "supported",
   "ai#error-unknown-model": "supported",
+  "ai#fncall-function-role-refused": "supported",
   "ai#fncall-id-present": "supported",
   "ai#fncall-mode-any": "supported",
   "ai#fncall-part-shape": "supported",
@@ -67,6 +70,13 @@ export const CONFORMANCE_VERDICTS = {
   "ai#openai-fifo-tool-ids": "supported",
   "ai#openai-request-translation": "supported",
   "ai#openai-thought-parts-skipped": "supported",
+  "ai#request-model-gemini-pro": "unsupported",
+  "ai#request-roleless-contents": "unsupported",
+  "ai#request-string-system-instruction": "unsupported",
+  "ai#sandbox-app-check-initialize-after-getai": "supported",
+  "ai#sandbox-app-check-limited-use": "supported",
+  "ai#sandbox-app-check-required": "supported",
+  "ai#sandbox-app-check-stream-and-count-tokens": "supported",
   "ai#schema-anyof": "supported",
   "ai#schema-object-tojson": "supported",
   "ai#schema-primitives": "supported",
@@ -117,25 +127,37 @@ export const CONFORMANCE_VERDICTS = {
   "app#8": "supported",
   "app#9": "supported",
   "app-check#attestation-failure": "unsupported",
+  "app-check#custom-provider-without-debug-token": "qualified",
   "app-check#exchange-debug-token-wire": "unsupported",
   "app-check#get-token-before-initialize": "supported",
   "app-check#get-token-caching": "supported",
+  "app-check#get-token-concurrent": "supported",
   "app-check#get-token-shape": "supported",
   "app-check#initialize-returns-handle": "supported",
   "app-check#initialize-twice-different-options": "supported",
   "app-check#initialize-twice-same-options": "supported",
+  "app-check#initialize-twice-unset-auto-refresh": "supported",
   "app-check#limited-use-token": "supported",
   "app-check#on-token-changed-existing-token": "supported",
   "app-check#on-token-changed-refresh": "qualified",
   "app-check#providers-construct": "supported",
   "app-check#recaptcha-providers-construct": "qualified",
+  "app-check#recaptcha-providers-without-document": "qualified",
   "app-check#set-auto-refresh": "supported",
+  "app-check-admin#create-token-fractional-ttl": "unsupported",
+  "app-check-admin#create-token-limited-use-jti": "unsupported",
+  "app-check-admin#create-token-limited-use-ttl": "unsupported",
+  "app-check-admin#create-token-option-type-checks": "unsupported",
+  "app-check-admin#create-token-options-object": "unsupported",
   "app-check-admin#create-token-shape": "supported",
+  "app-check-admin#create-token-sync-throw": "unsupported",
   "app-check-admin#create-token-ttl": "supported",
+  "app-check-admin#create-token-ttl-type-message": "unsupported",
   "app-check-admin#create-token-unknown-app": "qualified",
   "app-check-admin#project-from-cert": "qualified",
   "app-check-admin#verify-token": "supported",
   "app-check-admin#verify-token-consume": "supported",
+  "app-check-admin#verify-token-consume-key-order": "unsupported",
   "app-check-admin#verify-token-content-checks": "qualified",
   "app-check-admin#verify-token-firebase-token": "qualified",
   "app-check-admin#verify-token-firebase-token-consume": "qualified",
@@ -245,6 +267,7 @@ export const CONFORMANCE_VERDICTS = {
   "auth#62": "supported",
   "auth#68": "supported",
   "auth#68b": "supported",
+  "auth#68c": "unsupported",
   "auth#69": "supported",
   "auth#7": "qualified",
   "auth#70": "supported",
@@ -462,20 +485,20 @@ export const CONFORMANCE_VERDICTS = {
   "firestore#139": "supported",
   "firestore#139a": "supported",
   "firestore#14": "supported",
-  "firestore#140": "supported",
+  "firestore#140": "qualified",
   "firestore#141": "supported",
   "firestore#142": "supported",
-  "firestore#143": "supported",
+  "firestore#143": "qualified",
   "firestore#144": "supported",
   "firestore#145": "qualified",
   "firestore#146": "qualified",
   "firestore#147": "supported",
-  "firestore#148": "supported",
+  "firestore#148": "qualified",
   "firestore#149": "qualified",
   "firestore#15": "supported",
   "firestore#150": "supported",
   "firestore#151": "supported",
-  "firestore#152": "supported",
+  "firestore#152": "qualified",
   "firestore#153": "supported",
   "firestore#154": "supported",
   "firestore#155": "supported",
@@ -593,6 +616,21 @@ export const CONFORMANCE_VERDICTS = {
   "firestore#RS1": "qualified",
   "firestore#RS2": "qualified",
   "firestore#RS3": "qualified",
+  "firestore#aggregate-count-with-sum": "unsupported",
+  "firestore#aggregate-non-finite": "unsupported",
+  "firestore#composite-index-required": "qualified",
+  "firestore#delete-then-update-same-commit": "supported",
+  "firestore#docchanges-metadata-ack": "unsupported",
+  "firestore#listener-local-write-pending": "unsupported",
+  "firestore#negative-zero-equality": "supported",
+  "firestore#offline-denied-write": "unsupported",
+  "firestore#query-disjunction-limits": "unsupported",
+  "firestore#served-non-finite-numbers": "unsupported",
+  "firestore#served-query-doc-pending-writes": "unsupported",
+  "firestore#servertimestamp-pending-value": "unsupported",
+  "firestore#transaction-error-codes": "unsupported",
+  "firestore#transaction-read-after-write": "unsupported",
+  "firestore#write-server-limits": "unsupported",
   "firestore-flutter#1": "supported",
   "firestore-flutter#10": "qualified",
   "firestore-flutter#11": "supported",
@@ -758,6 +796,12 @@ export const CONFORMANCE_VERDICTS = {
   "firestore-rules#192": "supported",
   "firestore-rules#196": "supported",
   "firestore-rules#197": "supported",
+  "firestore-rules#198": "unsupported",
+  "firestore-rules#199": "unsupported",
+  "firestore-rules#200": "supported",
+  "firestore-rules#201": "supported",
+  "firestore-rules#202": "supported",
+  "firestore-rules#203": "supported",
   "firestore-swift#1": "supported",
   "firestore-swift#10": "supported",
   "firestore-swift#100": "supported",
@@ -881,13 +925,13 @@ export const CONFORMANCE_VERDICTS = {
   "firestore.binding.resource.id": "supported",
   "firestore.function.cast.bool": "supported",
   "firestore.function.cast.float": "supported",
-  "firestore.function.cast.int": "supported",
+  "firestore.function.cast.int": "unsupported",
   "firestore.function.cast.path": "supported",
-  "firestore.function.cast.string": "supported",
-  "firestore.function.debug": "qualified",
+  "firestore.function.cast.string": "unsupported",
+  "firestore.function.debug": "supported",
   "firestore.function.duration.abs": "supported",
   "firestore.function.duration.time": "supported",
-  "firestore.function.duration.value": "supported",
+  "firestore.function.duration.value": "unsupported",
   "firestore.function.exists": "supported",
   "firestore.function.existsAfter": "supported",
   "firestore.function.get": "supported",
@@ -926,8 +970,8 @@ export const CONFORMANCE_VERDICTS = {
   "firestore.method.map.diff": "supported",
   "firestore.method.map.get": "supported",
   "firestore.method.map.hasAll": "supported",
-  "firestore.method.map.hasAny": "qualified",
-  "firestore.method.map.hasOnly": "qualified",
+  "firestore.method.map.hasAny": "supported",
+  "firestore.method.map.hasOnly": "supported",
   "firestore.method.map.keys": "supported",
   "firestore.method.map.size": "supported",
   "firestore.method.map.values": "supported",
@@ -945,10 +989,10 @@ export const CONFORMANCE_VERDICTS = {
   "firestore.method.set.size": "supported",
   "firestore.method.set.union": "supported",
   "firestore.method.string.lower": "supported",
-  "firestore.method.string.matches": "supported",
+  "firestore.method.string.matches": "unsupported",
   "firestore.method.string.replace": "supported",
   "firestore.method.string.size": "supported",
-  "firestore.method.string.split": "supported",
+  "firestore.method.string.split": "unsupported",
   "firestore.method.string.toUtf8": "supported",
   "firestore.method.string.trim": "supported",
   "firestore.method.string.upper": "supported",
@@ -964,9 +1008,9 @@ export const CONFORMANCE_VERDICTS = {
   "firestore.method.timestamp.time": "supported",
   "firestore.method.timestamp.toMillis": "supported",
   "firestore.method.timestamp.year": "supported",
-  "firestore.operator.add": "supported",
+  "firestore.operator.add": "unsupported",
   "firestore.operator.and": "supported",
-  "firestore.operator.div": "supported",
+  "firestore.operator.div": "unsupported",
   "firestore.operator.eq": "supported",
   "firestore.operator.gt": "supported",
   "firestore.operator.gte": "supported",
@@ -982,9 +1026,9 @@ export const CONFORMANCE_VERDICTS = {
   "firestore.operator.not": "supported",
   "firestore.operator.or": "supported",
   "firestore.operator.slice": "supported",
-  "firestore.operator.sub": "supported",
+  "firestore.operator.sub": "unsupported",
   "firestore.operator.ternary": "supported",
-  "firestore.operator.unary-minus": "supported",
+  "firestore.operator.unary-minus": "unsupported",
   "firestore.rule-kind.allow-create": "supported",
   "firestore.rule-kind.allow-delete": "supported",
   "firestore.rule-kind.allow-get": "supported",
@@ -1278,7 +1322,7 @@ export const CONFORMANCE_VERDICTS = {
   "rtdb-modular#171": "qualified",
   "rtdb-modular#172": "qualified",
   "rtdb-modular#173": "qualified",
-  "rtdb-modular#174": "qualified",
+  "rtdb-modular#174": "supported",
   "rtdb-modular#183": "supported",
   "rtdb-modular#94": "supported",
   "rtdb-modular#95": "supported",
@@ -1297,6 +1341,7 @@ export const CONFORMANCE_VERDICTS = {
   "rtdb-modular#M14": "supported",
   "rtdb-modular#M15": "supported",
   "rtdb-modular#M16": "supported",
+  "rtdb-modular#M16b": "supported",
   "rtdb-modular#M17": "supported",
   "rtdb-modular#M18": "supported",
   "rtdb-modular#M19": "supported",
@@ -1406,10 +1451,20 @@ export const CONFORMANCE_VERDICTS = {
   "rtdb-modular#RS1": "qualified",
   "rtdb-modular#RS2": "qualified",
   "rtdb-modular#RS3": "qualified",
+  "rtdb-modular#SW1": "supported",
   "rtdb-modular#VR1": "supported",
   "rtdb-modular#VR2": "supported",
   "rtdb-modular#VR3": "supported",
   "rtdb-modular#VR4": "supported",
+  "rtdb-modular#grandchild-priority-query-value": "unsupported",
+  "rtdb-modular#priority-change-child-changed": "unsupported",
+  "rtdb-modular#priority-change-child-moved": "unsupported",
+  "rtdb-modular#priority-window-limit-to-last": "supported",
+  "rtdb-modular#remote-update-event-order": "unsupported",
+  "rtdb-modular#served-event-order": "unsupported",
+  "rtdb-modular#served-transaction-then-set": "unsupported",
+  "rtdb-modular#transaction-then-set-cold": "unsupported",
+  "rtdb-modular#val-key-order": "supported",
   "rtdb-rules#1": "supported",
   "rtdb-rules#10": "supported",
   "rtdb-rules#11": "supported",
@@ -1745,14 +1800,30 @@ export const CONFORMANCE_VERDICTS = {
   "storage-rules#132": "supported",
   "storage-rules#133": "supported",
   "storage-rules#134": "supported",
+  "storage-rules#204": "unsupported",
+  "storage-rules#205": "unsupported",
+  "storage-rules#206": "supported",
+  "storage-rules#207": "unsupported",
+  "storage-rules#208": "unsupported",
+  "storage-rules#209": "supported",
+  "storage-rules#210": "unsupported",
+  "storage-rules#211": "unsupported",
+  "storage-rules#212": "supported",
+  "storage-rules#213": "supported",
+  "storage-rules#214": "unsupported",
+  "storage-rules#215": "supported",
+  "storage-rules#216": "supported",
+  "storage-rules#217": "unsupported",
+  "storage-rules#218": "supported",
+  "storage-rules#219": "unsupported",
   "storage-rules#94": "supported",
   "storage-rules#95": "supported",
   "storage-rules#96": "supported",
   "storage-rules#97": "supported",
   "storage-rules#98": "supported",
   "storage-rules#99": "supported",
-  "storage-rules#storage.semantic.strict-boolean-allow-boundary": "qualified",
-  "storage-rules#storage.semantic.strict-boolean-ternary-condition": "qualified",
+  "storage-rules#storage.semantic.strict-boolean-allow-boundary": "supported",
+  "storage-rules#storage.semantic.strict-boolean-ternary-condition": "supported",
   "storage-rules#storage.stdlib.bytes-hashing": "supported",
   "storage-rules#storage.stdlib.map-diff": "supported",
   "storage-rules#storage.stdlib.sets": "supported",
@@ -1761,7 +1832,7 @@ export const CONFORMANCE_VERDICTS = {
   "storage.binding.path-variable": "supported",
   "storage.binding.request": "supported",
   "storage.binding.request.auth": "supported",
-  "storage.binding.request.auth.token": "supported",
+  "storage.binding.request.auth.token": "unsupported",
   "storage.binding.request.auth.uid": "supported",
   "storage.binding.request.method": "supported",
   "storage.binding.request.path": "supported",
@@ -1773,15 +1844,15 @@ export const CONFORMANCE_VERDICTS = {
   "storage.binding.request.time": "supported",
   "storage.binding.resource": "supported",
   "storage.binding.resource.bucket": "supported",
-  "storage.binding.resource.cacheControl": "qualified",
-  "storage.binding.resource.contentDisposition": "qualified",
-  "storage.binding.resource.contentEncoding": "qualified",
-  "storage.binding.resource.contentLanguage": "qualified",
+  "storage.binding.resource.cacheControl": "unsupported",
+  "storage.binding.resource.contentDisposition": "unsupported",
+  "storage.binding.resource.contentEncoding": "unsupported",
+  "storage.binding.resource.contentLanguage": "unsupported",
   "storage.binding.resource.contentType": "supported",
-  "storage.binding.resource.crc32c": "qualified",
-  "storage.binding.resource.etag": "qualified",
+  "storage.binding.resource.crc32c": "unsupported",
+  "storage.binding.resource.etag": "unsupported",
   "storage.binding.resource.generation": "supported",
-  "storage.binding.resource.md5Hash": "qualified",
+  "storage.binding.resource.md5Hash": "unsupported",
   "storage.binding.resource.metadata": "supported",
   "storage.binding.resource.metageneration": "supported",
   "storage.binding.resource.name": "supported",
@@ -1790,9 +1861,9 @@ export const CONFORMANCE_VERDICTS = {
   "storage.binding.resource.updated": "supported",
   "storage.function.cast.bool": "unsupported",
   "storage.function.cast.float": "supported",
-  "storage.function.cast.int": "supported",
+  "storage.function.cast.int": "unsupported",
   "storage.function.cast.path": "supported",
-  "storage.function.cast.string": "supported",
+  "storage.function.cast.string": "unsupported",
   "storage.function.duration.abs": "supported",
   "storage.function.duration.time": "supported",
   "storage.function.duration.value": "supported",
@@ -1844,9 +1915,9 @@ export const CONFORMANCE_VERDICTS = {
   "storage.method.set.union": "supported",
   "storage.method.size": "supported",
   "storage.method.string.lower": "supported",
-  "storage.method.string.matches": "supported",
+  "storage.method.string.matches": "unsupported",
   "storage.method.string.replace": "supported",
-  "storage.method.string.split": "supported",
+  "storage.method.string.split": "unsupported",
   "storage.method.string.toUtf8": "supported",
   "storage.method.string.trim": "supported",
   "storage.method.string.upper": "supported",
@@ -1862,15 +1933,15 @@ export const CONFORMANCE_VERDICTS = {
   "storage.method.timestamp.time": "supported",
   "storage.method.timestamp.toMillis": "supported",
   "storage.method.timestamp.year": "supported",
-  "storage.operator.add": "supported",
-  "storage.operator.and": "supported",
-  "storage.operator.div": "supported",
+  "storage.operator.add": "unsupported",
+  "storage.operator.and": "unsupported",
+  "storage.operator.div": "unsupported",
   "storage.operator.eq": "supported",
   "storage.operator.gt": "supported",
   "storage.operator.gte": "supported",
-  "storage.operator.in": "supported",
+  "storage.operator.in": "unsupported",
   "storage.operator.index": "supported",
-  "storage.operator.is": "supported",
+  "storage.operator.is": "unsupported",
   "storage.operator.lt": "supported",
   "storage.operator.lte": "supported",
   "storage.operator.member": "supported",
@@ -1878,11 +1949,11 @@ export const CONFORMANCE_VERDICTS = {
   "storage.operator.mul": "supported",
   "storage.operator.neq": "supported",
   "storage.operator.not": "supported",
-  "storage.operator.or": "supported",
+  "storage.operator.or": "unsupported",
   "storage.operator.slice": "supported",
-  "storage.operator.sub": "supported",
+  "storage.operator.sub": "unsupported",
   "storage.operator.ternary": "supported",
-  "storage.operator.unary-minus": "supported",
+  "storage.operator.unary-minus": "unsupported",
   "storage.rule-kind.allow-create": "supported",
   "storage.rule-kind.allow-delete": "supported",
   "storage.rule-kind.allow-get": "supported",
@@ -1892,7 +1963,7 @@ export const CONFORMANCE_VERDICTS = {
   "storage.rule-kind.allow-write": "supported",
   "storage.rule-kind.function": "supported",
   "storage.rule-kind.let": "supported",
-  "storage.rule-kind.match": "supported",
+  "storage.rule-kind.match": "unsupported",
   "storage.rule-kind.rules_version": "supported",
   "storage.semantic.deny-by-default": "supported",
   "storage.semantic.read-umbrella": "supported",

package/src/assurance/capabilities.ts

@@ -2,8 +2,10 @@
 // (this runtime ships to the browser, so the Node-only `internal/rtdb` entry is
 // not reachable from here):
 //
-//   rulesSourceRejection — production's load check, the one every CLI load
-//   path runs: the source parses and is within the compile limits.
+//   rulesSourceRejection — production's Firestore load check, the one every
+//   CLI load path runs: the source parses, its service is cloud.firestore,
+//   and it is within the compile limits. rulesGrammarRejection is its parse
+//   and compile-limit half, for Storage, which checks its own service.
 //
 //   parseToASTOrError / MatchBlock / PathSegment — the public API exposes
 //   lint/simulate but no parsed AST, and the overlapping-match analysis below
@@ -16,6 +18,7 @@
 import {
   parseToASTOrError,
   parseRtdbExpression,
+  rulesGrammarRejection,
   rulesSourceRejection,
   type MatchBlock,
   type PathSegment,
@@ -119,21 +122,14 @@ export function rulesLoadRefusal(
       ? target.rules.firestore
       : target.rules.storage;
   if (typeof source !== "string" || source.trim().length === 0) return undefined;
-  const rejection = rulesSourceRejection(source);
-  if (rejection !== null) {
-    return `${service === "firestore" ? "Firestore" : "Storage"} ${rejection.message}`;
-  }
   if (service === "firestore") {
-    const parsed = parseToASTOrError(source);
-    if (
-      parsed.ok &&
-      parsed.ast.service?.name &&
-      parsed.ast.service.name !== "cloud.firestore"
-    ) {
-      return `Firestore rules did not compile: Expected 'service cloud.firestore', got 'service ${parsed.ast.service.name}'.`;
-    }
-    return undefined;
+    const rejection = rulesSourceRejection(source);
+    return rejection === null ? undefined : `Firestore ${rejection.message}`;
   }
+  // Storage checks its own service in `compileStorageRules`; the shared
+  // check here is the parse and compile-limit half only.
+  const rejection = rulesGrammarRejection(source);
+  if (rejection !== null) return `Storage ${rejection.message}`;
   try {
     compileStorageRules(source);
     return undefined;

package/src/bounded-request.ts

@@ -10,11 +10,13 @@
  * socket in any state. `req.setTimeout()` is no substitute: it does not arm
  * until the `connect` event.
  *
- * Discovery's health probes and the register beacon both go through
- * {@link boundedRequest}. The http modules load on first use, so a runtime
+ * Discovery's health probes and the register beacon go through
+ * {@link boundedRequest}; the CLI's other local probes (snapshot, serve
+ * diagnostics, the sandbox peer wait, the collision probe) go through its
+ * fetch-shaped {@link boundedFetch} (#1167). The http modules load on first use, so a runtime
  * without them loses the request only, never the importing module.
  */
-import type { IncomingMessage, OutgoingHttpHeaders, request as httpRequestFn } from 'node:http';
+import type { IncomingHttpHeaders, IncomingMessage, OutgoingHttpHeaders, request as httpRequestFn } from 'node:http';
 import { createRequire } from 'node:module';
 
 /** The most response body a bounded request reads. Past it, the request gives up. */
@@ -33,10 +35,15 @@ export interface BoundedRequestOptions {
    * deadline still ends it.
    */
   readonly unref?: boolean;
+  /** The most response body to read. Past it, the request gives up. Defaults to {@link MAX_RESPONSE_BYTES}. */
+  readonly maxBytes?: number;
+  /** Ends the request early, as the deadline would. */
+  readonly signal?: AbortSignal;
 }
 
 export interface BoundedResponse {
   readonly status: number;
+  readonly headers: IncomingHttpHeaders;
   readonly body: Buffer;
 }
 
@@ -73,13 +80,18 @@ function readBody(res: IncomingMessage, maxBytes: number): Promise<Buffer | null
 /**
  * Send one request to `url` and read its response, all within
  * `options.deadlineMs` of the call. `null` for a refused or dropped connect,
- * an error, a body past {@link MAX_RESPONSE_BYTES}, a url the http module
- * rejects, or the deadline passing. Never rejects. Redirects are not followed:
+ * an error, a body past `options.maxBytes`, a url the http module rejects, an
+ * aborted `options.signal`, or the deadline passing. Never rejects. Redirects are not followed:
  * a 3xx is returned as its own status. No agent is used, and the socket is
  * destroyed when the result settles, so nothing outlives the call.
  */
 export function boundedRequest(url: string, options: BoundedRequestOptions): Promise<BoundedResponse | null> {
   return new Promise((resolve) => {
+    const signal = options.signal;
+    if (signal?.aborted) {
+      resolve(null);
+      return;
+    }
     let req: ReturnType<RequestFn>;
     try {
       // No agent: a pooled keep-alive socket would outlive the call.
@@ -93,10 +105,13 @@ export function boundedRequest(url: string, options: BoundedRequestOptions): Pro
       if (settled) return;
       settled = true;
       clearTimeout(deadline);
+      signal?.removeEventListener('abort', onAbort);
       req.destroy();
       resolve(result);
     };
     const deadline = setTimeout(() => finish(null), options.deadlineMs);
+    const onAbort = (): void => finish(null);
+    signal?.addEventListener('abort', onAbort, { once: true });
     if (options.unref) {
       deadline.unref();
       req.on('socket', (socket) => socket.unref());
@@ -104,9 +119,9 @@ export function boundedRequest(url: string, options: BoundedRequestOptions): Pro
     req.on('error', () => finish(null));
     req.on('response', (res: IncomingMessage) => {
       res.on('error', () => finish(null));
-      void readBody(res, MAX_RESPONSE_BYTES).then((body) => {
+      void readBody(res, options.maxBytes ?? MAX_RESPONSE_BYTES).then((body) => {
         const hasBody = body !== null;
-        finish(hasBody ? { status: res.statusCode ?? 0, body } : null);
+        finish(hasBody ? { status: res.statusCode ?? 0, headers: res.headers, body } : null);
       });
     });
     req.end(options.body);
@@ -133,3 +148,47 @@ export async function getJsonWithin(url: string, deadlineMs: number): Promise<Js
     return null;
   }
 }
+
+/** Options for {@link boundedFetch}: a bounded request plus fetch's redirect mode. */
+export interface BoundedFetchOptions extends BoundedRequestOptions {
+  /**
+   * Redirects are never followed. `'error'` rejects on a 3xx, as fetch does;
+   * `'manual'`, the default, returns it.
+   */
+  readonly redirect?: 'error' | 'manual';
+}
+
+/** Statuses whose `Response` must have a null body. */
+const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
+
+function headersOf(incoming: IncomingHttpHeaders): Headers {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(incoming)) {
+    const values = Array.isArray(value) ? value : [value];
+    for (const one of values) {
+      const isPresent = one !== undefined;
+      if (isPresent) headers.append(name, one);
+    }
+  }
+  return headers;
+}
+
+/**
+ * {@link boundedRequest} in fetch's shape, for code written against `fetch`
+ * and its injectable `fetchImpl` seams. Resolves a `Response` whose body is
+ * already read, and rejects with a `TypeError` where `boundedRequest` gives
+ * `null`, as `fetch` rejects on a network error or an abort.
+ */
+export async function boundedFetch(input: string | URL, options: BoundedFetchOptions): Promise<Response> {
+  const url = String(input);
+  const response = await boundedRequest(url, options);
+  if (response === null) throw new TypeError(`fetch failed: ${url}`);
+  const { status } = response;
+  const isRedirect = status >= 300 && status < 400;
+  const refusesRedirect = isRedirect && options.redirect === 'error';
+  if (refusesRedirect) throw new TypeError(`fetch failed: ${url} redirected`);
+  const isConstructible = status >= 200 && status <= 599;
+  if (!isConstructible) throw new TypeError(`fetch failed: ${url} answered ${status}`);
+  const body = NULL_BODY_STATUSES.has(status) ? null : new Uint8Array(response.body);
+  return new Response(body, { status, headers: headersOf(response.headers) });
+}

package/src/bridge/client/bridge-url.ts

@@ -1,6 +1,10 @@
 import { DEFAULT_BRIDGE_PORT, DEFAULT_SANDBOX_PATH } from '../protocol.js';
 
-/** Explicit URL, Vite injection, then the sidecar on the page's hostname. */
+/**
+ * Explicit URL, then `window.__PYRIC_BRIDGE_URL__` when the page sets it (no
+ * pyric integration does), then the standalone `pyric bridge` port on the
+ * page's hostname, which refuses a browser page with a reason (#1468).
+ */
 export function resolveBridgeUrl(explicit?: string): string {
   const hasExplicitUrl = explicit !== undefined && explicit.length > 0;
   if (hasExplicitUrl) return explicit;

package/src/bridge/client/bridge.ts

@@ -7,8 +7,13 @@
  *
  * Discovery order for the bridge URL:
  *   1. Explicit `opts.url`.
- *   2. `window.__PYRIC_BRIDGE_URL__` (set by the Vite plugin).
- *   3. `ws://${location.hostname}:5174/sandbox` (sidecar default).
+ *   2. `window.__PYRIC_BRIDGE_URL__`, when the page sets it. No pyric
+ *      integration sets it: the Vite plugin, `withPyric` and the served entry
+ *      mount their own bridge and hand its URL to their own runtime.
+ *   3. `ws://${location.hostname}:5174/sandbox`, the standalone `pyric bridge`
+ *      port. That bridge has no browser socket (#1468): it closes the page
+ *      with NO_BROWSER_PEER_CLOSE_CODE, and this client stops there with a
+ *      reason that names `pyric sandbox --bridge`.
  *
  * Reconnect strategy: simple exponential backoff up to 30s. The
  * connection is best-effort — if the bridge is down the host app
@@ -42,6 +47,7 @@ import {
   isBridgeMessage,
   MAX_BRIDGE_FRAME_BYTES,
   assertJsonSafeRelayValue,
+  NO_BROWSER_PEER_CLOSE_CODE,
   PEER_REPLACED_CLOSE_CODE,
   WORKER_RELAY_CAPABILITY,
 } from '../protocol.js';
@@ -58,7 +64,8 @@ const utf8 = new TextEncoder();
 export interface ConnectBridgeOptions {
   /**
    * Bridge WebSocket URL. Overrides the discovery chain.
-   * Example: `ws://localhost:5174/sandbox`.
+   * Example: `ws://localhost:3473/__pyric/sandbox`, the socket
+   * `pyric sandbox --bridge` serves.
    */
   url?: string;
   /**
@@ -367,6 +374,15 @@ export function connectBridge(
       // and re-issues it after the next hello, so live worker listeners from
       // THIS connection must go now (or the next connection double-delivers).
       teardownRelaySubs();
+      const hasNoBrowserSocket = event.code === NO_BROWSER_PEER_CLOSE_CODE;
+      if (hasNoBrowserSocket) {
+        // The standalone `pyric bridge` takes no browser peer. Reconnecting
+        // can never succeed, so stop and say what to run instead.
+        closed = true;
+        console.error(`[pyric] ${reason}`);
+        setState({ kind: 'disconnected', reason });
+        return;
+      }
       const isReplacedByPeer = event.code === PEER_REPLACED_CLOSE_CODE;
       if (isReplacedByPeer) {
         // Another tab won the peer slot. Re-helloing now would kick it right