@dereekb/dbx-cli 13.37.0 → 13.38.0

package/firestore-query-manifest/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@dereekb/dbx-cli-firestore-query-manifest",
+  "version": "13.38.0",
+  "private": true,
+  "type": "module",
+  "devDependencies": {
+    "eslint": "10.4.0"
+  },
+  "peerDependencies": {
+    "@dereekb/dbx-cli": "13.38.0",
+    "@dereekb/util": "13.38.0"
+  }
+}

package/firestore-rules/src/firestore-rules-scan.d.ts

@@ -0,0 +1,89 @@
+/**
+ * A deliberately small `firestore.rules` reader.
+ *
+ * This is NOT a CEL implementation and must not become one. It answers exactly one question per
+ * collection — "could a client read this at all?" — which needs only three things from the grammar:
+ *
+ *   - `match /<segments> { … }` with brace nesting, `{var}` and `{path=**}` wildcards
+ *   - `allow <ops>: if <expr>;`, where the only thing that matters about `<expr>` is whether it is
+ *     literally `false`
+ *   - everything else (functions, `let`, real conditions) ignored
+ *
+ * Keeping it to match-nesting plus constant-`false` detection is what makes it tractable and keeps
+ * it from rotting. `apps/demo-api/src/test/tests/firestore.rules.spec.ts` remains the DYNAMIC oracle
+ * (it drives the real rules engine via `@firebase/rules-unit-testing`); this scanner is the static
+ * routing source, cross-checked against it.
+ */
+/**
+ * How a client read of one operation on one collection resolves under the rules.
+ *
+ * - `allowed` — some `allow` covering the op has a condition that is not constant-`false`.
+ * - `denied` — the op is covered only by `allow`s whose condition is literally `false`.
+ * - `unmatched` — no `allow` covers the op at all, so Firestore's implicit default-deny applies.
+ *
+ * `denied` and `unmatched` are both refusals; they are kept distinct because they mean different
+ * things to a reviewer — `denied` is a deliberate written-down "no", `unmatched` is an absence.
+ */
+export type FirestoreRulesAccess = 'allowed' | 'denied' | 'unmatched';
+/**
+ * The read posture of one collection, as written in the rules file.
+ */
+export interface FirestoreRulesCollectionEntry {
+    /**
+     * Short collection name — the same token `firestoreModelIdentity('guestbook', 'gb')` produces,
+     * which the CLI model manifest already carries as `collectionPrefix`.
+     */
+    readonly collection: string;
+    /**
+     * Every fully-qualified match path that reached this collection.
+     */
+    readonly paths: readonly string[];
+    readonly get: FirestoreRulesAccess;
+    readonly list: FirestoreRulesAccess;
+    /**
+     * True when a `/{path=**}/<collection>/{id}` block exists — the collection is reachable as a
+     * collection group, not only under its parent.
+     */
+    readonly collectionGroup: boolean;
+    /**
+     * True when neither {@link get} nor {@link list} is `allowed` — no client can read this model, so
+     * it is server-only.
+     */
+    readonly serverOnly: boolean;
+}
+/**
+ * The result of scanning one rules file.
+ */
+export interface FirestoreRulesScan {
+    readonly collections: readonly FirestoreRulesCollectionEntry[];
+}
+/**
+ * Scans `firestore.rules` source and reports the read posture of every collection it names.
+ *
+ * A collection with no match block does not appear in the result at all — absence IS the answer,
+ * and {@link firestoreRulesAccessForCollection} synthesizes the `unmatched` entry for it.
+ *
+ * @param source - The full text of a `firestore.rules` file.
+ * @returns The per-collection read posture, in collection-name order.
+ */
+export declare function scanFirestoreRules(source: string): FirestoreRulesScan;
+/**
+ * Looks a collection up in a scan, synthesizing the `unmatched` (and therefore server-only) entry
+ * for a collection the rules file never names.
+ *
+ * @param scan - The scan result.
+ * @param collection - The short collection name to look up.
+ * @returns The collection's read posture, never `undefined`.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function firestoreRulesAccessForCollection(scan: FirestoreRulesScan, collection: string): FirestoreRulesCollectionEntry;
+/**
+ * The collections a scan reports as server-only — no client read grant of any kind.
+ *
+ * @param scan - The scan result.
+ * @returns The server-only collection names, in scan order.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function serverOnlyCollections(scan: FirestoreRulesScan): readonly string[];

package/firestore-rules/src/index.d.ts

@@ -0,0 +1 @@
+export * from './firestore-rules-scan.js';

package/generate-firestore-indexes/main.js

@@ -5,14 +5,14 @@ const require = __createRequire(import.meta.url);
 // packages/dbx-cli/generate-firestore-indexes/package.json
 var package_default = {
   name: "@dereekb/dbx-cli-generate-firestore-indexes",
-  version: "13.37.0",
+  version: "13.38.0",
   private: true,
   type: "module",
   devDependencies: {
     eslint: "10.4.0"
   },
   peerDependencies: {
-    "@dereekb/dbx-cli": "13.37.0"
+    "@dereekb/dbx-cli": "13.38.0"
   }
 };
 

package/generate-firestore-indexes/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@dereekb/dbx-cli-generate-firestore-indexes",
-  "version": "13.37.0",
+  "version": "13.38.0",
   "private": true,
   "type": "module",
   "devDependencies": {
     "eslint": "10.4.0"
   },
   "peerDependencies": {
-    "@dereekb/dbx-cli": "13.37.0"
+    "@dereekb/dbx-cli": "13.38.0"
   }
 }

package/generate-mcp-manifest/main.js

@@ -1134,6 +1134,7 @@ function projectModelEntry(entry) {
     ...entry.description == null ? {} : { description: entry.description },
     ...entry.mcpToolNameSegment == null ? {} : { mcpToolNameSegment: entry.mcpToolNameSegment },
     ...entry.read == null ? {} : { read: entry.read },
+    ...entry.serverOnly == null ? {} : { serverOnly: entry.serverOnly },
     ...entry.serviceFactory == null ? {} : { serviceFactory: entry.serviceFactory }
   };
   return projected;

package/generate-mcp-manifest/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@dereekb/dbx-cli-generate-mcp-manifest",
-  "version": "13.37.0",
+  "version": "13.38.0",
   "private": true,
   "type": "module",
   "peerDependencies": {
-    "@dereekb/dbx-cli": "13.37.0",
-    "@dereekb/model": "13.37.0",
+    "@dereekb/dbx-cli": "13.38.0",
+    "@dereekb/model": "13.38.0",
     "arktype": "^2.2.0",
     "jiti": "2.6.1"
   }

package/generate-route-manifest/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dereekb/dbx-cli-generate-route-manifest",
-  "version": "13.37.0",
+  "version": "13.38.0",
   "private": true,
   "type": "module",
   "peerDependencies": {
-    "@dereekb/dbx-cli": "13.37.0",
+    "@dereekb/dbx-cli": "13.38.0",
     "ts-morph": "^21.0.0"
   }
 }