@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/dist/register/child-process-guard.js

@@ -0,0 +1,165 @@
+/**
+ * The register in child processes.
+ *
+ * A child process of a registered process is in the sandbox, whatever it is
+ * started with (#1618). Node passes a preload to a child only through
+ * `NODE_OPTIONS`, so a child loses the register when the parent got it on the
+ * command line (`node --import @pyric/cli/register`), or when the caller gives
+ * the child its own `NODE_OPTIONS` or `env`. Each of those children kept or
+ * dropped `PYRIC_SANDBOX` and loaded the real `firebase-admin`.
+ *
+ * This module rewrites the environment of every child the process starts:
+ * `NODE_OPTIONS` gets `--import <register>` when it lacks the register, and
+ * each `PYRIC_*` variable this process has and the child's environment lacks
+ * is copied in, `PYRIC_SANDBOX` first among them. A variable the caller set
+ * for the child keeps the caller's value. A shell the process starts passes
+ * the environment on, so a Node process the shell starts is registered too,
+ * unless the command line it runs sets `NODE_OPTIONS` itself
+ * (`NODE_OPTIONS=--max-old-space-size=4096 node server.js`), which no code in
+ * this process can see.
+ *
+ * Every asynchronous child (`spawn`, `exec`, `execFile`, `fork`, and their
+ * promisified forms) is built by `ChildProcess.prototype.spawn` from the env
+ * Node has already resolved, so one wrapper there covers them. The
+ * synchronous forms reach a native binding instead, so `spawnSync`,
+ * `execSync` and `execFileSync` are wrapped where they are exported.
+ */
+import Module, { createRequire } from 'node:module';
+/** Marks a function this module already wrapped. */
+const GUARDED = Symbol.for('pyric.guardedChildProcess');
+/** The variables that carry the sandbox to a child. */
+const SANDBOX_VARIABLE = /^PYRIC_/;
+/** The register, named by its package rather than its file. */
+const REGISTER_BY_NAME = /(^|\s)--import[= ]?["']?@pyric\/cli\/register(["'\s]|$)/;
+/** Whether `nodeOptions` already loads the register. */
+function loadsRegister(nodeOptions, registerUrl) {
+    return nodeOptions.includes(registerUrl) || REGISTER_BY_NAME.test(nodeOptions);
+}
+/**
+ * The environment to start a child with, so that it loads the register at
+ * `registerUrl` in the sandbox `parentEnv` names. Returns a new object and
+ * never changes `childEnv`. `file:` URLs are percent-encoded, so the import
+ * needs no quoting in `NODE_OPTIONS`.
+ */
+export function guardChildEnv(childEnv, parentEnv, registerUrl) {
+    const guarded = { ...childEnv };
+    for (const [name, value] of Object.entries(parentEnv)) {
+        const childLacksIt = guarded[name] === undefined || guarded[name] === '';
+        if (SANDBOX_VARIABLE.test(name) && value !== undefined && childLacksIt)
+            guarded[name] = value;
+    }
+    const nodeOptions = guarded.NODE_OPTIONS ?? '';
+    if (!loadsRegister(nodeOptions, registerUrl)) {
+        const importFlag = `--import ${registerUrl}`;
+        guarded.NODE_OPTIONS = nodeOptions.trim() === '' ? importFlag : `${nodeOptions} ${importFlag}`;
+    }
+    return guarded;
+}
+/** `envPairs` (`NAME=value` strings, as `ChildProcess.prototype.spawn` takes them) with the guarded env. */
+export function guardEnvPairs(envPairs, parentEnv, registerUrl) {
+    const childEnv = {};
+    for (const pair of envPairs) {
+        const split = pair.indexOf('=');
+        if (split === -1)
+            childEnv[pair] = '';
+        else
+            childEnv[pair.slice(0, split)] = pair.slice(split + 1);
+    }
+    const guarded = guardChildEnv(childEnv, parentEnv, registerUrl);
+    const pairs = [];
+    for (const [name, value] of Object.entries(guarded)) {
+        if (value !== undefined)
+            pairs.push(`${name}=${value}`);
+    }
+    return pairs;
+}
+function isOptions(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Where a synchronous call's options go. `execSync(command, options)` takes
+ * them second. `spawnSync` and `execFileSync` take `(file, args, options)`,
+ * where `args` may be left out, or passed as `undefined` or `null`.
+ */
+function optionsIndex(takesArgs, args) {
+    if (!takesArgs)
+        return 1;
+    const second = args[1];
+    if (isOptions(second))
+        return 1;
+    const hasArgsSlot = Array.isArray(second) || (second == null && args.length > 2);
+    return hasArgsSlot ? 2 : 1;
+}
+/**
+ * The arguments for a synchronous `child_process` call, with options whose
+ * `env` is guarded. A call that names no env gets one built from this
+ * process's env, as Node would build it. Returns new values and never changes
+ * the caller's.
+ */
+export function guardSyncArguments(takesArgs, args, parentEnv, registerUrl) {
+    const guarded = [...args];
+    const index = optionsIndex(takesArgs, guarded);
+    const options = isOptions(guarded[index]) ? guarded[index] : {};
+    guarded[index] = { ...options, env: guardChildEnv(options.env ?? parentEnv, parentEnv, registerUrl) };
+    return guarded;
+}
+function isGuarded(value) {
+    return typeof value === 'function' && value[GUARDED] === true;
+}
+function markGuarded(wrapper, original) {
+    Object.defineProperty(wrapper, GUARDED, { value: true });
+    Object.defineProperty(wrapper, 'name', { value: original.name });
+    return wrapper;
+}
+/**
+ * The options `ChildProcess.prototype.spawn` receives, with the env guarded.
+ * Node resolves the child's env into `envPairs` before this call. Bun builds
+ * its children elsewhere and ignores the env here, so its asynchronous
+ * children are not covered; its synchronous ones are.
+ */
+export function guardSpawnOptions(options, registerUrl) {
+    if (!isOptions(options))
+        return options;
+    const { envPairs } = options;
+    if (!Array.isArray(envPairs))
+        return options;
+    return { ...options, envPairs: guardEnvPairs(envPairs, process.env, registerUrl) };
+}
+function guardAsyncSpawn(target, registerUrl) {
+    const prototype = target.ChildProcess?.prototype;
+    const original = prototype?.spawn;
+    if (typeof original !== 'function' || isGuarded(original))
+        return;
+    const spawnOriginal = original;
+    prototype.spawn = markGuarded(function (...args) {
+        args[0] = guardSpawnOptions(args[0], registerUrl);
+        return spawnOriginal.apply(this, args);
+    }, spawnOriginal);
+}
+function guardSyncExport(target, name, registerUrl) {
+    const original = target[name];
+    if (typeof original !== 'function' || isGuarded(original))
+        return;
+    const takesArgs = name !== 'execSync';
+    const syncOriginal = original;
+    target[name] = markGuarded(function (...args) {
+        return syncOriginal.apply(this, guardSyncArguments(takesArgs, args, process.env, registerUrl));
+    }, syncOriginal);
+}
+/**
+ * Start every child process of this process with the register at
+ * `registerUrl` (see the module comment). `childProcess` defaults to
+ * `node:child_process`; tests pass a stand-in.
+ */
+export function installChildProcessGuard(registerUrl, childProcess) {
+    const target = childProcess ?? createRequire(import.meta.url)('node:child_process');
+    guardAsyncSpawn(target, registerUrl);
+    guardSyncExport(target, 'spawnSync', registerUrl);
+    guardSyncExport(target, 'execSync', registerUrl);
+    guardSyncExport(target, 'execFileSync', registerUrl);
+    // ESM `import { spawnSync } from 'node:child_process'` reads the export as
+    // synced, so publish the replacements there too.
+    if (childProcess === undefined)
+        Module.syncBuiltinESMExports();
+}
+//# sourceMappingURL=child-process-guard.js.map

package/dist/register/child-process-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process-guard.js","sourceRoot":"","sources":["../../src/register/child-process-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAYpD,oDAAoD;AACpD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;AAExD,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAEnC,+DAA+D;AAC/D,MAAM,gBAAgB,GAAG,yDAAyD,CAAC;AAEnF,wDAAwD;AACxD,SAAS,aAAa,CAAC,WAAmB,EAAE,WAAmB;IAC7D,OAAO,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAAa,EAAE,SAAc,EAAE,WAAmB;IAC9E,MAAM,OAAO,GAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACzE,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAChG,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,YAAY,WAAW,EAAE,CAAC;QAC7C,OAAO,CAAC,YAAY,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,UAAU,EAAE,CAAC;IACjG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,aAAa,CAAC,QAA2B,EAAE,SAAc,EAAE,WAAmB;IAC5F,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;;YACjC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,SAAkB,EAAE,IAAwB;IAChE,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjF,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAkB,EAClB,IAAwB,EACxB,SAAc,EACd,WAAmB;IAEnB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;IACtG,OAAO,OAAO,CAAC;AACjB,CAAC;AAID,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,UAAU,IAAK,KAA8B,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAC1F,CAAC;AAED,SAAS,WAAW,CAAwB,OAAU,EAAE,QAAqB;IAC3E,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,WAAmB;IACrE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAiC,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAoB,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B,EAAE,WAAmB;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;IACjD,MAAM,QAAQ,GAAG,SAAS,EAAE,KAAK,CAAC;IAClC,IAAI,OAAO,QAAQ,KAAK,UAAU,IAAI,SAAS,CAAC,QAAQ,CAAC;QAAE,OAAO;IAClE,MAAM,aAAa,GAAG,QAAuB,CAAC;IAC9C,SAAS,CAAC,KAAK,GAAG,WAAW,CAAC,UAAyB,GAAG,IAAe;QACvE,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAClD,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC,EAAE,aAAa,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CACtB,MAA0B,EAC1B,IAA+C,EAC/C,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,QAAQ,KAAK,UAAU,IAAI,SAAS,CAAC,QAAQ,CAAC;QAAE,OAAO;IAClE,MAAM,SAAS,GAAG,IAAI,KAAK,UAAU,CAAC;IACtC,MAAM,YAAY,GAAG,QAAuB,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,UAAyB,GAAG,IAAe;QACpE,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IACjG,CAAC,EAAE,YAAY,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB,EAAE,YAAiC;IAC7F,MAAM,MAAM,GAAG,YAAY,IAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAwB,CAAC;IAC5G,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAClD,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACjD,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACrD,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;AACjE,CAAC"}

package/dist/register/client/bootstrap.js

@@ -9,7 +9,7 @@
  *
  * - the host is resolved as `remoteSandbox()` resolves it for `pyric-admin`
  *   (`PYRIC_SANDBOX_INSTANCE`, the stale-url check, `.pyric/serve.json`), at
- *   the first call that needs it;
+ *   the first call that needs it, and again after the connection is lost;
  * - the served entries get a Node runtime origin: `init.json` and the socket
  *   on that host, the `ws` realm (`./node-realm.ts`), and the refusal every
  *   call gets when the host is not the Node host;
@@ -79,12 +79,17 @@ function hostOnce() {
     }
     return host;
 }
+/** A lost connection resolves the host again at the next call; a host that moved is found where it now runs. */
+function forgetHost() {
+    host = undefined;
+}
 const socketRealm = createNodeSocketRealm({ onAttached: ack => reportVersionSkew(ack.serveVersion) });
 // The in-process host ended for good (its dev server closed): let the process go.
 onProcessActivationEnd(() => socketRealm.releaseAll());
 installNodeRuntimeOrigin({
     realm: 'node',
     host: hostOnce,
+    forgetHost,
     socketRealm,
     offHostError: (detail) => inProcessActivation()?.offHostError(detail) ?? offHostRefusal(detail),
 });

package/dist/register/client/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../src/register/client/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnG,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,sFAAsF;AACtF,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,OAAO,iBAAiB,CAAC;QACvB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,aAAa;QACb,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;KAC/C,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,SAAS,iBAAiB,CAAC,YAAqB;IAC9C,IAAI,YAAY;QAAE,OAAO;IACzB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;IACpG,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IAC9B,YAAY,GAAG,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,QAAQ,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,IAAI,IAAiC,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,QAAQ;IACf,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;QAChC,IAAI,GAAG,SAAS,CAAC;QACjB,+EAA+E;QAC/E,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE;YACnB,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC;YACpC,IAAI,QAAQ;gBAAE,IAAI,GAAG,SAAS,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AACtG,kFAAkF;AAClF,sBAAsB,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;AAEvD,wBAAwB,CAAC;IACvB,KAAK,EAAE,MAAM;IACb,IAAI,EAAE,QAAQ;IACd,WAAW;IACX,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC;CAChG,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;AAChD,sBAAsB,CAAC,GAAG,EAAE;IAC1B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../src/register/client/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnG,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,sFAAsF;AACtF,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,OAAO,iBAAiB,CAAC;QACvB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,aAAa;QACb,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;KAC/C,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,SAAS,iBAAiB,CAAC,YAAqB;IAC9C,IAAI,YAAY;QAAE,OAAO;IACzB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;IACpG,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IAC9B,YAAY,GAAG,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,QAAQ,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,IAAI,IAAiC,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,QAAQ;IACf,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;QAChC,IAAI,GAAG,SAAS,CAAC;QACjB,+EAA+E;QAC/E,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE;YACnB,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC;YACpC,IAAI,QAAQ;gBAAE,IAAI,GAAG,SAAS,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gHAAgH;AAChH,SAAS,UAAU;IACjB,IAAI,GAAG,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AACtG,kFAAkF;AAClF,sBAAsB,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;AAEvD,wBAAwB,CAAC;IACvB,KAAK,EAAE,MAAM;IACb,IAAI,EAAE,QAAQ;IACd,UAAU;IACV,WAAW;IACX,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC;CAChG,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;AAChD,sBAAsB,CAAC,GAAG,EAAE;IAC1B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC"}

package/dist/register/connect-prototypes.d.ts

@@ -15,4 +15,13 @@ export declare function nodeAgentPrototypes(): object[];
  * is the seam no client connection can route around.
  */
 export declare function nodeSocketPrototypes(): object[];
+/**
+ * The `http.ClientRequest` prototype. Every `http.request` and `https.request`
+ * reaches `ClientRequest.prototype.onSocket` once it has a socket, whether an
+ * Agent made it or the caller's `createConnection` did, and before the request
+ * line is written. It is the one place the request's own `method` and `path`
+ * are readable: an Agent's `createConnection` receives `path: null`. A
+ * `CONNECT` request names its real destination there.
+ */
+export declare function nodeClientRequestPrototypes(): object[];
 //# sourceMappingURL=connect-prototypes.d.ts.map

package/dist/register/connect-prototypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-prototypes.d.ts","sourceRoot":"","sources":["../../src/register/connect-prototypes.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAK9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAE/C"}
+{"version":3,"file":"connect-prototypes.d.ts","sourceRoot":"","sources":["../../src/register/connect-prototypes.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAK9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAE/C;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,EAAE,CAEtD"}

package/dist/register/connect-prototypes.js

@@ -55,4 +55,15 @@ export function nodeAgentPrototypes() {
 export function nodeSocketPrototypes() {
     return builtinPrototypes([['node:net', 'Socket']]);
 }
+/**
+ * The `http.ClientRequest` prototype. Every `http.request` and `https.request`
+ * reaches `ClientRequest.prototype.onSocket` once it has a socket, whether an
+ * Agent made it or the caller's `createConnection` did, and before the request
+ * line is written. It is the one place the request's own `method` and `path`
+ * are readable: an Agent's `createConnection` receives `path: null`. A
+ * `CONNECT` request names its real destination there.
+ */
+export function nodeClientRequestPrototypes() {
+    return builtinPrototypes([['node:http', 'ClientRequest']]);
+}
 //# sourceMappingURL=connect-prototypes.js.map

package/dist/register/connect-prototypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-prototypes.js","sourceRoot":"","sources":["../../src/register/connect-prototypes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,EAAU,EAAE,UAAkB;IACtD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAwD,CAAC;QAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;QAC7C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8CAA8C;AAC9C,SAAS,iBAAiB,CAAC,OAA+C;IACxE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,iBAAiB,CAAC;QACvB,CAAC,WAAW,EAAE,OAAO,CAAC;QACtB,CAAC,YAAY,EAAE,OAAO,CAAC;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,iBAAiB,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"connect-prototypes.js","sourceRoot":"","sources":["../../src/register/connect-prototypes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,EAAU,EAAE,UAAkB;IACtD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAwD,CAAC;QAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;QAC7C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8CAA8C;AAC9C,SAAS,iBAAiB,CAAC,OAA+C;IACxE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,iBAAiB,CAAC;QACvB,CAAC,WAAW,EAAE,OAAO,CAAC;QACtB,CAAC,YAAY,EAAE,OAAO,CAAC;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,iBAAiB,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/register/hooks.d.ts

@@ -8,6 +8,12 @@ interface ResolveResult {
     format?: string | null;
     shortCircuit?: boolean;
 }
-export declare function resolve(specifier: string, context: ResolveContext, nextResolve: (specifier: string, context?: ResolveContext) => Promise<ResolveResult>): Promise<ResolveResult>;
+type NextResolve = (specifier: string, context?: ResolveContext) => Promise<ResolveResult>;
+/**
+ * Swap or stop (ADR 0022). A throw here rejects the import on the main
+ * thread, so this hook stops ESM imports of the real SDK without reaching the
+ * network guard. CommonJS `require` never reaches this hook.
+ */
+export declare function resolve(specifier: string, context: ResolveContext, nextResolve: NextResolve): Promise<ResolveResult>;
 export {};
 //# sourceMappingURL=hooks.d.ts.map

package/dist/register/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/register/hooks.ts"],"names":[],"mappings":"AAYA,UAAU,cAAc;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AACD,UAAU,aAAa;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,OAAO,CACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,GACnF,OAAO,CAAC,aAAa,CAAC,CAOxB"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/register/hooks.ts"],"names":[],"mappings":"AAcA,UAAU,cAAc;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AACD,UAAU,aAAa;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,KAAK,WAAW,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAyB3F;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,aAAa,CAAC,CAWxB"}

package/dist/register/hooks.js

@@ -8,8 +8,50 @@
  * a warning saying exactly that). Keep this module free of side effects and
  * heavy imports: the loader thread re-instantiates it in isolation.
  */
-import { mapFirebaseSpecifier } from './mapping.js';
-export function resolve(specifier, context, nextResolve) {
+import { canonicalFirebaseSpecifier, mapFirebaseSpecifier } from './mapping.js';
+import { resolvesIntoPackage } from './package-identity.js';
+import { createStopReporter, stopFor } from './swap-or-stop.js';
+/**
+ * A Turbopack-renamed import (`firebase-admin-<hash>/app`, #1443) resolves as
+ * given first, and maps by its canonical name only when that landed in the
+ * real package, so an unrelated package with such a name stays itself.
+ */
+async function resolveRenamed(specifier, canonical, context, nextResolve) {
+    const renamed = await nextResolve(specifier, context);
+    const isRealFirebasePackage = resolvesIntoPackage(renamed.url, canonical);
+    if (!isRealFirebasePackage)
+        return renamed;
+    const mappedSpecifier = mapFirebaseSpecifier(canonical, context.parentURL);
+    if (mappedSpecifier === null)
+        return renamed;
+    return nextResolve(mappedSpecifier, context);
+}
+const reportStop = createStopReporter((line) => void process.stderr.write(line));
+/** The real SDK files this hook allowed (`stopFor`). */
+const allowedUrls = new Set();
+/**
+ * Swap or stop (ADR 0022). A throw here rejects the import on the main
+ * thread, so this hook stops ESM imports of the real SDK without reaching the
+ * network guard. CommonJS `require` never reaches this hook.
+ */
+export async function resolve(specifier, context, nextResolve) {
+    const result = await resolveFirebase(specifier, context, nextResolve);
+    const stop = stopFor({
+        specifier,
+        canonical: canonicalFirebaseSpecifier(specifier),
+        importer: context.parentURL,
+        url: result.url,
+    }, allowedUrls);
+    if (stop === null)
+        return result;
+    reportStop(stop);
+    throw stop;
+}
+function resolveFirebase(specifier, context, nextResolve) {
+    const canonical = canonicalFirebaseSpecifier(specifier);
+    if (canonical !== null) {
+        return resolveRenamed(specifier, canonical, context, nextResolve);
+    }
     const mappedSpecifier = mapFirebaseSpecifier(specifier, context.parentURL);
     const hasMappedSpecifier = mappedSpecifier !== null && mappedSpecifier !== undefined;
     if (hasMappedSpecifier) {

package/dist/register/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/register/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAapD,MAAM,UAAU,OAAO,CACrB,SAAiB,EACjB,OAAuB,EACvB,WAAoF;IAEpF,MAAM,eAAe,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,kBAAkB,GAAG,eAAe,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,CAAC;IACrF,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/register/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAehE;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,SAAiB,EACjB,SAAiB,EACjB,OAAuB,EACvB,WAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,qBAAqB,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1E,IAAI,CAAC,qBAAqB;QAAE,OAAO,OAAO,CAAC;IAC3C,MAAM,eAAe,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3E,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC7C,OAAO,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACjF,wDAAwD;AACxD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAiB,EACjB,OAAuB,EACvB,WAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC;QACnB,SAAS;QACT,SAAS,EAAE,0BAA0B,CAAC,SAAS,CAAC;QAChD,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,EAAE,WAAW,CAAC,CAAC;IAChB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACjC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,IAAI,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CACtB,SAAiB,EACjB,OAAuB,EACvB,WAAwB;IAExB,MAAM,SAAS,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,kBAAkB,GAAG,eAAe,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,CAAC;IACrF,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/dist/register/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/register/index.ts"],"names":[],"mappings":"AAkOA;;yEAEyE;AACzE,eAAO,IAAI,MAAM,SAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/register/index.ts"],"names":[],"mappings":"AAySA;;yEAEyE;AACzE,eAAO,IAAI,MAAM,SAAQ,CAAC"}

package/dist/register/index.js

@@ -18,10 +18,19 @@
  * `module.register()` (ESM-only) with a warning that CJS require() is not
  * rewritten.
  *
+ * Swap or stop (ADR 0022, `./swap-or-stop.js`): an import that resolves into
+ * the real `firebase-admin`, or into the real client SDK where the swap table
+ * didn't choose it, throws `PYRIC_REAL_SDK_STOPPED` before the file loads.
+ *
  * On activation it also installs the NETWORK GUARD (`./net-guard.js`), which
  * refuses egress from this process to live Google/Firebase endpoints, or only
  * reports it under `PYRIC_GUARD=warn`. See that module for the policy and the
- * `PYRIC_GUARD` and `PYRIC_GUARD_ALLOW` knobs.
+ * `PYRIC_GUARD` and `PYRIC_GUARD_ALLOW` knobs. Whatever the guard mode, it
+ * wraps `worker_threads.Worker` (`./worker-guard.js`) so every worker thread
+ * loads this module as well, including those Node starts without preloads,
+ * and gets the swap and the stop. It also wraps `child_process`
+ * (`./child-process-guard.js`), so every child process starts with this
+ * module in its `NODE_OPTIONS` and in this process's sandbox.
  *
  * Finally it emits the HANDSHAKE BEACON (`./beacon.js`): a fire-and-forget
  * `POST /__pyric/beacon` when the activator carries a bridge URL, plus a
@@ -33,10 +42,15 @@ import Module from 'node:module';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { mapFirebaseSpecifier } from './mapping.js';
+import { canonicalFirebaseSpecifier, mapFirebaseSpecifier } from './mapping.js';
+import { resolvesIntoPackage } from './package-identity.js';
+import { markRegisterActive } from './activation.js';
+import { createStopReporter, stopFor } from './swap-or-stop.js';
 import { resolveEsmOnlySubpath } from './esm-exports.js';
 import { NET_GUARD_GLOBAL, installNetGuard, parseGuardMode } from './net-guard.js';
 import { emitBeacon } from './beacon.js';
+import { installWorkerGuard } from './worker-guard.js';
+import { installChildProcessGuard } from './child-process-guard.js';
 import { remoteSandbox } from '../remote/index.js';
 import { resolveAiMode } from '../serve/firebase-module-swap.js';
 /** The shared seam with pyric-admin's ambient init: a synchronous factory
@@ -85,6 +99,71 @@ function resolveEsmOnlyForRequire(mapped) {
         return null;
     }
 }
+/** Resolve a mapped pyric target from this installed CLI. */
+function resolveMapped(mapped, context, nextResolve) {
+    try {
+        return nextResolve(mapped, { ...context, parentURL: import.meta.url });
+    }
+    catch (err) {
+        // CJS `require('firebase-admin/app')` resolves under the `require`
+        // condition, but the pyric mirrors are ESM-only. Resolve the file
+        // under import conditions ourselves — require(esm) (Node ≥ 22.12)
+        // loads it fine once given the URL.
+        const code = err.code;
+        if (code === 'ERR_PACKAGE_PATH_NOT_EXPORTED' || code === 'MODULE_NOT_FOUND') {
+            const url = resolveEsmOnlyForRequire(mapped);
+            if (url)
+                return { url, shortCircuit: true };
+        }
+        throw err;
+    }
+}
+/**
+ * The sync resolve hook. A canonical Firebase specifier maps directly. A
+ * Turbopack-renamed one (`firebase-admin-<hash>/app`, #1443) resolves as
+ * given first, and maps by its canonical name only when that landed in the
+ * real package, so an unrelated package with such a name stays itself.
+ */
+const resolveFirebase = (specifier, context, nextResolve) => {
+    const canonical = canonicalFirebaseSpecifier(specifier);
+    if (canonical === null) {
+        const mapped = mapFirebaseSpecifier(specifier, context.parentURL);
+        if (mapped === null)
+            return nextResolve(specifier, context);
+        return resolveMapped(mapped, context, nextResolve);
+    }
+    const renamed = nextResolve(specifier, context);
+    const isRealFirebasePackage = resolvesIntoPackage(renamed.url, canonical);
+    if (!isRealFirebasePackage)
+        return renamed;
+    const mapped = mapFirebaseSpecifier(canonical, context.parentURL);
+    if (mapped === null)
+        return renamed;
+    return resolveMapped(mapped, context, nextResolve);
+};
+/**
+ * Swap or stop (ADR 0022): a resolve that lands in the real `firebase-admin`,
+ * or in the real client SDK where the swap table didn't choose it, throws
+ * before the file loads, and the stop is written to stderr once per file. It
+ * does not depend on the network guard, so `PYRIC_GUARD=off` keeps it.
+ */
+function withSwapOrStop(resolve) {
+    const report = createStopReporter((line) => void process.stderr.write(line));
+    const allowedUrls = new Set();
+    return (specifier, context, nextResolve) => {
+        const result = resolve(specifier, context, nextResolve);
+        const stop = stopFor({
+            specifier,
+            canonical: canonicalFirebaseSpecifier(specifier),
+            importer: context.parentURL,
+            url: result.url,
+        }, allowedUrls);
+        if (stop === null)
+            return result;
+        report(stop);
+        throw stop;
+    };
+}
 function activate() {
     // FIRST, before any hook or global: the network guard.
     //
@@ -107,6 +186,16 @@ function activate() {
     // plugin's configured AI upstream, can permit it (`permitGuardHost`).
     if (guard !== null)
         globalThis[NET_GUARD_GLOBAL] = guard;
+    // Built-ins and resolve hooks are per thread: every worker this process
+    // starts loads this module too, including the kinds Node starts without
+    // running preloads. Whatever PYRIC_GUARD says, since the worker's swap and
+    // stop come from this module; the worker installs its own network guard, or
+    // none under `off`, exactly as this thread does.
+    installWorkerGuard(import.meta.url);
+    // Child processes too (#1618): every child starts with this module in its
+    // NODE_OPTIONS and with this process's PYRIC_* variables it lacks, so a
+    // child of a registered process is registered whatever env it is given.
+    installChildProcessGuard(import.meta.url);
     // Whether module resolution is actually being intercepted. Both branches
     // below install SOMETHING, but a runtime with neither API installs nothing,
     // which is precisely the state the beacon exists to make visible.
@@ -114,27 +203,7 @@ function activate() {
     if (typeof moduleApi.registerHooks === 'function') {
         hooksInstalled = true;
         moduleApi.registerHooks({
-            resolve(specifier, context, nextResolve) {
-                const mapped = mapFirebaseSpecifier(specifier, context.parentURL);
-                if (mapped === null)
-                    return nextResolve(specifier, context);
-                try {
-                    return nextResolve(mapped, { ...context, parentURL: import.meta.url });
-                }
-                catch (err) {
-                    // CJS `require('firebase-admin/app')` resolves under the `require`
-                    // condition, but the pyric mirrors are ESM-only. Resolve the file
-                    // under import conditions ourselves — require(esm) (Node ≥ 22.12)
-                    // loads it fine once given the URL.
-                    const code = err.code;
-                    if (code === 'ERR_PACKAGE_PATH_NOT_EXPORTED' || code === 'MODULE_NOT_FOUND') {
-                        const url = resolveEsmOnlyForRequire(mapped);
-                        if (url)
-                            return { url, shortCircuit: true };
-                    }
-                    throw err;
-                }
-            },
+            resolve: withSwapOrStop(resolveFirebase),
         });
     }
     else {
@@ -208,6 +277,7 @@ if (process.env.PYRIC_SANDBOX) {
     else {
         activate();
         active = true;
+        markRegisterActive();
     }
 }
 // No PYRIC_SANDBOX → inert by design: importing this module rewrites nothing.

package/dist/register/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/register/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAkB,MAAM,gBAAgB,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEjE;;4CAE4C;AAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAElE,gHAAgH;AAChH,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAiBxF;iEACiE;AACjE,MAAM,SAAS,GAAG,MAIjB,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,MAAc;IAC9C,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACjE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/D,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,SAAS,CAAC,eAAe,CACrC,OAAO,EACP,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAA0B,CAAC;QACnF,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,uDAAuD;IACvD,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,+BAA+B;IAC/B,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,KAAK,KAAK,IAAI;QAAG,UAAiD,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;IAEjG,yEAAyE;IACzE,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QAClD,cAAc,GAAG,IAAI,CAAC;QACtB,SAAS,CAAC,aAAa,CAAC;YACtB,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW;gBACrC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;gBAClE,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC5D,IAAI,CAAC;oBACH,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,mEAAmE;oBACnE,kEAAkE;oBAClE,kEAAkE;oBAClE,oCAAoC;oBACpC,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;oBAC7C,IAAI,IAAI,KAAK,+BAA+B,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;wBAC5E,MAAM,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;wBAC7C,IAAI,GAAG;4BAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;oBAC9C,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sFAAsF;YACpF,yFAAyF;YACzF,qGAAqG,CACxG,CAAC;QACF,cAAc,GAAG,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC;QAC1D,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACvE,UAAsC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAuB,EAAE,EAAE,CACrF,aAAa,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAE9F,uBAAuB,EAAE,CAAC;IAE1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kFAAkF;QAChF,gCAAgC,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAClE,CAAC;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,0EAA0E;IAC1E,UAAU,CAAC;QACT,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB;IAC9B,MAAM,kBAAkB,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC;IAClF,IAAI,CAAC,kBAAkB;QAAE,OAAO;IAC/B,UAAsC,CAAC,2BAA2B,CAAC,GAAG,KAAK,EAAE,KAAa,EAAE,SAAiB,EAAE,EAAE;QAChH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,2BAA2B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,KAAiC;IAC3D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IACtC,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;;yEAEyE;AACzE,MAAM,CAAC,IAAI,MAAM,GAAG,KAAK,CAAC;AAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wEAAwE;YACtE,qDAAqD;YACrD,wDAAwD,CAC3D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,QAAQ,EAAE,CAAC;QACX,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AACD,8EAA8E"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/register/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAkB,MAAM,gBAAgB,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEjE;;4CAE4C;AAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAElE,gHAAgH;AAChH,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAiBxF;iEACiE;AACjE,MAAM,SAAS,GAAG,MAIjB,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,MAAc;IAC9C,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACjE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/D,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,SAAS,CAAC,eAAe,CACrC,OAAO,EACP,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAA0B,CAAC;QACnF,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAID,6DAA6D;AAC7D,SAAS,aAAa,CAAC,MAAc,EAAE,OAA2B,EAAE,WAA4B;IAC9F,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,oCAAoC;QACpC,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;QAC7C,IAAI,IAAI,KAAK,+BAA+B,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC5E,MAAM,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;IACvE,MAAM,SAAS,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,qBAAqB,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1E,IAAI,CAAC,qBAAqB;QAAE,OAAO,OAAO,CAAC;IAC3C,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpC,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAoB;IAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC;YACnB,SAAS;YACT,SAAS,EAAE,0BAA0B,CAAC,SAAS,CAAC;YAChD,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,uDAAuD;IACvD,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,+BAA+B;IAC/B,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,KAAK,KAAK,IAAI;QAAG,UAAiD,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;IACjG,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,iDAAiD;IACjD,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1C,yEAAyE;IACzE,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QAClD,cAAc,GAAG,IAAI,CAAC;QACtB,SAAS,CAAC,aAAa,CAAC;YACtB,OAAO,EAAE,cAAc,CAAC,eAAe,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sFAAsF;YACpF,yFAAyF;YACzF,qGAAqG,CACxG,CAAC;QACF,cAAc,GAAG,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC;QAC1D,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACvE,UAAsC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAuB,EAAE,EAAE,CACrF,aAAa,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAE9F,uBAAuB,EAAE,CAAC;IAE1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kFAAkF;QAChF,gCAAgC,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAClE,CAAC;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,0EAA0E;IAC1E,UAAU,CAAC;QACT,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB;IAC9B,MAAM,kBAAkB,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC;IAClF,IAAI,CAAC,kBAAkB;QAAE,OAAO;IAC/B,UAAsC,CAAC,2BAA2B,CAAC,GAAG,KAAK,EAAE,KAAa,EAAE,SAAiB,EAAE,EAAE;QAChH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,2BAA2B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,KAAiC;IAC3D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IACtC,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;;yEAEyE;AACzE,MAAM,CAAC,IAAI,MAAM,GAAG,KAAK,CAAC;AAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wEAAwE;YACtE,qDAAqD;YACrD,wDAAwD,CAC3D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,QAAQ,EAAE,CAAC;QACX,MAAM,GAAG,IAAI,CAAC;QACd,kBAAkB,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AACD,8EAA8E"}

package/dist/register/mapping.d.ts

@@ -18,6 +18,12 @@
  * narrow: only the two package roots match. `@firebase/*` internals,
  * `firebase-functions`, and anything merely *containing* "firebase" pass
  * through untouched.
+ *
+ * Next 16's Turbopack renames server externals (#1443): it links
+ * `.next/node_modules/firebase-admin-<16 hex>` to the installed package and
+ * imports `firebase-admin-<hash>/app`. `canonicalFirebaseSpecifier` names such
+ * an import by its package, and the hooks map the canonical name only after
+ * the renamed import resolved into the real package (`package-identity.ts`).
  */
 import { type AiMode } from '../serve/firebase-module-swap.js';
 export interface MapFirebaseOptions {
@@ -25,6 +31,33 @@ export interface MapFirebaseOptions {
     /** The activator value; defaults to `process.env.PYRIC_SANDBOX`. */
     sandbox?: string;
 }
+/**
+ * The canonical name of a Turbopack-renamed Firebase import
+ * (`firebase-admin-<hash>/app` → `firebase-admin/app`), or `null` when the
+ * specifier isn't one. The name alone proves nothing: the caller confirms the
+ * import resolved into the package of that name before mapping it.
+ */
+export declare function canonicalFirebaseSpecifier(specifier: string): string | null;
+export interface RealFirebaseLoad {
+    /** The specifier as written, or its canonical name when Turbopack renamed it. */
+    specifier: string;
+    importer: string | undefined;
+    /** The package the resolved file belongs to, `firebase` or `@firebase/*`. */
+    packageName: string;
+    /** The resolved file's path inside that package; read only for `firebase` in production AI mode. */
+    pathInPackage: () => string | null;
+    aiMode: AiMode;
+}
+/**
+ * Whether the swap table hands this client SDK load to the real SDK (ADR
+ * 0022): one of pyric's shadow modules reaching the `firebase/app` or
+ * `firebase/app-check` it wraps, or, in production AI mode, the files of
+ * `firebase/ai`, `firebase/app` and `firebase/app-check` and the `@firebase/*`
+ * packages they import (`isProductionAiSdkFile`). The stop in
+ * `swap-or-stop.ts` allows exactly these, so the swap and the stop cannot
+ * disagree.
+ */
+export declare function choosesRealFirebase(load: RealFirebaseLoad): boolean;
 /**
  * Map a Firebase specifier to its pyric mirror, or return `null` when the
  * specifier is not a Firebase package (leave it for the default resolver).

package/dist/register/mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapping.d.ts","sourceRoot":"","sources":["../../src/register/mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAyC,KAAK,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAetG,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAgBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,MAAM,GAAG,IAAI,CAuCf"}
+{"version":3,"file":"mapping.d.ts","sourceRoot":"","sources":["../../src/register/mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAgE,KAAK,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAe7H,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAwBD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,oGAAoG;IACpG,aAAa,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAInE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,MAAM,GAAG,IAAI,CAwCf"}