@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/src/{functions-rtdb → functions/rtdb}/discovery.ts

@@ -1,3 +1,5 @@
+import { listFirebaseEndpoints, type FirebaseEndpoint } from '../endpoints.js';
+import type { FunctionsTriggerFamily } from '../unsupported.js';
 import {
   normalizeRtdbReference,
   supportsRtdbReference,
@@ -27,55 +29,13 @@ export interface OnValueCreatedInspection {
 
 export const CREATED_EVENT_TYPE = 'google.firebase.database.ref.v1.created';
 
-export type FirebaseEndpointFunction = RtdbCreatedCallable & {
-  __endpoint?: {
-    omit?: unknown;
-    region?: unknown;
-    eventTrigger?: {
-      eventType?: unknown;
-      eventFilters?: Record<string, unknown>;
-      eventFilterPathPatterns?: Record<string, unknown>;
-    };
-    callableTrigger?: unknown;
-    httpsTrigger?: unknown;
-    scheduleTrigger?: unknown;
-    taskQueueTrigger?: unknown;
-  };
-};
-
-/** Walk exports using the same hyphenated nested names as Firebase's loader. */
-export function listFirebaseEndpoints(
-  exported: Record<string, unknown>,
-): Array<{ exportName: string; callable: FirebaseEndpointFunction }> {
-  const endpoints: Array<{ exportName: string; callable: FirebaseEndpointFunction }> = [];
-  const visit = (
-    value: Record<string, unknown>,
-    prefix: string,
-    ancestors: ReadonlySet<object>,
-  ): void => {
-    if (ancestors.has(value)) return;
-    const nestedAncestors = new Set(ancestors).add(value);
-    for (const [name, candidate] of Object.entries(value)) {
-      const exportName = `${prefix}${name}`;
-      const callable = candidate as FirebaseEndpointFunction;
-      if (typeof candidate === 'function' && callable.__endpoint) {
-        endpoints.push({ exportName, callable });
-      } else if (typeof candidate === 'object' && candidate !== null) {
-        visit(candidate as Record<string, unknown>, `${exportName}-`, nestedAncestors);
-      }
-    }
-  };
-  visit(exported, '', new Set());
-  return endpoints;
-}
-
 /** Classify unchanged v2 RTDB create exports against the admitted first slice. */
 export function inspectOnValueCreated(
   exported: Record<string, unknown>,
 ): OnValueCreatedInspection {
   const triggers: DiscoveredOnValueCreated[] = [];
   const unsupported: UnsupportedOnValueCreated[] = [];
-  for (const { exportName, callable } of listFirebaseEndpoints(exported)) {
+  for (const { exportName, callable } of listFirebaseEndpoints<RtdbCreatedCallable>(exported)) {
     const endpoint = callable.__endpoint;
     const trigger = endpoint?.eventTrigger;
     if (trigger?.eventType !== CREATED_EVENT_TYPE) continue;
@@ -134,3 +94,9 @@ export function discoverOnValueCreated(
 ): DiscoveredOnValueCreated[] {
   return inspectOnValueCreated(exported).triggers;
 }
+
+/** The RTDB create family: it claims every `onValueCreated` endpoint. */
+export const rtdbCreatedFamily: FunctionsTriggerFamily = {
+  claims: (endpoint: FirebaseEndpoint) => endpoint.eventTrigger?.eventType === CREATED_EVENT_TYPE,
+  unsupported: (exported) => inspectOnValueCreated(exported).unsupported,
+};

package/src/{functions-rtdb → functions/rtdb}/remote-delivery.ts

@@ -1,4 +1,4 @@
-import type { RemoteRtdb } from '../remote/index.js';
+import type { RemoteRtdb } from '../../remote/index.js';
 import type { RtdbTriggerDelivery } from './delivery.js';
 
 /** Existing remote RTDB value subscriptions adapted to the execution seam. */

package/src/functions/spawn.ts

@@ -0,0 +1,212 @@
+/**
+ * The host side of the isolated Functions child: its environment, its entry
+ * module, and the spawn, ready, and stop handshake over IPC.
+ */
+import { spawn, type ChildProcess } from 'node:child_process';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  isChildMessage,
+  type FunctionsChildEvent,
+  type FunctionsChildReady,
+} from './child-protocol.js';
+
+export interface SpawnFunctionsChildOptions {
+  cwd: string;
+  entry: string;
+  env: NodeJS.ProcessEnv;
+  instance: string;
+  location: string;
+  databaseHost?: string;
+  /** The project the child runs as, from `resolveFirebaseProject`. */
+  projectId: string;
+  childModuleUrl?: string | URL;
+  nodeExecutable?: string;
+  onEvent?(event: FunctionsChildEvent): void;
+}
+
+export interface FunctionsChildHandle {
+  child: ChildProcess;
+  ready: Promise<FunctionsChildReady>;
+  exited: Promise<number>;
+  stop(): Promise<number>;
+}
+
+const FORCE_KILL_AFTER_MS = 2_000;
+
+export interface FunctionsChildEnvOptions {
+  baseEnv: NodeJS.ProcessEnv;
+  entry: string;
+  instance: string;
+  location: string;
+  databaseHost: string;
+  projectId: string;
+}
+
+/**
+ * Resolve the database host, defaulting to 'firebasedatabase.app'.
+ */
+export function resolveChildDatabaseHost(databaseHost?: string): string {
+  if (typeof databaseHost === 'string' && databaseHost.length > 0) {
+    return databaseHost;
+  }
+  return 'firebasedatabase.app';
+}
+
+/**
+ * Resolve the filesystem path to the child entrypoint module.
+ */
+export function resolveChildModulePath(childModuleUrl?: string | URL): string {
+  if (!childModuleUrl) {
+    return fileURLToPath(new URL('./child.js', import.meta.url));
+  }
+  if (typeof childModuleUrl === 'string' && !childModuleUrl.startsWith('file:')) {
+    return resolve(childModuleUrl);
+  }
+  return fileURLToPath(childModuleUrl);
+}
+
+/**
+ * Assemble the child process environment variables.
+ *
+ * Guaranteed child-only synthetic sandbox metadata:
+ * - GCLOUD_PROJECT, GOOGLE_CLOUD_PROJECT and GCP_PROJECT are set to the
+ *   resolved sandbox project ID, as production sets them to the function's
+ *   own project (the Firebase emulator reserves the same three)
+ * - FIREBASE_CONFIG is set to synthetic JSON with projectId, databaseURL, and storageBucket
+ * - GOOGLE_APPLICATION_CREDENTIALS is removed, so a Google client in function
+ *   code never loads the host's credentials file
+ *
+ * Explicit control flow ensures that host environment cannot pollute or route
+ * sandbox functions execution to a production Firebase/GCP project.
+ */
+export function buildFunctionsChildEnv(options: FunctionsChildEnvOptions): NodeJS.ProcessEnv {
+  const { baseEnv, entry, instance, location, databaseHost, projectId } = options;
+
+  const resolvedEntry = resolve(entry);
+  const databaseURL = `https://${instance}.${databaseHost}`;
+  const storageBucket = `${projectId}.appspot.com`;
+
+  const syntheticFirebaseConfig = JSON.stringify({
+    projectId,
+    databaseURL,
+    storageBucket,
+  });
+
+  const childEnv: NodeJS.ProcessEnv = {
+    ...baseEnv,
+    PYRIC_FUNCTIONS_RTDB_CHILD: '1',
+    PYRIC_FUNCTIONS_ENTRY: resolvedEntry,
+    PYRIC_FUNCTIONS_INSTANCE: instance,
+    PYRIC_FUNCTIONS_LOCATION: location,
+    PYRIC_FUNCTIONS_DATABASE_HOST: databaseHost,
+    GCLOUD_PROJECT: projectId,
+    GOOGLE_CLOUD_PROJECT: projectId,
+    GCP_PROJECT: projectId,
+    FIREBASE_CONFIG: syntheticFirebaseConfig,
+  };
+  delete childEnv.GOOGLE_APPLICATION_CREDENTIALS;
+
+  return childEnv;
+}
+
+/** Spawn the real Firebase Functions SDK in an isolated Node process. */
+export function spawnFunctionsChild(
+  options: SpawnFunctionsChildOptions,
+): FunctionsChildHandle {
+  const childModulePath = resolveChildModulePath(options.childModuleUrl);
+  const { projectId } = options;
+  const databaseHost = resolveChildDatabaseHost(options.databaseHost);
+  const childEnv = buildFunctionsChildEnv({
+    baseEnv: options.env,
+    entry: options.entry,
+    instance: options.instance,
+    location: options.location,
+    databaseHost,
+    projectId,
+  });
+
+  const nodeExecutable = options.nodeExecutable ?? 'node';
+  const child = spawn(nodeExecutable, [childModulePath], {
+    cwd: options.cwd,
+    env: childEnv,
+    stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
+  });
+
+  let readySettled = false;
+  let stopping = false;
+  let stderr = '';
+  child.stderr?.setEncoding('utf8');
+  child.stderr?.on('data', (chunk: string) => {
+    stderr = `${stderr}${chunk}`.slice(-8_192);
+  });
+
+  let resolveReady!: (ready: FunctionsChildReady) => void;
+  let rejectReady!: (error: Error) => void;
+  const ready = new Promise<FunctionsChildReady>((resolvePromise, rejectPromise) => {
+    resolveReady = resolvePromise;
+    rejectReady = rejectPromise;
+  });
+
+  child.on('message', (raw: unknown) => {
+    if (!isChildMessage(raw)) return;
+    if (raw.type === 'ready') {
+      readySettled = true;
+      resolveReady({
+        triggerCount: raw.triggerCount,
+        unsupportedTriggers: raw.unsupportedTriggers,
+      });
+    } else if (raw.type === 'fatal') {
+      if (!readySettled) {
+        readySettled = true;
+        rejectReady(new Error(
+          `Functions RTDB child failed: ${raw.error.stack ?? raw.error.message}`,
+        ));
+      }
+    } else if (raw.type === 'execution' || raw.type === 'delivery-error') {
+      options.onEvent?.(raw);
+    }
+  });
+
+  let forceTimer: ReturnType<typeof setTimeout> | undefined;
+  const exited = new Promise<number>((resolveExited) => {
+    child.once('error', (error) => {
+      if (!readySettled) {
+        readySettled = true;
+        rejectReady(error);
+      }
+    });
+    child.once('close', (code, signal) => {
+      if (forceTimer !== undefined) clearTimeout(forceTimer);
+      const exitCode = typeof code === 'number' ? code : signal ? 1 : 0;
+      if (!readySettled) {
+        readySettled = true;
+        const diagnostic = stderr.trim();
+        rejectReady(new Error(
+          `Functions RTDB child exited before ready (code ${exitCode})` +
+            (diagnostic ? `\n${diagnostic}` : ''),
+        ));
+      }
+      resolveExited(exitCode);
+    });
+  });
+
+  return {
+    child,
+    ready,
+    exited,
+    async stop(): Promise<number> {
+      if (child.exitCode !== null || child.signalCode !== null) return exited;
+      if (!stopping) {
+        stopping = true;
+        if (child.connected) child.send({ type: 'stop' });
+        else child.kill('SIGTERM');
+        forceTimer = setTimeout(() => {
+          if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');
+        }, FORCE_KILL_AFTER_MS);
+        forceTimer.unref();
+      }
+      return exited;
+    },
+  };
+}

package/src/functions/unsupported.ts

@@ -0,0 +1,42 @@
+/**
+ * The endpoints a development session will not run, and why.
+ *
+ * Each trigger family the child serves registers here: it claims the
+ * endpoints of its kind and reports the ones of its kind it still refuses
+ * (an unsupported pattern, an omitted export). Every endpoint no family
+ * claims is reported under its trigger label, so a new family is one entry
+ * in the list the child passes, not another branch in a label chain.
+ */
+import {
+  endpointTriggerLabel,
+  listFirebaseEndpoints,
+  type FirebaseEndpoint,
+} from './endpoints.js';
+
+export interface UnsupportedFunctionsTrigger {
+  exportName: string;
+  eventType: string;
+}
+
+export interface FunctionsTriggerFamily {
+  /** Whether this family owns an endpoint, served or refused. */
+  claims(endpoint: FirebaseEndpoint): boolean;
+  /** The endpoints this family owns but refuses, in export order. */
+  unsupported(exported: Record<string, unknown>): UnsupportedFunctionsTrigger[];
+}
+
+/** Every endpoint the given families refuse or do not claim, families first. */
+export function findUnsupportedTriggers(
+  exported: Record<string, unknown>,
+  families: readonly FunctionsTriggerFamily[],
+): UnsupportedFunctionsTrigger[] {
+  const unsupported = families.flatMap((family) => family.unsupported(exported));
+  for (const { exportName, callable } of listFirebaseEndpoints(exported)) {
+    const endpoint = callable.__endpoint;
+    if (!endpoint) continue;
+    const claimed = families.some((family) => family.claims(endpoint));
+    if (claimed) continue;
+    unsupported.push({ exportName, eventType: endpointTriggerLabel(endpoint) });
+  }
+  return unsupported;
+}

package/src/google-endpoints.ts

@@ -133,10 +133,81 @@ const CATALOG_BY_SPECIFICITY: readonly GoogleEndpoint[] = [...GOOGLE_ENDPOINT_CA
   (a, b) => b.host.length - a.host.length,
 );
 
-/** Trim, lowercase, and drop a trailing root dot. The one spelling of a
- *  hostname that every comparison in the guard and the catalog uses. */
+/**
+ * Trim, lowercase, drop a trailing root dot, and write an IP address in one
+ * form. The one spelling of a hostname that every comparison in the guard and
+ * the catalog uses.
+ *
+ * The system resolver connects to `2852039166`, `0xa9fea9fe`, `169.254.43518`
+ * and `::ffff:169.254.169.254` as `169.254.169.254`, so comparing the text a
+ * caller wrote would let any of them past an entry for the metadata server.
+ */
 export function normalizeHostname(value: string): string {
-  return value.trim().toLowerCase().replace(/\.$/, '');
+  const text = value.trim().toLowerCase().replace(/\.$/, '');
+  return canonicalIpAddress(text) ?? text;
+}
+
+/** Characters the URL parser reads as something other than part of a host. */
+const URL_DELIMITERS = /[\s/?#@\\%]/;
+
+/** A host the URL parser could read as IPv4: digits, dots and hex. */
+const IPV4_CANDIDATE = /^[0-9a-fx.]+$/;
+
+const DOTTED_QUAD = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+
+/** An IPv4-mapped IPv6 address as the URL parser writes it. */
+const MAPPED_IPV4 = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/;
+
+/**
+ * `text` written the way the URL parser writes an IP address: a dotted quad
+ * for every IPv4 form, and for IPv6 the compressed form without brackets, or
+ * its IPv4 address when it is IPv4-mapped. `undefined` for anything that is
+ * not an IP address, which stays as text.
+ */
+function canonicalIpAddress(text: string): string | undefined {
+  if (text.includes(':')) return canonicalIpv6Text(text);
+  if (text.length === 0 || URL_DELIMITERS.test(text)) return undefined;
+  if (!IPV4_CANDIDATE.test(text)) return undefined;
+  const hostname = parsedHostname(text);
+  if (hostname !== undefined && DOTTED_QUAD.test(hostname)) return hostname;
+  return undefined;
+}
+
+/** A trailing IPv6 zone id, `%lo`, or `%25lo` as a URL writes it. */
+const ZONE_ID = /%(?:25)?[^%]*$/;
+
+/**
+ * IPv6 text without its brackets and zone id. Node and the kernel accept
+ * `::ffff:a9fe:a9fe%lo` and reach the IPv4 address, but the URL parser rejects
+ * a zone id, so it comes off before parsing.
+ */
+function canonicalIpv6Text(text: string): string | undefined {
+  const bare = text.replace(/^\[(.*)\]$/, '$1').replace(ZONE_ID, '');
+  if (bare.length === 0 || URL_DELIMITERS.test(bare)) return undefined;
+  return canonicalIpv6(bare);
+}
+
+function canonicalIpv6(bare: string): string | undefined {
+  const hostname = parsedHostname(`[${bare}]`);
+  if (hostname === undefined) return undefined;
+  const address = hostname.replace(/^\[(.*)\]$/, '$1');
+  const mapped = MAPPED_IPV4.exec(address);
+  if (mapped === null) return address;
+  return [...hextetBytes(mapped[1]!), ...hextetBytes(mapped[2]!)].join('.');
+}
+
+function hextetBytes(hextet: string): [number, number] {
+  const value = Number.parseInt(hextet, 16);
+  return [value >> 8, value & 0xff];
+}
+
+/** The hostname the WHATWG URL parser reads from `host`, or `undefined`. */
+function parsedHostname(host: string): string | undefined {
+  try {
+    return new URL(`http://${host}/`).hostname;
+  } catch {
+    return undefined;
+  }
 }
 
 /**

package/src/next/bridge-import-loader.ts

@@ -0,0 +1,56 @@
+/**
+ * Webpack and Turbopack loader for the shadow-app wrappers in production AI
+ * mode (#1637): rewrites the wrapper's own `firebase/app` or
+ * `firebase/app-check` import to a relative path to the browser file of the
+ * `firebase` the project root resolves, so the bundler's alias for that
+ * specifier, which names the wrapper's entry, does not send the wrapper back
+ * to itself. A file the options do not name passes through unchanged; a
+ * named file whose import cannot be rewritten throws.
+ */
+import { realpathSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { bridgeImportTarget, PyricNextBridgeError, type BridgeImportOptions } from './bridge-imports.js';
+
+interface LoaderContext {
+  resourcePath: string;
+  rootContext?: string;
+  getOptions(): BridgeImportOptions;
+}
+
+function realFile(path: string): string {
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
+  }
+}
+
+function importOf(specifier: string): RegExp {
+  return new RegExp(`(from\\s*)(['"])${specifier.replace(/[/-]/g, '\\$&')}\\2`, 'g');
+}
+
+function projectRoot(context: LoaderContext): string {
+  const root = context.rootContext;
+  if (root === undefined || root === '') {
+    throw new PyricNextBridgeError(
+      `pyric: production AI mode could not rewrite the Firebase SDK import in ${context.resourcePath}: the bundler gave the loader no project root.`,
+    );
+  }
+  return root;
+}
+
+export default function bridgeImportLoader(this: LoaderContext, source: string): string {
+  const { wrappers } = this.getOptions();
+  const path = isAbsolute(this.resourcePath) ? this.resourcePath : resolve(projectRoot(this), this.resourcePath);
+  const file = realFile(path);
+  const specifier = wrappers[file];
+  if (specifier === undefined) return source;
+  const target = bridgeImportTarget(file, specifier, projectRoot(this));
+  const rewritten = source.replace(importOf(specifier), `$1$2${target}$2`);
+  if (rewritten === source) {
+    throw new PyricNextBridgeError(
+      `pyric: production AI mode expected ${file} to import '${specifier}', and found no such import to point at the Firebase SDK.`,
+    );
+  }
+  return rewritten;
+}

package/src/next/bridge-imports.ts

@@ -0,0 +1,108 @@
+/**
+ * The Next plane's form of the shadow-app bypass (#1637). In production AI
+ * mode `firebase/app` and `firebase/app-check` alias to the passthrough
+ * entries, whose shadow-app wrappers import the Firebase SDK under those same
+ * specifiers. Vite and the register let those imports through by importer
+ * (`isBypassedBridgeImport`). Webpack and Turbopack aliases apply to every
+ * importer, so here a loader rewrites the two imports in the wrappers to
+ * relative paths to the Firebase SDK's browser files in the project's own
+ * `firebase` install. Nothing else of the SDK loads: the same three modules
+ * Vite lets through.
+ *
+ * The bundler config names only the wrappers. The loader finds `firebase`
+ * when it runs, from the project root the bundler gives it, so a Next config
+ * that calls `withPyric` from a shared package still resolves the app's own
+ * install.
+ */
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { dirname, join, relative, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { isBypassedBridgeImport, resolveAiMode } from '../serve/firebase-module-swap.js';
+
+/** The shadow-app wrappers that import the Firebase SDK, by file name under `register/`, and the specifier each imports. */
+const BRIDGE_MODULES: ReadonlyArray<readonly [name: string, specifier: string]> = [
+  ['app-bridge-shadow', 'firebase/app'],
+  ['app-bridge-app-check', 'firebase/app-check'],
+];
+
+/** The loader's options: each wrapper's absolute path to the specifier whose import it rewrites. */
+export interface BridgeImportOptions {
+  wrappers: Record<string, string>;
+}
+
+/** Thrown when production AI mode cannot point a wrapper's import at the project's Firebase SDK. */
+export class PyricNextBridgeError extends Error {
+  override readonly name = 'PyricNextBridgeError';
+}
+
+const UNSUPPORTED_RESOLUTION = 'Pyric looks for node_modules/firebase from the project directory up; Yarn Plug\'n\'Play and NODE_PATH installs are not supported.';
+
+/** This package's built loader, next to this module. */
+export const BRIDGE_IMPORT_LOADER = fileURLToPath(new URL(`./bridge-import-loader${moduleExtension()}`, import.meta.url));
+
+function moduleExtension(): string {
+  return import.meta.url.endsWith('.ts') ? '.ts' : '.js';
+}
+
+/** The project's `firebase` package directory, found as Node finds a package from the project directory. */
+function firebasePackageDir(projectDir: string): string {
+  for (let dir = projectDir; ; dir = dirname(dir)) {
+    const candidate = join(dir, 'node_modules', 'firebase');
+    if (existsSync(join(candidate, 'package.json'))) return realpathSync(candidate);
+    if (dirname(dir) === dir) break;
+  }
+  throw new PyricNextBridgeError(
+    `pyric: production AI mode needs the Firebase SDK, but no node_modules/firebase was found from ${projectDir} up. ${UNSUPPORTED_RESOLUTION}`,
+  );
+}
+
+/** The browser ESM file `firebase/<subpath>` resolves to under a bundler's browser conditions. */
+function browserFile(packageDir: string, specifier: string): string {
+  const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8')) as {
+    exports?: Record<string, { browser?: { import?: string }; default?: string }>;
+  };
+  const entry = manifest.exports?.[`./${specifier.slice('firebase/'.length)}`];
+  const file = entry?.browser?.import ?? entry?.default;
+  if (file === undefined) {
+    throw new PyricNextBridgeError(
+      `pyric: production AI mode needs ${specifier} from the Firebase SDK, but ${join(packageDir, 'package.json')} exports no browser entry for it.`,
+    );
+  }
+  return join(packageDir, file);
+}
+
+/**
+ * The relative specifier a wrapper imports `specifier` by: the browser file
+ * of the `firebase` that `projectDir` resolves. Throws
+ * {@link PyricNextBridgeError} when there is none.
+ */
+export function bridgeImportTarget(wrapper: string, specifier: string, projectDir: string): string {
+  const target = browserFile(firebasePackageDir(projectDir), specifier);
+  const path = relative(dirname(wrapper), target).split(sep).join('/');
+  return path.startsWith('.') ? path : `./${path}`;
+}
+
+/**
+ * The wrappers of this install. Only imports {@link isBypassedBridgeImport}
+ * names are listed, so this plane bypasses exactly what the others do.
+ */
+export function bridgeImportOptions(): BridgeImportOptions {
+  const registerDir = fileURLToPath(new URL('../register/', import.meta.url));
+  const wrappers: Record<string, string> = {};
+  for (const [name, specifier] of BRIDGE_MODULES) {
+    const wrapper = realpathSync(join(registerDir, `${name}${moduleExtension()}`));
+    if (isBypassedBridgeImport(specifier, wrapper)) wrappers[wrapper] = specifier;
+  }
+  return { wrappers };
+}
+
+/** The options both bundler configs read: present only in production AI mode, as the environment names it. */
+export function productionBridgeOptions(): BridgeImportOptions | undefined {
+  const isProductionAiMode = resolveAiMode(undefined, process.env) === 'production';
+  return isProductionAiMode ? bridgeImportOptions() : undefined;
+}
+
+/** The file names of the wrappers, for bundler rules keyed by name. */
+export function bridgeModuleFileNames(): string[] {
+  return BRIDGE_MODULES.map(([name]) => `${name}${moduleExtension()}`);
+}

package/src/next/client-aliases.ts

@@ -2,38 +2,25 @@
  * Client-side module aliasing definitions for Firebase Web SDKs.
  */
 
-/**
- * Each client `firebase/*` specifier and the `serve/entries` wrapper that
- * replaces it. Every wrapper is exported by `@pyric/cli` as
- * `@pyric/cli/next/internal/<entry>`.
- */
-const CLIENT_MODULES: Readonly<Record<string, string>> = {
-  'firebase/ai': 'ai',
-  'firebase/analytics': 'analytics',
-  'firebase/app': 'app',
-  'firebase/app-check': 'app-check',
-  'firebase/auth': 'auth',
-  'firebase/firestore': 'firestore',
-  'firebase/firestore/lite': 'firestore-lite',
-  'firebase/functions': 'functions',
-  'firebase/database': 'database',
-  'firebase/messaging': 'messaging',
-  'firebase/messaging/sw': 'messaging-sw',
-  'firebase/performance': 'performance',
-  'firebase/remote-config': 'remote-config',
-  'firebase/storage': 'storage',
-};
+import { resolveAiMode, swappedFirebaseEntries, type AiMode } from '../serve/firebase-module-swap.js';
 
 /**
  * Retrieve the explicit map of canonical Firebase import specifiers to their
- * Pyric browser wrapper entries. Each target is a package specifier rather
- * than a file path: Turbopack reads an absolute alias path as relative to the
- * project root, while a package specifier resolves from the application's own
- * dependencies in Webpack and Turbopack alike.
+ * Pyric browser wrapper entries, for one AI mode. The entries come from
+ * {@link swappedFirebaseEntries}, the table every plane that swaps reads, so
+ * production AI mode leaves `firebase/ai` to the Firebase SDK here as the
+ * import map and the Vite resolver do. The mode defaults to the one the
+ * environment names, resolved as every front door resolves it.
+ *
+ * Each target is a package specifier rather than a file path: Turbopack reads
+ * an absolute alias path as relative to the project root, while a package
+ * specifier resolves from the application's own dependencies in Webpack and
+ * Turbopack alike. Every wrapper is exported by `@pyric/cli` as
+ * `@pyric/cli/next/internal/<entry>`.
  */
-export function getClientAliases(): Record<string, string> {
+export function getClientAliases(mode: AiMode = resolveAiMode(undefined, process.env)): Record<string, string> {
   const aliases: Record<string, string> = {};
-  for (const [source, entry] of Object.entries(CLIENT_MODULES)) {
+  for (const [source, entry] of swappedFirebaseEntries(mode)) {
     aliases[source] = `@pyric/cli/next/internal/${entry}`;
   }
   return aliases;