pyric 0.1.0-alpha.31 → 0.1.0-alpha.33

package/dist/ai/app-check-gate.d.ts

@@ -1,12 +1,15 @@
 /**
  * Firebase AI Logic's App Check gate, as the sandbox plays it.
  *
- * From November 2, 2026 AI Logic requires App Check on every project. A
- * request with no `X-Firebase-AppCheck` header, a malformed one, the web SDK's
- * placeholder token, or a token whose signature fails gets HTTP 403
- * `PERMISSION_DENIED` (capture `app-check-ai-gate-wire`, `noHeader.raw`), and
- * a valid token answers. The sandbox broker refuses the same requests with the
- * same envelope before any engine runs.
+ * What AI Logic answers a request without a valid App Check token depends on
+ * the project. Enforcement is required from a date each project can set, up to
+ * January 21, 2027, and an unenforced project may answer 200 until then. The
+ * sandbox always refuses, so an app finds the missing token before production
+ * does: a request with no `X-Firebase-AppCheck` header, a malformed one, the web
+ * SDK's placeholder token, or a token whose signature fails gets HTTP 403
+ * `PERMISSION_DENIED`, the envelope captured from another unenforced project
+ * (`earlier-captures/ai-logic-refusal-unenforced.json`), before any engine runs.
+ * A valid token answers. See #1300.
  *
  * The App Check claim a request carries comes from the handle: `getAI(app)`
  * reads the app's App Check activation when it builds the handle, as the SDK's
@@ -18,15 +21,22 @@
  *
  * The error the app gets stays production's. Pyric's guidance rides beside
  * it: on the `request_rejected` event the dev server prints, and once per app
- * as a `console.warn` in the page or process.
+ * as a `console.warn` in the page or process. A server process (a registered
+ * Node process, a server-rendered module) gets its own guidance: the reCAPTCHA
+ * providers throw there and it has no `self`, so it sets the debug token on
+ * `globalThis` beside a CustomProvider, as `build/ai-logic.md` shows (#1639).
+ * A page's workers are browser realms: they have no `document`, but `self`
+ * works there, so they keep the page guidance.
  */
 import type { FirebaseApp } from '../app/types.js';
 import type { AppCheckClaim, WireErrorEnvelope } from './broker/types.js';
-/** Production's message for a refused request (capture `app-check-ai-gate-wire`), verbatim. */
+/** Production's message for a refused request (`earlier-captures/ai-logic-refusal-unenforced.json`), verbatim. */
 export declare const APP_CHECK_REQUIRED_MESSAGE = "Firebase AI Logic has been deactivated in this project. To resume using Firebase AI Logic, you must enforce Firebase App Check. Learn more: https://firebase.google.com/docs/ai-logic/app-check";
-/** Pyric's guidance, printed beside production's error, never in place of it. */
+/** Pyric's guidance for a page, printed beside production's error, never in place of it. */
 export declare const APP_CHECK_HINT = "Firebase AI Logic refuses requests without an App Check token, and so does the sandbox. Call initializeAppCheck(app, { provider }) before getAI(app). For local development, set self.FIREBASE_APPCHECK_DEBUG_TOKEN = true before initializeAppCheck to use the debug provider; the sandbox accepts its tokens. https://firebase.google.com/docs/ai-logic/app-check";
-/** The captured refusal envelope (`app-check-ai-gate-wire`, `noHeader.raw`). */
+/** Pyric's guidance for a server process, where reCAPTCHA throws and `self` does not exist. */
+export declare const APP_CHECK_SERVER_HINT = "Firebase AI Logic refuses requests without an App Check token, and so does the sandbox. This process has no document, so the reCAPTCHA providers throw here. For local development, set globalThis.FIREBASE_APPCHECK_DEBUG_TOKEN = true, then call initializeAppCheck(app, { provider: new CustomProvider({ getToken }) }) before getAI(app). The sandbox does not call getToken while the debug token is set. Without the debug token, getToken returns { token, expireTimeMillis: Date.now() + ttlMillis } from a token your server mints with firebase-admin's getAppCheck().createToken(appId). https://firebase.google.com/docs/ai-logic/app-check";
+/** The captured refusal envelope (`earlier-captures/ai-logic-refusal-unenforced.json`). */
 export declare function appCheckRequired(): WireErrorEnvelope;
 /**
  * Whether AI Logic would accept this token: one the sandbox signed (the web

package/dist/ai/app-check-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-check-gate.d.ts","sourceRoot":"","sources":["../../src/ai/app-check-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG1E,+FAA+F;AAC/F,eAAO,MAAM,0BAA0B,oMAC4J,CAAC;AAEpM,iFAAiF;AACjF,eAAO,MAAM,cAAc,wWAC4U,CAAC;AAExW,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,iBAAiB,CAEpD;AAOD;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,GAAE,MAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhH;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASzD;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAChC,0FAA0F;IAC1F,WAAW,IAAI,IAAI,CAAC;CACrB;AAwBD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,GAAG,kBAAkB,CAM/F"}
+{"version":3,"file":"app-check-gate.d.ts","sourceRoot":"","sources":["../../src/ai/app-check-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG1E,kHAAkH;AAClH,eAAO,MAAM,0BAA0B,oMAC4J,CAAC;AAEpM,4FAA4F;AAC5F,eAAO,MAAM,cAAc,wWAC4U,CAAC;AAExW,+FAA+F;AAC/F,eAAO,MAAM,qBAAqB,4nBACylB,CAAC;AAgB5nB,2FAA2F;AAC3F,wBAAgB,gBAAgB,IAAI,iBAAiB,CAEpD;AAOD;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,GAAE,MAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhH;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASzD;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAChC,0FAA0F;IAC1F,WAAW,IAAI,IAAI,CAAC;CACrB;AAwBD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,GAAG,kBAAkB,CAM/F"}

package/dist/ai/app-check-gate.js

@@ -1,11 +1,27 @@
 import { appCheckActivationOf, appCheckTokenFor } from '../sandbox/internal/app-check-activation.js';
 import { APP_CHECK_PLACEHOLDER_TOKEN, checkAppCheckToken } from '../sandbox/internal/app-check-token.js';
 import { RequestHeadersFailure } from './errors.js';
-/** Production's message for a refused request (capture `app-check-ai-gate-wire`), verbatim. */
+/** Production's message for a refused request (`earlier-captures/ai-logic-refusal-unenforced.json`), verbatim. */
 export const APP_CHECK_REQUIRED_MESSAGE = 'Firebase AI Logic has been deactivated in this project. To resume using Firebase AI Logic, you must enforce Firebase App Check. Learn more: https://firebase.google.com/docs/ai-logic/app-check';
-/** Pyric's guidance, printed beside production's error, never in place of it. */
+/** Pyric's guidance for a page, printed beside production's error, never in place of it. */
 export const APP_CHECK_HINT = 'Firebase AI Logic refuses requests without an App Check token, and so does the sandbox. Call initializeAppCheck(app, { provider }) before getAI(app). For local development, set self.FIREBASE_APPCHECK_DEBUG_TOKEN = true before initializeAppCheck to use the debug provider; the sandbox accepts its tokens. https://firebase.google.com/docs/ai-logic/app-check';
-/** The captured refusal envelope (`app-check-ai-gate-wire`, `noHeader.raw`). */
+/** Pyric's guidance for a server process, where reCAPTCHA throws and `self` does not exist. */
+export const APP_CHECK_SERVER_HINT = "Firebase AI Logic refuses requests without an App Check token, and so does the sandbox. This process has no document, so the reCAPTCHA providers throw here. For local development, set globalThis.FIREBASE_APPCHECK_DEBUG_TOKEN = true, then call initializeAppCheck(app, { provider: new CustomProvider({ getToken }) }) before getAI(app). The sandbox does not call getToken while the debug token is set. Without the debug token, getToken returns { token, expireTimeMillis: Date.now() + ttlMillis } from a token your server mints with firebase-admin's getAppCheck().createToken(appId). https://firebase.google.com/docs/ai-logic/app-check";
+/**
+ * The guidance for the realm the app runs in. A page has a `document`, and a
+ * page's Web Worker, SharedWorker or service worker has `WorkerGlobalScope`:
+ * both are browser realms. Anything else is a server process.
+ */
+function appCheckHintForThisRealm() {
+    const scope = globalThis;
+    const hasDocument = typeof scope.document !== 'undefined';
+    const isWorkerRealm = typeof scope.WorkerGlobalScope !== 'undefined';
+    const isBrowserRealm = hasDocument || isWorkerRealm;
+    if (isBrowserRealm)
+        return APP_CHECK_HINT;
+    return APP_CHECK_SERVER_HINT;
+}
+/** The captured refusal envelope (`earlier-captures/ai-logic-refusal-unenforced.json`). */
 export function appCheckRequired() {
     return { error: { code: 403, message: APP_CHECK_REQUIRED_MESSAGE, status: 'PERMISSION_DENIED' } };
 }
@@ -46,7 +62,7 @@ function warnOnce(app) {
     if (warnedApps.has(app))
         return;
     warnedApps.add(app);
-    console.warn(`[pyric/ai] ${APP_CHECK_HINT}`);
+    console.warn(`[pyric/ai] ${appCheckHintForThisRealm()}`);
 }
 /**
  * The token a request carries. A limited-use token request can reject (the

package/dist/ai/app-check-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-check-gate.js","sourceRoot":"","sources":["../../src/ai/app-check-gate.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAEzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,0BAA0B,GACrC,iMAAiM,CAAC;AAEpM,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GACzB,qWAAqW,CAAC;AAExW,gFAAgF;AAChF,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,YAAY,CAAC,MAAyC,EAAE,SAAiB;IAChF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,SAAS,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAoB,EAAE,YAAoB,IAAI,CAAC,GAAG,EAAE;IAC5F,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;IACjD,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,KAAK,2BAA2B;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,QAAQ,GAAI,KAAiD,EAAE,QAAQ,CAAC;IAC9E,MAAM,eAAe,GAAG,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,KAAK,0BAA0B,CAAC;IAC9G,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,KAA6E,CAAC;IAC/F,MAAM,YAAY,GAAG,QAAQ,EAAE,eAAe,EAAE,MAAM,KAAK,GAAG;WACzD,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;WACpC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC;AACtB,CAAC;AAUD,MAAM,UAAU,GAAG,IAAI,OAAO,EAAU,CAAC;AAEzC,SAAS,QAAQ,CAAC,GAAgB;IAChC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,cAAc,cAAc,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,GAAgB,EAAE,UAAmB;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAgB,EAAE,UAAmB;IACzE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACjE,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChG,WAAW,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"app-check-gate.js","sourceRoot":"","sources":["../../src/ai/app-check-gate.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAEzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,kHAAkH;AAClH,MAAM,CAAC,MAAM,0BAA0B,GACrC,iMAAiM,CAAC;AAEpM,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GACzB,qWAAqW,CAAC;AAExW,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAChC,ynBAAynB,CAAC;AAE5nB;;;;GAIG;AACH,SAAS,wBAAwB;IAC/B,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC1D,MAAM,aAAa,GAAG,OAAO,KAAK,CAAC,iBAAiB,KAAK,WAAW,CAAC;IACrE,MAAM,cAAc,GAAG,WAAW,IAAI,aAAa,CAAC;IACpD,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,YAAY,CAAC,MAAyC,EAAE,SAAiB;IAChF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,SAAS,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAoB,EAAE,YAAoB,IAAI,CAAC,GAAG,EAAE;IAC5F,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;IACjD,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,KAAK,2BAA2B;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,QAAQ,GAAI,KAAiD,EAAE,QAAQ,CAAC;IAC9E,MAAM,eAAe,GAAG,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,KAAK,0BAA0B,CAAC;IAC9G,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,KAA6E,CAAC;IAC/F,MAAM,YAAY,GAAG,QAAQ,EAAE,eAAe,EAAE,MAAM,KAAK,GAAG;WACzD,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;WACpC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC;AACtB,CAAC;AAUD,MAAM,UAAU,GAAG,IAAI,OAAO,EAAU,CAAC;AAEzC,SAAS,QAAQ,CAAC,GAAgB;IAChC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,cAAc,wBAAwB,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,GAAgB,EAAE,UAAmB;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAgB,EAAE,UAAmB;IACzE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACjE,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChG,WAAW,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/ai/broker/gemini-engine.d.ts

@@ -43,10 +43,18 @@ export declare class GeminiEngine implements AnswerEngine {
      * upstream's own error envelope: its HTTP code, `status` and message. A
      * body that is not a Gemini error envelope keeps the HTTP code and reports
      * the body text. Either way the credentials the request carried are masked
-     * in every form the upstream can quote them, as the gemini proxy masks
-     * them (`upstream-error-redaction.ts`).
+     * in every form the upstream can quote them, in the message and the status
+     * alike, with the masking the gemini proxy applies to the same body
+     * (`upstream-error-redaction.ts`, #1660).
      */
     private checkStatus;
+    /**
+     * One read of an upstream stream. A read that fails mid-stream becomes an
+     * {@link AiBrokerError} whose message has the request's credentials masked,
+     * as a failed fetch's does (#1737): the broker logs the message and the
+     * caller receives it, and a read error can quote upstream text.
+     */
+    private readStream;
     generateContent(req: GenerateContentRequest, model: string): Promise<WireResponse>;
     streamGenerateContent(req: GenerateContentRequest, model: string): AsyncIterable<WireChunk>;
     countTokens(req: CountTokensRequest, model: string): Promise<CountTokensResponse>;

package/dist/ai/broker/gemini-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gemini-engine.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/gemini-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElF,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAgBnF,MAAM,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAExD,qBAAa,YAAa,YAAW,YAAY;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;gBAE9B,OAAO,CAAC,EAAE,mBAAmB;IAIzC;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO;IAI3B,oFAAoF;YACtE,IAAI;IASlB;;;;;OAKG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe;IAIrD,OAAO,CAAC,cAAc;IAItB;;;;;;;OAOG;YACW,WAAW;IAkBnB,eAAe,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKjF,qBAAqB,CAC1B,GAAG,EAAE,sBAAsB,EAC3B,KAAK,EAAE,MAAM,GACZ,aAAa,CAAC,SAAS,CAAC;IAkErB,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAIxF"}
+{"version":3,"file":"gemini-engine.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/gemini-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElF,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAuCnF,MAAM,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAExD,qBAAa,YAAa,YAAW,YAAY;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;gBAE9B,OAAO,CAAC,EAAE,mBAAmB;IAIzC;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO;IAI3B,oFAAoF;YACtE,IAAI;IAUlB;;;;;OAKG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe;IAIrD,OAAO,CAAC,cAAc;IAItB;;;;;;;;OAQG;YACW,WAAW;IAiBzB;;;;;OAKG;YACW,UAAU;IAclB,eAAe,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKjF,qBAAqB,CAC1B,GAAG,EAAE,sBAAsB,EAC3B,KAAK,EAAE,MAAM,GACZ,aAAa,CAAC,SAAS,CAAC;IA2DrB,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAIxF"}

package/dist/ai/broker/gemini-engine.js

@@ -16,7 +16,7 @@
  */
 import { AiBrokerError, errorEnvelope } from './synthesizer.js';
 import { GeminiUpstream } from './gemini-upstream.js';
-import { redactUpstreamText } from './upstream-error-redaction.js';
+import { redactUpstreamError, redactUpstreamText } from './upstream-error-redaction.js';
 export { GEMINI_DEFAULT_BASE_URL, hasGeminiStaticKey } from './gemini-upstream.js';
 /** The `message` and `status` of a Gemini `{ error: { ... } }` body, or null. */
 function parseUpstreamError(text) {
@@ -33,6 +33,24 @@ function parseUpstreamError(text) {
         return null;
     return { message: error.message, status: error.status };
 }
+/**
+ * One SSE event's data as a chunk, or undefined when it is not JSON. A 2xx
+ * stream can carry an error event mid-response; it passes through as the
+ * upstream sent it, with the credentials the request carried masked (#1660).
+ */
+function parseStreamData(data, credentials) {
+    let chunk;
+    try {
+        chunk = JSON.parse(data);
+    }
+    catch {
+        return undefined;
+    }
+    const isErrorEvent = chunk !== null && typeof chunk === 'object' && 'error' in chunk;
+    if (!isErrorEvent)
+        return chunk;
+    return JSON.parse(redactUpstreamError(data, credentials));
+}
 export class GeminiEngine {
     upstream;
     constructor(options) {
@@ -50,7 +68,8 @@ export class GeminiEngine {
     /** Sends one upstream request; a non-2xx answer throws the upstream's own error. */
     async send(model, action, body) {
         const { response, credentials } = await this.upstream.sendWithCredentials(this.normalizeModel(model), action, JSON.stringify(body));
-        return this.checkStatus(response, credentials);
+        await this.checkStatus(response, credentials);
+        return { response, credentials };
     }
     /**
      * The model this engine calls upstream: always the requested one. The
@@ -69,27 +88,45 @@ export class GeminiEngine {
      * upstream's own error envelope: its HTTP code, `status` and message. A
      * body that is not a Gemini error envelope keeps the HTTP code and reports
      * the body text. Either way the credentials the request carried are masked
-     * in every form the upstream can quote them, as the gemini proxy masks
-     * them (`upstream-error-redaction.ts`).
+     * in every form the upstream can quote them, in the message and the status
+     * alike, with the masking the gemini proxy applies to the same body
+     * (`upstream-error-redaction.ts`, #1660).
      */
     async checkStatus(response, credentials) {
         const isSuccess = response.ok;
         if (isSuccess)
-            return response;
+            return;
         const errorText = await response.text().catch(() => '');
-        const upstream = parseUpstreamError(errorText);
+        const upstream = parseUpstreamError(redactUpstreamError(errorText, credentials));
         if (upstream !== null) {
-            const message = redactUpstreamText(upstream.message, credentials);
-            throw new AiBrokerError(errorEnvelope(response.status, message, upstream.status));
+            throw new AiBrokerError(errorEnvelope(response.status, upstream.message, upstream.status));
         }
         throw new AiBrokerError(errorEnvelope(response.status, `Gemini API returned status ${response.status}: ${redactUpstreamText(errorText, credentials)}`, 'INTERNAL'));
     }
+    /**
+     * One read of an upstream stream. A read that fails mid-stream becomes an
+     * {@link AiBrokerError} whose message has the request's credentials masked,
+     * as a failed fetch's does (#1737): the broker logs the message and the
+     * caller receives it, and a read error can quote upstream text.
+     */
+    async readStream(reader, credentials) {
+        try {
+            return await reader.read();
+        }
+        catch (err) {
+            if (err instanceof AiBrokerError)
+                throw err;
+            const rawMessage = err instanceof Error ? err.message : String(err);
+            const message = `Gemini API stream aborted mid-response: ${redactUpstreamText(rawMessage, credentials)}`;
+            throw new AiBrokerError(errorEnvelope(502, message, 'UNAVAILABLE'));
+        }
+    }
     async generateContent(req, model) {
-        const response = await this.send(model, 'generateContent', req);
+        const { response } = await this.send(model, 'generateContent', req);
         return (await response.json());
     }
     async *streamGenerateContent(req, model) {
-        const response = await this.send(model, 'streamGenerateContent?alt=sse', req);
+        const { response, credentials } = await this.send(model, 'streamGenerateContent?alt=sse', req);
         const hasBody = response.body !== null && response.body !== undefined;
         if (!hasBody) {
             throw new AiBrokerError(errorEnvelope(500, 'Gemini API returned an empty stream response.', 'INTERNAL'));
@@ -99,7 +136,7 @@ export class GeminiEngine {
         let buffer = '';
         try {
             while (true) {
-                const { done, value } = await reader.read();
+                const { done, value } = await this.readStream(reader, credentials);
                 const isDone = done === true;
                 if (isDone) {
                     break;
@@ -117,13 +154,10 @@ export class GeminiEngine {
                     if (isEmptyOrDone) {
                         continue;
                     }
-                    try {
-                        const chunk = JSON.parse(dataStr);
+                    // A malformed SSE chunk is skipped.
+                    const chunk = parseStreamData(dataStr, credentials);
+                    if (chunk !== undefined)
                         yield chunk;
-                    }
-                    catch {
-                        // Ignore malformed SSE chunk in stream
-                    }
                 }
             }
             const hasTrailingBuffer = buffer.trim().length > 0;
@@ -134,13 +168,9 @@ export class GeminiEngine {
                     const dataStr = line.slice(6).trim();
                     const isNotEmptyOrDone = dataStr !== '' && dataStr !== '[DONE]';
                     if (isNotEmptyOrDone) {
-                        try {
-                            const chunk = JSON.parse(dataStr);
+                        const chunk = parseStreamData(dataStr, credentials);
+                        if (chunk !== undefined)
                             yield chunk;
-                        }
-                        catch {
-                            // Ignore malformed SSE chunk in stream
-                        }
                     }
                 }
             }
@@ -150,7 +180,7 @@ export class GeminiEngine {
         }
     }
     async countTokens(req, model) {
-        const response = await this.send(model, 'countTokens', req);
+        const { response } = await this.send(model, 'countTokens', req);
         return (await response.json());
     }
 }

package/dist/ai/broker/gemini-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"gemini-engine.js","sourceRoot":"","sources":["../../../src/ai/broker/gemini-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,cAAc,EAA8B,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAWnE,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAI,MAAqE,EAAE,KAAK,CAAC;IAC5F,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;IAC1F,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAgB,EAAE,CAAC;AAC9E,CAAC;AAID,MAAM,OAAO,YAAY;IACN,QAAQ,CAAiB;IAE1C,YAAY,OAA6B;QACvC,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC;IAED,oFAAoF;IAC5E,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,IAAa;QAC7D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CACvE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAC1B,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CACrB,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,KAAa;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1E,CAAC;IAEO,cAAc,CAAC,KAAa;QAClC,OAAO,UAAU,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CAAC,QAAkB,EAAE,WAA8B;QAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAClE,MAAM,IAAI,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,aAAa,CACX,QAAQ,CAAC,MAAM,EACf,8BAA8B,QAAQ,CAAC,MAAM,KAAK,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAC9F,UAAU,CACX,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAA2B,EAAE,KAAa;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,CAAC,qBAAqB,CAC1B,GAA2B,EAC3B,KAAa;QAEb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAE9E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,aAAa,CAAC,GAAG,EAAE,+CAA+C,EAAE,UAAU,CAAC,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;gBAC7B,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,SAAS;oBACX,CAAC;oBACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACrC,MAAM,aAAa,GAAG,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,QAAQ,CAAC;oBAC7D,IAAI,aAAa,EAAE,CAAC;wBAClB,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;wBAC/C,MAAM,KAAK,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,uCAAuC;oBACzC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACnD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC7C,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACrC,MAAM,gBAAgB,GAAG,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,QAAQ,CAAC;oBAChE,IAAI,gBAAgB,EAAE,CAAC;wBACrB,IAAI,CAAC;4BACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;4BAC/C,MAAM,KAAK,CAAC;wBACd,CAAC;wBAAC,MAAM,CAAC;4BACP,uCAAuC;wBACzC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB,EAAE,KAAa;QACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IACxD,CAAC;CACF"}
+{"version":3,"file":"gemini-engine.js","sourceRoot":"","sources":["../../../src/ai/broker/gemini-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,cAAc,EAA8B,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAWxF,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAI,MAAqE,EAAE,KAAK,CAAC;IAC5F,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;IAC1F,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAgB,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,WAA8B;IACnE,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,CAAC;IACrF,IAAI,CAAC,YAAY;QAAE,OAAO,KAAkB,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAc,CAAC;AACzE,CAAC;AAUD,MAAM,OAAO,YAAY;IACN,QAAQ,CAAiB;IAE1C,YAAY,OAA6B;QACvC,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC;IAED,oFAAoF;IAC5E,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,IAAa;QAC7D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CACvE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAC1B,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CACrB,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,KAAa;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1E,CAAC;IAEO,cAAc,CAAC,KAAa;QAClC,OAAO,UAAU,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,WAAW,CAAC,QAAkB,EAAE,WAA8B;QAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,SAAS;YAAE,OAAO;QACtB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACjF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,aAAa,CACX,QAAQ,CAAC,MAAM,EACf,8BAA8B,QAAQ,CAAC,MAAM,KAAK,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAC9F,UAAU,CACX,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CACtB,MAA+C,EAC/C,WAA8B;QAE9B,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa;gBAAE,MAAM,GAAG,CAAC;YAC5C,MAAM,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,2CAA2C,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,aAAa,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAA2B,EAAE,KAAa;QAC9D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACpE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,CAAC,qBAAqB,CAC1B,GAA2B,EAC3B,KAAa;QAEb,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAE/F,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,aAAa,CAAC,GAAG,EAAE,+CAA+C,EAAE,UAAU,CAAC,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBACnE,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;gBAC7B,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,SAAS;oBACX,CAAC;oBACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACrC,MAAM,aAAa,GAAG,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,QAAQ,CAAC;oBAC7D,IAAI,aAAa,EAAE,CAAC;wBAClB,SAAS;oBACX,CAAC;oBACD,oCAAoC;oBACpC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;oBACpD,IAAI,KAAK,KAAK,SAAS;wBAAE,MAAM,KAAK,CAAC;gBACvC,CAAC;YACH,CAAC;YAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACnD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC7C,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACrC,MAAM,gBAAgB,GAAG,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,QAAQ,CAAC;oBAChE,IAAI,gBAAgB,EAAE,CAAC;wBACrB,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;wBACpD,IAAI,KAAK,KAAK,SAAS;4BAAE,MAAM,KAAK,CAAC;oBACvC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB,EAAE,KAAa;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IACxD,CAAC;CACF"}

package/dist/ai/broker/gemini-upstream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gemini-upstream.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/gemini-upstream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH;;gDAEgD;AAChD,eAAO,MAAM,uBAAuB,8CAA8C,CAAC;AAqBnF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG3E;AAyDD,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;gEAC4D;IAC5D,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;oEACgE;IAChE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAmBD,qBAAa,cAAc;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsE;IAChG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAmD;IACnE,OAAO,CAAC,SAAS,CAA8B;gBAEnC,OAAO,CAAC,EAAE,qBAAqB;IAS3C;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO;IAI3B;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIvG;;;;;OAKG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GACrC,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAgBzD;;;;OAIG;YACW,gBAAgB;IAyB9B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;YAkBR,cAAc;IAa5B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;YAuBf,IAAI;CAuBnB"}
+{"version":3,"file":"gemini-upstream.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/gemini-upstream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH;;gDAEgD;AAChD,eAAO,MAAM,uBAAuB,8CAA8C,CAAC;AAqBnF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG3E;AAyDD,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;gEAC4D;IAC5D,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;oEACgE;IAChE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAmBD,qBAAa,cAAc;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsE;IAChG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAmD;IACnE,OAAO,CAAC,SAAS,CAA8B;gBAEnC,OAAO,CAAC,EAAE,qBAAqB;IAS3C;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO;IAI3B;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIvG;;;;;OAKG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GACrC,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAgBzD;;;;OAIG;YACW,gBAAgB;IAyB9B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;YAkBR,cAAc;IAa5B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;YAuBf,IAAI;CAyBnB"}

package/dist/ai/broker/gemini-upstream.js

@@ -12,7 +12,8 @@
  * `/__pyric/ai-proxy/gemini`, which attaches the credentials itself, so none
  * are sent and the browser never holds the key.
  */
-import { AiBrokerError, errorEnvelope, redactUrl } from './synthesizer.js';
+import { AiBrokerError, errorEnvelope } from './synthesizer.js';
+import { redactUpstreamText } from './upstream-error-redaction.js';
 /** Where the gemini engine talks when no `baseUrl` overrides it. Published
  *  through `pyric/ai/internal` so the CLI's startup banner can name the same
  *  endpoint instead of keeping its own copy. */
@@ -150,14 +151,14 @@ export class GeminiUpstream {
         const auth = await this.resolveAuthToken();
         const credentials = credentialsOf(auth);
         const first = this.formatUpstreamRequest(resource, action, auth);
-        const response = await this.post(first.url, first.headers, body);
+        const response = await this.post(first.url, first.headers, body, credentials);
         if (response.status === 401 && auth.isAdc) {
             await response.body?.cancel().catch(() => { });
             this.adcToken = undefined;
             const retryAuth = await this.resolveAuthToken();
             credentials.push(...credentialsOf(retryAuth));
             const retry = this.formatUpstreamRequest(resource, action, retryAuth);
-            return { response: await this.post(retry.url, retry.headers, body), credentials };
+            return { response: await this.post(retry.url, retry.headers, body, credentials), credentials };
         }
         return { response, credentials };
     }
@@ -241,17 +242,18 @@ export class GeminiUpstream {
         const separator = url.includes('?') ? '&' : '?';
         return { url: `${url}${separator}key=${encodeURIComponent(auth.token)}`, headers };
     }
-    async post(url, headers, body) {
+    async post(url, headers, body, credentials) {
         try {
             return await this.fetchImpl(url, { method: 'POST', headers, body });
         }
         catch (err) {
-            // Redact both: `url` always carries the key when auth is a static key
-            // (not bearer/ADC); `message` is defensively redacted too in case the
-            // fetch implementation's own error text echoes the request URL.
+            // Mask both with the request's exact credentials, as an error body is
+            // masked (#1737): `url` carries a static key, and a fetch error can
+            // quote the URL or a header, such as Node's refusal of an invalid
+            // `Authorization` value, which quotes the bearer token.
             const rawMessage = err instanceof Error ? err.message : String(err);
-            const safeUrl = redactUrl(url);
-            const safeMessage = redactUrl(rawMessage);
+            const safeUrl = redactUpstreamText(url, credentials);
+            const safeMessage = redactUpstreamText(rawMessage, credentials);
             throw new AiBrokerError(errorEnvelope(502, `Failed to connect to Gemini API at ${safeUrl}: ${safeMessage}`, 'UNAVAILABLE'));
         }
     }

package/dist/ai/broker/gemini-upstream.js.map

@@ -1 +1 @@
-{"version":3,"file":"gemini-upstream.js","sourceRoot":"","sources":["../../../src/ai/broker/gemini-upstream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3E;;gDAEgD;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,2CAA2C,CAAC;AAEnF,MAAM,aAAa,GAAG,CAAC,gBAAgB,EAAE,sBAAsB,CAAU,CAAC;AAE1E;6DAC6D;AAC7D,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAI,UAAyE,CAAC,OAAO,EAAE,GAAG,CAAC;IACpG,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,qEAAqE;AACrE,SAAS,aAAa,CAAC,WAA+B;IACpD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA+B;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,WAAW,GAAG,oDAAoD,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAKxC;;;GAGG;AACH,SAAS,OAAO;IACd,MAAM,OAAO,GAAI,UAA2E,CAAC,OAAO,CAAC;IACrG,MAAM,GAAG,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACtC,MAAM,mBAAmB,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC;IACtD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAmC,CAAC;IACrF,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,CAAC,IAAc,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB;IAC9B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3E,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AA2BD,yEAAyE;AACzE,SAAS,aAAa,CAAC,IAAkB;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;IACnC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,2EAA2E;AAC3E,MAAM,oBAAoB,GAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAExF,MAAM,OAAO,cAAc;IAChB,OAAO,CAAS;IACzB,sEAAsE;IAC7D,kBAAkB,CAAU;IACpB,SAAS,CAAsE;IAC/E,WAAW,CAAU;IACrB,aAAa,CAAwB;IACrC,GAAG,CAAe;IAC3B,QAAQ,CAAmD;IAC3D,SAAS,CAA8B;IAE/C,YAAY,OAA+B;QACzC,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,MAAM,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,uBAAuB,CAAC;QACvE,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACjE,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACd,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAsC;QACjF,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CACvB,QAAgB,EAChB,MAAc,EACd,IAAsC;QAEtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1C,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAChD,WAAW,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB;QAC5B,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO,oBAAoB,CAAC;QACzD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,UAAU,KAAK,EAAE,CAAC;YACvC,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,IAAI,aAAa,CACrB,aAAa,CACX,GAAG,EACH,yLAAyL,EACzL,iBAAiB,CAClB,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAC3B,QAAgB,EAChB,MAAc,EACd,IAAkB;QAElB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,WAAW,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACrD,MAAM,WAAW,GACf,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;QACrD,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;QACzD,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;YAClD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,kDAAkD;QAClD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,SAAS,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;IACrF,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,GAAW,EACX,OAA+B,EAC/B,IAAsC;QAEtC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,IAAI,aAAa,CACrB,aAAa,CACX,GAAG,EACH,sCAAsC,OAAO,KAAK,WAAW,EAAE,EAC/D,aAAa,CACd,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"gemini-upstream.js","sourceRoot":"","sources":["../../../src/ai/broker/gemini-upstream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE;;gDAEgD;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,2CAA2C,CAAC;AAEnF,MAAM,aAAa,GAAG,CAAC,gBAAgB,EAAE,sBAAsB,CAAU,CAAC;AAE1E;6DAC6D;AAC7D,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAI,UAAyE,CAAC,OAAO,EAAE,GAAG,CAAC;IACpG,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,qEAAqE;AACrE,SAAS,aAAa,CAAC,WAA+B;IACpD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA+B;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,WAAW,GAAG,oDAAoD,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAKxC;;;GAGG;AACH,SAAS,OAAO;IACd,MAAM,OAAO,GAAI,UAA2E,CAAC,OAAO,CAAC;IACrG,MAAM,GAAG,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACtC,MAAM,mBAAmB,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC;IACtD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAmC,CAAC;IACrF,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,CAAC,IAAc,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB;IAC9B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3E,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AA2BD,yEAAyE;AACzE,SAAS,aAAa,CAAC,IAAkB;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;IACnC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,2EAA2E;AAC3E,MAAM,oBAAoB,GAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAExF,MAAM,OAAO,cAAc;IAChB,OAAO,CAAS;IACzB,sEAAsE;IAC7D,kBAAkB,CAAU;IACpB,SAAS,CAAsE;IAC/E,WAAW,CAAU;IACrB,aAAa,CAAwB;IACrC,GAAG,CAAe;IAC3B,QAAQ,CAAmD;IAC3D,SAAS,CAA8B;IAE/C,YAAY,OAA+B;QACzC,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,MAAM,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,uBAAuB,CAAC;QACvE,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACjE,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACd,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAsC;QACjF,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CACvB,QAAgB,EAChB,MAAc,EACd,IAAsC;QAEtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1C,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAChD,WAAW,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB;QAC5B,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO,oBAAoB,CAAC;QACzD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,UAAU,KAAK,EAAE,CAAC;YACvC,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,IAAI,aAAa,CACrB,aAAa,CACX,GAAG,EACH,yLAAyL,EACzL,iBAAiB,CAClB,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAC3B,QAAgB,EAChB,MAAc,EACd,IAAkB;QAElB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,WAAW,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACrD,MAAM,WAAW,GACf,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;QACrD,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;QACzD,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;YAClD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,kDAAkD;QAClD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,SAAS,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;IACrF,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,GAAW,EACX,OAA+B,EAC/B,IAAsC,EACtC,WAA8B;QAE9B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,kEAAkE;YAClE,wDAAwD;YACxD,MAAM,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAChE,MAAM,IAAI,aAAa,CACrB,aAAa,CACX,GAAG,EACH,sCAAsC,OAAO,KAAK,WAAW,EAAE,EAC/D,aAAa,CACd,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/ai/broker/upstream-error-redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-error-redaction.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/upstream-error-redaction.ts"],"names":[],"mappings":"AA6BA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMvF;AAqBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIxF"}
+{"version":3,"file":"upstream-error-redaction.d.ts","sourceRoot":"","sources":["../../../src/ai/broker/upstream-error-redaction.ts"],"names":[],"mappings":"AAkCA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIvF;AAqBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIxF"}

package/dist/ai/broker/upstream-error-redaction.js

@@ -19,9 +19,14 @@
  */
 import { redactUrl } from './synthesizer.js';
 const MASK = '***';
-/** The forms a credential can appear in, longest first. */
-function quotedForms(credential) {
-    const forms = new Set([encodeURIComponent(credential), credential]);
+/**
+ * Every form every credential can appear in, raw and percent-encoded,
+ * longest first. One credential can contain another, such as an ADC token
+ * and the refreshed token that extends it, so the longer is masked first:
+ * masking the shorter first would leave the rest of the longer behind.
+ */
+function quotedForms(credentials) {
+    const forms = new Set(credentials.flatMap((credential) => [encodeURIComponent(credential), credential]));
     return [...forms].sort((a, b) => b.length - a.length);
 }
 /**
@@ -31,10 +36,8 @@ function quotedForms(credential) {
  */
 export function redactUpstreamText(text, credentials) {
     let masked = text;
-    for (const credential of credentials) {
-        for (const form of quotedForms(credential))
-            masked = masked.split(form).join(MASK);
-    }
+    for (const form of quotedForms(credentials))
+        masked = masked.split(form).join(MASK);
     return redactUrl(masked);
 }
 function redactValue(value, credentials) {

package/dist/ai/broker/upstream-error-redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-error-redaction.js","sourceRoot":"","sources":["../../../src/ai/broker/upstream-error-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,IAAI,GAAG,KAAK,CAAC;AAEnB,2DAA2D;AAC3D,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,WAA8B;IAC7E,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC;YAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,WAA8B;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,qEAAqE;AACrE,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAA8B;IAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"upstream-error-redaction.js","sourceRoot":"","sources":["../../../src/ai/broker/upstream-error-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,IAAI,GAAG,KAAK,CAAC;AAEnB;;;;;GAKG;AACH,SAAS,WAAW,CAAC,WAA8B;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,WAA8B;IAC7E,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,WAAW,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,WAA8B;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,qEAAqE;AACrE,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAA8B;IAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/ai/errors.d.ts

@@ -12,6 +12,7 @@
  */
 import { FirebaseError } from '../sandbox/internal/firebase-error.js';
 import { type WireErrorEnvelope } from './broker/index.js';
+import { type Backend } from './backend.js';
 /** Standardized error codes the SDK can throw — 14 codes in 2.12.0. */
 export declare const AIErrorCode: {
     readonly ERROR: "error";
@@ -50,17 +51,20 @@ export declare class AIError extends FirebaseError {
 /** Minimal HTTP status text table for the statuses the sandbox mints. */
 export declare function statusTextOf(status: number): string;
 /**
- * Production-shaped request URL for sandbox-minted fetch errors. There is no
- * real project behind the sandbox; the path is deterministic and mirrors the
- * GoogleAI backend's `/v1beta/projects/<project>/models/<model>:<op>` shape.
+ * Production-shaped request URL for sandbox-minted fetch errors, the
+ * `RequestURL` the SDK interpolates into its `Error fetching from <url>`
+ * message. There is no real project behind the sandbox, so the project is
+ * `sandbox`; the model path follows the handle's backend (Google AI when none
+ * is given), and a stream carries `?alt=sse`, as the SDK's `queryParams` add
+ * it (#1640).
  */
-export declare function sandboxRequestUrl(modelResource: string, op: string): string;
+export declare function sandboxRequestUrl(modelResource: string, op: string, backend?: Backend): string;
 /**
  * Translate a broker wire error envelope into the SDK-equivalent
  * `AIError('fetch-error', ...)` — the exact decoration `makeRequest` applies
  * to a non-ok response in the installed 2.12.0.
  */
-export declare function aiErrorFromEnvelope(envelope: WireErrorEnvelope, modelResource: string, op: string): AIError;
+export declare function aiErrorFromEnvelope(envelope: WireErrorEnvelope, modelResource: string, op: string, backend?: Backend): AIError;
 /**
  * A failure while building a request's headers, before anything is sent: the
  * App Check provider rejected a limited-use token request. Upstream
@@ -72,5 +76,5 @@ export declare class RequestHeadersFailure extends Error {
     constructor(reason: unknown);
 }
 /** Rethrow broker errors and header failures as SDK errors; pass anything else through. */
-export declare function toAIError(err: unknown, modelResource: string, op: string): unknown;
+export declare function toAIError(err: unknown, modelResource: string, op: string, backend?: Backend): unknown;
 //# sourceMappingURL=errors.d.ts.map

package/dist/ai/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/ai/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAI1E,uEAAuE;AACvE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;CAed,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAEzE,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/C;AAED;;;;GAIG;AACH,qBAAa,OAAQ,SAAQ,aAAa;IACxC,SAAkB,IAAI,EAAE,WAAW,CAAC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;gBAE/B,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,eAAe;CAYlF;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAYnD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,iBAAiB,EAC3B,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,GACT,OAAO,CAeT;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO;gBAAf,MAAM,EAAE,OAAO;CAIrC;AAsBD,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAQlF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/ai/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAe,KAAK,OAAO,EAAwB,MAAM,cAAc,CAAC;AAI/E,uEAAuE;AACvE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;CAed,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAEzE,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/C;AAED;;;;GAIG;AACH,qBAAa,OAAQ,SAAQ,aAAa;IACxC,SAAkB,IAAI,EAAE,WAAW,CAAC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;gBAE/B,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,eAAe;CAYlF;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAYnD;AAoBD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAG9F;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,iBAAiB,EAC3B,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAeT;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO;gBAAf,MAAM,EAAE,OAAO;CAIrC;AA2BD,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAQrG"}