@pyric/cli 0.1.0-alpha.30 → 0.1.0-alpha.30.2

package/dist/serve/entries/app-ai-passthrough.js

@@ -2,58 +2,14 @@
 import { bindAppRegistrySandbox } from 'pyric/app/internal';
 import { sandbox } from './app-backend.js';
 import * as pyricApp from 'pyric/app';
-import * as realApp from 'firebase/app';
+import { shadowedAppRegistry } from '../../register/app-bridge-shadow.js';
 bindAppRegistrySandbox(sandbox);
-function decorateApp(app, options, rawSettings) {
-    try {
-        let shadow;
-        try {
-            shadow = realApp.getApp(app.name);
-        }
-        catch {
-            const initOptions = (options ?? app.options);
-            const initSettings = rawSettings ?? app.name;
-            const isStringSettings = typeof initSettings === 'string';
-            if (isStringSettings) {
-                shadow = realApp.initializeApp(initOptions, initSettings);
-            }
-            else {
-                const objectSettings = initSettings;
-                shadow = realApp.initializeApp(initOptions, objectSettings);
-            }
-        }
-        const hasShadowContainer = shadow.container !== undefined && shadow.container !== null;
-        if (hasShadowContainer) {
-            Object.defineProperty(app, 'container', { value: shadow.container, configurable: true });
-        }
-    }
-    catch {
-        // Observational/best-effort: do not break Pyric initialization if shadow initialization fails.
-    }
-    return app;
-}
-export function initializeApp(options, rawSettings) {
-    const app = pyricApp.initializeApp(options, rawSettings);
-    return decorateApp(app, options, rawSettings);
-}
-export function getApp(name) {
-    return decorateApp(pyricApp.getApp(name));
-}
-export function getApps() {
-    return pyricApp.getApps().map((app) => decorateApp(app));
-}
-export async function deleteApp(app) {
-    try {
-        const shadow = realApp.getApp(app.name);
-        const hasShadow = shadow !== undefined && shadow !== null;
-        if (hasShadow) {
-            await realApp.deleteApp(shadow);
-        }
-    }
-    catch {
-        // Ignore if shadow app was not initialized or already deleted.
-    }
-    return pyricApp.deleteApp(app);
-}
+// One shadow implementation for every plane: the register adapters build
+// their exports from the same registry.
+const registry = shadowedAppRegistry(pyricApp);
+export const initializeApp = registry.initializeApp;
+export const getApp = registry.getApp;
+export const getApps = registry.getApps;
+export const deleteApp = registry.deleteApp;
 export { FirebaseError, SDK_VERSION, onLog, registerVersion, setLogLevel, } from 'pyric/app';
 //# sourceMappingURL=app-ai-passthrough.js.map

package/dist/serve/entries/app-ai-passthrough.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-ai-passthrough.js","sourceRoot":"","sources":["../../../src/serve/entries/app-ai-passthrough.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;AAExC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAEhC,SAAS,WAAW,CAClB,GAAyB,EACzB,OAAkC,EAClC,WAAmD;IAEnD,IAAI,CAAC;QACH,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,WAAW,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAA4B,CAAC;YACxE,MAAM,YAAY,GAAG,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC;YAC7C,MAAM,gBAAgB,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC;YAC1D,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,YAAY,CAA4B,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,MAAM,cAAc,GAAG,YAA2C,CAAC;gBACnE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,cAAc,CAA4B,CAAC;YACzF,CAAC;QACH,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC;QACvF,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;IACjG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,OAAkC,EAClC,WAAmD;IAEnD,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzD,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAa;IAClC,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAyB;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,EACL,eAAe,EACf,WAAW,GACZ,MAAM,WAAW,CAAC"}
+{"version":3,"file":"app-ai-passthrough.js","sourceRoot":"","sources":["../../../src/serve/entries/app-ai-passthrough.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAEhC,yEAAyE;AACzE,wCAAwC;AACxC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;AACxC,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;AAE5C,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,EACL,eAAe,EACf,WAAW,GACZ,MAAM,WAAW,CAAC"}

package/dist/serve/firebase-module-swap.d.ts

@@ -15,6 +15,21 @@ export declare function resolveAiMode(explicit: AiMode | undefined, env: Record<
  * from the result is not swapped and resolves to the Firebase SDK.
  */
 export declare function swappedFirebaseEntries(mode: AiMode): ReadonlyMap<ServedFirebaseSpecifier, string>;
+/**
+ * The Firebase SDK modules `pyric sandbox` builds for the browser from the
+ * project's own `firebase` install in production AI mode, to the entry key of
+ * each (`/__pyric/sdk/<key>.js`). One build, so the three share one
+ * `@firebase/app` component registry. The Vite and register planes resolve
+ * the Firebase SDK themselves and never read this.
+ */
+export declare const REAL_SDK_ENTRIES: ReadonlyMap<ServedFirebaseSpecifier, string>;
+/**
+ * The import-map plane's specifier to entry key table: the swap, plus, in
+ * production AI mode, the unswapped `firebase/ai` sent to the Firebase SDK
+ * that `pyric sandbox` builds. A browser has no package resolution, so on
+ * this plane an unswapped specifier still needs a URL.
+ */
+export declare function importMapFirebaseEntries(mode: AiMode): ReadonlyMap<ServedFirebaseSpecifier, string>;
 /**
  * Whether an importer is one of this package's own modules that wrap the
  * Firebase SDK's `firebase/app` or `firebase/app-check`. Those imports must
@@ -24,4 +39,11 @@ export declare function swappedFirebaseEntries(mode: AiMode): ReadonlyMap<Served
 export declare function isShadowAppImporter(importer: string | undefined): boolean;
 /** Whether this import is a shadow-app wrapper reaching the Firebase SDK it wraps. */
 export declare function isBypassedBridgeImport(specifier: string, importer: string | undefined): boolean;
+/**
+ * Where a bypassed bridge import goes on the import-map plane: the entry key
+ * of the Firebase SDK module `pyric sandbox` builds. The bare specifier
+ * cannot stay, because the import map sends it back to the wrapper itself.
+ * Undefined for every import {@link isBypassedBridgeImport} does not name.
+ */
+export declare function bridgeImportEntryKey(specifier: string, importer: string | undefined): string | undefined;
 //# sourceMappingURL=firebase-module-swap.d.ts.map

package/dist/serve/firebase-module-swap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firebase-module-swap.d.ts","sourceRoot":"","sources":["../../src/serve/firebase-module-swap.ts"],"names":[],"mappings":"AAmBA,2EAA2E;AAC3E,eAAO,MAAM,WAAW,wTAed,CAAC;AAEX,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9C,mFAAmF;AACnF,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAIR;AAOD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAYjG;AAsBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIzE;AAKD,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE/F"}
+{"version":3,"file":"firebase-module-swap.d.ts","sourceRoot":"","sources":["../../src/serve/firebase-module-swap.ts"],"names":[],"mappings":"AAoBA,2EAA2E;AAC3E,eAAO,MAAM,WAAW,wTAed,CAAC;AAEX,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9C,mFAAmF;AACnF,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAIR;AAOD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAYjG;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,uBAAuB,EAAE,MAAM,CAIxE,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAOnG;AAsBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIzE;AAcD,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGxG"}

package/dist/serve/firebase-module-swap.js

@@ -8,7 +8,8 @@
  * container.
  *
  * Every plane that swaps Firebase modules reads {@link swappedFirebaseEntries}:
- * the `pyric sandbox` import map (`html-injection.ts`) and the Vite resolver
+ * the `pyric sandbox` import map (`html-injection.ts`, through
+ * {@link importMapFirebaseEntries}) and the Vite resolver
  * (`vite-module-swap.ts`). Every front door resolves the mode with
  * {@link resolveAiMode}. One table and one precedence rule, so the planes
  * cannot disagree about what production mode means. It imports only Node
@@ -66,6 +67,33 @@ export function swappedFirebaseEntries(mode) {
     }
     return swapped;
 }
+/**
+ * The Firebase SDK modules `pyric sandbox` builds for the browser from the
+ * project's own `firebase` install in production AI mode, to the entry key of
+ * each (`/__pyric/sdk/<key>.js`). One build, so the three share one
+ * `@firebase/app` component registry. The Vite and register planes resolve
+ * the Firebase SDK themselves and never read this.
+ */
+export const REAL_SDK_ENTRIES = new Map([
+    ['firebase/app', 'firebase-sdk-app'],
+    ['firebase/ai', 'firebase-sdk-ai'],
+    ['firebase/app-check', 'firebase-sdk-app-check'],
+]);
+/**
+ * The import-map plane's specifier to entry key table: the swap, plus, in
+ * production AI mode, the unswapped `firebase/ai` sent to the Firebase SDK
+ * that `pyric sandbox` builds. A browser has no package resolution, so on
+ * this plane an unswapped specifier still needs a URL.
+ */
+export function importMapFirebaseEntries(mode) {
+    const entries = new Map(swappedFirebaseEntries(mode));
+    for (const [specifier, key] of REAL_SDK_ENTRIES) {
+        const isUnswapped = !entries.has(specifier);
+        if (isUnswapped)
+            entries.set(specifier, key);
+    }
+    return entries;
+}
 /** This package's root (`src/serve/` and `dist/serve/` both sit two levels below it), as written and resolved. */
 const PACKAGE_ROOTS = (() => {
     const root = fileURLToPath(new URL('../../', import.meta.url)).replaceAll('\\', '/');
@@ -96,10 +124,30 @@ export function isShadowAppImporter(importer) {
     const file = importerFile(importer);
     return PACKAGE_ROOTS.some((root) => file.startsWith(root) && SHADOW_MODULE.test(file.slice(root.length)));
 }
-/** The SDK modules a shadow-app wrapper imports for itself. */
-const BRIDGED_SPECIFIERS = new Set(['firebase/app', 'firebase/app-check']);
+/**
+ * The SDK modules a shadow-app wrapper imports for itself. The firebase-admin
+ * pair is the register's App Check verifier for production AI mode
+ * (`register/app-bridge-admin-app-check.ts`); no browser plane serves them.
+ */
+const BRIDGED_SPECIFIERS = new Set([
+    'firebase/app',
+    'firebase/app-check',
+    'firebase-admin/app',
+    'firebase-admin/app-check',
+]);
 /** Whether this import is a shadow-app wrapper reaching the Firebase SDK it wraps. */
 export function isBypassedBridgeImport(specifier, importer) {
     return BRIDGED_SPECIFIERS.has(specifier) && isShadowAppImporter(importer);
 }
+/**
+ * Where a bypassed bridge import goes on the import-map plane: the entry key
+ * of the Firebase SDK module `pyric sandbox` builds. The bare specifier
+ * cannot stay, because the import map sends it back to the wrapper itself.
+ * Undefined for every import {@link isBypassedBridgeImport} does not name.
+ */
+export function bridgeImportEntryKey(specifier, importer) {
+    if (!isBypassedBridgeImport(specifier, importer))
+        return undefined;
+    return REAL_SDK_ENTRIES.get(specifier);
+}
 //# sourceMappingURL=firebase-module-swap.js.map

package/dist/serve/firebase-module-swap.js.map

@@ -1 +1 @@
-{"version":3,"file":"firebase-module-swap.js","sourceRoot":"","sources":["../../src/serve/firebase-module-swap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,aAAa;IACb,oBAAoB;IACpB,cAAc;IACd,oBAAoB;IACpB,eAAe;IACf,oBAAoB;IACpB,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,wBAAwB;IACxB,kBAAkB;CACV,CAAC;AAOX;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA4B,EAC5B,GAAuC;IAEvC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa,KAAK,YAAY,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IAC/F,OAAO,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,SAAkC;IACzD,OAAO,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC3D,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;QAClD,8EAA8E;QAC9E,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kHAAkH;AAClH,MAAM,aAAa,GAAsB,CAAC,GAAG,EAAE;IAC7C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;QAC/E,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,6DAA6D;AAC7D,MAAM,aAAa,GAAG,oGAAoG,CAAC;AAE3H,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7F,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA4B;IAC9D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,+DAA+D;AAC/D,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEhG,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,QAA4B;IACpF,OAAO,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"firebase-module-swap.js","sourceRoot":"","sources":["../../src/serve/firebase-module-swap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,aAAa;IACb,oBAAoB;IACpB,cAAc;IACd,oBAAoB;IACpB,eAAe;IACf,oBAAoB;IACpB,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,wBAAwB;IACxB,kBAAkB;CACV,CAAC;AAOX;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA4B,EAC5B,GAAuC;IAEvC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa,KAAK,YAAY,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IAC/F,OAAO,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,SAAkC;IACzD,OAAO,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC3D,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;QAClD,8EAA8E;QAC9E,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAiD,IAAI,GAAG,CAAC;IACpF,CAAC,cAAc,EAAE,kBAAkB,CAAC;IACpC,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAClC,CAAC,oBAAoB,EAAE,wBAAwB,CAAC;CACjD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kHAAkH;AAClH,MAAM,aAAa,GAAsB,CAAC,GAAG,EAAE;IAC7C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;QAC/E,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,6DAA6D;AAC7D,MAAM,aAAa,GAAG,oGAAoG,CAAC;AAE3H,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7F,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA4B;IAC9D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED;;;;GAIG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,cAAc;IACd,oBAAoB;IACpB,oBAAoB;IACpB,0BAA0B;CAC3B,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,QAA4B;IACpF,OAAO,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,QAA4B;IAClF,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,gBAAgB,CAAC,GAAG,CAAC,SAAoC,CAAC,CAAC;AACpE,CAAC"}

package/dist/serve/gemini-error-redaction.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `text` with every credential in `credentials` removed, and every
+ * credential URL parameter masked. A JSON body stays JSON.
+ */
+export declare function redactUpstreamError(text: string, credentials: readonly string[]): string;
+//# sourceMappingURL=gemini-error-redaction.d.ts.map

package/dist/serve/gemini-error-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-error-redaction.d.ts","sourceRoot":"","sources":["../../src/serve/gemini-error-redaction.ts"],"names":[],"mappings":"AAmDA;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIxF"}

package/dist/serve/gemini-error-redaction.js

@@ -0,0 +1,61 @@
+/**
+ * Masking an upstream Gemini error before the gemini proxy relays it to the
+ * browser (#1584). An upstream or a gateway can quote the credential it was
+ * sent in any form: in the URL (`?key=`, `&key=`, JSON-escaped or
+ * percent-encoded), in plain text, or in an echoed header such as
+ * `x-goog-api-key` or `Authorization: Bearer`. So the proxy removes the exact
+ * credentials the request carried, raw and percent-encoded, then runs
+ * `redactUrl` as a second pass for any other credential parameter.
+ *
+ * A JSON body is masked value by value and serialized again, so the
+ * browser engine still reads Gemini's own status and message. Text
+ * redaction over the raw JSON could eat a closing quote and leave the
+ * envelope unparseable.
+ */
+import { redactUrl } from 'pyric/ai/internal';
+const MASK = '***';
+/** The forms a credential can appear in, longest first. */
+function quotedForms(credential) {
+    const forms = new Set([encodeURIComponent(credential), credential]);
+    return [...forms].sort((a, b) => b.length - a.length);
+}
+function redactText(text, credentials) {
+    let masked = text;
+    for (const credential of credentials) {
+        for (const form of quotedForms(credential))
+            masked = masked.split(form).join(MASK);
+    }
+    return redactUrl(masked);
+}
+function redactValue(value, credentials) {
+    if (typeof value === 'string')
+        return redactText(value, credentials);
+    if (Array.isArray(value))
+        return value.map((item) => redactValue(item, credentials));
+    const isObject = value !== null && typeof value === 'object';
+    if (!isObject)
+        return value;
+    const entries = Object.entries(value)
+        .map(([key, item]) => [redactText(key, credentials), redactValue(item, credentials)]);
+    return Object.fromEntries(entries);
+}
+/** The JSON value `text` holds, or undefined when it is not JSON. */
+function parseJson(text) {
+    try {
+        return { value: JSON.parse(text) };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * `text` with every credential in `credentials` removed, and every
+ * credential URL parameter masked. A JSON body stays JSON.
+ */
+export function redactUpstreamError(text, credentials) {
+    const json = parseJson(text);
+    if (json === undefined)
+        return redactText(text, credentials);
+    return JSON.stringify(redactValue(json.value, credentials));
+}
+//# sourceMappingURL=gemini-error-redaction.js.map

package/dist/serve/gemini-error-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-error-redaction.js","sourceRoot":"","sources":["../../src/serve/gemini-error-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,IAAI,GAAG,KAAK,CAAC;AAEnB,2DAA2D;AAC3D,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,WAA8B;IAC9D,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC;YAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,WAA8B;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,qEAAqE;AACrE,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAA8B;IAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/serve/gemini-proxy.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `/__pyric/ai-proxy/gemini`: where a browser gemini engine sends (#1584).
+ *
+ * A page or SharedWorker has no server environment, and the Gemini API key
+ * must never reach it. The browser engine sends each request here with no
+ * credentials. The dev server sends it on with the gemini engine's own
+ * request code (`GeminiUpstream` from `pyric/ai/internal`): the key from the
+ * server's environment or ADC, to the server's configured base URL. A
+ * successful answer streams back unchanged. An error comes back with its
+ * status and with any credential it quotes masked, so the browser engine
+ * reads Gemini's own error and never the key. The body is bounded as the
+ * openai route's is.
+ *
+ * The browser chooses only the model and the call. The target and the
+ * credentials are the server's, so no page can send the key anywhere else.
+ * The App Check gate runs before any of this, in the broker that owns the
+ * browser engine.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type GeminiUpstreamOptions } from 'pyric/ai/internal';
+import type { ServeLogger } from './server.js';
+import { type AiDiagnosticThrottle } from './ai-proxy.js';
+import { type AiEngineConfigWire } from './worker/protocol.js';
+export { GEMINI_PROXY_PATH } from './worker/ai-proxy-paths.js';
+/** The server's gemini engine config: the Vite plugin's `ai.engine`, when it is gemini. */
+export interface GeminiProxyConfig {
+    baseUrl?: string;
+    apiKey?: string;
+}
+/** The gemini proxy's config from a configured engine, when that engine is gemini. */
+export declare function geminiProxyConfig(engine: AiEngineConfigWire | undefined): GeminiProxyConfig | undefined;
+/** Is this request for the gemini proxy (and not the OpenAI-compatible one)? */
+export declare function isGeminiProxyPath(pathname: string): boolean;
+/**
+ * The gemini proxy handler. One `GeminiUpstream` serves every request, so an
+ * ADC token is looked up once and reused, as the engine itself does.
+ * `seams` replaces the ADC lookup in tests.
+ */
+export declare function createGeminiProxy(config: GeminiProxyConfig | undefined, throttle: AiDiagnosticThrottle, logger?: ServeLogger, seams?: Pick<GeminiUpstreamOptions, 'printAdcToken'>): (req: IncomingMessage, res: ServerResponse, url: URL) => Promise<void>;
+//# sourceMappingURL=gemini-proxy.d.ts.map

package/dist/serve/gemini-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-proxy.d.ts","sourceRoot":"","sources":["../../src/serve/gemini-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAqD,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE7G,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAOvG;AAYD,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE3D;AAgCD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,CAAC,EAAE,WAAW,EACpB,KAAK,GAAE,IAAI,CAAC,qBAAqB,EAAE,eAAe,CAAM,GACvD,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAwCxE"}

package/dist/serve/gemini-proxy.js

@@ -0,0 +1,105 @@
+import { GeminiUpstream } from 'pyric/ai/internal';
+import { redactUpstreamError } from './gemini-error-redaction.js';
+import { fetchAiUpstream, readAiProxyBody, relayAiUpstream } from './ai-proxy.js';
+import { GEMINI_PROXY_PATH } from './worker/ai-proxy-paths.js';
+import { serializeError } from './worker/protocol.js';
+export { GEMINI_PROXY_PATH } from './worker/ai-proxy-paths.js';
+/** The gemini proxy's config from a configured engine, when that engine is gemini. */
+export function geminiProxyConfig(engine) {
+    const isGemini = engine?.kind === 'gemini';
+    if (!isGemini)
+        return undefined;
+    return {
+        ...(engine.baseUrl !== undefined ? { baseUrl: engine.baseUrl } : {}),
+        ...(engine.apiKey !== undefined ? { apiKey: engine.apiKey } : {}),
+    };
+}
+/** `/v1beta/models/<model>:<call>`, for the three calls the browser engine makes. */
+const GEMINI_CALL_PATH = /^\/v1beta\/(models\/[A-Za-z0-9._-]+):(generateContent|streamGenerateContent|countTokens)$/;
+/** The query each call may carry: only the stream asks for server-sent events. */
+const CALL_QUERY = {
+    generateContent: '',
+    countTokens: '',
+    streamGenerateContent: '?alt=sse',
+};
+/** Is this request for the gemini proxy (and not the OpenAI-compatible one)? */
+export function isGeminiProxyPath(pathname) {
+    return pathname.startsWith(`${GEMINI_PROXY_PATH}/`);
+}
+/** The resource and the action `GeminiUpstream.send` takes, or null for anything else. */
+function geminiCall(url) {
+    const match = url.pathname.slice(GEMINI_PROXY_PATH.length).match(GEMINI_CALL_PATH);
+    if (match === null)
+        return null;
+    const [, resource, call] = match;
+    const isExpectedQuery = url.search === CALL_QUERY[call];
+    if (!isExpectedQuery)
+        return null;
+    return { resource, action: `${call}${url.search}` };
+}
+/** Answer with a Gemini error envelope, as the upstream would. */
+function sendEnvelope(res, code, message, status) {
+    res.writeHead(code, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+    res.end(JSON.stringify({ error: { code, message, status } }));
+}
+/**
+ * Send a non-2xx upstream answer with the credentials the request carried
+ * removed, in whatever form the upstream quotes them, and a JSON envelope
+ * kept parseable (`gemini-error-redaction.ts`).
+ */
+async function relayRedactedError(upstream, credentials, res) {
+    const text = redactUpstreamError(await upstream.text().catch(() => ''), credentials);
+    const headers = { 'cache-control': 'no-store' };
+    const contentType = upstream.headers.get('content-type');
+    if (contentType)
+        headers['content-type'] = contentType;
+    res.writeHead(upstream.status, headers);
+    res.end(text);
+}
+/**
+ * The gemini proxy handler. One `GeminiUpstream` serves every request, so an
+ * ADC token is looked up once and reused, as the engine itself does.
+ * `seams` replaces the ADC lookup in tests.
+ */
+export function createGeminiProxy(config, throttle, logger, seams = {}) {
+    const upstream = new GeminiUpstream({
+        ...seams,
+        ...(config?.baseUrl !== undefined ? { baseUrl: config.baseUrl } : {}),
+        ...(config?.apiKey !== undefined ? { apiKey: config.apiKey } : {}),
+        fetch: Object.assign((input, init) => fetchAiUpstream(input, init, throttle, logger), { preconnect: fetch.preconnect }),
+    });
+    return async (req, res, url) => {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { allow: 'POST' }).end('method not allowed');
+            return;
+        }
+        const call = geminiCall(url);
+        if (call === null) {
+            sendEnvelope(res, 404, `pyric dev ai-proxy: ${url.pathname} is not a Gemini call the proxy sends.`, 'NOT_FOUND');
+            return;
+        }
+        const body = await readAiProxyBody(req, res);
+        if (body === null)
+            return;
+        let response;
+        let credentials;
+        try {
+            ({ response, credentials } = await upstream.sendWithCredentials(call.resource, call.action, body));
+        }
+        catch (error) {
+            // Missing credentials (401) and an unreachable upstream (502) come as
+            // the engine's own envelopes, already redacted.
+            const envelope = serializeError(error).aiEnvelope;
+            if (envelope === undefined)
+                throw error;
+            sendEnvelope(res, envelope.error.code, envelope.error.message, envelope.error.status);
+            return;
+        }
+        if (response.ok) {
+            await relayAiUpstream(response, res);
+            return;
+        }
+        await relayRedactedError(response, credentials, res);
+    };
+}
+//# sourceMappingURL=gemini-proxy.js.map

package/dist/serve/gemini-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-proxy.js","sourceRoot":"","sources":["../../src/serve/gemini-proxy.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,cAAc,EAA8B,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAA6B,MAAM,eAAe,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAA2B,MAAM,sBAAsB,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAQ/D,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,MAAsC;IACtE,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC;IAC3C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,2FAA2F,CAAC;AAErH,kFAAkF;AAClF,MAAM,UAAU,GAA2B;IACzC,eAAe,EAAE,EAAE;IACnB,WAAW,EAAE,EAAE;IACf,qBAAqB,EAAE,UAAU;CAClC,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,GAAQ;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACnF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,KAA4C,CAAC;IACxE,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,kEAAkE;AAClE,SAAS,YAAY,CAAC,GAAmB,EAAE,IAAY,EAAE,OAAe,EAAE,MAAc;IACtF,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACzF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,QAAkB,EAAE,WAA8B,EAAE,GAAmB;IACvG,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IACrF,MAAM,OAAO,GAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;IACvD,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAqC,EACrC,QAA8B,EAC9B,MAAoB,EACpB,QAAsD,EAAE;IAExD,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;QAClC,GAAG,KAAK;QACR,GAAG,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,KAAK,EAAE,MAAM,CAAC,MAAM,CAClB,CAAC,KAAkC,EAAE,IAAkB,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAC1G,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CACjC;KACF,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,GAAG,CAAC,QAAQ,wCAAwC,EAAE,WAAW,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO;QAC1B,IAAI,QAAkB,CAAC;QACvB,IAAI,WAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,gDAAgD;YAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;YAClD,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAC;YACxC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}

package/dist/serve/hosted/method-protocol.d.ts

@@ -12,15 +12,15 @@ export declare const hostedMethodRequest: z.ZodObject<{
     allowProduction: z.ZodDefault<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
     key: string;
+    projectDir: string;
     instanceId: string;
     args: Record<string, unknown>;
-    projectDir: string;
     allowProduction: boolean;
 }, {
     key: string;
+    projectDir: string;
     instanceId: string;
     args: Record<string, unknown>;
-    projectDir: string;
     allowProduction?: boolean | undefined;
 }>;
 export type HostedMethodRequest = z.infer<typeof hostedMethodRequest>;
@@ -43,10 +43,10 @@ export declare const hostedReproRequest: z.ZodObject<{
     instanceId: z.ZodString;
     projectDir: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    instanceId: string;
     projectDir: string;
-}, {
     instanceId: string;
+}, {
     projectDir: string;
+    instanceId: string;
 }>;
 //# sourceMappingURL=method-protocol.d.ts.map

package/dist/serve/html-injection.d.ts

@@ -3,6 +3,8 @@ import { type AiMode } from './firebase-module-swap.js';
 /**
  * The import-map targets, specifier to served URL, for one AI mode. Derived
  * from the shared swap table, so the Vite resolver serves the same modules.
+ * In production AI mode `firebase/ai` goes to the Firebase SDK that
+ * `pyric sandbox` builds from the project's `firebase` install.
  */
 export declare function sdkImportMap(mode?: AiMode): Record<string, string>;
 /** Inject the sandbox import map and boot tags before application modules. */

package/dist/serve/html-injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html-injection.d.ts","sourceRoot":"","sources":["../../src/serve/html-injection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,EAA0B,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEhF;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7E;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,4FAA4F;IAC5F,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CAOnF"}
+{"version":3,"file":"html-injection.d.ts","sourceRoot":"","sources":["../../src/serve/html-injection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAElF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7E;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,4FAA4F;IAC5F,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CAOnF"}

package/dist/serve/html-injection.js

@@ -1,14 +1,16 @@
 import { stampHostedTarget } from './runtime/hosted-target.js';
 import { REACT_BOOTSTRAP } from './react-bootstrap.js';
 import { SANDBOX_BUILD_MARKER } from './sandbox-marker.js';
-import { swappedFirebaseEntries } from './firebase-module-swap.js';
+import { importMapFirebaseEntries } from './firebase-module-swap.js';
 /**
  * The import-map targets, specifier to served URL, for one AI mode. Derived
  * from the shared swap table, so the Vite resolver serves the same modules.
+ * In production AI mode `firebase/ai` goes to the Firebase SDK that
+ * `pyric sandbox` builds from the project's `firebase` install.
  */
 export function sdkImportMap(mode = 'sandbox') {
     const imports = {};
-    for (const [specifier, entryKey] of swappedFirebaseEntries(mode)) {
+    for (const [specifier, entryKey] of importMapFirebaseEntries(mode)) {
         imports[specifier] = `/__pyric/sdk/${entryKey}.js`;
     }
     return imports;

package/dist/serve/html-injection.js.map

@@ -1 +1 @@
-{"version":3,"file":"html-injection.js","sourceRoot":"","sources":["../../src/serve/html-injection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAe,MAAM,2BAA2B,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,SAAS;IACnD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,SAAS,CAAC,GAAG,gBAAgB,QAAQ,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAcD,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,UAA2B,EAAE;IACzE,OAAO,iBAAiB,CACtB,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,EAChC,OAAO,CAAC,MAAM,EAAE,UAAU,EAC1B,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EAAE,UAAU,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAAwB;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,EAAE,aAAa,EAAE,WAAW,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACvD,MAAM,MAAM,GAAG,kBAAkB,CAAC;IAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACnC,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,iBAAiB,GAAG,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC/E,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,iBAAiB;YAAE,IAAI,IAAI,wCAAwC,aAAa,KAAK,MAAM,GAAG,CAAC;QACnG,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC5C,IAAI,iBAAiB;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC;QACpC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,WAAW,GAAG,gBAAgB;QAClC,CAAC,CAAC,wCAAwC,aAAa,KAAK,MAAM,GAAG;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,WAAW;QAC1B,CAAC,CAAC,WAAW,MAAM,mDAAmD;QACtE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,GACR,eAAe;QACf,WAAW;QACX,QAAQ;QACR,4BAA4B,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,WAAW;QACvF,oDAAoD,MAAM,YAAY,CAAC;IACzE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC;IACpC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,GAAG,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"html-injection.js","sourceRoot":"","sources":["../../src/serve/html-injection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAe,MAAM,2BAA2B,CAAC;AAElF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,SAAS;IACnD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,SAAS,CAAC,GAAG,gBAAgB,QAAQ,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAcD,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,UAA2B,EAAE;IACzE,OAAO,iBAAiB,CACtB,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,EAChC,OAAO,CAAC,MAAM,EAAE,UAAU,EAC1B,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,EAAE,UAAU,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAAwB;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,EAAE,aAAa,EAAE,WAAW,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACvD,MAAM,MAAM,GAAG,kBAAkB,CAAC;IAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACnC,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,iBAAiB,GAAG,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC/E,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,iBAAiB;YAAE,IAAI,IAAI,wCAAwC,aAAa,KAAK,MAAM,GAAG,CAAC;QACnG,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC5C,IAAI,iBAAiB;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC;QACpC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,WAAW,GAAG,gBAAgB;QAClC,CAAC,CAAC,wCAAwC,aAAa,KAAK,MAAM,GAAG;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,WAAW;QAC1B,CAAC,CAAC,WAAW,MAAM,mDAAmD;QACtE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,GACR,eAAe;QACf,WAAW;QACX,QAAQ;QACR,4BAA4B,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,WAAW;QACvF,oDAAoD,MAAM,YAAY,CAAC;IACzE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC;IACpC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,GAAG,IAAI,CAAC;AACrB,CAAC"}

package/dist/serve/namespace.d.ts

@@ -4,6 +4,7 @@ import { type StateStore } from './state-store.js';
 import { type StudioRouteOptions } from './studio/index.js';
 import { type ServeLogger } from './server.js';
 import type { InitPayload } from './init-payload.js';
+import { type GeminiProxyConfig } from './gemini-proxy.js';
 import { type AiDiagnosticPayload } from './ai-terminal-blocks.js';
 import type { AssetResolver } from './assets/resolver.js';
 import { type BeaconReport } from '../register/beacon.js';
@@ -75,6 +76,10 @@ export interface NamespaceOptions {
      *  (local Ollama). Always mounted — the route only touches the network
      *  when a request arrives. */
     aiProxyUpstream?: string;
+    /** The gemini engine `/__pyric/ai-proxy/gemini` sends for a browser engine
+     *  (#1584): the Vite plugin's `ai.engine` when it is gemini. Absent, it
+     *  sends to Google AI Studio with the key from this process's environment. */
+    aiGemini?: GeminiProxyConfig;
     /** Receives one handshake beacon per pyric-launched child (`POST
      *  /__pyric/beacon`, sent by `@pyric/cli/register` once its hooks and
      *  net-guard are installed). Absent means the route still 204s; the child
@@ -90,6 +95,10 @@ export interface NamespaceOptions {
      *  falling back to raw `console`). */
     logger?: ServeLogger;
 }
+/** Largest relayed denial the route reads. A real one is a message, a path, a
+ *  uid and a short owner stack, a few KiB at most; the index route's 64 KiB
+ *  leaves room for a deep stack without letting a page grow the server. */
+export declare const DENIAL_BODY_LIMIT_BYTES: number;
 /** Loosely-typed mirror of the client's relay payload — JSON from the served
  *  page, read defensively since nothing here enforces the wire shape. */
 interface DenialRelayPayload {

package/dist/serve/namespace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/serve/namespace.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEtF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAwF,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AACrI,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAIvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEvE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IACxD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9C,WAAW,IAAI,MAAM,CAAC;IACtB,8EAA8E;IAC9E,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,cAAc,IAAI,aAAa,CAwC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,OAAO,yBAAyB,EAAE,gBAAgB,CAAC;IAClE,OAAO,CAAC,EAAE,OAAO,yBAAyB,EAAE,gBAAgB,CAAC;IAC7D,UAAU,CAAC,EAAE,OAAO,6BAA6B,EAAE,oBAAoB,CAAC;IACxE,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf;mDAC+C;IAC/C,WAAW,EAAE,MAAM,WAAW,CAAC;IAC/B,iEAAiE;IACjE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;oFACgF;IAChF,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAChD,2EAA2E;IAC3E,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,kEAAkE;IAClE,UAAU,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,OAAO,iCAAiC,EAAE,iBAAiB,CAAC;IACtF;;;;gFAI4E;IAC5E,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,IAAI,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC/D;;;iCAG6B;IAC7B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;wDAEoD;IACpD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;kCAI8B;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;+DAG2D;IAC3D,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC;;4EAEwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;0CAGsC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAiMD;yEACyE;AACzE,UAAU,kBAAkB;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;4EACwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QAC/B,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,wEAAwE;QACxE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,IAAI,CAAC;IACT,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;2DAC2D;AAC3D,wBAAgB,oBAAoB,CAAC,QAAQ,GAAE,MAA2B,GAAG;IAC3E,qFAAqF;IACrF,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACjE,CAUA;AACD,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAErE;;4DAE4D;AAC5D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAoBrE;AA6CD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,OAAO,EAAE,mBAAmB,GAC3B,IAAI,CAMN;AA+DD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,IAmCjD,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,GAAG,KAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA6KzF"}
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/serve/namespace.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEtF,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAwF,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AACrI,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAwC,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAKvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEvE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IACxD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9C,WAAW,IAAI,MAAM,CAAC;IACtB,8EAA8E;IAC9E,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,cAAc,IAAI,aAAa,CAwC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,OAAO,yBAAyB,EAAE,gBAAgB,CAAC;IAClE,OAAO,CAAC,EAAE,OAAO,yBAAyB,EAAE,gBAAgB,CAAC;IAC7D,UAAU,CAAC,EAAE,OAAO,6BAA6B,EAAE,oBAAoB,CAAC;IACxE,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf;mDAC+C;IAC/C,WAAW,EAAE,MAAM,WAAW,CAAC;IAC/B,iEAAiE;IACjE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;oFACgF;IAChF,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAChD,2EAA2E;IAC3E,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,kEAAkE;IAClE,UAAU,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,OAAO,iCAAiC,EAAE,iBAAiB,CAAC;IACtF;;;;gFAI4E;IAC5E,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,IAAI,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC/D;;;iCAG6B;IAC7B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;wDAEoD;IACpD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;kCAI8B;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;kFAE8E;IAC9E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;+DAG2D;IAC3D,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC;;4EAEwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;0CAGsC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAiMD;;2EAE2E;AAC3E,eAAO,MAAM,uBAAuB,QAAY,CAAC;AAEjD;yEACyE;AACzE,UAAU,kBAAkB;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;4EACwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QAC/B,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,wEAAwE;QACxE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,IAAI,CAAC;IACT,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;2DAC2D;AAC3D,wBAAgB,oBAAoB,CAAC,QAAQ,GAAE,MAA2B,GAAG;IAC3E,qFAAqF;IACrF,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACjE,CAUA;AACD,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAuBrE;;4DAE4D;AAC5D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAoBrE;AA6CD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,OAAO,EAAE,mBAAmB,GAC3B,IAAI,CAMN;AAwED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,IAoCjD,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,GAAG,KAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA8LzF"}