@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/src/register/index.ts

@@ -18,10 +18,19 @@
  * `module.register()` (ESM-only) with a warning that CJS require() is not
  * rewritten.
  *
+ * Swap or stop (ADR 0022, `./swap-or-stop.js`): an import that resolves into
+ * the real `firebase-admin`, or into the real client SDK where the swap table
+ * didn't choose it, throws `PYRIC_REAL_SDK_STOPPED` before the file loads.
+ *
  * On activation it also installs the NETWORK GUARD (`./net-guard.js`), which
  * refuses egress from this process to live Google/Firebase endpoints, or only
  * reports it under `PYRIC_GUARD=warn`. See that module for the policy and the
- * `PYRIC_GUARD` and `PYRIC_GUARD_ALLOW` knobs.
+ * `PYRIC_GUARD` and `PYRIC_GUARD_ALLOW` knobs. Whatever the guard mode, it
+ * wraps `worker_threads.Worker` (`./worker-guard.js`) so every worker thread
+ * loads this module as well, including those Node starts without preloads,
+ * and gets the swap and the stop. It also wraps `child_process`
+ * (`./child-process-guard.js`), so every child process starts with this
+ * module in its `NODE_OPTIONS` and in this process's sandbox.
  *
  * Finally it emits the HANDSHAKE BEACON (`./beacon.js`): a fire-and-forget
  * `POST /__pyric/beacon` when the activator carries a bridge URL, plus a
@@ -33,10 +42,15 @@ import Module from 'node:module';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { mapFirebaseSpecifier } from './mapping.js';
+import { canonicalFirebaseSpecifier, mapFirebaseSpecifier } from './mapping.js';
+import { resolvesIntoPackage } from './package-identity.js';
+import { markRegisterActive } from './activation.js';
+import { createStopReporter, stopFor } from './swap-or-stop.js';
 import { resolveEsmOnlySubpath } from './esm-exports.js';
 import { NET_GUARD_GLOBAL, installNetGuard, parseGuardMode, type GuardMode } from './net-guard.js';
 import { emitBeacon } from './beacon.js';
+import { installWorkerGuard } from './worker-guard.js';
+import { installChildProcessGuard } from './child-process-guard.js';
 import { remoteSandbox } from '../remote/index.js';
 import { resolveAiMode } from '../serve/firebase-module-swap.js';
 
@@ -107,6 +121,70 @@ function resolveEsmOnlyForRequire(mapped: string): string | null {
   }
 }
 
+type NextSyncResolve = Parameters<SyncResolve>[2];
+
+/** Resolve a mapped pyric target from this installed CLI. */
+function resolveMapped(mapped: string, context: SyncResolveContext, nextResolve: NextSyncResolve): SyncResolveResult {
+  try {
+    return nextResolve(mapped, { ...context, parentURL: import.meta.url });
+  } catch (err) {
+    // CJS `require('firebase-admin/app')` resolves under the `require`
+    // condition, but the pyric mirrors are ESM-only. Resolve the file
+    // under import conditions ourselves — require(esm) (Node ≥ 22.12)
+    // loads it fine once given the URL.
+    const code = (err as { code?: string }).code;
+    if (code === 'ERR_PACKAGE_PATH_NOT_EXPORTED' || code === 'MODULE_NOT_FOUND') {
+      const url = resolveEsmOnlyForRequire(mapped);
+      if (url) return { url, shortCircuit: true };
+    }
+    throw err;
+  }
+}
+
+/**
+ * The sync resolve hook. A canonical Firebase specifier maps directly. A
+ * Turbopack-renamed one (`firebase-admin-<hash>/app`, #1443) resolves as
+ * given first, and maps by its canonical name only when that landed in the
+ * real package, so an unrelated package with such a name stays itself.
+ */
+const resolveFirebase: SyncResolve = (specifier, context, nextResolve) => {
+  const canonical = canonicalFirebaseSpecifier(specifier);
+  if (canonical === null) {
+    const mapped = mapFirebaseSpecifier(specifier, context.parentURL);
+    if (mapped === null) return nextResolve(specifier, context);
+    return resolveMapped(mapped, context, nextResolve);
+  }
+  const renamed = nextResolve(specifier, context);
+  const isRealFirebasePackage = resolvesIntoPackage(renamed.url, canonical);
+  if (!isRealFirebasePackage) return renamed;
+  const mapped = mapFirebaseSpecifier(canonical, context.parentURL);
+  if (mapped === null) return renamed;
+  return resolveMapped(mapped, context, nextResolve);
+};
+
+/**
+ * Swap or stop (ADR 0022): a resolve that lands in the real `firebase-admin`,
+ * or in the real client SDK where the swap table didn't choose it, throws
+ * before the file loads, and the stop is written to stderr once per file. It
+ * does not depend on the network guard, so `PYRIC_GUARD=off` keeps it.
+ */
+function withSwapOrStop(resolve: SyncResolve): SyncResolve {
+  const report = createStopReporter((line) => void process.stderr.write(line));
+  const allowedUrls = new Set<string>();
+  return (specifier, context, nextResolve) => {
+    const result = resolve(specifier, context, nextResolve);
+    const stop = stopFor({
+      specifier,
+      canonical: canonicalFirebaseSpecifier(specifier),
+      importer: context.parentURL,
+      url: result.url,
+    }, allowedUrls);
+    if (stop === null) return result;
+    report(stop);
+    throw stop;
+  };
+}
+
 function activate(): void {
   // FIRST, before any hook or global: the network guard.
   //
@@ -128,6 +206,16 @@ function activate(): void {
   // Published so code that learns a destination later, such as the Vite
   // plugin's configured AI upstream, can permit it (`permitGuardHost`).
   if (guard !== null) (globalThis as unknown as Record<symbol, unknown>)[NET_GUARD_GLOBAL] = guard;
+  // Built-ins and resolve hooks are per thread: every worker this process
+  // starts loads this module too, including the kinds Node starts without
+  // running preloads. Whatever PYRIC_GUARD says, since the worker's swap and
+  // stop come from this module; the worker installs its own network guard, or
+  // none under `off`, exactly as this thread does.
+  installWorkerGuard(import.meta.url);
+  // Child processes too (#1618): every child starts with this module in its
+  // NODE_OPTIONS and with this process's PYRIC_* variables it lacks, so a
+  // child of a registered process is registered whatever env it is given.
+  installChildProcessGuard(import.meta.url);
 
   // Whether module resolution is actually being intercepted. Both branches
   // below install SOMETHING, but a runtime with neither API installs nothing,
@@ -137,24 +225,7 @@ function activate(): void {
   if (typeof moduleApi.registerHooks === 'function') {
     hooksInstalled = true;
     moduleApi.registerHooks({
-      resolve(specifier, context, nextResolve) {
-        const mapped = mapFirebaseSpecifier(specifier, context.parentURL);
-        if (mapped === null) return nextResolve(specifier, context);
-        try {
-          return nextResolve(mapped, { ...context, parentURL: import.meta.url });
-        } catch (err) {
-          // CJS `require('firebase-admin/app')` resolves under the `require`
-          // condition, but the pyric mirrors are ESM-only. Resolve the file
-          // under import conditions ourselves — require(esm) (Node ≥ 22.12)
-          // loads it fine once given the URL.
-          const code = (err as { code?: string }).code;
-          if (code === 'ERR_PACKAGE_PATH_NOT_EXPORTED' || code === 'MODULE_NOT_FOUND') {
-            const url = resolveEsmOnlyForRequire(mapped);
-            if (url) return { url, shortCircuit: true };
-          }
-          throw err;
-        }
-      },
+      resolve: withSwapOrStop(resolveFirebase),
     });
   } else {
     process.stderr.write(
@@ -239,6 +310,7 @@ if (process.env.PYRIC_SANDBOX) {
   } else {
     activate();
     active = true;
+    markRegisterActive();
   }
 }
 // No PYRIC_SANDBOX → inert by design: importing this module rewrites nothing.

package/src/register/mapping.ts

@@ -18,10 +18,16 @@
  * narrow: only the two package roots match. `@firebase/*` internals,
  * `firebase-functions`, and anything merely *containing* "firebase" pass
  * through untouched.
+ *
+ * Next 16's Turbopack renames server externals (#1443): it links
+ * `.next/node_modules/firebase-admin-<16 hex>` to the installed package and
+ * imports `firebase-admin-<hash>/app`. `canonicalFirebaseSpecifier` names such
+ * an import by its package, and the hooks map the canonical name only after
+ * the renamed import resolved into the real package (`package-identity.ts`).
  */
 
 import { parsePyricSandbox } from 'pyric/sandbox/internal';
-import { isBypassedBridgeImport, resolveAiMode, type AiMode } from '../serve/firebase-module-swap.js';
+import { isBypassedBridgeImport, isProductionAiSdkFile, resolveAiMode, type AiMode } from '../serve/firebase-module-swap.js';
 
 const MAPPINGS: ReadonlyArray<readonly [from: string, to: string]> = [
   // firebase-admin first — `firebase-admin` must never match the bare
@@ -56,6 +62,53 @@ function nodeHostClientTarget(specifier: string): string | null {
   return servedByHost ? `${NODE_HOST_CLIENT}/${subpath}` : null;
 }
 
+/**
+ * A Turbopack-renamed package root: `firebase-admin` or `firebase`, a dash and
+ * exactly 16 lowercase hex characters, then the end or a non-empty subpath.
+ * Anchored at the start, so `firebase-functions-<hash>`, `@firebase/*` and
+ * `my-firebase-<hash>` never match.
+ */
+const RENAMED_FIREBASE = /^(firebase-admin|firebase)-[0-9a-f]{16}(\/.+)?$/;
+
+/**
+ * The canonical name of a Turbopack-renamed Firebase import
+ * (`firebase-admin-<hash>/app` → `firebase-admin/app`), or `null` when the
+ * specifier isn't one. The name alone proves nothing: the caller confirms the
+ * import resolved into the package of that name before mapping it.
+ */
+export function canonicalFirebaseSpecifier(specifier: string): string | null {
+  const match = RENAMED_FIREBASE.exec(specifier);
+  if (match === null) return null;
+  const [, packageRoot, subpath = ''] = match;
+  return `${packageRoot}${subpath}`;
+}
+
+export interface RealFirebaseLoad {
+  /** The specifier as written, or its canonical name when Turbopack renamed it. */
+  specifier: string;
+  importer: string | undefined;
+  /** The package the resolved file belongs to, `firebase` or `@firebase/*`. */
+  packageName: string;
+  /** The resolved file's path inside that package; read only for `firebase` in production AI mode. */
+  pathInPackage: () => string | null;
+  aiMode: AiMode;
+}
+
+/**
+ * Whether the swap table hands this client SDK load to the real SDK (ADR
+ * 0022): one of pyric's shadow modules reaching the `firebase/app` or
+ * `firebase/app-check` it wraps, or, in production AI mode, the files of
+ * `firebase/ai`, `firebase/app` and `firebase/app-check` and the `@firebase/*`
+ * packages they import (`isProductionAiSdkFile`). The stop in
+ * `swap-or-stop.ts` allows exactly these, so the swap and the stop cannot
+ * disagree.
+ */
+export function choosesRealFirebase(load: RealFirebaseLoad): boolean {
+  if (isBypassedBridgeImport(load.specifier, load.importer, load.aiMode)) return true;
+  const isProductionMode = load.aiMode === 'production';
+  return isProductionMode && isProductionAiSdkFile(load.packageName, load.pathInPackage);
+}
+
 /**
  * Map a Firebase specifier to its pyric mirror, or return `null` when the
  * specifier is not a Firebase package (leave it for the default resolver).
@@ -66,11 +119,12 @@ export function mapFirebaseSpecifier(
   options?: MapFirebaseOptions,
 ): string | null {
   const isFirebaseAppSpecifier = specifier === 'firebase/app';
-  if (isBypassedBridgeImport(specifier, importer)) {
+  const aiMode = resolveAiMode(options?.aiMode, process.env);
+  if (isBypassedBridgeImport(specifier, importer, aiMode)) {
     return null;
   }
 
-  const isProductionMode = resolveAiMode(options?.aiMode, process.env) === 'production';
+  const isProductionMode = aiMode === 'production';
   const isFirebaseAiSpecifier = specifier === 'firebase/ai';
   const isProductionAiPassthrough = isProductionMode && isFirebaseAiSpecifier;
   if (isProductionAiPassthrough) {

package/src/register/net-guard.ts

@@ -57,6 +57,19 @@
  *    patches are installed BEFORE the dispatcher is materialized: materializing
  *    loads undici, which loads `_http_agent`.
  *
+ * 3. `http.ClientRequest.prototype.onSocket`, for a request to a proxy. The
+ *    socket reaches only the proxy; the real destination is the `CONNECT`
+ *    target or the absolute-form URL in the request's path, and the request is
+ *    the only object that still carries its path. Likewise a TLS session over a
+ *    tunnel names its destination only in `servername`, which the socket seams
+ *    check beside `host`.
+ *
+ * Every host is compared in the catalog's one spelling (`normalizeHostname`),
+ * which writes each IPv4 form the resolver accepts (`2852039166`,
+ * `0xa9fea9fe`, `169.254.43518`) and each IPv4-mapped IPv6 address as a dotted
+ * quad, so no respelling of the metadata IP gets past its entry. Worker
+ * threads load the register too (`./worker-guard.js`).
+ *
  * Policy
  * ------
  * One knob, `PYRIC_GUARD=warn|block|off`, default `warn`:
@@ -109,7 +122,11 @@ import {
   normalizeHostname,
   type GoogleEndpoint,
 } from '../google-endpoints.js';
-import { nodeAgentPrototypes, nodeSocketPrototypes } from './connect-prototypes.js';
+import {
+  nodeAgentPrototypes,
+  nodeClientRequestPrototypes,
+  nodeSocketPrototypes,
+} from './connect-prototypes.js';
 
 /** undici's version-suffixed global-dispatcher slots (`undici.globalDispatcher.1` in undici 6 / Node 20–22, `.2` in undici 7+ / Node 24+). */
 const UNDICI_DISPATCHER_KEY_PREFIX = 'undici.globalDispatcher.';
@@ -181,31 +198,29 @@ export function parseAllowHosts(raw: string | undefined): string[] {
   return out;
 }
 
-/** Only a trailing `:port` is stripped; a bare IPv6 address is left alone. */
-const HOST_WITH_PORT = /^(.+):\d+$/;
+/** `name:port`: one colon, so never a bare IPv6 address. */
+const NAME_WITH_PORT = /^([^:]+):\d+$/;
+
+/** `[v6]` or `[v6]:port`. */
+const BRACKETED_HOST = /^\[([^\]]+)\](?::\d+)?$/;
 
 /**
- * Best-effort hostname from a host, `host:port`, or full URL. Normalization
- * and suffix matching are the catalog's, so the guard and the catalog can
- * never disagree about what a hostname is.
+ * Best-effort hostname from a host, `host:port`, `[v6]:port`, or full URL.
+ * Normalization and suffix matching are the catalog's, so the guard and the
+ * catalog can never disagree about what a hostname is.
  */
 function hostnameOf(value: string): string {
   const trimmed = value.trim();
   if (trimmed.includes('://')) {
     try {
-      return normalizeHostname(new URL(trimmed).hostname).replace(/^\[|\]$/g, '');
+      return normalizeHostname(new URL(trimmed).hostname);
     } catch {
       // Not a parseable URL: fall through to the textual forms.
     }
   }
   const withoutPath = trimmed.split('/')[0] ?? trimmed;
-  const portMatch = HOST_WITH_PORT.exec(withoutPath);
-  let hostPart: string;
-  if (portMatch === null) {
-    hostPart = withoutPath;
-  } else {
-    hostPart = portMatch[1]!;
-  }
+  const hostPart =
+    BRACKETED_HOST.exec(withoutPath)?.[1] ?? NAME_WITH_PORT.exec(withoutPath)?.[1] ?? withoutPath;
   return normalizeHostname(hostPart);
 }
 
@@ -347,12 +362,12 @@ interface Reporter {
 
 function createReporter(options: ReporterOptions): Reporter {
   const write = options.write ?? ((line: string) => void process.stderr.write(line));
-  const policy = { mode: options.mode, allow: options.allow };
   const reported = options.reported ?? new Set<string>();
   return {
     check(hostname, transport) {
       if (hostname === undefined) return;
-      const verdict = evaluateEgress(hostname, policy);
+      // Read per check: an escalated guard (`NetGuard.escalate`) changes the mode.
+      const verdict = evaluateEgress(hostname, { mode: options.mode, allow: options.allow });
       if (verdict === null) return;
       // A dev server retries relentlessly; one line per host is the signal,
       // and it also collapses the undici-over-net.connect double report.
@@ -441,11 +456,27 @@ export interface NetGuardHooks {
   /** Prototypes whose `connect` is patched. Defaults to the `net.Socket`
    *  prototype. */
   socketPrototypes?: readonly SocketPrototype[];
+  /** Prototypes whose `onSocket` is patched. Defaults to the
+   *  `http.ClientRequest` prototype. */
+  requestPrototypes?: readonly RequestPrototype[];
 }
 
+/** An `onSocket`-bearing object: `http.ClientRequest.prototype` in
+ *  production, a stand-in under test. */
+type RequestPrototype = { onSocket?: unknown };
+
 export interface NetGuard {
+  /** The mode in force now; `escalate` can move it from `warn` to `block`. */
   readonly mode: GuardMode;
   readonly allow: readonly string[];
+  /**
+   * Move a `warn` guard to `block` for the rest of this process, and write one
+   * line naming `reason`. A `block` guard is left as it is. Returns whether
+   * the mode changed. Used when the process shows it is about to reach
+   * production by mistake, such as the real `firebase-admin` loading under
+   * the register (#1443), and by `withPyric` in the Next dev server.
+   */
+  escalate(reason: string): boolean;
   /** Permit one more host, given bare or as a URL, for the rest of this
    *  process. A launcher that learns a destination after install, such as the
    *  Vite plugin's configured AI upstream, names it here. */
@@ -522,7 +553,17 @@ export function installNetGuard(hooks: NetGuardHooks = {}): NetGuard | null {
 
   const allow = parseAllowHosts(env.PYRIC_GUARD_ALLOW);
   const context = contextFrom(hooks.argv ?? process.argv);
-  const reporterOptions: ReporterOptions = { mode, allow, write, context, reported: new Set() };
+  // One mode for every seam, read on each check, so `escalate` reaches them all.
+  const state = { mode };
+  const reporterOptions: ReporterOptions = {
+    get mode() {
+      return state.mode;
+    },
+    allow,
+    write,
+    context,
+    reported: new Set(),
+  };
 
   const scope = hooks.scope ?? (globalThis as unknown as Record<symbol, unknown>);
 
@@ -543,7 +584,7 @@ export function installNetGuard(hooks: NetGuardHooks = {}): NetGuard | null {
     const original = target[name];
     if (typeof original !== 'function') return;
     const wrapped = function (this: unknown, ...args: unknown[]): unknown {
-      reporter.check(connectHost(args), 'socket');
+      for (const host of connectHosts(args)) reporter.check(host, 'socket');
       return (original as ConnectFn).apply(this, args);
     };
     target[name] = wrapped;
@@ -565,6 +606,11 @@ export function installNetGuard(hooks: NetGuardHooks = {}): NetGuard | null {
   for (const prototype of hooks.socketPrototypes ?? nodeSocketPrototypes()) {
     guardConnect(prototype as { [k: string]: unknown }, 'connect');
   }
+  // And the request a socket carries, whose path names a proxy's real
+  // destination. The socket itself only reaches the proxy.
+  for (const prototype of hooks.requestPrototypes ?? nodeClientRequestPrototypes()) {
+    guardProxiedRequest(prototype, reporter);
+  }
 
   const installed = new Map<symbol, Dispatcher>();
   const wrapGlobalDispatcher = (): void => {
@@ -592,8 +638,20 @@ export function installNetGuard(hooks: NetGuardHooks = {}): NetGuard | null {
   }
 
   return {
-    mode,
+    get mode() {
+      return state.mode;
+    },
     allow,
+    escalate(reason: string): boolean {
+      const isWarn = state.mode === 'warn';
+      if (!isWarn) return false;
+      state.mode = 'block';
+      write(
+        `${LOG_PREFIX} escalated to block: ${reason}. Egress from this process to live ` +
+          `Google/Firebase endpoints now fails with ${GUARD_BLOCKED_CODE}; PYRIC_GUARD_ALLOW still permits its hosts.\n`,
+      );
+      return true;
+    },
     permit(hostOrUrl: string): void {
       for (const host of parseAllowHosts(hostOrUrl)) {
         if (!allow.includes(host)) allow.push(host);
@@ -607,29 +665,81 @@ export function installNetGuard(hooks: NetGuardHooks = {}): NetGuard | null {
 }
 
 /**
- * Extract the destination host from `net.connect` / `tls.connect` /
- * `Socket.prototype.connect` arguments, across all of their overloads:
+ * Check the destination a request to a proxy names before its request line is
+ * written. A refusal goes to `onSocket` as its error argument, which is how
+ * Node fails a request whose socket could not be used: the request emits
+ * `error` with the guard's error and the proxy receives nothing. Throwing here
+ * instead would surface as an uncaught exception from the Agent's callback.
+ */
+function guardProxiedRequest(prototype: RequestPrototype, reporter: Reporter): void {
+  const original = prototype.onSocket;
+  if (typeof original !== 'function') return;
+  prototype.onSocket = function (this: RequestLike, socket: unknown, error?: unknown): unknown {
+    const target = proxiedTarget(this);
+    if (target === undefined || error !== undefined) return original.call(this, socket, error);
+    try {
+      reporter.check(target, 'socket');
+    } catch (refusal) {
+      return original.call(this, socket, refusal);
+    }
+    return original.call(this, socket, error);
+  };
+}
+
+/**
+ * Every host a `net.connect` / `tls.connect` / `Socket.prototype.connect` /
+ * `Agent.prototype.createConnection` call names, across their overloads:
  * `(options[, cb])`, `(port[, host][, cb])`, `(path[, cb])`, and the
  * `[options, cb]` array `net.connect` hands the socket once it has normalized
- * its own arguments. An IPC path or a portless local socket has no host, which
- * is exactly the "nothing to say" answer.
+ * its own arguments. An IPC path or a portless local socket names no host,
+ * which is exactly the "nothing to say" answer.
+ *
+ * The TCP peer is not the only host. A connection tunnelled through a proxy
+ * names its real destination elsewhere, and each of those is checked too.
  */
-function connectHost(args: readonly unknown[]): string | undefined {
+function connectHosts(args: readonly unknown[]): string[] {
   const first = args[0];
-  if (Array.isArray(first)) return connectHost(first);
-  if (typeof first === 'object' && first !== null) {
-    const host = (first as { host?: unknown; hostname?: unknown }).host ??
-      (first as { hostname?: unknown }).hostname;
-    return typeof host === 'string' ? host : undefined;
-  }
-  if (typeof first === 'number' || (typeof first === 'string' && /^\d+$/.test(first))) {
-    // (port, host?, ...): the host, when given, is the next string argument.
-    const second = args[1];
-    if (typeof second === 'string') return second;
-    if (typeof second === 'object' && second !== null) {
-      const host = (second as { host?: unknown }).host;
-      return typeof host === 'string' ? host : undefined;
-    }
-  }
+  if (Array.isArray(first)) return connectHosts(first);
+  if (typeof first === 'object' && first !== null) return optionHosts(first as ConnectOptions);
+  const isPort = typeof first === 'number' || (typeof first === 'string' && /^\d+$/.test(first));
+  if (!isPort) return [];
+  // (port, host?, ...): the host, when given, is the next string argument.
+  const second = args[1];
+  if (typeof second === 'string') return [second];
+  if (typeof second === 'object' && second !== null) return optionHosts(second as ConnectOptions);
+  return [];
+}
+
+/** The connect options the guard reads. */
+interface ConnectOptions {
+  host?: unknown;
+  hostname?: unknown;
+  /** The TLS SNI name: the real destination of a TLS session over a tunnel. */
+  servername?: unknown;
+}
+
+function optionHosts(options: ConnectOptions): string[] {
+  const named = [options.host ?? options.hostname, options.servername];
+  return named.filter((host): host is string => typeof host === 'string' && host.length > 0);
+}
+
+/** The parts of an `http.ClientRequest` the guard reads. */
+interface RequestLike {
+  method?: unknown;
+  path?: unknown;
+}
+
+/** Matches an absolute-form request target, `http://host/...`. */
+const ABSOLUTE_FORM = /^[a-z][a-z0-9+.-]*:\/\//i;
+
+/**
+ * The destination a request to a proxy names in its path: the `host:port`
+ * target of a `CONNECT`, or the URL of a forward-proxy request
+ * (`GET http://host/...`). An ordinary request path names none.
+ */
+function proxiedTarget(request: RequestLike): string | undefined {
+  if (typeof request.path !== 'string') return undefined;
+  const isConnect = typeof request.method === 'string' && request.method.toUpperCase() === 'CONNECT';
+  if (isConnect || ABSOLUTE_FORM.test(request.path)) return request.path;
   return undefined;
 }

package/src/register/package-identity.ts

@@ -0,0 +1,98 @@
+/**
+ * Which installed package a resolved module file belongs to (#1443).
+ *
+ * Turbopack links `.next/node_modules/firebase-admin-<16 hex>` to the
+ * installed `firebase-admin`, so a renamed import's name says what it probably
+ * is. The register maps it only once the resolved file proves it: the nearest
+ * `package.json` with a `name`, read from disk. Reading the file rather than
+ * resolving `<pkg>/package.json` works for packages whose `exports` hide it,
+ * and under store layouts (bun, pnpm) where the link points into `.bun/` or
+ * `.pnpm/`.
+ *
+ * Nameless `package.json` files are skipped: `firebase-admin/lib/esm` has one
+ * that only sets `"type": "module"`. A subpath manifest such as
+ * `firebase/firestore/package.json` (`"name": "firebase/firestore"`) names its
+ * package root, `firebase`.
+ *
+ * Loaded by both resolve hooks, including the loader-thread one, so it imports
+ * node built-ins only and has no side effects.
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join, relative, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/** Package name per directory, `null` for a directory with no named manifest. */
+const namesByDirectory = new Map<string, string | null>();
+
+/** `firebase/firestore` → `firebase`; `@scope/pkg/sub` → `@scope/pkg`. */
+function packageRoot(name: string): string {
+  const parts = name.split('/');
+  const isScoped = name.startsWith('@');
+  const rootLength = isScoped ? 2 : 1;
+  return parts.slice(0, rootLength).join('/');
+}
+
+/** The `name` of `<directory>/package.json` as written, or `null` when there is none. */
+function writtenManifestName(directory: string): string | null {
+  try {
+    const manifest = JSON.parse(readFileSync(join(directory, 'package.json'), 'utf8')) as { name?: unknown };
+    const hasName = typeof manifest.name === 'string' && manifest.name !== '';
+    return hasName ? (manifest.name as string) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The package `<directory>/package.json` names, or `null` when it names none. */
+function manifestName(directory: string): string | null {
+  const written = writtenManifestName(directory);
+  return written === null ? null : packageRoot(written);
+}
+
+function nameFromDirectory(directory: string): string | null {
+  const cached = namesByDirectory.get(directory);
+  if (cached !== undefined) return cached;
+  const parent = dirname(directory);
+  const isFilesystemRoot = parent === directory;
+  let name = manifestName(directory);
+  const looksFurtherUp = name === null && !isFilesystemRoot;
+  if (looksFurtherUp) name = nameFromDirectory(parent);
+  namesByDirectory.set(directory, name);
+  return name;
+}
+
+/** The package a resolved module URL belongs to, or `null` for a URL outside any named package. */
+export function packageNameOf(url: string): string | null {
+  const isFileUrl = url.startsWith('file:');
+  if (!isFileUrl) return null;
+  return nameFromDirectory(dirname(fileURLToPath(url)));
+}
+
+/**
+ * A resolved module file's path inside the package `name`, with `/`
+ * separators (`ai/dist/index.mjs` for a `firebase/ai` file), or `null` when no
+ * directory above it has a manifest named exactly `name`. Subpath manifests
+ * (`"name": "firebase/ai"`) are passed over, so the path starts at the root.
+ */
+export function pathInPackageOf(url: string, name: string): string | null {
+  const isFileUrl = url.startsWith('file:');
+  if (!isFileUrl) return null;
+  const file = fileURLToPath(url);
+  let directory = dirname(file);
+  while (writtenManifestName(directory) !== name) {
+    const parent = dirname(directory);
+    const isFilesystemRoot = parent === directory;
+    if (isFilesystemRoot) return null;
+    directory = parent;
+  }
+  return relative(directory, file).split(sep).join('/');
+}
+
+/**
+ * Whether a resolved module URL lies inside the package a specifier names:
+ * `firebase-admin/app` names `firebase-admin`, `firebase/firestore` names
+ * `firebase`.
+ */
+export function resolvesIntoPackage(url: string, specifier: string): boolean {
+  return packageNameOf(url) === packageRoot(specifier);
+}