@pyric/cli 0.1.0-alpha.19 → 0.1.0-alpha.20

package/src/serve/runtime/manifest.ts

@@ -1,7 +1,7 @@
 /** Stable routes and identity used by the served runtime and its UI. */
 export const PYRIC_WORKER_URL = '/__pyric/sdk/worker.js';
 export const PYRIC_WORKER_NAME = 'pyric-shared-worker';
-export const PYRIC_STUDIO_URL = '/__pyric/ui/';
+export const PYRIC_STUDIO_URL = '/__pyric/ui/studio';
 
 export interface PyricRuntimeManifest {
   studioUrl: string;

package/src/serve/runtime/status.ts

@@ -108,6 +108,13 @@ function isListenerPhaseErroredEvent(event: SandboxEvent): boolean {
   return isListenerKind && isErroredPhase && hasErrorPayload;
 }
 
+function isAiRejectedEvent(event: SandboxEvent): boolean {
+  const isServiceMutationKind = event.kind === 'service_mutation';
+  const isAiService = event.service === 'ai';
+  const isRejectedOp = 'op' in event && event.op === 'request_rejected';
+  return isServiceMutationKind && isAiService && isRejectedOp;
+}
+
 function sandboxError(event: SandboxEvent): PyricRuntimeError | null {
   if (isRuntimeErrorEvent(event)) {
     const hasPathProperty = 'path' in event && typeof event.path === 'string';
@@ -127,6 +134,23 @@ function sandboxError(event: SandboxEvent): PyricRuntimeError | null {
       message: errorPayload?.message ? errorPayload.message : 'Sandbox runtime error',
     };
   }
+  if (isAiRejectedEvent(event)) {
+    const detail = 'detail' in event ? (event.detail as Record<string, unknown> | undefined) : undefined;
+    const code = typeof detail?.code === 'string' ? detail.code : 'AI_ERROR';
+    const message = typeof detail?.message === 'string' ? detail.message : 'AI request rejected';
+    const hasPathProperty = 'path' in event && typeof event.path === 'string';
+    const targetPath = hasPathProperty ? event.path : '(ai)';
+    return {
+      id: event.id,
+      source: 'sandbox',
+      at: event.at,
+      service: 'ai',
+      method: 'generateContent',
+      path: targetPath,
+      code,
+      message: `AI_ERROR: ${message}`,
+    };
+  }
   if (isListenerErroredEvent(event)) {
     const errorPayload = (event as { error: { code?: string; message: string } }).error;
     return {

package/src/serve/sandbox-session.ts

@@ -35,6 +35,7 @@ export interface SandboxSessionOptions {
   bridgeUrl?: () => string | null;
   ai?: InitPayload['ai'];
   aiProxyUpstream?: string;
+  permissive?: boolean;
   logger?: ServeLogger;
   activity?: (incident: ActivityIncident) => void;
 }
@@ -97,6 +98,13 @@ export async function createSandboxSession(
     databaseRules: database.rules,
     databaseRulesHash: database.rulesHash,
   };
+  if (!database.sourcePath) {
+    if (options.permissive) {
+      options.logger?.note('  ⓘ RTDB permissive mode active — client reads/writes are open by default.');
+    } else {
+      options.logger?.note('  ⚠ no database.rules.json found — client RTDB reads/writes default to DENY (matching production Firebase). Use --permissive for open prototyping.');
+    }
+  }
   const events = createEventHub();
   const capture: CaptureStore | undefined = (options.capture ?? true)
     ? createCaptureStore(options.projectDir)
@@ -164,6 +172,7 @@ export async function createSandboxSession(
       : seedUsers,
     messaging: true,
     ai: options.ai ?? null,
+    permissive: Boolean(options.permissive),
   });
 
   const summary: SandboxSessionSummary = {
@@ -221,16 +230,13 @@ export async function createSandboxSession(
     }
   };
   const reloadDatabaseRules = async (): Promise<RulesReloadResult> => {
-    const isMissingDatabaseRules = database.sourcePath === null;
-    if (isMissingDatabaseRules) {
-      return { kind: 'not-configured' };
-    }
     try {
       const updated = await loadProjectDatabaseRules(options.projectDir, options.firebaseConfig);
       const isMissingUpdatedRules = updated.rules === null || updated.rulesHash === null;
       if (isMissingUpdatedRules) {
         return { kind: 'not-configured' };
       }
+      database.sourcePath = updated.sourcePath;
       live.databaseRules = updated.rules;
       live.databaseRulesHash = updated.rulesHash;
       events.broadcast('rtdb-rules-update', { rules: updated.rules, rulesHash: updated.rulesHash });

package/src/serve/server.ts

@@ -134,6 +134,23 @@ export function isAllowedUpgrade(
   );
 }
 
+/**
+ * Extract a header value case-insensitively from either Node's IncomingMessage headers
+ * or Fetch API Headers object.
+ */
+export function getHeader(
+  req: { headers?: Record<string, string | string[] | undefined> | Headers },
+  name: string,
+): string | undefined {
+  const headers = req?.headers;
+  if (!headers) return undefined;
+  if (typeof (headers as Headers).get === 'function') {
+    return (headers as Headers).get(name) ?? undefined;
+  }
+  const val = (headers as Record<string, string | string[] | undefined>)[name.toLowerCase()];
+  return Array.isArray(val) ? val.join(', ') : val;
+}
+
 export interface ServeHandle {
   port: number;
   host: string;
@@ -249,7 +266,7 @@ async function handleRequest(
   if (!isAllowedHost(req.headers.host, opts.host ?? 'localhost', opts.allowedHosts)) {
     logger.note(`  ✖ 403 blocked Host '${req.headers.host}' (DNS-rebinding guard)`);
     res.writeHead(403, { 'content-type': 'text/plain' }).end(
-      `pyric dev: refused request for Host '${req.headers.host ?? ''}'. ` +
+      `pyric sandbox: refused request for Host '${req.headers.host ?? ''}'. ` +
         'Only localhost is allowed; use --allowed-host to add one.',
     );
     return;

package/src/serve/studio/routes.ts

@@ -33,12 +33,22 @@ import type {
   WorkspaceChange,
   WorkspaceStore,
 } from './store-types.js';
+import { isAllowedHost, isAllowedOrigin, getHeader } from '../server.js';
+import type { WriterLock } from '../writer-lock.js';
 
 export interface StudioRouteOptions {
   /** The single-project file tree served at `/__pyric/workspace`. */
   workspace?: WorkspaceStore;
   /** The project list served at `/__pyric/projects`. */
   projects?: ProjectStore;
+  /** Per-boot session capability token required on workspace & project endpoints. */
+  sessionToken?: string;
+  /** Single-writer lock validator for file mutation & deletion endpoints. */
+  writerLock?: WriterLock;
+  /** Bound host for DNS rebinding guard. */
+  boundHost?: string;
+  /** Extra hostnames allowed for DNS rebinding/origin guard. */
+  allowedHosts?: string[];
 }
 
 /** Collect the raw request body as a UTF-8 string. */
@@ -207,6 +217,10 @@ async function handleProjects(
     .end('method not allowed');
 }
 
+function isWorkspaceMutation(method?: string): boolean {
+  return method === 'PUT' || method === 'POST' || method === 'PATCH' || method === 'DELETE';
+}
+
 /**
  * Build a namespace fragment for the Studio storage routes. Returns a handler
  * shaped like the other `/__pyric/*` fragments: it resolves `true` when it
@@ -219,13 +233,55 @@ export function createStudioRoutes(opts: StudioRouteOptions) {
     url: URL,
   ): Promise<boolean> => {
     try {
-      if (opts.workspace && url.pathname.startsWith('/__pyric/workspace')) {
-        await handleWorkspace(opts.workspace, req, res, url);
-        return true;
-      }
-      if (opts.projects && url.pathname.startsWith('/__pyric/projects')) {
-        await handleProjects(opts.projects, req, res, url);
-        return true;
+      const isWorkspaceRoute = opts.workspace && url.pathname.startsWith('/__pyric/workspace');
+      const isProjectsRoute = opts.projects && url.pathname.startsWith('/__pyric/projects');
+
+      if (isWorkspaceRoute || isProjectsRoute) {
+        const hostHeader = getHeader(req, 'host');
+        const originHeader = getHeader(req, 'origin');
+
+        // 1. Host and Origin guard (Requirement 1)
+        if (!isAllowedHost(hostHeader, opts.boundHost ?? 'localhost', opts.allowedHosts)) {
+          res.writeHead(403, { 'content-type': 'text/plain' }).end('Forbidden: host not allowed');
+          return true;
+        }
+        if (originHeader && !isAllowedOrigin(originHeader, opts.boundHost ?? 'localhost', opts.allowedHosts)) {
+          res.writeHead(403, { 'content-type': 'text/plain' }).end('Forbidden: origin mismatch');
+          return true;
+        }
+
+        // 2. Per-boot session capability token guard (Requirement 2)
+        if (opts.sessionToken) {
+          const reqToken =
+            getHeader(req, 'x-pyric-session-token') ??
+            url.searchParams.get('token');
+          if (!reqToken || reqToken !== opts.sessionToken) {
+            res.writeHead(401, { 'content-type': 'text/plain' }).end('Unauthorized: invalid session capability token');
+            return true;
+          }
+        }
+
+        // 3. Single-writer lock guard for mutation endpoints (Requirement 4)
+        if (opts.writerLock && isWorkspaceMutation(req.method)) {
+          const writerId = getHeader(req, 'x-pyric-writer');
+          if (!writerId) {
+            res.writeHead(423, { 'content-type': 'text/plain' }).end('Locked: missing active writer lock header');
+            return true;
+          }
+          if (!opts.writerLock.claim(writerId, Date.now())) {
+            res.writeHead(423, { 'content-type': 'text/plain' }).end('Locked: another tab holds the writer lock');
+            return true;
+          }
+        }
+
+        if (isWorkspaceRoute) {
+          await handleWorkspace(opts.workspace!, req, res, url);
+          return true;
+        }
+        if (isProjectsRoute) {
+          await handleProjects(opts.projects!, req, res, url);
+          return true;
+        }
       }
     } catch (e) {
       if (!res.headersSent) sendError(res, e);

package/src/serve/vite-ai-config.ts

@@ -44,7 +44,18 @@ export function loadViteAiEnv(
   const resolvedEnvDir = envDir === undefined
     ? resolvedRoot
     : path.resolve(resolvedRoot, envDir);
-  return loadEnv(mode, resolvedEnvDir, '');
+  const loaded = loadEnv(mode, resolvedEnvDir, '');
+  for (const [key, val] of Object.entries(loaded)) {
+    const isAuthKey =
+      key === 'GEMINI_API_KEY' ||
+      key === 'GOOGLE_GENAI_API_KEY' ||
+      key === 'VITE_GEMINI_API_KEY' ||
+      key === 'PYRIC_API_KEY';
+    if (isAuthKey && process.env[key] === undefined) {
+      process.env[key] = val;
+    }
+  }
+  return loaded;
 }
 
 /** Convert a public declarative engine into the JSON-safe worker wire shape. */
@@ -65,6 +76,21 @@ export function engineConfigToWire(engine: PyricAiEngineConfig): AiEngineConfigW
     }
     return result as AiEngineConfigWire;
   }
+  const isGeminiEngine = engine.kind === 'gemini';
+  if (isGeminiEngine) {
+    const result: Record<string, unknown> = {
+      kind: 'gemini',
+    };
+    const hasBaseUrl = engine.baseUrl !== undefined;
+    if (hasBaseUrl) {
+      result.baseUrl = engine.baseUrl;
+    }
+    const hasApiKey = engine.apiKey !== undefined;
+    if (hasApiKey) {
+      result.apiKey = engine.apiKey;
+    }
+    return result as AiEngineConfigWire;
+  }
   const result: Record<string, unknown> = {
     kind: 'scripted',
   };
@@ -123,12 +149,16 @@ export function resolveViteAiConfig(
   }
 
   let engineWire: AiEngineConfigWire | undefined = undefined;
-  if (!isProductionMode) {
-    if (explicitEngine !== undefined) {
-      engineWire = engineConfigToWire(explicitEngine);
-    } else if (model !== undefined) {
-      engineWire = engineConfigToWire({ kind: 'openai', baseUrl: AI_PROXY_PATH, model });
-    }
+  if (isProductionMode) {
+    const apiKey = env.GEMINI_API_KEY ?? env.GOOGLE_GENAI_API_KEY ?? env.VITE_GEMINI_API_KEY;
+    engineWire = {
+      kind: 'gemini',
+      ...(apiKey !== undefined && apiKey.trim() !== '' ? { apiKey: apiKey.trim() } : {}),
+    };
+  } else if (explicitEngine !== undefined) {
+    engineWire = engineConfigToWire(explicitEngine);
+  } else if (model !== undefined) {
+    engineWire = engineConfigToWire({ kind: 'openai', baseUrl: AI_PROXY_PATH, model });
   }
 
   let proxyUpstream: string | undefined = undefined;

package/src/serve/vite-module-swap.ts

@@ -86,20 +86,6 @@ export function createViteModuleSwap(
 
         const match = FIREBASE_SPECIFIER.exec(args.path);
         const subpath = match !== null && match[1] !== undefined ? match[1] : '';
-        const isProductionAiMode = aiMode() === 'production';
-        if (isProductionAiMode) {
-          const isAiSubpath = subpath === 'ai';
-          if (isAiSubpath) {
-            return null;
-          }
-          const isAppSubpath = subpath === 'app';
-          const passthroughEntry = entries['app-ai-passthrough'];
-          const hasPassthroughEntry = passthroughEntry !== undefined;
-          const shouldUsePassthroughBridge = isAppSubpath && hasPassthroughEntry;
-          if (shouldUsePassthroughBridge) {
-            return { path: passthroughEntry };
-          }
-        }
 
         const isServedSubpath = SERVED_FIREBASE_SUBPATHS.has(subpath);
         if (isServedSubpath) {
@@ -173,20 +159,6 @@ export function createViteModuleSwap(
       const isFirebaseSpecifier = firebaseMatch !== null;
       if (isFirebaseSpecifier) {
         const subpath = firebaseMatch[1] !== undefined ? firebaseMatch[1] : '';
-        const isProductionAiMode = aiMode() === 'production';
-        if (isProductionAiMode) {
-          const isAiSubpath = subpath === 'ai';
-          if (isAiSubpath) {
-            return null;
-          }
-          const isAppSubpath = subpath === 'app';
-          const passthroughEntry = entries['app-ai-passthrough'];
-          const hasPassthroughEntry = passthroughEntry !== undefined;
-          const shouldUsePassthroughBridge = isAppSubpath && hasPassthroughEntry;
-          if (shouldUsePassthroughBridge) {
-            return passthroughEntry;
-          }
-        }
         const isServedSubpath = SERVED_FIREBASE_SUBPATHS.has(subpath);
         if (isServedSubpath) {
           const key = entryKey(subpath);

package/src/serve/vite-sandbox-generation.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import type { ViteDevServer } from 'vite';
 import { readFirebaseJson, readFirebaseRc, type FirebaseJson } from '../cli/firebase-json.js';
-import { registerModuleUrl } from '../cli/dev-runner.js';
+import { registerModuleUrl } from '../cli/sandbox-runner.js';
 import {
   discoverFunctionsRtdbProject,
   type FunctionsRtdbProject,

package/src/serve/worker/client/disconnect.ts

@@ -15,7 +15,7 @@ function deleteTimeoutError(): Error & { code: string } {
   return Object.assign(
     new Error(
       'Timed out waiting for SharedWorker app cleanup acknowledgment. ' +
-      'Close all tabs using this pyric dev origin so the worker can restart.',
+      'Close all tabs using this pyric sandbox origin so the worker can restart.',
     ),
     { code: 'app/delete-timeout' },
   );

package/src/serve/worker/client/presence.ts

@@ -25,9 +25,29 @@ import type { ClientDb, Unsubscribe } from './handles.js';
 export type { PresenceClientKind, PresenceSnapshot, PresenceVisibility };
 export { PRESENCE_HEARTBEAT_INTERVAL_MS, PRESENCE_STALE_MS };
 
+function supportsRandomUUID(): boolean {
+  return typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function';
+}
+
+function supportsDocumentEventListeners(): boolean {
+  return (
+    typeof document !== 'undefined' &&
+    typeof document.addEventListener === 'function' &&
+    typeof document.removeEventListener === 'function'
+  );
+}
+
+function supportsWindowEventListeners(): boolean {
+  return (
+    typeof window !== 'undefined' &&
+    typeof window.addEventListener === 'function' &&
+    typeof window.removeEventListener === 'function'
+  );
+}
+
 /** Mint a random client id (page-lifetime). */
 export function mintPresenceClientId(): string {
-  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
+  if (supportsRandomUUID()) {
     return crypto.randomUUID();
   }
   return `page-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
@@ -114,10 +134,10 @@ export function startPresence(opts: StartPresenceOptions): PresenceSession {
 
   register();
 
-  if (typeof document !== 'undefined') {
+  if (supportsDocumentEventListeners()) {
     document.addEventListener('visibilitychange', update);
   }
-  if (typeof window !== 'undefined') {
+  if (supportsWindowEventListeners()) {
     window.addEventListener('popstate', update);
     window.addEventListener('hashchange', update);
     // Best-effort clean disconnect; lease expiry covers unclean shutdown.
@@ -139,10 +159,10 @@ export function startPresence(opts: StartPresenceOptions): PresenceSession {
       clearInterval(timer);
       timer = null;
     }
-    if (typeof document !== 'undefined') {
+    if (supportsDocumentEventListeners()) {
       document.removeEventListener('visibilitychange', update);
     }
-    if (typeof window !== 'undefined') {
+    if (supportsWindowEventListeners()) {
       window.removeEventListener('popstate', update);
       window.removeEventListener('hashchange', update);
       window.removeEventListener('pagehide', onPageHide);

package/src/serve/worker/host-ai.ts

@@ -57,6 +57,21 @@ function resolveEngineConfig(wire: AiEngineConfigWire): NonNullable<AIOptions['e
       ...(wire.modelMap !== undefined ? { modelMap: wire.modelMap } : {}),
     };
   }
+  const isGeminiWire = wire.kind === 'gemini';
+  if (isGeminiWire) {
+    const result: Record<string, unknown> = {
+      kind: 'gemini',
+    };
+    const hasBaseUrl = wire.baseUrl !== undefined;
+    if (hasBaseUrl) {
+      result.baseUrl = wire.baseUrl;
+    }
+    const hasApiKey = wire.apiKey !== undefined;
+    if (hasApiKey) {
+      result.apiKey = wire.apiKey;
+    }
+    return result as unknown as NonNullable<AIOptions['engine']>;
+  }
   return {
     kind: 'scripted',
     ...(wire.script !== undefined

package/src/serve/worker/protocol.ts

@@ -203,7 +203,8 @@ export type AiEngineConfigWire =
       model?: string;
       /** Explicit Gemini-model-id → upstream-model mapping. */
       modelMap?: Record<string, string>;
-    };
+    }
+  | { kind: 'gemini'; baseUrl?: string; apiKey?: string };
 
 /**
  * Wire form of the Gemini error envelope an `AiBrokerError` carries

package/src/serve/worker/serve-init.ts

@@ -221,8 +221,8 @@ export function applyServeInit(
       };
     }
   }
+  const rtdb = ctx.rtdb ??= getDatabase(ctx.sandbox);
   if (payload.databaseRules) {
-    const rtdb = ctx.rtdb ??= getDatabase(ctx.sandbox);
     rtdbSandbox.setRules(rtdb, payload.databaseRules);
     ctx.activeRules ??= {};
     ctx.activeRules.database = {
@@ -231,6 +231,10 @@ export function applyServeInit(
       status: 'active',
       messages: [],
     };
+  } else if (payload.permissive) {
+    rtdbSandbox.setDefaultPolicy(rtdb, 'allow');
+  } else {
+    rtdbSandbox.setDefaultPolicy(rtdb, 'deny');
   }
 
   // 1b. Storage rules — deployed ONCE, here, before any storage op can run.

package/README.md.orig

@@ -1,145 +0,0 @@
-# `@pyric/cli`
-
-The Pyric CLI and programmatic helpers for local sandbox development,
-verification, artifact generation, and agent bridges.
-
-> **Alpha.** This package is an early alpha. Non-mirrored exports (e.g.
-> `@pyric/cli/serve/worker`, `@pyric/cli/verify`, `@pyric/cli/credentials/node`)
-> are experimental public-alpha surfaces that may change without notice. The
-> MCP tool surface (tool names and shapes) will consolidate during early
-> alpha — do not treat tool names as stable.
-
-Production project administration (deploy, Identity Toolkit configuration,
-hosted discovery) is **not** part of this package. Use
-[`firebase-tools`](https://firebase.google.com/docs/cli) or the Firebase
-Console to ship rules, indexes, hosting, and functions to a real project.
-
-## CLI subcommands
-
-| Command | What it does |
-|---|---|
-| `pyric init [dir]` | Scaffold a pyric project — never prompts, idempotent, safe to rerun. `--template web` (default) creates a Vite app with canonical `firebase/*` imports; `--template static` creates a no-bundler app; `--template node` creates a script-style project. Run any template through `pyric dev` for sandbox resolution; inactive production tooling loads Firebase directly. Also `--name`, `--force` (overwrite scaffold-owned files), and `--json` (machine result on stdout). |
-| `pyric bridge` | Stand up an HTTP+WebSocket bridge an MCP client (Claude Code, Cursor) connects to (sandbox mode only) |
-| `pyric dev` | Local dev server with the pyric sandbox standing in for Firebase: serves `hosting.public`, resolves unmodified `firebase/*` imports to a pyric sandbox via a served import map, deploys + hot-reloads `firestore.rules` (SSE), opens an emulator-style sign-in helper for `signInWithPopup`/`signInWithRedirect`. The sandbox runs in a **SharedWorker by default** — one backend shared by every tab of the origin (live cross-tab sync), kept in the browser's IndexedDB so **your sandbox data — Firestore docs, auth users, RTDB, storage objects, and the traffic history — survives a refresh/restart by default** (see the persistence guide's coverage matrix for the exact tiers); a per-tab in-page sandbox is the fallback when SharedWorker is unavailable. Flags + exit codes: [CLI reference](docs/reference/cli.md#pyric-dev); persistence, ephemeral runs, clearing data, and SharedWorker tips: [persistence & multi-tab](docs/how-to/serve-persistence-and-multi-tab.md) |
-| `pyric snapshot` | Promote lived sandbox state (live `dev --persist`, else `.pyric/state/state.json`) to a committable fixture; `pyric dev --seed <fixture>` re-serves it (docs + users). `--out`, `--port`, `--force`, `--json` |
-| `pyric verify` | Replay a captured sandbox session against candidate rules (`--engine sandbox\|rules-test-api\|both`). Hosted Rules Test API needs SA/ADC via `FIREBASE_SA_BASE64` / `GOOGLE_APPLICATION_CREDENTIALS` |
-| `pyric can-i-use <feature>` | Query the canonical conformance model for availability, behaviour fidelity, assurance eligibility, caveats, and evidence. Only an exact canonical feature name exits 0; ambiguous names, spelling suggestions, and missing features exit 1. Accepts `--json`. |
-| `pyric mcp` | Start the stdio MCP server; attach to `pyric dev --bridge` when available or host a headless sandbox |
-| `pyric firestore rules lint <path>` | Lint a Firestore rules file |
-| `pyric firestore rules validate <path>` | Validate Firestore rules structure |
-| `pyric firestore rules simulate` | Run the local Firestore rules simulator |
-| `pyric firestore rules resolve <path>` | Resolve `2+modules` imports into a Firebase rules artifact |
-| `pyric firestore indexes generate <path...>` | Derive composite-index definitions from application source |
-| `pyric storage rules lint <path>` / `simulate` | Run local Storage rules lint or simulation |
-| `pyric storage rules resolve <path> --out storage.rules` | Resolve `storage.modules.rules` into a deployable Storage rules artifact |
-| `pyric database rules lint <path>` | Lint a Realtime Database rules JSON file |
-| `pyric database rules validate <path>` | Validate Realtime Database rules expressions |
-| `pyric database rules simulate` | Run the local Realtime Database rules simulator |
-| `pyric database rules generate` | Compile a constraints module to local `database.rules.json` without contacting production |
-
-Every command's full flags, defaults, exit codes, and environment variables are
-in the **[CLI reference](docs/reference/cli.md)**. Task guides and the rest of
-the docs are indexed in **[docs/](docs/README.md)**.
-
-### Persistence caveats (documented limits)
-
-- **Anonymous users don't persist** (no round-trip key) — but their *documents
-  do*. An app that calls `signInAnonymously` on load mints a new uid every
-  reload under `--persist`, so docs owned by prior anonymous uids accumulate
-  unreachably. Use the sign-in helper (or seeded users) for owner-based data
-  you want durable.
-- **The state file is not a point-in-time snapshot** — firestore and auth
-  sections flush on independent debounces; a crash between them can persist
-  docs whose owner user hasn't flushed yet (or vice versa).
-- **One writer tab at a time (in-page fallback only)** — when several per-tab
-  in-page sandboxes share one `.pyric/state` file, the first tab to flush holds
-  the writer lock; others run read-only (console warning + `persistReadOnly`
-  diagnostic) so they can't erase the writer's data. On the default SharedWorker
-  path this can't happen — the single worker is the sole writer.
-- **Loss window** — the final unsaved change can be lost if the tab CLOSES
-  within the flush debounce while the state exceeds ~60KB (keepalive cap);
-  smaller states flush on unload, and reloads are always safe. A reset (or
-  any delete-all) that empties a non-empty state first preserves the prior
-  file at `.pyric/state/state.json.bak`.
-
-### Agent onboarding (init → dev → MCP)
-
-Three parseable steps, no flags to discover:
-
-```bash
-pyric init myapp --json        # → {..., "nextSteps": [...]}
-cd myapp && bun install
-bun run dev:agent              # pyric dev --bridge --seed seed.json
-```
-
-Readiness probe: `GET <url>/__pyric/init.json` → 200 once serving (body
-carries the live rules hash). MCP endpoint: `<url>/__pyric/mcp`. With
-`pyric dev --json`, stdout's single line carries `{url, port, mcpUrl,
-rulesHash}`.
-
-## Programmatic subpaths
-
-| Subpath | Surface |
-|---|---|
-| `@pyric/cli/credentials/node` | `fromServiceAccount`, `fromAdc` — build a `ProjectScope` for the Rules Test API (`pyric verify --engine rules-test-api\|both`) |
-| `@pyric/cli/verify` | Captured-session replay for Firestore and RTDB rules |
-| `@pyric/cli/conformance` | Node query surface: `canIUse` returns full claims and evidence; `canIUseImport` resolves a published import to its canonical compatibility page. |
-| `@pyric/cli/conformance/browser` | Compact browser query surface: `canIUse` returns availability, fidelity, assurance, summary, caveats, and the evidence slug without the full claim graph. |
-| `@pyric/cli/assurance` | Assurance campaign types and tools |
-| `@pyric/cli/assurance/browser` | Browser attachment for assurance campaigns |
-| `@pyric/cli/bridge` | `createBridge`, `startServer` (Node) / `connectBridge` (browser via conditional export). Vite integration is `pyric({ bridge })` in `@pyric/cli/vite`. |
-| `@pyric/cli/bridge/client` | Browser bridge client helpers |
-| `@pyric/cli/vite` | `pyric(opts)`, the dev-only firebase→sandbox swap plugin. Opts: `rules`, `persist`/`fresh`, `seed`, `capture`, `bridge` (MCP), `ui` (Pyric Studio at `/__pyric/ui/`, parity with `dev --ui`). |
-| `@pyric/cli/discover` | Credential-free crawl helpers for sandbox discovery (`crawl`, `findCollectionGroup`, `createFirestoreDiscoverTools`). Not registered on the default MCP bridge. |
-| `@pyric/cli/serve/worker` | SharedWorker serve runtime |
-| `@pyric/cli/remote` | Remote / headless helpers |
-| `@pyric/cli/register` | Registration helpers |
-
-## MCP tool surface (`pyric bridge`)
-
-The bridge composes its toolsets from the same factories used by its browser
-dispatcher so advertised and executable tools cannot drift. The canonical,
-always-current list is the
-[agent tool inventory](../../docs/agent-tools.md).
-
-**Sandbox-routed** — dispatched against the connected browser sandbox
-(`createFirestoreDataTools` + `createFirestoreSimulatorTools` +
-`createFirestoreInspectTools` + local RTDB inspection):
-
-- data: `firestore_get_document` / `_list_documents` / `_create_document` / `_add_document` / `_update_document` / `_delete_document` / `_batch_write` / `_query_where` / `firestore_create_with_auto_id`
-- stateful simulator session: `firestore_simulator_create` / `_execute` / `_read` / `_batch` / `_undo` / `_redo` / `_events` / `_transaction`
-- diagnostics: `sandbox_inspect` — single-call sandbox state/rules snapshot
-- RTDB authorization: `rtdb_simulate_access` — evaluates one operation against
-  the rules and data currently installed in the connected sandbox
-- RTDB structure: `rtdb_crawl_structure` — returns a bounded structural view of
-  current sandbox data without leaf values
-
-Assurance campaign tools remain available programmatically from
-`@pyric/cli/assurance`, but are not registered on the default MCP bridge.
-
-**In-process** — run on the bridge process itself (`createFirestoreRulesTools`
-without a live `ProjectScope`, so no Rules Test API tool):
-
-- `firestore_simulate_rules`
-- `rules_stdlib_list` / `_get` (Firestore or Storage), with
-  `firestore_rules_stdlib_list` / `_get` retained as compatibility aliases
-- `rules_resolve_modules` (Firestore or Storage), with
-  `firestore_resolve_modules` retained as a compatibility alias
-- `firestore_lint_rules`
-- `firestore_resolve_modules`
-
-### Gaps from the playground tool surface
-
-The `packages/playground/` app ships richer diagnostic tools that
-the `pyric bridge` does NOT register out of the box today. They're
-playground-specific orchestrators built on top of `useRuntimeStore`
-and other browser-only state:
-
-- `inspect_firestore_traffic` — structured dump of the sandbox traffic log
-- `seed_firestore_data_as_admin` — admin-bypass bulk writes for fixture setup
-- `generate_fixture_from_session` — snapshot `sandbox.history()` as a replay fixture
-- `try_rules_edit` — replay events under a proposed rules edit
-- `debug_firestore_rules` — orchestrator over simulate + lint + history + state
-
-The underlying primitives (`sandbox.history()`, `pyric/sandbox/replay`, and the
-rules simulator) remain available for custom compositions.

package/dist/cli/dev-runner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-runner.d.ts","sourceRoot":"","sources":["../../src/cli/dev-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAM9D;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC,GACL,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAID,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7D,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAKhE;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUxD;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;CAChC,GAAG,YAAY,GAAG,IAAI,CAWtB;AAID;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAQ1C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C,MAAM,CAAC,UAAU,CAOnB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAc9F;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC5B;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,IAAI,CAAA;CAAE,CAkB9C;AAID,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB;0EACsE;IACtE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAClC,KAAK,EAAE,YAAY,CAAC;CACrB;AAKD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3D,cAAc,CAiEhB"}

package/dist/cli/dev-runner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-runner.js","sourceRoot":"","sources":["../../src/cli/dev-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,OAKI,EAAE;IAEN,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC;YAC7E,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;gBACpE,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAMD,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAErE,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;QAC7B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,IAM/B;IACC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,cAAc,UAAU,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAuB,EACvB,IAA+C;IAE/C,MAAM,UAAU,GAAG,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO;QACL,GAAG,IAAI;QACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;QACxC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU;KACpF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA+C;IACpF,MAAM,YAAY,GAAG,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,yBAAyB,YAAY,GAAG,CAAC;IACvD,MAAM,KAAK,GAAG,wBAAwB,WAAW,GAAG,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,OAAO,CACL,IAAI;QACJ,+EAA+E;QAC/E,KAAK,OAAO,IAAI;QAChB,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,IAAI;QACd,KAAK,OAAO,IAAI,CACjB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,KAA6B;IAE7B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,MAAM,IAAI,KAAK,CAAC;YAChB,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1C,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,KAAK;YACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC;gBAC9B,MAAM,GAAG,EAAE,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAaD,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAkB,EAClB,IAA4D;IAE5D,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAQ,EAAE,IAAI,EAAE;QAClC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;QAClC,wEAAwE;QACxE,wEAAwE;QACxE,oDAAoD;QACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;KACvC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9D,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAAU,GAAyC,IAAI,CAAC;IAC5D,MAAM,QAAQ,GAAG,CAAC,MAAsB,EAAQ,EAAE;QAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;YACnF,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAClC,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACzC,kEAAkE;YAClE,IAAI,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC;iBACrB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;;gBAC5C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,KAAK;QACL,MAAM,CAAC,GAAmB;YACxB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS;gBAAE,OAAO;YACjD,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC;gBACH,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,IAAI,CAAC;oBACH,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACxB,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}