@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/dist/next/client-aliases.js

@@ -1,37 +1,24 @@
 /**
  * Client-side module aliasing definitions for Firebase Web SDKs.
  */
-/**
- * Each client `firebase/*` specifier and the `serve/entries` wrapper that
- * replaces it. Every wrapper is exported by `@pyric/cli` as
- * `@pyric/cli/next/internal/<entry>`.
- */
-const CLIENT_MODULES = {
-    'firebase/ai': 'ai',
-    'firebase/analytics': 'analytics',
-    'firebase/app': 'app',
-    'firebase/app-check': 'app-check',
-    'firebase/auth': 'auth',
-    'firebase/firestore': 'firestore',
-    'firebase/firestore/lite': 'firestore-lite',
-    'firebase/functions': 'functions',
-    'firebase/database': 'database',
-    'firebase/messaging': 'messaging',
-    'firebase/messaging/sw': 'messaging-sw',
-    'firebase/performance': 'performance',
-    'firebase/remote-config': 'remote-config',
-    'firebase/storage': 'storage',
-};
+import { resolveAiMode, swappedFirebaseEntries } from '../serve/firebase-module-swap.js';
 /**
  * Retrieve the explicit map of canonical Firebase import specifiers to their
- * Pyric browser wrapper entries. Each target is a package specifier rather
- * than a file path: Turbopack reads an absolute alias path as relative to the
- * project root, while a package specifier resolves from the application's own
- * dependencies in Webpack and Turbopack alike.
+ * Pyric browser wrapper entries, for one AI mode. The entries come from
+ * {@link swappedFirebaseEntries}, the table every plane that swaps reads, so
+ * production AI mode leaves `firebase/ai` to the Firebase SDK here as the
+ * import map and the Vite resolver do. The mode defaults to the one the
+ * environment names, resolved as every front door resolves it.
+ *
+ * Each target is a package specifier rather than a file path: Turbopack reads
+ * an absolute alias path as relative to the project root, while a package
+ * specifier resolves from the application's own dependencies in Webpack and
+ * Turbopack alike. Every wrapper is exported by `@pyric/cli` as
+ * `@pyric/cli/next/internal/<entry>`.
  */
-export function getClientAliases() {
+export function getClientAliases(mode = resolveAiMode(undefined, process.env)) {
     const aliases = {};
-    for (const [source, entry] of Object.entries(CLIENT_MODULES)) {
+    for (const [source, entry] of swappedFirebaseEntries(mode)) {
         aliases[source] = `@pyric/cli/next/internal/${entry}`;
     }
     return aliases;

package/dist/next/client-aliases.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-aliases.js","sourceRoot":"","sources":["../../src/next/client-aliases.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,MAAM,cAAc,GAAqC;IACvD,aAAa,EAAE,IAAI;IACnB,oBAAoB,EAAE,WAAW;IACjC,cAAc,EAAE,KAAK;IACrB,oBAAoB,EAAE,WAAW;IACjC,eAAe,EAAE,MAAM;IACvB,oBAAoB,EAAE,WAAW;IACjC,yBAAyB,EAAE,gBAAgB;IAC3C,oBAAoB,EAAE,WAAW;IACjC,mBAAmB,EAAE,UAAU;IAC/B,oBAAoB,EAAE,WAAW;IACjC,uBAAuB,EAAE,cAAc;IACvC,sBAAsB,EAAE,aAAa;IACrC,wBAAwB,EAAE,eAAe;IACzC,kBAAkB,EAAE,SAAS;CAC9B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,GAAG,4BAA4B,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,SAAS,GAA4B;QACzC,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,KAAK;QACV,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;KAClB,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"client-aliases.js","sourceRoot":"","sources":["../../src/next/client-aliases.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAe,MAAM,kCAAkC,CAAC;AAEtG;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC;IACnF,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,GAAG,4BAA4B,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,SAAS,GAA4B;QACzC,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,KAAK;QACV,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;KAClB,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/next/guard.d.ts

@@ -9,8 +9,9 @@ import type { PyricNextOptions } from './types.js';
  */
 export declare function isProductionPassthrough(phase: string): boolean;
 /**
- * Verify whether the Next.js development server is booting under a secure,
- * activated sandbox environment. Throws a protective terminal error if un-sandboxed.
+ * Verify that the Next.js development server is starting under an active
+ * sandbox: `PYRIC_SANDBOX` is set and `@pyric/cli/register` activated in this
+ * process. Throws a terminal error naming how to start it otherwise.
  */
 export declare function enforceSandboxGuard(options?: PyricNextOptions): void;
 //# sourceMappingURL=guard.d.ts.map

package/dist/next/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/next/guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAWnD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAuBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAcpE"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/next/guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAYnD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AA+CD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAUpE"}

package/dist/next/guard.js

@@ -1,3 +1,4 @@
+import { isRegisterActive } from '../register/activation.js';
 const FORCED_SANDBOX_FLAG = '1';
 /** Next phases that compile or serve a production build. */
 const PRODUCTION_PHASES = new Set([
@@ -35,22 +36,39 @@ function hasActiveSandboxEnvironment() {
     }
     return sandboxValue.length > 0;
 }
+const OPT_OUT = 'To disable this guard, pass { guard: false } to withPyric(config, options).';
+const NO_SANDBOX_MESSAGE = '[Pyric] Next.js development server started without active Pyric sandbox environment variables.\n' +
+    'To prevent accidental connections to production Firebase databases, launch this server using:\n' +
+    '  pyric sandbox -- next dev\n' +
+    'or start the host alone with `pyric sandbox --no-run` and paste the printed export lines into the terminal that runs next dev.\n' +
+    OPT_OUT;
 /**
- * Verify whether the Next.js development server is booting under a secure,
- * activated sandbox environment. Throws a protective terminal error if un-sandboxed.
+ * `PYRIC_SANDBOX` is set but the register didn't load, so route handlers
+ * would import the real `firebase-admin` (#1625). The message names the three
+ * ways that happens and how to start the server instead.
+ */
+const NO_REGISTER_MESSAGE = '[Pyric] PYRIC_SANDBOX is set, but @pyric/cli/register is not active in this process, ' +
+    'so firebase-admin and firebase imports in route handlers would load the real SDKs.\n' +
+    'Start the development server with:\n' +
+    '  pyric sandbox -- next dev\n' +
+    'The register is missing when PYRIC_SANDBOX comes only from a .env file, when NODE_ENV=production makes the register refuse, ' +
+    'or when a package script sets its own NODE_OPTIONS. A script that needs its own options appends them: ' +
+    'NODE_OPTIONS="$NODE_OPTIONS --max-old-space-size=4096" next dev\n' +
+    OPT_OUT;
+/**
+ * Verify that the Next.js development server is starting under an active
+ * sandbox: `PYRIC_SANDBOX` is set and `@pyric/cli/register` activated in this
+ * process. Throws a terminal error naming how to start it otherwise.
  */
 export function enforceSandboxGuard(options) {
     if (isGuardExplicitlyDisabled(options)) {
         return;
     }
-    if (hasActiveSandboxEnvironment()) {
-        return;
+    if (!hasActiveSandboxEnvironment()) {
+        throw new Error(NO_SANDBOX_MESSAGE);
+    }
+    if (!isRegisterActive()) {
+        throw new Error(NO_REGISTER_MESSAGE);
     }
-    const errorMessage = '[Pyric] Next.js development server started without active Pyric sandbox environment variables.\n' +
-        'To prevent accidental connections to production Firebase databases, launch this server using:\n' +
-        '  pyric sandbox -- next dev\n' +
-        'or start the host alone with `pyric sandbox --no-run` and paste the printed export lines into the terminal that runs next dev.\n' +
-        'To disable this guard, pass { guard: false } to withPyric(config, options).';
-    throw new Error(errorMessage);
 }
 //# sourceMappingURL=guard.js.map

package/dist/next/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/next/guard.ts"],"names":[],"mappings":"AAKA,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,4DAA4D;AAC5D,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,wBAAwB;IACxB,yBAAyB;IACzB,cAAc;CACf,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,OAA0B;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAC5D,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO;IACT,CAAC;IACD,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAChB,kGAAkG;QAClG,iGAAiG;QACjG,+BAA+B;QAC/B,kIAAkI;QAClI,6EAA6E,CAAC;IAChF,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/next/guard.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,4DAA4D;AAC5D,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,wBAAwB;IACxB,yBAAyB;IACzB,cAAc;CACf,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,OAA0B;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,GAAG,6EAA6E,CAAC;AAE9F,MAAM,kBAAkB,GACtB,kGAAkG;IAClG,iGAAiG;IACjG,+BAA+B;IAC/B,kIAAkI;IAClI,OAAO,CAAC;AAEV;;;;GAIG;AACH,MAAM,mBAAmB,GACvB,uFAAuF;IACvF,sFAAsF;IACtF,sCAAsC;IACtC,+BAA+B;IAC/B,8HAA8H;IAC9H,wGAAwG;IACxG,mEAAmE;IACnE,OAAO,CAAC;AAEV;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAC5D,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,2BAA2B,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/next/turbopack-config.d.ts

@@ -2,6 +2,15 @@
  * Turbopack configuration augmentation for Next.js client SDK aliases.
  */
 import type { NextConfigObject } from './types.js';
+import { type BridgeImportOptions } from './bridge-imports.js';
+/** The Turbopack rule that runs the bridge import loader on one wrapper. */
+export interface TurbopackBridgeRule {
+    loaders: Array<{
+        loader: string;
+        options: BridgeImportOptions;
+    }>;
+    as: '*.js';
+}
 /**
  * Configure Turbopack module aliases across standard and experimental sections.
  */

package/dist/next/turbopack-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"turbopack-config.d.ts","sourceRoot":"","sources":["../../src/next/turbopack-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAWnD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAkCjF"}
+{"version":3,"file":"turbopack-config.d.ts","sourceRoot":"","sources":["../../src/next/turbopack-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAwE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAErI,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;IACjE,EAAE,EAAE,MAAM,CAAC;CACZ;AA6BD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAkCjF"}

package/dist/next/turbopack-config.js

@@ -1,9 +1,30 @@
 import { getClientAliases } from './client-aliases.js';
+import { BRIDGE_IMPORT_LOADER, bridgeModuleFileNames, productionBridgeOptions } from './bridge-imports.js';
+/**
+ * In production AI mode, a rule per shadow-app wrapper that runs the bridge
+ * import loader, so the wrapper's Firebase SDK import escapes the alias that
+ * names the wrapper itself. Keyed by the wrapper's file name; the loader
+ * leaves any other file of that name unchanged.
+ */
+function assembleBridgeRules(existingRules) {
+    const options = productionBridgeOptions();
+    if (options === undefined)
+        return existingRules;
+    const rules = Object.assign({}, existingRules);
+    for (const name of bridgeModuleFileNames()) {
+        const rule = { loaders: [{ loader: BRIDGE_IMPORT_LOADER, options }], as: '*.js' };
+        rules[name] = rule;
+    }
+    return rules;
+}
 function assembleTurbopackAliases(existingTurbo) {
     const turboSection = existingTurbo !== undefined ? Object.assign({}, existingTurbo) : {};
     const currentAliases = turboSection.resolveAlias !== undefined ? Object.assign({}, turboSection.resolveAlias) : {};
     const pyricAliases = getClientAliases();
     turboSection.resolveAlias = Object.assign(currentAliases, pyricAliases);
+    const rules = assembleBridgeRules(turboSection.rules);
+    if (rules !== undefined)
+        turboSection.rules = rules;
     return turboSection;
 }
 /**

package/dist/next/turbopack-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"turbopack-config.js","sourceRoot":"","sources":["../../src/next/turbopack-config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,SAAS,wBAAwB,CAAC,aAA8C;IAC9E,MAAM,YAAY,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnH,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACxC,YAAY,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACxE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,MAAM,aAAa,GAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,kBAAkB,GAAG,OAAO,aAAa,CAAC,SAAS,KAAK,QAAQ,IAAI,aAAa,CAAC,SAAS,KAAK,IAAI,CAAC;IAC3G,MAAM,sBAAsB,GAAG,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,KAAK,KAAK,IAAI,CAAC;IACvG,MAAM,oBAAoB,GACxB,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ;QAC9C,aAAa,CAAC,YAAY,KAAK,IAAI;QACnC,OAAO,aAAa,CAAC,YAAY,CAAC,KAAK,KAAK,QAAQ;QACpD,aAAa,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC;IAE5C,MAAM,8BAA8B,GAClC,CAAC,kBAAkB,IAAI,CAAC,sBAAsB,IAAI,CAAC,oBAAoB,CAAC;IAE1E,IAAI,kBAAkB,IAAI,8BAA8B,EAAE,CAAC;QACzD,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC;QACjD,aAAa,CAAC,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC;QACzC,aAAa,CAAC,KAAK,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,oBAAoB,GACxB,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ,IAAI,aAAa,CAAC,YAAY,KAAK,IAAI;YACnF,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,CAAC;YAC/C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC;QAChD,oBAAoB,CAAC,KAAK,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACpE,aAAa,CAAC,YAAY,GAAG,oBAAoB,CAAC;IACpD,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"turbopack-config.js","sourceRoot":"","sources":["../../src/next/turbopack-config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,uBAAuB,EAA4B,MAAM,qBAAqB,CAAC;AAQrI;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,aAAkD;IAC7E,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAChD,MAAM,KAAK,GAA4B,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAwB,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACvG,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,aAA8C;IAC9E,MAAM,YAAY,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnH,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACxC,YAAY,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS;QAAE,YAAY,CAAC,KAAK,GAAG,KAAK,CAAC;IACpD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,MAAM,aAAa,GAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,kBAAkB,GAAG,OAAO,aAAa,CAAC,SAAS,KAAK,QAAQ,IAAI,aAAa,CAAC,SAAS,KAAK,IAAI,CAAC;IAC3G,MAAM,sBAAsB,GAAG,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,KAAK,KAAK,IAAI,CAAC;IACvG,MAAM,oBAAoB,GACxB,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ;QAC9C,aAAa,CAAC,YAAY,KAAK,IAAI;QACnC,OAAO,aAAa,CAAC,YAAY,CAAC,KAAK,KAAK,QAAQ;QACpD,aAAa,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC;IAE5C,MAAM,8BAA8B,GAClC,CAAC,kBAAkB,IAAI,CAAC,sBAAsB,IAAI,CAAC,oBAAoB,CAAC;IAE1E,IAAI,kBAAkB,IAAI,8BAA8B,EAAE,CAAC;QACzD,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC;QACjD,aAAa,CAAC,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC;QACzC,aAAa,CAAC,KAAK,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,oBAAoB,GACxB,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ,IAAI,aAAa,CAAC,YAAY,KAAK,IAAI;YACnF,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,CAAC;YAC/C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC;QAChD,oBAAoB,CAAC,KAAK,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACpE,aAAa,CAAC,YAAY,GAAG,oBAAoB,CAAC;IACpD,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/next/webpack-config.d.ts

@@ -2,6 +2,15 @@
  * Webpack configuration augmentation for Next.js client component builds.
  */
 import type { NextConfigObject } from './types.js';
+import { type BridgeImportOptions } from './bridge-imports.js';
+/** The webpack rule that runs the bridge import loader on the wrappers. */
+export interface WebpackBridgeRule {
+    test: string[];
+    use: Array<{
+        loader: string;
+        options: BridgeImportOptions;
+    }>;
+}
 /** The module that installs React's commit hook; it must evaluate before React. */
 export declare const REACT_HOOK_ENTRY = "@pyric/cli/next/internal/react-hook";
 /**

package/dist/next/webpack-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webpack-config.d.ts","sourceRoot":"","sources":["../../src/next/webpack-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA+BnD,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,wCAAwC,CAAC;AA+CtE;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAoB/E"}
+{"version":3,"file":"webpack-config.d.ts","sourceRoot":"","sources":["../../src/next/webpack-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAiD,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAgD9G,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,wCAAwC,CAAC;AA+CtE;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAqB/E"}

package/dist/next/webpack-config.js

@@ -1,4 +1,5 @@
 import { getClientAliases, getNodeBuiltinFallbacks } from './client-aliases.js';
+import { BRIDGE_IMPORT_LOADER, productionBridgeOptions } from './bridge-imports.js';
 function isClientSideBuild(options) {
     return options.isServer === false;
 }
@@ -17,6 +18,22 @@ function assembleClientResolveSection(existingResolve) {
     resolveSection.fallback = Object.assign(currentFallbacks, newFallbacks);
     return resolveSection;
 }
+/**
+ * In production AI mode, a rule that runs the bridge import loader on the
+ * shadow-app wrappers, so their Firebase SDK imports escape the aliases that
+ * name the wrappers themselves (see `bridge-imports.ts`).
+ */
+function assembleClientModuleSection(existingModule) {
+    const options = productionBridgeOptions();
+    if (options === undefined)
+        return existingModule;
+    const moduleSection = Object.assign({}, existingModule);
+    const rules = Array.isArray(moduleSection.rules) ? [...moduleSection.rules] : [];
+    const rule = { test: Object.keys(options.wrappers), use: [{ loader: BRIDGE_IMPORT_LOADER, options }] };
+    rules.push(rule);
+    moduleSection.rules = rules;
+    return moduleSection;
+}
 /** The module that installs React's commit hook; it must evaluate before React. */
 export const REACT_HOOK_ENTRY = '@pyric/cli/next/internal/react-hook';
 /** Next's client runtime entries: `main-app` for the App Router, `main` for Pages. */
@@ -79,6 +96,7 @@ export function augmentWebpackConfig(config) {
             return resolvedConfig;
         }
         resolvedConfig.resolve = assembleClientResolveSection(resolvedConfig.resolve);
+        resolvedConfig.module = assembleClientModuleSection(resolvedConfig.module);
         resolvedConfig.experiments = assembleClientExperimentsSection(resolvedConfig.experiments);
         resolvedConfig.output = assembleClientOutputSection(resolvedConfig.output);
         resolvedConfig.entry = assembleClientEntry(resolvedConfig.entry);

package/dist/next/webpack-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"webpack-config.js","sourceRoot":"","sources":["../../src/next/webpack-config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAOhF,SAAS,iBAAiB,CAAC,OAAuB;IAChD,OAAO,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC;AACpC,CAAC;AAED,SAAS,4BAA4B,CAAC,eAAgD;IACpF,MAAM,cAAc,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/F,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;QAClE,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC;IACpC,CAAC;IACD,cAAc,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAEjE,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjH,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;IAC/C,cAAc,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAExE,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAEtE,sFAAsF;AACtF,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAIpD,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,KAAK,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,gBAAgB,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,aAAsB;IACjD,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,QAAQ,GAAG,OAAO,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7F,MAAM,OAAO,GAA+B,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,QAAsC,CAAC,CAAC;QACtG,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CAAC,mBAAoD;IAC5F,MAAM,kBAAkB,GAAG,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3G,kBAAkB,CAAC,aAAa,GAAG,IAAI,CAAC;IACxC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,2BAA2B,CAAC,cAA+C;IAClF,MAAM,aAAa,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvH,kBAAkB,CAAC,aAAa,GAAG,IAAI,CAAC;IACxC,aAAa,CAAC,WAAW,GAAG,kBAAkB,CAAC;IAC/C,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,MAAM,aAAa,GAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC;IAE9C,aAAa,CAAC,OAAO,GAAG,CAAC,aAAkB,EAAE,cAA8B,EAAE,EAAE;QAC7E,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,UAAU,GAAG,OAAO,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAC1H,MAAM,cAAc,GAAG,UAAU,IAAI,aAAa,CAAC;QACnD,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,cAAc,CAAC,OAAO,GAAG,4BAA4B,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC9E,cAAc,CAAC,WAAW,GAAG,gCAAgC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAC1F,cAAc,CAAC,MAAM,GAAG,2BAA2B,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3E,cAAc,CAAC,KAAK,GAAG,mBAAmB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"webpack-config.js","sourceRoot":"","sources":["../../src/next/webpack-config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAA4B,MAAM,qBAAqB,CAAC;AAO9G,SAAS,iBAAiB,CAAC,OAAuB;IAChD,OAAO,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC;AACpC,CAAC;AAED,SAAS,4BAA4B,CAAC,eAAgD;IACpF,MAAM,cAAc,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/F,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;QAClE,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC;IACpC,CAAC;IACD,cAAc,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAEjE,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjH,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;IAC/C,cAAc,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAExE,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAClC,cAAyE;IAEzE,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IACjD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,IAAI,GAAsB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1H,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CAAC,KAAK,GAAG,KAAK,CAAC;IAC5B,OAAO,aAAa,CAAC;AACvB,CAAC;AAQD,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAEtE,sFAAsF;AACtF,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAIpD,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,KAAK,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,gBAAgB,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,aAAsB;IACjD,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,QAAQ,GAAG,OAAO,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7F,MAAM,OAAO,GAA+B,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,QAAsC,CAAC,CAAC;QACtG,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CAAC,mBAAoD;IAC5F,MAAM,kBAAkB,GAAG,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3G,kBAAkB,CAAC,aAAa,GAAG,IAAI,CAAC;IACxC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,2BAA2B,CAAC,cAA+C;IAClF,MAAM,aAAa,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvH,kBAAkB,CAAC,aAAa,GAAG,IAAI,CAAC;IACxC,aAAa,CAAC,WAAW,GAAG,kBAAkB,CAAC;IAC/C,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,MAAM,aAAa,GAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC;IAE9C,aAAa,CAAC,OAAO,GAAG,CAAC,aAAkB,EAAE,cAA8B,EAAE,EAAE;QAC7E,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,UAAU,GAAG,OAAO,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAC1H,MAAM,cAAc,GAAG,UAAU,IAAI,aAAa,CAAC;QACnD,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,cAAc,CAAC,OAAO,GAAG,4BAA4B,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC9E,cAAc,CAAC,MAAM,GAAG,2BAA2B,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3E,cAAc,CAAC,WAAW,GAAG,gCAAgC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAC1F,cAAc,CAAC,MAAM,GAAG,2BAA2B,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3E,cAAc,CAAC,KAAK,GAAG,mBAAmB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/next/with-pyric.d.ts

@@ -14,6 +14,7 @@ import type { NextConfig, NextConfigFunction, PyricNextOptions } from './types.j
  *     to the local Pyric server without CORS errors.
  *   - Enforces a bundler safety interlock (guard) to prevent accidental connections to
  *     production databases when `PYRIC_SANDBOX` is inactive.
+ *   - Defaults the network guard to `block` unless `PYRIC_GUARD` names a mode.
  *
  * In the production build, export and production server phases (without
  * `PYRIC_SANDBOX_FORCE=1`):

package/dist/next/with-pyric.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-pyric.d.ts","sourceRoot":"","sources":["../../src/next/with-pyric.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA6BrG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,SAAS,CAAC,MAAM,GAAE,UAAe,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,kBAAkB,CAYjG"}
+{"version":3,"file":"with-pyric.d.ts","sourceRoot":"","sources":["../../src/next/with-pyric.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAqDrG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,CAAC,MAAM,GAAE,UAAe,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,kBAAkB,CAajG"}

package/dist/next/with-pyric.js

@@ -5,6 +5,9 @@ import { augmentTurbopackConfig } from './turbopack-config.js';
 import { augmentDevRewrites } from './dev-rewrites.js';
 import { augmentRuntimeEnv } from './runtime-env.js';
 import { findEdgeRuntimeFiles, formatEdgeRuntimeWarning } from './edge-runtime.js';
+import { NET_GUARD_GLOBAL } from '../register/net-guard.js';
+const DEV_SERVER_PHASE = 'phase-development-server';
+const DEV_GUARD_REASON = 'withPyric runs the Next dev server, which defaults to PYRIC_GUARD=block (#1443)';
 function isFunctionConfig(config) {
     return typeof config === 'function';
 }
@@ -14,6 +17,26 @@ function warnAboutEdgeRuntime() {
         console.warn(warning);
     }
 }
+/**
+ * The Next dev server defaults the network guard to `block` (#1443), as the
+ * Vite dev server does (`serve/vite-net-guard.ts`): inside a framework dev
+ * server pyric's plugin wraps, nothing is meant to reach live Firebase except
+ * allowlisted hosts, and a missed import looks swapped to its author. It
+ * escalates the guard the register installed in this process, and sets
+ * `PYRIC_GUARD=block` for the processes Next starts afterward. An explicit
+ * `PYRIC_GUARD` (`warn`, `off`) still names the mode, and `PYRIC_GUARD_ALLOW`
+ * still permits its hosts.
+ */
+function blockByDefaultInDevServer(phase) {
+    const isDevServer = phase === DEV_SERVER_PHASE;
+    const namesMode = (process.env.PYRIC_GUARD ?? '').trim().length > 0;
+    const takesDefault = isDevServer && !namesMode;
+    if (!takesDefault)
+        return;
+    process.env.PYRIC_GUARD = 'block';
+    const guard = globalThis[NET_GUARD_GLOBAL];
+    guard?.escalate(DEV_GUARD_REASON);
+}
 function applyPyricEnhancements(config, options) {
     let enhancedConfig = augmentServerExternalPackages(config);
     enhancedConfig = augmentWebpackConfig(enhancedConfig);
@@ -34,6 +57,7 @@ function applyPyricEnhancements(config, options) {
  *     to the local Pyric server without CORS errors.
  *   - Enforces a bundler safety interlock (guard) to prevent accidental connections to
  *     production databases when `PYRIC_SANDBOX` is inactive.
+ *   - Defaults the network guard to `block` unless `PYRIC_GUARD` names a mode.
  *
  * In the production build, export and production server phases (without
  * `PYRIC_SANDBOX_FORCE=1`):
@@ -48,6 +72,7 @@ export function withPyric(config = {}, options) {
             return isFunctionConfig(config) ? await config(phase, defaults) : config;
         }
         enforceSandboxGuard(options);
+        blockByDefaultInDevServer(phase);
         warnAboutEdgeRuntime();
         const resolvedConfig = isFunctionConfig(config) ? await config(phase, defaults) : config;
         return applyPyricEnhancements(resolvedConfig, options);

package/dist/next/with-pyric.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-pyric.js","sourceRoot":"","sources":["../../src/next/with-pyric.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAEnF,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,wBAAwB,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB,EAAE,OAA0B;IAClF,IAAI,cAAc,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IAC3D,cAAc,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACtD,cAAc,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACxD,cAAc,GAAG,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC7D,cAAc,GAAG,iBAAiB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,SAAS,CAAC,SAAqB,EAAE,EAAE,OAA0B;IAC3E,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAED,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,oBAAoB,EAAE,CAAC;QAEvB,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzF,OAAO,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-pyric.js","sourceRoot":"","sources":["../../src/next/with-pyric.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAiB,MAAM,0BAA0B,CAAC;AAE3E,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,gBAAgB,GAAG,iFAAiF,CAAC;AAE3G,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,wBAAwB,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB,CAAC,KAAa;IAC9C,MAAM,WAAW,GAAG,KAAK,KAAK,gBAAgB,CAAC;IAC/C,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,WAAW,IAAI,CAAC,SAAS,CAAC;IAC/C,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC;IAClC,MAAM,KAAK,GAAI,UAAgF,CAAC,gBAAgB,CAAC,CAAC;IAClH,KAAK,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB,EAAE,OAA0B;IAClF,IAAI,cAAc,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IAC3D,cAAc,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACtD,cAAc,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACxD,cAAc,GAAG,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC7D,cAAc,GAAG,iBAAiB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,SAAS,CAAC,SAAqB,EAAE,EAAE,OAA0B;IAC3E,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAED,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACjC,oBAAoB,EAAE,CAAC;QAEvB,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzF,OAAO,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC"}

package/dist/register/activation.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Whether `@pyric/cli/register` is active in this thread.
+ *
+ * `PYRIC_SANDBOX` asks for the register, but the variable says nothing about
+ * whether it loaded: a `.env` file Next reads, a `NODE_ENV=production`
+ * refusal, or a package script that sets its own `NODE_OPTIONS` each leave the
+ * variable set and the register absent (#1625). Code that depends on the
+ * register reads this mark instead. It lives on `globalThis` under
+ * `Symbol.for`, so it holds across two installed copies of `@pyric/cli`, and
+ * importing this module never activates anything.
+ */
+/** Called by the register at the end of activation. */
+export declare function markRegisterActive(): void;
+/** Whether the register activated in this thread. */
+export declare function isRegisterActive(): boolean;
+//# sourceMappingURL=activation.d.ts.map

package/dist/register/activation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activation.d.ts","sourceRoot":"","sources":["../../src/register/activation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,uDAAuD;AACvD,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C"}

package/dist/register/activation.js

@@ -0,0 +1,22 @@
+/**
+ * Whether `@pyric/cli/register` is active in this thread.
+ *
+ * `PYRIC_SANDBOX` asks for the register, but the variable says nothing about
+ * whether it loaded: a `.env` file Next reads, a `NODE_ENV=production`
+ * refusal, or a package script that sets its own `NODE_OPTIONS` each leave the
+ * variable set and the register absent (#1625). Code that depends on the
+ * register reads this mark instead. It lives on `globalThis` under
+ * `Symbol.for`, so it holds across two installed copies of `@pyric/cli`, and
+ * importing this module never activates anything.
+ */
+/** Set by the register once its hooks, guard and factory global are in place. */
+const REGISTER_ACTIVE = Symbol.for('pyric.register.active');
+/** Called by the register at the end of activation. */
+export function markRegisterActive() {
+    globalThis[REGISTER_ACTIVE] = true;
+}
+/** Whether the register activated in this thread. */
+export function isRegisterActive() {
+    return globalThis[REGISTER_ACTIVE] === true;
+}
+//# sourceMappingURL=activation.js.map

package/dist/register/activation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activation.js","sourceRoot":"","sources":["../../src/register/activation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,iFAAiF;AACjF,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAI5D,uDAAuD;AACvD,MAAM,UAAU,kBAAkB;IAC/B,UAAsC,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;AAClE,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB;IAC9B,OAAQ,UAAsC,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC;AAC3E,CAAC"}

package/dist/register/app-bridge-admin-app-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-bridge-admin-app-check.d.ts","sourceRoot":"","sources":["../../src/register/app-bridge-admin-app-check.ts"],"names":[],"mappings":"AA0CA,+FAA+F;AAC/F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE9F"}
+{"version":3,"file":"app-bridge-admin-app-check.d.ts","sourceRoot":"","sources":["../../src/register/app-bridge-admin-app-check.ts"],"names":[],"mappings":"AA4CA,+FAA+F;AAC/F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE9F"}

package/dist/register/app-bridge-admin-app-check.js

@@ -7,7 +7,9 @@
  * production AI mode only, and loads this module on the first token whose
  * `kid` is not the sandbox's, so a server that never sees one never loads
  * firebase-admin. `firebase-admin/app` and `firebase-admin/app-check` reach
- * the real package from here (`isBypassedBridgeImport`).
+ * the real package from this module only, and only in production AI mode
+ * (`isBypassedBridgeImport`); the stop in `swap-or-stop.ts` lets them and the
+ * firebase-admin files they import through.
  *
  * Each project gets one firebase-admin app whose credential refuses to mint an
  * access token, so the app cannot fall back to Application Default

package/dist/register/app-bridge-admin-app-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-bridge-admin-app-check.js","sourceRoot":"","sources":["../../src/register/app-bridge-admin-app-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,aAAa,EAA6B,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,MAAM,cAAc,GAAG,kDAAkD,CAAC;AAE1E,qDAAqD;AACrD,MAAM,aAAa,GAAe;IAChC,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAe,CAAC;AAE7C,SAAS,WAAW,CAAC,SAAiB;IACpC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,8BAA8B,SAAS,EAAE,CAAC,CAAC;IAC/G,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,SAAiB;IAC1E,OAAO,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"app-bridge-admin-app-check.js","sourceRoot":"","sources":["../../src/register/app-bridge-admin-app-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,aAAa,EAA6B,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,MAAM,cAAc,GAAG,kDAAkD,CAAC;AAE1E,qDAAqD;AACrD,MAAM,aAAa,GAAe;IAChC,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAe,CAAC;AAE7C,SAAS,WAAW,CAAC,SAAiB;IACpC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,8BAA8B,SAAS,EAAE,CAAC,CAAC;IAC/G,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,SAAiB;IAC1E,OAAO,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/register/child-process-guard.d.ts

@@ -0,0 +1,43 @@
+type Env = Record<string, string | undefined>;
+/** The `child_process` exports this module replaces. */
+interface ChildProcessModule {
+    ChildProcess: {
+        prototype: {
+            spawn?: unknown;
+        };
+    };
+    spawnSync: unknown;
+    execSync: unknown;
+    execFileSync: unknown;
+}
+/**
+ * The environment to start a child with, so that it loads the register at
+ * `registerUrl` in the sandbox `parentEnv` names. Returns a new object and
+ * never changes `childEnv`. `file:` URLs are percent-encoded, so the import
+ * needs no quoting in `NODE_OPTIONS`.
+ */
+export declare function guardChildEnv(childEnv: Env, parentEnv: Env, registerUrl: string): Env;
+/** `envPairs` (`NAME=value` strings, as `ChildProcess.prototype.spawn` takes them) with the guarded env. */
+export declare function guardEnvPairs(envPairs: readonly string[], parentEnv: Env, registerUrl: string): string[];
+/**
+ * The arguments for a synchronous `child_process` call, with options whose
+ * `env` is guarded. A call that names no env gets one built from this
+ * process's env, as Node would build it. Returns new values and never changes
+ * the caller's.
+ */
+export declare function guardSyncArguments(takesArgs: boolean, args: readonly unknown[], parentEnv: Env, registerUrl: string): unknown[];
+/**
+ * The options `ChildProcess.prototype.spawn` receives, with the env guarded.
+ * Node resolves the child's env into `envPairs` before this call. Bun builds
+ * its children elsewhere and ignores the env here, so its asynchronous
+ * children are not covered; its synchronous ones are.
+ */
+export declare function guardSpawnOptions(options: unknown, registerUrl: string): unknown;
+/**
+ * Start every child process of this process with the register at
+ * `registerUrl` (see the module comment). `childProcess` defaults to
+ * `node:child_process`; tests pass a stand-in.
+ */
+export declare function installChildProcessGuard(registerUrl: string, childProcess?: ChildProcessModule): void;
+export {};
+//# sourceMappingURL=child-process-guard.d.ts.map

package/dist/register/child-process-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process-guard.d.ts","sourceRoot":"","sources":["../../src/register/child-process-guard.ts"],"names":[],"mappings":"AA4BA,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,wDAAwD;AACxD,UAAU,kBAAkB;IAC1B,YAAY,EAAE;QAAE,SAAS,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACjD,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;CACvB;AAgBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,CAYrF;AAED,4GAA4G;AAC5G,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAaxG;AAmBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,OAAO,EAClB,IAAI,EAAE,SAAS,OAAO,EAAE,EACxB,SAAS,EAAE,GAAG,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,EAAE,CAMX;AAcD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAKhF;AA2BD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,kBAAkB,GAAG,IAAI,CASrG"}