@pyric/cli 0.1.0-alpha.16 → 0.1.0-alpha.18

package/src/assurance/.generated/conformance-verdicts.ts

@@ -289,7 +289,13 @@ export const CONFORMANCE_VERDICTS = {
   "firestore#149": "qualified",
   "firestore#15": "supported",
   "firestore#150": "supported",
+  "firestore#151": "supported",
   "firestore#152": "supported",
+  "firestore#153": "supported",
+  "firestore#154": "supported",
+  "firestore#155": "supported",
+  "firestore#156": "supported",
+  "firestore#157": "supported",
   "firestore#16": "supported",
   "firestore#17": "supported",
   "firestore#18": "supported",
@@ -421,6 +427,8 @@ export const CONFORMANCE_VERDICTS = {
   "firestore-rules#187": "supported",
   "firestore-rules#188": "supported",
   "firestore-rules#189": "supported",
+  "firestore-rules#190": "supported",
+  "firestore-rules#191": "supported",
   "firestore.binding.path-variable": "supported",
   "firestore.binding.request": "supported",
   "firestore.binding.request.auth": "supported",
@@ -437,7 +445,7 @@ export const CONFORMANCE_VERDICTS = {
   "firestore.binding.resource.__name__": "supported",
   "firestore.binding.resource.data": "supported",
   "firestore.binding.resource.id": "supported",
-  "firestore.function.cast.bool": "unsupported",
+  "firestore.function.cast.bool": "supported",
   "firestore.function.cast.float": "supported",
   "firestore.function.cast.int": "supported",
   "firestore.function.cast.path": "supported",
@@ -458,7 +466,7 @@ export const CONFORMANCE_VERDICTS = {
   "firestore.function.math.abs": "supported",
   "firestore.function.math.ceil": "supported",
   "firestore.function.math.floor": "supported",
-  "firestore.function.math.isInfinite": "unsupported",
+  "firestore.function.math.isInfinite": "supported",
   "firestore.function.math.isNaN": "supported",
   "firestore.function.math.pow": "supported",
   "firestore.function.math.round": "supported",
@@ -483,9 +491,9 @@ export const CONFORMANCE_VERDICTS = {
   "firestore.method.list.toSet": "supported",
   "firestore.method.map.diff": "supported",
   "firestore.method.map.get": "supported",
-  "firestore.method.map.hasAll": "unsupported",
-  "firestore.method.map.hasAny": "unsupported",
-  "firestore.method.map.hasOnly": "unsupported",
+  "firestore.method.map.hasAll": "supported",
+  "firestore.method.map.hasAny": "supported",
+  "firestore.method.map.hasOnly": "supported",
   "firestore.method.map.keys": "supported",
   "firestore.method.map.size": "supported",
   "firestore.method.map.values": "supported",
@@ -875,62 +883,62 @@ export const CONFORMANCE_VERDICTS = {
   "rtdb-rules#7": "supported",
   "rtdb-rules#8": "supported",
   "rtdb-rules#9": "supported",
-  "rtdb.binding.auth": "qualified",
-  "rtdb.binding.auth.token": "qualified",
-  "rtdb.binding.auth.uid": "qualified",
-  "rtdb.binding.data": "qualified",
-  "rtdb.binding.newData": "qualified",
-  "rtdb.binding.now": "qualified",
-  "rtdb.binding.path-variable": "qualified",
-  "rtdb.binding.root": "qualified",
-  "rtdb.method.snapshot.child": "qualified",
-  "rtdb.method.snapshot.exists": "qualified",
-  "rtdb.method.snapshot.getPriority": "qualified",
-  "rtdb.method.snapshot.hasChild": "qualified",
-  "rtdb.method.snapshot.hasChildren": "qualified",
-  "rtdb.method.snapshot.isBoolean": "qualified",
-  "rtdb.method.snapshot.isNumber": "qualified",
-  "rtdb.method.snapshot.isString": "qualified",
-  "rtdb.method.snapshot.parent": "qualified",
-  "rtdb.method.snapshot.val": "qualified",
-  "rtdb.method.string.beginsWith": "qualified",
-  "rtdb.method.string.contains": "qualified",
-  "rtdb.method.string.endsWith": "qualified",
-  "rtdb.method.string.length": "qualified",
-  "rtdb.method.string.matches": "qualified",
-  "rtdb.method.string.replace": "qualified",
-  "rtdb.method.string.toLowerCase": "qualified",
-  "rtdb.method.string.toUpperCase": "qualified",
-  "rtdb.operator.add": "qualified",
-  "rtdb.operator.and": "qualified",
-  "rtdb.operator.div": "qualified",
-  "rtdb.operator.gt": "qualified",
-  "rtdb.operator.gte": "qualified",
-  "rtdb.operator.index": "qualified",
-  "rtdb.operator.looseEq": "qualified",
-  "rtdb.operator.looseNeq": "qualified",
-  "rtdb.operator.lt": "qualified",
-  "rtdb.operator.lte": "qualified",
-  "rtdb.operator.member": "qualified",
-  "rtdb.operator.mod": "qualified",
-  "rtdb.operator.mul": "qualified",
-  "rtdb.operator.neg": "qualified",
-  "rtdb.operator.not": "qualified",
-  "rtdb.operator.or": "qualified",
-  "rtdb.operator.strictEq": "qualified",
-  "rtdb.operator.strictNeq": "qualified",
-  "rtdb.operator.sub": "qualified",
-  "rtdb.operator.ternary": "qualified",
-  "rtdb.rule-kind.indexOn": "qualified",
-  "rtdb.rule-kind.location-wildcard": "qualified",
-  "rtdb.rule-kind.read": "qualified",
-  "rtdb.rule-kind.validate": "qualified",
-  "rtdb.rule-kind.write": "qualified",
+  "rtdb.binding.auth": "supported",
+  "rtdb.binding.auth.token": "supported",
+  "rtdb.binding.auth.uid": "supported",
+  "rtdb.binding.data": "supported",
+  "rtdb.binding.newData": "supported",
+  "rtdb.binding.now": "supported",
+  "rtdb.binding.path-variable": "supported",
+  "rtdb.binding.root": "supported",
+  "rtdb.method.snapshot.child": "supported",
+  "rtdb.method.snapshot.exists": "supported",
+  "rtdb.method.snapshot.getPriority": "supported",
+  "rtdb.method.snapshot.hasChild": "supported",
+  "rtdb.method.snapshot.hasChildren": "supported",
+  "rtdb.method.snapshot.isBoolean": "supported",
+  "rtdb.method.snapshot.isNumber": "supported",
+  "rtdb.method.snapshot.isString": "supported",
+  "rtdb.method.snapshot.parent": "supported",
+  "rtdb.method.snapshot.val": "supported",
+  "rtdb.method.string.beginsWith": "supported",
+  "rtdb.method.string.contains": "supported",
+  "rtdb.method.string.endsWith": "supported",
+  "rtdb.method.string.length": "supported",
+  "rtdb.method.string.matches": "supported",
+  "rtdb.method.string.replace": "supported",
+  "rtdb.method.string.toLowerCase": "supported",
+  "rtdb.method.string.toUpperCase": "supported",
+  "rtdb.operator.add": "supported",
+  "rtdb.operator.and": "supported",
+  "rtdb.operator.div": "supported",
+  "rtdb.operator.gt": "supported",
+  "rtdb.operator.gte": "supported",
+  "rtdb.operator.index": "supported",
+  "rtdb.operator.looseEq": "supported",
+  "rtdb.operator.looseNeq": "supported",
+  "rtdb.operator.lt": "supported",
+  "rtdb.operator.lte": "supported",
+  "rtdb.operator.member": "supported",
+  "rtdb.operator.mod": "supported",
+  "rtdb.operator.mul": "supported",
+  "rtdb.operator.neg": "supported",
+  "rtdb.operator.not": "supported",
+  "rtdb.operator.or": "supported",
+  "rtdb.operator.strictEq": "supported",
+  "rtdb.operator.strictNeq": "supported",
+  "rtdb.operator.sub": "supported",
+  "rtdb.operator.ternary": "supported",
+  "rtdb.rule-kind.indexOn": "supported",
+  "rtdb.rule-kind.location-wildcard": "supported",
+  "rtdb.rule-kind.read": "supported",
+  "rtdb.rule-kind.validate": "supported",
+  "rtdb.rule-kind.write": "supported",
   "rtdb.semantic.deny-by-default": "qualified",
-  "rtdb.semantic.read-cascade": "qualified",
-  "rtdb.semantic.regex-literal": "qualified",
-  "rtdb.semantic.validate-non-cascade": "qualified",
-  "rtdb.semantic.write-cascade": "qualified",
+  "rtdb.semantic.read-cascade": "supported",
+  "rtdb.semantic.regex-literal": "supported",
+  "rtdb.semantic.validate-non-cascade": "supported",
+  "rtdb.semantic.write-cascade": "supported",
   "storage#1": "supported",
   "storage#10": "supported",
   "storage#105": "supported",
@@ -977,12 +985,12 @@ export const CONFORMANCE_VERDICTS = {
   "storage#44": "supported",
   "storage#45": "supported",
   "storage#46": "supported",
-  "storage#47": "unsupported",
-  "storage#48": "unsupported",
-  "storage#49": "unsupported",
+  "storage#47": "qualified",
+  "storage#48": "qualified",
+  "storage#49": "qualified",
   "storage#4a": "supported",
   "storage#5": "supported",
-  "storage#50": "unsupported",
+  "storage#50": "qualified",
   "storage#51": "qualified",
   "storage#52": "supported",
   "storage#53": "supported",
@@ -1093,30 +1101,30 @@ export const CONFORMANCE_VERDICTS = {
   "storage.method.map.get": "supported",
   "storage.method.map.keys": "supported",
   "storage.method.set.hasAll": "supported",
-  "storage.method.size": "qualified",
+  "storage.method.size": "supported",
   "storage.method.string.matches": "supported",
-  "storage.method.string.split": "qualified",
+  "storage.method.string.split": "supported",
   "storage.operator.add": "supported",
   "storage.operator.and": "supported",
   "storage.operator.div": "supported",
   "storage.operator.eq": "supported",
   "storage.operator.gt": "supported",
   "storage.operator.gte": "supported",
-  "storage.operator.in": "qualified",
+  "storage.operator.in": "supported",
   "storage.operator.index": "supported",
-  "storage.operator.is": "qualified",
+  "storage.operator.is": "supported",
   "storage.operator.lt": "supported",
   "storage.operator.lte": "supported",
   "storage.operator.member": "supported",
-  "storage.operator.mod": "qualified",
+  "storage.operator.mod": "supported",
   "storage.operator.mul": "supported",
   "storage.operator.neq": "supported",
   "storage.operator.not": "supported",
   "storage.operator.or": "supported",
-  "storage.operator.slice": "qualified",
+  "storage.operator.slice": "supported",
   "storage.operator.sub": "supported",
-  "storage.operator.ternary": "qualified",
-  "storage.operator.unary-minus": "qualified",
+  "storage.operator.ternary": "supported",
+  "storage.operator.unary-minus": "supported",
   "storage.rule-kind.allow-create": "supported",
   "storage.rule-kind.allow-delete": "supported",
   "storage.rule-kind.allow-get": "supported",

package/src/bridge/server/bridge.ts

@@ -206,10 +206,12 @@ function workerOpError(
   code: string,
   message: string,
   denialContext?: unknown,
-): Error & { code: string; denialContext?: unknown } {
-  const err = new Error(message) as Error & { code: string; denialContext?: unknown };
+  envelope?: unknown,
+): Error & { code: string; denialContext?: unknown; envelope?: unknown } {
+  const err = new Error(message) as Error & { code: string; denialContext?: unknown; envelope?: unknown };
   err.code = code;
   if (denialContext !== undefined) err.denialContext = denialContext;
+  if (envelope !== undefined) err.envelope = envelope;
   return err;
 }
 
@@ -481,6 +483,7 @@ export function createBridge(opts: BridgeOptions): Bridge {
               res.error?.code ?? 'unknown',
               res.error?.message ?? 'unknown sandbox error',
               res.error?.denialContext,
+              (res.error as any)?.envelope,
             ),
           );
         }

package/src/bridge/server/peer.ts

@@ -162,7 +162,7 @@ export function createConsumerSession(
         case 'worker-op': {
           bridge.dispatchWorkerOp(msg.op).then(
             (value) => send({ type: 'worker-res', id: msg.id, ok: true, value }),
-            (err: Error & { code?: string; denialContext?: unknown }) =>
+            (err: Error & { code?: string; denialContext?: unknown; envelope?: unknown }) =>
               send({
                 type: 'worker-res',
                 id: msg.id,
@@ -173,6 +173,7 @@ export function createConsumerSession(
                   // Structured denial context (spike gap 6) — plain JSON,
                   // relayed verbatim so the Node side re-attaches it.
                   ...(err.denialContext !== undefined ? { denialContext: err.denialContext } : {}),
+                  ...(err.envelope !== undefined ? { envelope: err.envelope } : {}),
                 },
               }),
           );

package/src/cli/cli.test.ts

@@ -490,4 +490,18 @@ describe('scanForInlinedFirebase', () => {
     );
     expect(scanForInlinedFirebase(dir)).toEqual([]);
   });
+
+  it('ignores hidden frameworks and build cache directories like .next and .git', async () => {
+    const { scanForInlinedFirebase } = await import('./serve.js');
+    const { mkdtempSync, mkdirSync, writeFileSync } = await import('node:fs');
+    const { tmpdir } = await import('node:os');
+    const { join } = await import('node:path');
+    const dir = mkdtempSync(join(tmpdir(), 'pyric-inline-ignore-'));
+    mkdirSync(join(dir, '.next'));
+    writeFileSync(
+      join(dir, '.next', 'bundle.js'),
+      'fetch("https://identitytoolkit.googleapis.com/v1/projects?key="+k)',
+    );
+    expect(scanForInlinedFirebase(dir)).toEqual([]);
+  });
 });

package/src/cli/database-rules.ts

@@ -19,6 +19,7 @@ import {
   loadRtdbRulesDocument,
   type LoadRtdbRulesDocumentResult,
 } from '../rtdb/load-rules-document.js';
+import { stripJsonComments } from '../rtdb/rules-json.js';
 
 export interface DatabaseRulesDeps {
   readFile?: typeof readFile;
@@ -53,7 +54,7 @@ function defaultReadStdin(): Promise<string> {
 }
 
 function parseRulesJson(raw: string): CompiledRtdbRules {
-  return compileRtdbRules(JSON.parse(raw));
+  return compileRtdbRules(JSON.parse(stripJsonComments(raw)));
 }
 
 function collectFindings(node: RtdbNode, kind: 'errors' | 'warnings'): RuleFinding[] {
@@ -215,7 +216,8 @@ export async function runDatabaseRulesSimulate(
       rulesJson = payload.rulesJson ?? payload.rules;
     } else if (payload.rulesPath) {
       try {
-        rulesJson = JSON.parse(await readFileFn(resolvePath(deps.cwd ?? process.cwd(), payload.rulesPath), 'utf-8'));
+        const rawContent = await readFileFn(resolvePath(deps.cwd ?? process.cwd(), payload.rulesPath), 'utf-8');
+        rulesJson = JSON.parse(stripJsonComments(rawContent));
       } catch (e) {
         err.write(`pyric database rules simulate: ${e instanceof Error ? e.message : String(e)}\n`);
         return 1;
@@ -227,7 +229,7 @@ export async function runDatabaseRulesSimulate(
         return 1;
       }
       try {
-        rulesJson = JSON.parse(file.raw);
+        rulesJson = JSON.parse(stripJsonComments(file.raw));
       } catch (e) {
         err.write(`pyric database rules simulate: ${e instanceof Error ? e.message : String(e)}\n`);
         return 2;
@@ -247,7 +249,7 @@ export async function runDatabaseRulesSimulate(
       return 1;
     }
     try {
-      rulesJson = JSON.parse(file.raw);
+      rulesJson = JSON.parse(stripJsonComments(file.raw));
     } catch (e) {
       err.write(`pyric database rules simulate: ${e instanceof Error ? e.message : String(e)}\n`);
       return 2;

package/src/cli/dev-runner.ts

@@ -163,6 +163,27 @@ export function buildChildEnv(
   };
 }
 
+/**
+ * Format copy-pasteable POSIX export statements for host-only startup.
+ * Grouped in a cleanly formatted console block for easy selection and copying
+ * into a separate terminal (for example, when running Next.js independently).
+ */
+export function formatStartupEnvExport(opts: { serveUrl: string; registerUrl: string }): string {
+  const pyricSandbox = `remote:${opts.serveUrl}`;
+  const nodeOptions = `--import ${opts.registerUrl}`;
+  const line1 = `export PYRIC_SANDBOX="${pyricSandbox}"`;
+  const line2 = `export NODE_OPTIONS="${nodeOptions}"`;
+  const divider = '─'.repeat(Math.max(line1.length, line2.length) + 4);
+  return (
+    '\n' +
+    '  To run external commands against this sandbox, paste in another terminal:\n' +
+    `  ${divider}\n` +
+    `  ${line1}\n` +
+    `  ${line2}\n` +
+    `  ${divider}\n`
+  );
+}
+
 // ─── Line prefixing (pure core) ────────────────────────────────────────────
 
 /**

package/src/cli/serve.ts

@@ -31,6 +31,7 @@ import { openBrowser, shouldAutoOpen } from '../serve/open-browser.js';
 import {
   buildChildEnv,
   detectPackageManager,
+  formatStartupEnvExport,
   readDevScript,
   registerModuleUrl,
   resolveDevChild,
@@ -404,6 +405,47 @@ export async function startServe(opts: {
       watcher.close();
     });
   }
+  const dbRulesSourcePath = session.summary.rules.database.sourcePath;
+  const isWatchEnabled = opts.watch !== false;
+  const hasDbRulesPath = dbRulesSourcePath !== null;
+  const watchingDb = isWatchEnabled && hasDbRulesPath;
+  if (watchingDb) {
+    let debounceDb: ReturnType<typeof setTimeout> | null = null;
+    const dbWatcher = watchFile(dbRulesSourcePath as string, () => {
+      const hasDebounceDb = debounceDb !== null;
+      if (hasDebounceDb) {
+        clearTimeout(debounceDb as ReturnType<typeof setTimeout>);
+      }
+      debounceDb = setTimeout(() => {
+        void session.reloadDatabaseRules().then((result) => {
+          const isReloaded = result.kind === 'reloaded';
+          if (isReloaded) {
+            logger.note(`  ↻ rtdb rules reloaded (hash ${result.rulesHash}) → ${result.clients} page(s)`);
+          } else {
+            const isRejected = result.kind === 'rejected';
+            if (isRejected) {
+              logger.note(`  ⚠ rtdb rules NOT reloaded (last-good stays live): ${result.error.message}`);
+            }
+          }
+        });
+      }, 150);
+    });
+    dbWatcher.on('error', (error) => {
+      const isErrorInstance = error instanceof Error;
+      let errorMsg = String(error);
+      if (isErrorInstance) {
+        errorMsg = (error as Error).message;
+      }
+      logger.note(`  ⚠ rtdb rules watcher failed (hot reload off): ${errorMsg}`);
+    });
+    handle.server.once('close', () => {
+      const hasDebounceDb = debounceDb !== null;
+      if (hasDebounceDb) {
+        clearTimeout(debounceDb as ReturnType<typeof setTimeout>);
+      }
+      dbWatcher.close();
+    });
+  }
 
   logger.info(`=== Serving from '${opts.cwd}'...`);
   logger.info('');
@@ -476,7 +518,12 @@ export async function startServe(opts: {
   if (session.summary.capturePath) {
     logger.info(`✔ capture  session → ${session.summary.capturePath} (run \`pyric verify\` to replay it)`);
   }
-  if (watching) logger.info(`✔ watch    hot-reloading ${rulesSourcePath} over /__pyric/events`);
+  if (watching) {
+    logger.info(`✔ watch    hot-reloading ${rulesSourcePath} over /__pyric/events`);
+  }
+  if (watchingDb) {
+    logger.info(`✔ watch    hot-reloading ${dbRulesSourcePath} over /__pyric/events`);
+  }
   // Browser-honesty: the sandbox is browser-resident — firestore/auth and
   // persistence run IN the served page. With no page open, data ops silently
   // no-op. This warning (paired with auto-open in runServe) is the fix for the
@@ -570,7 +617,8 @@ export async function runServe(parsed: ParsedArgs): Promise<number> {
 
   const json = Boolean(parsed.flags.get('json'));
 
-  const uiOn = Boolean(parsed.flags.get('ui'));
+  const explicitUi = Boolean(parsed.flags.get('ui'));
+  const uiOn = !parsed.flags.get('no-ui');
 
   // Resolve the child plan BEFORE the server starts: a planned child implies
   // the bridge (see bridgeEnabledFor) — the child's injected PYRIC_SANDBOX
@@ -661,8 +709,9 @@ export async function runServe(parsed: ParsedArgs): Promise<number> {
     env: process.env,
   });
   if (opened) {
-    // With --ui, open Studio directly; the served page is still available.
-    void openBrowser(runtime.uiUrl ?? runtime.handle.url);
+    // When explicit --ui is passed, open Studio directly; otherwise open the served page.
+    const targetUrl = explicitUi && runtime.uiUrl !== null ? runtime.uiUrl : runtime.handle.url;
+    void openBrowser(targetUrl);
   }
 
   let devChild: DevChildHandle | null = null;
@@ -734,6 +783,7 @@ export async function runServe(parsed: ParsedArgs): Promise<number> {
       registerUrl: registerModuleUrl(),
       instance: `${functionsProjectId}-default-rtdb`,
       location: process.env.PYRIC_FUNCTIONS_RTDB_REGION ?? 'us-central1',
+      projectId: functionsProjectId ?? 'demo-project',
       readiness: createHttpFunctionsPeerReadiness(runtime.handle.url),
       onEvent: reportFunctionsEvent,
     });
@@ -800,6 +850,13 @@ export async function runServe(parsed: ParsedArgs): Promise<number> {
         registerUrl: registerModuleUrl(),
       }),
     });
+  } else if (!json) {
+    process.stdout.write(
+      formatStartupEnvExport({
+        serveUrl: runtime.handle.url,
+        registerUrl: registerModuleUrl(),
+      }),
+    );
   }
 
   return await new Promise<number>((resolveExit) => {
@@ -886,7 +943,8 @@ export function scanForInlinedFirebase(dir: string): string[] {
       if (st.isDirectory()) {
         // The pyric namespace itself never lands in hosting.public, but a
         // node_modules inside a served dir would be a scan-cost trap.
-        if (name === 'node_modules') continue;
+        // Dot-directories (.next, .git, .pyric) are internal caches and must be ignored.
+        if (name === 'node_modules' || name.startsWith('.')) continue;
         walk(p, r, depth + 1);
       } else if (/\.(js|mjs)$/.test(name)) {
         scanned++;

package/src/cli/verify.ts

@@ -18,7 +18,7 @@ import {
 import { readFirebaseJson, type FirebaseJson } from './firebase-json.js';
 import type { FlagValue, ParsedArgs } from './parse-args.js';
 import { resolveScope } from './scope.js';
-import { parseRtdbRulesJson } from '../rtdb/rules-json.js';
+import { parseRtdbRulesJson, stripJsonComments } from '../rtdb/rules-json.js';
 
 export type Fixture = PyricVerifyFixture;
 
@@ -358,7 +358,7 @@ async function readFirebaseJsonOrNull(cwd: string): Promise<FirebaseJson | null>
 function parseRtdbRulesFile(path: string): { rules: Record<string, unknown> } {
   let parsed: unknown;
   try {
-    parsed = JSON.parse(readFileSync(path, 'utf8'));
+    parsed = JSON.parse(stripJsonComments(readFileSync(path, 'utf8')));
   } catch (e) {
     throw new Error(`failed to parse RTDB rules JSON at ${path}: ${messageOf(e)}`);
   }