@pyric/cli 0.1.0-alpha.9

package/dist/cli/verify.js

@@ -0,0 +1,349 @@
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { basename, join, resolve } from 'node:path';
+import { deriveRulesTestCases, fixtureVerifiableServices, parseVerifyFixture, verifyFixture, VerifyInputError, } from '../verify/index.js';
+import { readFirebaseJson } from './firebase-json.js';
+import { resolveScope } from './scope.js';
+import { parseRtdbRulesJson } from '../rtdb/rules-json.js';
+export const SERVE_CAPTURE_PATH = '.pyric/last-session.json';
+export function loadFixture(path) {
+    return parseVerifyFixture(JSON.parse(readFileSync(path, 'utf8')));
+}
+export async function runFixture(name, fixture, rules, options = {}) {
+    const result = await verifyFixture(fixture, { rules, ...options });
+    return {
+        name,
+        ...(fixture.description !== undefined ? { description: fixture.description } : {}),
+        ok: result.ok,
+        result,
+    };
+}
+export async function checkDirectory(dir, rules, options = {}) {
+    const files = readdirSync(dir).filter((f) => f.endsWith('.json')).sort();
+    const results = await Promise.all(files.map((f) => runFixture(basename(f, '.json'), loadFixture(join(dir, f)), rules, options)));
+    return { results, allOk: results.every((r) => r.ok) };
+}
+export function formatResults(results) {
+    const lines = [];
+    for (const result of results) {
+        const marker = result.ok ? '✓' : '✗';
+        const desc = result.description ? ` - ${result.description}` : '';
+        const serviceSummary = Object.values(result.result.services)
+            .filter((service) => service !== undefined)
+            .map((service) => {
+            const failures = failingDivergences(service.divergences).length;
+            const info = service.divergences.length - failures;
+            return service.ok
+                ? `${service.service}: ok (${info} informational)`
+                : `${service.service}: ${failures} failure(s)`;
+        })
+            .join(', ');
+        lines.push(`${marker} ${result.name}${desc} - ${serviceSummary}`);
+        for (const service of Object.values(result.result.services)) {
+            if (!service)
+                continue;
+            for (const divergence of failingDivergences(service.divergences)) {
+                lines.push(`    [${service.service}] ${formatDivergence(divergence)}`);
+            }
+        }
+    }
+    return lines.join('\n');
+}
+export async function runVerify(parsed, deps = {}) {
+    const cwd = process.cwd();
+    const json = parsed.flags.get('json') === true;
+    if (parsed.positional[0] === 'cases') {
+        return runVerifyCases(parsed, cwd);
+    }
+    const target = parsed.positional[0];
+    const inputPath = resolve(cwd, target ?? SERVE_CAPTURE_PATH);
+    if (!existsSync(inputPath)) {
+        if (target) {
+            process.stderr.write(`pyric verify: no such fixture or directory: ${inputPath}\n`);
+        }
+        else {
+            process.stderr.write(`pyric verify: no captured session at ${SERVE_CAPTURE_PATH}.\n` +
+                '  Run `pyric dev`, exercise your app, then `pyric verify`, or pass a fixture path.\n');
+        }
+        return 2;
+    }
+    let loaded;
+    try {
+        loaded = statSync(inputPath).isDirectory()
+            ? loadFixturesFromDirectory(inputPath)
+            : [{ name: basename(inputPath, '.json'), fixture: loadFixture(inputPath) }];
+    }
+    catch (e) {
+        process.stderr.write(`pyric verify: failed to load fixture: ${messageOf(e)}\n`);
+        return 2;
+    }
+    if (loaded.length === 0) {
+        process.stderr.write(`pyric verify: no .json fixtures in ${inputPath}\n`);
+        return 2;
+    }
+    let services;
+    try {
+        services = selectedServices(parsed.flags.get('service'), loaded.map((item) => item.fixture));
+    }
+    catch (e) {
+        process.stderr.write(`pyric verify: ${messageOf(e)}\n`);
+        return 2;
+    }
+    let engines;
+    try {
+        engines = parseEngines(parsed.flags.get('engine'));
+    }
+    catch (e) {
+        process.stderr.write(`pyric verify: ${messageOf(e)}\n`);
+        return 2;
+    }
+    let rulesResolution;
+    try {
+        rulesResolution = await resolveCandidateRules(cwd, services, parsed.flags.get('rules'));
+    }
+    catch (e) {
+        process.stderr.write(`pyric verify: ${messageOf(e)}\n`);
+        return 2;
+    }
+    let rulesTestApi;
+    if (engines.includes('rulesTestApi')) {
+        try {
+            const resolved = await (deps.resolveScope ?? resolveScope)({
+                projectId: stringFlag(parsed.flags.get('project')),
+            });
+            rulesTestApi = { scope: resolved.scope };
+        }
+        catch (e) {
+            process.stderr.write(`pyric verify: ${messageOf(e)}\n`);
+            return 2;
+        }
+    }
+    let results;
+    try {
+        results = await Promise.all(loaded.map((item) => runFixture(item.name, item.fixture, rulesResolution.rules, {
+            services,
+            engines,
+            ...(rulesTestApi ? { rulesTestApi } : {}),
+        })));
+    }
+    catch (e) {
+        const prefix = e instanceof VerifyInputError ? 'invalid input' : 'failed to replay';
+        process.stderr.write(`pyric verify: ${prefix}: ${messageOf(e)}\n`);
+        return 2;
+    }
+    const allOk = results.every((result) => result.ok);
+    if (json) {
+        process.stdout.write(JSON.stringify({
+            ok: allOk,
+            engines,
+            rulesPaths: rulesResolution.paths,
+            results: results.map((result) => ({
+                name: result.name,
+                description: result.description,
+                ok: result.ok,
+                services: result.result.services,
+            })),
+        }) + '\n');
+    }
+    else {
+        process.stdout.write(formatResults(results) + '\n');
+        if (!allOk) {
+            const failed = results.filter((result) => !result.ok).length;
+            const rules = Object.entries(rulesResolution.paths)
+                .map(([service, path]) => `${service}=${basename(path)}`)
+                .join(', ');
+            process.stderr.write(`\n✗ ${failed} session(s) regressed under ${rules}.\n`);
+        }
+        else {
+            process.stdout.write('\n✓ all selected services replay cleanly.\n');
+        }
+    }
+    return allOk ? 0 : 1;
+}
+function runVerifyCases(parsed, cwd) {
+    const target = parsed.positional[1];
+    const inputPath = resolve(cwd, target ?? SERVE_CAPTURE_PATH);
+    if (!existsSync(inputPath)) {
+        process.stderr.write(`pyric verify cases: no such fixture: ${inputPath}\n`);
+        return 2;
+    }
+    const services = flagStrings(parsed.flags.get('service')).map(toVerifiableService);
+    if (services.some((service) => service !== 'firestore')) {
+        process.stderr.write('pyric verify cases: only --service firestore is supported for Rules Test API case derivation.\n');
+        return 2;
+    }
+    let fixture;
+    try {
+        fixture = loadFixture(inputPath);
+    }
+    catch (e) {
+        process.stderr.write(`pyric verify cases: failed to load fixture: ${messageOf(e)}\n`);
+        return 2;
+    }
+    const result = deriveRulesTestCases(fixture, {
+        service: 'firestore',
+    });
+    const output = JSON.stringify(result, null, 2) + '\n';
+    const out = stringFlag(parsed.flags.get('out'));
+    if (out) {
+        writeFileSync(resolve(cwd, out), output);
+    }
+    else {
+        process.stdout.write(output);
+    }
+    return result.ok ? 0 : 1;
+}
+function loadFixturesFromDirectory(dir) {
+    return readdirSync(dir)
+        .filter((f) => f.endsWith('.json'))
+        .sort()
+        .map((f) => ({ name: basename(f, '.json'), fixture: loadFixture(join(dir, f)) }));
+}
+function selectedServices(flag, fixtures) {
+    const explicit = flagStrings(flag);
+    if (explicit.length > 0) {
+        return explicit.map(toVerifiableService);
+    }
+    const union = new Set();
+    for (const fixture of fixtures) {
+        for (const service of fixtureVerifiableServices(fixture)) {
+            union.add(service);
+        }
+    }
+    if (union.size === 0) {
+        throw new Error('fixture does not contain firestore or rtdb rules services.');
+    }
+    return [...union].sort();
+}
+function parseEngines(flag) {
+    const raw = flagStrings(flag);
+    if (raw.length === 0)
+        return ['sandbox'];
+    const out = [];
+    for (const item of raw) {
+        if (item === 'both') {
+            pushUnique(out, 'sandbox');
+            pushUnique(out, 'rulesTestApi');
+        }
+        else if (item === 'sandbox') {
+            pushUnique(out, 'sandbox');
+        }
+        else if (item === 'rules-test-api' || item === 'rulesTestApi') {
+            pushUnique(out, 'rulesTestApi');
+        }
+        else {
+            throw new Error(`unsupported verify engine '${item}'. Supported engines: sandbox, rules-test-api, both.`);
+        }
+    }
+    return out;
+}
+function pushUnique(items, item) {
+    if (!items.includes(item))
+        items.push(item);
+}
+async function resolveCandidateRules(cwd, services, rulesFlag) {
+    const overrides = parseRulesOverrides(rulesFlag);
+    const needsDefaults = services.some((service) => !overrides.has(service));
+    const firebaseJson = needsDefaults ? await readFirebaseJsonOrNull(cwd) : null;
+    const rules = {};
+    const paths = {};
+    for (const service of services) {
+        const rel = overrides.get(service) ?? defaultRulesPath(firebaseJson, service);
+        if (!rel) {
+            throw new Error(`missing candidate ${service} rules. Pass --rules ${service}=<path> or configure firebase.json.`);
+        }
+        const path = resolve(cwd, rel);
+        if (!existsSync(path)) {
+            throw new Error(`rules file not found for ${service}: ${path}`);
+        }
+        paths[service] = path;
+        if (service === 'firestore') {
+            rules.firestore = readFileSync(path, 'utf8');
+        }
+        else if (service === 'rtdb') {
+            rules.rtdb = parseRtdbRulesFile(path);
+        }
+    }
+    return { rules, paths };
+}
+function parseRulesOverrides(flag) {
+    const out = new Map();
+    for (const raw of flagStrings(flag)) {
+        const eq = raw.indexOf('=');
+        if (eq <= 0 || eq === raw.length - 1) {
+            throw new Error(`--rules must use service-qualified values like --rules rtdb=database.rules.json.`);
+        }
+        const service = toVerifiableService(raw.slice(0, eq));
+        out.set(service, raw.slice(eq + 1));
+    }
+    return out;
+}
+function defaultRulesPath(config, service) {
+    if (service === 'firestore')
+        return config?.firestore?.rules;
+    if (service === 'rtdb')
+        return config?.database?.rules;
+    return undefined;
+}
+async function readFirebaseJsonOrNull(cwd) {
+    try {
+        return await readFirebaseJson(cwd);
+    }
+    catch {
+        return null;
+    }
+}
+function parseRtdbRulesFile(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (e) {
+        throw new Error(`failed to parse RTDB rules JSON at ${path}: ${messageOf(e)}`);
+    }
+    return parseRtdbRulesJson(parsed, () => new Error(`RTDB rules file must contain a top-level "rules" object: ${path}`));
+}
+function toVerifiableService(raw) {
+    if (raw === 'firestore' || raw === 'rtdb')
+        return raw;
+    if (raw === 'database')
+        return 'rtdb';
+    throw new Error(`unsupported verify service '${raw}'. Supported services: firestore, rtdb.`);
+}
+function flagStrings(value) {
+    const values = Array.isArray(value) ? value : [value];
+    return values.filter((item) => typeof item === 'string' && item.length > 0);
+}
+function stringFlag(value) {
+    if (Array.isArray(value))
+        return value.find((item) => typeof item === 'string');
+    return typeof value === 'string' ? value : undefined;
+}
+function failingDivergences(divergences) {
+    return divergences.filter((divergence) => divergence.kind !== 'expected-drift');
+}
+function formatDivergence(divergence) {
+    if (divergence.kind === 'now-denied') {
+        const method = divergence.method ? `${divergence.method} ` : '';
+        return `now-denied: ${method}${divergence.path ?? ''}${divergence.reason ? ` (${divergence.reason})` : ''}`;
+    }
+    if (divergence.kind === 'now-allowed') {
+        const method = divergence.method ? `${divergence.method} ` : '';
+        return `now-allowed: ${method}${divergence.path ?? ''}${divergence.reason ? ` (${divergence.reason})` : ''}`;
+    }
+    if (divergence.kind === 'state-drift') {
+        const where = `${divergence.path ?? ''}${divergence.field ? `.${divergence.field}` : ''}`;
+        return `state-drift: ${where}: ${JSON.stringify(divergence.before)} -> ${JSON.stringify(divergence.after)}`;
+    }
+    if (divergence.kind === 'unsupported') {
+        return `unsupported: ${divergence.method ?? 'operation'} ${divergence.path ?? ''}: ${divergence.reason}`;
+    }
+    if (divergence.kind === 'engine-drift') {
+        const method = divergence.method ? `${divergence.method} ` : '';
+        return `engine-drift: ${method}${divergence.path ?? ''}: sandbox=${divergence.sandbox}, rulesTestApi=${divergence.rulesTestApi}`;
+    }
+    return `${divergence.drift}: ${divergence.path ?? ''}`;
+}
+function messageOf(value) {
+    return value instanceof Error ? value.message : String(value);
+}
+//# sourceMappingURL=verify.js.map

package/dist/cli/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/cli/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,GASjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAqB,MAAM,oBAAoB,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAe3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,OAAgB,EAChB,KAAuB,EACvB,UAA+C,EAAE;IAEjD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACnE,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,KAAuB,EACvB,UAA+C,EAAE;IAEjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAC9F,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;aACzD,MAAM,CAAC,CAAC,OAAO,EAAkC,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC;aAC1E,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;YAChE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,QAAQ,CAAC;YACnD,OAAO,OAAO,CAAC,EAAE;gBACf,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,SAAS,IAAI,iBAAiB;gBAClD,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,QAAQ,aAAa,CAAC;QACnD,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,MAAM,cAAc,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,KAAK,MAAM,UAAU,IAAI,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjE,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,OAAO,KAAK,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAkB,EAAE,OAAsB,EAAE;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAE/C,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACrC,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,kBAAkB,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,SAAS,IAAI,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wCAAwC,kBAAkB,KAAK;gBAC7D,sFAAsF,CACzF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAiD,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YACxC,CAAC,CAAC,yBAAyB,CAAC,SAAS,CAAC;YACtC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,SAAS,IAAI,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,eAA+F,CAAC;IACpG,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,YAAkD,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,CAAC;gBACzD,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;aACnD,CAAC,CAAC;YACH,YAAY,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClB,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE;YACzD,QAAQ;YACR,OAAO;YACP,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC,CACN,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,CAAC,YAAY,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACpF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAEnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;YACb,EAAE,EAAE,KAAK;YACT,OAAO;YACP,UAAU,EAAE,eAAe,CAAC,KAAK;YACjC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;aACjC,CAAC,CAAC;SACJ,CAAC,GAAG,IAAI,CACV,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;iBAChD,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;iBACxD,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,OAAO,MAAM,+BAA+B,KAAK,KAAK,CACvD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,cAAc,CAAC,MAAkB,EAAE,GAAW;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,kBAAkB,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,SAAS,IAAI,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,WAAW,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iGAAiG,CAAC,CAAC;QACxH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE;QAC3C,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,IAAI,GAAG,EAAE,CAAC;QACR,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA2B,EAAE,QAAmB;IACxE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,IAA2B;IAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3B,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAChE,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,sDAAsD,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAI,KAAU,EAAE,IAAO;IACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAW,EACX,QAA6B,EAC7B,SAAgC;IAEhC,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9E,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,KAAK,GAA+C,EAAE,CAAC;IAC7D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,qBAAqB,OAAO,wBAAwB,OAAO,qCAAqC,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;QACtB,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,KAAK,CAAC,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA2B;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA2B,EAAE,OAA0B;IAC/E,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;IAC7D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;IACvD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,kBAAkB,CACvB,MAAM,EACN,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,4DAA4D,IAAI,EAAE,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,yCAAyC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,KAA4B;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,UAAU,CAAC,KAA4B;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IAChG,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,WAA+B;IACzD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,gBAAgB,CAAC,UAA4B;IACpD,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,eAAe,MAAM,GAAG,UAAU,CAAC,IAAI,IAAI,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,gBAAgB,MAAM,GAAG,UAAU,CAAC,IAAI,IAAI,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,UAAU,CAAC,IAAI,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1F,OAAO,gBAAgB,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,gBAAgB,UAAU,CAAC,MAAM,IAAI,WAAW,IAAI,UAAU,CAAC,IAAI,IAAI,EAAE,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,iBAAiB,MAAM,GAAG,UAAU,CAAC,IAAI,IAAI,EAAE,aAAa,UAAU,CAAC,OAAO,kBAAkB,UAAU,CAAC,YAAY,EAAE,CAAC;IACnI,CAAC;IACD,OAAO,GAAG,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/credentials/core/memoize-ttl.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Host-side caching wrapper for credential resolvers.
+ *
+ * Per F4, the SDK convention is "resolvers fire per-dispatch; hosts
+ * memoize via `memoizeTtl` if cost matters." This is that memoizer.
+ *
+ * Default behavior (locked in v4.1):
+ * - Parse `expires_in` from the resolved token's claims when the
+ *   resolver returns an object whose shape carries it.
+ * - Refresh proactively at **90% of TTL** — gives the next caller a
+ *   fresh token before the in-flight window hits expiry.
+ * - Accept an explicit `ttlMs` override when the resolver doesn't
+ *   surface `expires_in` (rare; tests, mock tokens).
+ *
+ * Two shapes supported:
+ *
+ * 1. **Plain string resolver** — `() => Promise<string>`. Caller
+ *    must supply `ttlMs` (the SDK can't infer TTL from an opaque
+ *    string).
+ * 2. **Structured token resolver** — `() => Promise<{ token: string;
+ *    expiresIn?: number }>`. `expiresIn` is parsed as seconds; the
+ *    memoizer refreshes at 90% of that. Callers can still pass
+ *    `ttlMs` to override.
+ */
+export interface MemoizeTtlOptions {
+    /** Explicit TTL in milliseconds. Required for plain-string
+     *  resolvers; optional override for structured-token resolvers
+     *  (defaults to 90% of `expiresIn`). */
+    ttlMs?: number;
+    /** Fraction of TTL to use as the refresh window. Default 0.9. */
+    refreshAtFraction?: number;
+    /**
+     * Per-attempt timeout (ms) on the underlying resolver. Default
+     * 30_000 (30 seconds). If the resolver hangs longer than this,
+     * the in-flight wait rejects with a timeout error and the next
+     * caller can retry afresh — prevents a wedged resolver from
+     * deadlocking every subsequent call.
+     */
+    resolverTimeoutMs?: number;
+}
+/**
+ * Wrap a plain string-returning resolver with TTL memoization.
+ * Callers must supply `ttlMs` since opaque strings carry no
+ * expiry information.
+ */
+export declare function memoizeTtl(resolver: () => Promise<string>, opts: MemoizeTtlOptions & {
+    ttlMs: number;
+}): () => Promise<string>;
+/**
+ * Wrap a structured-token resolver with TTL memoization. The
+ * memoizer parses `expiresIn` (seconds) from the resolver's return
+ * value and refreshes at 90% of TTL by default.
+ */
+export declare function memoizeTtl(resolver: () => Promise<{
+    token: string;
+    expiresIn?: number;
+}>, opts?: MemoizeTtlOptions): () => Promise<string>;
+//# sourceMappingURL=memoize-ttl.d.ts.map

package/dist/credentials/core/memoize-ttl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoize-ttl.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/memoize-ttl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AASH,MAAM,WAAW,iBAAiB;IAChC;;4CAEwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAC/B,IAAI,EAAE,iBAAiB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAEzB;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9D,IAAI,CAAC,EAAE,iBAAiB,GACvB,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC"}

package/dist/credentials/core/memoize-ttl.js

@@ -0,0 +1,88 @@
+/**
+ * Host-side caching wrapper for credential resolvers.
+ *
+ * Per F4, the SDK convention is "resolvers fire per-dispatch; hosts
+ * memoize via `memoizeTtl` if cost matters." This is that memoizer.
+ *
+ * Default behavior (locked in v4.1):
+ * - Parse `expires_in` from the resolved token's claims when the
+ *   resolver returns an object whose shape carries it.
+ * - Refresh proactively at **90% of TTL** — gives the next caller a
+ *   fresh token before the in-flight window hits expiry.
+ * - Accept an explicit `ttlMs` override when the resolver doesn't
+ *   surface `expires_in` (rare; tests, mock tokens).
+ *
+ * Two shapes supported:
+ *
+ * 1. **Plain string resolver** — `() => Promise<string>`. Caller
+ *    must supply `ttlMs` (the SDK can't infer TTL from an opaque
+ *    string).
+ * 2. **Structured token resolver** — `() => Promise<{ token: string;
+ *    expiresIn?: number }>`. `expiresIn` is parsed as seconds; the
+ *    memoizer refreshes at 90% of that. Callers can still pass
+ *    `ttlMs` to override.
+ */
+export function memoizeTtl(resolver, opts = {}) {
+    let entry = null;
+    let inFlight = null;
+    const fraction = opts.refreshAtFraction ?? 0.9;
+    const timeoutMs = opts.resolverTimeoutMs ?? 30_000;
+    return async () => {
+        const now = Date.now();
+        if (entry && entry.refreshAt > now)
+            return entry.value;
+        // Coalesce concurrent refreshes — only one inflight at a time.
+        if (inFlight)
+            return inFlight;
+        inFlight = (async () => {
+            // Race the resolver against a timeout so a hung resolver
+            // can't wedge every subsequent caller. The timer is cleared
+            // either way so we don't keep the process alive.
+            let timerHandle;
+            const timeout = new Promise((_, reject) => {
+                timerHandle = setTimeout(() => {
+                    reject(new Error(`memoizeTtl: resolver did not complete within ${timeoutMs}ms`));
+                }, timeoutMs);
+            });
+            let raw;
+            try {
+                raw = await Promise.race([resolver(), timeout]);
+            }
+            finally {
+                if (timerHandle !== undefined)
+                    clearTimeout(timerHandle);
+            }
+            let token;
+            let ttlMs;
+            if (typeof raw === 'string') {
+                token = raw;
+                if (opts.ttlMs === undefined) {
+                    throw new Error('memoizeTtl: plain-string resolver requires explicit ttlMs');
+                }
+                ttlMs = opts.ttlMs;
+            }
+            else {
+                token = raw.token;
+                ttlMs =
+                    opts.ttlMs ??
+                        (raw.expiresIn !== undefined
+                            ? raw.expiresIn * 1000
+                            : (() => {
+                                throw new Error('memoizeTtl: structured-token resolver returned no expiresIn; pass an explicit ttlMs');
+                            })());
+            }
+            entry = {
+                value: token,
+                refreshAt: Date.now() + Math.floor(ttlMs * fraction),
+            };
+            return token;
+        })();
+        try {
+            return await inFlight;
+        }
+        finally {
+            inFlight = null;
+        }
+    };
+}
+//# sourceMappingURL=memoize-ttl.js.map

package/dist/credentials/core/memoize-ttl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoize-ttl.js","sourceRoot":"","sources":["../../../src/credentials/core/memoize-ttl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA8CH,MAAM,UAAU,UAAU,CACxB,QAE0D,EAC1D,OAA0B,EAAE;IAE5B,IAAI,KAAK,GAAyB,IAAI,CAAC;IACvC,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,GAAG,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC;IAEnD,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QACvD,+DAA+D;QAC/D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,yDAAyD;YACzD,4DAA4D;YAC5D,iDAAiD;YACjD,IAAI,WAAsD,CAAC;YAC3D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/C,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,MAAM,CACJ,IAAI,KAAK,CACP,gDAAgD,SAAS,IAAI,CAC9D,CACF,CAAC;gBACJ,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,IAAI,GAAmD,CAAC;YACxD,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YAClD,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW,KAAK,SAAS;oBAAE,YAAY,CAAC,WAAW,CAAC,CAAC;YAC3D,CAAC;YAED,IAAI,KAAa,CAAC;YAClB,IAAI,KAAa,CAAC;YAClB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,KAAK,GAAG,GAAG,CAAC;gBACZ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;gBAClB,KAAK;oBACH,IAAI,CAAC,KAAK;wBACV,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS;4BAC1B,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI;4BACtB,CAAC,CAAC,CAAC,GAAG,EAAE;gCACJ,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;4BACJ,CAAC,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;YACD,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC;aACrD,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/credentials/core/types.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Project identity plus a fresh-enough Google OAuth token resolver.
+ *
+ * The identity is stable for the lifetime of an operation while token
+ * acquisition remains lazy so long-running commands can refresh credentials.
+ */
+export interface ProjectScope {
+    readonly projectId: string;
+    resolveToken(): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/credentials/core/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/credentials/core/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC"}

package/dist/credentials/core/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/credentials/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/credentials/core/types.ts"],"names":[],"mappings":""}

package/dist/credentials/node/from-adc.d.ts

@@ -0,0 +1,10 @@
+import type { ProjectScope } from '../core/types.js';
+/** The well-known ADC file path (honours CLOUDSDK_CONFIG; %APPDATA% on Windows). */
+export declare function adcWellKnownPath(env?: NodeJS.ProcessEnv): string;
+/**
+ * Build a `ProjectScope` from ADC, or `null` if no ADC file is present. The
+ * project is supplied by the caller — an ADC user credential isn't bound to one
+ * (`--project` / `.firebaserc`).
+ */
+export declare function fromAdc(projectId: string, env?: NodeJS.ProcessEnv, path?: string): Promise<ProjectScope | null>;
+//# sourceMappingURL=from-adc.d.ts.map

package/dist/credentials/node/from-adc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-adc.d.ts","sourceRoot":"","sources":["../../../src/credentials/node/from-adc.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAK7E;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,MAA8B,GACnC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAqC9B"}

package/dist/credentials/node/from-adc.js

@@ -0,0 +1,76 @@
+/**
+ * Application Default Credentials source — the gcloud / workload-identity path,
+ * the modern keyless alternative to a long-lived token. Reads the well-known ADC
+ * file (`gcloud auth application-default login`):
+ *   - `authorized_user` -> refresh-token grant (the common dev case).
+ *   - `service_account` -> delegate to `fromServiceAccount`.
+ * The metadata-server path (GCE / Cloud Run) is a separate fallback, not yet
+ * wired. Node-only (reads disk) -> lives in node/.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { memoizeTtl } from '../core/memoize-ttl.js';
+import { fromServiceAccount } from './from-service-account.js';
+const GOOGLE_TOKEN_URI = 'https://oauth2.googleapis.com/token';
+/** The well-known ADC file path (honours CLOUDSDK_CONFIG; %APPDATA% on Windows). */
+export function adcWellKnownPath(env = process.env) {
+    const base = env.CLOUDSDK_CONFIG ??
+        (process.platform === 'win32' && env.APPDATA ? join(env.APPDATA, 'gcloud') : join(homedir(), '.config', 'gcloud'));
+    return join(base, 'application_default_credentials.json');
+}
+/**
+ * Build a `ProjectScope` from ADC, or `null` if no ADC file is present. The
+ * project is supplied by the caller — an ADC user credential isn't bound to one
+ * (`--project` / `.firebaserc`).
+ */
+export async function fromAdc(projectId, env = process.env, path = adcWellKnownPath(env)) {
+    let raw;
+    try {
+        raw = await readFile(path, 'utf-8');
+    }
+    catch {
+        return null; // no ADC file
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.type === 'authorized_user' && parsed.client_id && parsed.client_secret && parsed.refresh_token) {
+        const clientId = parsed.client_id;
+        const clientSecret = parsed.client_secret;
+        const refreshToken = parsed.refresh_token;
+        const resolveToken = memoizeTtl(async () => {
+            const { access_token, expires_in } = await exchangeAdcRefreshToken(clientId, clientSecret, refreshToken);
+            return { token: access_token, expiresIn: expires_in };
+        });
+        return Object.freeze({ projectId, resolveToken });
+    }
+    if (parsed.type === 'service_account') {
+        const sa = await fromServiceAccount(raw); // fromServiceAccount accepts a raw JSON string
+        return projectId && projectId !== sa.projectId
+            ? Object.freeze({ projectId, resolveToken: sa.resolveToken })
+            : sa;
+    }
+    return null; // unknown ADC type (e.g. external_account) — not supported here
+}
+async function exchangeAdcRefreshToken(clientId, clientSecret, refreshToken) {
+    const response = await fetch(GOOGLE_TOKEN_URI, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: clientId,
+            client_secret: clientSecret,
+            refresh_token: refreshToken,
+            grant_type: 'refresh_token',
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`pyric: Application Default Credentials token exchange failed (${response.status}): ${await response.text()}`);
+    }
+    return (await response.json());
+}
+//# sourceMappingURL=from-adc.js.map

package/dist/credentials/node/from-adc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-adc.js","sourceRoot":"","sources":["../../../src/credentials/node/from-adc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,IAAI,GACR,GAAG,CAAC,eAAe;QACnB,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrH,OAAO,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAe,gBAAgB,CAAC,GAAG,CAAC;IAEpC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,cAAc;IAC7B,CAAC;IACD,IAAI,MAA6F,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1G,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,uBAAuB,CAChE,QAAQ,EACR,YAAY,EACZ,YAAY,CACb,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,+CAA+C;QACzF,OAAO,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,SAAS;YAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,gEAAgE;AAC/E,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,eAAe;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,iEAAiE,QAAQ,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;AACjF,CAAC"}