@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/dist/functions/spawn.js

@@ -0,0 +1,166 @@
+/**
+ * The host side of the isolated Functions child: its environment, its entry
+ * module, and the spawn, ready, and stop handshake over IPC.
+ */
+import { spawn } from 'node:child_process';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { isChildMessage, } from './child-protocol.js';
+const FORCE_KILL_AFTER_MS = 2_000;
+/**
+ * Resolve the database host, defaulting to 'firebasedatabase.app'.
+ */
+export function resolveChildDatabaseHost(databaseHost) {
+    if (typeof databaseHost === 'string' && databaseHost.length > 0) {
+        return databaseHost;
+    }
+    return 'firebasedatabase.app';
+}
+/**
+ * Resolve the filesystem path to the child entrypoint module.
+ */
+export function resolveChildModulePath(childModuleUrl) {
+    if (!childModuleUrl) {
+        return fileURLToPath(new URL('./child.js', import.meta.url));
+    }
+    if (typeof childModuleUrl === 'string' && !childModuleUrl.startsWith('file:')) {
+        return resolve(childModuleUrl);
+    }
+    return fileURLToPath(childModuleUrl);
+}
+/**
+ * Assemble the child process environment variables.
+ *
+ * Guaranteed child-only synthetic sandbox metadata:
+ * - GCLOUD_PROJECT, GOOGLE_CLOUD_PROJECT and GCP_PROJECT are set to the
+ *   resolved sandbox project ID, as production sets them to the function's
+ *   own project (the Firebase emulator reserves the same three)
+ * - FIREBASE_CONFIG is set to synthetic JSON with projectId, databaseURL, and storageBucket
+ * - GOOGLE_APPLICATION_CREDENTIALS is removed, so a Google client in function
+ *   code never loads the host's credentials file
+ *
+ * Explicit control flow ensures that host environment cannot pollute or route
+ * sandbox functions execution to a production Firebase/GCP project.
+ */
+export function buildFunctionsChildEnv(options) {
+    const { baseEnv, entry, instance, location, databaseHost, projectId } = options;
+    const resolvedEntry = resolve(entry);
+    const databaseURL = `https://${instance}.${databaseHost}`;
+    const storageBucket = `${projectId}.appspot.com`;
+    const syntheticFirebaseConfig = JSON.stringify({
+        projectId,
+        databaseURL,
+        storageBucket,
+    });
+    const childEnv = {
+        ...baseEnv,
+        PYRIC_FUNCTIONS_RTDB_CHILD: '1',
+        PYRIC_FUNCTIONS_ENTRY: resolvedEntry,
+        PYRIC_FUNCTIONS_INSTANCE: instance,
+        PYRIC_FUNCTIONS_LOCATION: location,
+        PYRIC_FUNCTIONS_DATABASE_HOST: databaseHost,
+        GCLOUD_PROJECT: projectId,
+        GOOGLE_CLOUD_PROJECT: projectId,
+        GCP_PROJECT: projectId,
+        FIREBASE_CONFIG: syntheticFirebaseConfig,
+    };
+    delete childEnv.GOOGLE_APPLICATION_CREDENTIALS;
+    return childEnv;
+}
+/** Spawn the real Firebase Functions SDK in an isolated Node process. */
+export function spawnFunctionsChild(options) {
+    const childModulePath = resolveChildModulePath(options.childModuleUrl);
+    const { projectId } = options;
+    const databaseHost = resolveChildDatabaseHost(options.databaseHost);
+    const childEnv = buildFunctionsChildEnv({
+        baseEnv: options.env,
+        entry: options.entry,
+        instance: options.instance,
+        location: options.location,
+        databaseHost,
+        projectId,
+    });
+    const nodeExecutable = options.nodeExecutable ?? 'node';
+    const child = spawn(nodeExecutable, [childModulePath], {
+        cwd: options.cwd,
+        env: childEnv,
+        stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
+    });
+    let readySettled = false;
+    let stopping = false;
+    let stderr = '';
+    child.stderr?.setEncoding('utf8');
+    child.stderr?.on('data', (chunk) => {
+        stderr = `${stderr}${chunk}`.slice(-8_192);
+    });
+    let resolveReady;
+    let rejectReady;
+    const ready = new Promise((resolvePromise, rejectPromise) => {
+        resolveReady = resolvePromise;
+        rejectReady = rejectPromise;
+    });
+    child.on('message', (raw) => {
+        if (!isChildMessage(raw))
+            return;
+        if (raw.type === 'ready') {
+            readySettled = true;
+            resolveReady({
+                triggerCount: raw.triggerCount,
+                unsupportedTriggers: raw.unsupportedTriggers,
+            });
+        }
+        else if (raw.type === 'fatal') {
+            if (!readySettled) {
+                readySettled = true;
+                rejectReady(new Error(`Functions RTDB child failed: ${raw.error.stack ?? raw.error.message}`));
+            }
+        }
+        else if (raw.type === 'execution' || raw.type === 'delivery-error') {
+            options.onEvent?.(raw);
+        }
+    });
+    let forceTimer;
+    const exited = new Promise((resolveExited) => {
+        child.once('error', (error) => {
+            if (!readySettled) {
+                readySettled = true;
+                rejectReady(error);
+            }
+        });
+        child.once('close', (code, signal) => {
+            if (forceTimer !== undefined)
+                clearTimeout(forceTimer);
+            const exitCode = typeof code === 'number' ? code : signal ? 1 : 0;
+            if (!readySettled) {
+                readySettled = true;
+                const diagnostic = stderr.trim();
+                rejectReady(new Error(`Functions RTDB child exited before ready (code ${exitCode})` +
+                    (diagnostic ? `\n${diagnostic}` : '')));
+            }
+            resolveExited(exitCode);
+        });
+    });
+    return {
+        child,
+        ready,
+        exited,
+        async stop() {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return exited;
+            if (!stopping) {
+                stopping = true;
+                if (child.connected)
+                    child.send({ type: 'stop' });
+                else
+                    child.kill('SIGTERM');
+                forceTimer = setTimeout(() => {
+                    if (child.exitCode === null && child.signalCode === null)
+                        child.kill('SIGKILL');
+                }, FORCE_KILL_AFTER_MS);
+                forceTimer.unref();
+            }
+            return exited;
+        },
+    };
+}
+//# sourceMappingURL=spawn.js.map

package/dist/functions/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../src/functions/spawn.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,cAAc,GAGf,MAAM,qBAAqB,CAAC;AAuB7B,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAWlC;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAqB;IAC5D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,cAA6B;IAClE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,aAAa,CAAC,cAAc,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC;IACtE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEhF,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,WAAW,QAAQ,IAAI,YAAY,EAAE,CAAC;IAC1D,MAAM,aAAa,GAAG,GAAG,SAAS,cAAc,CAAC;IAEjD,MAAM,uBAAuB,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7C,SAAS;QACT,WAAW;QACX,aAAa;KACd,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAsB;QAClC,GAAG,OAAO;QACV,0BAA0B,EAAE,GAAG;QAC/B,qBAAqB,EAAE,aAAa;QACpC,wBAAwB,EAAE,QAAQ;QAClC,wBAAwB,EAAE,QAAQ;QAClC,6BAA6B,EAAE,YAAY;QAC3C,cAAc,EAAE,SAAS;QACzB,oBAAoB,EAAE,SAAS;QAC/B,WAAW,EAAE,SAAS;QACtB,eAAe,EAAE,uBAAuB;KACzC,CAAC;IACF,OAAO,QAAQ,CAAC,8BAA8B,CAAC;IAE/C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,OAAmC;IAEnC,MAAM,eAAe,GAAG,sBAAsB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACvE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC9B,MAAM,YAAY,GAAG,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACtC,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY;QACZ,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE;QACrD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;KACzC,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,MAAM,GAAG,GAAG,MAAM,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,YAAmD,CAAC;IACxD,IAAI,WAAoC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAsB,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QAC/E,YAAY,GAAG,cAAc,CAAC;QAC9B,WAAW,GAAG,aAAa,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,EAAE;QACnC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO;QACjC,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,YAAY,CAAC;gBACX,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;aAC7C,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAC;gBACpB,WAAW,CAAC,IAAI,KAAK,CACnB,gCAAgC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACrE,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,UAAqD,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,aAAa,EAAE,EAAE;QACnD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAC;gBACpB,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,UAAU,KAAK,SAAS;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,WAAW,CAAC,IAAI,KAAK,CACnB,kDAAkD,QAAQ,GAAG;oBAC3D,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxC,CAAC,CAAC;YACL,CAAC;YACD,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,KAAK;QACL,MAAM;QACN,KAAK,CAAC,IAAI;YACR,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC;YACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,KAAK,CAAC,SAAS;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;;oBAC7C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3B,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;wBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAClF,CAAC,EAAE,mBAAmB,CAAC,CAAC;gBACxB,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/functions/unsupported.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The endpoints a development session will not run, and why.
+ *
+ * Each trigger family the child serves registers here: it claims the
+ * endpoints of its kind and reports the ones of its kind it still refuses
+ * (an unsupported pattern, an omitted export). Every endpoint no family
+ * claims is reported under its trigger label, so a new family is one entry
+ * in the list the child passes, not another branch in a label chain.
+ */
+import { type FirebaseEndpoint } from './endpoints.js';
+export interface UnsupportedFunctionsTrigger {
+    exportName: string;
+    eventType: string;
+}
+export interface FunctionsTriggerFamily {
+    /** Whether this family owns an endpoint, served or refused. */
+    claims(endpoint: FirebaseEndpoint): boolean;
+    /** The endpoints this family owns but refuses, in export order. */
+    unsupported(exported: Record<string, unknown>): UnsupportedFunctionsTrigger[];
+}
+/** Every endpoint the given families refuse or do not claim, families first. */
+export declare function findUnsupportedTriggers(exported: Record<string, unknown>, families: readonly FunctionsTriggerFamily[]): UnsupportedFunctionsTrigger[];
+//# sourceMappingURL=unsupported.d.ts.map

package/dist/functions/unsupported.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsupported.d.ts","sourceRoot":"","sources":["../../src/functions/unsupported.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,MAAM,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAC5C,mEAAmE;IACnE,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,2BAA2B,EAAE,CAAC;CAC/E;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAC1C,2BAA2B,EAAE,CAU/B"}

package/dist/functions/unsupported.js

@@ -0,0 +1,25 @@
+/**
+ * The endpoints a development session will not run, and why.
+ *
+ * Each trigger family the child serves registers here: it claims the
+ * endpoints of its kind and reports the ones of its kind it still refuses
+ * (an unsupported pattern, an omitted export). Every endpoint no family
+ * claims is reported under its trigger label, so a new family is one entry
+ * in the list the child passes, not another branch in a label chain.
+ */
+import { endpointTriggerLabel, listFirebaseEndpoints, } from './endpoints.js';
+/** Every endpoint the given families refuse or do not claim, families first. */
+export function findUnsupportedTriggers(exported, families) {
+    const unsupported = families.flatMap((family) => family.unsupported(exported));
+    for (const { exportName, callable } of listFirebaseEndpoints(exported)) {
+        const endpoint = callable.__endpoint;
+        if (!endpoint)
+            continue;
+        const claimed = families.some((family) => family.claims(endpoint));
+        if (claimed)
+            continue;
+        unsupported.push({ exportName, eventType: endpointTriggerLabel(endpoint) });
+    }
+    return unsupported;
+}
+//# sourceMappingURL=unsupported.js.map

package/dist/functions/unsupported.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsupported.js","sourceRoot":"","sources":["../../src/functions/unsupported.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAcxB,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CACrC,QAAiC,EACjC,QAA2C;IAE3C,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO;YAAE,SAAS;QACtB,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/google-endpoints.d.ts

@@ -52,8 +52,15 @@ export declare const GOOGLE_ENDPOINT_CATALOG: readonly GoogleEndpoint[];
  * {@link GoogleEndpoint.fingerprint}.
  */
 export declare const SDK_FINGERPRINT_HOSTS: readonly string[];
-/** Trim, lowercase, and drop a trailing root dot. The one spelling of a
- *  hostname that every comparison in the guard and the catalog uses. */
+/**
+ * Trim, lowercase, drop a trailing root dot, and write an IP address in one
+ * form. The one spelling of a hostname that every comparison in the guard and
+ * the catalog uses.
+ *
+ * The system resolver connects to `2852039166`, `0xa9fea9fe`, `169.254.43518`
+ * and `::ffff:169.254.169.254` as `169.254.169.254`, so comparing the text a
+ * caller wrote would let any of them past an entry for the metadata server.
+ */
 export declare function normalizeHostname(value: string): string;
 /**
  * Label-boundary suffix match: `x.example.com` matches `example.com`,

package/dist/google-endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-endpoints.d.ts","sourceRoot":"","sources":["../src/google-endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,oCAAoC,CAAC;AAExE,eAAO,MAAM,uBAAuB,EAAE,SAAS,cAAc,EAiE5D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAE/B,CAAC;AAWrB;wEACwE;AACxE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAGjF"}
+{"version":3,"file":"google-endpoints.d.ts","sourceRoot":"","sources":["../src/google-endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,oCAAoC,CAAC;AAExE,eAAO,MAAM,uBAAuB,EAAE,SAAS,cAAc,EAiE5D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAE/B,CAAC;AAWrB;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGvD;AAiED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAGjF"}

package/dist/google-endpoints.js

@@ -97,10 +97,79 @@ export const SDK_FINGERPRINT_HOSTS = GOOGLE_ENDPOINT_CATALOG.filter((e) => e.fin
  * (`firebasestorage.googleapis.com` before `storage.googleapis.com`).
  */
 const CATALOG_BY_SPECIFICITY = [...GOOGLE_ENDPOINT_CATALOG].sort((a, b) => b.host.length - a.host.length);
-/** Trim, lowercase, and drop a trailing root dot. The one spelling of a
- *  hostname that every comparison in the guard and the catalog uses. */
+/**
+ * Trim, lowercase, drop a trailing root dot, and write an IP address in one
+ * form. The one spelling of a hostname that every comparison in the guard and
+ * the catalog uses.
+ *
+ * The system resolver connects to `2852039166`, `0xa9fea9fe`, `169.254.43518`
+ * and `::ffff:169.254.169.254` as `169.254.169.254`, so comparing the text a
+ * caller wrote would let any of them past an entry for the metadata server.
+ */
 export function normalizeHostname(value) {
-    return value.trim().toLowerCase().replace(/\.$/, '');
+    const text = value.trim().toLowerCase().replace(/\.$/, '');
+    return canonicalIpAddress(text) ?? text;
+}
+/** Characters the URL parser reads as something other than part of a host. */
+const URL_DELIMITERS = /[\s/?#@\\%]/;
+/** A host the URL parser could read as IPv4: digits, dots and hex. */
+const IPV4_CANDIDATE = /^[0-9a-fx.]+$/;
+const DOTTED_QUAD = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+/** An IPv4-mapped IPv6 address as the URL parser writes it. */
+const MAPPED_IPV4 = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/;
+/**
+ * `text` written the way the URL parser writes an IP address: a dotted quad
+ * for every IPv4 form, and for IPv6 the compressed form without brackets, or
+ * its IPv4 address when it is IPv4-mapped. `undefined` for anything that is
+ * not an IP address, which stays as text.
+ */
+function canonicalIpAddress(text) {
+    if (text.includes(':'))
+        return canonicalIpv6Text(text);
+    if (text.length === 0 || URL_DELIMITERS.test(text))
+        return undefined;
+    if (!IPV4_CANDIDATE.test(text))
+        return undefined;
+    const hostname = parsedHostname(text);
+    if (hostname !== undefined && DOTTED_QUAD.test(hostname))
+        return hostname;
+    return undefined;
+}
+/** A trailing IPv6 zone id, `%lo`, or `%25lo` as a URL writes it. */
+const ZONE_ID = /%(?:25)?[^%]*$/;
+/**
+ * IPv6 text without its brackets and zone id. Node and the kernel accept
+ * `::ffff:a9fe:a9fe%lo` and reach the IPv4 address, but the URL parser rejects
+ * a zone id, so it comes off before parsing.
+ */
+function canonicalIpv6Text(text) {
+    const bare = text.replace(/^\[(.*)\]$/, '$1').replace(ZONE_ID, '');
+    if (bare.length === 0 || URL_DELIMITERS.test(bare))
+        return undefined;
+    return canonicalIpv6(bare);
+}
+function canonicalIpv6(bare) {
+    const hostname = parsedHostname(`[${bare}]`);
+    if (hostname === undefined)
+        return undefined;
+    const address = hostname.replace(/^\[(.*)\]$/, '$1');
+    const mapped = MAPPED_IPV4.exec(address);
+    if (mapped === null)
+        return address;
+    return [...hextetBytes(mapped[1]), ...hextetBytes(mapped[2])].join('.');
+}
+function hextetBytes(hextet) {
+    const value = Number.parseInt(hextet, 16);
+    return [value >> 8, value & 0xff];
+}
+/** The hostname the WHATWG URL parser reads from `host`, or `undefined`. */
+function parsedHostname(host) {
+    try {
+        return new URL(`http://${host}/`).hostname;
+    }
+    catch {
+        return undefined;
+    }
 }
 /**
  * Label-boundary suffix match: `x.example.com` matches `example.com`,

package/dist/google-endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-endpoints.js","sourceRoot":"","sources":["../src/google-endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA6BH,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AAExE,MAAM,CAAC,MAAM,uBAAuB,GAA8B;IAChE,kEAAkE;IAClE,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,IAAI,EAAE;IACjG;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,yCAAyC;QAClD,WAAW,EAAE,IAAI;KAClB;IACD,aAAa;IACb,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE;IACnF,4EAA4E;IAC5E,mEAAmE;IACnE,oEAAoE;IACpE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,EAAE;IAC5E,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAE;IACjF,2EAA2E;IAC3E,gCAAgC;IAChC;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,4BAA4B;QACrC,WAAW,EAAE,KAAK;KACnB;IACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE;IAChF,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,sDAAsD;IACtD,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE;IAC9E;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,KAAK;KACnB;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,8DAA8D;IAC9D;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,yCAAyC;QAClD,WAAW,EAAE,IAAI;KAClB;IACD,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,KAAK,EAAE;IACvF;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,IAAI;KAClB;IACD,yEAAyE;IACzE,wBAAwB;IACxB,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAE;IACjF,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE;IAC/E,0EAA0E;IAC1E,0CAA0C;IAC1C;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,KAAK;KACnB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,KAAK;KACnB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,uBAAuB,CAAC,MAAM,CACpF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CACrB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAErB;;;;GAIG;AACH,MAAM,sBAAsB,GAA8B,CAAC,GAAG,uBAAuB,CAAC,CAAC,IAAI,CACzF,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CACxC,CAAC;AAEF;wEACwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAc;IAChE,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"google-endpoints.js","sourceRoot":"","sources":["../src/google-endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA6BH,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AAExE,MAAM,CAAC,MAAM,uBAAuB,GAA8B;IAChE,kEAAkE;IAClE,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,IAAI,EAAE;IACjG;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,yCAAyC;QAClD,WAAW,EAAE,IAAI;KAClB;IACD,aAAa;IACb,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE;IACnF,4EAA4E;IAC5E,mEAAmE;IACnE,oEAAoE;IACpE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,EAAE;IAC5E,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAE;IACjF,2EAA2E;IAC3E,gCAAgC;IAChC;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,4BAA4B;QACrC,WAAW,EAAE,KAAK;KACnB;IACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE;IAChF,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,sDAAsD;IACtD,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE;IAC9E;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,KAAK;KACnB;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,8DAA8D;IAC9D;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,yCAAyC;QAClD,WAAW,EAAE,IAAI;KAClB;IACD,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,KAAK,EAAE;IACvF;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,IAAI;KAClB;IACD,yEAAyE;IACzE,wBAAwB;IACxB,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAE;IACjF,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE;IAC/E,0EAA0E;IAC1E,0CAA0C;IAC1C;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,KAAK;KACnB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,KAAK;KACnB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,uBAAuB,CAAC,MAAM,CACpF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CACrB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAErB;;;;GAIG;AACH,MAAM,sBAAsB,GAA8B,CAAC,GAAG,uBAAuB,CAAC,CAAC,IAAI,CACzF,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC,sEAAsE;AACtE,MAAM,cAAc,GAAG,eAAe,CAAC;AAEvC,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,+DAA+D;AAC/D,MAAM,WAAW,GAAG,0CAA0C,CAAC;AAE/D;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qEAAqE;AACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,KAAK,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAc;IAChE,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/next/bridge-import-loader.d.ts

@@ -0,0 +1,9 @@
+import { type BridgeImportOptions } from './bridge-imports.js';
+interface LoaderContext {
+    resourcePath: string;
+    rootContext?: string;
+    getOptions(): BridgeImportOptions;
+}
+export default function bridgeImportLoader(this: LoaderContext, source: string): string;
+export {};
+//# sourceMappingURL=bridge-import-loader.d.ts.map

package/dist/next/bridge-import-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-import-loader.d.ts","sourceRoot":"","sources":["../../src/next/bridge-import-loader.ts"],"names":[],"mappings":"AAWA,OAAO,EAA4C,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEzG,UAAU,aAAa;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,IAAI,mBAAmB,CAAC;CACnC;AAwBD,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CActF"}

package/dist/next/bridge-import-loader.js

@@ -0,0 +1,45 @@
+/**
+ * Webpack and Turbopack loader for the shadow-app wrappers in production AI
+ * mode (#1637): rewrites the wrapper's own `firebase/app` or
+ * `firebase/app-check` import to a relative path to the browser file of the
+ * `firebase` the project root resolves, so the bundler's alias for that
+ * specifier, which names the wrapper's entry, does not send the wrapper back
+ * to itself. A file the options do not name passes through unchanged; a
+ * named file whose import cannot be rewritten throws.
+ */
+import { realpathSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { bridgeImportTarget, PyricNextBridgeError } from './bridge-imports.js';
+function realFile(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+function importOf(specifier) {
+    return new RegExp(`(from\\s*)(['"])${specifier.replace(/[/-]/g, '\\$&')}\\2`, 'g');
+}
+function projectRoot(context) {
+    const root = context.rootContext;
+    if (root === undefined || root === '') {
+        throw new PyricNextBridgeError(`pyric: production AI mode could not rewrite the Firebase SDK import in ${context.resourcePath}: the bundler gave the loader no project root.`);
+    }
+    return root;
+}
+export default function bridgeImportLoader(source) {
+    const { wrappers } = this.getOptions();
+    const path = isAbsolute(this.resourcePath) ? this.resourcePath : resolve(projectRoot(this), this.resourcePath);
+    const file = realFile(path);
+    const specifier = wrappers[file];
+    if (specifier === undefined)
+        return source;
+    const target = bridgeImportTarget(file, specifier, projectRoot(this));
+    const rewritten = source.replace(importOf(specifier), `$1$2${target}$2`);
+    if (rewritten === source) {
+        throw new PyricNextBridgeError(`pyric: production AI mode expected ${file} to import '${specifier}', and found no such import to point at the Firebase SDK.`);
+    }
+    return rewritten;
+}
+//# sourceMappingURL=bridge-import-loader.js.map

package/dist/next/bridge-import-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-import-loader.js","sourceRoot":"","sources":["../../src/next/bridge-import-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAA4B,MAAM,qBAAqB,CAAC;AAQzG,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,OAAO,IAAI,MAAM,CAAC,mBAAmB,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,oBAAoB,CAC5B,0EAA0E,OAAO,CAAC,YAAY,gDAAgD,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAsB,MAAc;IAC5E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,MAAM,IAAI,CAAC,CAAC;IACzE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC5B,sCAAsC,IAAI,eAAe,SAAS,2DAA2D,CAC9H,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/next/bridge-imports.d.ts

@@ -0,0 +1,26 @@
+/** The loader's options: each wrapper's absolute path to the specifier whose import it rewrites. */
+export interface BridgeImportOptions {
+    wrappers: Record<string, string>;
+}
+/** Thrown when production AI mode cannot point a wrapper's import at the project's Firebase SDK. */
+export declare class PyricNextBridgeError extends Error {
+    readonly name = "PyricNextBridgeError";
+}
+/** This package's built loader, next to this module. */
+export declare const BRIDGE_IMPORT_LOADER: string;
+/**
+ * The relative specifier a wrapper imports `specifier` by: the browser file
+ * of the `firebase` that `projectDir` resolves. Throws
+ * {@link PyricNextBridgeError} when there is none.
+ */
+export declare function bridgeImportTarget(wrapper: string, specifier: string, projectDir: string): string;
+/**
+ * The wrappers of this install. Only imports {@link isBypassedBridgeImport}
+ * names are listed, so this plane bypasses exactly what the others do.
+ */
+export declare function bridgeImportOptions(): BridgeImportOptions;
+/** The options both bundler configs read: present only in production AI mode, as the environment names it. */
+export declare function productionBridgeOptions(): BridgeImportOptions | undefined;
+/** The file names of the wrappers, for bundler rules keyed by name. */
+export declare function bridgeModuleFileNames(): string[];
+//# sourceMappingURL=bridge-imports.d.ts.map

package/dist/next/bridge-imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-imports.d.ts","sourceRoot":"","sources":["../../src/next/bridge-imports.ts"],"names":[],"mappings":"AA2BA,oGAAoG;AACpG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,oGAAoG;AACpG,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,0BAA0B;CACjD;AAID,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,QAAwF,CAAC;AAiC1H;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAIjG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,mBAAmB,CAQzD;AAED,8GAA8G;AAC9G,wBAAgB,uBAAuB,IAAI,mBAAmB,GAAG,SAAS,CAGzE;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAEhD"}

package/dist/next/bridge-imports.js

@@ -0,0 +1,90 @@
+/**
+ * The Next plane's form of the shadow-app bypass (#1637). In production AI
+ * mode `firebase/app` and `firebase/app-check` alias to the passthrough
+ * entries, whose shadow-app wrappers import the Firebase SDK under those same
+ * specifiers. Vite and the register let those imports through by importer
+ * (`isBypassedBridgeImport`). Webpack and Turbopack aliases apply to every
+ * importer, so here a loader rewrites the two imports in the wrappers to
+ * relative paths to the Firebase SDK's browser files in the project's own
+ * `firebase` install. Nothing else of the SDK loads: the same three modules
+ * Vite lets through.
+ *
+ * The bundler config names only the wrappers. The loader finds `firebase`
+ * when it runs, from the project root the bundler gives it, so a Next config
+ * that calls `withPyric` from a shared package still resolves the app's own
+ * install.
+ */
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { dirname, join, relative, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { isBypassedBridgeImport, resolveAiMode } from '../serve/firebase-module-swap.js';
+/** The shadow-app wrappers that import the Firebase SDK, by file name under `register/`, and the specifier each imports. */
+const BRIDGE_MODULES = [
+    ['app-bridge-shadow', 'firebase/app'],
+    ['app-bridge-app-check', 'firebase/app-check'],
+];
+/** Thrown when production AI mode cannot point a wrapper's import at the project's Firebase SDK. */
+export class PyricNextBridgeError extends Error {
+    name = 'PyricNextBridgeError';
+}
+const UNSUPPORTED_RESOLUTION = 'Pyric looks for node_modules/firebase from the project directory up; Yarn Plug\'n\'Play and NODE_PATH installs are not supported.';
+/** This package's built loader, next to this module. */
+export const BRIDGE_IMPORT_LOADER = fileURLToPath(new URL(`./bridge-import-loader${moduleExtension()}`, import.meta.url));
+function moduleExtension() {
+    return import.meta.url.endsWith('.ts') ? '.ts' : '.js';
+}
+/** The project's `firebase` package directory, found as Node finds a package from the project directory. */
+function firebasePackageDir(projectDir) {
+    for (let dir = projectDir;; dir = dirname(dir)) {
+        const candidate = join(dir, 'node_modules', 'firebase');
+        if (existsSync(join(candidate, 'package.json')))
+            return realpathSync(candidate);
+        if (dirname(dir) === dir)
+            break;
+    }
+    throw new PyricNextBridgeError(`pyric: production AI mode needs the Firebase SDK, but no node_modules/firebase was found from ${projectDir} up. ${UNSUPPORTED_RESOLUTION}`);
+}
+/** The browser ESM file `firebase/<subpath>` resolves to under a bundler's browser conditions. */
+function browserFile(packageDir, specifier) {
+    const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
+    const entry = manifest.exports?.[`./${specifier.slice('firebase/'.length)}`];
+    const file = entry?.browser?.import ?? entry?.default;
+    if (file === undefined) {
+        throw new PyricNextBridgeError(`pyric: production AI mode needs ${specifier} from the Firebase SDK, but ${join(packageDir, 'package.json')} exports no browser entry for it.`);
+    }
+    return join(packageDir, file);
+}
+/**
+ * The relative specifier a wrapper imports `specifier` by: the browser file
+ * of the `firebase` that `projectDir` resolves. Throws
+ * {@link PyricNextBridgeError} when there is none.
+ */
+export function bridgeImportTarget(wrapper, specifier, projectDir) {
+    const target = browserFile(firebasePackageDir(projectDir), specifier);
+    const path = relative(dirname(wrapper), target).split(sep).join('/');
+    return path.startsWith('.') ? path : `./${path}`;
+}
+/**
+ * The wrappers of this install. Only imports {@link isBypassedBridgeImport}
+ * names are listed, so this plane bypasses exactly what the others do.
+ */
+export function bridgeImportOptions() {
+    const registerDir = fileURLToPath(new URL('../register/', import.meta.url));
+    const wrappers = {};
+    for (const [name, specifier] of BRIDGE_MODULES) {
+        const wrapper = realpathSync(join(registerDir, `${name}${moduleExtension()}`));
+        if (isBypassedBridgeImport(specifier, wrapper))
+            wrappers[wrapper] = specifier;
+    }
+    return { wrappers };
+}
+/** The options both bundler configs read: present only in production AI mode, as the environment names it. */
+export function productionBridgeOptions() {
+    const isProductionAiMode = resolveAiMode(undefined, process.env) === 'production';
+    return isProductionAiMode ? bridgeImportOptions() : undefined;
+}
+/** The file names of the wrappers, for bundler rules keyed by name. */
+export function bridgeModuleFileNames() {
+    return BRIDGE_MODULES.map(([name]) => `${name}${moduleExtension()}`);
+}
+//# sourceMappingURL=bridge-imports.js.map

package/dist/next/bridge-imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-imports.js","sourceRoot":"","sources":["../../src/next/bridge-imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEzF,4HAA4H;AAC5H,MAAM,cAAc,GAA8D;IAChF,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACrC,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;CAC/C,CAAC;AAOF,oGAAoG;AACpG,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAG,sBAAsB,CAAC;CACjD;AAED,MAAM,sBAAsB,GAAG,mIAAmI,CAAC;AAEnK,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,yBAAyB,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1H,SAAS,eAAe;IACtB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,4GAA4G;AAC5G,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,KAAK,IAAI,GAAG,GAAG,UAAU,GAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,MAAM;IAClC,CAAC;IACD,MAAM,IAAI,oBAAoB,CAC5B,iGAAiG,UAAU,QAAQ,sBAAsB,EAAE,CAC5I,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,WAAW,CAAC,UAAkB,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAEjF,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK,EAAE,OAAO,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC5B,mCAAmC,SAAS,+BAA+B,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,mCAAmC,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB,EAAE,UAAkB;IACvF,MAAM,MAAM,GAAG,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,GAAG,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC;YAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,uBAAuB;IACrC,MAAM,kBAAkB,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC;IAClF,OAAO,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,qBAAqB;IACnC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,eAAe,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC"}

package/dist/next/client-aliases.d.ts

@@ -1,14 +1,22 @@
 /**
  * Client-side module aliasing definitions for Firebase Web SDKs.
  */
+import { type AiMode } from '../serve/firebase-module-swap.js';
 /**
  * Retrieve the explicit map of canonical Firebase import specifiers to their
- * Pyric browser wrapper entries. Each target is a package specifier rather
- * than a file path: Turbopack reads an absolute alias path as relative to the
- * project root, while a package specifier resolves from the application's own
- * dependencies in Webpack and Turbopack alike.
+ * Pyric browser wrapper entries, for one AI mode. The entries come from
+ * {@link swappedFirebaseEntries}, the table every plane that swaps reads, so
+ * production AI mode leaves `firebase/ai` to the Firebase SDK here as the
+ * import map and the Vite resolver do. The mode defaults to the one the
+ * environment names, resolved as every front door resolves it.
+ *
+ * Each target is a package specifier rather than a file path: Turbopack reads
+ * an absolute alias path as relative to the project root, while a package
+ * specifier resolves from the application's own dependencies in Webpack and
+ * Turbopack alike. Every wrapper is exported by `@pyric/cli` as
+ * `@pyric/cli/next/internal/<entry>`.
  */
-export declare function getClientAliases(): Record<string, string>;
+export declare function getClientAliases(mode?: AiMode): Record<string, string>;
 /**
  * Retrieve benign boolean fallback replacements for Node built-in modules
  * accessible in browser packaging bundles.

package/dist/next/client-aliases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-aliases.d.ts","sourceRoot":"","sources":["../../src/next/client-aliases.ts"],"names":[],"mappings":"AAAA;;GAEG;AAwBH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUjE"}
+{"version":3,"file":"client-aliases.d.ts","sourceRoot":"","sources":["../../src/next/client-aliases.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAyC,KAAK,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAEtG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAA8C,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUjE"}