pyric 0.1.0-alpha.30.1 → 0.1.0-alpha.30.2

package/dist/ai/app-check-gate.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Firebase AI Logic's App Check gate, as the sandbox plays it.
+ *
+ * From November 2, 2026 AI Logic requires App Check on every project. A
+ * request with no `X-Firebase-AppCheck` header, a malformed one, the web SDK's
+ * placeholder token, or a token whose signature fails gets HTTP 403
+ * `PERMISSION_DENIED` (capture `app-check-ai-gate-wire`, `noHeader.raw`), and
+ * a valid token answers. The sandbox broker refuses the same requests with the
+ * same envelope before any engine runs.
+ *
+ * The App Check claim a request carries comes from the handle: `getAI(app)`
+ * reads the app's App Check activation when it builds the handle, as the SDK's
+ * AI service reads the provider it was constructed with, so a handle built
+ * before `initializeAppCheck` never attaches a token (capture
+ * `app-check-client-get-token-before-initialize`). Handles with no app
+ * (`getAI(sandbox)`, `createConfiguredSandboxAI`) carry no claim and are not
+ * gated: production has no such handle.
+ *
+ * The error the app gets stays production's. Pyric's guidance rides beside
+ * it: on the `request_rejected` event the dev server prints, and once per app
+ * as a `console.warn` in the page or process.
+ */
+import type { FirebaseApp } from '../app/types.js';
+import type { AppCheckClaim, WireErrorEnvelope } from './broker/types.js';
+/** Production's message for a refused request (capture `app-check-ai-gate-wire`), verbatim. */
+export declare const APP_CHECK_REQUIRED_MESSAGE = "Firebase AI Logic has been deactivated in this project. To resume using Firebase AI Logic, you must enforce Firebase App Check. Learn more: https://firebase.google.com/docs/ai-logic/app-check";
+/** Pyric's guidance, printed beside production's error, never in place of it. */
+export declare const APP_CHECK_HINT = "Firebase AI Logic refuses requests without an App Check token, and so does the sandbox. Call initializeAppCheck(app, { provider }) before getAI(app). For local development, set self.FIREBASE_APPCHECK_DEBUG_TOKEN = true before initializeAppCheck to use the debug provider; the sandbox accepts its tokens. https://firebase.google.com/docs/ai-logic/app-check";
+/** The captured refusal envelope (`app-check-ai-gate-wire`, `noHeader.raw`). */
+export declare function appCheckRequired(): WireErrorEnvelope;
+/**
+ * Whether AI Logic would accept this token: one the sandbox signed (the web
+ * mirror or `pyric-admin` minted it) that has not expired. A missing,
+ * malformed, placeholder, tampered, or expired token is refused.
+ */
+export declare function admitsAppCheckToken(token: string | null, nowMillis?: number): Promise<boolean>;
+/** Whether an error is this gate's refusal, as the broker throws it or the SDK error it becomes. */
+export declare function isAppCheckRefusal(error: unknown): boolean;
+/** What an app-backed handle attaches to every request. */
+export interface AppCheckAttachment {
+    /** The claim this request carries: a token, or `null` when the handle has none. */
+    claim(): Promise<AppCheckClaim>;
+    /** Log pyric's guidance once for this app, after the gate refused one of its requests. */
+    warnRefused(): void;
+}
+/**
+ * The attachment for a handle `getAI(app)` builds now. App Check is read once,
+ * here: a handle built before `initializeAppCheck` never attaches a token.
+ * With `useLimitedUseAppCheckTokens`, each request takes a fresh limited-use
+ * token.
+ */
+export declare function appCheckAttachmentFor(app: FirebaseApp, limitedUse: boolean): AppCheckAttachment;
+//# sourceMappingURL=app-check-gate.d.ts.map

package/dist/ai/app-check-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check-gate.d.ts","sourceRoot":"","sources":["../../src/ai/app-check-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE1E,+FAA+F;AAC/F,eAAO,MAAM,0BAA0B,oMAC4J,CAAC;AAEpM,iFAAiF;AACjF,eAAO,MAAM,cAAc,wWAC4U,CAAC;AAKxW,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,iBAAiB,CAEpD;AAOD;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,GAAE,MAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhH;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASzD;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAChC,0FAA0F;IAC1F,WAAW,IAAI,IAAI,CAAC;CACrB;AAUD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,GAAG,kBAAkB,CAM/F"}

package/dist/ai/app-check-gate.js

@@ -0,0 +1,65 @@
+import { appCheckActivationOf, appCheckTokenFor } from '../sandbox/internal/app-check-activation.js';
+import { checkAppCheckToken } from '../sandbox/internal/app-check-token.js';
+/** Production's message for a refused request (capture `app-check-ai-gate-wire`), verbatim. */
+export const APP_CHECK_REQUIRED_MESSAGE = 'Firebase AI Logic has been deactivated in this project. To resume using Firebase AI Logic, you must enforce Firebase App Check. Learn more: https://firebase.google.com/docs/ai-logic/app-check';
+/** Pyric's guidance, printed beside production's error, never in place of it. */
+export const APP_CHECK_HINT = 'Firebase AI Logic refuses requests without an App Check token, and so does the sandbox. Call initializeAppCheck(app, { provider }) before getAI(app). For local development, set self.FIREBASE_APPCHECK_DEBUG_TOKEN = true before initializeAppCheck to use the debug provider; the sandbox accepts its tokens. https://firebase.google.com/docs/ai-logic/app-check';
+/** The web SDK's stand-in when attestation fails: base64 of `{"error":"UNKNOWN_ERROR"}`. */
+const SDK_PLACEHOLDER_TOKEN = 'eyJlcnJvciI6IlVOS05PV05fRVJST1IifQ==';
+/** The captured refusal envelope (`app-check-ai-gate-wire`, `noHeader.raw`). */
+export function appCheckRequired() {
+    return { error: { code: 403, message: APP_CHECK_REQUIRED_MESSAGE, status: 'PERMISSION_DENIED' } };
+}
+function expiresAfter(claims, nowMillis) {
+    const exp = claims.exp;
+    return typeof exp === 'number' && exp * 1000 > nowMillis;
+}
+/**
+ * Whether AI Logic would accept this token: one the sandbox signed (the web
+ * mirror or `pyric-admin` minted it) that has not expired. A missing,
+ * malformed, placeholder, tampered, or expired token is refused.
+ */
+export async function admitsAppCheckToken(token, nowMillis = Date.now()) {
+    const isMissing = token === null || token === '';
+    if (isMissing)
+        return false;
+    if (token === SDK_PLACEHOLDER_TOKEN)
+        return false;
+    const check = await checkAppCheckToken(token);
+    if (!check.ok)
+        return false;
+    return expiresAfter(check.claims, nowMillis);
+}
+/** Whether an error is this gate's refusal, as the broker throws it or the SDK error it becomes. */
+export function isAppCheckRefusal(error) {
+    const envelope = error?.envelope;
+    const isBrokerRefusal = envelope?.error.code === 403 && envelope.error.message === APP_CHECK_REQUIRED_MESSAGE;
+    if (isBrokerRefusal)
+        return true;
+    const sdkError = error;
+    const isSdkRefusal = sdkError?.customErrorData?.status === 403
+        && typeof sdkError.message === 'string'
+        && sdkError.message.includes(APP_CHECK_REQUIRED_MESSAGE);
+    return isSdkRefusal;
+}
+const warnedApps = new WeakSet();
+function warnOnce(app) {
+    if (warnedApps.has(app))
+        return;
+    warnedApps.add(app);
+    console.warn(`[pyric/ai] ${APP_CHECK_HINT}`);
+}
+/**
+ * The attachment for a handle `getAI(app)` builds now. App Check is read once,
+ * here: a handle built before `initializeAppCheck` never attaches a token.
+ * With `useLimitedUseAppCheckTokens`, each request takes a fresh limited-use
+ * token.
+ */
+export function appCheckAttachmentFor(app, limitedUse) {
+    const activeAtCreation = appCheckActivationOf(app) !== undefined;
+    return {
+        claim: async () => ({ token: activeAtCreation ? await appCheckTokenFor(app, { limitedUse }) : null }),
+        warnRefused: () => warnOnce(app),
+    };
+}
+//# sourceMappingURL=app-check-gate.js.map

package/dist/ai/app-check-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-check-gate.js","sourceRoot":"","sources":["../../src/ai/app-check-gate.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAG5E,+FAA+F;AAC/F,MAAM,CAAC,MAAM,0BAA0B,GACrC,iMAAiM,CAAC;AAEpM,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GACzB,qWAAqW,CAAC;AAExW,4FAA4F;AAC5F,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,gFAAgF;AAChF,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,YAAY,CAAC,MAAyC,EAAE,SAAiB;IAChF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,SAAS,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAoB,EAAE,YAAoB,IAAI,CAAC,GAAG,EAAE;IAC5F,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;IACjD,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,QAAQ,GAAI,KAAiD,EAAE,QAAQ,CAAC;IAC9E,MAAM,eAAe,GAAG,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,KAAK,0BAA0B,CAAC;IAC9G,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,KAA6E,CAAC;IAC/F,MAAM,YAAY,GAAG,QAAQ,EAAE,eAAe,EAAE,MAAM,KAAK,GAAG;WACzD,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;WACpC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC;AACtB,CAAC;AAUD,MAAM,UAAU,GAAG,IAAI,OAAO,EAAU,CAAC;AAEzC,SAAS,QAAQ,CAAC,GAAgB;IAChC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,cAAc,cAAc,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAgB,EAAE,UAAmB;IACzE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACjE,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrG,WAAW,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/ai/broker/broker.d.ts

@@ -37,7 +37,7 @@ import { type AiEvidence } from '../../sandbox/internal/ai-evidence.js';
  * isolates listener throws; this guard covers the emit path itself).
  */
 import type { Sandbox } from 'pyric/sandbox';
-import type { AnswerEngine, CountTokensRequest, CountTokensResponse, EngineConfig, GenerateContentRequest, RawEnvelope, WireChunk, WireResponse } from './types.js';
+import type { AnswerEngine, AppCheckClaim, CountTokensRequest, CountTokensResponse, EngineConfig, GenerateContentRequest, RawEnvelope, WireChunk, WireResponse } from './types.js';
 export interface AiBrokerOptions {
     /** Engine config, or a fully custom engine. Default: zero-config scripted. */
     engine?: EngineConfig | AnswerEngine;
@@ -117,18 +117,34 @@ export declare class AiBroker {
      */
     private emitModelSubstitution;
     private emitRejectionIfBrokerError;
-    generateContent(req: GenerateContentRequest, model: string): Promise<WireResponse>;
+    /**
+     * AI Logic's App Check gate (`app-check-gate.ts`), before any engine runs:
+     * a request whose claim has no valid sandbox token is refused with
+     * production's 403 envelope. A request with no claim comes from a handle
+     * with no app, which production has no counterpart for, and passes.
+     */
+    admitAppCheck(model: string, appCheck: AppCheckClaim | undefined): Promise<void>;
+    generateContent(req: GenerateContentRequest, model: string, appCheck?: AppCheckClaim): Promise<WireResponse>;
     /**
      * Chunk objects with the captured framing SEMANTICS (finishReason last
      * chunk only, usageMetadata every chunk). Validation runs EAGERLY — a bad
      * request throws here, before iteration, the way production answers with
      * an HTTP error instead of a stream.
+     *
+     * The App Check gate is asynchronous, so a stream with a claim checks it
+     * at the start of iteration and opens the engine only once it passes.
+     * Callers that answer an HTTP-like error before any chunk (the sandbox
+     * plane, the worker host) call {@link admitAppCheck} first.
      */
-    streamGenerateContent(req: GenerateContentRequest, model: string): AsyncIterable<WireChunk>;
-    countTokens(req: CountTokensRequest, model: string): Promise<CountTokensResponse>;
+    streamGenerateContent(req: GenerateContentRequest, model: string, appCheck?: AppCheckClaim): AsyncIterable<WireChunk>;
+    countTokens(req: CountTokensRequest, model: string, appCheck?: AppCheckClaim): Promise<CountTokensResponse>;
     private validate;
     private validateContents;
-    /** Emit the rejection onto the event stream, then throw the wire envelope. */
+    /**
+     * Emit the rejection onto the event stream, then throw the wire envelope.
+     * A `hint` is pyric's guidance for the dev server terminal; the thrown
+     * envelope stays production's.
+     */
     private reject;
     /**
      * Land a broker operation on the sandbox's unified event stream.

package/dist/ai/broker/broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,UAAU,EAAE,MAAM,uCAAuC,CAAC;AAClH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAS7C,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EAEtB,WAAW,EACX,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAC;AAuBpB,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,MAAM,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACrC,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAMD,4EAA4E;AAC5E,KAAK,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,qBAAa,QAAQ;IACnB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAEvC,OAAO,GAAE,eAAoB;IAsBzC,0FAA0F;IAC1F,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAQ9C,OAAO,CAAC,QAAQ;IAShB,0EAA0E;IAC1E,OAAO,CAAC,cAAc;IAgBtB;;;;OAIG;IACH,cAAc,IAAI,cAAc;IAUhC,wFAAwF;IACxF,OAAO,CAAC,YAAY;IAgBpB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,qBAAqB;IAmB7B,OAAO,CAAC,0BAA0B;IAS5B,eAAe,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAoBxF;;;;;OAKG;IACH,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC;IAqCrF,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAevF,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,gBAAgB;IAaxB,8EAA8E;IAC9E,OAAO,CAAC,MAAM;IAWd;;;;OAIG;IACH,OAAO,CAAC,IAAI;CAmBb;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,CAYrE"}
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,UAAU,EAAE,MAAM,uCAAuC,CAAC;AAClH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAU7C,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EAEtB,WAAW,EACX,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAC;AAuBpB,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,MAAM,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACrC,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAMD,4EAA4E;AAC5E,KAAK,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,qBAAa,QAAQ;IACnB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAEvC,OAAO,GAAE,eAAoB;IAsBzC,0FAA0F;IAC1F,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAQ9C,OAAO,CAAC,QAAQ;IAShB,0EAA0E;IAC1E,OAAO,CAAC,cAAc;IAgBtB;;;;OAIG;IACH,cAAc,IAAI,cAAc;IAUhC,wFAAwF;IACxF,OAAO,CAAC,YAAY;IAgBpB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,qBAAqB;IAmB7B,OAAO,CAAC,0BAA0B;IASlC;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhF,eAAe,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBlH;;;;;;;;;;OAUG;IACH,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC;IAmD/G,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAiBjH,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,gBAAgB;IAaxB;;;;OAIG;IACH,OAAO,CAAC,MAAM;IAYd;;;;OAIG;IACH,OAAO,CAAC,IAAI;CAmBb;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,CAYrE"}

package/dist/ai/broker/broker.js

@@ -1,6 +1,7 @@
 import { aiEndpoint, getAiEvidence, setAiEvidence } from '../../sandbox/internal/ai-evidence.js';
 import { emitSandboxEvent, getClock, makeServiceMutationEvent } from 'pyric/sandbox/internal';
 import { describeResponseBlock } from '../blocked.js';
+import { APP_CHECK_HINT, admitsAppCheckToken, appCheckRequired } from '../app-check-gate.js';
 import { AiBrokerError, Synthesizer, badRole, emptyContents, missingThoughtSignature } from './synthesizer.js';
 import { ScriptedEngine } from './scripted-engine.js';
 import { OpenAiEngine } from './openai-engine.js';
@@ -197,8 +198,25 @@ export class AiBroker {
             : err instanceof Error ? err.message : String(err);
         this.emit('request_rejected', model, { code, status, message });
     }
-    async generateContent(req, model) {
+    /**
+     * AI Logic's App Check gate (`app-check-gate.ts`), before any engine runs:
+     * a request whose claim has no valid sandbox token is refused with
+     * production's 403 envelope. A request with no claim comes from a handle
+     * with no app, which production has no counterpart for, and passes.
+     */
+    async admitAppCheck(model, appCheck) {
+        if (appCheck === undefined)
+            return;
+        const admitted = await admitsAppCheckToken(appCheck.token);
+        if (admitted)
+            return;
+        this.reject(model, appCheckRequired(), APP_CHECK_HINT);
+    }
+    async generateContent(req, model, appCheck) {
         const identity = this.observationIdentity(model);
+        // No claim, no gate, and no extra turn: the request reaches the engine synchronously as before.
+        if (appCheck !== undefined)
+            await this.admitAppCheck(model, appCheck);
         this.validate(req, model);
         this.emitModelSubstitution(model);
         try {
@@ -222,12 +240,31 @@ export class AiBroker {
      * chunk only, usageMetadata every chunk). Validation runs EAGERLY — a bad
      * request throws here, before iteration, the way production answers with
      * an HTTP error instead of a stream.
+     *
+     * The App Check gate is asynchronous, so a stream with a claim checks it
+     * at the start of iteration and opens the engine only once it passes.
+     * Callers that answer an HTTP-like error before any chunk (the sandbox
+     * plane, the worker host) call {@link admitAppCheck} first.
      */
-    streamGenerateContent(req, model) {
+    streamGenerateContent(req, model, appCheck) {
         const identity = this.observationIdentity(model);
-        this.validate(req, model);
+        const hasClaim = appCheck !== undefined;
+        // The App Check gate comes before validation, as in generateContent. A
+        // claim's gate is asynchronous, so its request is validated after the gate
+        // passes; a stream with no claim still throws eagerly.
+        if (!hasClaim)
+            this.validate(req, model);
         this.emitModelSubstitution(model);
-        const inner = this.engine.streamGenerateContent(req, model);
+        const engine = this.engine;
+        const eager = hasClaim ? undefined : engine.streamGenerateContent(req, model);
+        const admit = () => this.admitAppCheck(model, appCheck);
+        const open = async () => {
+            if (eager !== undefined)
+                return eager;
+            await admit();
+            this.validate(req, model);
+            return engine.streamGenerateContent(req, model);
+        };
         const annotate = (chunk) => this.annotate(chunk, identity);
         const emit = (chunkCount) => this.emit('stream_generate_content', model, {
             contentCount: req.contents.length,
@@ -246,6 +283,8 @@ export class AiBroker {
         };
         return (async function* wrapped() {
             let chunkCount = 0;
+            // A refusal already landed its own request_rejected event.
+            const inner = await open();
             try {
                 for await (const chunk of inner) {
                     chunkCount++;
@@ -260,8 +299,11 @@ export class AiBroker {
             }
         })();
     }
-    async countTokens(req, model) {
+    async countTokens(req, model, appCheck) {
         const identity = this.observationIdentity(model);
+        // No claim, no gate, and no extra turn: the request reaches the engine synchronously as before.
+        if (appCheck !== undefined)
+            await this.admitAppCheck(model, appCheck);
         this.validateContents(req, model);
         try {
             const response = await this.engine.countTokens(req, model);
@@ -302,12 +344,17 @@ export class AiBroker {
             }
         }
     }
-    /** Emit the rejection onto the event stream, then throw the wire envelope. */
-    reject(model, envelope) {
+    /**
+     * Emit the rejection onto the event stream, then throw the wire envelope.
+     * A `hint` is pyric's guidance for the dev server terminal; the thrown
+     * envelope stays production's.
+     */
+    reject(model, envelope, hint) {
         this.emit('request_rejected', model, {
             code: envelope.error.code,
             status: envelope.error.status,
             message: envelope.error.message,
+            ...(hint !== undefined ? { hint } : {}),
         });
         throw new AiBrokerError(envelope);
     }

package/dist/ai/broker/broker.js.map

@@ -1 +1 @@
-{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../src/ai/broker/broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAmB,MAAM,uCAAuC,CAAC;AAwClH,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAG9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAa3E;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,QAAQ;IACR,UAAU;IACV,MAAM;IACN,WAAW;IACX,WAAW;IACX,SAAS;IACT,cAAc;IACd,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AASH,SAAS,cAAc,CAAC,KAAkC;IACxD,OAAO,OAAQ,KAAsB,CAAC,eAAe,KAAK,UAAU,CAAC;AACvE,CAAC;AAkBD,MAAM,OAAO,QAAQ;IACV,MAAM,CAAe;IACb,OAAO,CAAsB;IAC7B,UAAU,CAAa;IACvB,WAAW,CAAqB;IAChC,aAAa,CAAqB;IAEnD,YAAY,UAA2B,EAAE;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,UAAmB,EAAE,CAAC;QAC/D,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC;QAC7B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC/B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC;YAC3B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC;YAC3B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;YAChC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,0FAA0F;IAC1F,mBAAmB,CAAC,KAAa;QAC/B,IAAI,MAAmC,CAAC;QACxC,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC7F,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU;YACrD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChH,WAAW,EAAE,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3E,CAAC;IACO,QAAQ,CAAyB,QAAW,EAAE,QAAoB;QACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC;QACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,OAAO,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ;YAC1C,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,SAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/I,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;IAC9J,CAAC;IAED,0EAA0E;IAClE,cAAc;QACpB,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,6CAA6C,IAAI,CAAC,WAAW,IAAI,aAAa,cAAc,IAAI,CAAC,aAAa,GAAG,CAAC;QAC3H,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,gDAAgD,IAAI,CAAC,aAAa,IAAI,2CAA2C,GAAG,CAAC;QAC9H,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,iDAAiD,CAAC;QAC3D,CAAC;QACD,OAAO,8EAA8E,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACH,cAAc;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,YAAY,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAChG,MAAM,MAAM,GAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACvE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;QACpE,MAAM,QAAQ,GACZ,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QACtG,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wFAAwF;IAChF,YAAY;QAClB,MAAM,MAAM,GAA4B;YACtC,MAAM,EAAE,IAAI,CAAC,UAAU;SACxB,CAAC;QACF,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;YAChC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;QACtC,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,2CAA2C,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,kBAAkB,CAAC,KAAa,EAAE,QAAsB;QAC9D,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,qBAAqB,CAAC,KAAa;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAClD,IAAI,OAAO,OAAO,KAAK,UAAU;YAAE,OAAO;QAC1C,IAAI,SAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1F,IAAI,SAAS,CAAC,KAAK,KAAK,aAAa;YAAE,OAAO;QAC9C,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE;YACpC,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,SAAS,CAAC,KAAK;YAC/B,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B,CAAC,KAAa,EAAE,GAAY;QAC5D,MAAM,IAAI,GAAG,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,MAAM,MAAM,GAAG,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QACrF,MAAM,OAAO,GAAG,GAAG,YAAY,aAAa;YAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;YAC5B,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAA2B,EAAE,KAAa;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE;gBACnC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;gBACjC,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY;gBACpD,eAAe,EAAE,QAAQ,CAAC,aAAa,EAAE,eAAe;gBACxD,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,GAA2B,EAAE,KAAa;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,CAAC,KAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,CAAC,UAAkB,EAAE,EAAE,CAClC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE;YAC1C,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YACjC,UAAU;SACX,CAAC,CAAC;QACL,MAAM,aAAa,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpF,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,6EAA6E;QAC7E,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,MAAM,SAAS,GAAG,CAAC,KAAgB,EAAE,EAAE;YACrC,IAAI,cAAc;gBAAE,OAAO;YAC3B,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO;YAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;oBAChC,UAAU,EAAE,CAAC;oBACb,SAAS,CAAC,KAAK,CAAC,CAAC;oBACjB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB,EAAE,KAAa;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YACxE,OAAO,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACnP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,6EAA6E;IAErE,QAAQ,CAAC,GAA2B,EAAE,KAAa;QACzD,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,8DAA8D;QAC9D,oFAAoF;QACpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO;gBAAE,SAAS;YAC7D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACvC,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;oBAC7D,iEAAiE;oBACjE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,GAA0B,EAAE,KAAa;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAA8C,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IACtE,MAAM,CAAC,KAAa,EAAE,QAAmC;QAC/D,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE;YACnC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI;YACzB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;YAC7B,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;SAChC,CAAC,CAAC;QACH,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,6EAA6E;IAE7E;;;;OAIG;IACK,IAAI,CAAC,EAAoB,EAAE,KAAa,EAAE,MAA+B;QAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO;QACvC,IAAI,CAAC;YACH,gBAAgB,CACd,IAAI,CAAC,OAAO,EACZ,wBAAwB,CAAC;gBACvB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE,IAAI;gBACb,EAAE;gBACF,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE;aAC9C,CAAC,EACF,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,GAAG,GAAI,OAA4C,EAAE,QAAQ,EAAE,GAAG,CAAC;IACzE,IACE,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,KAAK,QAAQ;QACvB,CAAC,KAAK,CAAC,OAAO,CAAE,GAAmB,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAgB,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../src/ai/broker/broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAmB,MAAM,uCAAuC,CAAC;AAwClH,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAG9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAc3E;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,QAAQ;IACR,UAAU;IACV,MAAM;IACN,WAAW;IACX,WAAW;IACX,SAAS;IACT,cAAc;IACd,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AASH,SAAS,cAAc,CAAC,KAAkC;IACxD,OAAO,OAAQ,KAAsB,CAAC,eAAe,KAAK,UAAU,CAAC;AACvE,CAAC;AAkBD,MAAM,OAAO,QAAQ;IACV,MAAM,CAAe;IACb,OAAO,CAAsB;IAC7B,UAAU,CAAa;IACvB,WAAW,CAAqB;IAChC,aAAa,CAAqB;IAEnD,YAAY,UAA2B,EAAE;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,UAAmB,EAAE,CAAC;QAC/D,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC;QAC7B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC/B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC;YAC3B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC;YAC3B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;YAChC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,0FAA0F;IAC1F,mBAAmB,CAAC,KAAa;QAC/B,IAAI,MAAmC,CAAC;QACxC,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC7F,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU;YACrD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChH,WAAW,EAAE,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3E,CAAC;IACO,QAAQ,CAAyB,QAAW,EAAE,QAAoB;QACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC;QACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,OAAO,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ;YAC1C,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,SAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/I,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;IAC9J,CAAC;IAED,0EAA0E;IAClE,cAAc;QACpB,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,6CAA6C,IAAI,CAAC,WAAW,IAAI,aAAa,cAAc,IAAI,CAAC,aAAa,GAAG,CAAC;QAC3H,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,gDAAgD,IAAI,CAAC,aAAa,IAAI,2CAA2C,GAAG,CAAC;QAC9H,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,iDAAiD,CAAC;QAC3D,CAAC;QACD,OAAO,8EAA8E,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACH,cAAc;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,YAAY,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAChG,MAAM,MAAM,GAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QACvE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;QACpE,MAAM,QAAQ,GACZ,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QACtG,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wFAAwF;IAChF,YAAY;QAClB,MAAM,MAAM,GAA4B;YACtC,MAAM,EAAE,IAAI,CAAC,UAAU;SACxB,CAAC;QACF,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;YAChC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;QACtC,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,2CAA2C,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,kBAAkB,CAAC,KAAa,EAAE,QAAsB;QAC9D,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,qBAAqB,CAAC,KAAa;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAClD,IAAI,OAAO,OAAO,KAAK,UAAU;YAAE,OAAO;QAC1C,IAAI,SAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1F,IAAI,SAAS,CAAC,KAAK,KAAK,aAAa;YAAE,OAAO;QAC9C,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE;YACpC,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,SAAS,CAAC,KAAK;YAC/B,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B,CAAC,KAAa,EAAE,GAAY;QAC5D,MAAM,IAAI,GAAG,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,MAAM,MAAM,GAAG,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QACrF,MAAM,OAAO,GAAG,GAAG,YAAY,aAAa;YAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;YAC5B,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAmC;QACpE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ;YAAE,OAAO;QACrB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAA2B,EAAE,KAAa,EAAE,QAAwB;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACjD,gGAAgG;QAChG,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE;gBACnC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;gBACjC,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY;gBACpD,eAAe,EAAE,QAAQ,CAAC,aAAa,EAAE,eAAe;gBACxD,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,qBAAqB,CAAC,GAA2B,EAAE,KAAa,EAAE,QAAwB;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC;QACxC,uEAAuE;QACvE,2EAA2E;QAC3E,uDAAuD;QACvD,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,IAAuC,EAAE;YACzD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACtC,MAAM,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,KAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,CAAC,UAAkB,EAAE,EAAE,CAClC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE;YAC1C,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YACjC,UAAU;SACX,CAAC,CAAC;QACL,MAAM,aAAa,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpF,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,6EAA6E;QAC7E,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,MAAM,SAAS,GAAG,CAAC,KAAgB,EAAE,EAAE;YACrC,IAAI,cAAc;gBAAE,OAAO;YAC3B,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO;YAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,2DAA2D;YAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;oBAChC,UAAU,EAAE,CAAC;oBACb,SAAS,CAAC,KAAK,CAAC,CAAC;oBACjB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB,EAAE,KAAa,EAAE,QAAwB;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACjD,gGAAgG;QAChG,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YACxE,OAAO,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACnP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,6EAA6E;IAErE,QAAQ,CAAC,GAA2B,EAAE,KAAa;QACzD,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,8DAA8D;QAC9D,oFAAoF;QACpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO;gBAAE,SAAS;YAC7D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACvC,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;oBAC7D,iEAAiE;oBACjE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,GAA0B,EAAE,KAAa;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAA8C,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,KAAa,EAAE,QAAmC,EAAE,IAAa;QAC9E,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE;YACnC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI;YACzB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;YAC7B,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;YAC/B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,6EAA6E;IAE7E;;;;OAIG;IACK,IAAI,CAAC,EAAoB,EAAE,KAAa,EAAE,MAA+B;QAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO;QACvC,IAAI,CAAC;YACH,gBAAgB,CACd,IAAI,CAAC,OAAO,EACZ,wBAAwB,CAAC;gBACvB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE,IAAI;gBACb,EAAE;gBACF,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE;aAC9C,CAAC,EACF,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,GAAG,GAAI,OAA4C,EAAE,QAAQ,EAAE,GAAG,CAAC;IACzE,IACE,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,KAAK,QAAQ;QACvB,CAAC,KAAK,CAAC,OAAO,CAAE,GAAmB,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAgB,CAAC;AAC7C,CAAC"}

package/dist/ai/broker/gemini-engine.d.ts

@@ -6,75 +6,29 @@
  * on Pyric's backend server, authenticating via a local API key
  * (`GEMINI_API_KEY` / `GOOGLE_GENAI_API_KEY` / `VITE_GEMINI_API_KEY`) or Google
  * Cloud Application Default Credentials (`gcloud auth application-default login`)
- * without exposing secrets to the browser. AI production mode does not use
- * it: there `firebase/ai` is the Firebase SDK.
+ * without exposing secrets to the browser. In a browser page or SharedWorker
+ * its base URL is the dev server's `/__pyric/ai-proxy/gemini` route, and the
+ * server attaches the credentials (`gemini-upstream.ts`). AI production mode
+ * does not use it: there `firebase/ai` is the Firebase SDK.
  *
  * The requested model id goes upstream unchanged, and an upstream error
  * reaches the caller with the upstream's own code, status and message.
  */
+import { type GeminiUpstreamOptions } from './gemini-upstream.js';
 import type { AnswerEngine, CountTokensRequest, CountTokensResponse, GenerateContentRequest, ModelResolution, WireChunk, WireResponse } from './types.js';
-/** Where the gemini engine talks when no `baseUrl` overrides it. Published
- *  through `pyric/ai/internal` so the CLI's startup banner can name the same
- *  endpoint instead of keeping its own copy. */
-export declare const GEMINI_DEFAULT_BASE_URL = "https://generativelanguage.googleapis.com";
-/**
- * Whether a static API key is configured: the explicit option, else the first
- * of `GEMINI_API_KEY`, `GOOGLE_GENAI_API_KEY`, `VITE_GEMINI_API_KEY` that is
- * defined, which must then be non-blank. This is the engine's own precedence
- * (a blank earlier variable shadows a later real one), published through
- * `pyric/ai/internal` so the CLI's startup banner cannot disagree with it.
- * Application Default Credentials are not consulted: a status read must never
- * shell out.
- */
-export declare function hasGeminiStaticKey(explicitKey: string | undefined): boolean;
-export interface GeminiEngineOptions {
-    /** Explicit API key. Absent ⇒ resolved from environment variables or ADC. */
-    apiKey?: string;
-    /** Explicit base URL override (default: https://generativelanguage.googleapis.com). */
-    baseUrl?: string;
-    /** Explicit fetch seam for testing or custom transport. */
-    fetch?: typeof fetch;
-    /** Prints an ADC access token. Defaults to running
-     *  `gcloud auth application-default print-access-token`. */
-    printAdcToken?: () => Promise<string>;
-    /** Clock for the ADC token lifetime, in milliseconds. Defaults to `Date.now`. */
-    now?: () => number;
-}
+export { GEMINI_DEFAULT_BASE_URL, hasGeminiStaticKey } from './gemini-upstream.js';
+export type GeminiEngineOptions = GeminiUpstreamOptions;
 export declare class GeminiEngine implements AnswerEngine {
-    private readonly baseUrl;
-    private readonly fetchImpl;
-    private readonly explicitKey?;
-    private readonly printAdcToken;
-    private readonly now;
-    private adcToken;
-    private adcLookup;
+    private readonly upstream;
     constructor(options?: GeminiEngineOptions);
     /**
      * Whether a static key is configured, checking the explicit option and the
-     * same environment variables {@link resolveAuthToken} does, without
-     * resolving Application Default Credentials: a status read must never shell
-     * out, and ADC's own presence answers only at call time.
+     * same environment variables the upstream request does, without resolving
+     * Application Default Credentials: a status read must never shell out, and
+     * ADC's own presence answers only at call time.
      */
     hasKeyConfigured(): boolean;
-    /**
-     * Resolves authentication credentials sequentially, checking static options,
-     * environment variables, and finally Google Cloud Application Default
-     * Credentials (`gcloud auth application-default print-access-token`).
-     */
-    private resolveAuthToken;
-    /**
-     * The ADC access token, reused for {@link ADC_TOKEN_TTL_MS}. Concurrent
-     * callers share one lookup. A failed or empty lookup is not cached, so the
-     * next request tries again. Resolves to the empty string when ADC is
-     * unavailable.
-     */
-    private cachedAdcToken;
-    private lookUpAdcToken;
-    /**
-     * Sends one upstream request. When the token came from ADC and the
-     * upstream answers 401, the cached token is dropped and the request is
-     * sent once more with a fresh one.
-     */
+    /** Sends one upstream request; a non-2xx answer throws the upstream's own error. */
     private send;
     /**
      * The model this engine calls upstream: always the requested one. The
@@ -84,12 +38,6 @@ export declare class GeminiEngine implements AnswerEngine {
      */
     resolveEffectiveModel(model: string): ModelResolution;
     private normalizeModel;
-    /**
-     * Formats upstream REST endpoint URLs and request headers for either Google
-     * AI Studio (`generativelanguage.googleapis.com`) or Vertex AI regional APIs.
-     */
-    private formatUpstreamRequest;
-    private post;
     /**
      * A non-2xx upstream answer becomes an {@link AiBrokerError} carrying the
      * upstream's own error envelope: its HTTP code, `status` and message. A

package/dist/ai/broker/gemini-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gemini-engine.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/gemini-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB;;gDAEgD;AAChD,eAAO,MAAM,uBAAuB,8CAA8C,CAAC;AAEnF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAS3E;AAuED,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;gEAC4D;IAC5D,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAUD,qBAAa,YAAa,YAAW,YAAY;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsE;IAChG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAmD;IACnE,OAAO,CAAC,SAAS,CAA8B;gBAEnC,OAAO,CAAC,EAAE,mBAAmB;IAQzC;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO;IAI3B;;;;OAIG;YACW,gBAAgB;IAkC9B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;YAkBR,cAAc;IAa5B;;;;OAIG;YACW,IAAI;IAelB;;;;;OAKG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe;IAIrD,OAAO,CAAC,cAAc;IAItB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;YA2Bf,IAAI;IA4BlB;;;;;OAKG;YACW,WAAW;IAmBnB,eAAe,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKjF,qBAAqB,CAC1B,GAAG,EAAE,sBAAsB,EAC3B,KAAK,EAAE,MAAM,GACZ,aAAa,CAAC,SAAS,CAAC;IAkErB,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAIxF"}
+{"version":3,"file":"gemini-engine.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/gemini-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAgBnF,MAAM,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAExD,qBAAa,YAAa,YAAW,YAAY;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;gBAE9B,OAAO,CAAC,EAAE,mBAAmB;IAIzC;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO;IAI3B,oFAAoF;YACtE,IAAI;IAKlB;;;;;OAKG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe;IAIrD,OAAO,CAAC,cAAc;IAItB;;;;;OAKG;YACW,WAAW;IAmBnB,eAAe,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKjF,qBAAqB,CAC1B,GAAG,EAAE,sBAAsB,EAC3B,KAAK,EAAE,MAAM,GACZ,aAAa,CAAC,SAAS,CAAC;IAkErB,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAIxF"}