@pyric/cli 0.1.0-alpha.15 → 0.1.0-alpha.17

package/src/serve/html-injection.ts

@@ -1,7 +1,32 @@
 import { SANDBOX_BUILD_MARKER } from './sandbox-marker.js';
 
 /** The import-map targets. Spec → served URL. */
-export function sdkImportMap(): Record<string, string> {
+export function sdkImportMap(options?: { aiMode?: 'sandbox' | 'production' }): Record<string, string> {
+  const explicitMode = options?.aiMode;
+  let mode: 'sandbox' | 'production' = 'sandbox';
+  const hasExplicitMode = explicitMode !== undefined;
+  if (hasExplicitMode) {
+    mode = explicitMode;
+  } else {
+    const isEnvProductionMode = process.env.PYRIC_AI_MODE === 'production';
+    const isEnvPassthroughFlag = process.env.PYRIC_AI_PASSTHROUGH === '1';
+    const isProductionEnv = isEnvProductionMode || isEnvPassthroughFlag;
+    if (isProductionEnv) {
+      mode = 'production';
+    }
+  }
+  const isProductionMode = mode === 'production';
+  if (isProductionMode) {
+    return {
+      'firebase/app': '/__pyric/sdk/app-ai-passthrough.js',
+      'firebase/auth': '/__pyric/sdk/auth.js',
+      'firebase/database': '/__pyric/sdk/database.js',
+      'firebase/firestore': '/__pyric/sdk/firestore.js',
+      'firebase/messaging': '/__pyric/sdk/messaging.js',
+      'firebase/messaging/sw': '/__pyric/sdk/messaging-sw.js',
+      'firebase/storage': '/__pyric/sdk/storage.js',
+    };
+  }
   return {
     'firebase/ai': '/__pyric/sdk/ai.js',
     'firebase/app': '/__pyric/sdk/app.js',

package/src/serve/rules.ts

@@ -16,7 +16,7 @@ import { isAbsolute, join } from 'node:path';
 import { lintFirestoreRules, resolveModulesBrowser } from 'pyric/rules/internal';
 import { parseStorageRules } from 'pyric/storage';
 import type { FirebaseJson } from '../cli/firebase-json.js';
-import { parseRtdbRulesJson } from '../rtdb/rules-json.js';
+import { parseRtdbRulesJson, stripJsonComments } from '../rtdb/rules-json.js';
 
 export interface LoadedRules {
   /** Plain-v2 source ready for the sandbox, or null when the project has no
@@ -186,7 +186,7 @@ export async function loadProjectDatabaseRules(
 
   let parsed: unknown;
   try {
-    parsed = JSON.parse(raw);
+    parsed = JSON.parse(stripJsonComments(raw));
   } catch (e) {
     throw new Error(`pyric dev: ${path} failed to parse as RTDB rules JSON: ${e instanceof Error ? e.message : String(e)}`);
   }

package/src/serve/runtime/chip-config.ts

@@ -17,14 +17,27 @@ interface RuntimeChipDocument {
   querySelector(selector: string): { getAttribute(name: string): string | null } | null;
 }
 
-/** Read only plugin-authored values; absent/unknown metadata keeps the UI off. */
+function hasBundlerRuntimeChipConfig(): boolean {
+  return typeof process !== 'undefined' && typeof process.env !== 'undefined' && typeof process.env.PYRIC_RUNTIME_CHIP === 'string';
+}
+
+/** Read plugin-authored values from DOM metadata or bundler environment variables, defaulting to collapsed UI when omitted. */
 export function readPyricRuntimeChipConfig(
   documentLike: RuntimeChipDocument,
 ): PyricRuntimeChipConfig | null {
   const meta = documentLike.querySelector(`meta[name="${PYRIC_RUNTIME_CHIP_META}"]`);
-  const value = meta?.getAttribute('content');
-  const studioEnabled = meta?.getAttribute('data-studio') !== 'off';
-  if (value === 'collapsed') return { initiallyOpen: false, studioEnabled };
-  if (value === 'expanded') return { initiallyOpen: true, studioEnabled };
-  return null;
+  const hasMetaTag = meta !== null;
+  let value = hasMetaTag ? meta.getAttribute('content') : null;
+
+  const shouldFallbackToEnv = !hasMetaTag && hasBundlerRuntimeChipConfig();
+  if (shouldFallbackToEnv) {
+    value = process.env.PYRIC_RUNTIME_CHIP as string;
+  }
+  if (value === 'off') {
+    return null;
+  }
+
+  const studioEnabled = !hasMetaTag || meta.getAttribute('data-studio') !== 'off';
+  const initiallyOpen = value === 'expanded';
+  return { initiallyOpen, studioEnabled };
 }

package/src/serve/sandbox-session.ts

@@ -63,6 +63,7 @@ export interface SandboxSession {
   payload(): InitPayload;
   handle(req: IncomingMessage, res: ServerResponse, url: URL): boolean | Promise<boolean>;
   reloadFirestoreRules(): Promise<RulesReloadResult>;
+  reloadDatabaseRules(): Promise<RulesReloadResult>;
   close(): Promise<void>;
 }
 
@@ -93,6 +94,8 @@ export async function createSandboxSession(
   const live = {
     rules: firestore.rules,
     rulesHash: firestore.rulesHash,
+    databaseRules: database.rules,
+    databaseRulesHash: database.rulesHash,
   };
   const events = createEventHub();
   const capture: CaptureStore | undefined = (options.capture ?? true)
@@ -145,8 +148,8 @@ export async function createSandboxSession(
   const payload = (): InitPayload => ({
     rules: live.rules,
     rulesHash: live.rulesHash,
-    databaseRules: database.rules,
-    databaseRulesHash: database.rulesHash,
+    databaseRules: live.databaseRules,
+    databaseRulesHash: live.databaseRulesHash,
     databaseUrl: database.databaseUrl,
     storageRules: storage.rules,
     storageRulesHash: storage.rulesHash,
@@ -217,6 +220,31 @@ export async function createSandboxSession(
       return { kind: 'rejected', error: error instanceof Error ? error : new Error(String(error)) };
     }
   };
+  const reloadDatabaseRules = async (): Promise<RulesReloadResult> => {
+    const isMissingDatabaseRules = database.sourcePath === null;
+    if (isMissingDatabaseRules) {
+      return { kind: 'not-configured' };
+    }
+    try {
+      const updated = await loadProjectDatabaseRules(options.projectDir, options.firebaseConfig);
+      const isMissingUpdatedRules = updated.rules === null || updated.rulesHash === null;
+      if (isMissingUpdatedRules) {
+        return { kind: 'not-configured' };
+      }
+      live.databaseRules = updated.rules;
+      live.databaseRulesHash = updated.rulesHash;
+      events.broadcast('rtdb-rules-update', { rules: updated.rules, rulesHash: updated.rulesHash });
+      return { kind: 'reloaded', rulesHash: updated.rulesHash as string, clients: events.clientCount() };
+    } catch (error) {
+      const isErrorInstance = error instanceof Error;
+      let errorResult: Error = new Error(String(error));
+      if (isErrorInstance) {
+        errorResult = error as Error;
+      }
+      return { kind: 'rejected', error: errorResult };
+    }
+  };
+
   let closePromise: Promise<void> | null = null;
   const close = (): Promise<void> => {
     closePromise ??= Promise.resolve().then(() => events.close());
@@ -228,6 +256,7 @@ export async function createSandboxSession(
     payload,
     handle: namespace,
     reloadFirestoreRules,
+    reloadDatabaseRules,
     close,
   };
 }

package/src/serve/vite-ai-config.ts

@@ -9,6 +9,8 @@ const AI_PROXY_PATH = '/__pyric/ai-proxy';
 export type PyricAiEngineConfig = Extract<NonNullable<AIOptions['engine']>, { kind: string }>;
 
 export interface PyricAiOptions {
+  /** Mode for AI Logic: 'sandbox' (local mirrors) or 'production' (pass-through to Google AI / Vertex AI). */
+  mode?: 'sandbox' | 'production';
   /** Simple OpenAI-compatible model selection through Pyric's same-origin proxy. */
   model?: string;
   /** Advanced declarative engine configuration. */
@@ -18,6 +20,7 @@ export interface PyricAiOptions {
 }
 
 export interface ResolvedViteAiConfig {
+  mode: 'sandbox' | 'production';
   engineWire: AiEngineConfigWire | undefined;
   proxyUpstream: string | undefined;
 }
@@ -26,8 +29,9 @@ export interface ResolvedViteAiConfig {
 export function viteWorkerEpochSalt(
   projectKey: string,
   engineWire: AiEngineConfigWire | undefined,
+  mode: 'sandbox' | 'production' = 'sandbox',
 ): string {
-  return JSON.stringify({ projectKey, aiEngine: engineWire ?? null });
+  return JSON.stringify({ projectKey, aiEngine: engineWire ?? null, aiMode: mode });
 }
 
 /** Load env using Vite's `envDir`-relative-to-root convention. */
@@ -45,20 +49,30 @@ export function loadViteAiEnv(
 
 /** Convert a public declarative engine into the JSON-safe worker wire shape. */
 export function engineConfigToWire(engine: PyricAiEngineConfig): AiEngineConfigWire {
-  if (engine.kind === 'openai') {
-    return {
+  const isOpenAiEngine = engine.kind === 'openai';
+  if (isOpenAiEngine) {
+    const result: Record<string, unknown> = {
       kind: 'openai',
-      baseUrl: engine.baseUrl ?? AI_PROXY_PATH,
-      ...(engine.model !== undefined ? { model: engine.model } : {}),
-      ...(engine.modelMap !== undefined ? { modelMap: engine.modelMap } : {}),
+      baseUrl: engine.baseUrl !== undefined && engine.baseUrl !== null ? engine.baseUrl : AI_PROXY_PATH,
     };
+    const hasModel = engine.model !== undefined;
+    if (hasModel) {
+      result.model = engine.model;
+    }
+    const hasModelMap = engine.modelMap !== undefined;
+    if (hasModelMap) {
+      result.modelMap = engine.modelMap;
+    }
+    return result as AiEngineConfigWire;
   }
-  return {
+  const result: Record<string, unknown> = {
     kind: 'scripted',
-    ...(engine.script !== undefined
-      ? { script: engine.script as unknown as Array<Record<string, unknown>> }
-      : {}),
   };
+  const hasScript = engine.script !== undefined;
+  if (hasScript) {
+    result.script = engine.script as unknown as Array<Record<string, unknown>>;
+  }
+  return result as AiEngineConfigWire;
 }
 
 /** Resolve the plugin's explicit-options-over-Vite-env AI convention. */
@@ -66,20 +80,73 @@ export function resolveViteAiConfig(
   options: PyricAiOptions | undefined,
   env: Record<string, string | undefined>,
 ): ResolvedViteAiConfig {
-  if (options?.model !== undefined && options.engine !== undefined) {
+  const explicitModel = options?.model;
+  const explicitEngine = options?.engine;
+  const hasModelOption = explicitModel !== undefined;
+  const hasEngineOption = explicitEngine !== undefined;
+  const hasBothModelAndEngine = hasModelOption && hasEngineOption;
+  if (hasBothModelAndEngine) {
     throw new Error('@pyric/cli/vite: Choose either ai.model or ai.engine, not both.');
   }
 
-  const model = options?.model?.trim() || env.PYRIC_AI_MODEL?.trim();
-  const engineWire = options?.engine
-    ? engineConfigToWire(options.engine)
-    : model
-      ? engineConfigToWire({ kind: 'openai', baseUrl: AI_PROXY_PATH, model })
-      : undefined;
+  let mode: 'sandbox' | 'production' = 'sandbox';
+  const explicitMode = options?.mode;
+  const hasExplicitMode = explicitMode !== undefined;
+  if (hasExplicitMode) {
+    mode = explicitMode;
+  } else {
+    const isEnvProductionMode = env.PYRIC_AI_MODE === 'production';
+    const isEnvPassthroughFlag = env.PYRIC_AI_PASSTHROUGH === '1';
+    const isProductionEnv = isEnvProductionMode || isEnvPassthroughFlag;
+    if (isProductionEnv) {
+      mode = 'production';
+    }
+  }
+
+  const isProductionMode = mode === 'production';
+  const hasAnyEngineConfig = hasModelOption || hasEngineOption;
+  const isInvalidProductionConfig = isProductionMode && hasAnyEngineConfig;
+  if (isInvalidProductionConfig) {
+    throw new Error('@pyric/cli/vite: Cannot configure ai.model or ai.engine when ai.mode is set to "production".');
+  }
+
+  let model: string | undefined = undefined;
+  const envModel = env.PYRIC_AI_MODEL;
+  if (explicitModel !== undefined) {
+    model = explicitModel.trim();
+  } else if (envModel !== undefined) {
+    model = envModel.trim();
+  }
+  const hasNonEmptyModel = model !== undefined && model !== '';
+  if (!hasNonEmptyModel) {
+    model = undefined;
+  }
+
+  let engineWire: AiEngineConfigWire | undefined = undefined;
+  if (!isProductionMode) {
+    if (explicitEngine !== undefined) {
+      engineWire = engineConfigToWire(explicitEngine);
+    } else if (model !== undefined) {
+      engineWire = engineConfigToWire({ kind: 'openai', baseUrl: AI_PROXY_PATH, model });
+    }
+  }
+
+  let proxyUpstream: string | undefined = undefined;
+  const explicitProxyUpstream = options?.proxyUpstream;
+  const envProxyUpstream = env.PYRIC_AI_PROXY_UPSTREAM;
+  if (explicitProxyUpstream !== undefined) {
+    proxyUpstream = explicitProxyUpstream.trim();
+  } else if (envProxyUpstream !== undefined) {
+    proxyUpstream = envProxyUpstream.trim();
+  }
+  const hasNonEmptyProxyUpstream = proxyUpstream !== undefined && proxyUpstream !== '';
+  if (!hasNonEmptyProxyUpstream) {
+    proxyUpstream = undefined;
+  }
 
   return {
+    mode,
     engineWire,
-    proxyUpstream:
-      options?.proxyUpstream?.trim() || env.PYRIC_AI_PROXY_UPSTREAM?.trim() || undefined,
+    proxyUpstream,
   };
 }

package/src/serve/vite-generation-rules-watch.ts

@@ -8,30 +8,82 @@ export function watchViteGenerationRules(input: {
   session: SandboxSession;
 }): (() => void) | null {
   const { server, session } = input;
-  const rulesFile = session.summary.rules.firestore.sourcePath;
-  if (!rulesFile) return null;
+  const firestoreFile = session.summary.rules.firestore.sourcePath;
+  const databaseFile = session.summary.rules.database.sourcePath;
+  const hasFirestoreFile = firestoreFile !== null;
+  const hasDatabaseFile = databaseFile !== null;
+  const hasNeitherFile = !hasFirestoreFile && !hasDatabaseFile;
+  if (hasNeitherFile) {
+    return null;
+  }
 
   let debounce: ReturnType<typeof setTimeout> | null = null;
   const onRulesChange = (file: string): void => {
-    if (path.resolve(file) !== path.resolve(rulesFile)) return;
-    if (debounce) clearTimeout(debounce);
+    const resolvedFile = path.resolve(file);
+    let isFirestoreMatch = false;
+    if (hasFirestoreFile) {
+      const firestoreResolved = path.resolve(firestoreFile);
+      isFirestoreMatch = resolvedFile === firestoreResolved;
+    }
+    let isDatabaseMatch = false;
+    if (hasDatabaseFile) {
+      const databaseResolved = path.resolve(databaseFile);
+      isDatabaseMatch = resolvedFile === databaseResolved;
+    }
+    const isNeitherMatch = !isFirestoreMatch && !isDatabaseMatch;
+    if (isNeitherMatch) {
+      return;
+    }
+    const hasDebounce = debounce !== null;
+    if (hasDebounce) {
+      clearTimeout(debounce as ReturnType<typeof setTimeout>);
+    }
     debounce = setTimeout(() => {
-      void session.reloadFirestoreRules().then((result) => {
-        if (result.kind === 'reloaded') {
-          server.config.logger.info(`  ↻ [pyric] rules reloaded (${result.rulesHash})`);
-        } else if (result.kind === 'rejected') {
-          server.config.logger.warn(
-            `  ⚠ [pyric] rules NOT reloaded (last-good stays live): ${result.error.message}`,
-          );
-        }
-      });
+      if (isFirestoreMatch) {
+        void session.reloadFirestoreRules().then((result) => {
+          const isReloaded = result.kind === 'reloaded';
+          if (isReloaded) {
+            server.config.logger.info(`  ↻ [pyric] rules reloaded (${result.rulesHash})`);
+          } else {
+            const isRejected = result.kind === 'rejected';
+            if (isRejected) {
+              server.config.logger.warn(
+                `  ⚠ [pyric] rules NOT reloaded (last-good stays live): ${result.error.message}`,
+              );
+            }
+          }
+        });
+      }
+      if (isDatabaseMatch) {
+        void session.reloadDatabaseRules().then((result) => {
+          const isReloaded = result.kind === 'reloaded';
+          if (isReloaded) {
+            server.config.logger.info(`  ↻ [pyric] rtdb rules reloaded (${result.rulesHash})`);
+          } else {
+            const isRejected = result.kind === 'rejected';
+            if (isRejected) {
+              server.config.logger.warn(
+                `  ⚠ [pyric] rtdb rules NOT reloaded (last-good stays live): ${result.error.message}`,
+              );
+            }
+          }
+        });
+      }
     }, 150);
   };
 
-  server.watcher.add(rulesFile);
+  if (hasFirestoreFile) {
+    server.watcher.add(firestoreFile);
+  }
+  if (hasDatabaseFile) {
+    server.watcher.add(databaseFile);
+  }
   server.watcher.on('change', onRulesChange);
   return () => {
-    if (debounce) clearTimeout(debounce);
+    const hasDebounce = debounce !== null;
+    if (hasDebounce) {
+      clearTimeout(debounce as ReturnType<typeof setTimeout>);
+    }
     server.watcher.off('change', onRulesChange);
   };
 }

package/src/serve/vite-module-swap.ts

@@ -45,10 +45,18 @@ export function createViteModuleContext(): ViteModuleContext {
   return { entries, cliRoot: packageRootOf(entries.init) };
 }
 
+export interface ViteModuleSwapOptions {
+  getAiMode?: () => 'sandbox' | 'production';
+}
+
 /** Own the Vite and optimizer forms of the Firebase-module swap. */
-export function createViteModuleSwap(context: ViteModuleContext): ViteModuleSwap {
+export function createViteModuleSwap(
+  context: ViteModuleContext,
+  options?: ViteModuleSwapOptions,
+): ViteModuleSwap {
   const { entries, cliRoot } = context;
   const pyricRoot = pyricPackageRoot();
+  const aiMode = () => options?.getAiMode?.() ?? 'sandbox';
 
   const isPyricImporter = (importer: string | undefined): boolean => {
     if (!importer) return false;
@@ -68,28 +76,72 @@ export function createViteModuleSwap(context: ViteModuleContext): ViteModuleSwap
     name: 'pyric-sandbox-optimizer',
     setup(build) {
       build.onResolve({ filter: FIREBASE_SPECIFIER }, (args) => {
-        const subpath = FIREBASE_SPECIFIER.exec(args.path)![1]!;
-        if (SERVED_FIREBASE_SUBPATHS.has(subpath)) {
-          return { path: entries[entryKey(subpath)]! };
+        const isShadowBridgeImporter = args.importer !== undefined && args.importer !== '' &&
+          (args.importer.includes('app-ai-passthrough') || args.importer.includes('app-bridge'));
+        const isFirebaseAppSpecifier = args.path === 'firebase/app';
+        const isBypassedBridgeImport = isShadowBridgeImporter && isFirebaseAppSpecifier;
+        if (isBypassedBridgeImport) {
+          return null;
+        }
+
+        const match = FIREBASE_SPECIFIER.exec(args.path);
+        const subpath = match !== null && match[1] !== undefined ? match[1] : '';
+        const isProductionAiMode = aiMode() === 'production';
+        if (isProductionAiMode) {
+          const isAiSubpath = subpath === 'ai';
+          if (isAiSubpath) {
+            return null;
+          }
+          const isAppSubpath = subpath === 'app';
+          const passthroughEntry = entries['app-ai-passthrough'];
+          const hasPassthroughEntry = passthroughEntry !== undefined;
+          const shouldUsePassthroughBridge = isAppSubpath && hasPassthroughEntry;
+          if (shouldUsePassthroughBridge) {
+            return { path: passthroughEntry };
+          }
+        }
+
+        const isServedSubpath = SERVED_FIREBASE_SUBPATHS.has(subpath);
+        if (isServedSubpath) {
+          const key = entryKey(subpath);
+          const entryPath = entries[key];
+          if (entryPath !== undefined) {
+            return { path: entryPath };
+          }
         }
         return null;
       });
       build.onResolve({ filter: NODE_BUILTIN_RE }, (args) => {
-        if (!isOurCode(args.importer)) return null;
-        return { path: args.path.replace(/^node:/, ''), namespace: 'pyric-node-shim' };
+        const isOwnedImporter = isOurCode(args.importer);
+        if (!isOwnedImporter) {
+          return null;
+        }
+        const shimPath = args.path.replace(/^node:/, '');
+        return { path: shimPath, namespace: 'pyric-node-shim' };
+      });
+      build.onLoad({ filter: /.*/, namespace: 'pyric-node-shim' }, (args) => {
+        const content = NODE_BUILTIN_SHIMS[args.path];
+        if (content !== undefined) {
+          return { contents: content, loader: 'js' };
+        }
+        return null;
       });
-      build.onLoad({ filter: /.*/, namespace: 'pyric-node-shim' }, (args) => ({
-        contents: NODE_BUILTIN_SHIMS[args.path]!,
-        loader: 'js',
-      }));
     },
   };
 
   return {
     config() {
+      const excludedModules = [
+        ...SDK_MODULES,
+        '@firebase/app',
+        '@firebase/component',
+        '@firebase/ai',
+        '@firebase/util',
+        '@firebase/logger',
+      ];
       return {
         optimizeDeps: {
-          exclude: [...SDK_MODULES],
+          exclude: excludedModules,
           include: ['js-md5', 'js-sha256'],
           esbuildOptions: { plugins: [optimizerMirror] },
         },
@@ -97,23 +149,71 @@ export function createViteModuleSwap(context: ViteModuleContext): ViteModuleSwap
     },
     configResolved(config) {
       const allow = config.server?.fs?.allow;
-      if (!allow) return;
+      const hasAllowList = allow !== undefined && Array.isArray(allow);
+      if (!hasAllowList) {
+        return;
+      }
       for (const dir of [pyricRoot, cliRoot]) {
-        if (!allow.includes(dir)) allow.push(dir);
+        const isAlreadyAllowed = allow.includes(dir);
+        if (!isAlreadyAllowed) {
+          allow.push(dir);
+        }
       }
     },
     resolveId(source, importer) {
-      const firebase = FIREBASE_SPECIFIER.exec(source);
-      if (firebase) {
-        const subpath = firebase[1]!;
-        return SERVED_FIREBASE_SUBPATHS.has(subpath) ? entries[entryKey(subpath)]! : null;
+      const isShadowBridgeImporter = importer !== undefined &&
+        (importer.includes('app-ai-passthrough') || importer.includes('app-bridge'));
+      const isFirebaseAppSpecifier = source === 'firebase/app';
+      const isBypassedBridgeImport = isShadowBridgeImporter && isFirebaseAppSpecifier;
+      if (isBypassedBridgeImport) {
+        return null;
       }
-      const node = NODE_BUILTIN_RE.exec(source);
-      return node && isOurCode(importer) ? NODE_SHIM_PREFIX + node[2]! : null;
+
+      const firebaseMatch = FIREBASE_SPECIFIER.exec(source);
+      const isFirebaseSpecifier = firebaseMatch !== null;
+      if (isFirebaseSpecifier) {
+        const subpath = firebaseMatch[1] !== undefined ? firebaseMatch[1] : '';
+        const isProductionAiMode = aiMode() === 'production';
+        if (isProductionAiMode) {
+          const isAiSubpath = subpath === 'ai';
+          if (isAiSubpath) {
+            return null;
+          }
+          const isAppSubpath = subpath === 'app';
+          const passthroughEntry = entries['app-ai-passthrough'];
+          const hasPassthroughEntry = passthroughEntry !== undefined;
+          const shouldUsePassthroughBridge = isAppSubpath && hasPassthroughEntry;
+          if (shouldUsePassthroughBridge) {
+            return passthroughEntry;
+          }
+        }
+        const isServedSubpath = SERVED_FIREBASE_SUBPATHS.has(subpath);
+        if (isServedSubpath) {
+          const key = entryKey(subpath);
+          const entryPath = entries[key];
+          if (entryPath !== undefined) {
+            return entryPath;
+          }
+        }
+        return null;
+      }
+
+      const nodeMatch = NODE_BUILTIN_RE.exec(source);
+      const isNodeBuiltin = nodeMatch !== null && nodeMatch[2] !== undefined;
+      const isOwnedImporter = isOurCode(importer);
+      const shouldShimNodeBuiltin = isNodeBuiltin && isOwnedImporter;
+      if (shouldShimNodeBuiltin) {
+        return NODE_SHIM_PREFIX + nodeMatch[2];
+      }
+      return null;
     },
     load(id) {
-      if (!id.startsWith(NODE_SHIM_PREFIX)) return null;
-      return shimFor(id.slice(NODE_SHIM_PREFIX.length));
+      const isNodeShim = id.startsWith(NODE_SHIM_PREFIX);
+      if (!isNodeShim) {
+        return null;
+      }
+      const specifier = id.slice(NODE_SHIM_PREFIX.length);
+      return shimFor(specifier);
     },
   };
 }