@pyric/cli 0.1.0-alpha.9

package/dist/serve/worker/host-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-auth.js","sourceRoot":"","sources":["../../../src/serve/worker/host-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAA+B,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EACL,OAAO,EACP,OAAO,IAAI,cAAc,GAI1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,aAAa,GAGd,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAElE,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,OAAO,EAAgE,CAAC;AAE9F,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC9B,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC;IAC7D,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,IAAc;IACtD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,IAAc,EAAE,OAA6B;IACjF,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAExC,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,gEAAgE;IAChE,GAAG,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC;IAEhC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,wBAAwB,CAC/B,GAAY,EACZ,IAAc,EACd,OAAsB,EACtB,MAA+B;IAE/B,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAEpC,mEAAmE;IACnE,2EAA2E;IAC3E,yDAAyD;IACzD,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;IACxB,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;IAC1B,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC;IAE7B,uEAAuE;IACvE,0EAA0E;IAC1E,0DAA0D;IAC1D,GAAG,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,IAAc;IAC7D,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,6EAA6E;AAE7E,kEAAkE;AAClE,SAAS,SAAS,CAAC,OAAsB,EAAE,UAAyB;IAClE,OAAO;QACL,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,UAAU;QACV,aAAa,EAAE,QAAiB;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,IAAc,EAAE,GAAc;IAC7E,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE7B,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC/C,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBACjE,CAAC,CAAC;gBACH,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACnC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,yCAAyC;gBACrE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC/C,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBAC3D,CAAC,CAAC;gBACH,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACnC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,mEAAmE;gBACnE,+DAA+D;gBAC/D,0DAA0D;gBAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1C,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;oBAC5C,MAAM;gBACR,CAAC;gBACD,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxE,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACnC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,0CAA0C;gBACtE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,sEAAsE;YACtE,uEAAuE;YACvE,IAAI,CAAC;gBACH,IAAI,OAAO,GAAyB,IAAI,CAAC;gBACzC,IAAI,CAAC;oBACH,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,OAAO;oBAAE,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAChD,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;gBAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;gBAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACtD,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;oBAClD,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC9D,CAAC;gBACD,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,uBAAuB,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;gBAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;gBAC1B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACxD,IAAI,GAAG,CAAC,YAAY;oBAAE,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7E,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;oBACf,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,cAAc,EAAE,CAAC,CAAC,cAAc;oBAChC,YAAY,EAAE,CAAC,CAAC,YAAY;oBAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;iBACzC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,oEAAoE;YACpE,uEAAuE;YACvE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;YAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACvC,IAAI,CAAC,OAAO;oBAAE,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC;gBACrD,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACzE,cAAc,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC9D,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1C,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,qEAAqE;YACrE,iEAAiE;YACjE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC3E,cAAc,CAAC,yBAAyB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAC3D,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;wBAC9B,GAAG;wBACH,KAAK,EAAE,KAAK,IAAI,EAAE;wBAClB,QAAQ,EAAE,2BAA2B;wBACrC,WAAW,EAAE,WAAW,IAAI,SAAS;wBACrC,YAAY,EAAE,YAAY,IAAI,EAAE;wBAChC,UAAU;qBACX,CAAC,CAAC,CAAC;gBACJ,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvE,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACnC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,2CAA2C;gBACvE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,wDAAwD;YACxD,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CACvC,IAAI,EACJ,GAAG,CAAC,OAA0D,CAC/D,CAAC;gBACF,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CACvC,IAAI,EACJ,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,OAA0D,CAC/D,CAAC;gBACF,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;gBACzC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAChC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC3B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,8DAA8D;YAC9D,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACH,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACxE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YACtC,MAAM;QACR,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAE,GAA2B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAS,kBAAkB,CAAC,GAAY,EAAE,IAAc,EAAE,GAAW;IACnE,OAAO,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,IAAc,EAAE,GAAW;IACnE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CACzB,IAAU,EACV,OAAkE;IAElE,MAAM,OAAO,GAAG,IAAgD,CAAC;IACjE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACjF,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAE1B,CAAC;IACd,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACnF,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,GAAG,iCAAiC,CAA6B,CAAC;IAC3F,GAAG,CAAC,IAAI,GAAG,sBAAsB,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAA2B;IAClD,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAE7E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,IAAc,EAAE,GAAmB;IAC7E,UAAU,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,aAAa;IACjD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEnC,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,IAAc,EAAE,KAAa;IACzE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/serve/worker/host-context.d.ts

@@ -0,0 +1,220 @@
+/**
+ * SharedWorker host — shared foundation (context + reply helpers).
+ *
+ * The `HostCtx` is the single per-worker context shared across ALL connected
+ * ports and across the auth + event-stream subsystems. `PortLike`, `post`,
+ * `ok`, and `fail` are the minimal port + reply primitives every subsystem
+ * uses. This module imports NOTHING from the sibling `host-*` files, so it is
+ * the dependency root (no circular imports).
+ */
+import type { Firestore } from 'pyric/firestore';
+import type { Database } from 'pyric/database';
+import type { LocalSandbox, PersistenceBackend } from 'pyric/sandbox';
+import type { Auth, MintedSession } from 'pyric/auth';
+import type { FirebaseStorage } from 'pyric/storage';
+import { type OutboundMessage, type AuthPersistenceMode, type AiEngineConfigWire } from './protocol.js';
+/**
+ * The worker host's view of `pyric/ai`'s `AiBroker` — the in-process
+ * Gemini-wire answer seam (cdd-deltas #98.1: the broker lives with the
+ * sandbox, i.e. HERE in the serve worker host). Structural because the
+ * `AiBroker` class is not exported from `pyric/ai`'s public surface; the
+ * host recovers the instance from a `getAI(sandbox)` handle via
+ * `TARGET_SYMBOL` (see host-ai.ts). Requests/responses are the plain
+ * Gemini-wire JSON the protocol's ai ops carry.
+ */
+export interface AiBrokerLike {
+    generateContent(req: Record<string, unknown>, model: string): Promise<Record<string, unknown>>;
+    streamGenerateContent(req: Record<string, unknown>, model: string): AsyncIterable<Record<string, unknown>>;
+    countTokens(req: Record<string, unknown>, model: string): Promise<Record<string, unknown>>;
+}
+/** Minimal postMessage interface. Fake ports in tests implement this. */
+export interface PortLike {
+    postMessage(msg: OutboundMessage): void;
+}
+export interface HostCtx {
+    /** The single shared Firestore handle (sandbox-live — reads currentUser per op). */
+    db: Firestore;
+    /** The underlying Sandbox, for setRules + direct sandbox ops. */
+    sandbox: LocalSandbox;
+    /** Stable per-SharedWorker instance id (see {@link INSTANCE_ID_KEY}). Reported
+     *  via `getVersion` so the UI can identify which sandbox instance this is. */
+    instanceId: string;
+    /** The shared Storage handle (Pyric Studio data browse). Lazily created on
+     *  the first storage op via `getStorageSandbox(sandbox)`. */
+    storage?: FirebaseStorage;
+    /** Shared RTDB handle. Lazily created for the playground shared-runtime path. */
+    rtdb?: Database;
+    /** Cached admin (rules-bypass) RTDB handle for Studio/Playground data inspection. */
+    adminRtdb?: Database;
+    /** Cached admin (rules-bypass) Storage handle for the `{ mode: 'admin' }`
+     *  lens — `pyric/storage/internal`'s `getAdminStorageSandbox`, the handle
+     *  the pyric-admin remote arm's storage ops resolve to. */
+    adminStorage?: FirebaseStorage;
+    /** Per-uid/token Storage handles for the impersonation lens (rules evaluate
+     *  as that user). Mirrors {@link HostCtx.lensRtdbs}. */
+    lensStorages?: Map<string, FirebaseStorage>;
+    /** Per-session Storage handles so app-session rules see the initiating
+     * port's authenticated identity. */
+    sessionStorages?: Map<string, FirebaseStorage>;
+    /** Cached genuinely-UNAUTHENTICATED Firestore handle for the
+     *  `{ mode: 'anon' }` lens — `getFirestore(sandbox.withAuth(null))`, so
+     *  rules evaluate with `request.auth == null`. The remote arm's
+     *  `withAuth(null)`; distinct from an absent lens (the port's session). */
+    anonDb?: Firestore;
+    /** Cached unauthenticated RTDB handle for the `{ mode: 'anon' }` lens. */
+    anonRtdb?: Database;
+    /** Cached unauthenticated Storage handle for the `{ mode: 'anon' }` lens. */
+    anonStorage?: FirebaseStorage;
+    /** Per-uid RTDB handles carrying a port session's real identity. */
+    sessionRtdbs?: Map<string, Database>;
+    /** Per-uid/token RTDB handles for the Studio impersonation lens. */
+    lensRtdbs?: Map<string, Database>;
+    /** Current active rules metadata for shared-runtime diagnostics and revert. */
+    activeRules?: {
+        firestore?: ActiveRulesState;
+        database?: ActiveRulesState;
+    };
+    /** Per-port subscription registry. Map<port, Map<subId, unsub>>. */
+    subs: Map<PortLike, Map<string, () => void>>;
+    /** Ports whose app containers completed explicit deletion. */
+    disconnectedPorts?: WeakSet<PortLike>;
+    /** Firebase options accepted by the first app-owned port. All named apps
+     * and tabs share this one backend, so later app ports must match it. */
+    appOptions?: Record<string, unknown>;
+    /** App ports that attempted to attach a different Firebase configuration. */
+    rejectedConfigPorts?: WeakSet<PortLike>;
+    /**
+     * The ONE shared auth handle for the worker — the USER POOL (who exists)
+     * and the admin surface. Lazily created on first auth op or auth
+     * subscription. Sessions (who a connection IS) are per-port: see
+     * {@link HostCtx.portSessions} (#754). The handle's own `currentUser`
+     * stays null in served mode.
+     */
+    auth?: Auth;
+    /**
+     * Per-connection identity (#754): each port's signed-in session, minted
+     * via `sandbox.mintSession` (an authentic session — validated
+     * credentials / a really-minted identity, NOT the impersonation lens).
+     * A port absent from the map, or mapped to null, is signed out. The
+     * user pool + data + rules stay shared across ports.
+     */
+    portSessions?: Map<PortLike, MintedSession | null>;
+    /**
+     * Re-establish a port's session-bound Firestore listeners under its NEW
+     * session (#754) — set lazily by host.ts (which owns subs) and invoked by
+     * host-auth.ts on every port session change, mirroring prod's stream
+     * re-establishment on auth transitions: a sign-out re-evaluates live
+     * listeners so an auth-gated stream loses access instead of leaking the
+     * previous user's data. (A ctx hook, not an import — host-auth must not
+     * import host.ts.)
+     */
+    resubscribePortSubs?: (port: PortLike) => void;
+    /**
+     * Per-session-token Firestore handles carrying a PORT SESSION's identity —
+     * `getFirestore(sandbox.withAuth(session.state))`, so rules see the
+     * session's uid AND its custom claims on `request.auth.token`. Keyed by
+     * uid + token so distinct claim snapshots never share a handle; forced
+     * refresh also clears the cache. Distinct from
+     * {@link HostCtx.lensHandles}, which is the Studio debugging lens
+     * (uid-only, caller-gated writes).
+     */
+    sessionDbs?: Map<string, Firestore>;
+    /**
+     * The backend used for named state branches (save/switch). Session
+     * persistence is NOT here anymore: per-tab sessions persist client-side
+     * in web storage (the page restores via `auth.restorePortSession`),
+     * mirroring how the real SDK owns persistence in the client (#754).
+     */
+    sessionBackend?: PersistenceBackend;
+    /**
+     * Accepted `auth.setPersistence` mode, kept for surface parity. The
+     * worker itself no longer writes a session record — the CLIENT's
+     * SessionStore honors the mode (which web storage slot, or none).
+     */
+    sessionMode?: AuthPersistenceMode;
+    /**
+     * Per-uid impersonation Firestore handles (Pyric Studio auth lens, T2).
+     * Keyed by the impersonated uid. Each is a FROZEN-identity
+     * `getFirestore(sandbox.withAuth({ uid }))` handle whose ops evaluate
+     * security rules AS that user — the rules-debugging primitive. Cached so
+     * repeated `{ mode: 'as', uid }` ops reuse one handle (and so the modular
+     * layer's per-ctx ref cache stays warm). Lazily populated by `lensDb`.
+     */
+    lensHandles?: Map<string, Firestore>;
+    /**
+     * Cached admin (rules-bypass) Firestore handle for the `{ mode: 'admin' }`
+     * lens (Pyric Studio, Gap #2). A modular `getAdminFirestore(sandbox)` handle
+     * whose ops skip security-rule evaluation — Studio's "edit anything as admin"
+     * (F2). Lazily populated by `lensDb`.
+     */
+    adminDb?: Firestore;
+    /**
+     * The sandbox's AiBroker (pyric/ai), lazily created on the first ai op /
+     * ai stream sub via `getAI(ctx.sandbox, …)` — so the worker's broker IS the
+     * mirror's per-sandbox broker (one instance, events land on the shared
+     * sandbox's unified stream). See `ensureAiBroker` in host-ai.ts.
+     */
+    aiBroker?: AiBrokerLike;
+    /**
+     * Host-construction engine config for the AI broker (cdd-deltas #98.4).
+     * When set (embedding/test hosts, or serve wiring), it WINS over any
+     * op-carried `engine` field; absent, the first ai op's `engine` field is
+     * honored; both absent ⇒ the zero-config scripted default.
+     */
+    aiEngine?: AiEngineConfigWire;
+    /**
+     * Lazily-built agent tool dispatcher (the canonical sandbox tool set) bound to
+     * THIS worker's sandbox. The bridge peer forwards `tool` messages here so the
+     * agent executes against the one shared sandbox, not a separate in-page
+     * backend. Cached so the handler array is built once.
+     */
+    toolDispatch?: (name: string, args: Record<string, unknown>) => Promise<{
+        ok: boolean;
+        summary: string;
+        data?: unknown;
+    }>;
+    /**
+     * Messaging host capability. Normal serve producers enable it because
+     * Messaging is in the canonical SDK swap. Absent/false answers
+     * `messaging/disabled` for standalone host construction and focused tests.
+     */
+    messagingEnabled?: boolean;
+    /**
+     * Per-port broker client ids (the worker-host seam's visibility mapping):
+     * a port that reports `messaging.setVisibility` becomes ONE window client
+     * in the broker, so the captured routing rule — foreground iff ANY visible
+     * client — spans tabs. `cleanupPort` removes the client so a closed tab
+     * stops counting as visible. Lazily populated by host-messaging.ts.
+     */
+    messagingClients?: Map<PortLike, string>;
+}
+export interface ActiveRulesState {
+    source: unknown;
+    updatedAt: number;
+    status: 'active' | 'error';
+    messages: Array<{
+        severity: 'info' | 'warn' | 'error';
+        text: string;
+        line?: number;
+        column?: number;
+    }>;
+    lastKnownGood?: unknown;
+}
+export declare function post(port: PortLike, msg: OutboundMessage): void;
+export declare function ok(port: PortLike, id: string, value: unknown): void;
+export declare function fail(port: PortLike, id: string, err: unknown): void;
+/**
+ * Await a persistence flush BEFORE acking a mutating op, so an acknowledged
+ * write is durable in IndexedDB when the reply reaches the client. This is
+ * the worker's ONLY durability mechanism: there is no beforeterminate-style
+ * event for a SharedWorker, so a teardown on last-tab close/reload can kill
+ * the worker inside the controller's debounce window — an un-flushed write
+ * would be silently lost (the reload-durability bug).
+ *
+ * "Best-effort" refers to the REPLY, not the flush: a flush failure (e.g.
+ * storage quota) must not turn a successful in-memory mutation into a wire
+ * error, but it IS logged — a silently swallowed flush failure is exactly
+ * how a broken flush contract stays invisible.
+ */
+export declare function bestEffortFlush(ctx: HostCtx): Promise<void>;
+//# sourceMappingURL=host-context.d.ts.map

package/dist/serve/worker/host-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-context.d.ts","sourceRoot":"","sources":["../../../src/serve/worker/host-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAIvB;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/F,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5F;AAID,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;CACzC;AAID,MAAM,WAAW,OAAO;IACtB,oFAAoF;IACpF,EAAE,EAAE,SAAS,CAAC;IACd,iEAAiE;IACjE,OAAO,EAAE,YAAY,CAAC;IACtB;kFAC8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB;iEAC6D;IAC7D,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB;;+DAE2D;IAC3D,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B;4DACwD;IACxD,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;wCACoC;IACpC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C;;;+EAG2E;IAC3E,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,oEAAoE;IACpE,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrC,oEAAoE;IACpE,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,+EAA+E;IAC/E,WAAW,CAAC,EAAE;QACZ,SAAS,CAAC,EAAE,gBAAgB,CAAC;QAC7B,QAAQ,CAAC,EAAE,gBAAgB,CAAC;KAC7B,CAAC;IACF,oEAAoE;IACpE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;IAC7C,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC;4EACwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC,CAAC;IACnD;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IAC/C;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/D;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC3B,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,wBAAgB,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,GAAG,IAAI,CAE/D;AAED,wBAAgB,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEnE;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAInE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE"}

package/dist/serve/worker/host-context.js

@@ -0,0 +1,45 @@
+/**
+ * SharedWorker host — shared foundation (context + reply helpers).
+ *
+ * The `HostCtx` is the single per-worker context shared across ALL connected
+ * ports and across the auth + event-stream subsystems. `PortLike`, `post`,
+ * `ok`, and `fail` are the minimal port + reply primitives every subsystem
+ * uses. This module imports NOTHING from the sibling `host-*` files, so it is
+ * the dependency root (no circular imports).
+ */
+import { serializeError, } from './protocol.js';
+// ─── Utility: post a typed reply to a port ───────────────────────────────
+export function post(port, msg) {
+    port.postMessage(msg);
+}
+export function ok(port, id, value) {
+    post(port, { t: 'res', id, ok: true, value });
+}
+export function fail(port, id, err) {
+    // The serialized error carries `denialContext` when present (spike gap 6) —
+    // post it whole so the structured denial frame reaches remote consumers.
+    post(port, { t: 'res', id, ok: false, error: serializeError(err) });
+}
+/**
+ * Await a persistence flush BEFORE acking a mutating op, so an acknowledged
+ * write is durable in IndexedDB when the reply reaches the client. This is
+ * the worker's ONLY durability mechanism: there is no beforeterminate-style
+ * event for a SharedWorker, so a teardown on last-tab close/reload can kill
+ * the worker inside the controller's debounce window — an un-flushed write
+ * would be silently lost (the reload-durability bug).
+ *
+ * "Best-effort" refers to the REPLY, not the flush: a flush failure (e.g.
+ * storage quota) must not turn a successful in-memory mutation into a wire
+ * error, but it IS logged — a silently swallowed flush failure is exactly
+ * how a broken flush contract stays invisible.
+ */
+export async function bestEffortFlush(ctx) {
+    try {
+        await ctx.sandbox.flush?.();
+    }
+    catch (e) {
+        // eslint-disable-next-line no-console
+        console.warn('[pyric worker] persistence flush after acked write failed:', e);
+    }
+}
+//# sourceMappingURL=host-context.js.map

package/dist/serve/worker/host-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-context.js","sourceRoot":"","sources":["../../../src/serve/worker/host-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EACL,cAAc,GAIf,MAAM,eAAe,CAAC;AAiMvB,4EAA4E;AAE5E,MAAM,UAAU,IAAI,CAAC,IAAc,EAAE,GAAoB;IACvD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,IAAc,EAAE,EAAU,EAAE,KAAc;IAC3D,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAc,EAAE,EAAU,EAAE,GAAY;IAC3D,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAY;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,4DAA4D,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/serve/worker/host-events.d.ts

@@ -0,0 +1,21 @@
+/**
+ * SharedWorker host — event-stream subsystem (Pyric Studio keystone).
+ *
+ * Surfaces the sandbox's unified cross-service `onEvent`/`history()` stream over
+ * the port so Studio's Action Center / traffic / rules-debug denial feed see
+ * real activity. Imports only from `./host-context.js` + external packages (no
+ * circular imports).
+ */
+import { type HostCtx, type PortLike } from './host-context.js';
+import type { EventSubMessage } from './protocol.js';
+export declare function eventSubsFor(ctx: HostCtx): Map<PortLike, Set<string>>;
+/**
+ * Register an event-stream subscription for a port (Pyric Studio keystone).
+ * Records the (port, subId) so live events reach it, ensures the single real
+ * sandbox subscription is wired, and immediately delivers `sandbox.history()`
+ * (every event so far) as the initial batch — so a late subscriber folds the
+ * full backlog then streams uniformly (mirrors `onEvent` + `history`).
+ */
+export declare function handleEventSub(ctx: HostCtx, port: PortLike, msg: EventSubMessage): void;
+export declare function handleEventUnsub(ctx: HostCtx, port: PortLike, subId: string): boolean;
+//# sourceMappingURL=host-events.d.ts.map

package/dist/serve/worker/host-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-events.d.ts","sourceRoot":"","sources":["../../../src/serve/worker/host-events.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAQ,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAoBrD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAOrE;AA0BD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,GAAG,IAAI,CAavF;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAOrF"}

package/dist/serve/worker/host-events.js

@@ -0,0 +1,87 @@
+/**
+ * SharedWorker host — event-stream subsystem (Pyric Studio keystone).
+ *
+ * Surfaces the sandbox's unified cross-service `onEvent`/`history()` stream over
+ * the port so Studio's Action Center / traffic / rules-debug denial feed see
+ * real activity. Imports only from `./host-context.js` + external packages (no
+ * circular imports).
+ */
+import { post } from './host-context.js';
+// ─── Event-stream subscription (Pyric Studio keystone) ─────────────────────
+//
+// Surfaces the sandbox's unified cross-service `onEvent`/`history()` stream over
+// the port so Studio's Action Center / traffic / rules-debug denial feed see
+// real activity. Architecture mirrors the AUTH fan-out: ONE real
+// `sandbox.onEvent` subscription per worker (lazily wired in {@link ensureEventStream}),
+// and a per-port routing registry telling the host which ports want events. On
+// any event the single sandbox subscription fires once and we fan it out to
+// EVERY subscribed port — so multiple Studio/app tabs share the one backend
+// stream. Events are plain JSON (no codec round-trip; see EventSubMessage).
+/** Per-port event-stream subscription registry. Map<port, Set<subId>>. The
+ *  WeakMap is keyed by ctx so multiple in-process hosts (tests) don't collide. */
+const _eventSubs = new WeakMap();
+/** Tracks whether the single real `sandbox.onEvent` subscription is wired. */
+const _eventStreamWired = new WeakSet();
+export function eventSubsFor(ctx) {
+    let m = _eventSubs.get(ctx);
+    if (!m) {
+        m = new Map();
+        _eventSubs.set(ctx, m);
+    }
+    return m;
+}
+/**
+ * Lazily wire the ONE real `sandbox.onEvent` subscription for this ctx. On every
+ * sandbox event it fans the event out (as a single-element batch) to every port
+ * subscribed to the stream. Idempotent — only the first event sub wires it; the
+ * subscription then lives for the worker's lifetime (cheap, observational).
+ */
+function ensureEventStream(ctx) {
+    if (_eventStreamWired.has(ctx))
+        return;
+    _eventStreamWired.add(ctx);
+    ctx.sandbox.onEvent((event) => {
+        broadcastEvents(ctx, [event]);
+    });
+}
+/** Fan a batch of events out to every port subscribed to the event stream. */
+function broadcastEvents(ctx, events) {
+    const subs = eventSubsFor(ctx);
+    for (const [port, subIds] of subs) {
+        for (const subId of subIds) {
+            post(port, { t: 'event', subId, events });
+        }
+    }
+}
+/**
+ * Register an event-stream subscription for a port (Pyric Studio keystone).
+ * Records the (port, subId) so live events reach it, ensures the single real
+ * sandbox subscription is wired, and immediately delivers `sandbox.history()`
+ * (every event so far) as the initial batch — so a late subscriber folds the
+ * full backlog then streams uniformly (mirrors `onEvent` + `history`).
+ */
+export function handleEventSub(ctx, port, msg) {
+    ensureEventStream(ctx);
+    const subs = eventSubsFor(ctx);
+    let subIds = subs.get(port);
+    if (!subIds) {
+        subIds = new Set();
+        subs.set(port, subIds);
+    }
+    if (subIds.has(msg.subId))
+        return; // idempotent
+    subIds.add(msg.subId);
+    // Initial fire: the full history snapshot (a defensive copy from the sandbox).
+    post(port, { t: 'event', subId: msg.subId, events: ctx.sandbox.history() });
+}
+export function handleEventUnsub(ctx, port, subId) {
+    const subs = eventSubsFor(ctx);
+    const subIds = subs.get(port);
+    if (!subIds || !subIds.has(subId))
+        return false;
+    subIds.delete(subId);
+    if (subIds.size === 0)
+        subs.delete(port);
+    return true;
+}
+//# sourceMappingURL=host-events.js.map

package/dist/serve/worker/host-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-events.js","sourceRoot":"","sources":["../../../src/serve/worker/host-events.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAA+B,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAItE,8EAA8E;AAC9E,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,iEAAiE;AACjE,yFAAyF;AACzF,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAE5E;kFACkF;AAClF,MAAM,UAAU,GAAG,IAAI,OAAO,EAAuC,CAAC;AAEtE,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAAW,CAAC;AAEjD,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QACd,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACvC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5B,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,GAAY,EAAE,MAA+B;IACpE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,IAAc,EAAE,GAAoB;IAC/E,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,aAAa;IAChD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEtB,+EAA+E;IAC/E,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,IAAc,EAAE,KAAa;IAC1E,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/serve/worker/host-messaging.d.ts

@@ -0,0 +1,60 @@
+/**
+ * SharedWorker host — messaging subsystem: the broker's documented
+ * worker-host seam, wired (see `pyric/src/messaging/broker/broker.ts`
+ * header — each public broker method is one `messaging.*` op here).
+ *
+ * ONE broker per sandbox (`getMessagingBroker`), shared by every port —
+ * production's one-service-worker-per-origin model. Two seams cross the
+ * transport:
+ *
+ *   OPS   token lifecycle (`getToken`/`deleteToken`), the send plane
+ *         (`send`, topic management), the delivery driver (`deliver`), and
+ *         visibility (`setVisibility`). Send-plane rejections carry the
+ *         broker's captured google.rpc envelope VERBATIM on
+ *         `error.envelope` (plain JSON, structured-clone-safe).
+ *
+ *   SUBS  `messaging.foreground` / `messaging.background` register real
+ *         broker handlers whose payloads forward to the subscribing port as
+ *         snaps. Unsubs ride the ordinary `ctx.subs` registry, so
+ *         `cleanupPort` tears them down like Firestore listeners.
+ *
+ * PER-PORT VISIBILITY — the captured routing rule crossing the transport:
+ * each port that reports `messaging.setVisibility` is ONE window client in
+ * the broker (`setClientVisibility(portId, state)` on the page's
+ * `visibilitychange`). A hidden tab's port marks its client not-visible;
+ * routing is foreground iff ANY visible client (oracle:
+ * `messaging-web-visibility-routing` — visibility, never focus). Port close
+ * removes the client so a dead tab cannot pin foreground routing.
+ *
+ * HOST CAPABILITY GATE: ops exist only when the ctx was built with
+ * `messagingEnabled: true`. Both serve producers enable it because Messaging
+ * is part of the canonical Firebase SDK swap. The disabled path remains for
+ * standalone host construction and focused tests.
+ *
+ * Imports only from `./host-context.js` + external packages (host-auth
+ * precedent — no circular imports).
+ */
+import { type HostCtx, type PortLike } from './host-context.js';
+import type { OpMessage, MessagingSubMessage } from './protocol.js';
+/** Registration id used when a `messaging.getToken`/`deleteToken` op names
+ *  none — the transport twin of the mirrors' module-default registration. */
+export declare const DEFAULT_WIRE_REGISTRATION_ID = "swreg-port-default";
+/** Is this op method part of the messaging surface? (Routing predicate for
+ *  handleMessage — the auth-op precedent.) */
+export declare function isMessagingOp(method: string): boolean;
+export declare function handleMessagingOp(ctx: HostCtx, port: PortLike, msg: OpMessage): Promise<void>;
+/**
+ * Register a foreground/background delivery listener for this port. The
+ * broker handler's unsub goes into the ordinary `ctx.subs` registry, so the
+ * generic unsub path and `cleanupPort` both tear it down. Payloads are plain
+ * JSON (`DeliveredPayload`) — no codec round-trip.
+ */
+export declare function handleMessagingSub(ctx: HostCtx, port: PortLike, msg: MessagingSubMessage): void;
+/**
+ * Drop a disconnected port's broker client so its last-reported visibility
+ * stops feeding the routing rule (a closed visible tab must not pin
+ * foreground routing forever). Handler subs are NOT touched here — they
+ * live in `ctx.subs`, which `cleanupPort` already tears down.
+ */
+export declare function cleanupPortMessaging(ctx: HostCtx, port: PortLike): void;
+//# sourceMappingURL=host-messaging.d.ts.map

package/dist/serve/worker/host-messaging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-messaging.d.ts","sourceRoot":"","sources":["../../../src/serve/worker/host-messaging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAKH,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAkB,MAAM,mBAAmB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpE;6EAC6E;AAC7E,eAAO,MAAM,4BAA4B,uBAAuB,CAAC;AAYjE;8CAC8C;AAC9C,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAErD;AAqDD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,IAAI,CAAC,CAyEf;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAoB/F;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,CAKvE"}