@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/dist/register/swap-or-stop.js

@@ -0,0 +1,170 @@
+/**
+ * Swap or stop (ADR 0022): under the register, `firebase` and `firebase-admin`
+ * imports resolve to the sandbox. When a resolve lands in the real SDK anyway,
+ * through an absolute path, an npm alias, a link under another name, or a
+ * direct `@firebase/*` import, the import stops before the file loads. The
+ * real SDK never runs, so it never reaches production with this machine's
+ * credentials.
+ *
+ * The package is named by the resolved file's own `package.json`
+ * (`package-identity.ts`), never by its folder. Only files under a
+ * `node_modules` directory are checked: every installed SDK lives under one,
+ * including the pnpm and bun stores, and the check stays off the resolve path
+ * for everything else.
+ *
+ * The real SDK is allowed only where the swap table chooses it
+ * (`choosesRealFirebase` in `mapping.ts`), or when an SDK file this hook
+ * already allowed imports what its entry needs: a firebase-admin file
+ * reaches only the verifier bridge pair's files, and a client SDK file only
+ * the `@firebase/*` packages the production AI entries import. The importer's
+ * URL alone is no proof, since `createRequire` can name any file, so each
+ * hook keeps the URLs it allowed. In sandbox AI mode that set stays empty.
+ * `firebase-admin` is never chosen, with one exception: the App Check verifier
+ * bridge that production AI mode loads on pyric's behalf (#1552), whose
+ * firebase-admin app holds no credentials. An app's own import of the real
+ * package still stops. `PYRIC_GUARD` does not change any of this: the stop
+ * belongs to the swap, not to the network guard.
+ *
+ * Loaded by both resolve hooks, including the loader-thread one, so it imports
+ * node built-ins and side-effect-free modules only.
+ */
+import { fileURLToPath } from 'node:url';
+import { packageNameOf, pathInPackageOf } from './package-identity.js';
+import { choosesRealFirebase } from './mapping.js';
+import { SDK_MODULES, isAdminBridgeFile, isBypassedBridgeImport, isProductionAiSdkPackage, resolveAiMode, } from '../serve/firebase-module-swap.js';
+/** The code on the error a stopped import throws. */
+export const REAL_SDK_STOPPED_CODE = 'PYRIC_REAL_SDK_STOPPED';
+const LOG_PREFIX = '@pyric/cli/register';
+const REPORT_URL = 'https://github.com/davideast/pyric/issues/new';
+/** `firebase-admin` is the admin SDK; `firebase` and every `@firebase/*` package are the client SDK. */
+function sdkFamilyOf(name) {
+    if (name === 'firebase-admin')
+        return 'admin';
+    const isClientPackage = name === 'firebase' || (name?.startsWith('@firebase/') ?? false);
+    return isClientPackage ? 'client' : null;
+}
+function isInstalledFile(url) {
+    return url.startsWith('file:') && url.includes('/node_modules/');
+}
+/**
+ * Whether this load is an SDK file the hook already allowed, importing what
+ * that SDK entry needs: a firebase-admin file reaches only the files of the
+ * verifier bridge's `firebase-admin/app` and `firebase-admin/app-check`, and a
+ * client SDK file only the `@firebase/*` packages that `firebase/ai`,
+ * `firebase/app` and `firebase/app-check` import. So a `createRequire` forge
+ * from an allowed file gets no further than the entry it came from.
+ */
+function isFromAllowedSdkFile(load, packageName, allowedUrls) {
+    const importer = load.importer;
+    const isAllowedImporter = importer !== undefined && allowedUrls.has(importer);
+    if (!isAllowedImporter)
+        return false;
+    const importerFamily = sdkFamilyOf((load.nameOf ?? packageNameOf)(importer));
+    if (importerFamily === 'client')
+        return isProductionAiSdkPackage(packageName);
+    const isAdminTarget = importerFamily === 'admin' && packageName === 'firebase-admin';
+    if (!isAdminTarget)
+        return false;
+    const pathOf = load.pathInPackage ?? pathInPackageOf;
+    return isAdminBridgeFile(pathOf(load.url, packageName));
+}
+/** Whether this load may reach the real SDK. */
+function isAllowedRealLoad(load, packageName, family, allowedUrls) {
+    if (isFromAllowedSdkFile(load, packageName, allowedUrls))
+        return true;
+    const specifier = load.canonical ?? load.specifier;
+    const aiMode = load.aiMode ?? resolveAiMode(undefined, process.env);
+    if (family === 'admin')
+        return isBypassedBridgeImport(specifier, load.importer, aiMode);
+    const pathOf = load.pathInPackage ?? pathInPackageOf;
+    return choosesRealFirebase({
+        specifier,
+        importer: load.importer,
+        packageName,
+        pathInPackage: () => pathOf(load.url, packageName),
+        aiMode,
+    });
+}
+/** The served `firebase/*` import that stands for a `@firebase/*` package, when pyric serves one. */
+function servedImportFor(packageName) {
+    const candidate = `firebase/${packageName.slice('@firebase/'.length)}`;
+    const isServed = SDK_MODULES.includes(candidate);
+    return isServed ? candidate : null;
+}
+/** The import an app writes in place of the one that stopped. */
+function fixFor(family, packageName) {
+    if (family === 'admin') {
+        return "import firebase-admin by its package name (for example 'firebase-admin/app'), so the register routes it to the sandbox";
+    }
+    if (packageName === 'firebase') {
+        return "import firebase by its package name (for example 'firebase/firestore'), so the register routes it to the sandbox";
+    }
+    const served = servedImportFor(packageName);
+    if (served === null) {
+        return `pyric serves no firebase/* import for '${packageName}', so import a served one (for example 'firebase/firestore'), or move this code out of the sandboxed process`;
+    }
+    return `import '${served}' instead of '${packageName}', so the register routes it to the sandbox`;
+}
+function stopMessage(load, family, packageName) {
+    const consequence = family === 'admin'
+        ? "so it would have run with this machine's Google credentials"
+        : "so it would have reached production with the app's API key";
+    return [
+        `${LOG_PREFIX}: stopped loading the real ${packageName}`,
+        `  import '${load.specifier}'`,
+        `  from   ${load.importer ?? 'the entry point'}`,
+        `  found  ${load.url}`,
+        `Under pyric, ${packageName} resolves to the sandbox. This import didn't, ${consequence}.`,
+        `Fix: ${fixFor(family, packageName)}. To run the real SDK, start this process without @pyric/cli/register.`,
+        `If pyric should have routed this import, report it: ${REPORT_URL}`,
+        `code: ${REAL_SDK_STOPPED_CODE}`,
+    ].join('\n');
+}
+/**
+ * Whether this load is Node 22 resolving again a CommonJS file this hook
+ * already allowed. Node 22 resolves a CommonJS file imported from ESM a second
+ * time, by its own path and with no importer; Node 24 does not. That second
+ * pass loads nothing new, so it goes ahead. An app's import of the same file
+ * names its importer, so it still stops.
+ */
+function isCjsReloadOfAllowedFile(load, allowedUrls) {
+    const hasNoImporter = load.importer === undefined;
+    const wasAllowed = allowedUrls.has(load.url);
+    if (!hasNoImporter || !wasAllowed)
+        return false;
+    return load.specifier === fileURLToPath(load.url);
+}
+/**
+ * The error that stops this load, or `null` when the load may go ahead: it is
+ * not the real SDK, or the swap table chose the real SDK here. `allowedUrls`
+ * is the calling hook's record of the real SDK files it allowed; an allowed
+ * load joins it.
+ */
+export function stopFor(load, allowedUrls) {
+    if (!isInstalledFile(load.url))
+        return null;
+    const packageName = (load.nameOf ?? packageNameOf)(load.url);
+    const family = sdkFamilyOf(packageName);
+    if (family === null || packageName === null)
+        return null;
+    if (isCjsReloadOfAllowedFile(load, allowedUrls))
+        return null;
+    if (isAllowedRealLoad(load, packageName, family, allowedUrls)) {
+        allowedUrls.add(load.url);
+        return null;
+    }
+    const error = new Error(stopMessage(load, family, packageName));
+    return Object.assign(error, { code: REAL_SDK_STOPPED_CODE, url: load.url, specifier: load.specifier });
+}
+/** Writes each stop to stderr once per file, so a caught import still shows in the log. */
+export function createStopReporter(write) {
+    const reported = new Set();
+    return (error) => {
+        const url = error.url ?? error.message;
+        if (reported.has(url))
+            return;
+        reported.add(url);
+        write(`${error.message}\n`);
+    };
+}
+//# sourceMappingURL=swap-or-stop.js.map

package/dist/register/swap-or-stop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"swap-or-stop.js","sourceRoot":"","sources":["../../src/register/swap-or-stop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,aAAa,GAEd,MAAM,kCAAkC,CAAC;AAE1C,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,UAAU,GAAG,+CAA+C,CAAC;AAmBnE,wGAAwG;AACxG,SAAS,WAAW,CAAC,IAAmB;IACtC,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,eAAe,GAAG,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,CAAC;IACzF,OAAO,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAkB,EAAE,WAAmB,EAAE,WAAgC;IACrG,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,iBAAiB,GAAG,QAAQ,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,IAAI,cAAc,KAAK,QAAQ;QAAE,OAAO,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,cAAc,KAAK,OAAO,IAAI,WAAW,KAAK,gBAAgB,CAAC;IACrF,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;IACrD,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,gDAAgD;AAChD,SAAS,iBAAiB,CAAC,IAAkB,EAAE,WAAmB,EAAE,MAAiB,EAAE,WAAgC;IACrH,IAAI,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;IACrD,OAAO,mBAAmB,CAAC;QACzB,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW;QACX,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;QAClD,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,SAAS,GAAG,YAAY,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAI,WAAiC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,iEAAiE;AACjE,SAAS,MAAM,CAAC,MAAiB,EAAE,WAAmB;IACpD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,wHAAwH,CAAC;IAClI,CAAC;IACD,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,kHAAkH,CAAC;IAC5H,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,0CAA0C,WAAW,8GAA8G,CAAC;IAC7K,CAAC;IACD,OAAO,WAAW,MAAM,iBAAiB,WAAW,6CAA6C,CAAC;AACpG,CAAC;AAED,SAAS,WAAW,CAAC,IAAkB,EAAE,MAAiB,EAAE,WAAmB;IAC7E,MAAM,WAAW,GAAG,MAAM,KAAK,OAAO;QACpC,CAAC,CAAC,6DAA6D;QAC/D,CAAC,CAAC,4DAA4D,CAAC;IACjE,OAAO;QACL,GAAG,UAAU,8BAA8B,WAAW,EAAE;QACxD,aAAa,IAAI,CAAC,SAAS,GAAG;QAC9B,YAAY,IAAI,CAAC,QAAQ,IAAI,iBAAiB,EAAE;QAChD,YAAY,IAAI,CAAC,GAAG,EAAE;QACtB,gBAAgB,WAAW,iDAAiD,WAAW,GAAG;QAC1F,QAAQ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,wEAAwE;QAC3G,uDAAuD,UAAU,EAAE;QACnE,SAAS,qBAAqB,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,IAAkB,EAAE,WAAgC;IACpF,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;IAClD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAkB,EAAE,WAAwB;IAClE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,wBAAwB,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9D,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;AACzG,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,KAA6B;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,GAAG,GAAI,KAA0B,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC;QAC7D,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC"}

package/dist/register/worker-guard.d.ts

@@ -0,0 +1,20 @@
+/** The `Worker` options this module reads. */
+interface WorkerOptionsLike {
+    eval?: unknown;
+    execArgv?: unknown;
+}
+/**
+ * The arguments to build the worker with, so that it loads the register at
+ * `registerUrl`. Returns new values and never changes the caller's.
+ */
+export declare function guardWorkerArguments(source: unknown, options: WorkerOptionsLike | undefined, registerUrl: string): [unknown, WorkerOptionsLike | undefined];
+/**
+ * Replace `workerThreads.Worker` with a subclass that builds every worker with
+ * {@link guardWorkerArguments}. A subclass keeps `instanceof Worker` true.
+ * `workerThreads` defaults to `node:worker_threads`; tests pass a stand-in.
+ */
+export declare function installWorkerGuard(registerUrl: string, workerThreads?: {
+    Worker: unknown;
+}): void;
+export {};
+//# sourceMappingURL=worker-guard.d.ts.map

package/dist/register/worker-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-guard.d.ts","sourceRoot":"","sources":["../../src/register/worker-guard.ts"],"names":[],"mappings":"AAsBA,8CAA8C;AAC9C,UAAU,iBAAiB;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAUD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,iBAAiB,GAAG,SAAS,EACtC,WAAW,EAAE,MAAM,GAClB,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,CAAC,CAU1C;AAeD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAejG"}

package/dist/register/worker-guard.js

@@ -0,0 +1,77 @@
+/**
+ * The register in worker threads.
+ *
+ * Built-in modules and resolve hooks are per thread, so the swap, the stop
+ * and the network guard have to be installed inside each worker as well. The
+ * register installs this wrapper whatever `PYRIC_GUARD` says. Node runs `--import` preloads (from the command
+ * line or `NODE_OPTIONS`) in a worker built from a file, a `data:` URL or ESM
+ * source, and the register then activates there as it does on the main
+ * thread. Two kinds of worker skip it:
+ *
+ *  - a worker built from CommonJS source with `eval: true`, which never runs
+ *    preloads;
+ *  - a worker given its own `execArgv`, when the register came from the
+ *    command line rather than `NODE_OPTIONS`.
+ *
+ * Wrapping `worker_threads.Worker` closes both. The worker still activates
+ * the register only under its own `PYRIC_SANDBOX`, exactly as the main thread
+ * does, so a worker the caller started outside the sandbox stays outside it.
+ */
+import Module, { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+/** Marks a `Worker` this module already wrapped. */
+const GUARDED_WORKER = Symbol.for('pyric.guardedWorker');
+/** A `'use strict'` directive, which must stay the first statement. */
+const USE_STRICT = /^(\s*(['"])use strict\2;?[ \t]*\n?)/;
+/**
+ * The arguments to build the worker with, so that it loads the register at
+ * `registerUrl`. Returns new values and never changes the caller's.
+ */
+export function guardWorkerArguments(source, options, registerUrl) {
+    let guardedSource = source;
+    let guardedOptions = options;
+    if (options?.eval === true && typeof source === 'string') {
+        guardedSource = withRegisterPrefix(source, registerUrl);
+    }
+    if (Array.isArray(options?.execArgv) && !options.execArgv.includes(registerUrl)) {
+        guardedOptions = { ...options, execArgv: [...options.execArgv, '--import', registerUrl] };
+    }
+    return [guardedSource, guardedOptions];
+}
+/**
+ * Eval source that first loads the register. `require` exists only when Node
+ * runs the source as CommonJS; ESM source already ran the preload, and the
+ * prefix does nothing there.
+ */
+function withRegisterPrefix(source, registerUrl) {
+    const prefix = `typeof require === 'function' && require(${JSON.stringify(fileURLToPath(registerUrl))});\n`;
+    const directive = USE_STRICT.exec(source)?.[1];
+    if (directive === undefined)
+        return `${prefix}${source}`;
+    const separator = directive.endsWith('\n') ? '' : '\n';
+    return `${directive}${separator}${prefix}${source.slice(directive.length)}`;
+}
+/**
+ * Replace `workerThreads.Worker` with a subclass that builds every worker with
+ * {@link guardWorkerArguments}. A subclass keeps `instanceof Worker` true.
+ * `workerThreads` defaults to `node:worker_threads`; tests pass a stand-in.
+ */
+export function installWorkerGuard(registerUrl, workerThreads) {
+    const target = workerThreads ?? createRequire(import.meta.url)('node:worker_threads');
+    const Original = target.Worker;
+    if (typeof Original !== 'function' || Original[GUARDED_WORKER] === true)
+        return;
+    class GuardedWorker extends Original {
+        static [GUARDED_WORKER] = true;
+        constructor(source, options) {
+            super(...guardWorkerArguments(source, options, registerUrl));
+        }
+    }
+    Object.defineProperty(GuardedWorker, 'name', { value: Original.name });
+    target.Worker = GuardedWorker;
+    // ESM `import { Worker } from 'node:worker_threads'` reads the export as
+    // synced, so publish the replacement there too.
+    if (workerThreads === undefined)
+        Module.syncBuiltinESMExports();
+}
+//# sourceMappingURL=worker-guard.js.map

package/dist/register/worker-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-guard.js","sourceRoot":"","sources":["../../src/register/worker-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAUzC,oDAAoD;AACpD,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AAEzD,uEAAuE;AACvE,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAEzD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAe,EACf,OAAsC,EACtC,WAAmB;IAEnB,IAAI,aAAa,GAAG,MAAM,CAAC;IAC3B,IAAI,cAAc,GAAG,OAAO,CAAC;IAC7B,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzD,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAChF,cAAc,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,WAAmB;IAC7D,MAAM,MAAM,GAAG,4CAA4C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAC5G,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,aAAmC;IACzF,MAAM,MAAM,GAAG,aAAa,IAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAyB,CAAC;IAC/G,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAuE,CAAC;IAChG,IAAI,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,IAAI;QAAE,OAAO;IAChF,MAAM,aAAc,SAAQ,QAAQ;QAClC,MAAM,CAAU,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;QACxC,YAAY,MAAe,EAAE,OAA2B;YACtD,KAAK,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/D,CAAC;;IAEH,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC;IAC9B,yEAAyE;IACzE,gDAAgD;IAChD,IAAI,aAAa,KAAK,SAAS;QAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;AAClE,CAAC"}

package/dist/remote/resolve-host.d.ts

@@ -6,6 +6,13 @@
  * Shared by the Node remote client (`connectRemoteSandbox`, which
  * `pyric-admin` uses) and the client SDK bootstrap that `@pyric/cli/register`
  * installs (#1082), so both pick the same host for the same process.
+ *
+ * Discovery reads the project's `.pyric/serve.json` and probes the port it
+ * names, without the port scan `discoverServe` falls back to: a host found
+ * only by the scan is never attached to (`selectProjectHost`), and on a
+ * machine where closed ports never answer the scan takes seconds. A process
+ * resolves again at each reconnect, so a scan there would spend the window
+ * its held calls wait in (#1219).
  */
 import { type AnsweringHost, type Discovered } from '../serve/discovery.js';
 export interface ResolveRemoteHostOptions {
@@ -28,5 +35,7 @@ export interface ResolvedRemoteHost {
     /** The loopback base the health probe reached; sockets dial it. */
     wsBase: string;
 }
+/** The project's host as its `.pyric/serve.json` names it; no port scan. */
+export declare function discoverProjectPointer(cwd: string): Promise<Discovered | null>;
 export declare function resolveRemoteHost(options: ResolveRemoteHostOptions): Promise<ResolvedRemoteHost>;
 //# sourceMappingURL=resolve-host.d.ts.map

package/dist/remote/resolve-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-host.d.ts","sourceRoot":"","sources":["../../src/remote/resolve-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvD,kEAAkE;IAClE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmDD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAWtG"}
+{"version":3,"file":"resolve-host.d.ts","sourceRoot":"","sources":["../../src/remote/resolve-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvD,kEAAkE;IAClE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE9E;AAkCD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAWtG"}

package/dist/remote/resolve-host.js

@@ -6,6 +6,13 @@
  * Shared by the Node remote client (`connectRemoteSandbox`, which
  * `pyric-admin` uses) and the client SDK bootstrap that `@pyric/cli/register`
  * installs (#1082), so both pick the same host for the same process.
+ *
+ * Discovery reads the project's `.pyric/serve.json` and probes the port it
+ * names, without the port scan `discoverServe` falls back to: a host found
+ * only by the scan is never attached to (`selectProjectHost`), and on a
+ * machine where closed ports never answer the scan takes seconds. A process
+ * resolves again at each reconnect, so a scan there would spend the window
+ * its held calls wait in (#1219).
  */
 import { discoverServe, selectExplicitHost, selectProjectHost, } from '../serve/discovery.js';
 function hostError(code, message) {
@@ -25,12 +32,16 @@ function warnOncePerUrl(url, message, warn) {
     else
         process.stderr.write(`${message}\n`);
 }
+/** The project's host as its `.pyric/serve.json` names it; no port scan. */
+export function discoverProjectPointer(cwd) {
+    return discoverServe(cwd, () => { }, []);
+}
 async function resolveConfiguredHost(configuredUrl, options) {
     const choice = await selectExplicitHost({
         url: configuredUrl,
         cwd: options.cwd,
         launcherInstanceId: options.instanceId,
-        discover: options.discover,
+        discover: options.discover ?? discoverProjectPointer,
         probe: options.probe,
     });
     if (choice.kind === 'stale')
@@ -45,7 +56,7 @@ async function resolveConfiguredHost(configuredUrl, options) {
 }
 async function discoverProjectHost(options) {
     const refused = [];
-    const found = selectProjectHost(await (options.discover ?? discoverServe)(options.cwd), (m) => refused.push(m));
+    const found = selectProjectHost(await (options.discover ?? discoverProjectPointer)(options.cwd), (m) => refused.push(m));
     const hasNoDiscovery = found === null;
     if (hasNoDiscovery) {
         throw hostError('not-found', 'no running `pyric sandbox --bridge` found (looked for .pyric/serve.json in ' +

package/dist/remote/resolve-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-host.js","sourceRoot":"","sources":["../../src/remote/resolve-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,uBAAuB,CAAC;AAwB/B,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA6B,CAAC;IAC7D,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE5C,SAAS,cAAc,CAAC,GAAW,EAAE,OAAe,EAAE,IAAgC;IACpF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACvC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,CAAC,CAAC;;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,aAAqB,EAAE,OAAiC;IAC3F,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,cAAc,CAAC,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAiC;IAClE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChH,MAAM,cAAc,GAAG,KAAK,KAAK,IAAI,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,CACb,WAAW,EACX,6EAA6E;YAC3E,GAAG,OAAO,CAAC,GAAG,8DAA8D;YAC5E,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC;IACjC,MAAM,cAAc,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,IAAI,gBAAgB;QAAE,OAAO,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"resolve-host.js","sourceRoot":"","sources":["../../src/remote/resolve-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,uBAAuB,CAAC;AAwB/B,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA6B,CAAC;IAC7D,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE5C,SAAS,cAAc,CAAC,GAAW,EAAE,OAAe,EAAE,IAAgC;IACpF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACvC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,CAAC,CAAC;;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,aAAqB,EAAE,OAAiC;IAC3F,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,sBAAsB;QACpD,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,cAAc,CAAC,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAiC;IAClE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzH,MAAM,cAAc,GAAG,KAAK,KAAK,IAAI,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,CACb,WAAW,EACX,6EAA6E;YAC3E,GAAG,OAAO,CAAC,GAAG,8DAA8D;YAC5E,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC;IACjC,MAAM,cAAc,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,IAAI,gBAAgB;QAAE,OAAO,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}

package/dist/serve/ai-proxy.d.ts

@@ -38,6 +38,8 @@ type AiProxyFailure = {
     status: number;
     /** The upstream's raw `Retry-After` header, when it sent one. */
     retryAfter?: string;
+    /** The credentials the request carried, masked from `retryAfter`. */
+    credentials?: readonly string[];
 } | {
     kind: 'stream-abort';
     target: string;

package/dist/serve/ai-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-proxy.d.ts","sourceRoot":"","sources":["../../src/serve/ai-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAIxD;;mDAEmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChD;AAED,mEAAmE;AACnE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,qEAAqE;AACrE,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD;4DAC4D;AAC5D,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AA0BlE,sEAAsE;AACtE,KAAK,cAAc,GACf;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzE;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAwD/E;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAa,GAAG,MAAM,CA2BzF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAA;CAAE,CAY1D;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAKjF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC7C,GAAG,IAAI,CASP;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAClC,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,SAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CASzC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,aAAa,CACjC,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB5F"}
+{"version":3,"file":"ai-proxy.d.ts","sourceRoot":"","sources":["../../src/serve/ai-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAIxD;;mDAEmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChD;AAED,mEAAmE;AACnE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,qEAAqE;AACrE,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD;4DAC4D;AAC5D,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AA0BlE,sEAAsE;AACtE,KAAK,cAAc,GACf;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzE;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AA4D/E;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAa,GAAG,MAAM,CA2BzF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAA;CAAE,CAY1D;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAKjF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC7C,GAAG,IAAI,CASP;AAwBD;;GAEG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAClC,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,SAAa,GAClB,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CASzC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,aAAa,CACjC,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB5F"}

package/dist/serve/ai-proxy.js

@@ -1,9 +1,9 @@
-import { redactUrl } from 'pyric/ai/internal';
+import { redactUpstreamText, redactUrl } from 'pyric/ai/internal';
 import { sanitizeForTerminal } from './ai-terminal-text.js';
 import { permitGuardHost } from '../register/net-guard.js';
 import { FIREBASE_AI_LOGIC_HOST } from '../google-endpoints.js';
 import { HOSTED_METHOD_BODY_LIMIT } from './hosted/method-protocol.js';
-import { BODY_TOO_LARGE_CODE, collectRawBody } from '../bridge/server/peer.js';
+import { BODY_TOO_LARGE_CODE, closingHeaders, collectRawBody } from '../bridge/server/peer.js';
 /** Default upstream: local Ollama's OpenAI-compatible endpoint. */
 export const AI_PROXY_DEFAULT_UPSTREAM = 'http://localhost:11434/v1';
 /** The route the dev server mounts for OpenAI-compatible traffic. */
@@ -42,13 +42,17 @@ const AI_PROXY_RETRY_AFTER_MAX = 64;
  * nothing worth printing.
  *
  * The header is remote-authored, so it is sanitized and length-capped like
- * every other upstream string that reaches the terminal. Delta-seconds (the
+ * every other upstream string that reaches the terminal. It is masked of the
+ * request's credentials first, with the masking the gemini engine and proxy
+ * use (`redactUpstreamText`), so the cap cannot leave a prefix of a key
+ * behind. Delta-seconds (the
  * common form) get an `s` suffix so the wait reads as a duration; the
  * HTTP-date form is echoed verbatim, since `Wed, 21 Oct 2026 07:28:00 GMTs`
  * would be nonsense.
  */
-function formatRetryAfter(raw) {
-    const clean = sanitizeForTerminal(raw).slice(0, AI_PROXY_RETRY_AFTER_MAX).trim();
+function formatRetryAfter(raw, credentials) {
+    const masked = redactUpstreamText(raw, credentials);
+    const clean = sanitizeForTerminal(masked).slice(0, AI_PROXY_RETRY_AFTER_MAX).trim();
     if (clean === '')
         return null;
     if (/^\d+$/.test(clean))
@@ -117,7 +121,7 @@ export function formatAiProxyWarning(failure, source = 'ai-proxy') {
         lines.push(`      set PYRIC_AI_PROXY_UPSTREAM to an OpenAI-compatible base URL (default ${AI_PROXY_DEFAULT_UPSTREAM})`);
     }
     if (failure.kind === 'status' && failure.retryAfter !== undefined) {
-        const wait = formatRetryAfter(failure.retryAfter);
+        const wait = formatRetryAfter(failure.retryAfter, failure.credentials ?? []);
         if (wait !== null) {
             lines.push(`      Retry-After: ${wait}, no automatic retry; the status went to the caller`);
         }
@@ -181,6 +185,27 @@ export function permitAiUpstreams(ai) {
     for (const destination of destinations)
         permitGuardHost(destination);
 }
+/** The `key` parameter of `target`, or null when it has none or is not a URL. */
+function urlKeyParam(target) {
+    try {
+        return new URL(target).searchParams.get('key');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The credentials an upstream request carries: the `key` URL parameter, the
+ * `x-goog-api-key` header, and the `Authorization` value without its scheme.
+ */
+function requestCredentials(input, init) {
+    const isRequest = input instanceof Request;
+    const headers = new Headers(isRequest ? input.headers : init?.headers);
+    const urlKey = urlKeyParam(isRequest ? input.url : String(input));
+    const authorization = headers.get('authorization')?.replace(/^\S+\s+/, '') ?? null;
+    const found = [urlKey, headers.get('x-goog-api-key'), authorization];
+    return found.filter((value) => value !== null && value !== '');
+}
 /** Shared upstream I/O for the browser proxy and the direct Node engine.
  * Responses remain incremental; cancellation stops reading without a warning.
  */
@@ -202,7 +227,7 @@ export async function fetchAiUpstream(input, init, throttle, logger, source = 'a
     if (failed) {
         const retryAfter = upstream.headers.get('retry-after');
         note({ kind: 'status', target, latencyMs: Date.now() - startedAt, status: upstream.status,
-            ...(retryAfter !== null ? { retryAfter } : {}) });
+            ...(retryAfter !== null ? { retryAfter, credentials: requestCredentials(input, init) } : {}) });
     }
     const body = upstream.body;
     const hasNoBody = body === null;
@@ -250,7 +275,7 @@ export async function readAiProxyBody(req, res) {
     catch (error) {
         const tooLarge = error.code === BODY_TOO_LARGE_CODE;
         const status = tooLarge ? 413 : 400;
-        res.writeHead(status, { 'content-type': 'text/plain' }).end(tooLarge ? 'Payload Too Large' : 'Bad Request');
+        res.writeHead(status, closingHeaders({ 'content-type': 'text/plain' })).end(tooLarge ? 'Payload Too Large' : 'Bad Request');
         return null;
     }
 }

package/dist/serve/ai-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-proxy.js","sourceRoot":"","sources":["../../src/serve/ai-proxy.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS/E,mEAAmE;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD;4DAC4D;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAeH;2EAC2E;AAC3E,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,GAAG,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAuB;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,mBAAmB,OAAO,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IACpF,OAAO,YAAY,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CACzB,OAAuB,EACvB,QAA8B,EAC9B,MAAoB,EACpB,MAAM,GAAG,UAAU;IAEnB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO;IAC3E,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB,EAAE,MAAM,GAAG,UAAU;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,QAAQ,GAAG,yBAAyB,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;QAC3C,QAAQ,GAAG,qBAAqB,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,yCAAyC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,eAAe,MAAM,KAAK,QAAQ,EAAE;QACpC,cAAc,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK;KAChD,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,+EAA+E,yBAAyB,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,qDAAqD,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAA8B;IAE9B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACxD,IAAI,GAAG,GAAG,yBAAyB,CAAC;IACpC,IAAI,MAAM,GAAiC,SAAS,CAAC;IACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,GAAG,UAAU,CAAC;QACjB,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,GAAG,WAAW,CAAC;QAClB,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAA8B;IACrE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;IACxD,IAAI,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAIjC;IACC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,mBAAmB,GAAG,EAAE,CAAC,IAAI,KAAK,YAAY,CAAC;IACrD,IAAI,mBAAmB;QAAE,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS;QAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,aAAa,GAAI,EAAE,CAAC,UAAgD,EAAE,OAAO,CAAC;IACpF,MAAM,qBAAqB,GAAG,OAAO,aAAa,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvG,IAAI,qBAAqB;QAAE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5D,KAAK,MAAM,WAAW,IAAI,YAAY;QAAE,eAAe,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkC,EAClC,IAA6B,EAC7B,QAA8B,EAC9B,MAAoB,EACpB,MAAM,GAAG,UAAU;IAEnB,MAAM,SAAS,GAAG,KAAK,YAAY,OAAO,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,OAAuB,EAAQ,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtG,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvF,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC;IAChC,IAAI,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,YAAY,GAAG,IAAI,cAAc,CAAa;QAClD,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,IAAI;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;oBACxB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACpE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;KACF,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;KACpF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,GAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAI,KAA4B,CAAC,IAAI,KAAK,mBAAmB,CAAC;QAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC5G,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,kBAAsC,EACtC,QAA8B,EAC9B,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,MAAoB;IAEpB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAEvD,+EAA+E;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO;IAE1B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,yEAAyE;QACzE,mDAAmD;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CACL,gCAAgC,SAAS,CAAC,MAAM,CAAC,iBAAiB,SAAS,CAAC,KAAK,CAAC,IAAI;YACpF,+DAA+D;YAC/D,YAAY,yBAAyB,IAAI,CAC5C,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,GAAmB;IAC3E,MAAM,eAAe,GAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,eAAe,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;IAC/D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACA,GAAsD,CAAC,YAAY,EAAE,EAAE,CAAC;IAEzE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;IACpF,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"ai-proxy.js","sourceRoot":"","sources":["../../src/serve/ai-proxy.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS/F,mEAAmE;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD;4DAC4D;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAiBH;2EAC2E;AAC3E,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,WAA8B;IACnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,GAAG,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAuB;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,mBAAmB,OAAO,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IACpF,OAAO,YAAY,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CACzB,OAAuB,EACvB,QAA8B,EAC9B,MAAoB,EACpB,MAAM,GAAG,UAAU;IAEnB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO;IAC3E,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB,EAAE,MAAM,GAAG,UAAU;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,QAAQ,GAAG,yBAAyB,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;QAC3C,QAAQ,GAAG,qBAAqB,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,yCAAyC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,eAAe,MAAM,KAAK,QAAQ,EAAE;QACpC,cAAc,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK;KAChD,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,+EAA+E,yBAAyB,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC7E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,qDAAqD,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAA8B;IAE9B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACxD,IAAI,GAAG,GAAG,yBAAyB,CAAC;IACpC,IAAI,MAAM,GAAiC,SAAS,CAAC;IACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,GAAG,UAAU,CAAC;QACjB,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,GAAG,WAAW,CAAC;QAClB,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAA8B;IACrE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;IACxD,IAAI,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAIjC;IACC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,mBAAmB,GAAG,EAAE,CAAC,IAAI,KAAK,YAAY,CAAC;IACrD,IAAI,mBAAmB;QAAE,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS;QAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,aAAa,GAAI,EAAE,CAAC,UAAgD,EAAE,OAAO,CAAC;IACpF,MAAM,qBAAqB,GAAG,OAAO,aAAa,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvG,IAAI,qBAAqB;QAAE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5D,KAAK,MAAM,WAAW,IAAI,YAAY;QAAE,eAAe,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAkC,EAAE,IAA6B;IAC3F,MAAM,SAAS,GAAG,KAAK,YAAY,OAAO,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IACnF,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkC,EAClC,IAA6B,EAC7B,QAA8B,EAC9B,MAAoB,EACpB,MAAM,GAAG,UAAU;IAEnB,MAAM,SAAS,GAAG,KAAK,YAAY,OAAO,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,OAAuB,EAAQ,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtG,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvF,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC;IAChC,IAAI,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,YAAY,GAAG,IAAI,cAAc,CAAa;QAClD,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,IAAI;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;oBACxB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACpE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;KACF,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;KACpF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,GAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAI,KAA4B,CAAC,IAAI,KAAK,mBAAmB,CAAC;QAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC5H,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,kBAAsC,EACtC,QAA8B,EAC9B,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,MAAoB;IAEpB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAEvD,+EAA+E;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO;IAE1B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,yEAAyE;QACzE,mDAAmD;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CACL,gCAAgC,SAAS,CAAC,MAAM,CAAC,iBAAiB,SAAS,CAAC,KAAK,CAAC,IAAI;YACpF,+DAA+D;YAC/D,YAAY,yBAAyB,IAAI,CAC5C,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,GAAmB;IAC3E,MAAM,eAAe,GAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,eAAe,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;IAC/D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACA,GAAsD,CAAC,YAAY,EAAE,EAAE,CAAC;IAEzE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;IACpF,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC"}

package/dist/serve/app-ports.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The ports a page of this app may name in its `Origin` when it opens the
+ * bridge socket or calls a control route.
+ *
+ * A page this server serves names the server's own port. Under a dev server
+ * that proxies `/__pyric/*` to this one, such as `withPyric`'s rewrite under
+ * `pyric sandbox -- next dev`, the page loads from the dev server, so its
+ * Origin names the dev server's port instead. The proxy says which port that
+ * is: it forwards each request with `x-forwarded-host` set to the host the
+ * browser asked it for. A socket the proxy forwards (the Node host's page)
+ * carries that header itself. A socket that comes straight to this server
+ * (the SharedWorker sandbox) does not, but the page's `/__pyric/init.json`
+ * went through the proxy before the page learned the bridge URL, so the
+ * port was learned from that request.
+ *
+ * Only a same-origin request teaches a port: one whose `sec-fetch-site` is
+ * `same-origin`, which the browser sets and a page cannot change. The page
+ * Next serves fetches `/__pyric/*` from Next's own origin, and the proxy
+ * passes the header through. A page on another port that sends the request
+ * itself, even with an `x-forwarded-host` it chose, is `same-site` at most,
+ * so it teaches nothing. A proxy names its own host, never the page's, so a
+ * page on another port that goes through the proxy is still refused. Only
+ * loopback names and the bound host are learned; a name allowed through
+ * `--allowed-host` (a tunnel) is never port-checked in the first place.
+ *
+ * Only the standalone server learns (`learnsProxyPorts`). A mount inside a
+ * dev server, such as the Vite plugin's, serves the page on the connection's
+ * own port, and that dev server may answer cross-origin preflights for
+ * `/__pyric/*` paths it does not handle.
+ */
+import type { IncomingMessage } from 'node:http';
+export interface AppPorts {
+    /** Records the proxy port a same-origin forwarded request names. */
+    learn(req: IncomingMessage): void;
+    /** The ports a page's Origin may name on this request's connection. */
+    forRequest(req: IncomingMessage): number[];
+    /**
+     * The same, plus the proxy's port when a proxy forwarded this WebSocket
+     * upgrade from the page it serves: the Origin names the host the proxy
+     * names in `x-forwarded-host`. A browser cannot put a header on a
+     * WebSocket handshake, so only a proxy can name that host, and it names
+     * its own. The page may open its socket before any same-origin request
+     * has gone through the proxy, as the Node host's page under Next does.
+     */
+    forUpgrade(req: IncomingMessage): number[];
+}
+export declare function createAppPorts(boundHost: string): AppPorts;
+//# sourceMappingURL=app-ports.d.ts.map

package/dist/serve/app-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-ports.d.ts","sourceRoot":"","sources":["../../src/serve/app-ports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMjD,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,KAAK,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,uEAAuE;IACvE,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,EAAE,CAAC;IAC3C;;;;;;;OAOG;IACH,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,EAAE,CAAC;CAC5C;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CA8B1D"}