@pyric/cli 0.1.0-alpha.19 → 0.1.0-alpha.21

package/dist/bridge/server/tool-metadata.js

@@ -1,21 +1,21 @@
 /**
- * Extract tool metadata (name + description + parameters) from the
- * existing `pyric/rules` factories without running any
- * tool logic. Used by the bridge to register MCP tools whose actual
- * dispatch happens against the connected browser peer.
+ * Node-side composition of the tool families the bridge serves over MCP.
  *
- * Why: `createFirestoreSimulatorTools` returns `ToolHandler[]` with
- * `execute` bound to a `LocalEnvironment`. The bridge process doesn't
- * have a `LocalEnvironment` — it forwards. But it does need the
- * metadata to populate the MCP server's tool list. This module calls
- * the factory with a stub resolver and reads only the metadata; the
- * stub never gets invoked because the bridge replaces `execute`
- * before dispatch.
+ * Forwarded families are executed by the browser sandbox peer, so this
+ * process never holds a `LocalEnvironment`. It still needs each tool's
+ * metadata (name, description, parameters) to populate the MCP tool list, so
+ * it calls the family factories with a stub resolver and reads only the
+ * metadata; the bridge replaces `execute` with forward-to-peer dispatch
+ * before any call reaches a handler.
+ *
+ * In-process families run here without a browser peer and are returned as
+ * live handlers.
+ *
+ * Family order comes from the records under `../tool-family-records/`; the
+ * factories come from `./tool-family-factories.ts`.
  */
-import { createFirestoreSimulatorTools, createFirestoreRulesTools, } from 'pyric/rules/internal/node';
-import { createFirestoreDataTools, createFirestoreInspectTools } from 'pyric/firestore';
-import { createRtdbInspectionTools } from '../../rtdb/inspection.js';
-import { createConformanceTools } from '../../conformance/tools.js';
+import { toolFamilies } from '../tool-families.js';
+import { FORWARDED_METADATA_FACTORIES, IN_PROCESS_HANDLER_FACTORIES, } from './tool-family-factories.js';
 function toMetadata(handler) {
     return {
         name: handler.name,
@@ -24,61 +24,26 @@ function toMetadata(handler) {
     };
 }
 /**
- * Tool metadata for the sandbox bridge. Includes the
- * data-plane / sandbox-management tools that the browser dispatches
- * via `LocalEnvironment`. Rules tooling (lint, validate, simulate,
- * test) is NOT included here — those execute in Node and are
- * registered separately, since they don't need the browser sandbox.
+ * Tool metadata for every forwarded family, in family order. The stub
+ * resolver never runs: the bridge replaces `execute()` with its own
+ * forward-to-peer dispatch.
  */
 export function getSandboxToolMetadata() {
-    // The resolver stub never runs: the bridge replaces execute() with
-    // its own forward-to-peer dispatch.
-    const stubResolver = async () => {
+    const stub = () => {
         throw new Error('BUG: sandbox-tool factory executor invoked on the bridge side — should have been replaced');
     };
-    const handlers = [
-        // Simulator / write / batch / undo / redo / events / transaction —
-        // 8 tools that mutate or read the in-browser sandbox state.
-        ...createFirestoreSimulatorTools({
-            resolveSandbox: stubResolver,
-        }),
-        // Data plane — addDoc / setDoc / getDoc / updateDoc / deleteDoc /
-        // collection / query / where — the modular Firestore CRUD surface
-        // routed through the browser sandbox so agents can drive a real app
-        // session rather than only the simulator.
-        ...createFirestoreDataTools({
-            resolveDb: stubResolver,
-        }),
-        // `sandbox_inspect` — single-call diagnostic that answers
-        // "what state is the sandbox in?" Born out of CLAUDE_DEBUG_SESSION.md
-        // (a real agent needing 51 tool calls + 72k tokens to figure out
-        // that rules weren't loaded). Routes to the browser sandbox like
-        // the other forwarded tools.
-        ...createFirestoreInspectTools({
-            resolveSandbox: stubResolver,
-        }),
-        ...createRtdbInspectionTools({
-            resolveSandbox: stubResolver,
-        }),
-    ];
-    return handlers.map(toMetadata);
+    return toolFamilies('forwarded')
+        .flatMap((family) => FORWARDED_METADATA_FACTORIES[family.key](stub))
+        .map(toMetadata);
 }
 /**
- * Tooling factories that execute in-process on the bridge
- * (no browser needed). Returned as live ToolHandlers — the bridge
+ * Live handlers for every in-process family, in family order. The bridge
  * registers each handler's `execute` directly.
  *
  * `scope` is forwarded so the hosted Rules Test API verification tool can
  * authenticate without changing the bridge's sandbox-only execution model.
  */
 export function getInProcessToolHandlers(scope) {
-    // Factory accepts { scope } per packages/pyric/src/rules/tools.ts.
-    // The bridge does not need to own the structurally compatible type.
-    // Includes the rules tool surface plus the Node-only conformance query.
-    // No browser is needed.
-    return [
-        ...createFirestoreRulesTools({ scope }),
-        ...createConformanceTools(),
-    ];
+    return toolFamilies('in-process').flatMap((family) => IN_PROCESS_HANDLER_FACTORIES[family.key](scope));
 }
 //# sourceMappingURL=tool-metadata.js.map

package/dist/bridge/server/tool-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-metadata.js","sourceRoot":"","sources":["../../../src/bridge/server/tool-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAQpE,SAAS,UAAU,CAAC,OAAoB;IACtC,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAqC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE;QAC9B,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,QAAQ,GAAkB;QAC9B,mEAAmE;QACnE,4DAA4D;QAC5D,GAAG,6BAA6B,CAAC;YAC/B,cAAc,EAAE,YAAqB;SACtC,CAAC;QACF,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,0CAA0C;QAC1C,GAAG,wBAAwB,CAAC;YAC1B,SAAS,EAAE,YAAqB;SACjC,CAAC;QACF,0DAA0D;QAC1D,sEAAsE;QACtE,iEAAiE;QACjE,iEAAiE;QACjE,6BAA6B;QAC7B,GAAG,2BAA2B,CAAC;YAC7B,cAAc,EAAE,YAAqB;SACtC,CAAC;QACF,GAAG,yBAAyB,CAAC;YAC3B,cAAc,EAAE,YAAqB;SACtC,CAAC;KACH,CAAC;IACF,OAAO,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAe;IACtD,mEAAmE;IACnE,oEAAoE;IACpE,wEAAwE;IACxE,wBAAwB;IACxB,OAAO;QACL,GAAG,yBAAyB,CAAC,EAAE,KAAK,EAAW,CAAC;QAChD,GAAG,sBAAsB,EAAE;KAC5B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool-metadata.js","sourceRoot":"","sources":["../../../src/bridge/server/tool-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAE7B,MAAM,4BAA4B,CAAC;AAQpC,SAAS,UAAU,CAAC,OAAoB;IACtC,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAqC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAiB,GAAG,EAAE;QAC9B,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC,CAAC;IACF,OAAO,YAAY,CAAC,WAAW,CAAC;SAC7B,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;SACnE,GAAG,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAe;IACtD,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACnD,4BAA4B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC"}

package/dist/bridge/tool-families.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Tool family contract shared by both sides of the bridge.
+ *
+ * A family is authored as one record under `tool-family-records/`: its
+ * transport, its position in the default `tools/list` order, and the exact
+ * tool names its factory yields. `scripts/generate-tool-family-registry.ts`
+ * aggregates the records into `tool-families.generated.ts`. This module reads
+ * only that aggregate, so the browser bundle and the MCP process share one
+ * manifest without either importing the other's factories.
+ *
+ * Factories live in `server/tool-family-factories.ts` (Node) and
+ * `client/tool-family-factories.ts` (browser). Each map is typed against the
+ * family keys derived here, so a record without a factory, or a factory
+ * without a record, fails to compile.
+ */
+import { TOOL_FAMILIES } from './tool-families.generated.js';
+export type ToolTransport = 'forwarded' | 'in-process';
+/** Authored in one record file per family. The key is the filename without `.ts`; the generator adds it. */
+export interface ToolFamilyRecord {
+    /** `forwarded`: executed by the browser sandbox peer. `in-process`: executed in the MCP process. */
+    readonly transport: ToolTransport;
+    /** Stable position in the default `tools/list` order. Unique across all records; authored with gaps of 10. */
+    readonly order: number;
+    /** Exact names the family factory yields for the default surface, in factory order. */
+    readonly tools: readonly string[];
+}
+export interface ToolFamily extends ToolFamilyRecord {
+    readonly key: string;
+}
+type RegisteredFamily = (typeof TOOL_FAMILIES)[number];
+export type ForwardedFamilyKey = Extract<RegisteredFamily, {
+    transport: 'forwarded';
+}>['key'];
+export type InProcessFamilyKey = Extract<RegisteredFamily, {
+    transport: 'in-process';
+}>['key'];
+/** Families of one transport, sorted by `order`. Validates once at load: duplicate key, order, or tool name throws. */
+export declare function toolFamilies<T extends ToolTransport>(transport: T): readonly Extract<RegisteredFamily, {
+    transport: T;
+}>[];
+/**
+ * Fail closed when a factory yields a different name set from the records.
+ * Both sides call this with the same message so drift reads the same
+ * wherever it surfaces.
+ */
+export declare function assertExactToolNames(label: string, actual: readonly string[], expected: readonly string[]): void;
+export {};
+//# sourceMappingURL=tool-families.d.ts.map

package/dist/bridge/tool-families.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-families.d.ts","sourceRoot":"","sources":["../../src/bridge/tool-families.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;AAEvD,4GAA4G;AAC5G,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,8GAA8G;IAC9G,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,KAAK,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AACvD,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,SAAS,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC9F,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,SAAS,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAmB/F,uHAAuH;AACvH,wBAAgB,YAAY,CAAC,CAAC,SAAS,aAAa,EAClD,SAAS,EAAE,CAAC,GACX,SAAS,OAAO,CAAC,gBAAgB,EAAE;IAAE,SAAS,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAKxD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,IAAI,CAaN"}

package/dist/bridge/tool-families.generated.d.ts

@@ -0,0 +1,32 @@
+export declare const TOOL_FAMILIES: readonly [{
+    readonly transport: "in-process";
+    readonly order: 60;
+    readonly tools: readonly ["pyric_can_i_use"];
+    readonly key: "conformance";
+}, {
+    readonly transport: "forwarded";
+    readonly order: 20;
+    readonly tools: readonly ["firestore_get_document", "firestore_list_documents", "firestore_create_document", "firestore_add_document", "firestore_update_document", "firestore_delete_document", "firestore_batch_write", "firestore_query_where"];
+    readonly key: "firestore-data";
+}, {
+    readonly transport: "forwarded";
+    readonly order: 30;
+    readonly tools: readonly ["sandbox_inspect"];
+    readonly key: "firestore-inspect";
+}, {
+    readonly transport: "in-process";
+    readonly order: 50;
+    readonly tools: readonly ["firestore_simulate_rules", "firestore_rules_stdlib_list", "firestore_rules_stdlib_get", "firestore_lint_rules", "firestore_resolve_modules", "rules_stdlib_list", "rules_stdlib_get", "rules_resolve_modules"];
+    readonly key: "firestore-rules";
+}, {
+    readonly transport: "forwarded";
+    readonly order: 10;
+    readonly tools: readonly ["firestore_simulator_create", "firestore_simulator_execute", "firestore_simulator_read", "firestore_simulator_batch", "firestore_create_with_auto_id", "firestore_simulator_undo", "firestore_simulator_redo", "firestore_simulator_events", "firestore_simulator_transaction"];
+    readonly key: "firestore-simulator";
+}, {
+    readonly transport: "forwarded";
+    readonly order: 40;
+    readonly tools: readonly ["rtdb_simulate_access", "rtdb_crawl_structure"];
+    readonly key: "rtdb-inspection";
+}];
+//# sourceMappingURL=tool-families.generated.d.ts.map

package/dist/bridge/tool-families.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-families.generated.d.ts","sourceRoot":"","sources":["../../src/bridge/tool-families.generated.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOgB,CAAC"}

package/dist/bridge/tool-families.generated.js

@@ -0,0 +1,15 @@
+import conformance from './tool-family-records/conformance.js';
+import firestoreData from './tool-family-records/firestore-data.js';
+import firestoreInspect from './tool-family-records/firestore-inspect.js';
+import firestoreRules from './tool-family-records/firestore-rules.js';
+import firestoreSimulator from './tool-family-records/firestore-simulator.js';
+import rtdbInspection from './tool-family-records/rtdb-inspection.js';
+export const TOOL_FAMILIES = [
+    { key: "conformance", ...conformance },
+    { key: "firestore-data", ...firestoreData },
+    { key: "firestore-inspect", ...firestoreInspect },
+    { key: "firestore-rules", ...firestoreRules },
+    { key: "firestore-simulator", ...firestoreSimulator },
+    { key: "rtdb-inspection", ...rtdbInspection },
+];
+//# sourceMappingURL=tool-families.generated.js.map

package/dist/bridge/tool-families.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-families.generated.js","sourceRoot":"","sources":["../../src/bridge/tool-families.generated.ts"],"names":[],"mappings":"AAEA,OAAO,WAAW,MAAM,sCAAsC,CAAC;AAC/D,OAAO,aAAa,MAAM,yCAAyC,CAAC;AACpE,OAAO,gBAAgB,MAAM,4CAA4C,CAAC;AAC1E,OAAO,cAAc,MAAM,0CAA0C,CAAC;AACtE,OAAO,kBAAkB,MAAM,8CAA8C,CAAC;AAC9E,OAAO,cAAc,MAAM,0CAA0C,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE;IACtC,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,aAAa,EAAE;IAC3C,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,gBAAgB,EAAE;IACjD,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,cAAc,EAAE;IAC7C,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,kBAAkB,EAAE;IACrD,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,cAAc,EAAE;CACL,CAAC"}

package/dist/bridge/tool-families.js

@@ -0,0 +1,51 @@
+/**
+ * Tool family contract shared by both sides of the bridge.
+ *
+ * A family is authored as one record under `tool-family-records/`: its
+ * transport, its position in the default `tools/list` order, and the exact
+ * tool names its factory yields. `scripts/generate-tool-family-registry.ts`
+ * aggregates the records into `tool-families.generated.ts`. This module reads
+ * only that aggregate, so the browser bundle and the MCP process share one
+ * manifest without either importing the other's factories.
+ *
+ * Factories live in `server/tool-family-factories.ts` (Node) and
+ * `client/tool-family-factories.ts` (browser). Each map is typed against the
+ * family keys derived here, so a record without a factory, or a factory
+ * without a record, fails to compile.
+ */
+import { TOOL_FAMILIES } from './tool-families.generated.js';
+function assertUnique(label, values) {
+    const seen = new Set();
+    for (const value of values) {
+        if (seen.has(value))
+            throw new Error(`duplicate tool family ${label} '${value}'`);
+        seen.add(value);
+    }
+}
+function validateFamilies(families) {
+    assertUnique('key', families.map((family) => family.key));
+    assertUnique('order', families.map((family) => family.order));
+    assertUnique('tool name', families.flatMap((family) => family.tools));
+    return [...families].sort((a, b) => a.order - b.order);
+}
+const FAMILIES_BY_ORDER = validateFamilies(TOOL_FAMILIES);
+/** Families of one transport, sorted by `order`. Validates once at load: duplicate key, order, or tool name throws. */
+export function toolFamilies(transport) {
+    return FAMILIES_BY_ORDER.filter((family) => family.transport === transport);
+}
+/**
+ * Fail closed when a factory yields a different name set from the records.
+ * Both sides call this with the same message so drift reads the same
+ * wherever it surfaces.
+ */
+export function assertExactToolNames(label, actual, expected) {
+    const actualSorted = [...actual].sort();
+    const expectedSorted = [...expected].sort();
+    if (actualSorted.length !== expectedSorted.length ||
+        actualSorted.some((name, index) => name !== expectedSorted[index])) {
+        throw new Error(`${label} drifted from the default MCP contract\n` +
+            `expected: ${expected.join(', ')}\n` +
+            `actual:   ${actual.join(', ')}`);
+    }
+}
+//# sourceMappingURL=tool-families.js.map

package/dist/bridge/tool-families.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-families.js","sourceRoot":"","sources":["../../src/bridge/tool-families.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAsB7D,SAAS,YAAY,CAAC,KAAa,EAAE,MAAoC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,KAAK,KAAK,GAAG,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAqC;IAC7D,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;AAE1D,uHAAuH;AACvH,MAAM,UAAU,YAAY,CAC1B,SAAY;IAEZ,OAAO,iBAAiB,CAAC,MAAM,CAC7B,CAAC,MAAM,EAAyD,EAAE,CAChE,MAAM,CAAC,SAAS,KAAK,SAAS,CACjC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,MAAyB,EACzB,QAA2B;IAE3B,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IACE,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAC7C,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,EAClE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,0CAA0C;YAChD,aAAa,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACpC,aAAa,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/bridge/tool-family-records/conformance.d.ts

@@ -0,0 +1,7 @@
+declare const _default: {
+    readonly transport: "in-process";
+    readonly order: 60;
+    readonly tools: readonly ["pyric_can_i_use"];
+};
+export default _default;
+//# sourceMappingURL=conformance.d.ts.map

package/dist/bridge/tool-family-records/conformance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.d.ts","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/conformance.ts"],"names":[],"mappings":";;;;;AACA,wBAIsC"}

package/dist/bridge/tool-family-records/conformance.js

@@ -0,0 +1,6 @@
+export default {
+    transport: 'in-process',
+    order: 60,
+    tools: ['pyric_can_i_use'],
+};
+//# sourceMappingURL=conformance.js.map

package/dist/bridge/tool-family-records/conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.js","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/conformance.ts"],"names":[],"mappings":"AACA,eAAe;IACb,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,CAAC,iBAAiB,CAAC;CACS,CAAC"}

package/dist/bridge/tool-family-records/firestore-data.d.ts

@@ -0,0 +1,7 @@
+declare const _default: {
+    readonly transport: "forwarded";
+    readonly order: 20;
+    readonly tools: readonly ["firestore_get_document", "firestore_list_documents", "firestore_create_document", "firestore_add_document", "firestore_update_document", "firestore_delete_document", "firestore_batch_write", "firestore_query_where"];
+};
+export default _default;
+//# sourceMappingURL=firestore-data.d.ts.map

package/dist/bridge/tool-family-records/firestore-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-data.d.ts","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/firestore-data.ts"],"names":[],"mappings":";;;;;AACA,wBAasC"}

package/dist/bridge/tool-family-records/firestore-data.js

@@ -0,0 +1,15 @@
+export default {
+    transport: 'forwarded',
+    order: 20,
+    tools: [
+        'firestore_get_document',
+        'firestore_list_documents',
+        'firestore_create_document',
+        'firestore_add_document',
+        'firestore_update_document',
+        'firestore_delete_document',
+        'firestore_batch_write',
+        'firestore_query_where',
+    ],
+};
+//# sourceMappingURL=firestore-data.js.map

package/dist/bridge/tool-family-records/firestore-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-data.js","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/firestore-data.ts"],"names":[],"mappings":"AACA,eAAe;IACb,SAAS,EAAE,WAAW;IACtB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE;QACL,wBAAwB;QACxB,0BAA0B;QAC1B,2BAA2B;QAC3B,wBAAwB;QACxB,2BAA2B;QAC3B,2BAA2B;QAC3B,uBAAuB;QACvB,uBAAuB;KACxB;CACkC,CAAC"}

package/dist/bridge/tool-family-records/firestore-inspect.d.ts

@@ -0,0 +1,7 @@
+declare const _default: {
+    readonly transport: "forwarded";
+    readonly order: 30;
+    readonly tools: readonly ["sandbox_inspect"];
+};
+export default _default;
+//# sourceMappingURL=firestore-inspect.d.ts.map

package/dist/bridge/tool-family-records/firestore-inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-inspect.d.ts","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/firestore-inspect.ts"],"names":[],"mappings":";;;;;AACA,wBAIsC"}

package/dist/bridge/tool-family-records/firestore-inspect.js

@@ -0,0 +1,6 @@
+export default {
+    transport: 'forwarded',
+    order: 30,
+    tools: ['sandbox_inspect'],
+};
+//# sourceMappingURL=firestore-inspect.js.map

package/dist/bridge/tool-family-records/firestore-inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-inspect.js","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/firestore-inspect.ts"],"names":[],"mappings":"AACA,eAAe;IACb,SAAS,EAAE,WAAW;IACtB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,CAAC,iBAAiB,CAAC;CACS,CAAC"}

package/dist/bridge/tool-family-records/firestore-rules.d.ts

@@ -0,0 +1,7 @@
+declare const _default: {
+    readonly transport: "in-process";
+    readonly order: 50;
+    readonly tools: readonly ["firestore_simulate_rules", "firestore_rules_stdlib_list", "firestore_rules_stdlib_get", "firestore_lint_rules", "firestore_resolve_modules", "rules_stdlib_list", "rules_stdlib_get", "rules_resolve_modules"];
+};
+export default _default;
+//# sourceMappingURL=firestore-rules.d.ts.map

package/dist/bridge/tool-family-records/firestore-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-rules.d.ts","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/firestore-rules.ts"],"names":[],"mappings":";;;;;AACA,wBAasC"}

package/dist/bridge/tool-family-records/firestore-rules.js

@@ -0,0 +1,15 @@
+export default {
+    transport: 'in-process',
+    order: 50,
+    tools: [
+        'firestore_simulate_rules',
+        'firestore_rules_stdlib_list',
+        'firestore_rules_stdlib_get',
+        'firestore_lint_rules',
+        'firestore_resolve_modules',
+        'rules_stdlib_list',
+        'rules_stdlib_get',
+        'rules_resolve_modules',
+    ],
+};
+//# sourceMappingURL=firestore-rules.js.map

package/dist/bridge/tool-family-records/firestore-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-rules.js","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/firestore-rules.ts"],"names":[],"mappings":"AACA,eAAe;IACb,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE;QACL,0BAA0B;QAC1B,6BAA6B;QAC7B,4BAA4B;QAC5B,sBAAsB;QACtB,2BAA2B;QAC3B,mBAAmB;QACnB,kBAAkB;QAClB,uBAAuB;KACxB;CACkC,CAAC"}

package/dist/bridge/tool-family-records/firestore-simulator.d.ts

@@ -0,0 +1,7 @@
+declare const _default: {
+    readonly transport: "forwarded";
+    readonly order: 10;
+    readonly tools: readonly ["firestore_simulator_create", "firestore_simulator_execute", "firestore_simulator_read", "firestore_simulator_batch", "firestore_create_with_auto_id", "firestore_simulator_undo", "firestore_simulator_redo", "firestore_simulator_events", "firestore_simulator_transaction"];
+};
+export default _default;
+//# sourceMappingURL=firestore-simulator.d.ts.map

package/dist/bridge/tool-family-records/firestore-simulator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-simulator.d.ts","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/firestore-simulator.ts"],"names":[],"mappings":";;;;;AACA,wBAcsC"}

package/dist/bridge/tool-family-records/firestore-simulator.js

@@ -0,0 +1,16 @@
+export default {
+    transport: 'forwarded',
+    order: 10,
+    tools: [
+        'firestore_simulator_create',
+        'firestore_simulator_execute',
+        'firestore_simulator_read',
+        'firestore_simulator_batch',
+        'firestore_create_with_auto_id',
+        'firestore_simulator_undo',
+        'firestore_simulator_redo',
+        'firestore_simulator_events',
+        'firestore_simulator_transaction',
+    ],
+};
+//# sourceMappingURL=firestore-simulator.js.map

package/dist/bridge/tool-family-records/firestore-simulator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-simulator.js","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/firestore-simulator.ts"],"names":[],"mappings":"AACA,eAAe;IACb,SAAS,EAAE,WAAW;IACtB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE;QACL,4BAA4B;QAC5B,6BAA6B;QAC7B,0BAA0B;QAC1B,2BAA2B;QAC3B,+BAA+B;QAC/B,0BAA0B;QAC1B,0BAA0B;QAC1B,4BAA4B;QAC5B,iCAAiC;KAClC;CACkC,CAAC"}

package/dist/bridge/tool-family-records/rtdb-inspection.d.ts

@@ -0,0 +1,7 @@
+declare const _default: {
+    readonly transport: "forwarded";
+    readonly order: 40;
+    readonly tools: readonly ["rtdb_simulate_access", "rtdb_crawl_structure"];
+};
+export default _default;
+//# sourceMappingURL=rtdb-inspection.d.ts.map

package/dist/bridge/tool-family-records/rtdb-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rtdb-inspection.d.ts","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/rtdb-inspection.ts"],"names":[],"mappings":";;;;;AACA,wBAIsC"}

package/dist/bridge/tool-family-records/rtdb-inspection.js

@@ -0,0 +1,6 @@
+export default {
+    transport: 'forwarded',
+    order: 40,
+    tools: ['rtdb_simulate_access', 'rtdb_crawl_structure'],
+};
+//# sourceMappingURL=rtdb-inspection.js.map

package/dist/bridge/tool-family-records/rtdb-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rtdb-inspection.js","sourceRoot":"","sources":["../../../src/bridge/tool-family-records/rtdb-inspection.ts"],"names":[],"mappings":"AACA,eAAe;IACb,SAAS,EAAE,WAAW;IACtB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;CACpB,CAAC"}

package/dist/bundler/externals.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Externalization presets and helpers for Node backend bundlers.
+ *
+ * Prevents backend bundlers (Rolldown, esbuild, tsup, Rollup, Vite, Webpack)
+ * from inlining Firebase and Firebase Admin SDKs into bundled server outputs,
+ * preserving runtime interception by `@pyric/cli/register` under `pyric sandbox`.
+ */
+/**
+ * RegExp patterns matching Firebase packages for bundlers that accept RegExp
+ * in their external configuration (Rolldown, Rollup, Vite, Webpack).
+ */
+export declare const pyricRollupExternals: readonly RegExp[];
+/**
+ * Wildcard string patterns matching Firebase packages for bundlers that require
+ * string arrays with glob wildcards (esbuild, tsup).
+ */
+export declare const pyricEsbuildExternals: readonly string[];
+/**
+ * Universal predicate returning true if a module specifier belongs to Firebase
+ * or Firebase Admin SDK surfaces intercepted by Pyric.
+ *
+ * Compatible with bundlers that accept a function in their external setting
+ * (Rolldown, Rollup, Vite, Webpack).
+ */
+export declare function isPyricExternal(id: string): boolean;
+/**
+ * Convenience presets mapping bundler names to their supported external pattern format.
+ */
+export declare const pyricExternals: Readonly<{
+    rolldown: readonly RegExp[];
+    rollup: readonly RegExp[];
+    vite: readonly RegExp[];
+    webpack: readonly RegExp[];
+    esbuild: readonly string[];
+    tsup: readonly string[];
+}>;
+//# sourceMappingURL=externals.d.ts.map

package/dist/bundler/externals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"externals.d.ts","sourceRoot":"","sources":["../../src/bundler/externals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAIhD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAMjD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAKnD;AAED;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;;EAOzB,CAAC"}

package/dist/bundler/externals.js

@@ -0,0 +1,52 @@
+/**
+ * Externalization presets and helpers for Node backend bundlers.
+ *
+ * Prevents backend bundlers (Rolldown, esbuild, tsup, Rollup, Vite, Webpack)
+ * from inlining Firebase and Firebase Admin SDKs into bundled server outputs,
+ * preserving runtime interception by `@pyric/cli/register` under `pyric sandbox`.
+ */
+/**
+ * RegExp patterns matching Firebase packages for bundlers that accept RegExp
+ * in their external configuration (Rolldown, Rollup, Vite, Webpack).
+ */
+export const pyricRollupExternals = Object.freeze([
+    /^firebase-admin(\/.*)?$/,
+    /^firebase(\/.*)?$/,
+    /^@firebase(\/.*)?$/,
+]);
+/**
+ * Wildcard string patterns matching Firebase packages for bundlers that require
+ * string arrays with glob wildcards (esbuild, tsup).
+ */
+export const pyricEsbuildExternals = Object.freeze([
+    'firebase-admin',
+    'firebase-admin/*',
+    'firebase',
+    'firebase/*',
+    '@firebase/*',
+]);
+/**
+ * Universal predicate returning true if a module specifier belongs to Firebase
+ * or Firebase Admin SDK surfaces intercepted by Pyric.
+ *
+ * Compatible with bundlers that accept a function in their external setting
+ * (Rolldown, Rollup, Vite, Webpack).
+ */
+export function isPyricExternal(id) {
+    if (typeof id !== 'string' || id.length === 0) {
+        return false;
+    }
+    return pyricRollupExternals.some((regex) => regex.test(id));
+}
+/**
+ * Convenience presets mapping bundler names to their supported external pattern format.
+ */
+export const pyricExternals = Object.freeze({
+    rolldown: pyricRollupExternals,
+    rollup: pyricRollupExternals,
+    vite: pyricRollupExternals,
+    webpack: pyricRollupExternals,
+    esbuild: pyricEsbuildExternals,
+    tsup: pyricEsbuildExternals,
+});
+//# sourceMappingURL=externals.js.map

package/dist/bundler/externals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"externals.js","sourceRoot":"","sources":["../../src/bundler/externals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACnE,yBAAyB;IACzB,mBAAmB;IACnB,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,gBAAgB;IAChB,kBAAkB;IAClB,UAAU;IACV,YAAY;IACZ,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,oBAAoB;IAC9B,MAAM,EAAE,oBAAoB;IAC5B,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,qBAAqB;IAC9B,IAAI,EAAE,qBAAqB;CAC5B,CAAC,CAAC"}

package/dist/bundler/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `@pyric/cli/bundler` — externalization presets and helpers for Node backend
+ * bundlers (Rolldown, esbuild, tsup, Rollup, Vite) to preserve `@pyric/cli/register`
+ * runtime sandbox interception.
+ *
+ *   // rolldown.config.ts / rollup.config.js
+ *   import { pyricExternals } from '@pyric/cli/bundler';
+ *   export default { external: pyricExternals.rolldown };
+ *
+ *   // vite.config.ts (SSR / Node backend builds)
+ *   export default { build: { rollupOptions: { external: pyricExternals.vite } } };
+ *
+ *   // tsup.config.ts / esbuild.config.mjs
+ *   export default { external: pyricExternals.esbuild };
+ */
+export { pyricRollupExternals, pyricEsbuildExternals, isPyricExternal, pyricExternals, } from './externals.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/bundler/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bundler/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,gBAAgB,CAAC"}

package/dist/bundler/index.js

@@ -0,0 +1,17 @@
+/**
+ * `@pyric/cli/bundler` — externalization presets and helpers for Node backend
+ * bundlers (Rolldown, esbuild, tsup, Rollup, Vite) to preserve `@pyric/cli/register`
+ * runtime sandbox interception.
+ *
+ *   // rolldown.config.ts / rollup.config.js
+ *   import { pyricExternals } from '@pyric/cli/bundler';
+ *   export default { external: pyricExternals.rolldown };
+ *
+ *   // vite.config.ts (SSR / Node backend builds)
+ *   export default { build: { rollupOptions: { external: pyricExternals.vite } } };
+ *
+ *   // tsup.config.ts / esbuild.config.mjs
+ *   export default { external: pyricExternals.esbuild };
+ */
+export { pyricRollupExternals, pyricEsbuildExternals, isPyricExternal, pyricExternals, } from './externals.js';
+//# sourceMappingURL=index.js.map

package/dist/bundler/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/bundler/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,gBAAgB,CAAC"}

package/dist/cli/index.d.ts

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /**
- * `pyric` CLI — front door to the bridge + project tooling.
+ * `pyric` CLI front door to the bridge and project tooling.
  *
  * Subcommands:
  *   pyric bridge [--port N] [--project ID]
- *   pyric dev [--port N] [--host H] [--no-cache] [--bridge] [--ui] [--seed FILE] [--no-watch] [--no-open] [--no-capture] [--no-run] [--json] [--persist] [--fresh] [-- <cmd>]
+ *   pyric sandbox [flags] [--] [command...]
  *   pyric init [dir] [--template web|node] [--name N] [--force] [--json]
  *   pyric vendor [dir] [--json]
  *   pyric snapshot [--out FILE] [--port N] [--force] [--json] [--include-passwords]