@pyric/cli 0.1.0-alpha.20 → 0.1.0-alpha.21

package/dist/cli/inlined-sdk-scanner.js

@@ -0,0 +1,82 @@
+/**
+ * Detect a served frontend build that inlined the real Firebase SDK.
+ *
+ * The served import map remaps only bare `firebase/*` specifiers, so a plain
+ * `vite build` that compiled the SDK into an app chunk cannot be sandboxed:
+ * its calls reach real Google endpoints while the injected banner claims
+ * otherwise. `cli/serve.ts` refuses such a dist rather than serving it.
+ *
+ * Only the SDK fingerprint hosts are matched, never the full endpoint catalog.
+ * This check throws, and a dist can legitimately carry a bare callable URL, a
+ * public asset URL, or a `databaseURL` literal without any Firebase SDK in it.
+ *
+ * Backend bundles are deliberately out of scope. `withPyric` externalizes
+ * firebase and firebase-admin, the backend-bundler docs tell users to mark them
+ * external, and the net guard reports real egress at runtime with attribution,
+ * which a grep over build output cannot do.
+ */
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { SDK_FINGERPRINT_HOSTS } from '../google-endpoints.js';
+/** Depth limit for the walk. */
+const MAX_DEPTH = 4;
+/** Total script files read. */
+const MAX_FILES = 200;
+/** Script extensions worth reading in served frontend output. */
+const SCRIPT_FILE = /\.(js|mjs)$/;
+/**
+ * Scan `dir` for inlined SDK fingerprints and return the offending paths,
+ * relative to `dir`. Bounded: depth 4, 200 script files, first hit per file.
+ */
+export function scanForInlinedFirebase(dir) {
+    const hits = [];
+    let scanned = 0;
+    const walk = (current, rel, depth) => {
+        if (depth > MAX_DEPTH || scanned >= MAX_FILES)
+            return;
+        let names;
+        try {
+            names = readdirSync(current);
+        }
+        catch {
+            return;
+        }
+        for (const name of names) {
+            if (scanned >= MAX_FILES)
+                return;
+            const path = join(current, name);
+            const relPath = rel ? `${rel}/${name}` : name;
+            let stat;
+            try {
+                stat = statSync(path);
+            }
+            catch {
+                continue;
+            }
+            if (stat.isDirectory()) {
+                // The pyric namespace itself never lands in hosting.public, but a
+                // node_modules inside a served dir would be a scan-cost trap.
+                // Dot-directories (.next, .git, .pyric) are internal caches.
+                if (name === 'node_modules' || name.startsWith('.'))
+                    continue;
+                walk(path, relPath, depth + 1);
+                continue;
+            }
+            if (!SCRIPT_FILE.test(name))
+                continue;
+            scanned++;
+            let text;
+            try {
+                text = readFileSync(path, 'utf8');
+            }
+            catch {
+                continue; // unreadable asset
+            }
+            if (SDK_FINGERPRINT_HOSTS.some((host) => text.includes(host)))
+                hits.push(relPath);
+        }
+    };
+    walk(dir, '', 0);
+    return hits;
+}
+//# sourceMappingURL=inlined-sdk-scanner.js.map

package/dist/cli/inlined-sdk-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inlined-sdk-scanner.js","sourceRoot":"","sources":["../../src/cli/inlined-sdk-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,gCAAgC;AAChC,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,+BAA+B;AAC/B,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,iEAAiE;AACjE,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,GAAW,EAAE,KAAa,EAAQ,EAAE;QACjE,IAAI,KAAK,GAAG,SAAS,IAAI,OAAO,IAAI,SAAS;YAAE,OAAO;QACtD,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,SAAS;gBAAE,OAAO;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9C,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,kEAAkE;gBAClE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC9D,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,OAAO,EAAE,CAAC;YACV,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,mBAAmB;YAC/B,CAAC;YACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/sandbox-interlock.d.ts

@@ -0,0 +1,97 @@
+import { type GuardMode } from '../register/net-guard.js';
+/**
+ * What `pyric sandbox` can say about the interception it is about to hand the
+ * child, entirely from the env it just assembled: no waiting, no round trip.
+ */
+export interface InterlockStatus {
+    /** Net-guard mode the child will run under (`PYRIC_GUARD`, default warn). */
+    readonly guard: GuardMode;
+    /** Whether `NODE_OPTIONS` actually carries the register `--import`. */
+    readonly registerImported: boolean;
+    /** Where the child's handshake beacon will land, or null when the
+     *  activator carries no bridge URL. */
+    readonly beacon: string | null;
+}
+/**
+ * Read the interlock off the child env. Everything here is synchronous by
+ * construction: it is a statement about the launch, printed before anything at
+ * runtime has had a chance to go wrong.
+ */
+export declare function describeInterlock(childEnv: NodeJS.ProcessEnv, registerUrl: string): InterlockStatus;
+/**
+ * The startup status line, alongside the other `✔ <service>` checks.
+ *
+ * The healthy line is deliberately short: one fact per field and nothing the
+ * reader has to skim past. The degraded line is long because it reports a
+ * broken launch, which is worth every word.
+ */
+export declare function formatInterlockLine(status: InterlockStatus): string;
+export interface LaunchCheckOptions {
+    /** The environment the child is about to receive. */
+    readonly childEnv: NodeJS.ProcessEnv;
+    /** Absolute `file:` URL of the register module, to look for in NODE_OPTIONS. */
+    readonly registerUrl: string;
+    /** The child's argv, for the unsupported-runtime check. */
+    readonly argv: readonly string[];
+    readonly write: (line: string) => void;
+}
+/**
+ * Every statement the launcher makes about the child, printed in one block
+ * before the spawn, and the interlock status it derived on the way.
+ *
+ * Two checks: the interlock status line, from the env alone, and the
+ * unsupported-runtime warning for the other way interception can be absent, a
+ * child runtime that never evaluates Node loader hooks at all.
+ */
+export declare function reportLaunchChecks(opts: LaunchCheckOptions): InterlockStatus;
+export interface BeaconWatchdogOptions {
+    /** The child command, for attribution in the warning. */
+    readonly label: string;
+    /** The endpoint the child would post to. Null means nothing to watch. */
+    readonly beacon: string | null;
+    /** Whether a beacon from this child has been recorded. */
+    readonly sawBeacon: () => boolean;
+    /** Whether the child is still running. */
+    readonly isAlive: () => boolean;
+    readonly warn: (line: string) => void;
+    readonly graceMs?: number;
+}
+export interface BeaconWatchdog {
+    /** Cancel a pending check. Idempotent. */
+    stop(): void;
+}
+/** The warning itself: one paragraph naming what the silence means and what
+ *  to check. Kept separate so its exact wording is testable. */
+export declare function formatMissingBeaconWarning(opts: {
+    label: string;
+    graceMs: number;
+    beacon: string;
+}): string;
+/**
+ * The warn-only interlock watchdog.
+ *
+ * It never kills the child and never blocks a request. The reason is the
+ * signal's own honesty: beacon delivery is best-effort (see
+ * `register/beacon.ts`), and a plausible silent child is not the same thing as
+ * a broken one. A short-lived script that exits before its POST lands, a child
+ * that reaches the sandbox only through a grandchild, a dev server slow to
+ * boot: each would be killed by a fail-closed version of this check, and each
+ * is fine.
+ *
+ * So the heuristic is the simple, attributable one: the child is still alive
+ * `graceMs` after launch and no beacon has arrived. Both halves matter. An
+ * exited child was never expected to say anything, and a child whose beacon
+ * landed has already proved the point. One warning per child, guaranteed by
+ * the one-shot timer; the timer is unref'd so a watchdog can never be the
+ * reason a process stays up.
+ *
+ * `sawBeacon` is a count delta rather than a pid match, deliberately. The
+ * process that loads register is often a grandchild (`npm run dev` starts
+ * node, `next dev` starts its worker), so the spawned child's own pid is
+ * frequently not the pid in the beacon, and matching on it would warn about
+ * perfectly healthy launches. The delta's known imprecision runs the other
+ * way: a sibling runtime's beacon that lands inside the grace window can mask
+ * a real miss. Erring toward silence is the right bias for a warn-only check.
+ */
+export declare function startBeaconWatchdog(opts: BeaconWatchdogOptions): BeaconWatchdog;
+//# sourceMappingURL=sandbox-interlock.d.ts.map

package/dist/cli/sandbox-interlock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-interlock.d.ts","sourceRoot":"","sources":["../../src/cli/sandbox-interlock.ts"],"names":[],"mappings":"AAWA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1E;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;2CACuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,CAAC,UAAU,EAC3B,WAAW,EAAE,MAAM,GAClB,eAAe,CAMjB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAQnE;AAED,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;IACrC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAM5E;AAKD,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,IAAI,IAAI,IAAI,CAAC;CACd;AAED;gEACgE;AAChE,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAUT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,cAAc,CAc/E"}

package/dist/cli/sandbox-interlock.js

@@ -0,0 +1,112 @@
+/**
+ * The interlock: the launcher's statement about interception in the child it
+ * is about to start, plus the warn-only watchdog for the child's answer.
+ *
+ * The status line is knowable synchronously from the env `pyric sandbox` just
+ * assembled: guard mode, whether NODE_OPTIONS really carries the register
+ * import, and where the child's handshake beacon will land. The watchdog is
+ * the other half: a child still alive well after launch that never posted a
+ * beacon is probably not intercepted.
+ */
+import { beaconEndpoint } from '../register/beacon.js';
+import { parseGuardMode } from '../register/net-guard.js';
+import { detectUnsupportedRuntime, formatUnsupportedRuntimeWarning } from './unsupported-runtime.js';
+/**
+ * Read the interlock off the child env. Everything here is synchronous by
+ * construction: it is a statement about the launch, printed before anything at
+ * runtime has had a chance to go wrong.
+ */
+export function describeInterlock(childEnv, registerUrl) {
+    return {
+        guard: parseGuardMode(childEnv.PYRIC_GUARD),
+        registerImported: (childEnv.NODE_OPTIONS ?? '').includes(`--import ${registerUrl}`),
+        beacon: beaconEndpoint(childEnv.PYRIC_SANDBOX),
+    };
+}
+/**
+ * The startup status line, alongside the other `✔ <service>` checks.
+ *
+ * The healthy line is deliberately short: one fact per field and nothing the
+ * reader has to skim past. The degraded line is long because it reports a
+ * broken launch, which is worth every word.
+ */
+export function formatInterlockLine(status) {
+    if (!status.registerImported) {
+        return (`⚠ interlock guard=${status.guard}, register is NOT in the child's NODE_OPTIONS. ` +
+            `Its firebase-admin/firebase imports will NOT be rewritten and would reach LIVE Firebase.\n`);
+    }
+    return `✔ interlock guard=${status.guard}, register loaded via NODE_OPTIONS\n`;
+}
+/**
+ * Every statement the launcher makes about the child, printed in one block
+ * before the spawn, and the interlock status it derived on the way.
+ *
+ * Two checks: the interlock status line, from the env alone, and the
+ * unsupported-runtime warning for the other way interception can be absent, a
+ * child runtime that never evaluates Node loader hooks at all.
+ */
+export function reportLaunchChecks(opts) {
+    const interlock = describeInterlock(opts.childEnv, opts.registerUrl);
+    opts.write(formatInterlockLine(interlock));
+    const unsupportedRuntime = detectUnsupportedRuntime(opts.argv);
+    if (unsupportedRuntime !== null)
+        opts.write(formatUnsupportedRuntimeWarning(unsupportedRuntime));
+    return interlock;
+}
+/** How long a child may live without its beacon before we say something. */
+const BEACON_GRACE_MS = 15_000;
+/** The warning itself: one paragraph naming what the silence means and what
+ *  to check. Kept separate so its exact wording is testable. */
+export function formatMissingBeaconWarning(opts) {
+    const seconds = Math.round(opts.graceMs / 1000);
+    return (`  ⚠ interlock: \`${opts.label}\` has been running ${seconds}s without posting a register ` +
+        `beacon to ${opts.beacon}. Its firebase-admin/firebase imports are probably NOT routed to ` +
+        `the pyric sandbox, which means they would reach LIVE Firebase. Check that the command starts ` +
+        `a Node process (bun and deno do not evaluate Node loader hooks), that it does not overwrite ` +
+        `NODE_OPTIONS, and that NODE_ENV is not production. Warning only: nothing was blocked, and ` +
+        `this is reported once per child.`);
+}
+/**
+ * The warn-only interlock watchdog.
+ *
+ * It never kills the child and never blocks a request. The reason is the
+ * signal's own honesty: beacon delivery is best-effort (see
+ * `register/beacon.ts`), and a plausible silent child is not the same thing as
+ * a broken one. A short-lived script that exits before its POST lands, a child
+ * that reaches the sandbox only through a grandchild, a dev server slow to
+ * boot: each would be killed by a fail-closed version of this check, and each
+ * is fine.
+ *
+ * So the heuristic is the simple, attributable one: the child is still alive
+ * `graceMs` after launch and no beacon has arrived. Both halves matter. An
+ * exited child was never expected to say anything, and a child whose beacon
+ * landed has already proved the point. One warning per child, guaranteed by
+ * the one-shot timer; the timer is unref'd so a watchdog can never be the
+ * reason a process stays up.
+ *
+ * `sawBeacon` is a count delta rather than a pid match, deliberately. The
+ * process that loads register is often a grandchild (`npm run dev` starts
+ * node, `next dev` starts its worker), so the spawned child's own pid is
+ * frequently not the pid in the beacon, and matching on it would warn about
+ * perfectly healthy launches. The delta's known imprecision runs the other
+ * way: a sibling runtime's beacon that lands inside the grace window can mask
+ * a real miss. Erring toward silence is the right bias for a warn-only check.
+ */
+export function startBeaconWatchdog(opts) {
+    const beacon = opts.beacon;
+    if (beacon === null)
+        return { stop: () => { } };
+    const graceMs = opts.graceMs ?? BEACON_GRACE_MS;
+    const timer = setTimeout(() => {
+        if (opts.sawBeacon() || !opts.isAlive())
+            return;
+        opts.warn(formatMissingBeaconWarning({ label: opts.label, graceMs, beacon }));
+    }, graceMs);
+    timer.unref?.();
+    return {
+        stop() {
+            clearTimeout(timer);
+        },
+    };
+}
+//# sourceMappingURL=sandbox-interlock.js.map

package/dist/cli/sandbox-interlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-interlock.js","sourceRoot":"","sources":["../../src/cli/sandbox-interlock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAkB,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAgBrG;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA2B,EAC3B,WAAmB;IAEnB,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3C,gBAAgB,EAAE,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,WAAW,EAAE,CAAC;QACnF,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAuB;IACzD,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,CACL,qBAAqB,MAAM,CAAC,KAAK,iDAAiD;YAClF,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,MAAM,CAAC,KAAK,sCAAsC,CAAC;AACjF,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,kBAAkB,KAAK,IAAI;QAAE,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACjG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4EAA4E;AAC5E,MAAM,eAAe,GAAG,MAAM,CAAC;AAoB/B;gEACgE;AAChE,MAAM,UAAU,0BAA0B,CAAC,IAI1C;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAChD,OAAO,CACL,oBAAoB,IAAI,CAAC,KAAK,uBAAuB,OAAO,+BAA+B;QAC3F,aAAa,IAAI,CAAC,MAAM,mEAAmE;QAC3F,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,kCAAkC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA2B;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO;QAChD,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC,EAAE,OAAO,CAAC,CAAC;IACZ,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO;QACL,IAAI;YACF,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/sandbox-runner.d.ts

@@ -71,25 +71,33 @@ export declare function resolveSandboxChild(opts: ResolveSandboxChildOptions): S
  * dist/register/), for runtimes without a usable import.meta.resolve.
  */
 export declare function registerModuleUrl(): string;
+/** What the launcher has to put in a child's environment for interception. */
+export interface ChildActivation {
+    /** The serve host the child's sandbox calls reach. */
+    readonly serveUrl: string;
+    /** Absolute `file:` URL of the register module. */
+    readonly registerUrl: string;
+    /** The per-launch secret the child's handshake beacon must present.
+     *  Absent when the launcher runs no beacon receiver, as the Vite plugin's
+     *  Functions runtime does; the child then reports on stderr only. */
+    readonly beaconToken?: string | undefined;
+}
 /**
- * Child env: sets the activator and APPENDS the loader to NODE_OPTIONS —
- * never replaces it (the user's own --inspect / --max-old-space-size etc.
- * must survive). `file:` URLs are percent-encoded, so no quoting is needed
- * even for paths with spaces.
+ * Child env: sets the activator and the beacon secret, and APPENDS the loader
+ * to NODE_OPTIONS rather than replacing it (the user's own --inspect /
+ * --max-old-space-size and so on must survive). `file:` URLs are
+ * percent-encoded, so no quoting is needed even for paths with spaces.
  */
-export declare function buildChildEnv(base: NodeJS.ProcessEnv, opts: {
-    serveUrl: string;
-    registerUrl: string;
-}): NodeJS.ProcessEnv;
+export declare function buildChildEnv(base: NodeJS.ProcessEnv, opts: ChildActivation): NodeJS.ProcessEnv;
 /**
  * Format copy-pasteable POSIX export statements for host-only startup.
  * Grouped in a cleanly formatted console block for easy selection and copying
  * into a separate terminal (for example, when running Next.js independently).
+ *
+ * The beacon secret is part of the block: without it a process started this
+ * way still intercepts, but the dev server cannot confirm that it did.
  */
-export declare function formatStartupEnvExport(opts: {
-    serveUrl: string;
-    registerUrl: string;
-}): string;
+export declare function formatStartupEnvExport(opts: ChildActivation): string;
 /**
  * Incremental line prefixer: every child output line gets `[dev] `, partial
  * lines are buffered until their newline (or flush at stream end).

package/dist/cli/sandbox-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-runner.d.ts","sourceRoot":"","sources":["../../src/cli/sandbox-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAI9D;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC,GACL,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAID,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAE5C;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAcxD;AAED,MAAM,WAAW,0BAA0B;IACzC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,gBAAgB,GAAG,IAAI,CAuB7F;AAID;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAQ1C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C,MAAM,CAAC,UAAU,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAc9F;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,IAAI,CAAA;CAAE,CAkB9C;AASD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAClC,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3D,kBAAkB,CAoGpB;AAED,eAAO,MAAM,aAAa,0BAAoB,CAAC"}
+{"version":3,"file":"sandbox-runner.d.ts","sourceRoot":"","sources":["../../src/cli/sandbox-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK9D;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC,GACL,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAID,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAE5C;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAcxD;AAED,MAAM,WAAW,0BAA0B;IACzC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,gBAAgB,GAAG,IAAI,CAuB7F;AAID;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAQ1C;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;yEAEqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,IAAI,EAAE,eAAe,GACpB,MAAM,CAAC,UAAU,CASnB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAgBpE;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,IAAI,CAAA;CAAE,CAkB9C;AAOD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAClC,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3D,kBAAkB,CA6FpB;AAED,eAAO,MAAM,aAAa,0BAAoB,CAAC"}

package/dist/cli/sandbox-runner.js

@@ -16,6 +16,7 @@
  * only `spawnDevChild` touches the process table.
  */
 import { spawn } from 'node:child_process';
+import { SHELL_OPERATORS } from './unsupported-runtime.js';
 // ─── First-run race guard ───────────────────────────────────────────────────
 /**
  * Wait (bounded) for a browser tab to register as the bridge's sandbox peer
@@ -124,35 +125,43 @@ export function registerModuleUrl() {
     return new URL('../register/index.js', import.meta.url).href;
 }
 /**
- * Child env: sets the activator and APPENDS the loader to NODE_OPTIONS —
- * never replaces it (the user's own --inspect / --max-old-space-size etc.
- * must survive). `file:` URLs are percent-encoded, so no quoting is needed
- * even for paths with spaces.
+ * Child env: sets the activator and the beacon secret, and APPENDS the loader
+ * to NODE_OPTIONS rather than replacing it (the user's own --inspect /
+ * --max-old-space-size and so on must survive). `file:` URLs are
+ * percent-encoded, so no quoting is needed even for paths with spaces.
  */
 export function buildChildEnv(base, opts) {
     const importFlag = `--import ${opts.registerUrl}`;
-    return {
+    const env = {
         ...base,
         PYRIC_SANDBOX: `remote:${opts.serveUrl}`,
         NODE_OPTIONS: base.NODE_OPTIONS ? `${base.NODE_OPTIONS} ${importFlag}` : importFlag,
     };
+    if (opts.beaconToken !== undefined)
+        env.PYRIC_BEACON_TOKEN = opts.beaconToken;
+    return env;
 }
 /**
  * Format copy-pasteable POSIX export statements for host-only startup.
  * Grouped in a cleanly formatted console block for easy selection and copying
  * into a separate terminal (for example, when running Next.js independently).
+ *
+ * The beacon secret is part of the block: without it a process started this
+ * way still intercepts, but the dev server cannot confirm that it did.
  */
 export function formatStartupEnvExport(opts) {
-    const pyricSandbox = `remote:${opts.serveUrl}`;
-    const nodeOptions = `--import ${opts.registerUrl}`;
-    const line1 = `export PYRIC_SANDBOX="${pyricSandbox}"`;
-    const line2 = `export NODE_OPTIONS="${nodeOptions}"`;
-    const divider = '─'.repeat(Math.max(line1.length, line2.length) + 4);
+    const lines = [`export PYRIC_SANDBOX="remote:${opts.serveUrl}"`];
+    if (opts.beaconToken !== undefined) {
+        lines.push(`export PYRIC_BEACON_TOKEN="${opts.beaconToken}"`);
+    }
+    lines.push(`export NODE_OPTIONS="--import ${opts.registerUrl}"`);
+    const width = Math.max(...lines.map((line) => line.length));
+    const divider = '─'.repeat(width + 4);
+    const body = lines.map((line) => `  ${line}\n`).join('');
     return ('\n' +
         '  To run external commands against this sandbox, paste in another terminal:\n' +
         `  ${divider}\n` +
-        `  ${line1}\n` +
-        `  ${line2}\n` +
+        body +
         `  ${divider}\n`);
 }
 // ─── Line prefixing (pure core) ────────────────────────────────────────────
@@ -182,7 +191,6 @@ export function createLinePrefixer(prefix, write) {
 // ─── Spawn + lifecycle ─────────────────────────────────────────────────────
 /** How long a signalled child may linger before SIGKILL. */
 const FORCE_KILL_AFTER_MS = 2_000;
-const SHELL_OPERATORS = new Set(['&&', '||', '|', ';', '&']);
 /**
  * Spawn the child with inherited stdin and `[dev]`-prefixed stdout/stderr.
  * In `--json` mode ALL child output goes to stderr — stdout carries exactly
@@ -201,14 +209,9 @@ export function spawnSandboxChild(plan, opts) {
     }
     // 2. Check for discrete shell operators (&&, ||, |, ;) among top-level tokens
     const hasShellOperators = parts.some((token) => SHELL_OPERATORS.has(token));
-    // 3. Warn if runtime is bun or deno
-    if (parts.length > 0 && (parts[0] === 'bun' || parts[0] === 'deno')) {
-        const runner = parts[0];
-        const target = opts.json ? process.stderr : process.stdout;
-        target.write(`  ⚠ ${runner} detected: pyric intercepts Firebase imports via Node.js module loader hooks (NODE_OPTIONS="--import ..."). ` +
-            `${runner} does not evaluate Node loader hooks — SDK calls in this process will not reach the pyric sandbox. ` +
-            `Use \`node\` (or \`npx tsx\`) to run with the sandbox swap.\n`);
-    }
+    // The bun/deno warning is emitted by the launch seam in serve.ts, alongside
+    // the interlock line, so every pre-spawn statement about the child prints in
+    // one block and in order.
     const [command, ...args] = parts;
     let child;
     if (hasShellOperators) {

package/dist/cli/sandbox-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-runner.js","sourceRoot":"","sources":["../../src/cli/sandbox-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,OAKI,EAAE;IAEN,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC;YAC7E,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;gBACpE,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAaD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,+BAA+B,CAAC;IAC9C,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAE5B,IAAI,aAAa,GAAoB,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC;IACvC,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,CAAC;IAED,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAuB,EACvB,IAA+C;IAE/C,MAAM,UAAU,GAAG,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO;QACL,GAAG,IAAI;QACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;QACxC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU;KACpF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA+C;IACpF,MAAM,YAAY,GAAG,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,yBAAyB,YAAY,GAAG,CAAC;IACvD,MAAM,KAAK,GAAG,wBAAwB,WAAW,GAAG,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,OAAO,CACL,IAAI;QACJ,+EAA+E;QAC/E,KAAK,OAAO,IAAI;QAChB,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,IAAI;QACd,KAAK,OAAO,IAAI,CACjB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,KAA6B;IAE7B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,MAAM,IAAI,KAAK,CAAC;YAChB,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,KAAK;YACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC;gBAC9B,MAAM,GAAG,EAAE,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAU7D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAsB,EACtB,IAA4D;IAE5D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/C,yEAAyE;IACzE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAE5E,oCAAoC;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3D,MAAM,CAAC,KAAK,CACV,OAAO,MAAM,8GAA8G;YACzH,GAAG,MAAM,qGAAqG;YAC9G,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IACjC,IAAI,KAAmB,CAAC;IACxB,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE;YAC5B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG;YACH,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;YAClC,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,KAAK,CAAC,OAAQ,EAAE,IAAI,EAAE;YAC5B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG;YACH,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9D,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAAU,GAAyC,IAAI,CAAC;IAC5D,MAAM,QAAQ,GAAG,CAAC,MAAsB,EAAQ,EAAE;QAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;YACvF,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAClC,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACzC,kEAAkE;YAClE,IAAI,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC;iBACrB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;;gBAC5C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,KAAK;QACL,MAAM,CAAC,GAAmB;YACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS;gBAAE,OAAO;YACjD,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC;gBACH,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,IAAI,CAAC;oBACH,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACxB,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC"}
+{"version":3,"file":"sandbox-runner.js","sourceRoot":"","sources":["../../src/cli/sandbox-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,OAKI,EAAE;IAEN,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC;YAC7E,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;gBACpE,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAaD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,+BAA+B,CAAC;IAC9C,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAE5B,IAAI,aAAa,GAAoB,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC;IACvC,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,CAAC;IAED,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAuB,EACvB,IAAqB;IAErB,MAAM,UAAU,GAAG,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,GAAG,GAAsB;QAC7B,GAAG,IAAI;QACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;QACxC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU;KACpF,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC,WAAW,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAqB;IAC1D,MAAM,KAAK,GAAG,CAAC,gCAAgC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CACL,IAAI;QACJ,+EAA+E;QAC/E,KAAK,OAAO,IAAI;QAChB,IAAI;QACJ,KAAK,OAAO,IAAI,CACjB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,KAA6B;IAE7B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,MAAM,IAAI,KAAK,CAAC;YAChB,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,KAAK;YACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC;gBAC9B,MAAM,GAAG,EAAE,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAUlC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAsB,EACtB,IAA4D;IAE5D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/C,yEAAyE;IACzE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAE5E,4EAA4E;IAC5E,6EAA6E;IAC7E,0BAA0B;IAE1B,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IACjC,IAAI,KAAmB,CAAC;IACxB,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE;YAC5B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG;YACH,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;YAClC,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,KAAK,CAAC,OAAQ,EAAE,IAAI,EAAE;YAC5B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG;YACH,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9D,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAAU,GAAyC,IAAI,CAAC;IAC5D,MAAM,QAAQ,GAAG,CAAC,MAAsB,EAAQ,EAAE;QAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;YACvF,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAClC,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACzC,kEAAkE;YAClE,IAAI,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC;iBACrB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;;gBAC5C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,KAAK;QACL,MAAM,CAAC,GAAmB;YACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS;gBAAE,OAAO;YACjD,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC;gBACH,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,IAAI,CAAC;oBACH,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACxB,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC"}

package/dist/cli/serve.d.ts

@@ -29,6 +29,12 @@ export interface ServeRuntime {
         restoredDocs: number;
         restoredUsers: number;
     } | null;
+    /** Handshake beacons posted to `/__pyric/beacon` so far, the interlock
+     *  watchdog's only input. */
+    beaconCount: () => number;
+    /** The per-launch secret a beacon must present, placed in every child's
+     *  `PYRIC_BEACON_TOKEN`. */
+    beaconToken: string;
 }
 /** The `--json` stdout contract — one line, keep stable; agents parse this.
  *  Readiness probe: GET {url}/__pyric/init.json → 200 (body carries the live
@@ -110,15 +116,5 @@ export declare function bridgeEnabledFor(flags: {
 export declare function installServeProcessGuard(log: (message: string) => void, proc?: Pick<NodeJS.Process, 'on' | 'off'>): () => void;
 /** CLI entry. Resolves on SIGINT/SIGTERM after a clean stop. */
 export declare function runServe(parsed: ParsedArgs): Promise<number>;
-/**
- * Detect a bundler build that INLINED the real firebase SDK into its served
- * assets (`vite build` output). The served import map remaps only bare
- * `firebase/*` specifiers, so such a build cannot be sandboxed — its calls
- * reach real Google endpoints. Fingerprints are real-SDK-only endpoint hosts
- * that never appear in a sandbox-clean app (whose calls all route to
- * `/__pyric/*`). Bounded: depth ≤ 4, ≤ 200 script files, first hit per file.
- * Returns publicDir-relative paths of offending assets.
- */
-export declare function scanForInlinedFirebase(dir: string): string[];
 export {};
 //# sourceMappingURL=serve.d.ts.map

package/dist/cli/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/cli/serve.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AASzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAsB,iBAAiB,EAAqB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA6BhH,UAAU,aAAa;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED;;8BAE8B;AAC9B,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,aAAa,GAAG,IAAI,CAKhF;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAItE;AAGD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,WAAW,CAAC;IAC3B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;mCAC+B;IAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0DAA0D;IAC1D,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACjE;AAED;;mBAEmB;AACnB,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAY3D;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;6BACyB;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;yCACqC;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;4EACwE;IACxE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;gFAG4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;2EAEuE;IACvE,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,uFAAuF;IACvF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAC5D,GAAG,OAAO,CAAC,YAAY,CAAC,CAqZxB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,OAAO,CAEpF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EACpC,SAAS,EAAE,OAAO,EAClB,gBAAgB,GAAE,OAAc,GAC/B,OAAO,CAET;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EAC9B,IAAI,GAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,GAAG,KAAK,CAAW,GACjD,MAAM,IAAI,CAqBZ;AAgCD,gEAAgE;AAChE,wBAAsB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAiUlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CA8C5D"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/cli/serve.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAUzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,EAAsB,iBAAiB,EAAqB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmChH,UAAU,aAAa;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED;;8BAE8B;AAC9B,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,aAAa,GAAG,IAAI,CAKhF;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAItE;AAGD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,WAAW,CAAC;IAC3B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;mCAC+B;IAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0DAA0D;IAC1D,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE;iCAC6B;IAC7B,WAAW,EAAE,MAAM,MAAM,CAAC;IAC1B;gCAC4B;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;mBAEmB;AACnB,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAY3D;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;6BACyB;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;yCACqC;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;4EACwE;IACxE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;gFAG4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;2EAEuE;IACvE,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,uFAAuF;IACvF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAC5D,GAAG,OAAO,CAAC,YAAY,CAAC,CAwaxB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,OAAO,CAEpF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EACpC,SAAS,EAAE,OAAO,EAClB,gBAAgB,GAAE,OAAc,GAC/B,OAAO,CAET;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EAC9B,IAAI,GAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,GAAG,KAAK,CAAW,GACjD,MAAM,IAAI,CAqBZ;AAgCD,gEAAgE;AAChE,wBAAsB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAuVlE"}