npm - @pyric/cli - Versions diffs - 0.1.0-alpha.20 → 0.1.0-alpha.21 - Mend

@pyric/cli 0.1.0-alpha.20 → 0.1.0-alpha.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (491) hide show

package/dist/serve/site-ui/docs/pyric-sandbox-reference-api/index.html CHANGED Viewed

@@ -2,7 +2,7 @@
 <link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.Da5VLhW1.css">
 <style>:root{--rhythm-para: .875rem;--rhythm-group: 1.5rem;--rhythm-subsection: 2.25rem;--rhythm-section: 3.25rem;--rhythm-list: calc(var(--rhythm-para) * .75)}.prose>*,.prose blockquote>*,.prose li>*,.prose .compat-stat>*{margin-block:0}.prose>*+*{margin-block-start:var(--rhythm-group)}.prose>*+h2{margin-block-start:var(--rhythm-section)}.prose>*+h3,.prose>*+h4{margin-block-start:var(--rhythm-subsection)}.prose>h1+*,.prose>h2+*,.prose>h3+*,.prose>h4+*{margin-block-start:var(--rhythm-para)}.prose>p+p{margin-block-start:var(--rhythm-para)}.prose>p+ul,.prose>p+ol,.prose>p+blockquote{margin-block-start:var(--rhythm-para)}.prose li+li{margin-block-start:var(--rhythm-list)}.prose li>ul,.prose li>ol{margin-block-start:var(--rhythm-list)}.prose li>*+*,.prose blockquote>*+*{margin-block-start:var(--rhythm-para)}
 html{scrollbar-gutter:stable}
-</style></head> <body>  <header class="studio__chrome"> <div class="studio__bar"> <div class="studio__chrome-inner"> <nav class="studio__nav" aria-label="Site"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric">pyric</a> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a><a class="studio__nav-tab" href="/__pyric/ui/studio"> Studio </a> </nav> </div> </div> </header> <div class="docs-shell" data-astro-cid-mw7aashj>  <details class="docs-nav-drawer" data-astro-cid-mw7aashj> <summary data-astro-cid-mw7aashj>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <details class="docs-nav-group"> <summary>Overview</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/overview/"> Overview </a> </li><li> <a href="/__pyric/ui/docs/tutorial/"> Tutorial </a> </li><li> <a href="/__pyric/ui/docs/examples/"> Examples </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Get started</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/get-started/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/get-started/vite/"> Vite </a> </li><li> <a href="/__pyric/ui/docs/get-started/nextjs/"> Next.js </a> </li><li> <a href="/__pyric/ui/docs/get-started/how-the-swap-works/"> How the swap works </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Build</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/build/authentication/"> Authentication </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-firestore/"> Cloud Firestore </a> </li><li> <a href="/__pyric/ui/docs/build/realtime-database/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-storage/"> Cloud Storage </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-messaging/"> Cloud Messaging </a> </li><li> <a href="/__pyric/ui/docs/build/ai-logic/"> AI Logic </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Secure &amp; debug</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/secure/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/secure/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/secure/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/secure/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/secure/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/secure/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/secure/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/secure/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Examples </h2> <ul> <li> <a href="/__pyric/ui/docs/examples/chess/"> Chess showcase </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Observe &amp; shape</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/observe/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/observe/resolve-runtime-status/"> Runtime status </a> </li><li> <a href="/__pyric/ui/docs/observe/shape-your-data/"> Seed, snapshot, replay </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship &amp; test</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/ship/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Work with an agent</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/agent/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/agent/work-with-an-agent/"> Use the MCP tools </a> </li><li> <a href="/__pyric/ui/docs/agent/watch-and-review/"> Watch in Pyric Studio </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Trust</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/trust/versioning-and-compatibility/"> Versioning and the fb tag </a> </li><li> <a href="/__pyric/ui/docs/trust/rules-standard-library/"> Rules standard library reference </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/trust/how-we-know-it-matches-firebase/"> How we know it matches Firebase </a> </li><li> <a href="/__pyric/ui/docs/app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/functions-rtdb-compat/"> Functions · RTDB </a> </li><li> <a href="/__pyric/ui/docs/rules-compat/"> Rules </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" open> <summary>Reference</summary> <div class="docs-nav-group-body docs-nav-group-body--reference"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">pyric</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-app-reference-api/"> pyric/app </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-api/"> pyric/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-api/"> pyric/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-reference-api/"> pyric/ai </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-scripting-reference-api/"> pyric/ai/scripting </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-reference-api/"> pyric/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-api/"> pyric/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-reference-api/"> pyric/messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-sw-reference-api/"> pyric/messaging/sw </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-api/"> pyric/rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-api/" aria-current="page"> pyric/sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-firestore-reference-api/"> pyric/sandbox/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-database-reference-api/"> pyric/sandbox/database </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">pyric-admin</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-reference-api/"> pyric-admin </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app-reference-api/"> pyric-admin/app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-api/"> pyric-admin/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth-reference-api/"> pyric-admin/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database-reference-api/"> pyric-admin/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage-reference-api/"> pyric-admin/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-messaging-reference-api/"> pyric-admin/messaging </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">create-pyric</h2> <ul> <li> <a href="/__pyric/ui/docs/create-pyric-reference-api/"> create-pyric </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/cli</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-credentials-node-reference-api/"> @pyric/cli/credentials/node </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-verify-reference-api/"> @pyric/cli/verify </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-reference-api/"> @pyric/cli/conformance </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-browser-reference-api/"> @pyric/cli/conformance/browser </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-docs-reference-api/"> @pyric/cli/conformance/docs </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-assurance-reference-api/"> @pyric/cli/assurance </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-assurance-browser-reference-api/"> @pyric/cli/assurance/browser </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bridge-reference-api/"> @pyric/cli/bridge </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bridge-client-reference-api/"> @pyric/cli/bridge/client </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-discover-reference-api/"> @pyric/cli/discover </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-vite-reference-api/"> @pyric/cli/vite </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-next-reference-api/"> @pyric/cli/next </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-serve-worker-reference-api/"> @pyric/cli/serve/worker </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-remote-reference-api/"> @pyric/cli/remote </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-register-reference-api/"> @pyric/cli/register </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-register-app-bridge-reference-api/"> @pyric/cli/register/app-bridge </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/ui</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-ui-auth-reference-api/"> @pyric/ui/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-auth-hooks-reference-api/"> @pyric/ui/auth/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-primitives-reference-api/"> @pyric/ui/primitives </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-firestore-reference-api/"> @pyric/ui/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-firestore-hooks-reference-api/"> @pyric/ui/firestore/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rtdb-reference-api/"> @pyric/ui/rtdb </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-storage-reference-api/"> @pyric/ui/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-storage-hooks-reference-api/"> @pyric/ui/storage/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-traffic-reference-api/"> @pyric/ui/traffic </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-traffic-hooks-reference-api/"> @pyric/ui/traffic/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-events-reference-api/"> @pyric/ui/events </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-events-hooks-reference-api/"> @pyric/ui/events/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-agents-reference-api/"> @pyric/ui/agents </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rules-reference-api/"> @pyric/ui/rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rules-hooks-reference-api/"> @pyric/ui/rules/hooks </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/cli</h2> <ul> <li> <a href="/__pyric/ui/docs/reference/cli/"> CLI </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <details class="docs-nav-group" id="nav-group-overview"> <summary>Overview</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/overview/"> Overview </a> </li><li> <a href="/__pyric/ui/docs/tutorial/"> Tutorial </a> </li><li> <a href="/__pyric/ui/docs/examples/"> Examples </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-get-started"> <summary>Get started</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/get-started/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/get-started/vite/"> Vite </a> </li><li> <a href="/__pyric/ui/docs/get-started/nextjs/"> Next.js </a> </li><li> <a href="/__pyric/ui/docs/get-started/how-the-swap-works/"> How the swap works </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-build"> <summary>Build</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/build/authentication/"> Authentication </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-firestore/"> Cloud Firestore </a> </li><li> <a href="/__pyric/ui/docs/build/realtime-database/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-storage/"> Cloud Storage </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-messaging/"> Cloud Messaging </a> </li><li> <a href="/__pyric/ui/docs/build/ai-logic/"> AI Logic </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-secure-debug"> <summary>Secure &amp; debug</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/secure/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/secure/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/secure/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/secure/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/secure/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/secure/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/secure/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/secure/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-secure-debug-examples"> Examples </h2> <ul> <li> <a href="/__pyric/ui/docs/examples/chess/"> Chess showcase </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-observe-shape"> <summary>Observe &amp; shape</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/observe/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/observe/resolve-runtime-status/"> Runtime status </a> </li><li> <a href="/__pyric/ui/docs/observe/shape-your-data/"> Seed, snapshot, replay </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-test"> <summary>Ship &amp; test</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/ship/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-work-with-an-agent"> <summary>Work with an agent</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/agent/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/agent/work-with-an-agent/"> Use the MCP tools </a> </li><li> <a href="/__pyric/ui/docs/agent/watch-and-review/"> Watch in Pyric Studio </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-trust"> <summary>Trust</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/trust/versioning-and-compatibility/"> Versioning and the fb tag </a> </li><li> <a href="/__pyric/ui/docs/trust/rules-standard-library/"> Rules standard library reference </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/trust/how-we-know-it-matches-firebase/"> How we know it matches Firebase </a> </li><li> <a href="/__pyric/ui/docs/app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/functions-rtdb-compat/"> Functions · RTDB </a> </li><li> <a href="/__pyric/ui/docs/rules-compat/"> Rules </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference" open> <summary>Reference</summary> <div class="docs-nav-group-body docs-nav-group-body--reference"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">pyric</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-app-reference-api/"> pyric/app </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-api/"> pyric/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-api/"> pyric/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-reference-api/"> pyric/ai </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-scripting-reference-api/"> pyric/ai/scripting </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-reference-api/"> pyric/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-api/"> pyric/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-reference-api/"> pyric/messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-sw-reference-api/"> pyric/messaging/sw </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-api/"> pyric/rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-api/" aria-current="page"> pyric/sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-firestore-reference-api/"> pyric/sandbox/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-database-reference-api/"> pyric/sandbox/database </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">pyric-admin</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-reference-api/"> pyric-admin </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app-reference-api/"> pyric-admin/app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-api/"> pyric-admin/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth-reference-api/"> pyric-admin/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database-reference-api/"> pyric-admin/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage-reference-api/"> pyric-admin/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-messaging-reference-api/"> pyric-admin/messaging </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">create-pyric</h2> <ul> <li> <a href="/__pyric/ui/docs/create-pyric-reference-api/"> create-pyric </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/cli</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-credentials-node-reference-api/"> @pyric/cli/credentials/node </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-verify-reference-api/"> @pyric/cli/verify </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-reference-api/"> @pyric/cli/conformance </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-browser-reference-api/"> @pyric/cli/conformance/browser </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-docs-reference-api/"> @pyric/cli/conformance/docs </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-assurance-reference-api/"> @pyric/cli/assurance </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-assurance-browser-reference-api/"> @pyric/cli/assurance/browser </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bridge-reference-api/"> @pyric/cli/bridge </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bridge-client-reference-api/"> @pyric/cli/bridge/client </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-discover-reference-api/"> @pyric/cli/discover </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-vite-reference-api/"> @pyric/cli/vite </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-next-reference-api/"> @pyric/cli/next </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-serve-worker-reference-api/"> @pyric/cli/serve/worker </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-remote-reference-api/"> @pyric/cli/remote </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-register-reference-api/"> @pyric/cli/register </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-register-app-bridge-reference-api/"> @pyric/cli/register/app-bridge </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/ui</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-ui-auth-reference-api/"> @pyric/ui/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-auth-hooks-reference-api/"> @pyric/ui/auth/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-primitives-reference-api/"> @pyric/ui/primitives </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-firestore-reference-api/"> @pyric/ui/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-firestore-hooks-reference-api/"> @pyric/ui/firestore/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rtdb-reference-api/"> @pyric/ui/rtdb </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-storage-reference-api/"> @pyric/ui/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-storage-hooks-reference-api/"> @pyric/ui/storage/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-traffic-reference-api/"> @pyric/ui/traffic </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-traffic-hooks-reference-api/"> @pyric/ui/traffic/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-events-reference-api/"> @pyric/ui/events </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-events-hooks-reference-api/"> @pyric/ui/events/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-agents-reference-api/"> @pyric/ui/agents </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rules-reference-api/"> @pyric/ui/rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rules-hooks-reference-api/"> @pyric/ui/rules/hooks </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/cli</h2> <ul> <li> <a href="/__pyric/ui/docs/reference/cli/"> CLI </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main" data-astro-cid-mw7aashj> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/api-reference/">API reference</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span>pyric</span> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">pyric/sandbox</span> </li> </ol> </nav> <header class="api-reference-header" data-astro-cid-mw7aashj> <p class="api-reference-kicker" data-astro-cid-mw7aashj>API reference</p> <h1 data-astro-cid-mw7aashj><code data-astro-cid-mw7aashj>pyric/sandbox</code></h1> <p class="api-reference-meta" data-astro-cid-mw7aashj> 73 published symbols from <code data-astro-cid-mw7aashj>pyric</code> </p> <p class="api-reference-source" data-astro-cid-mw7aashj>
+</style></head> <body>  <header class="studio__chrome"> <div class="studio__bar"> <div class="studio__chrome-inner"> <nav class="studio__nav" aria-label="Site"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric">pyric</a> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a><a class="studio__nav-tab" href="/__pyric/ui/studio"> Studio </a> </nav> </div> </div> </header> <div class="docs-shell" data-astro-cid-mw7aashj>  <details class="docs-nav-drawer" data-astro-cid-mw7aashj> <summary data-astro-cid-mw7aashj>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <details class="docs-nav-group"> <summary>Overview</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/overview/"> Overview </a> </li><li> <a href="/__pyric/ui/docs/tutorial/"> Tutorial </a> </li><li> <a href="/__pyric/ui/docs/examples/"> Examples </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Get started</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/get-started/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/get-started/vite/"> Vite </a> </li><li> <a href="/__pyric/ui/docs/get-started/nextjs/"> Next.js </a> </li><li> <a href="/__pyric/ui/docs/get-started/backend-bundlers/"> Backend bundlers </a> </li><li> <a href="/__pyric/ui/docs/get-started/how-the-swap-works/"> How the swap works </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Build</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/build/authentication/"> Authentication </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-firestore/"> Cloud Firestore </a> </li><li> <a href="/__pyric/ui/docs/build/realtime-database/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-storage/"> Cloud Storage </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-messaging/"> Cloud Messaging </a> </li><li> <a href="/__pyric/ui/docs/build/ai-logic/"> AI Logic </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Secure &amp; debug</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/secure/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/secure/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/secure/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/secure/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/secure/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/secure/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/secure/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/secure/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Examples </h2> <ul> <li> <a href="/__pyric/ui/docs/examples/chess/"> Chess showcase </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Observe &amp; shape</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/observe/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/observe/resolve-runtime-status/"> Runtime status </a> </li><li> <a href="/__pyric/ui/docs/observe/shape-your-data/"> Seed, snapshot, replay </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship &amp; test</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/ship/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Work with an agent</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/agent/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/agent/work-with-an-agent/"> Use the MCP tools </a> </li><li> <a href="/__pyric/ui/docs/agent/watch-and-review/"> Watch in Pyric Studio </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Trust</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/trust/versioning-and-compatibility/"> Versioning and the fb tag </a> </li><li> <a href="/__pyric/ui/docs/trust/rules-standard-library/"> Rules standard library reference </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/trust/how-we-know-it-matches-firebase/"> How we know it matches Firebase </a> </li><li> <a href="/__pyric/ui/docs/app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/functions-rtdb-compat/"> Functions · RTDB </a> </li><li> <a href="/__pyric/ui/docs/rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/firestore-flutter-compat/"> Firestore · Flutter </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" open> <summary>Reference</summary> <div class="docs-nav-group-body docs-nav-group-body--reference"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">pyric</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-app-reference-api/"> pyric/app </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-api/"> pyric/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-lite-reference-api/"> pyric/firestore/lite </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-api/"> pyric/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-reference-api/"> pyric/ai </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-scripting-reference-api/"> pyric/ai/scripting </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-reference-api/"> pyric/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-api/"> pyric/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-reference-api/"> pyric/messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-sw-reference-api/"> pyric/messaging/sw </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-api/"> pyric/rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-api/" aria-current="page"> pyric/sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-firestore-reference-api/"> pyric/sandbox/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-database-reference-api/"> pyric/sandbox/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-check-reference-api/"> pyric/app-check </a> </li><li> <a href="/__pyric/ui/docs/pyric-functions-reference-api/"> pyric/functions </a> </li><li> <a href="/__pyric/ui/docs/pyric-analytics-reference-api/"> pyric/analytics </a> </li><li> <a href="/__pyric/ui/docs/pyric-performance-reference-api/"> pyric/performance </a> </li><li> <a href="/__pyric/ui/docs/pyric-remote-config-reference-api/"> pyric/remote-config </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">pyric-admin</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-reference-api/"> pyric-admin </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app-reference-api/"> pyric-admin/app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-api/"> pyric-admin/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth-reference-api/"> pyric-admin/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database-reference-api/"> pyric-admin/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage-reference-api/"> pyric-admin/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-messaging-reference-api/"> pyric-admin/messaging </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">create-pyric</h2> <ul> <li> <a href="/__pyric/ui/docs/create-pyric-reference-api/"> create-pyric </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/cli</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-credentials-node-reference-api/"> @pyric/cli/credentials/node </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-verify-reference-api/"> @pyric/cli/verify </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-reference-api/"> @pyric/cli/conformance </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-browser-reference-api/"> @pyric/cli/conformance/browser </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-docs-reference-api/"> @pyric/cli/conformance/docs </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-assurance-reference-api/"> @pyric/cli/assurance </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-assurance-browser-reference-api/"> @pyric/cli/assurance/browser </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bridge-reference-api/"> @pyric/cli/bridge </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bridge-client-reference-api/"> @pyric/cli/bridge/client </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-discover-reference-api/"> @pyric/cli/discover </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-vite-reference-api/"> @pyric/cli/vite </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-next-reference-api/"> @pyric/cli/next </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bundler-reference-api/"> @pyric/cli/bundler </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-serve-worker-reference-api/"> @pyric/cli/serve/worker </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-remote-reference-api/"> @pyric/cli/remote </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-register-reference-api/"> @pyric/cli/register </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-register-app-bridge-reference-api/"> @pyric/cli/register/app-bridge </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/ui</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-ui-auth-reference-api/"> @pyric/ui/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-auth-hooks-reference-api/"> @pyric/ui/auth/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-primitives-reference-api/"> @pyric/ui/primitives </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-firestore-reference-api/"> @pyric/ui/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-firestore-hooks-reference-api/"> @pyric/ui/firestore/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rtdb-reference-api/"> @pyric/ui/rtdb </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-storage-reference-api/"> @pyric/ui/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-storage-hooks-reference-api/"> @pyric/ui/storage/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-traffic-reference-api/"> @pyric/ui/traffic </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-traffic-hooks-reference-api/"> @pyric/ui/traffic/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-events-reference-api/"> @pyric/ui/events </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-events-hooks-reference-api/"> @pyric/ui/events/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-agents-reference-api/"> @pyric/ui/agents </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rules-reference-api/"> @pyric/ui/rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rules-hooks-reference-api/"> @pyric/ui/rules/hooks </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/cli</h2> <ul> <li> <a href="/__pyric/ui/docs/reference/cli/"> CLI </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <details class="docs-nav-group" id="nav-group-overview"> <summary>Overview</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/overview/"> Overview </a> </li><li> <a href="/__pyric/ui/docs/tutorial/"> Tutorial </a> </li><li> <a href="/__pyric/ui/docs/examples/"> Examples </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-get-started"> <summary>Get started</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/get-started/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/get-started/vite/"> Vite </a> </li><li> <a href="/__pyric/ui/docs/get-started/nextjs/"> Next.js </a> </li><li> <a href="/__pyric/ui/docs/get-started/backend-bundlers/"> Backend bundlers </a> </li><li> <a href="/__pyric/ui/docs/get-started/how-the-swap-works/"> How the swap works </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-build"> <summary>Build</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/build/authentication/"> Authentication </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-firestore/"> Cloud Firestore </a> </li><li> <a href="/__pyric/ui/docs/build/realtime-database/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-storage/"> Cloud Storage </a> </li><li> <a href="/__pyric/ui/docs/build/cloud-messaging/"> Cloud Messaging </a> </li><li> <a href="/__pyric/ui/docs/build/ai-logic/"> AI Logic </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-secure-debug"> <summary>Secure &amp; debug</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/secure/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/secure/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/secure/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/secure/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/secure/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/secure/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/secure/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/secure/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-secure-debug-examples"> Examples </h2> <ul> <li> <a href="/__pyric/ui/docs/examples/chess/"> Chess showcase </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-observe-shape"> <summary>Observe &amp; shape</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/observe/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/observe/resolve-runtime-status/"> Runtime status </a> </li><li> <a href="/__pyric/ui/docs/observe/shape-your-data/"> Seed, snapshot, replay </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-test"> <summary>Ship &amp; test</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/ship/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-work-with-an-agent"> <summary>Work with an agent</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/agent/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/agent/work-with-an-agent/"> Use the MCP tools </a> </li><li> <a href="/__pyric/ui/docs/agent/watch-and-review/"> Watch in Pyric Studio </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-trust"> <summary>Trust</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/trust/versioning-and-compatibility/"> Versioning and the fb tag </a> </li><li> <a href="/__pyric/ui/docs/trust/rules-standard-library/"> Rules standard library reference </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/trust/how-we-know-it-matches-firebase/"> How we know it matches Firebase </a> </li><li> <a href="/__pyric/ui/docs/app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/functions-rtdb-compat/"> Functions · RTDB </a> </li><li> <a href="/__pyric/ui/docs/rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/firestore-flutter-compat/"> Firestore · Flutter </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference" open> <summary>Reference</summary> <div class="docs-nav-group-body docs-nav-group-body--reference"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">pyric</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-app-reference-api/"> pyric/app </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-api/"> pyric/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-lite-reference-api/"> pyric/firestore/lite </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-api/"> pyric/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-reference-api/"> pyric/ai </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-scripting-reference-api/"> pyric/ai/scripting </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-reference-api/"> pyric/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-api/"> pyric/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-reference-api/"> pyric/messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-sw-reference-api/"> pyric/messaging/sw </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-api/"> pyric/rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-api/" aria-current="page"> pyric/sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-firestore-reference-api/"> pyric/sandbox/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-database-reference-api/"> pyric/sandbox/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-check-reference-api/"> pyric/app-check </a> </li><li> <a href="/__pyric/ui/docs/pyric-functions-reference-api/"> pyric/functions </a> </li><li> <a href="/__pyric/ui/docs/pyric-analytics-reference-api/"> pyric/analytics </a> </li><li> <a href="/__pyric/ui/docs/pyric-performance-reference-api/"> pyric/performance </a> </li><li> <a href="/__pyric/ui/docs/pyric-remote-config-reference-api/"> pyric/remote-config </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">pyric-admin</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-reference-api/"> pyric-admin </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app-reference-api/"> pyric-admin/app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-api/"> pyric-admin/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth-reference-api/"> pyric-admin/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database-reference-api/"> pyric-admin/database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage-reference-api/"> pyric-admin/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-messaging-reference-api/"> pyric-admin/messaging </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">create-pyric</h2> <ul> <li> <a href="/__pyric/ui/docs/create-pyric-reference-api/"> create-pyric </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/cli</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-credentials-node-reference-api/"> @pyric/cli/credentials/node </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-verify-reference-api/"> @pyric/cli/verify </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-reference-api/"> @pyric/cli/conformance </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-browser-reference-api/"> @pyric/cli/conformance/browser </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-conformance-docs-reference-api/"> @pyric/cli/conformance/docs </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-assurance-reference-api/"> @pyric/cli/assurance </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-assurance-browser-reference-api/"> @pyric/cli/assurance/browser </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bridge-reference-api/"> @pyric/cli/bridge </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bridge-client-reference-api/"> @pyric/cli/bridge/client </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-discover-reference-api/"> @pyric/cli/discover </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-vite-reference-api/"> @pyric/cli/vite </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-next-reference-api/"> @pyric/cli/next </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-bundler-reference-api/"> @pyric/cli/bundler </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-serve-worker-reference-api/"> @pyric/cli/serve/worker </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-remote-reference-api/"> @pyric/cli/remote </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-register-reference-api/"> @pyric/cli/register </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-register-app-bridge-reference-api/"> @pyric/cli/register/app-bridge </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/ui</h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-ui-auth-reference-api/"> @pyric/ui/auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-auth-hooks-reference-api/"> @pyric/ui/auth/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-primitives-reference-api/"> @pyric/ui/primitives </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-firestore-reference-api/"> @pyric/ui/firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-firestore-hooks-reference-api/"> @pyric/ui/firestore/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rtdb-reference-api/"> @pyric/ui/rtdb </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-storage-reference-api/"> @pyric/ui/storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-storage-hooks-reference-api/"> @pyric/ui/storage/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-traffic-reference-api/"> @pyric/ui/traffic </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-traffic-hooks-reference-api/"> @pyric/ui/traffic/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-events-reference-api/"> @pyric/ui/events </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-events-hooks-reference-api/"> @pyric/ui/events/hooks </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-agents-reference-api/"> @pyric/ui/agents </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rules-reference-api/"> @pyric/ui/rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-ui-rules-hooks-reference-api/"> @pyric/ui/rules/hooks </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading">@pyric/cli</h2> <ul> <li> <a href="/__pyric/ui/docs/reference/cli/"> CLI </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main" data-astro-cid-mw7aashj> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/api-reference/">API reference</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span>pyric</span> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">pyric/sandbox</span> </li> </ol> </nav> <header class="api-reference-header" data-astro-cid-mw7aashj> <p class="api-reference-kicker" data-astro-cid-mw7aashj>API reference</p> <h1 data-astro-cid-mw7aashj><code data-astro-cid-mw7aashj>pyric/sandbox</code></h1> <p class="api-reference-meta" data-astro-cid-mw7aashj> 75 published symbols from <code data-astro-cid-mw7aashj>pyric</code> </p> <p class="api-reference-source" data-astro-cid-mw7aashj>
 Generated from the TypeScript declarations shipped at this import path.
 </p>  </header> <article class="prose api-reference-body" data-astro-cid-mw7aashj> <!-- Generated from published package declarations via TypeDoc. Rendered by the api-reference content loader. -->
 <h2 id="classes">Classes</h2>
@@ -57,7 +57,8 @@ factories; consumers don’t construct it directly.</p>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">new</span><span style="color:#61AFEF"> SandboxContextImpl</span><span style="color:#ABB2BF">(</span></span>
 <span class="line"><span style="color:#E06C75">   sandbox</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">Sandbox</span><span style="color:#ABB2BF">,</span></span>
 <span class="line"><span style="color:#E06C75">   auth</span><span style="color:#ABB2BF">: {</span></span>
-<span class="line"><span style="color:#ABB2BF">  token?: </span><span style="color:#E06C75">Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, unknown>;</span></span>
+<span class="line"><span style="color:#ABB2BF">  tenant?: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, unknown>;</span></span>
 <span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#ABB2BF">},</span></span>
 <span class="line"><span style="color:#E06C75">   operationContext</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> OperationContext</span><span style="color:#ABB2BF">): </span><span style="color:#E06C75">SandboxContextImpl</span><span style="color:#ABB2BF">;</span></span></code></pre>
@@ -91,7 +92,11 @@ factories; consumers don’t construct it directly.</p>
-<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>sandbox</code></td><td align="left"><a href="/docs/pyric-firestore-reference-api/#sandbox"><code>Sandbox</code></a></td></tr><tr><td align="left"><code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>operationContext?</code></td><td align="left"><a href="#operationcontext-2"><code>OperationContext</code></a></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>sandbox</code></td><td align="left"><a href="/docs/pyric-firestore-reference-api/#sandbox"><code>Sandbox</code></a></td></tr><tr><td align="left"><code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>operationContext?</code></td><td align="left"><a href="#operationcontext-2"><code>OperationContext</code></a></td></tr></tbody></table></div>
 <h6 id="returns-1">Returns</h6>
 <p><a href="#sandboxcontextimpl"><code>SandboxContextImpl</code></a></p>
 <h4 id="properties">Properties</h4>
@@ -136,12 +141,19 @@ factories; consumers don’t construct it directly.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="auth"></a> <code>auth</code></td><td align="left"><code>readonly</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">The identity rules evaluate under for operations through this context.</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="operationcontext"></a> <code>operationContext</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#operationcontext-2"><code>OperationContext</code></a></td><td align="left">Immutable provenance bound to every operation issued through this handle.</td></tr><tr><td align="left"><a id="sandbox"></a> <code>sandbox</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="/docs/pyric-firestore-reference-api/#sandbox"><code>Sandbox</code></a></td><td align="left">The data foundation this context operates against.</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="auth"></a> <code>auth</code></td><td align="left"><code>readonly</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">The identity rules evaluate under for operations through this context.</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="operationcontext"></a> <code>operationContext</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#operationcontext-2"><code>OperationContext</code></a></td><td align="left">Immutable provenance bound to every operation issued through this handle.</td></tr><tr><td align="left"><a id="sandbox"></a> <code>sandbox</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="/docs/pyric-firestore-reference-api/#sandbox"><code>Sandbox</code></a></td><td align="left">The data foundation this context operates against.</td></tr></tbody></table></div>
 <h4 id="methods">Methods</h4>
 <p><a id="withauth"></a></p>
 <h5 id="withauth">withAuth()</h5>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#61AFEF">withAuth</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">auth</span><span style="color:#ABB2BF">: {</span></span>
-<span class="line"><span style="color:#ABB2BF">  token?: </span><span style="color:#E06C75">Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, unknown>;</span></span>
+<span class="line"><span style="color:#ABB2BF">  tenant?: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, unknown>;</span></span>
 <span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#ABB2BF">}): </span><span style="color:#E06C75">SandboxContext</span><span style="color:#ABB2BF">;</span></span></code></pre>
 <p>Derive a sibling context on the same sandbox with different auth.
@@ -169,7 +181,11 @@ optional plan identity.</p>
-<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
 <h6 id="returns-2">Returns</h6>
 <p><a href="/docs/pyric-firestore-reference-api/#sandboxcontext"><code>SandboxContext</code></a></p>
 <h6 id="implementation-of">Implementation of</h6>
@@ -518,7 +534,13 @@ reference traces.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="auth-1"></a> <code>auth?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">Auth identity that was active when the denial fired.</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="failedfields"></a> <code>failedFields?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code>[]</td><td align="left">Field paths in <code>request.resource.data</code> that the rule referenced and that failed.</td></tr><tr><td align="left"><a id="query"></a> <code>query?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>limit?</code>: <code>number</code>; <code>offset?</code>: <code>number</code>; <code>orderBy?</code>: <code>string</code>; <code>where?</code>: readonly { <code>field</code>: <code>string</code>; <code>op</code>: <code>string</code>; <code>value</code>: <code>string</code> | <code>number</code> | <code>boolean</code>; }[]; }</td><td align="left">Machine-readable descriptor of the denied query’s where/orderBy/limit shape (RULES-B11). Populated when a <code>list</code>/query is denied as statically unprovable (“rules are not filters”), so consumers can render the exact query the engine rejected without re-deriving it. Absent for single-doc and non-query denials.</td></tr><tr><td align="left"><code>query.limit?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>query.offset?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>query.orderBy?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>query.where?</code></td><td align="left"><code>readonly</code></td><td align="left">readonly { <code>field</code>: <code>string</code>; <code>op</code>: <code>string</code>; <code>value</code>: <code>string</code> | <code>number</code> | <code>boolean</code>; }[]</td><td align="left">-</td></tr><tr><td align="left"><a id="reasons"></a> <code>reasons?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code>[]</td><td align="left">Raw simulator reasoning lines (the underlying engine’s <code>debugMessages</code>). Always present on <code>permission-denied</code>. Stable enough for log surfacing; not stable as machine-parseable data.</td></tr><tr><td align="left"><a id="request"></a> <code>request?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>method</code>: <code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code>; <code>path</code>: <code>string</code>; <code>resourceData?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td><td align="left">Eval-time request shape — what the rule saw on <code>request.*</code>. Lets callers render a “why did this deny” frame (auth, method, path, <code>request.resource.data</code> with sentinels resolved) without re-deriving any of it from out-of-band state.</td></tr><tr><td align="left"><code>request.method</code></td><td align="left"><code>public</code></td><td align="left"><code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code></td><td align="left">-</td></tr><tr><td align="left"><code>request.path</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">The user’s proposed <code>request.resource.data</code> — pre-resolution. <code>FieldValue.*</code> sentinels are preserved as their marker shapes (<code>{ __type: 'serverTimestamp' }</code>, etc.). The rule engine evaluated against the resolved form; what surfaces here is the caller’s INTENT so consumers see what they tried to write. Absent for reads (no proposed write) and for <code>delete</code> (no payload).</td></tr><tr><td align="left"><a id="resource"></a> <code>resource?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">Eval-time existing-document snapshot — what the rule saw on <code>resource.data</code>. <code>null</code> data with <code>exists: false</code> mirrors how the rule sees an absent doc. Absent for collection ops (<code>list</code>).</td></tr><tr><td align="left"><code>resource.data</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>resource.exists</code></td><td align="left"><code>public</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="rule"></a> <code>rule?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>citation?</code>: <code>string</code>; <code>col?</code>: <code>number</code>; <code>column?</code>: <code>number</code>; <code>expression?</code>: <code>string</code>; <code>file?</code>: <code>string</code>; <code>line?</code>: <code>number</code>; }</td><td align="left">The rule whose evaluation produced the denial (#370).</td></tr><tr><td align="left"><code>rule.citation?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.col?</code></td><td align="left"><code>public</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.column?</code></td><td align="left"><code>public</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.expression?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.file?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.line?</code></td><td align="left"><code>public</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="auth-1"></a> <code>auth?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">Auth identity that was active when the denial fired.</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="failedfields"></a> <code>failedFields?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code>[]</td><td align="left">Field paths in <code>request.resource.data</code> that the rule referenced and that failed.</td></tr><tr><td align="left"><a id="query"></a> <code>query?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>limit?</code>: <code>number</code>; <code>offset?</code>: <code>number</code>; <code>orderBy?</code>: <code>string</code>; <code>where?</code>: readonly { <code>field</code>: <code>string</code>; <code>op</code>: <code>string</code>; <code>value</code>: <code>string</code> | <code>number</code> | <code>boolean</code>; }[]; }</td><td align="left">Machine-readable descriptor of the denied query’s where/orderBy/limit shape (RULES-B11). Populated when a <code>list</code>/query is denied as statically unprovable (“rules are not filters”), so consumers can render the exact query the engine rejected without re-deriving it. Absent for single-doc and non-query denials.</td></tr><tr><td align="left"><code>query.limit?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>query.offset?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>query.orderBy?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>query.where?</code></td><td align="left"><code>readonly</code></td><td align="left">readonly { <code>field</code>: <code>string</code>; <code>op</code>: <code>string</code>; <code>value</code>: <code>string</code> | <code>number</code> | <code>boolean</code>; }[]</td><td align="left">-</td></tr><tr><td align="left"><a id="reasons"></a> <code>reasons?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code>[]</td><td align="left">Raw simulator reasoning lines (the underlying engine’s <code>debugMessages</code>). Always present on <code>permission-denied</code>. Stable enough for log surfacing; not stable as machine-parseable data.</td></tr><tr><td align="left"><a id="request"></a> <code>request?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>method</code>: <code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code>; <code>path</code>: <code>string</code>; <code>resourceData?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td><td align="left">Eval-time request shape — what the rule saw on <code>request.*</code>. Lets callers render a “why did this deny” frame (auth, method, path, <code>request.resource.data</code> with sentinels resolved) without re-deriving any of it from out-of-band state.</td></tr><tr><td align="left"><code>request.method</code></td><td align="left"><code>public</code></td><td align="left"><code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code></td><td align="left">-</td></tr><tr><td align="left"><code>request.path</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">The user’s proposed <code>request.resource.data</code> — pre-resolution. <code>FieldValue.*</code> sentinels are preserved as their marker shapes (<code>{ __type: 'serverTimestamp' }</code>, etc.). The rule engine evaluated against the resolved form; what surfaces here is the caller’s INTENT so consumers see what they tried to write. Absent for reads (no proposed write) and for <code>delete</code> (no payload).</td></tr><tr><td align="left"><a id="resource"></a> <code>resource?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">Eval-time existing-document snapshot — what the rule saw on <code>resource.data</code>. <code>null</code> data with <code>exists: false</code> mirrors how the rule sees an absent doc. Absent for collection ops (<code>list</code>).</td></tr><tr><td align="left"><code>resource.data</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>resource.exists</code></td><td align="left"><code>public</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="rule"></a> <code>rule?</code></td><td align="left"><code>public</code></td><td align="left">{ <code>citation?</code>: <code>string</code>; <code>col?</code>: <code>number</code>; <code>column?</code>: <code>number</code>; <code>expression?</code>: <code>string</code>; <code>file?</code>: <code>string</code>; <code>line?</code>: <code>number</code>; }</td><td align="left">The rule whose evaluation produced the denial (#370).</td></tr><tr><td align="left"><code>rule.citation?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.col?</code></td><td align="left"><code>public</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.column?</code></td><td align="left"><code>public</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.expression?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.file?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rule.line?</code></td><td align="left"><code>public</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr></tbody></table></div>
 <hr>
 <p><a id="denialevent"></a></p>
 <h3 id="denialevent">DenialEvent</h3>
@@ -591,7 +613,11 @@ frame either way.</li>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="auth-2"></a> <code>auth?</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="code"></a> <code>code</code></td><td align="left"><code>"permission-denied"</code></td></tr><tr><td align="left"><a id="message"></a> <code>message</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="reasons-1"></a> <code>reasons?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><a id="request-1"></a> <code>request?</code></td><td align="left">{ <code>method</code>: <code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code>; <code>path</code>: <code>string</code>; <code>resourceData?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td></tr><tr><td align="left"><code>request.method</code></td><td align="left"><code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code></td></tr><tr><td align="left"><code>request.path</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="resource-1"></a> <code>resource?</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td></tr><tr><td align="left"><code>resource.data</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>resource.exists</code></td><td align="left"><code>boolean</code></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="auth-2"></a> <code>auth?</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="code"></a> <code>code</code></td><td align="left"><code>"permission-denied"</code></td></tr><tr><td align="left"><a id="message"></a> <code>message</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="reasons-1"></a> <code>reasons?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><a id="request-1"></a> <code>request?</code></td><td align="left">{ <code>method</code>: <code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code>; <code>path</code>: <code>string</code>; <code>resourceData?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td></tr><tr><td align="left"><code>request.method</code></td><td align="left"><code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code></td></tr><tr><td align="left"><code>request.path</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="resource-1"></a> <code>resource?</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td></tr><tr><td align="left"><code>resource.data</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>resource.exists</code></td><td align="left"><code>boolean</code></td></tr></tbody></table></div>
 <hr>
 <p><a id="eventprovenance"></a></p>
 <h3 id="eventprovenance">EventProvenance</h3>
@@ -716,7 +742,12 @@ on the errored phase only.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-3"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="error"></a> <code>error?</code></td><td align="left">{ <code>code</code>: <code>"permission-denied"</code>; <code>message</code>: <code>string</code>; <code>reasons?</code>: <code>string</code>[]; }</td><td align="left">Populated on <code>listener_errored</code> only.</td></tr><tr><td align="left"><code>error.code</code></td><td align="left"><code>"permission-denied"</code></td><td align="left">-</td></tr><tr><td align="left"><code>error.message</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>error.reasons?</code></td><td align="left"><code>string</code>[]</td><td align="left">-</td></tr><tr><td align="left"><a id="id"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind"></a> <code>kind</code></td><td align="left"><code>"listener_attach"</code> | <code>"listener_detach"</code> | <code>"listener_errored"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="listenerid-1"></a> <code>listenerId</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="target"></a> <code>target</code></td><td align="left">| { <code>kind</code>: <code>"doc"</code>; <code>path</code>: <code>string</code>; } | { <code>collection</code>: <code>string</code>; <code>kind</code>: <code>"query"</code>; <code>query?</code>: <code>unknown</code>; }</td><td align="left">-</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-3"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="error"></a> <code>error?</code></td><td align="left">{ <code>code</code>: <code>"permission-denied"</code>; <code>message</code>: <code>string</code>; <code>reasons?</code>: <code>string</code>[]; }</td><td align="left">Populated on <code>listener_errored</code> only.</td></tr><tr><td align="left"><code>error.code</code></td><td align="left"><code>"permission-denied"</code></td><td align="left">-</td></tr><tr><td align="left"><code>error.message</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>error.reasons?</code></td><td align="left"><code>string</code>[]</td><td align="left">-</td></tr><tr><td align="left"><a id="id"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind"></a> <code>kind</code></td><td align="left"><code>"listener_attach"</code> | <code>"listener_detach"</code> | <code>"listener_errored"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="listenerid-1"></a> <code>listenerId</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="target"></a> <code>target</code></td><td align="left">| { <code>kind</code>: <code>"doc"</code>; <code>path</code>: <code>string</code>; } | { <code>collection</code>: <code>string</code>; <code>kind</code>: <code>"query"</code>; <code>query?</code>: <code>unknown</code>; }</td><td align="left">-</td></tr></tbody></table></div>
 <hr>
 <p><a id="localsandbox"></a></p>
 <h3 id="localsandbox">LocalSandbox</h3>
@@ -770,7 +801,13 @@ are deliberately not assignable to this local-only interface.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="local_sandbox"></a> <code>[LOCAL_SANDBOX]</code></td><td align="left"><code>readonly</code></td><td align="left"><code>true</code></td><td align="left">-</td></tr><tr><td align="left"><a id="admin"></a> <code>admin</code></td><td align="left"><code>readonly</code></td><td align="left"><code>SandboxAdmin</code></td><td align="left">Admin-plane access (rule-bypass reads). Identity-agnostic by design — admin reads aren’t gated on auth, so they live on the sandbox, not on a context. See SandboxAdmin.</td></tr><tr><td align="left"><a id="currentuser"></a> <code>currentUser</code></td><td align="left"><code>public</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">Current authenticated user across the sandbox. Mutated by <code>pyric/auth</code>’s <code>signInAnonymously</code> / <code>signInWithEmailAndPassword</code> / <code>signOut</code> / <code>sandbox.setUser</code>. Read per-call by service factories (e.g. a future <code>getFirestore(sandbox)</code> overload) so they see auth state changes without re-binding handles. Defaults to <code>null</code> (anonymous / signed out). <strong>Independent of <code>withAuth({uid})</code></strong> — <code>withAuth</code> still produces a frozen <a href="/docs/pyric-firestore-reference-api/#sandboxcontext">SandboxContext</a> that carries its own identity for the runner’s test code (the existing pattern: explicit identity per service call). <code>currentUser</code> exists for the <code>pyric/auth</code> mirror, where consumer app code drives identity through a stateful <code>Auth</code> handle rather than naming it per call.</td></tr><tr><td align="left"><code>currentUser.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>currentUser.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="local_sandbox"></a> <code>[LOCAL_SANDBOX]</code></td><td align="left"><code>readonly</code></td><td align="left"><code>true</code></td><td align="left">-</td></tr><tr><td align="left"><a id="admin"></a> <code>admin</code></td><td align="left"><code>readonly</code></td><td align="left"><code>SandboxAdmin</code></td><td align="left">Admin-plane access (rule-bypass reads). Identity-agnostic by design — admin reads aren’t gated on auth, so they live on the sandbox, not on a context. See SandboxAdmin.</td></tr><tr><td align="left"><a id="currentuser"></a> <code>currentUser</code></td><td align="left"><code>public</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">Current authenticated user across the sandbox. Mutated by <code>pyric/auth</code>’s <code>signInAnonymously</code> / <code>signInWithEmailAndPassword</code> / <code>signOut</code> / <code>sandbox.setUser</code>. Read per-call by service factories (e.g. a future <code>getFirestore(sandbox)</code> overload) so they see auth state changes without re-binding handles. Defaults to <code>null</code> (anonymous / signed out). <strong>Independent of <code>withAuth({uid})</code></strong> — <code>withAuth</code> still produces a frozen <a href="/docs/pyric-firestore-reference-api/#sandboxcontext">SandboxContext</a> that carries its own identity for the runner’s test code (the existing pattern: explicit identity per service call). <code>currentUser</code> exists for the <code>pyric/auth</code> mirror, where consumer app code drives identity through a stateful <code>Auth</code> handle rather than naming it per call.</td></tr><tr><td align="left"><code>currentUser.tenant?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>currentUser.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>currentUser.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
 <h4 id="methods-2">Methods</h4>
 <p><a id="clearpersistence"></a></p>
 <h5 id="clearpersistence">clearPersistence()</h5>
@@ -948,6 +985,7 @@ a service this one lacks).</p>
 <p><a id="oncurrentuserchanged"></a></p>
 <h5 id="oncurrentuserchanged">onCurrentUserChanged()</h5>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#61AFEF">onCurrentUserChanged</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">cb</span><span style="color:#ABB2BF">: (</span><span style="color:#E06C75;font-style:italic">user</span><span style="color:#ABB2BF">: {</span></span>
+<span class="line"><span style="color:#E06C75">  tenant</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">>;</span></span>
 <span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#ABB2BF">}) </span><span style="color:#C678DD">=></span><span style="color:#C678DD"> void</span><span style="color:#ABB2BF">): () </span><span style="color:#C678DD">=></span><span style="color:#C678DD"> void</span><span style="color:#ABB2BF">;</span></span></code></pre>
@@ -974,7 +1012,7 @@ their errors.</p>
-<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>cb</code></td><td align="left">(<code>user</code>: { <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }) => <code>void</code></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>cb</code></td><td align="left">(<code>user</code>: { <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }) => <code>void</code></td></tr></tbody></table></div>
 <h6 id="returns-15">Returns</h6>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#ABB2BF">(): </span><span style="color:#E5C07B">void</span><span style="color:#ABB2BF">;</span></span></code></pre>
 <h6 id="returns-16">Returns</h6>
@@ -1180,7 +1218,8 @@ paths to data. Future services will add their own keys.</p>
 <p><a id="withauth-2"></a></p>
 <h5 id="withauth-1">withAuth()</h5>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#61AFEF">withAuth</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">auth</span><span style="color:#ABB2BF">: {</span></span>
-<span class="line"><span style="color:#ABB2BF">  token?: </span><span style="color:#E06C75">Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, unknown>;</span></span>
+<span class="line"><span style="color:#ABB2BF">  tenant?: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, unknown>;</span></span>
 <span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#ABB2BF">}): </span><span style="color:#E06C75">SandboxContext</span><span style="color:#ABB2BF">;</span></span></code></pre>
 <p>Derive a context bound to this sandbox under the given auth
@@ -1213,7 +1252,11 @@ unambiguous.</p>
-<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
 <h6 id="returns-25">Returns</h6>
 <p><a href="/docs/pyric-firestore-reference-api/#sandboxcontext"><code>SandboxContext</code></a></p>
 <h6 id="example-1">Example</h6>
@@ -1329,7 +1372,12 @@ as a user, while an app or agent may use an admin lens.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="at-1"></a> <code>at</code></td><td align="left"><code>readonly</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="auth-4"></a> <code>auth</code></td><td align="left"><code>readonly</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="context"></a> <code>context</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#operationcontext-2"><code>OperationContext</code></a></td></tr><tr><td align="left"><a id="eventkind"></a> <code>eventKind</code></td><td align="left"><code>readonly</code></td><td align="left"><code>"request"</code> | <code>"listener"</code> | <code>"operation"</code></td></tr><tr><td align="left"><a id="id-1"></a> <code>id</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="method"></a> <code>method</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="path"></a> <code>path?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="result"></a> <code>result?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>"unsupported"</code> | <code>"error"</code> | <code>"allow"</code> | <code>"deny"</code> | <code>"not-applicable"</code></td></tr><tr><td align="left"><a id="rules-1"></a> <code>rules</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#rulesdisposition-3"><code>RulesDisposition</code></a></td></tr><tr><td align="left"><a id="service-1"></a> <code>service</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="at-1"></a> <code>at</code></td><td align="left"><code>readonly</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="auth-4"></a> <code>auth</code></td><td align="left"><code>readonly</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="context"></a> <code>context</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#operationcontext-2"><code>OperationContext</code></a></td></tr><tr><td align="left"><a id="eventkind"></a> <code>eventKind</code></td><td align="left"><code>readonly</code></td><td align="left"><code>"request"</code> | <code>"listener"</code> | <code>"operation"</code></td></tr><tr><td align="left"><a id="id-1"></a> <code>id</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="method"></a> <code>method</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="path"></a> <code>path?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="result"></a> <code>result?</code></td><td align="left"><code>readonly</code></td><td align="left"><code>"allow"</code> | <code>"deny"</code> | <code>"unsupported"</code> | <code>"error"</code> | <code>"not-applicable"</code></td></tr><tr><td align="left"><a id="rules-1"></a> <code>rules</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#rulesdisposition-3"><code>RulesDisposition</code></a></td></tr><tr><td align="left"><a id="service-1"></a> <code>service</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td></tr></tbody></table></div>
 <hr>
 <p><a id="persistableservice"></a></p>
 <h3 id="persistableservice">PersistableService</h3>
@@ -1685,7 +1733,13 @@ dispatch on <a href="#isremotesandbox">isRemoteSandbox</a> and use <a href="#cha
-<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="remote_sandbox"></a> <code>[REMOTE_SANDBOX]</code></td><td align="left"><code>readonly</code></td><td align="left"><code>true</code></td><td align="left">-</td></tr><tr><td align="left"><a id="admin-1"></a> <code>admin</code></td><td align="left"><code>readonly</code></td><td align="left"><code>SandboxAdmin</code></td><td align="left">Admin-plane access (rule-bypass reads). Identity-agnostic by design — admin reads aren’t gated on auth, so they live on the sandbox, not on a context. See SandboxAdmin.</td></tr><tr><td align="left"><a id="channel"></a> <code>channel</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#remotesandboxchannel-1"><code>RemoteSandboxChannel</code></a></td><td align="left">The raw worker op/sub relay channel.</td></tr><tr><td align="left"><a id="currentuser-1"></a> <code>currentUser</code></td><td align="left"><code>public</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">Current authenticated user across the sandbox. Mutated by <code>pyric/auth</code>’s <code>signInAnonymously</code> / <code>signInWithEmailAndPassword</code> / <code>signOut</code> / <code>sandbox.setUser</code>. Read per-call by service factories (e.g. a future <code>getFirestore(sandbox)</code> overload) so they see auth state changes without re-binding handles. Defaults to <code>null</code> (anonymous / signed out). <strong>Independent of <code>withAuth({uid})</code></strong> — <code>withAuth</code> still produces a frozen <a href="/docs/pyric-firestore-reference-api/#sandboxcontext">SandboxContext</a> that carries its own identity for the runner’s test code (the existing pattern: explicit identity per service call). <code>currentUser</code> exists for the <code>pyric/auth</code> mirror, where consumer app code drives identity through a stateful <code>Auth</code> handle rather than naming it per call.</td></tr><tr><td align="left"><code>currentUser.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>currentUser.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="serveurl"></a> <code>serveUrl</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td><td align="left">Base URL of the <code>pyric dev</code> this handle is attached to (used in error guidance: “open <serveurl> in a browser and retry”).</serveurl></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Modifier</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="remote_sandbox"></a> <code>[REMOTE_SANDBOX]</code></td><td align="left"><code>readonly</code></td><td align="left"><code>true</code></td><td align="left">-</td></tr><tr><td align="left"><a id="admin-1"></a> <code>admin</code></td><td align="left"><code>readonly</code></td><td align="left"><code>SandboxAdmin</code></td><td align="left">Admin-plane access (rule-bypass reads). Identity-agnostic by design — admin reads aren’t gated on auth, so they live on the sandbox, not on a context. See SandboxAdmin.</td></tr><tr><td align="left"><a id="channel"></a> <code>channel</code></td><td align="left"><code>readonly</code></td><td align="left"><a href="#remotesandboxchannel-1"><code>RemoteSandboxChannel</code></a></td><td align="left">The raw worker op/sub relay channel.</td></tr><tr><td align="left"><a id="currentuser-1"></a> <code>currentUser</code></td><td align="left"><code>public</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">Current authenticated user across the sandbox. Mutated by <code>pyric/auth</code>’s <code>signInAnonymously</code> / <code>signInWithEmailAndPassword</code> / <code>signOut</code> / <code>sandbox.setUser</code>. Read per-call by service factories (e.g. a future <code>getFirestore(sandbox)</code> overload) so they see auth state changes without re-binding handles. Defaults to <code>null</code> (anonymous / signed out). <strong>Independent of <code>withAuth({uid})</code></strong> — <code>withAuth</code> still produces a frozen <a href="/docs/pyric-firestore-reference-api/#sandboxcontext">SandboxContext</a> that carries its own identity for the runner’s test code (the existing pattern: explicit identity per service call). <code>currentUser</code> exists for the <code>pyric/auth</code> mirror, where consumer app code drives identity through a stateful <code>Auth</code> handle rather than naming it per call.</td></tr><tr><td align="left"><code>currentUser.tenant?</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>currentUser.token?</code></td><td align="left"><code>public</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>currentUser.uid</code></td><td align="left"><code>public</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="serveurl"></a> <code>serveUrl</code></td><td align="left"><code>readonly</code></td><td align="left"><code>string</code></td><td align="left">Base URL of the <code>pyric sandbox</code> this handle is attached to (used in error guidance: “open <serveurl> in a browser and retry”).</serveurl></td></tr></tbody></table></div>
 <h4 id="methods-6">Methods</h4>
 <p><a id="clearpersistence-2"></a></p>
 <h5 id="clearpersistence-1">clearPersistence()</h5>
@@ -1863,6 +1917,7 @@ a service this one lacks).</p>
 <p><a id="oncurrentuserchanged-2"></a></p>
 <h5 id="oncurrentuserchanged-1">onCurrentUserChanged()</h5>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#61AFEF">onCurrentUserChanged</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">cb</span><span style="color:#ABB2BF">: (</span><span style="color:#E06C75;font-style:italic">user</span><span style="color:#ABB2BF">: {</span></span>
+<span class="line"><span style="color:#E06C75">  tenant</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">>;</span></span>
 <span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#ABB2BF">}) </span><span style="color:#C678DD">=></span><span style="color:#C678DD"> void</span><span style="color:#ABB2BF">): () </span><span style="color:#C678DD">=></span><span style="color:#C678DD"> void</span><span style="color:#ABB2BF">;</span></span></code></pre>
@@ -1889,7 +1944,7 @@ their errors.</p>
-<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>cb</code></td><td align="left">(<code>user</code>: { <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }) => <code>void</code></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>cb</code></td><td align="left">(<code>user</code>: { <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }) => <code>void</code></td></tr></tbody></table></div>
 <h6 id="returns-46">Returns</h6>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#ABB2BF">(): </span><span style="color:#E5C07B">void</span><span style="color:#ABB2BF">;</span></span></code></pre>
 <h6 id="returns-47">Returns</h6>
@@ -2095,7 +2150,8 @@ paths to data. Future services will add their own keys.</p>
 <p><a id="withauth-4"></a></p>
 <h5 id="withauth-2">withAuth()</h5>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#61AFEF">withAuth</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">auth</span><span style="color:#ABB2BF">: {</span></span>
-<span class="line"><span style="color:#ABB2BF">  token?: </span><span style="color:#E06C75">Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, unknown>;</span></span>
+<span class="line"><span style="color:#ABB2BF">  tenant?: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, unknown>;</span></span>
 <span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#ABB2BF">}): </span><span style="color:#E06C75">SandboxContext</span><span style="color:#ABB2BF">;</span></span></code></pre>
 <p>Derive a context bound to this sandbox under the given auth
@@ -2128,7 +2184,11 @@ unambiguous.</p>
-<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
 <h6 id="returns-56">Returns</h6>
 <p><a href="/docs/pyric-firestore-reference-api/#sandboxcontext"><code>SandboxContext</code></a></p>
 <h6 id="example-3">Example</h6>
@@ -2236,7 +2296,7 @@ Returns the unsubscribe function.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="url"></a> <code>url?</code></td><td align="left"><code>string</code></td><td align="left">Explicit <code>pyric dev</code> base URL (from <code>PYRIC_SANDBOX=remote:&#x3C;url></code>). When omitted the factory discovers the running host itself (the <code>.pyric/serve.json</code> locator protocol).</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="url"></a> <code>url?</code></td><td align="left"><code>string</code></td><td align="left">Explicit <code>pyric sandbox</code> base URL (from <code>PYRIC_SANDBOX=remote:&#x3C;url></code>). When omitted the factory discovers the running host itself (the <code>.pyric/serve.json</code> locator protocol).</td></tr></tbody></table></div>
 <hr>
 <p><a id="replayoptions"></a></p>
 <h3 id="replayoptions">ReplayOptions</h3>
@@ -2480,7 +2540,12 @@ subscriber can’t change rule semantics or hide other events.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at-2"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">Wall-clock at op start, ms since epoch.</td></tr><tr><td align="left"><a id="auth-5"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="detail"></a> <code>detail?</code></td><td align="left">{ <code>admin?</code>: <code>boolean</code>; } &#x26; <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">Free-form operation metadata. <code>admin: true</code> marks a rules-bypassing setup/admin operation so fixture tooling can exclude it from protected behavior while still preserving it as replay context.</td></tr><tr><td align="left"><a id="evalms"></a> <code>evalMs</code></td><td align="left"><code>number</code></td><td align="left">Wall-clock duration of the simulator.simulate(…) call, in ms.</td></tr><tr><td align="left"><a id="evaluatedrule"></a> <code>evaluatedRule?</code></td><td align="left"><a href="/docs/pyric-rules-reference-api/#evaluatedruleinfo"><code>EvaluatedRuleInfo</code></a></td><td align="left">The DECIDING rule’s verdict + 1-indexed source line + full sub-expression trace, projected from the simulator’s structured <code>RuleEvaluation</code> (additive: present on `result: ‘allow'</td></tr><tr><td align="left"><a id="groupid"></a> <code>groupId?</code></td><td align="left"><code>string</code></td><td align="left">Shared across ops in one batch or transaction. Opaque to consumers.</td></tr><tr><td align="left"><a id="groupkind-1"></a> <code>groupKind?</code></td><td align="left"><code>"transaction"</code> | <code>"batch"</code></td><td align="left">Disambiguates `origin: ‘transaction'</td></tr><tr><td align="left"><a id="id-2"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">Unique within a sandbox process. Useful for React list keys.</td></tr><tr><td align="left"><a id="kind-1"></a> <code>kind</code></td><td align="left"><code>"request"</code></td><td align="left">Discriminator.</td></tr><tr><td align="left"><a id="matchedrule"></a> <code>matchedRule?</code></td><td align="left">{ <code>operations</code>: <code>string</code>[]; <code>ruleIndex</code>: <code>number</code>; }</td><td align="left">Parsed from the simulator’s “Rule #N → …” debug line. Absent when no rule matched (e.g. no allow rules at the path — implicit deny).</td></tr><tr><td align="left"><code>matchedRule.operations</code></td><td align="left"><code>string</code>[]</td><td align="left">-</td></tr><tr><td align="left"><code>matchedRule.ruleIndex</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="method-1"></a> <code>method</code></td><td align="left"><code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code> | <code>"set"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="origin"></a> <code>origin</code></td><td align="left"><code>"user"</code> | <code>"transaction"</code> | <code>"listener"</code> | <code>"batch"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="path-1"></a> <code>path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="reasons-2"></a> <code>reasons</code></td><td align="left"><code>string</code>[]</td><td align="left">Simulator debug messages — the per-rule trace (<code>Rule #0 (read) → ALLOW</code>). Same shape as <code>DenialEvent.reasons</code> so consumer code can share rendering.</td></tr><tr><td align="left"><a id="request-2"></a> <code>request?</code></td><td align="left">{ <code>resourceData?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td><td align="left">Proposed write payload, for create/update/set. Absent on reads + delete. Pre-resolution: <code>FieldValue.*</code> sentinels are preserved as their marker shapes (<code>{ __type: 'serverTimestamp' }</code>, etc.) so the replay engine can re-resolve them. The rule engine evaluated against the resolved form internally; that resolved form lives on <a href="#nextstate-1">WriteSandboxEvent.nextState</a>, not here.</td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><a id="resourceafter"></a> <code>resourceAfter?</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">Projected document state after the write. Absent on reads.</td></tr><tr><td align="left"><code>resourceAfter.data</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>resourceAfter.exists</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="resourcebefore"></a> <code>resourceBefore?</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">Existing document state before the write (or read target for get).</td></tr><tr><td align="left"><code>resourceBefore.data</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>resourceBefore.exists</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="result-1"></a> <code>result</code></td><td align="left"><code>"unsupported"</code> | <code>"allow"</code> | <code>"deny"</code></td><td align="left"><code>'unsupported'</code> fires when the simulator hit an unmodelled feature and the sandbox upgraded it (today: thrown as SimulatorUnsupportedError, surfaced here as a discrete result so the panel can show it distinctly from a real denial).</td></tr><tr><td align="left"><a id="rulesdisposition"></a> <code>rulesDisposition?</code></td><td align="left"><a href="#rulesdisposition-3"><code>RulesDisposition</code></a></td><td align="left">Canonical statement of whether Security Rules evaluated this request. Added by the sandbox event recorder when an older emitter omits it.</td></tr><tr><td align="left"><a id="triggeredby"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path</code>: <code>string</code>; }</td><td align="left">For listener re-evals: the originating user op that triggered this re-evaluation. Absent on the initial-snapshot fire.</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at-2"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">Wall-clock at op start, ms since epoch.</td></tr><tr><td align="left"><a id="auth-5"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="detail"></a> <code>detail?</code></td><td align="left">{ <code>admin?</code>: <code>boolean</code>; } &#x26; <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">Free-form operation metadata. <code>admin: true</code> marks a rules-bypassing setup/admin operation so fixture tooling can exclude it from protected behavior while still preserving it as replay context.</td></tr><tr><td align="left"><a id="evalms"></a> <code>evalMs</code></td><td align="left"><code>number</code></td><td align="left">Wall-clock duration of the simulator.simulate(…) call, in ms.</td></tr><tr><td align="left"><a id="evaluatedrule"></a> <code>evaluatedRule?</code></td><td align="left"><a href="/docs/pyric-rules-reference-api/#evaluatedruleinfo"><code>EvaluatedRuleInfo</code></a></td><td align="left">The DECIDING rule’s verdict + 1-indexed source line + full sub-expression trace, projected from the simulator’s structured <code>RuleEvaluation</code> (additive: present on `result: ‘allow'</td></tr><tr><td align="left"><a id="groupid"></a> <code>groupId?</code></td><td align="left"><code>string</code></td><td align="left">Shared across ops in one batch or transaction. Opaque to consumers.</td></tr><tr><td align="left"><a id="groupkind-1"></a> <code>groupKind?</code></td><td align="left"><code>"transaction"</code> | <code>"batch"</code></td><td align="left">Disambiguates `origin: ‘transaction'</td></tr><tr><td align="left"><a id="id-2"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">Unique within a sandbox process. Useful for React list keys.</td></tr><tr><td align="left"><a id="kind-1"></a> <code>kind</code></td><td align="left"><code>"request"</code></td><td align="left">Discriminator.</td></tr><tr><td align="left"><a id="matchedrule"></a> <code>matchedRule?</code></td><td align="left">{ <code>operations</code>: <code>string</code>[]; <code>ruleIndex</code>: <code>number</code>; }</td><td align="left">Parsed from the simulator’s “Rule #N → …” debug line. Absent when no rule matched (e.g. no allow rules at the path — implicit deny).</td></tr><tr><td align="left"><code>matchedRule.operations</code></td><td align="left"><code>string</code>[]</td><td align="left">-</td></tr><tr><td align="left"><code>matchedRule.ruleIndex</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="method-1"></a> <code>method</code></td><td align="left"><code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code> | <code>"set"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="origin"></a> <code>origin</code></td><td align="left"><code>"user"</code> | <code>"transaction"</code> | <code>"listener"</code> | <code>"batch"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="path-1"></a> <code>path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="reasons-2"></a> <code>reasons</code></td><td align="left"><code>string</code>[]</td><td align="left">Simulator debug messages — the per-rule trace (<code>Rule #0 (read) → ALLOW</code>). Same shape as <code>DenialEvent.reasons</code> so consumer code can share rendering.</td></tr><tr><td align="left"><a id="request-2"></a> <code>request?</code></td><td align="left">{ <code>resourceData?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td><td align="left">Proposed write payload, for create/update/set. Absent on reads + delete. Pre-resolution: <code>FieldValue.*</code> sentinels are preserved as their marker shapes (<code>{ __type: 'serverTimestamp' }</code>, etc.) so the replay engine can re-resolve them. The rule engine evaluated against the resolved form internally; that resolved form lives on <a href="#nextstate-1">WriteSandboxEvent.nextState</a>, not here.</td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><a id="resourceafter"></a> <code>resourceAfter?</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">Projected document state after the write. Absent on reads.</td></tr><tr><td align="left"><code>resourceAfter.data</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>resourceAfter.exists</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="resourcebefore"></a> <code>resourceBefore?</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">Existing document state before the write (or read target for get).</td></tr><tr><td align="left"><code>resourceBefore.data</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>resourceBefore.exists</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="result-1"></a> <code>result</code></td><td align="left"><code>"allow"</code> | <code>"deny"</code> | <code>"unsupported"</code></td><td align="left"><code>'unsupported'</code> fires when the simulator hit an unmodelled feature and the sandbox upgraded it (today: thrown as SimulatorUnsupportedError, surfaced here as a discrete result so the panel can show it distinctly from a real denial).</td></tr><tr><td align="left"><a id="rulesdisposition"></a> <code>rulesDisposition?</code></td><td align="left"><a href="#rulesdisposition-3"><code>RulesDisposition</code></a></td><td align="left">Canonical statement of whether Security Rules evaluated this request. Added by the sandbox event recorder when an older emitter omits it.</td></tr><tr><td align="left"><a id="triggeredby"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path</code>: <code>string</code>; }</td><td align="left">For listener re-evals: the originating user op that triggered this re-evaluation. Absent on the initial-snapshot fire.</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
 <hr>
 <p><a id="sandboxcommitevent"></a></p>
 <h3 id="sandboxcommitevent">SandboxCommitEvent</h3>
@@ -2573,7 +2638,11 @@ these service adapters instead of filtering Firestore-only <code>write</code> ev
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="at-3"></a> <code>at</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="auth-6"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="data"></a> <code>data?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="detail-1"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="groupid-1"></a> <code>groupId?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="groupkind-2"></a> <code>groupKind?</code></td><td align="left"><code>"transaction"</code> | <code>"batch"</code></td></tr><tr><td align="left"><a id="id-3"></a> <code>id</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="kind-2"></a> <code>kind</code></td><td align="left"><code>"commit"</code></td></tr><tr><td align="left"><a id="method-2"></a> <code>method</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="nextstate"></a> <code>nextState?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="path-2"></a> <code>path?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="priorstate"></a> <code>priorState?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="replay"></a> <code>replay?</code></td><td align="left">{ <code>autoId?</code>: <code>string</code>; <code>requestTime?</code>: <code>number</code>; <code>sentinels?</code>: { <code>field</code>: <code>string</code>; <code>kind</code>: <code>string</code>; }[]; }</td></tr><tr><td align="left"><code>replay.autoId?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>replay.requestTime?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><code>replay.sentinels?</code></td><td align="left">{ <code>field</code>: <code>string</code>; <code>kind</code>: <code>string</code>; }[]</td></tr><tr><td align="left"><a id="service-2"></a> <code>service</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="at-3"></a> <code>at</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="auth-6"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="data"></a> <code>data?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="detail-1"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="groupid-1"></a> <code>groupId?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="groupkind-2"></a> <code>groupKind?</code></td><td align="left"><code>"transaction"</code> | <code>"batch"</code></td></tr><tr><td align="left"><a id="id-3"></a> <code>id</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="kind-2"></a> <code>kind</code></td><td align="left"><code>"commit"</code></td></tr><tr><td align="left"><a id="method-2"></a> <code>method</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="nextstate"></a> <code>nextState?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="path-2"></a> <code>path?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="priorstate"></a> <code>priorState?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="replay"></a> <code>replay?</code></td><td align="left">{ <code>autoId?</code>: <code>string</code>; <code>requestTime?</code>: <code>number</code>; <code>sentinels?</code>: { <code>field</code>: <code>string</code>; <code>kind</code>: <code>string</code>; }[]; }</td></tr><tr><td align="left"><code>replay.autoId?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>replay.requestTime?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><code>replay.sentinels?</code></td><td align="left">{ <code>field</code>: <code>string</code>; <code>kind</code>: <code>string</code>; }[]</td></tr><tr><td align="left"><a id="service-2"></a> <code>service</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td></tr></tbody></table></div>
 <hr>
 <p><a id="sandboxconfig"></a></p>
 <h3 id="sandboxconfig">SandboxConfig</h3>
@@ -2741,7 +2810,11 @@ service listeners the same debuggable surface.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="at-4"></a> <code>at</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="auth-7"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="detail-2"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="error-1"></a> <code>error?</code></td><td align="left">{ <code>code?</code>: <code>string</code>; <code>message</code>: <code>string</code>; <code>reasons?</code>: <code>string</code>[]; }</td></tr><tr><td align="left"><code>error.code?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>error.message</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>error.reasons?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><a id="id-4"></a> <code>id</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="kind-3"></a> <code>kind</code></td><td align="left"><code>"listener"</code></td></tr><tr><td align="left"><a id="listenerid-2"></a> <code>listenerId</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="phase"></a> <code>phase</code></td><td align="left"><code>"attach"</code> | <code>"detach"</code> | <code>"delivery"</code> | <code>"suppressed"</code> | <code>"errored"</code></td></tr><tr><td align="left"><a id="reason"></a> <code>reason?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="reasons-3"></a> <code>reasons?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><a id="result-2"></a> <code>result?</code></td><td align="left"><code>"unsupported"</code> | <code>"error"</code> | <code>"allow"</code> | <code>"deny"</code></td></tr><tr><td align="left"><a id="rules-2"></a> <code>rules?</code></td><td align="left">{ <code>engine</code>: <code>"firestore"</code> | <code>"rtdb"</code> | <code>"storage"</code>; <code>errorCode?</code>: <code>string</code>; <code>matchedPath?</code>: <code>string</code>; <code>matchedRule?</code>: <code>string</code>; <code>operations?</code>: <code>string</code>[]; <code>pathVariableBindings?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>string</code>>; <code>reason?</code>: <code>string</code>; <code>ruleIndex?</code>: <code>number</code>; }</td></tr><tr><td align="left"><code>rules.engine</code></td><td align="left"><code>"firestore"</code> | <code>"rtdb"</code> | <code>"storage"</code></td></tr><tr><td align="left"><code>rules.errorCode?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.matchedPath?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.matchedRule?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.operations?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><code>rules.pathVariableBindings?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>string</code>></td></tr><tr><td align="left"><code>rules.reason?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.ruleIndex?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="rulesdisposition-1"></a> <code>rulesDisposition?</code></td><td align="left"><a href="#rulesdisposition-3"><code>RulesDisposition</code></a></td></tr><tr><td align="left"><a id="sample"></a> <code>sample?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="service-3"></a> <code>service</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td></tr><tr><td align="left"><a id="size"></a> <code>size?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="target-1"></a> <code>target</code></td><td align="left">{ <code>kind</code>: <code>string</code>; <code>path?</code>: <code>string</code>; <code>query?</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>target.kind</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>target.path?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>target.query?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="triggeredby-1"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path?</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>triggeredBy.path?</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="at-4"></a> <code>at</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="auth-7"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="detail-2"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="error-1"></a> <code>error?</code></td><td align="left">{ <code>code?</code>: <code>string</code>; <code>message</code>: <code>string</code>; <code>reasons?</code>: <code>string</code>[]; }</td></tr><tr><td align="left"><code>error.code?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>error.message</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>error.reasons?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><a id="id-4"></a> <code>id</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="kind-3"></a> <code>kind</code></td><td align="left"><code>"listener"</code></td></tr><tr><td align="left"><a id="listenerid-2"></a> <code>listenerId</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="phase"></a> <code>phase</code></td><td align="left"><code>"attach"</code> | <code>"detach"</code> | <code>"delivery"</code> | <code>"suppressed"</code> | <code>"errored"</code></td></tr><tr><td align="left"><a id="reason"></a> <code>reason?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="reasons-3"></a> <code>reasons?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><a id="result-2"></a> <code>result?</code></td><td align="left"><code>"allow"</code> | <code>"deny"</code> | <code>"unsupported"</code> | <code>"error"</code></td></tr><tr><td align="left"><a id="rules-2"></a> <code>rules?</code></td><td align="left">{ <code>engine</code>: <code>"firestore"</code> | <code>"rtdb"</code> | <code>"storage"</code>; <code>errorCode?</code>: <code>string</code>; <code>matchedPath?</code>: <code>string</code>; <code>matchedRule?</code>: <code>string</code>; <code>operations?</code>: <code>string</code>[]; <code>pathVariableBindings?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>string</code>>; <code>reason?</code>: <code>string</code>; <code>ruleIndex?</code>: <code>number</code>; }</td></tr><tr><td align="left"><code>rules.engine</code></td><td align="left"><code>"firestore"</code> | <code>"rtdb"</code> | <code>"storage"</code></td></tr><tr><td align="left"><code>rules.errorCode?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.matchedPath?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.matchedRule?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.operations?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><code>rules.pathVariableBindings?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>string</code>></td></tr><tr><td align="left"><code>rules.reason?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.ruleIndex?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="rulesdisposition-1"></a> <code>rulesDisposition?</code></td><td align="left"><a href="#rulesdisposition-3"><code>RulesDisposition</code></a></td></tr><tr><td align="left"><a id="sample"></a> <code>sample?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="service-3"></a> <code>service</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td></tr><tr><td align="left"><a id="size"></a> <code>size?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="target-1"></a> <code>target</code></td><td align="left">{ <code>kind</code>: <code>string</code>; <code>path?</code>: <code>string</code>; <code>query?</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>target.kind</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>target.path?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>target.query?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="triggeredby-1"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path?</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>triggeredBy.path?</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
 <hr>
 <p><a id="sandboxoperationevent"></a></p>
 <h3 id="sandboxoperationevent">SandboxOperationEvent</h3>
@@ -2959,7 +3032,12 @@ their state is a Firestore document.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at-5"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-8"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="detail-3"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><a id="durationms"></a> <code>durationMs?</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="groupid-2"></a> <code>groupId?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="groupkind-3"></a> <code>groupKind?</code></td><td align="left"><code>"transaction"</code> | <code>"batch"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="id-5"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-4"></a> <code>kind</code></td><td align="left"><code>"operation"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="method-3"></a> <code>method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="origin-1"></a> <code>origin</code></td><td align="left"><code>"admin"</code> | <code>"user"</code> | <code>"system"</code> | <code>"transaction"</code> | <code>"listener"</code> | <code>"batch"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="path-3"></a> <code>path?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="reasons-4"></a> <code>reasons?</code></td><td align="left"><code>string</code>[]</td><td align="left">-</td></tr><tr><td align="left"><a id="request-3"></a> <code>request?</code></td><td align="left">{ <code>data?</code>: <code>unknown</code>; <code>query?</code>: <code>unknown</code>; <code>resourceData?</code>: <code>unknown</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>request.data?</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><code>request.query?</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><a id="resourceafter-1"></a> <code>resourceAfter?</code></td><td align="left">{ <code>data</code>: <code>unknown</code>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>resourceAfter.data</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><code>resourceAfter.exists</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="resourcebefore-1"></a> <code>resourceBefore?</code></td><td align="left">{ <code>data</code>: <code>unknown</code>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>resourceBefore.data</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><code>resourceBefore.exists</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="result-3"></a> <code>result</code></td><td align="left"><code>"unsupported"</code> | <code>"error"</code> | <code>"allow"</code> | <code>"deny"</code> | <code>"not-applicable"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="rules-3"></a> <code>rules?</code></td><td align="left">{ <code>engine</code>: <code>"firestore"</code> | <code>"rtdb"</code> | <code>"storage"</code>; <code>errorCode?</code>: <code>string</code>; <code>matchedPath?</code>: <code>string</code>; <code>matchedRule?</code>: <code>string</code>; <code>operations?</code>: <code>string</code>[]; <code>pathVariableBindings?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>string</code>>; <code>reason?</code>: <code>string</code>; <code>ruleIndex?</code>: <code>number</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>rules.engine</code></td><td align="left"><code>"firestore"</code> | <code>"rtdb"</code> | <code>"storage"</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.errorCode?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.matchedPath?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.matchedRule?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.operations?</code></td><td align="left"><code>string</code>[]</td><td align="left">-</td></tr><tr><td align="left"><code>rules.pathVariableBindings?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>string</code>></td><td align="left">-</td></tr><tr><td align="left"><code>rules.reason?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.ruleIndex?</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="rulesdisposition-2"></a> <code>rulesDisposition?</code></td><td align="left"><a href="#rulesdisposition-3"><code>RulesDisposition</code></a></td><td align="left">Canonical statement of whether Security Rules evaluated this operation. Service emitters may provide it directly; the recorder normalizes legacy operation shapes at the unified stream seam.</td></tr><tr><td align="left"><a id="service-4"></a> <code>service</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td><td align="left">-</td></tr><tr><td align="left"><a id="triggeredby-2"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path?</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.path?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at-5"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-8"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="detail-3"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><a id="durationms"></a> <code>durationMs?</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="groupid-2"></a> <code>groupId?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="groupkind-3"></a> <code>groupKind?</code></td><td align="left"><code>"transaction"</code> | <code>"batch"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="id-5"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-4"></a> <code>kind</code></td><td align="left"><code>"operation"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="method-3"></a> <code>method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="origin-1"></a> <code>origin</code></td><td align="left"><code>"admin"</code> | <code>"user"</code> | <code>"system"</code> | <code>"transaction"</code> | <code>"listener"</code> | <code>"batch"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="path-3"></a> <code>path?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="reasons-4"></a> <code>reasons?</code></td><td align="left"><code>string</code>[]</td><td align="left">-</td></tr><tr><td align="left"><a id="request-3"></a> <code>request?</code></td><td align="left">{ <code>data?</code>: <code>unknown</code>; <code>query?</code>: <code>unknown</code>; <code>resourceData?</code>: <code>unknown</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>request.data?</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><code>request.query?</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><a id="resourceafter-1"></a> <code>resourceAfter?</code></td><td align="left">{ <code>data</code>: <code>unknown</code>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>resourceAfter.data</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><code>resourceAfter.exists</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="resourcebefore-1"></a> <code>resourceBefore?</code></td><td align="left">{ <code>data</code>: <code>unknown</code>; <code>exists</code>: <code>boolean</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>resourceBefore.data</code></td><td align="left"><code>unknown</code></td><td align="left">-</td></tr><tr><td align="left"><code>resourceBefore.exists</code></td><td align="left"><code>boolean</code></td><td align="left">-</td></tr><tr><td align="left"><a id="result-3"></a> <code>result</code></td><td align="left"><code>"allow"</code> | <code>"deny"</code> | <code>"unsupported"</code> | <code>"error"</code> | <code>"not-applicable"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="rules-3"></a> <code>rules?</code></td><td align="left">{ <code>engine</code>: <code>"firestore"</code> | <code>"rtdb"</code> | <code>"storage"</code>; <code>errorCode?</code>: <code>string</code>; <code>matchedPath?</code>: <code>string</code>; <code>matchedRule?</code>: <code>string</code>; <code>operations?</code>: <code>string</code>[]; <code>pathVariableBindings?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>string</code>>; <code>reason?</code>: <code>string</code>; <code>ruleIndex?</code>: <code>number</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>rules.engine</code></td><td align="left"><code>"firestore"</code> | <code>"rtdb"</code> | <code>"storage"</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.errorCode?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.matchedPath?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.matchedRule?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.operations?</code></td><td align="left"><code>string</code>[]</td><td align="left">-</td></tr><tr><td align="left"><code>rules.pathVariableBindings?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>string</code>></td><td align="left">-</td></tr><tr><td align="left"><code>rules.reason?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>rules.ruleIndex?</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="rulesdisposition-2"></a> <code>rulesDisposition?</code></td><td align="left"><a href="#rulesdisposition-3"><code>RulesDisposition</code></a></td><td align="left">Canonical statement of whether Security Rules evaluated this operation. Service emitters may provide it directly; the recorder normalizes legacy operation shapes at the unified stream seam.</td></tr><tr><td align="left"><a id="service-4"></a> <code>service</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td><td align="left">-</td></tr><tr><td align="left"><a id="triggeredby-2"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path?</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.path?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
 <hr>
 <p><a id="sandboxpersistenceoptions"></a></p>
 <h3 id="sandboxpersistenceoptions">SandboxPersistenceOptions</h3>
@@ -3077,7 +3155,11 @@ their state is a Firestore document.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="at-6"></a> <code>at</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="auth-9"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="detail-4"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="error-2"></a> <code>error</code></td><td align="left">{ <code>code?</code>: <code>string</code>; <code>message</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>error.code?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>error.message</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="id-6"></a> <code>id</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="kind-5"></a> <code>kind</code></td><td align="left"><code>"runtime_error"</code></td></tr><tr><td align="left"><a id="method-4"></a> <code>method</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="path-4"></a> <code>path?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="service-5"></a> <code>service</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="at-6"></a> <code>at</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><a id="auth-9"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="detail-4"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="error-2"></a> <code>error</code></td><td align="left">{ <code>code?</code>: <code>string</code>; <code>message</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>error.code?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>error.message</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="id-6"></a> <code>id</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="kind-5"></a> <code>kind</code></td><td align="left"><code>"runtime_error"</code></td></tr><tr><td align="left"><a id="method-4"></a> <code>method</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="path-4"></a> <code>path?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="service-5"></a> <code>service</code></td><td align="left"><a href="#eventservice"><code>EventService</code></a></td></tr></tbody></table></div>
 <hr>
 <p><a id="sandboxsnapshot"></a></p>
 <h3 id="sandboxsnapshot">SandboxSnapshot</h3>
@@ -3205,7 +3287,12 @@ diff <code>before</code>→<code>after</code> when both are present.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="after"></a> <code>after?</code></td><td align="left"><code>unknown</code></td><td align="left">Best-effort serializable snapshot of the state AFTER the mutation. Absent on deletes / sign-outs (nothing remains).</td></tr><tr><td align="left"><a id="at-7"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-10"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">Identity in effect when the op ran (the service’s <code>request.auth</code> equivalent). <code>null</code> for admin/anonymous-driven mutations (e.g. <code>sandbox.createUser</code>, an unauthenticated RTDB write).</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="before"></a> <code>before?</code></td><td align="left"><code>unknown</code></td><td align="left">Best-effort serializable snapshot of the state BEFORE the mutation. Absent when there was no prior state (a create) or it isn’t cheap to capture.</td></tr><tr><td align="left"><a id="detail-5"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">Free-form, service-specific extras a consumer may surface without re-deriving (e.g. storage <code>{ size, contentType }</code>, rtdb <code>{ committed }</code> for a transaction). Kept loose on purpose — it’s a display hint, not a contract.</td></tr><tr><td align="left"><a id="id-7"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-6"></a> <code>kind</code></td><td align="left"><code>"service_mutation"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="op-2"></a> <code>op</code></td><td align="left"><code>string</code></td><td align="left">Service-scoped operation name. Stable, lowercase, snake/kebab-free: - auth: <code>user_create</code></td></tr><tr><td align="left"><a id="path-5"></a> <code>path?</code></td><td align="left"><code>string</code></td><td align="left">The thing mutated, in the service’s own addressing scheme: - auth: the user <code>uid</code> (or <code>'*'</code> for a clear-all). Absent for a sign-out with no prior user. - storage: the object <code>fullPath</code> (e.g. <code>avatars/alice.png</code>). - rtdb: the database path (e.g. <code>/rooms/r1/messages</code>), or for a multi-path <code>update</code> the ref path the call targeted.</td></tr><tr><td align="left"><a id="service-6"></a> <code>service</code></td><td align="left"><code>"rtdb"</code> | <code>"auth"</code> | <code>"storage"</code> | <code>"messaging"</code> | <code>"ai"</code></td><td align="left">Which service performed the mutation. Always one of the non-Firestore services — Firestore rides its own <code>request</code>/<code>write</code> path. (The provenance <code>service</code> field on the stamped event mirrors this; it is set redundantly here so a consumer matching purely on <code>kind</code> still gets the discriminator without reaching into provenance.)</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="after"></a> <code>after?</code></td><td align="left"><code>unknown</code></td><td align="left">Best-effort serializable snapshot of the state AFTER the mutation. Absent on deletes / sign-outs (nothing remains).</td></tr><tr><td align="left"><a id="at-7"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-10"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">Identity in effect when the op ran (the service’s <code>request.auth</code> equivalent). <code>null</code> for admin/anonymous-driven mutations (e.g. <code>sandbox.createUser</code>, an unauthenticated RTDB write).</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="before"></a> <code>before?</code></td><td align="left"><code>unknown</code></td><td align="left">Best-effort serializable snapshot of the state BEFORE the mutation. Absent when there was no prior state (a create) or it isn’t cheap to capture.</td></tr><tr><td align="left"><a id="detail-5"></a> <code>detail?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">Free-form, service-specific extras a consumer may surface without re-deriving (e.g. storage <code>{ size, contentType }</code>, rtdb <code>{ committed }</code> for a transaction). Kept loose on purpose — it’s a display hint, not a contract.</td></tr><tr><td align="left"><a id="id-7"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-6"></a> <code>kind</code></td><td align="left"><code>"service_mutation"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="op-2"></a> <code>op</code></td><td align="left"><code>string</code></td><td align="left">Service-scoped operation name. Stable, lowercase, snake/kebab-free: - auth: <code>user_create</code></td></tr><tr><td align="left"><a id="path-5"></a> <code>path?</code></td><td align="left"><code>string</code></td><td align="left">The thing mutated, in the service’s own addressing scheme: - auth: the user <code>uid</code> (or <code>'*'</code> for a clear-all). Absent for a sign-out with no prior user. - storage: the object <code>fullPath</code> (e.g. <code>avatars/alice.png</code>). - rtdb: the database path (e.g. <code>/rooms/r1/messages</code>), or for a multi-path <code>update</code> the ref path the call targeted.</td></tr><tr><td align="left"><a id="service-6"></a> <code>service</code></td><td align="left"><code>"rtdb"</code> | <code>"auth"</code> | <code>"storage"</code> | <code>"messaging"</code> | <code>"ai"</code></td><td align="left">Which service performed the mutation. Always one of the non-Firestore services — Firestore rides its own <code>request</code>/<code>write</code> path. (The provenance <code>service</code> field on the stamped event mirrors this; it is set redundantly here so a consumer matching purely on <code>kind</code> still gets the discriminator without reaching into provenance.)</td></tr></tbody></table></div>
 <hr>
 <p><a id="sessionboundaryevent"></a></p>
 <h3 id="sessionboundaryevent">SessionBoundaryEvent</h3>
@@ -3357,7 +3444,12 @@ scenario produces large snapshots.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="addedcount"></a> <code>addedCount</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="at-9"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-11"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="id-9"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-8"></a> <code>kind</code></td><td align="left"><code>"snapshot_delivery"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="listenerid-3"></a> <code>listenerId</code></td><td align="left"><code>string</code></td><td align="left">Opaque listener id assigned at attach time.</td></tr><tr><td align="left"><a id="modifiedcount"></a> <code>modifiedCount</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="removedcount"></a> <code>removedCount</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="sample-1"></a> <code>sample?</code></td><td align="left">{ <code>docs</code>: { <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>path</code>: <code>string</code>; }[]; }</td><td align="left">Doc payloads, in the order the user callback saw them.</td></tr><tr><td align="left"><code>sample.docs</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>path</code>: <code>string</code>; }[]</td><td align="left">-</td></tr><tr><td align="left"><a id="size-1"></a> <code>size</code></td><td align="left"><code>number</code></td><td align="left"><code>1</code> for doc-kind (exists) / <code>0</code> (deleted), <code>n</code> for query-kind.</td></tr><tr><td align="left"><a id="target-2"></a> <code>target</code></td><td align="left">| { <code>kind</code>: <code>"doc"</code>; <code>path</code>: <code>string</code>; } | { <code>collection</code>: <code>string</code>; <code>kind</code>: <code>"query"</code>; }</td><td align="left">-</td></tr><tr><td align="left"><a id="triggeredby-3"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path</code>: <code>string</code>; }</td><td align="left">The user op that triggered this re-eval. Absent on initial fire and on <code>deployRules</code>-driven re-evals.</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="addedcount"></a> <code>addedCount</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="at-9"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-11"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="id-9"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-8"></a> <code>kind</code></td><td align="left"><code>"snapshot_delivery"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="listenerid-3"></a> <code>listenerId</code></td><td align="left"><code>string</code></td><td align="left">Opaque listener id assigned at attach time.</td></tr><tr><td align="left"><a id="modifiedcount"></a> <code>modifiedCount</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="removedcount"></a> <code>removedCount</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="sample-1"></a> <code>sample?</code></td><td align="left">{ <code>docs</code>: { <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>path</code>: <code>string</code>; }[]; }</td><td align="left">Doc payloads, in the order the user callback saw them.</td></tr><tr><td align="left"><code>sample.docs</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>path</code>: <code>string</code>; }[]</td><td align="left">-</td></tr><tr><td align="left"><a id="size-1"></a> <code>size</code></td><td align="left"><code>number</code></td><td align="left"><code>1</code> for doc-kind (exists) / <code>0</code> (deleted), <code>n</code> for query-kind.</td></tr><tr><td align="left"><a id="target-2"></a> <code>target</code></td><td align="left">| { <code>kind</code>: <code>"doc"</code>; <code>path</code>: <code>string</code>; } | { <code>collection</code>: <code>string</code>; <code>kind</code>: <code>"query"</code>; }</td><td align="left">-</td></tr><tr><td align="left"><a id="triggeredby-3"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path</code>: <code>string</code>; }</td><td align="left">The user op that triggered this re-eval. Absent on initial fire and on <code>deployRules</code>-driven re-evals.</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
 <hr>
 <p><a id="snapshoterrorevent"></a></p>
 <h3 id="snapshoterrorevent">SnapshotErrorEvent</h3>
@@ -3440,7 +3532,11 @@ scenario surfaces them.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="auth-12"></a> <code>auth?</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="code-1"></a> <code>code</code></td><td align="left"><code>"permission-denied"</code></td></tr><tr><td align="left"><a id="message-1"></a> <code>message</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="reasons-5"></a> <code>reasons?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><a id="request-4"></a> <code>request?</code></td><td align="left">{ <code>method</code>: <code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code>; <code>path</code>: <code>string</code>; <code>resourceData?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td></tr><tr><td align="left"><code>request.method</code></td><td align="left"><code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code></td></tr><tr><td align="left"><code>request.path</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="resource-2"></a> <code>resource?</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td></tr><tr><td align="left"><code>resource.data</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>resource.exists</code></td><td align="left"><code>boolean</code></td></tr><tr><td align="left"><a id="target-3"></a> <code>target</code></td><td align="left">| { <code>kind</code>: <code>"doc"</code>; <code>path</code>: <code>string</code>; } | { <code>collection</code>: <code>string</code>; <code>kind</code>: <code>"query"</code>; <code>query?</code>: <code>unknown</code>; }</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="auth-12"></a> <code>auth?</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="code-1"></a> <code>code</code></td><td align="left"><code>"permission-denied"</code></td></tr><tr><td align="left"><a id="message-1"></a> <code>message</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="reasons-5"></a> <code>reasons?</code></td><td align="left"><code>string</code>[]</td></tr><tr><td align="left"><a id="request-4"></a> <code>request?</code></td><td align="left">{ <code>method</code>: <code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code>; <code>path</code>: <code>string</code>; <code>resourceData?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td></tr><tr><td align="left"><code>request.method</code></td><td align="left"><code>"delete"</code> | <code>"get"</code> | <code>"list"</code> | <code>"create"</code> | <code>"update"</code></td></tr><tr><td align="left"><code>request.path</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>request.resourceData?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><a id="resource-2"></a> <code>resource?</code></td><td align="left">{ <code>data</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>exists</code>: <code>boolean</code>; }</td></tr><tr><td align="left"><code>resource.data</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>resource.exists</code></td><td align="left"><code>boolean</code></td></tr><tr><td align="left"><a id="target-3"></a> <code>target</code></td><td align="left">| { <code>kind</code>: <code>"doc"</code>; <code>path</code>: <code>string</code>; } | { <code>collection</code>: <code>string</code>; <code>kind</code>: <code>"query"</code>; <code>query?</code>: <code>unknown</code>; }</td></tr></tbody></table></div>
 <hr>
 <p><a id="snapshotsuppressedevent"></a></p>
 <h3 id="snapshotsuppressedevent">SnapshotSuppressedEvent</h3>
@@ -3521,7 +3617,12 @@ them.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at-10"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-13"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="id-10"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-9"></a> <code>kind</code></td><td align="left"><code>"snapshot_suppressed"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="listenerid-4"></a> <code>listenerId</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="reason-1"></a> <code>reason</code></td><td align="left"><code>"no-op"</code></td><td align="left">Why this re-eval was suppressed. v1 only emits <code>'no-op'</code>.</td></tr><tr><td align="left"><a id="target-4"></a> <code>target</code></td><td align="left">| { <code>kind</code>: <code>"doc"</code>; <code>path</code>: <code>string</code>; } | { <code>collection</code>: <code>string</code>; <code>kind</code>: <code>"query"</code>; }</td><td align="left">-</td></tr><tr><td align="left"><a id="triggeredby-4"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at-10"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-13"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="id-10"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-9"></a> <code>kind</code></td><td align="left"><code>"snapshot_suppressed"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="listenerid-4"></a> <code>listenerId</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="reason-1"></a> <code>reason</code></td><td align="left"><code>"no-op"</code></td><td align="left">Why this re-eval was suppressed. v1 only emits <code>'no-op'</code>.</td></tr><tr><td align="left"><a id="target-4"></a> <code>target</code></td><td align="left">| { <code>kind</code>: <code>"doc"</code>; <code>path</code>: <code>string</code>; } | { <code>collection</code>: <code>string</code>; <code>kind</code>: <code>"query"</code>; }</td><td align="left">-</td></tr><tr><td align="left"><a id="triggeredby-4"></a> <code>triggeredBy?</code></td><td align="left">{ <code>method</code>: <code>string</code>; <code>path</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.method</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>triggeredBy.path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr></tbody></table></div>
 <hr>
 <p><a id="tabsyncoptions"></a></p>
 <h3 id="tabsyncoptions">TabSyncOptions</h3>
@@ -3554,7 +3655,7 @@ the defaults provide a ready-to-use configuration for browser environments.</p>
 <h3 id="webstoragelike">WebStorageLike</h3>
 <p>Minimal web-storage-like contract the session persistence controller
 reads/writes. Matches the <code>localStorage</code> / <code>sessionStorage</code> browser
-API subset that <code>pyric dev</code>’s <code>SessionStore</code> already uses, so
+API subset that <code>pyric sandbox</code>’s <code>SessionStore</code> already uses, so
 browsers pass real storages and tests pass in-memory Map-backed fakes.</p>
 <p>Why the minimal subset (get/set/remove) instead of the full
 <code>Storage</code> interface: this library targets multiple environments
@@ -3747,7 +3848,12 @@ sentinel/auto-id capture lands.</p>
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at-11"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-14"></a> <code>auth</code></td><td align="left">{ <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="autoid"></a> <code>autoId?</code></td><td align="left"><code>string</code></td><td align="left">Minted document ID when this write came from <code>collection.add()</code> / <code>LocalEnvironment.createWithAutoId</code>. The replay engine aliases the path’s last segment to a fresh mint on replay (rather than preserving the original auto-ID).</td></tr><tr><td align="left"><a id="data-1"></a> <code>data?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">Pre-resolution write payload — <code>FieldValue.*</code> sentinels preserved as marker shapes (<code>{ __type: 'serverTimestamp' }</code>, etc.) so the replay engine can re-resolve them. The rule engine evaluated against the resolved form internally; the resolved form lives on <a href="#nextstate-1">nextState</a>. Absent on <code>delete</code>.</td></tr><tr><td align="left"><a id="detail-6"></a> <code>detail?</code></td><td align="left">{ <code>admin?</code>: <code>boolean</code>; } &#x26; <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">Free-form write metadata. <code>admin: true</code> marks a rules-bypassing setup/admin commit so replay can apply it as context without asking candidate rules to permit it.</td></tr><tr><td align="left"><a id="groupid-3"></a> <code>groupId?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="groupkind-4"></a> <code>groupKind?</code></td><td align="left"><code>"transaction"</code> | <code>"batch"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="id-11"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-10"></a> <code>kind</code></td><td align="left"><code>"write"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="method-5"></a> <code>method</code></td><td align="left"><code>"delete"</code> | <code>"create"</code> | <code>"update"</code> | <code>"set"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="nextstate-1"></a> <code>nextState</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">State AFTER this write. <code>null</code> on <code>delete</code>.</td></tr><tr><td align="left"><a id="path-6"></a> <code>path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="priorstate-1"></a> <code>priorState</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">State BEFORE this write. <code>null</code> for a non-existent doc.</td></tr><tr><td align="left"><a id="requesttime"></a> <code>requestTime</code></td><td align="left">{ <code>nanoseconds</code>: <code>number</code>; <code>seconds</code>: <code>number</code>; }</td><td align="left">Server time at which the rule engine evaluated this write — pinned per op (or shared across sub-ops in a batch / transaction). The replay engine re-issues this exact value when re-resolving <code>serverTimestamp()</code> sentinels so resolved fields are bit-identical on replay. Shape mirrors the Firestore Web SDK Timestamp (<code>{ seconds, nanoseconds }</code>).</td></tr><tr><td align="left"><code>requestTime.nanoseconds</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>requestTime.seconds</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="sentinels"></a> <code>sentinels?</code></td><td align="left">{ <code>field</code>: <code>string</code>; <code>kind</code>: | <code>"delete"</code> | <code>"serverTimestamp"</code> | <code>"increment"</code> | <code>"arrayUnion"</code> | <code>"arrayRemove"</code>; }[]</td><td align="left">FieldValue sentinels (serverTimestamp / increment / arrayUnion / arrayRemove / deleteField → ‘delete’) extracted from the pre-resolution write payload. The replay engine consumes this to re-issue the same sentinels at replay time without consulting resolved values that would have drifted. Path syntax: dotted with bracket-indices (‘a.b[0].c’). Absent when the write contained no sentinels.</td></tr></tbody></table></div>
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="at-11"></a> <code>at</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="auth-14"></a> <code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">-</td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="autoid"></a> <code>autoId?</code></td><td align="left"><code>string</code></td><td align="left">Minted document ID when this write came from <code>collection.add()</code> / <code>LocalEnvironment.createWithAutoId</code>. The replay engine aliases the path’s last segment to a fresh mint on replay (rather than preserving the original auto-ID).</td></tr><tr><td align="left"><a id="data-1"></a> <code>data?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">Pre-resolution write payload — <code>FieldValue.*</code> sentinels preserved as marker shapes (<code>{ __type: 'serverTimestamp' }</code>, etc.) so the replay engine can re-resolve them. The rule engine evaluated against the resolved form internally; the resolved form lives on <a href="#nextstate-1">nextState</a>. Absent on <code>delete</code>.</td></tr><tr><td align="left"><a id="detail-6"></a> <code>detail?</code></td><td align="left">{ <code>admin?</code>: <code>boolean</code>; } &#x26; <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">Free-form write metadata. <code>admin: true</code> marks a rules-bypassing setup/admin commit so replay can apply it as context without asking candidate rules to permit it.</td></tr><tr><td align="left"><a id="groupid-3"></a> <code>groupId?</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="groupkind-4"></a> <code>groupKind?</code></td><td align="left"><code>"transaction"</code> | <code>"batch"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="id-11"></a> <code>id</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="kind-10"></a> <code>kind</code></td><td align="left"><code>"write"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="method-5"></a> <code>method</code></td><td align="left"><code>"delete"</code> | <code>"create"</code> | <code>"update"</code> | <code>"set"</code></td><td align="left">-</td></tr><tr><td align="left"><a id="nextstate-1"></a> <code>nextState</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">State AFTER this write. <code>null</code> on <code>delete</code>.</td></tr><tr><td align="left"><a id="path-6"></a> <code>path</code></td><td align="left"><code>string</code></td><td align="left">-</td></tr><tr><td align="left"><a id="priorstate-1"></a> <code>priorState</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td><td align="left">State BEFORE this write. <code>null</code> for a non-existent doc.</td></tr><tr><td align="left"><a id="requesttime"></a> <code>requestTime</code></td><td align="left">{ <code>nanoseconds</code>: <code>number</code>; <code>seconds</code>: <code>number</code>; }</td><td align="left">Server time at which the rule engine evaluated this write — pinned per op (or shared across sub-ops in a batch / transaction). The replay engine re-issues this exact value when re-resolving <code>serverTimestamp()</code> sentinels so resolved fields are bit-identical on replay. Shape mirrors the Firestore Web SDK Timestamp (<code>{ seconds, nanoseconds }</code>).</td></tr><tr><td align="left"><code>requestTime.nanoseconds</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><code>requestTime.seconds</code></td><td align="left"><code>number</code></td><td align="left">-</td></tr><tr><td align="left"><a id="sentinels"></a> <code>sentinels?</code></td><td align="left">{ <code>field</code>: <code>string</code>; <code>kind</code>: | <code>"delete"</code> | <code>"serverTimestamp"</code> | <code>"increment"</code> | <code>"arrayUnion"</code> | <code>"arrayRemove"</code>; }[]</td><td align="left">FieldValue sentinels (serverTimestamp / increment / arrayUnion / arrayRemove / deleteField → ‘delete’) extracted from the pre-resolution write payload. The replay engine consumes this to re-issue the same sentinels at replay time without consulting resolved values that would have drifted. Path syntax: dotted with bracket-indices (‘a.b[0].c’). Absent when the write contained no sentinels.</td></tr></tbody></table></div>
 <h2 id="type-aliases">Type Aliases</h2>
 <p><a id="authlens-2"></a></p>
 <h3 id="authlens">AuthLens</h3>
@@ -3757,6 +3863,7 @@ sentinel/auto-id capture lands.</p>
 <span class="line"><span style="color:#ABB2BF">}</span></span>
 <span class="line"><span style="color:#ABB2BF">  | {</span></span>
 <span class="line"><span style="color:#E06C75">  mode</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">"as"</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  tenant</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">>;</span></span>
 <span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#ABB2BF">}</span></span>
@@ -4301,12 +4408,67 @@ than into process-local state.</p>
 <h4 id="returns-77">Returns</h4>
 <p><code>sandbox is RemoteSandbox</code></p>
 <hr>
+<p><a id="normalizeauthstate"></a></p>
+<h3 id="normalizeauthstate">normalizeAuthState()</h3>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">function</span><span style="color:#61AFEF"> normalizeAuthState</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75;font-style:italic">auth</span><span style="color:#ABB2BF">: {</span></span>
+<span class="line"><span style="color:#E06C75">  tenant</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">>;</span></span>
+<span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#ABB2BF">}): {</span></span>
+<span class="line"><span style="color:#E06C75">  tenant</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">>;</span></span>
+<span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#ABB2BF">};</span></span></code></pre>
+<p>Normalize AuthState during SandboxContextImpl context assembly.
+Automatically projects top-level <code>tenant</code> into <code>token.firebase.tenant</code>
+while preserving custom claims and explicit nested token overrides.
+Never mutates original input.</p>
+<h4 id="parameters-45">Parameters</h4>
+<div class="table-scroll">
+<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>auth</code></td><td align="left">{ <code>tenant?</code>: <code>string</code>; <code>token?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>uid</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>auth.tenant?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>auth.token?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>auth.uid</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
+<h4 id="returns-78">Returns</h4>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#ABB2BF">{</span></span>
+<span class="line"><span style="color:#E06C75">  tenant</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  token</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, </span><span style="color:#E06C75">unknown</span><span style="color:#56B6C2">></span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  uid</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<h5 id="tenant">tenant?</h5>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#E06C75">optional</span><span style="color:#E06C75"> tenant</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span></code></pre>
+<h5 id="token">token?</h5>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#E06C75">optional</span><span style="color:#E06C75"> token</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, </span><span style="color:#E06C75">unknown</span><span style="color:#56B6C2">></span><span style="color:#ABB2BF">;</span></span></code></pre>
+<h5 id="uid">uid</h5>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#E06C75">uid</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span></code></pre>
+<hr>
 <p><a id="operationcontextfor"></a></p>
 <h3 id="operationcontextfor">operationContextFor()</h3>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">function</span><span style="color:#61AFEF"> operationContextFor</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75;font-style:italic">event</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Pick</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">EventProvenance</span><span style="color:#ABB2BF">, </span><span style="color:#98C379">"operationContext"</span><span style="color:#ABB2BF"> | </span><span style="color:#98C379">"actor"</span><span style="color:#ABB2BF"> | </span><span style="color:#98C379">"authLens"</span><span style="color:#ABB2BF"> | </span><span style="color:#98C379">"planId"</span><span style="color:#ABB2BF">>): </span><span style="color:#E5C07B">OperationContext</span><span style="color:#ABB2BF">;</span></span></code></pre>
 <p>The canonical context on a recorded event. Old/pre-context events are
 explicitly unattributed rather than silently asserted to be app traffic.</p>
-<h4 id="parameters-45">Parameters</h4>
+<h4 id="parameters-46">Parameters</h4>
 <div class="table-scroll">
@@ -4321,7 +4483,7 @@ explicitly unattributed rather than silently asserted to be app traffic.</p>
 <table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>event</code></td><td align="left"><code>Pick</code>&#x3C;<a href="#eventprovenance"><code>EventProvenance</code></a>, <code>"operationContext"</code> | <code>"actor"</code> | <code>"authLens"</code> | <code>"planId"</code>></td></tr></tbody></table></div>
-<h4 id="returns-78">Returns</h4>
+<h4 id="returns-79">Returns</h4>
 <p><a href="#operationcontext-2"><code>OperationContext</code></a></p>
 <hr>
 <p><a id="parsebundle"></a></p>
@@ -4330,7 +4492,7 @@ explicitly unattributed rather than silently asserted to be app traffic.</p>
 <p>Parse a v3 bundle blob back into records. Returns an empty map for an
 unrecognized blob (e.g. a legacy v2 single-blob snapshot); migrate-on-open (a
 later commit) handles converting a v2 blob to v3 records.</p>
-<h4 id="parameters-46">Parameters</h4>
+<h4 id="parameters-47">Parameters</h4>
 <div class="table-scroll">
@@ -4345,7 +4507,7 @@ later commit) handles converting a v2 blob to v3 records.</p>
 <table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>blob</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
-<h4 id="returns-79">Returns</h4>
+<h4 id="returns-80">Returns</h4>
 <p><code>Map</code>&#x3C;<code>string</code>, <code>unknown</code>></p>
 <hr>
 <p><a id="promote"></a></p>
@@ -4364,7 +4526,7 @@ the admin plane:</p>
 <p>Admin-plane application fires the target’s listeners (matching how
 persistence restore lands docs), so live UI/handles see the promotion.</p>
 <p>The branch is marked discarded afterward — a promoted branch is spent.</p>
-<h4 id="parameters-47">Parameters</h4>
+<h4 id="parameters-48">Parameters</h4>
 <div class="table-scroll">
@@ -4386,7 +4548,7 @@ persistence restore lands docs), so live UI/handles see the promotion.</p>
 <table><thead><tr><th align="left">Parameter</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><code>branch</code></td><td align="left"><a href="#branch"><code>Branch</code></a></td><td align="left">The experiment to land.</td></tr><tr><td align="left"><code>target</code></td><td align="left"><a href="#localsandbox"><code>LocalSandbox</code></a></td><td align="left">The live sandbox to land it on.</td></tr></tbody></table></div>
-<h4 id="returns-80">Returns</h4>
+<h4 id="returns-81">Returns</h4>
 <p><code>void</code></p>
 <hr>
 <p><a id="recordbackendoverblob"></a></p>
@@ -4401,7 +4563,7 @@ The whole record set is bundled into that blob, for serve’s committable export
 file / HTTP state endpoint and any single-key store. It loses chunking’s scale
 benefit by design (the blob IS the single artifact). The blob is loaded once and
 cached, so a restore (list + per-record get) costs one read, not one per record.</p>
-<h4 id="parameters-48">Parameters</h4>
+<h4 id="parameters-49">Parameters</h4>
 <div class="table-scroll">
@@ -4428,7 +4590,7 @@ cached, so a restore (list + per-record get) costs one read, not one per record.
 <table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>io</code></td><td align="left">{ <code>clear</code>: <code>Promise</code>&#x3C;<code>void</code>>; <code>read</code>: <code>Promise</code>&#x3C;<code>string</code>>; <code>write</code>: <code>Promise</code>&#x3C;<code>void</code>>; }</td></tr><tr><td align="left"><code>io.clear</code></td><td align="left"></td></tr><tr><td align="left"><code>io.read</code></td><td align="left"></td></tr><tr><td align="left"><code>io.write</code></td><td align="left"></td></tr></tbody></table></div>
-<h4 id="returns-81">Returns</h4>
+<h4 id="returns-82">Returns</h4>
 <p><a href="#persistencebackend"><code>PersistenceBackend</code></a></p>
 <hr>
 <p><a id="rehydratedocvalue"></a></p>
@@ -4440,7 +4602,7 @@ values (and plain objects without a recognized discriminator) pass through.</p>
 <p>This is the canonical rehydrate used by BOTH the sandbox persistence
 serializer and the SharedWorker wire protocol, so the IDB format and the
 MessagePort wire format are guaranteed identical.</p>
-<h4 id="parameters-49">Parameters</h4>
+<h4 id="parameters-50">Parameters</h4>
 <div class="table-scroll">
@@ -4455,7 +4617,7 @@ MessagePort wire format are guaranteed identical.</p>
 <table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>value</code></td><td align="left"><code>unknown</code></td></tr></tbody></table></div>
-<h4 id="returns-82">Returns</h4>
+<h4 id="returns-83">Returns</h4>
 <p><code>unknown</code></p>
 <hr>
 <p><a id="replay-1"></a></p>
@@ -4470,7 +4632,7 @@ MessagePort wire format are guaranteed identical.</p>
 diffs the replayed sandbox’s final state against it and returns
 classified divergences. When omitted, divergences is <code>[]</code> (you still
 get the replayed sandbox; you can inspect its state manually).</p>
-<h4 id="parameters-50">Parameters</h4>
+<h4 id="parameters-51">Parameters</h4>
 <div class="table-scroll">
@@ -4497,7 +4659,7 @@ get the replayed sandbox; you can inspect its state manually).</p>
 <table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>events</code></td><td align="left">readonly <a href="#sandboxevent"><code>SandboxEvent</code></a>[]</td></tr><tr><td align="left"><code>rules</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>options?</code></td><td align="left"><a href="#replayoptions"><code>ReplayOptions</code></a></td></tr><tr><td align="left"><code>originalState?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>DocData</code>></td></tr></tbody></table></div>
-<h4 id="returns-83">Returns</h4>
+<h4 id="returns-84">Returns</h4>
 <p><a href="#replayresult"><code>ReplayResult</code></a></p>
 <hr>
 <p><a id="rulesdispositionfor"></a></p>
@@ -4506,7 +4668,7 @@ get the replayed sandbox; you can inspect its state manually).</p>
 <p>Normalize the legacy per-service markers exactly once, at the sandbox
 stream seam. Consumers must not inspect <code>detail.admin</code>, <code>origin</code>, or the
 presence of a trace themselves.</p>
-<h4 id="parameters-51">Parameters</h4>
+<h4 id="parameters-52">Parameters</h4>
 <div class="table-scroll">
@@ -4521,7 +4683,7 @@ presence of a trace themselves.</p>
 <table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>event</code></td><td align="left"><code>OperationEvent</code></td></tr></tbody></table></div>
-<h4 id="returns-84">Returns</h4>
+<h4 id="returns-85">Returns</h4>
 <p><a href="#rulesdisposition-3"><code>RulesDisposition</code></a></p>
 <hr>
 <p><a id="serializetobuckets"></a></p>
@@ -4533,7 +4695,7 @@ presence of a trace themselves.</p>
 <p>Partition a firestore doc map into v3 records: one bucket record per occupied
 bucket plus the <code>meta</code> record. The returned map’s keys are record ids; values
 are structured-clone-safe.</p>
-<h4 id="parameters-52">Parameters</h4>
+<h4 id="parameters-53">Parameters</h4>
 <div class="table-scroll">
@@ -4556,14 +4718,14 @@ are structured-clone-safe.</p>
 <table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>firestore</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>></td></tr><tr><td align="left"><code>services</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>savedAt</code></td><td align="left"><code>number</code></td></tr></tbody></table></div>
-<h4 id="returns-85">Returns</h4>
+<h4 id="returns-86">Returns</h4>
 <p><code>Map</code>&#x3C;<code>string</code>, <code>BucketRecord</code> | <code>MetaRecord</code>></p>
 <hr>
 <p><a id="tooperationrecord"></a></p>
 <h3 id="tooperationrecord">toOperationRecord()</h3>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">function</span><span style="color:#61AFEF"> toOperationRecord</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75;font-style:italic">event</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">SandboxEvent</span><span style="color:#ABB2BF">): </span><span style="color:#E5C07B">OperationRecord</span><span style="color:#ABB2BF">;</span></span></code></pre>
 <p>Project either traffic event family into the canonical record.</p>
-<h4 id="parameters-53">Parameters</h4>
+<h4 id="parameters-54">Parameters</h4>
 <div class="table-scroll">
@@ -4578,8 +4740,36 @@ are structured-clone-safe.</p>
 <table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>event</code></td><td align="left"><a href="#sandboxevent"><code>SandboxEvent</code></a></td></tr></tbody></table></div>
-<h4 id="returns-86">Returns</h4>
+<h4 id="returns-87">Returns</h4>
 <p><a href="#operationrecord"><code>OperationRecord</code></a></p>
+<hr>
+<p><a id="validateauthstate"></a></p>
+<h3 id="validateauthstate">validateAuthState()</h3>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">function</span><span style="color:#61AFEF"> validateAuthState</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75;font-style:italic">auth</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">): asserts </span><span style="color:#E06C75;font-style:italic">auth</span><span style="color:#C678DD"> is</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">tenant</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> string</span><span style="color:#ABB2BF">; </span><span style="color:#E06C75">token</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, </span><span style="color:#E06C75">unknown</span><span style="color:#56B6C2">></span><span style="color:#ABB2BF">; </span><span style="color:#E06C75">uid</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF"> };</span></span></code></pre>
+<p>Reject <code>undefined</code> and other clearly-malformed inputs at the
+<code>withAuth</code> call site. <code>null</code> is valid (anonymous);
+<code>{ uid: 'someUid' }</code> is valid; everything else throws so the
+mistake surfaces at the boundary instead of leaking into rule
+eval as a confusing denial.</p>
+<p>Shared between <code>Sandbox.withAuth</code> and <code>SandboxContext.withAuth</code>
+so both entries enforce the same validation.</p>
+<h4 id="parameters-55">Parameters</h4>
+<div class="table-scroll">
+<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>auth</code></td><td align="left"><code>unknown</code></td></tr></tbody></table></div>
+<h4 id="returns-88">Returns</h4>
+<p><code>asserts auth is { tenant?: string; token?: Record&#x3C;string, unknown>; uid: string }</code></p>
 <h2 id="references">References</h2>
 <p><a id="authstate"></a></p>
 <h3 id="authstate">AuthState</h3>
@@ -4595,4 +4785,4 @@ are structured-clone-safe.</p>
 <hr>
 <p><a id="sandboxerror"></a></p>
 <h3 id="sandboxerror">SandboxError</h3>
-<p>Re-exports <a href="/docs/pyric-firestore-reference-api/#sandboxerror">SandboxError</a></p> </article> </main> <aside class="doc-toc api-symbols" aria-label="API symbols" data-astro-cid-mw7aashj> <h2 class="doc-toc-heading" data-astro-cid-mw7aashj>Symbols</h2> <input class="api-symbol-filter" type="search" placeholder="Filter symbols" aria-label="Filter API symbols" data-api-symbol-filter data-astro-cid-mw7aashj> <div class="api-symbol-groups" data-api-symbol-groups data-astro-cid-mw7aashj> <section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#classes" data-astro-cid-mw7aashj> Classes </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="persistenceschemaerror" data-astro-cid-mw7aashj> <a href="#persistenceschemaerror" data-astro-cid-mw7aashj>PersistenceSchemaError</a> </li><li data-api-symbol="sandboxcontextimpl" data-astro-cid-mw7aashj> <a href="#sandboxcontextimpl" data-astro-cid-mw7aashj>SandboxContextImpl</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#interfaces" data-astro-cid-mw7aashj> Interfaces </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="activityeventprovenance" data-astro-cid-mw7aashj> <a href="#activityeventprovenance" data-astro-cid-mw7aashj>ActivityEventProvenance</a> </li><li data-api-symbol="branch" data-astro-cid-mw7aashj> <a href="#branch" data-astro-cid-mw7aashj>Branch</a> </li><li data-api-symbol="broadcastchannellike" data-astro-cid-mw7aashj> <a href="#broadcastchannellike" data-astro-cid-mw7aashj>BroadcastChannelLike</a> </li><li data-api-symbol="denialcontext" data-astro-cid-mw7aashj> <a href="#denialcontext" data-astro-cid-mw7aashj>DenialContext</a> </li><li data-api-symbol="denialevent" data-astro-cid-mw7aashj> <a href="#denialevent" data-astro-cid-mw7aashj>DenialEvent</a> </li><li data-api-symbol="eventprovenance" data-astro-cid-mw7aashj> <a href="#eventprovenance" data-astro-cid-mw7aashj>EventProvenance</a> </li><li data-api-symbol="listenerlifecycleevent" data-astro-cid-mw7aashj> <a href="#listenerlifecycleevent" data-astro-cid-mw7aashj>ListenerLifecycleEvent</a> </li><li data-api-symbol="localsandbox" data-astro-cid-mw7aashj> <a href="#localsandbox" data-astro-cid-mw7aashj>LocalSandbox</a> </li><li data-api-symbol="operationcontext" data-astro-cid-mw7aashj> <a href="#operationcontext" data-astro-cid-mw7aashj>OperationContext</a> </li><li data-api-symbol="operationrecord" data-astro-cid-mw7aashj> <a href="#operationrecord" data-astro-cid-mw7aashj>OperationRecord</a> </li><li data-api-symbol="persistableservice" data-astro-cid-mw7aashj> <a href="#persistableservice" data-astro-cid-mw7aashj>PersistableService</a> </li><li data-api-symbol="persistencebackend" data-astro-cid-mw7aashj> <a href="#persistencebackend" data-astro-cid-mw7aashj>PersistenceBackend</a> </li><li data-api-symbol="persistencecontroller" data-astro-cid-mw7aashj> <a href="#persistencecontroller" data-astro-cid-mw7aashj>PersistenceController</a> </li><li data-api-symbol="remotesandbox" data-astro-cid-mw7aashj> <a href="#remotesandbox" data-astro-cid-mw7aashj>RemoteSandbox</a> </li><li data-api-symbol="remotesandboxchannel" data-astro-cid-mw7aashj> <a href="#remotesandboxchannel" data-astro-cid-mw7aashj>RemoteSandboxChannel</a> </li><li data-api-symbol="remotesandboxfactoryoptions" data-astro-cid-mw7aashj> <a href="#remotesandboxfactoryoptions" data-astro-cid-mw7aashj>RemoteSandboxFactoryOptions</a> </li><li data-api-symbol="replayoptions" data-astro-cid-mw7aashj> <a href="#replayoptions" data-astro-cid-mw7aashj>ReplayOptions</a> </li><li data-api-symbol="replayresult" data-astro-cid-mw7aashj> <a href="#replayresult" data-astro-cid-mw7aashj>ReplayResult</a> </li><li data-api-symbol="requestevent" data-astro-cid-mw7aashj> <a href="#requestevent" data-astro-cid-mw7aashj>RequestEvent</a> </li><li data-api-symbol="sandboxcommitevent" data-astro-cid-mw7aashj> <a href="#sandboxcommitevent" data-astro-cid-mw7aashj>SandboxCommitEvent</a> </li><li data-api-symbol="sandboxconfig" data-astro-cid-mw7aashj> <a href="#sandboxconfig" data-astro-cid-mw7aashj>SandboxConfig</a> </li><li data-api-symbol="sandboxlistenerevent" data-astro-cid-mw7aashj> <a href="#sandboxlistenerevent" data-astro-cid-mw7aashj>SandboxListenerEvent</a> </li><li data-api-symbol="sandboxoperationevent" data-astro-cid-mw7aashj> <a href="#sandboxoperationevent" data-astro-cid-mw7aashj>SandboxOperationEvent</a> </li><li data-api-symbol="sandboxpersistenceoptions" data-astro-cid-mw7aashj> <a href="#sandboxpersistenceoptions" data-astro-cid-mw7aashj>SandboxPersistenceOptions</a> </li><li data-api-symbol="sandboxruntimeerrorevent" data-astro-cid-mw7aashj> <a href="#sandboxruntimeerrorevent" data-astro-cid-mw7aashj>SandboxRuntimeErrorEvent</a> </li><li data-api-symbol="sandboxsnapshot" data-astro-cid-mw7aashj> <a href="#sandboxsnapshot" data-astro-cid-mw7aashj>SandboxSnapshot</a> </li><li data-api-symbol="servicemutationevent" data-astro-cid-mw7aashj> <a href="#servicemutationevent" data-astro-cid-mw7aashj>ServiceMutationEvent</a> </li><li data-api-symbol="sessionboundaryevent" data-astro-cid-mw7aashj> <a href="#sessionboundaryevent" data-astro-cid-mw7aashj>SessionBoundaryEvent</a> </li><li data-api-symbol="snapshotdeliveryevent" data-astro-cid-mw7aashj> <a href="#snapshotdeliveryevent" data-astro-cid-mw7aashj>SnapshotDeliveryEvent</a> </li><li data-api-symbol="snapshoterrorevent" data-astro-cid-mw7aashj> <a href="#snapshoterrorevent" data-astro-cid-mw7aashj>SnapshotErrorEvent</a> </li><li data-api-symbol="snapshotsuppressedevent" data-astro-cid-mw7aashj> <a href="#snapshotsuppressedevent" data-astro-cid-mw7aashj>SnapshotSuppressedEvent</a> </li><li data-api-symbol="tabsyncoptions" data-astro-cid-mw7aashj> <a href="#tabsyncoptions" data-astro-cid-mw7aashj>TabSyncOptions</a> </li><li data-api-symbol="webstoragelike" data-astro-cid-mw7aashj> <a href="#webstoragelike" data-astro-cid-mw7aashj>WebStorageLike</a> </li><li data-api-symbol="writesandboxevent" data-astro-cid-mw7aashj> <a href="#writesandboxevent" data-astro-cid-mw7aashj>WriteSandboxEvent</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#type-aliases" data-astro-cid-mw7aashj> Type Aliases </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="authlens" data-astro-cid-mw7aashj> <a href="#authlens" data-astro-cid-mw7aashj>AuthLens</a> </li><li data-api-symbol="difftarget" data-astro-cid-mw7aashj> <a href="#difftarget" data-astro-cid-mw7aashj>DiffTarget</a> </li><li data-api-symbol="divergence" data-astro-cid-mw7aashj> <a href="#divergence" data-astro-cid-mw7aashj>Divergence</a> </li><li data-api-symbol="eventactor" data-astro-cid-mw7aashj> <a href="#eventactor" data-astro-cid-mw7aashj>EventActor</a> </li><li data-api-symbol="eventservice" data-astro-cid-mw7aashj> <a href="#eventservice" data-astro-cid-mw7aashj>EventService</a> </li><li data-api-symbol="remotesandboxfactory()" data-astro-cid-mw7aashj> <a href="#remotesandboxfactory" data-astro-cid-mw7aashj>RemoteSandboxFactory()</a> </li><li data-api-symbol="rulesdisposition" data-astro-cid-mw7aashj> <a href="#rulesdisposition" data-astro-cid-mw7aashj>RulesDisposition</a> </li><li data-api-symbol="sandboxerrorcode" data-astro-cid-mw7aashj> <a href="#sandboxerrorcode" data-astro-cid-mw7aashj>SandboxErrorCode</a> </li><li data-api-symbol="sandboxevent" data-astro-cid-mw7aashj> <a href="#sandboxevent" data-astro-cid-mw7aashj>SandboxEvent</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#variables" data-astro-cid-mw7aashj> Variables </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="remote_sandbox" data-astro-cid-mw7aashj> <a href="#remote_sandbox" data-astro-cid-mw7aashj>REMOTE_SANDBOX</a> </li><li data-api-symbol="remote_sandbox_factory" data-astro-cid-mw7aashj> <a href="#remote_sandbox_factory" data-astro-cid-mw7aashj>REMOTE_SANDBOX_FACTORY</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#functions" data-astro-cid-mw7aashj> Functions </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="apply()" data-astro-cid-mw7aashj> <a href="#apply" data-astro-cid-mw7aashj>apply()</a> </li><li data-api-symbol="attachpersistence()" data-astro-cid-mw7aashj> <a href="#attachpersistence" data-astro-cid-mw7aashj>attachPersistence()</a> </li><li data-api-symbol="attachtabsync()" data-astro-cid-mw7aashj> <a href="#attachtabsync" data-astro-cid-mw7aashj>attachTabSync()</a> </li><li data-api-symbol="bundlerecords()" data-astro-cid-mw7aashj> <a href="#bundlerecords" data-astro-cid-mw7aashj>bundleRecords()</a> </li><li data-api-symbol="createindexeddbbackend()" data-astro-cid-mw7aashj> <a href="#createindexeddbbackend" data-astro-cid-mw7aashj>createIndexedDBBackend()</a> </li><li data-api-symbol="creatememorybackend()" data-astro-cid-mw7aashj> <a href="#creatememorybackend" data-astro-cid-mw7aashj>createMemoryBackend()</a> </li><li data-api-symbol="deserializefrombuckets()" data-astro-cid-mw7aashj> <a href="#deserializefrombuckets" data-astro-cid-mw7aashj>deserializeFromBuckets()</a> </li><li data-api-symbol="diff()" data-astro-cid-mw7aashj> <a href="#diff" data-astro-cid-mw7aashj>diff()</a> </li><li data-api-symbol="discard()" data-astro-cid-mw7aashj> <a href="#discard" data-astro-cid-mw7aashj>discard()</a> </li><li data-api-symbol="fork()" data-astro-cid-mw7aashj> <a href="#fork" data-astro-cid-mw7aashj>fork()</a> </li><li data-api-symbol="initializesandbox()" data-astro-cid-mw7aashj> <a href="#initializesandbox" data-astro-cid-mw7aashj>initializeSandbox()</a> </li><li data-api-symbol="isoperationevent()" data-astro-cid-mw7aashj> <a href="#isoperationevent" data-astro-cid-mw7aashj>isOperationEvent()</a> </li><li data-api-symbol="isremotesandbox()" data-astro-cid-mw7aashj> <a href="#isremotesandbox" data-astro-cid-mw7aashj>isRemoteSandbox()</a> </li><li data-api-symbol="operationcontextfor()" data-astro-cid-mw7aashj> <a href="#operationcontextfor" data-astro-cid-mw7aashj>operationContextFor()</a> </li><li data-api-symbol="parsebundle()" data-astro-cid-mw7aashj> <a href="#parsebundle" data-astro-cid-mw7aashj>parseBundle()</a> </li><li data-api-symbol="promote()" data-astro-cid-mw7aashj> <a href="#promote" data-astro-cid-mw7aashj>promote()</a> </li><li data-api-symbol="recordbackendoverblob()" data-astro-cid-mw7aashj> <a href="#recordbackendoverblob" data-astro-cid-mw7aashj>recordBackendOverBlob()</a> </li><li data-api-symbol="rehydratedocvalue()" data-astro-cid-mw7aashj> <a href="#rehydratedocvalue" data-astro-cid-mw7aashj>rehydrateDocValue()</a> </li><li data-api-symbol="replay()" data-astro-cid-mw7aashj> <a href="#replay" data-astro-cid-mw7aashj>replay()</a> </li><li data-api-symbol="rulesdispositionfor()" data-astro-cid-mw7aashj> <a href="#rulesdispositionfor" data-astro-cid-mw7aashj>rulesDispositionFor()</a> </li><li data-api-symbol="serializetobuckets()" data-astro-cid-mw7aashj> <a href="#serializetobuckets" data-astro-cid-mw7aashj>serializeToBuckets()</a> </li><li data-api-symbol="tooperationrecord()" data-astro-cid-mw7aashj> <a href="#tooperationrecord" data-astro-cid-mw7aashj>toOperationRecord()</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#references" data-astro-cid-mw7aashj> References </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="authstate" data-astro-cid-mw7aashj> <a href="#authstate" data-astro-cid-mw7aashj>AuthState</a> </li><li data-api-symbol="sandbox" data-astro-cid-mw7aashj> <a href="#sandbox" data-astro-cid-mw7aashj>Sandbox</a> </li><li data-api-symbol="sandboxcontext" data-astro-cid-mw7aashj> <a href="#sandboxcontext" data-astro-cid-mw7aashj>SandboxContext</a> </li><li data-api-symbol="sandboxerror" data-astro-cid-mw7aashj> <a href="#sandboxerror" data-astro-cid-mw7aashj>SandboxError</a> </li> </ul> </section> <p class="api-symbol-empty" data-api-symbol-empty hidden data-astro-cid-mw7aashj>No matching symbols</p> </div> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script>  </body></html>
+<p>Re-exports <a href="/docs/pyric-firestore-reference-api/#sandboxerror">SandboxError</a></p> </article> </main> <aside class="doc-toc api-symbols" aria-label="API symbols" data-astro-cid-mw7aashj> <h2 class="doc-toc-heading" data-astro-cid-mw7aashj>Symbols</h2> <input class="api-symbol-filter" type="search" placeholder="Filter symbols" aria-label="Filter API symbols" data-api-symbol-filter data-astro-cid-mw7aashj> <div class="api-symbol-groups" data-api-symbol-groups data-astro-cid-mw7aashj> <section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#classes" data-astro-cid-mw7aashj> Classes </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="persistenceschemaerror" data-astro-cid-mw7aashj> <a href="#persistenceschemaerror" data-astro-cid-mw7aashj>PersistenceSchemaError</a> </li><li data-api-symbol="sandboxcontextimpl" data-astro-cid-mw7aashj> <a href="#sandboxcontextimpl" data-astro-cid-mw7aashj>SandboxContextImpl</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#interfaces" data-astro-cid-mw7aashj> Interfaces </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="activityeventprovenance" data-astro-cid-mw7aashj> <a href="#activityeventprovenance" data-astro-cid-mw7aashj>ActivityEventProvenance</a> </li><li data-api-symbol="branch" data-astro-cid-mw7aashj> <a href="#branch" data-astro-cid-mw7aashj>Branch</a> </li><li data-api-symbol="broadcastchannellike" data-astro-cid-mw7aashj> <a href="#broadcastchannellike" data-astro-cid-mw7aashj>BroadcastChannelLike</a> </li><li data-api-symbol="denialcontext" data-astro-cid-mw7aashj> <a href="#denialcontext" data-astro-cid-mw7aashj>DenialContext</a> </li><li data-api-symbol="denialevent" data-astro-cid-mw7aashj> <a href="#denialevent" data-astro-cid-mw7aashj>DenialEvent</a> </li><li data-api-symbol="eventprovenance" data-astro-cid-mw7aashj> <a href="#eventprovenance" data-astro-cid-mw7aashj>EventProvenance</a> </li><li data-api-symbol="listenerlifecycleevent" data-astro-cid-mw7aashj> <a href="#listenerlifecycleevent" data-astro-cid-mw7aashj>ListenerLifecycleEvent</a> </li><li data-api-symbol="localsandbox" data-astro-cid-mw7aashj> <a href="#localsandbox" data-astro-cid-mw7aashj>LocalSandbox</a> </li><li data-api-symbol="operationcontext" data-astro-cid-mw7aashj> <a href="#operationcontext" data-astro-cid-mw7aashj>OperationContext</a> </li><li data-api-symbol="operationrecord" data-astro-cid-mw7aashj> <a href="#operationrecord" data-astro-cid-mw7aashj>OperationRecord</a> </li><li data-api-symbol="persistableservice" data-astro-cid-mw7aashj> <a href="#persistableservice" data-astro-cid-mw7aashj>PersistableService</a> </li><li data-api-symbol="persistencebackend" data-astro-cid-mw7aashj> <a href="#persistencebackend" data-astro-cid-mw7aashj>PersistenceBackend</a> </li><li data-api-symbol="persistencecontroller" data-astro-cid-mw7aashj> <a href="#persistencecontroller" data-astro-cid-mw7aashj>PersistenceController</a> </li><li data-api-symbol="remotesandbox" data-astro-cid-mw7aashj> <a href="#remotesandbox" data-astro-cid-mw7aashj>RemoteSandbox</a> </li><li data-api-symbol="remotesandboxchannel" data-astro-cid-mw7aashj> <a href="#remotesandboxchannel" data-astro-cid-mw7aashj>RemoteSandboxChannel</a> </li><li data-api-symbol="remotesandboxfactoryoptions" data-astro-cid-mw7aashj> <a href="#remotesandboxfactoryoptions" data-astro-cid-mw7aashj>RemoteSandboxFactoryOptions</a> </li><li data-api-symbol="replayoptions" data-astro-cid-mw7aashj> <a href="#replayoptions" data-astro-cid-mw7aashj>ReplayOptions</a> </li><li data-api-symbol="replayresult" data-astro-cid-mw7aashj> <a href="#replayresult" data-astro-cid-mw7aashj>ReplayResult</a> </li><li data-api-symbol="requestevent" data-astro-cid-mw7aashj> <a href="#requestevent" data-astro-cid-mw7aashj>RequestEvent</a> </li><li data-api-symbol="sandboxcommitevent" data-astro-cid-mw7aashj> <a href="#sandboxcommitevent" data-astro-cid-mw7aashj>SandboxCommitEvent</a> </li><li data-api-symbol="sandboxconfig" data-astro-cid-mw7aashj> <a href="#sandboxconfig" data-astro-cid-mw7aashj>SandboxConfig</a> </li><li data-api-symbol="sandboxlistenerevent" data-astro-cid-mw7aashj> <a href="#sandboxlistenerevent" data-astro-cid-mw7aashj>SandboxListenerEvent</a> </li><li data-api-symbol="sandboxoperationevent" data-astro-cid-mw7aashj> <a href="#sandboxoperationevent" data-astro-cid-mw7aashj>SandboxOperationEvent</a> </li><li data-api-symbol="sandboxpersistenceoptions" data-astro-cid-mw7aashj> <a href="#sandboxpersistenceoptions" data-astro-cid-mw7aashj>SandboxPersistenceOptions</a> </li><li data-api-symbol="sandboxruntimeerrorevent" data-astro-cid-mw7aashj> <a href="#sandboxruntimeerrorevent" data-astro-cid-mw7aashj>SandboxRuntimeErrorEvent</a> </li><li data-api-symbol="sandboxsnapshot" data-astro-cid-mw7aashj> <a href="#sandboxsnapshot" data-astro-cid-mw7aashj>SandboxSnapshot</a> </li><li data-api-symbol="servicemutationevent" data-astro-cid-mw7aashj> <a href="#servicemutationevent" data-astro-cid-mw7aashj>ServiceMutationEvent</a> </li><li data-api-symbol="sessionboundaryevent" data-astro-cid-mw7aashj> <a href="#sessionboundaryevent" data-astro-cid-mw7aashj>SessionBoundaryEvent</a> </li><li data-api-symbol="snapshotdeliveryevent" data-astro-cid-mw7aashj> <a href="#snapshotdeliveryevent" data-astro-cid-mw7aashj>SnapshotDeliveryEvent</a> </li><li data-api-symbol="snapshoterrorevent" data-astro-cid-mw7aashj> <a href="#snapshoterrorevent" data-astro-cid-mw7aashj>SnapshotErrorEvent</a> </li><li data-api-symbol="snapshotsuppressedevent" data-astro-cid-mw7aashj> <a href="#snapshotsuppressedevent" data-astro-cid-mw7aashj>SnapshotSuppressedEvent</a> </li><li data-api-symbol="tabsyncoptions" data-astro-cid-mw7aashj> <a href="#tabsyncoptions" data-astro-cid-mw7aashj>TabSyncOptions</a> </li><li data-api-symbol="webstoragelike" data-astro-cid-mw7aashj> <a href="#webstoragelike" data-astro-cid-mw7aashj>WebStorageLike</a> </li><li data-api-symbol="writesandboxevent" data-astro-cid-mw7aashj> <a href="#writesandboxevent" data-astro-cid-mw7aashj>WriteSandboxEvent</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#type-aliases" data-astro-cid-mw7aashj> Type Aliases </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="authlens" data-astro-cid-mw7aashj> <a href="#authlens" data-astro-cid-mw7aashj>AuthLens</a> </li><li data-api-symbol="difftarget" data-astro-cid-mw7aashj> <a href="#difftarget" data-astro-cid-mw7aashj>DiffTarget</a> </li><li data-api-symbol="divergence" data-astro-cid-mw7aashj> <a href="#divergence" data-astro-cid-mw7aashj>Divergence</a> </li><li data-api-symbol="eventactor" data-astro-cid-mw7aashj> <a href="#eventactor" data-astro-cid-mw7aashj>EventActor</a> </li><li data-api-symbol="eventservice" data-astro-cid-mw7aashj> <a href="#eventservice" data-astro-cid-mw7aashj>EventService</a> </li><li data-api-symbol="remotesandboxfactory()" data-astro-cid-mw7aashj> <a href="#remotesandboxfactory" data-astro-cid-mw7aashj>RemoteSandboxFactory()</a> </li><li data-api-symbol="rulesdisposition" data-astro-cid-mw7aashj> <a href="#rulesdisposition" data-astro-cid-mw7aashj>RulesDisposition</a> </li><li data-api-symbol="sandboxerrorcode" data-astro-cid-mw7aashj> <a href="#sandboxerrorcode" data-astro-cid-mw7aashj>SandboxErrorCode</a> </li><li data-api-symbol="sandboxevent" data-astro-cid-mw7aashj> <a href="#sandboxevent" data-astro-cid-mw7aashj>SandboxEvent</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#variables" data-astro-cid-mw7aashj> Variables </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="remote_sandbox" data-astro-cid-mw7aashj> <a href="#remote_sandbox" data-astro-cid-mw7aashj>REMOTE_SANDBOX</a> </li><li data-api-symbol="remote_sandbox_factory" data-astro-cid-mw7aashj> <a href="#remote_sandbox_factory" data-astro-cid-mw7aashj>REMOTE_SANDBOX_FACTORY</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#functions" data-astro-cid-mw7aashj> Functions </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="apply()" data-astro-cid-mw7aashj> <a href="#apply" data-astro-cid-mw7aashj>apply()</a> </li><li data-api-symbol="attachpersistence()" data-astro-cid-mw7aashj> <a href="#attachpersistence" data-astro-cid-mw7aashj>attachPersistence()</a> </li><li data-api-symbol="attachtabsync()" data-astro-cid-mw7aashj> <a href="#attachtabsync" data-astro-cid-mw7aashj>attachTabSync()</a> </li><li data-api-symbol="bundlerecords()" data-astro-cid-mw7aashj> <a href="#bundlerecords" data-astro-cid-mw7aashj>bundleRecords()</a> </li><li data-api-symbol="createindexeddbbackend()" data-astro-cid-mw7aashj> <a href="#createindexeddbbackend" data-astro-cid-mw7aashj>createIndexedDBBackend()</a> </li><li data-api-symbol="creatememorybackend()" data-astro-cid-mw7aashj> <a href="#creatememorybackend" data-astro-cid-mw7aashj>createMemoryBackend()</a> </li><li data-api-symbol="deserializefrombuckets()" data-astro-cid-mw7aashj> <a href="#deserializefrombuckets" data-astro-cid-mw7aashj>deserializeFromBuckets()</a> </li><li data-api-symbol="diff()" data-astro-cid-mw7aashj> <a href="#diff" data-astro-cid-mw7aashj>diff()</a> </li><li data-api-symbol="discard()" data-astro-cid-mw7aashj> <a href="#discard" data-astro-cid-mw7aashj>discard()</a> </li><li data-api-symbol="fork()" data-astro-cid-mw7aashj> <a href="#fork" data-astro-cid-mw7aashj>fork()</a> </li><li data-api-symbol="initializesandbox()" data-astro-cid-mw7aashj> <a href="#initializesandbox" data-astro-cid-mw7aashj>initializeSandbox()</a> </li><li data-api-symbol="isoperationevent()" data-astro-cid-mw7aashj> <a href="#isoperationevent" data-astro-cid-mw7aashj>isOperationEvent()</a> </li><li data-api-symbol="isremotesandbox()" data-astro-cid-mw7aashj> <a href="#isremotesandbox" data-astro-cid-mw7aashj>isRemoteSandbox()</a> </li><li data-api-symbol="normalizeauthstate()" data-astro-cid-mw7aashj> <a href="#normalizeauthstate" data-astro-cid-mw7aashj>normalizeAuthState()</a> </li><li data-api-symbol="operationcontextfor()" data-astro-cid-mw7aashj> <a href="#operationcontextfor" data-astro-cid-mw7aashj>operationContextFor()</a> </li><li data-api-symbol="parsebundle()" data-astro-cid-mw7aashj> <a href="#parsebundle" data-astro-cid-mw7aashj>parseBundle()</a> </li><li data-api-symbol="promote()" data-astro-cid-mw7aashj> <a href="#promote" data-astro-cid-mw7aashj>promote()</a> </li><li data-api-symbol="recordbackendoverblob()" data-astro-cid-mw7aashj> <a href="#recordbackendoverblob" data-astro-cid-mw7aashj>recordBackendOverBlob()</a> </li><li data-api-symbol="rehydratedocvalue()" data-astro-cid-mw7aashj> <a href="#rehydratedocvalue" data-astro-cid-mw7aashj>rehydrateDocValue()</a> </li><li data-api-symbol="replay()" data-astro-cid-mw7aashj> <a href="#replay" data-astro-cid-mw7aashj>replay()</a> </li><li data-api-symbol="rulesdispositionfor()" data-astro-cid-mw7aashj> <a href="#rulesdispositionfor" data-astro-cid-mw7aashj>rulesDispositionFor()</a> </li><li data-api-symbol="serializetobuckets()" data-astro-cid-mw7aashj> <a href="#serializetobuckets" data-astro-cid-mw7aashj>serializeToBuckets()</a> </li><li data-api-symbol="tooperationrecord()" data-astro-cid-mw7aashj> <a href="#tooperationrecord" data-astro-cid-mw7aashj>toOperationRecord()</a> </li><li data-api-symbol="validateauthstate()" data-astro-cid-mw7aashj> <a href="#validateauthstate" data-astro-cid-mw7aashj>validateAuthState()</a> </li> </ul> </section><section class="api-symbol-group" data-api-symbol-group data-astro-cid-mw7aashj> <a class="api-symbol-kind" href="#references" data-astro-cid-mw7aashj> References </a> <ul data-astro-cid-mw7aashj> <li data-api-symbol="authstate" data-astro-cid-mw7aashj> <a href="#authstate" data-astro-cid-mw7aashj>AuthState</a> </li><li data-api-symbol="sandbox" data-astro-cid-mw7aashj> <a href="#sandbox" data-astro-cid-mw7aashj>Sandbox</a> </li><li data-api-symbol="sandboxcontext" data-astro-cid-mw7aashj> <a href="#sandboxcontext" data-astro-cid-mw7aashj>SandboxContext</a> </li><li data-api-symbol="sandboxerror" data-astro-cid-mw7aashj> <a href="#sandboxerror" data-astro-cid-mw7aashj>SandboxError</a> </li> </ul> </section> <p class="api-symbol-empty" data-api-symbol-empty hidden data-astro-cid-mw7aashj>No matching symbols</p> </div> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script>  </body></html>