@pyric/cli 0.1.0-alpha.26 → 0.1.0-alpha.27

package/dist/serve/site-ui/_astro/{app.DFdWhpVY.js → app.DpzsBfos.js}

@@ -1 +1 @@
-import{S}from"./app.BpEphDR7.js";import"./sandbox-controls.Bp5PoonS.js";import"./index.DBy5LfQW.js";import"./writes.DHSW22XD.js";import"./index.DNyk7q8W.js";export{S as StudioApp};
+import{S}from"./app.CiMHEvEW.js";import"./sandbox-controls.Bp5PoonS.js";import"./index.DBy5LfQW.js";import"./writes.DHSW22XD.js";import"./index.DNyk7q8W.js";export{S as StudioApp};

package/dist/serve/site-ui/_astro/{seed.vvXV1ioI.js → seed.BpXSRzLo.js}

@@ -1,4 +1,4 @@
-import{s as f,b7 as h,b8 as w}from"./sandbox-controls.Bp5PoonS.js";import{s as o,d as s}from"./writes.DHSW22XD.js";import{s as n,a as A,b as y,u as m,r as d}from"./app.BpEphDR7.js";import"./index.DBy5LfQW.js";import"./index.DNyk7q8W.js";class g{static serverTimestamp(){return{__type:"serverTimestamp"}}static increment(a){return{__type:"increment",value:a}}static arrayUnion(...a){return{__type:"arrayUnion",values:a}}static arrayRemove(...a){return{__type:"arrayRemove",values:a}}static delete(){return{__type:"deleteField"}}}function p(){return g.serverTimestamp()}async function b(t){n.createUser(t,{uid:"alice",email:"alice@gmail.com",displayName:"Alice Nguyen",emailVerified:!0,photoUrl:"https://lh3.googleusercontent.com/a/alice",providerUserInfo:[{providerId:"google.com"}],customClaims:{plan:"pro"}}),n.createUser(t,{uid:"bob",email:"bob@example.com",password:"pyric-demo",displayName:"Bob Carter",emailVerified:!0,customClaims:{role:"editor"}}),n.createUser(t,{uid:"carol",email:"carol@example.com",displayName:"Carol Diaz",emailVerified:!1}),await A(t),await y(t)}const v=new w(37.7749,-122.4194);async function R(t){const a=Date.now(),i=e=>h.fromMillis(a-e*6e4),l=[{id:"alice",name:"Alice Nguyen",email:"alice@gmail.com",plan:"pro"},{id:"bob",name:"Bob Carter",email:"bob@example.com",plan:"free"},{id:"carol",name:"Carol Diaz",email:"carol@example.com",plan:"free"}];for(const e of l)await o(s(t,"users",e.id),{name:e.name,email:e.email,plan:e.plan,createdAt:p()});const r=["alice","bob","carol"],c=["Ship the redesign","Reply to carol","Buy milk","Draft the launch post","Review the rules","Plan offsite","Renew the domain","Read the spec","Fix the flaky test","Call the bank","Water the plants","Book the flights"];for(let e=0;e<c.length;e++){const u=r[e%r.length];await o(s(t,"notes",`note-${String(e+1).padStart(2,"0")}`),{title:c[e],done:e%3===0,pinned:e===0,priority:e%3+1,ownerId:u,ownerRef:`users/${u}`,tags:e%2===0?["work","urgent"]:["personal"],meta:{source:e%2===0?"app":"import",revision:e+1,flags:{starred:e%4===0,archived:!1}},location:e%3===0?v:null,createdAt:i(120-e*7),updatedAt:p()})}await o(s(t,"posts","post-hello"),{title:"Hello world",body:"First post from the seeded sandbox.",authorRef:"users/alice",published:!0,publishedAt:i(8)}),await o(s(t,"posts","post-draft"),{title:"Draft: roadmap",body:"Unpublished draft.",authorRef:"users/bob",published:!1})}async function C(t){const a=new TextEncoder,l=Uint8Array.from(atob("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg=="),r=>r.charCodeAt(0));await m(d(t,"avatars/alice.png"),l,{contentType:"image/png"}),await m(d(t,"notes/note-01/attachment.txt"),a.encode(`Attachment for the redesign note.
+import{s as f,b7 as h,b8 as w}from"./sandbox-controls.Bp5PoonS.js";import{s as o,d as s}from"./writes.DHSW22XD.js";import{s as n,a as A,b as y,u as m,r as d}from"./app.CiMHEvEW.js";import"./index.DBy5LfQW.js";import"./index.DNyk7q8W.js";class g{static serverTimestamp(){return{__type:"serverTimestamp"}}static increment(a){return{__type:"increment",value:a}}static arrayUnion(...a){return{__type:"arrayUnion",values:a}}static arrayRemove(...a){return{__type:"arrayRemove",values:a}}static delete(){return{__type:"deleteField"}}}function p(){return g.serverTimestamp()}async function b(t){n.createUser(t,{uid:"alice",email:"alice@gmail.com",displayName:"Alice Nguyen",emailVerified:!0,photoUrl:"https://lh3.googleusercontent.com/a/alice",providerUserInfo:[{providerId:"google.com"}],customClaims:{plan:"pro"}}),n.createUser(t,{uid:"bob",email:"bob@example.com",password:"pyric-demo",displayName:"Bob Carter",emailVerified:!0,customClaims:{role:"editor"}}),n.createUser(t,{uid:"carol",email:"carol@example.com",displayName:"Carol Diaz",emailVerified:!1}),await A(t),await y(t)}const v=new w(37.7749,-122.4194);async function R(t){const a=Date.now(),i=e=>h.fromMillis(a-e*6e4),l=[{id:"alice",name:"Alice Nguyen",email:"alice@gmail.com",plan:"pro"},{id:"bob",name:"Bob Carter",email:"bob@example.com",plan:"free"},{id:"carol",name:"Carol Diaz",email:"carol@example.com",plan:"free"}];for(const e of l)await o(s(t,"users",e.id),{name:e.name,email:e.email,plan:e.plan,createdAt:p()});const r=["alice","bob","carol"],c=["Ship the redesign","Reply to carol","Buy milk","Draft the launch post","Review the rules","Plan offsite","Renew the domain","Read the spec","Fix the flaky test","Call the bank","Water the plants","Book the flights"];for(let e=0;e<c.length;e++){const u=r[e%r.length];await o(s(t,"notes",`note-${String(e+1).padStart(2,"0")}`),{title:c[e],done:e%3===0,pinned:e===0,priority:e%3+1,ownerId:u,ownerRef:`users/${u}`,tags:e%2===0?["work","urgent"]:["personal"],meta:{source:e%2===0?"app":"import",revision:e+1,flags:{starred:e%4===0,archived:!1}},location:e%3===0?v:null,createdAt:i(120-e*7),updatedAt:p()})}await o(s(t,"posts","post-hello"),{title:"Hello world",body:"First post from the seeded sandbox.",authorRef:"users/alice",published:!0,publishedAt:i(8)}),await o(s(t,"posts","post-draft"),{title:"Draft: roadmap",body:"Unpublished draft.",authorRef:"users/bob",published:!1})}async function C(t){const a=new TextEncoder,l=Uint8Array.from(atob("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg=="),r=>r.charCodeAt(0));await m(d(t,"avatars/alice.png"),l,{contentType:"image/png"}),await m(d(t,"notes/note-01/attachment.txt"),a.encode(`Attachment for the redesign note.
 `),{contentType:"text/plain"})}const U=`rules_version = '2';
 service cloud.firestore {
   match /databases/{database}/documents {

package/dist/serve/site-ui/auth/index.html

@@ -6,7 +6,7 @@
         </script><link rel="preconnect" href="https://use.typekit.net" crossorigin><link rel="stylesheet" href="https://use.typekit.net/jwb3ycu.css"><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_studio_.CzyEuvVS.css">
 <style>html{scrollbar-gutter:stable}
 </style>
-<link rel="stylesheet" href="/__pyric/ui/_astro/app.8TtSeQQX.css"></head> <body>  <div id="root" data-astro-cid-w5sm6wlz> <style>astro-island,astro-slot,astro-static-slot{display:contents}</style><script>(()=>{var e=async t=>{await(await t())()};(self.Astro||(self.Astro={})).only=e;window.dispatchEvent(new Event("astro:only"));})();</script><script>(()=>{var A=Object.defineProperty;var g=(i,o,a)=>o in i?A(i,o,{enumerable:!0,configurable:!0,writable:!0,value:a}):i[o]=a;var d=(i,o,a)=>g(i,typeof o!="symbol"?o+"":o,a);{let i={0:t=>m(t),1:t=>a(t),2:t=>new RegExp(t),3:t=>new Date(t),4:t=>new Map(a(t)),5:t=>new Set(a(t)),6:t=>BigInt(t),7:t=>new URL(t),8:t=>new Uint8Array(t),9:t=>new Uint16Array(t),10:t=>new Uint32Array(t),11:t=>1/0*t},o=t=>{let[l,e]=t;return l in i?i[l](e):void 0},a=t=>t.map(o),m=t=>typeof t!="object"||t===null?t:Object.fromEntries(Object.entries(t).map(([l,e])=>[l,o(e)]));class y extends HTMLElement{constructor(){super(...arguments);d(this,"Component");d(this,"hydrator");d(this,"hydrate",async()=>{var b;if(!this.hydrator||!this.isConnected)return;let e=(b=this.parentElement)==null?void 0:b.closest("astro-island[ssr]");if(e){e.addEventListener("astro:hydrate",this.hydrate,{once:!0});return}let c=this.querySelectorAll("astro-slot"),n={},h=this.querySelectorAll("template[data-astro-template]");for(let r of h){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("data-astro-template")||"default"]=r.innerHTML,r.remove())}for(let r of c){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("name")||"default"]=r.innerHTML)}let p;try{p=this.hasAttribute("props")?m(JSON.parse(this.getAttribute("props"))):{}}catch(r){let s=this.getAttribute("component-url")||"<unknown>",v=this.getAttribute("component-export");throw v&&(s+=` (export ${v})`),console.error(`[hydrate] Error parsing props for component ${s}`,this.getAttribute("props"),r),r}let u;await this.hydrator(this)(this.Component,p,n,{client:this.getAttribute("client")}),this.removeAttribute("ssr"),this.dispatchEvent(new CustomEvent("astro:hydrate"))});d(this,"unmount",()=>{this.isConnected||this.dispatchEvent(new CustomEvent("astro:unmount"))})}disconnectedCallback(){document.removeEventListener("astro:after-swap",this.unmount),document.addEventListener("astro:after-swap",this.unmount,{once:!0})}connectedCallback(){if(!this.hasAttribute("await-children")||document.readyState==="interactive"||document.readyState==="complete")this.childrenConnectedCallback();else{let e=()=>{document.removeEventListener("DOMContentLoaded",e),c.disconnect(),this.childrenConnectedCallback()},c=new MutationObserver(()=>{var n;((n=this.lastChild)==null?void 0:n.nodeType)===Node.COMMENT_NODE&&this.lastChild.nodeValue==="astro:end"&&(this.lastChild.remove(),e())});c.observe(this,{childList:!0}),document.addEventListener("DOMContentLoaded",e)}}async childrenConnectedCallback(){let e=this.getAttribute("before-hydration-url");e&&await import(e),this.start()}async start(){let e=JSON.parse(this.getAttribute("opts")),c=this.getAttribute("client");if(Astro[c]===void 0){window.addEventListener(`astro:${c}`,()=>this.start(),{once:!0});return}try{await Astro[c](async()=>{let n=this.getAttribute("renderer-url"),[h,{default:p}]=await Promise.all([import(this.getAttribute("component-url")),n?import(n):()=>()=>{}]),u=this.getAttribute("component-export")||"default";if(!u.includes("."))this.Component=h[u];else{this.Component=h;for(let f of u.split("."))this.Component=this.Component[f]}return this.hydrator=p,this.hydrate},e,this)}catch(n){console.error(`[astro-island] Error hydrating ${this.getAttribute("component-url")}`,n)}}attributeChangedCallback(){this.hydrate()}}d(y,"observedAttributes",["props"]),customElements.get("astro-island")||customElements.define("astro-island",y)}})();</script><astro-island uid="b1btC" component-url="/__pyric/ui/_astro/app.DFdWhpVY.js" component-export="StudioApp" renderer-url="/__pyric/ui/_astro/client.D2ORs4B-.js" props="{&quot;data-astro-cid-w5sm6wlz&quot;:[0,true]}" ssr client="only" opts="{&quot;name&quot;:&quot;StudioApp&quot;,&quot;value&quot;:&quot;react&quot;}" await-children><p class="studio-loading" aria-live="polite" data-astro-cid-w5sm6wlz>
+<link rel="stylesheet" href="/__pyric/ui/_astro/app.8TtSeQQX.css"></head> <body>  <div id="root" data-astro-cid-w5sm6wlz> <style>astro-island,astro-slot,astro-static-slot{display:contents}</style><script>(()=>{var e=async t=>{await(await t())()};(self.Astro||(self.Astro={})).only=e;window.dispatchEvent(new Event("astro:only"));})();</script><script>(()=>{var A=Object.defineProperty;var g=(i,o,a)=>o in i?A(i,o,{enumerable:!0,configurable:!0,writable:!0,value:a}):i[o]=a;var d=(i,o,a)=>g(i,typeof o!="symbol"?o+"":o,a);{let i={0:t=>m(t),1:t=>a(t),2:t=>new RegExp(t),3:t=>new Date(t),4:t=>new Map(a(t)),5:t=>new Set(a(t)),6:t=>BigInt(t),7:t=>new URL(t),8:t=>new Uint8Array(t),9:t=>new Uint16Array(t),10:t=>new Uint32Array(t),11:t=>1/0*t},o=t=>{let[l,e]=t;return l in i?i[l](e):void 0},a=t=>t.map(o),m=t=>typeof t!="object"||t===null?t:Object.fromEntries(Object.entries(t).map(([l,e])=>[l,o(e)]));class y extends HTMLElement{constructor(){super(...arguments);d(this,"Component");d(this,"hydrator");d(this,"hydrate",async()=>{var b;if(!this.hydrator||!this.isConnected)return;let e=(b=this.parentElement)==null?void 0:b.closest("astro-island[ssr]");if(e){e.addEventListener("astro:hydrate",this.hydrate,{once:!0});return}let c=this.querySelectorAll("astro-slot"),n={},h=this.querySelectorAll("template[data-astro-template]");for(let r of h){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("data-astro-template")||"default"]=r.innerHTML,r.remove())}for(let r of c){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("name")||"default"]=r.innerHTML)}let p;try{p=this.hasAttribute("props")?m(JSON.parse(this.getAttribute("props"))):{}}catch(r){let s=this.getAttribute("component-url")||"<unknown>",v=this.getAttribute("component-export");throw v&&(s+=` (export ${v})`),console.error(`[hydrate] Error parsing props for component ${s}`,this.getAttribute("props"),r),r}let u;await this.hydrator(this)(this.Component,p,n,{client:this.getAttribute("client")}),this.removeAttribute("ssr"),this.dispatchEvent(new CustomEvent("astro:hydrate"))});d(this,"unmount",()=>{this.isConnected||this.dispatchEvent(new CustomEvent("astro:unmount"))})}disconnectedCallback(){document.removeEventListener("astro:after-swap",this.unmount),document.addEventListener("astro:after-swap",this.unmount,{once:!0})}connectedCallback(){if(!this.hasAttribute("await-children")||document.readyState==="interactive"||document.readyState==="complete")this.childrenConnectedCallback();else{let e=()=>{document.removeEventListener("DOMContentLoaded",e),c.disconnect(),this.childrenConnectedCallback()},c=new MutationObserver(()=>{var n;((n=this.lastChild)==null?void 0:n.nodeType)===Node.COMMENT_NODE&&this.lastChild.nodeValue==="astro:end"&&(this.lastChild.remove(),e())});c.observe(this,{childList:!0}),document.addEventListener("DOMContentLoaded",e)}}async childrenConnectedCallback(){let e=this.getAttribute("before-hydration-url");e&&await import(e),this.start()}async start(){let e=JSON.parse(this.getAttribute("opts")),c=this.getAttribute("client");if(Astro[c]===void 0){window.addEventListener(`astro:${c}`,()=>this.start(),{once:!0});return}try{await Astro[c](async()=>{let n=this.getAttribute("renderer-url"),[h,{default:p}]=await Promise.all([import(this.getAttribute("component-url")),n?import(n):()=>()=>{}]),u=this.getAttribute("component-export")||"default";if(!u.includes("."))this.Component=h[u];else{this.Component=h;for(let f of u.split("."))this.Component=this.Component[f]}return this.hydrator=p,this.hydrate},e,this)}catch(n){console.error(`[astro-island] Error hydrating ${this.getAttribute("component-url")}`,n)}}attributeChangedCallback(){this.hydrate()}}d(y,"observedAttributes",["props"]),customElements.get("astro-island")||customElements.define("astro-island",y)}})();</script><astro-island uid="b1btC" component-url="/__pyric/ui/_astro/app.DpzsBfos.js" component-export="StudioApp" renderer-url="/__pyric/ui/_astro/client.D2ORs4B-.js" props="{&quot;data-astro-cid-w5sm6wlz&quot;:[0,true]}" ssr client="only" opts="{&quot;name&quot;:&quot;StudioApp&quot;,&quot;value&quot;:&quot;react&quot;}" await-children><p class="studio-loading" aria-live="polite" data-astro-cid-w5sm6wlz>
 Starting Pyric Studio…
 </p><template data-astro-template="fallback"><p class="studio-loading" aria-live="polite" data-astro-cid-w5sm6wlz>
 Starting Pyric Studio…

package/dist/serve/site-ui/docs/database-compat/index.html

@@ -503,6 +503,10 @@ html{scrollbar-gutter:stable}
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">pyric verify --rules rtdb:&#x3C;instance>=&#x3C;path></code><span class="compat-sub"><span class="compat-behavior">The verify capture records every instance a session held: the default instance's rules, data and URL, and each named instance's active rules and data under its name, on the SharedWorker, the Node host and the in-page runtime. RTDB events name the instance they hit. <code>pyric verify</code> replays each instance the session used on its own: only that instance's events, into the tree the session left it with, under that instance's candidate rules, so a write to one instance is never checked against another's rules or tree. Candidate rules come from <code>--rules rtdb=&#x3C;path></code> for the default instance and <code>--rules rtdb:&#x3C;instance>=&#x3C;path></code> for a named one (a name or a database URL), else from <code>firebase.json</code> as <code>firebase deploy</code> resolves it: an array entry's <code>instance</code>, a <code>target</code> that <code>.firebaserc</code> maps for the project, and <code>database.rules.json</code> when there is no <code>database</code> key. The project's default instance name selects the default instance, and so does <code>&#x3C;projectId></code> or its <code>https://&#x3C;projectId>.firebaseio.com</code> URL. A divergence on a named instance names it. An instance the session used with no candidate rules is an error that names it, with the reason a deploy target did not resolve; rules for an instance the session never used are refused with the instances it did use.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/verify/rtdb-instances.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/verify/rtdb-instances.test.ts</code></a> captures a session on the default instance and <code>shard-00</code> and asserts each instance's rules, tree and the default URL in the capture, a <code>now-denied</code> on the shard alone under tightened shard rules, no drift under unchanged rules, drift in a tampered shard tree tagged with the shard, and <code>skippedInstances</code> for an instance without candidate rules. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/cli/verify-rtdb-instances.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/cli/verify-rtdb-instances.test.ts</code></a> runs <code>pyric verify</code> over a <code>firebase.json</code> instance array, a deploy target resolved through <code>.firebaserc</code> and <code>--project</code>, an unresolved target, <code>rtdb:&#x3C;instance>=</code> by name, URL and default name, an override for an unused instance, and <code>database.rules.json</code> with no <code>database</code> key. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/cli/verify-rtdb-legacy-default.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/cli/verify-rtdb-legacy-default.test.ts</code></a> maps <code>rtdb:&#x3C;projectId>=</code> and its URL to the default instance and reads the default's candidate rules from a <code>firebase.json</code> entry for <code>&#x3C;projectId></code>. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/serve-init.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/serve-init.test.ts</code></a> asserts the host capture holds each named instance, and <code>bundler.test.ts</code> that the in-page runtime bundles the capture. App scenario <code>test/apps/rtdb-named-instance-tools</code> runs the installed <code>pyric verify</code> on the <code>.pyric/last-session.json</code> the Node host wrote while Chromium wrote to both instances: clean under <code>firebase.json</code>, <code>now-denied</code> on <code>shard-00</code> only under stricter shard rules, and an error naming <code>shard-00</code> when <code>firebase.json</code> deploys it no rules. CDD assertion <code>rtdb-modular#MI6</code> pins the sandbox side: a replay selects one instance's events by name or URL and checks them under that instance's rules and tree. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/database/cdd/lifecycle-and-identity.test.ts#L28" target="_blank" rel="noopener noreferrer"><code>lifecycle-and-identity.test.ts</code></a>)</div></div>
 </details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">pyric assurance / pyric.assurance.target.v1</code><span class="compat-sub"><span class="compat-behavior">Assurance campaigns (local-sandbox targets) declare named RTDB instances in <code>rules.rtdbInstances</code> and <code>state.rtdbInstances</code>, alongside the default instance. Operations name an <code>instance</code> (a name, URL, or <code>default</code>). The runner sets each instance's rules and data, executing operations on their target instance so mutations and access checks are isolated. An operation naming an instance the target does not declare is an invalid-input refusal listing the declared instances.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/assurance/rtdb-instances.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/assurance/rtdb-instances.test.ts</code></a> runs a campaign where a named-instance probe under its own relaxed rules succeeds while a default-instance probe under locked rules fails, and asserts that naming an undeclared instance throws an invalid-input refusal naming the missing instance. The <code>pyric.assurance.campaign.v1</code> schema and the MCP worker protocol in <code>packages/cli/src/bridge/surface/arguments/assurance.ts</code> carry the instance and <code>rtdbInstances</code> fields. CDD assertion <code>rtdb-modular#MI7</code> pins the sandbox isolation: rules and data set on a named instance are strictly isolated from the default instance, and operations are decided by their specific rules. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/rtdb-named-instance-assurance/scenario.ts#L5" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/database/cdd/lifecycle-and-identity.test.ts#L28" target="_blank" rel="noopener noreferrer"><code>lifecycle-and-identity.test.ts</code></a>)</div></div>
+</details>
 </div>
 <h3 id="refdb-path--child--parent--root"><code>ref(db, path)</code> / <code>child</code> / <code>parent</code> / <code>root</code></h3>
 <div class="compat-list">

package/dist/serve/site-ui/docs/database-compat.md

@@ -512,6 +512,10 @@ In production each database URL is its own instance, with its own data and its o
 <summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">pyric verify --rules rtdb:&lt;instance&gt;=&lt;path&gt;</code><span class="compat-sub"><span class="compat-behavior">The verify capture records every instance a session held: the default instance's rules, data and URL, and each named instance's active rules and data under its name, on the SharedWorker, the Node host and the in-page runtime. RTDB events name the instance they hit. <code>pyric verify</code> replays each instance the session used on its own: only that instance's events, into the tree the session left it with, under that instance's candidate rules, so a write to one instance is never checked against another's rules or tree. Candidate rules come from <code>--rules rtdb=&lt;path&gt;</code> for the default instance and <code>--rules rtdb:&lt;instance&gt;=&lt;path&gt;</code> for a named one (a name or a database URL), else from <code>firebase.json</code> as <code>firebase deploy</code> resolves it: an array entry's <code>instance</code>, a <code>target</code> that <code>.firebaserc</code> maps for the project, and <code>database.rules.json</code> when there is no <code>database</code> key. The project's default instance name selects the default instance, and so does <code>&lt;projectId&gt;</code> or its <code>https://&lt;projectId&gt;.firebaseio.com</code> URL. A divergence on a named instance names it. An instance the session used with no candidate rules is an error that names it, with the reason a deploy target did not resolve; rules for an instance the session never used are refused with the instances it did use.</span></span></span></summary>
 <div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/verify/rtdb-instances.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/verify/rtdb-instances.test.ts</code></a> captures a session on the default instance and <code>shard-00</code> and asserts each instance's rules, tree and the default URL in the capture, a <code>now-denied</code> on the shard alone under tightened shard rules, no drift under unchanged rules, drift in a tampered shard tree tagged with the shard, and <code>skippedInstances</code> for an instance without candidate rules. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/cli/verify-rtdb-instances.test.ts#L6" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/cli/verify-rtdb-instances.test.ts</code></a> runs <code>pyric verify</code> over a <code>firebase.json</code> instance array, a deploy target resolved through <code>.firebaserc</code> and <code>--project</code>, an unresolved target, <code>rtdb:&lt;instance&gt;=</code> by name, URL and default name, an override for an unused instance, and <code>database.rules.json</code> with no <code>database</code> key. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/cli/verify-rtdb-legacy-default.test.ts#L11" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/cli/verify-rtdb-legacy-default.test.ts</code></a> maps <code>rtdb:&lt;projectId&gt;=</code> and its URL to the default instance and reads the default's candidate rules from a <code>firebase.json</code> entry for <code>&lt;projectId&gt;</code>. <a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/serve/worker/serve-init.test.ts#L20" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/serve/worker/serve-init.test.ts</code></a> asserts the host capture holds each named instance, and <code>bundler.test.ts</code> that the in-page runtime bundles the capture. App scenario <code>test/apps/rtdb-named-instance-tools</code> runs the installed <code>pyric verify</code> on the <code>.pyric/last-session.json</code> the Node host wrote while Chromium wrote to both instances: clean under <code>firebase.json</code>, <code>now-denied</code> on <code>shard-00</code> only under stricter shard rules, and an error naming <code>shard-00</code> when <code>firebase.json</code> deploys it no rules. CDD assertion <code>rtdb-modular#MI6</code> pins the sandbox side: a replay selects one instance's events by name or URL and checks them under that instance's rules and tree. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/database/cdd/lifecycle-and-identity.test.ts#L28" target="_blank" rel="noopener noreferrer"><code>lifecycle-and-identity.test.ts</code></a>)</div></div>
 </details>
+<details class="compat-row" data-status="ok">
+<summary class="compat-line"><span class="compat-dot" data-status="ok" role="img" aria-label="Conforming" title="Conforming"></span><span class="compat-main"><code class="compat-api">pyric assurance / pyric.assurance.target.v1</code><span class="compat-sub"><span class="compat-behavior">Assurance campaigns (local-sandbox targets) declare named RTDB instances in <code>rules.rtdbInstances</code> and <code>state.rtdbInstances</code>, alongside the default instance. Operations name an <code>instance</code> (a name, URL, or <code>default</code>). The runner sets each instance's rules and data, executing operations on their target instance so mutations and access checks are isolated. An operation naming an instance the target does not declare is an invalid-input refusal listing the declared instances.</span></span></span></summary>
+<div class="compat-evidence"><div class="compat-probe"><a href="https://github.com/davideast/pyric/blob/main/packages/cli/test/assurance/rtdb-instances.test.ts#L2" target="_blank" rel="noopener noreferrer"><code>packages/cli/test/assurance/rtdb-instances.test.ts</code></a> runs a campaign where a named-instance probe under its own relaxed rules succeeds while a default-instance probe under locked rules fails, and asserts that naming an undeclared instance throws an invalid-input refusal naming the missing instance. The <code>pyric.assurance.campaign.v1</code> schema and the MCP worker protocol in <code>packages/cli/src/bridge/surface/arguments/assurance.ts</code> carry the instance and <code>rtdbInstances</code> fields. CDD assertion <code>rtdb-modular#MI7</code> pins the sandbox isolation: rules and data set on a named instance are strictly isolated from the default instance, and operations are decided by their specific rules. (Structured evidence: <a href="https://github.com/davideast/pyric/blob/main/test/apps/rtdb-named-instance-assurance/scenario.ts#L5" target="_blank" rel="noopener noreferrer"><code>scenario.ts</code></a>, <a href="https://github.com/davideast/pyric/blob/main/packages/pyric/test/database/cdd/lifecycle-and-identity.test.ts#L28" target="_blank" rel="noopener noreferrer"><code>lifecycle-and-identity.test.ts</code></a>)</div></div>
+</details>
 </div>
 
 ### `ref(db, path)` / `child` / `parent` / `root`

package/dist/serve/site-ui/docs/get-started/start-building/index.html

@@ -99,4 +99,5 @@ html{scrollbar-gutter:stable}
 <p>You can also set <code>command</code>, <code>port</code>, <code>project</code>, and rules paths in <code>pyric.json</code>. See the <a href="../../reference/cli/">CLI reference</a>. <a href="../../ship/test-in-node/">Test in Node</a> covers an in-process sandbox for tests and scripts.</p>
 <h2 id="what-remains-local">What remains local</h2>
 <p>The mirrored services do not connect to a production Firebase project. Local data changes stay in the sandbox. Local Security Rules changes are enforced there and are not deployed. Firebase configuration passed to <code>initializeApp(config)</code> is accepted so the application code stays unchanged, but it does not select a cloud backend during development.</p>
+<p>Before you ship, check your rules against your captured sessions: <a href="../../ship/ship-to-production/">The same code goes live</a>.</p>
 <p>Continue with <a href="../how-the-swap-works/">How the swap works</a>, then <a href="../../build/authentication/">develop with the Firebase APIs</a>.</p> </article> </main> <aside class="doc-toc" aria-label="On this page" data-astro-cid-mw7aashj> <h2 class="doc-toc-heading" data-astro-cid-mw7aashj>On this page</h2> <ul data-astro-cid-mw7aashj> <li data-depth="2" data-astro-cid-mw7aashj> <a href="#start-with-a-coding-agent" data-astro-cid-mw7aashj>Start with a coding agent</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#start-from-the-terminal" data-astro-cid-mw7aashj>Start from the terminal</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#add-pyric-to-an-existing-application" data-astro-cid-mw7aashj>Add Pyric to an existing application</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#vite" data-astro-cid-mw7aashj>Vite</a> </li><li data-depth="3" data-astro-cid-mw7aashj> <a href="#nextjs" data-astro-cid-mw7aashj>Next.js</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#use-a-static-application-or-node-process" data-astro-cid-mw7aashj>Use a static application or Node process</a> </li><li data-depth="2" data-astro-cid-mw7aashj> <a href="#what-remains-local" data-astro-cid-mw7aashj>What remains local</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script>  </body></html> 

package/dist/serve/site-ui/docs/get-started/start-building.md

@@ -137,4 +137,6 @@ You can also set `command`, `port`, `project`, and rules paths in `pyric.json`.
 
 The mirrored services do not connect to a production Firebase project. Local data changes stay in the sandbox. Local Security Rules changes are enforced there and are not deployed. Firebase configuration passed to `initializeApp(config)` is accepted so the application code stays unchanged, but it does not select a cloud backend during development.
 
+Before you ship, check your rules against your captured sessions: [The same code goes live](../ship/ship-to-production.md).
+
 Continue with [How the swap works](./how-the-swap-works.md), then [develop with the Firebase APIs](../build/authentication.md).

package/dist/serve/site-ui/docs/pyric-cli-assurance-reference-api/index.html

@@ -515,7 +515,10 @@ observation may name an actor that arrives beside it.</p>
 <span class="line"><span style="color:#E06C75">     rtdb</span><span style="color:#C678DD">?:</span><span style="color:#ABB2BF"> {</span></span>
 <span class="line"><span style="color:#E06C75">        rules</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, unknown>;</span></span>
 <span class="line"><span style="color:#ABB2BF">     };</span></span>
-<span class="line"><span style="color:#E06C75">     storage</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">     rtdbInstances</span><span style="color:#C678DD">?:</span><span style="color:#E06C75"> Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, {</span></span>
+<span class="line"><span style="color:#E06C75">        rules</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">Record</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">, </span><span style="color:#E06C75">unknown</span><span style="color:#56B6C2">></span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#ABB2BF">     }>;</span></span>
+<span class="line"><span style="color:#ABB2BF">     storage?: </span><span style="color:#E06C75">string</span><span style="color:#ABB2BF">;</span></span>
 <span class="line"><span style="color:#ABB2BF">  };</span></span>
 <span class="line"><span style="color:#ABB2BF">}): </span><span style="color:#E5C07B">Promise</span><span style="color:#56B6C2">&#x3C;</span><span style="color:#E06C75">AuthorizationCampaignReport</span><span style="color:#56B6C2">></span><span style="color:#ABB2BF">;</span></span></code></pre>
 <h6 id="parameters-19">Parameters</h6>
@@ -560,7 +563,11 @@ observation may name an actor that arrives beside it.</p>
 
 
 
-<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>options</code></td><td align="left">{ <code>id?</code>: <code>string</code>; <code>includeCandidates?</code>: <code>boolean</code>; <code>rules</code>: { <code>firestore?</code>: <code>string</code>; <code>rtdb?</code>: { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }; <code>storage?</code>: <code>string</code>; }; }</td></tr><tr><td align="left"><code>options.id?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>options.includeCandidates?</code></td><td align="left"><code>boolean</code></td></tr><tr><td align="left"><code>options.rules</code></td><td align="left">{ <code>firestore?</code>: <code>string</code>; <code>rtdb?</code>: { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }; <code>storage?</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>options.rules.firestore?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>options.rules.rtdb?</code></td><td align="left">{ <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td></tr><tr><td align="left"><code>options.rules.rtdb.rules</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>options.rules.storage?</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
+
+
+
+
+<table><thead><tr><th align="left">Parameter</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><code>options</code></td><td align="left">{ <code>id?</code>: <code>string</code>; <code>includeCandidates?</code>: <code>boolean</code>; <code>rules</code>: { <code>firestore?</code>: <code>string</code>; <code>rtdb?</code>: { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }; <code>rtdbInstances?</code>: <code>Record</code>&#x3C;<code>string</code>, { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }>; <code>storage?</code>: <code>string</code>; }; }</td></tr><tr><td align="left"><code>options.id?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>options.includeCandidates?</code></td><td align="left"><code>boolean</code></td></tr><tr><td align="left"><code>options.rules</code></td><td align="left">{ <code>firestore?</code>: <code>string</code>; <code>rtdb?</code>: { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }; <code>rtdbInstances?</code>: <code>Record</code>&#x3C;<code>string</code>, { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }>; <code>storage?</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>options.rules.firestore?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>options.rules.rtdb?</code></td><td align="left">{ <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td></tr><tr><td align="left"><code>options.rules.rtdb.rules</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>options.rules.rtdbInstances?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }></td></tr><tr><td align="left"><code>options.rules.storage?</code></td><td align="left"><code>string</code></td></tr></tbody></table></div>
 <h6 id="returns-24">Returns</h6>
 <p><code>Promise</code>&#x3C;<a href="#authorizationcampaignreport-1"><code>AuthorizationCampaignReport</code></a>></p>
 <p><a id="visualization"></a></p>
@@ -1540,7 +1547,15 @@ observation may name an actor that arrives beside it.</p>
 
 
 
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="network"></a> <code>network</code></td><td align="left"><code>"forbid"</code></td></tr><tr><td align="left"><a id="rules-1"></a> <code>rules</code></td><td align="left">{ <code>firestore?</code>: <code>string</code>; <code>rtdb?</code>: { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }; <code>storage?</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>rules.firestore?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.rtdb?</code></td><td align="left">{ <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td></tr><tr><td align="left"><code>rules.rtdb.rules</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>rules.storage?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="schema-4"></a> <code>schema</code></td><td align="left"><code>"pyric.assurance.target.v1"</code></td></tr><tr><td align="left"><a id="state"></a> <code>state</code></td><td align="left">{ <code>auth?</code>: { <code>users</code>: <a href="#authfixtureuser"><code>AuthFixtureUser</code></a>[]; }; <code>firestore?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>>; <code>rtdb?</code>: <code>unknown</code>; <code>storage?</code>: <a href="#storageobjectfixture"><code>StorageObjectFixture</code></a>[]; }</td></tr><tr><td align="left"><code>state.auth?</code></td><td align="left">{ <code>users</code>: <a href="#authfixtureuser"><code>AuthFixtureUser</code></a>[]; }</td></tr><tr><td align="left"><code>state.auth.users</code></td><td align="left"><a href="#authfixtureuser"><code>AuthFixtureUser</code></a>[]</td></tr><tr><td align="left"><code>state.firestore?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>></td></tr><tr><td align="left"><code>state.rtdb?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>state.storage?</code></td><td align="left"><a href="#storageobjectfixture"><code>StorageObjectFixture</code></a>[]</td></tr></tbody></table></div>
+
+
+
+
+
+
+
+
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="network"></a> <code>network</code></td><td align="left"><code>"forbid"</code></td></tr><tr><td align="left"><a id="rules-1"></a> <code>rules</code></td><td align="left">{ <code>firestore?</code>: <code>string</code>; <code>rtdb?</code>: { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }; <code>rtdbInstances?</code>: <code>Record</code>&#x3C;<code>string</code>, { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }>; <code>storage?</code>: <code>string</code>; }</td></tr><tr><td align="left"><code>rules.firestore?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>rules.rtdb?</code></td><td align="left">{ <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }</td></tr><tr><td align="left"><code>rules.rtdb.rules</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>rules.rtdbInstances?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, { <code>rules</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; }></td></tr><tr><td align="left"><code>rules.storage?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="schema-4"></a> <code>schema</code></td><td align="left"><code>"pyric.assurance.target.v1"</code></td></tr><tr><td align="left"><a id="state"></a> <code>state</code></td><td align="left">{ <code>auth?</code>: { <code>users</code>: <a href="#authfixtureuser"><code>AuthFixtureUser</code></a>[]; }; <code>firestore?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>>; <code>rtdb?</code>: <code>unknown</code>; <code>rtdbInstances?</code>: <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>; <code>storage?</code>: <a href="#storageobjectfixture"><code>StorageObjectFixture</code></a>[]; }</td></tr><tr><td align="left"><code>state.auth?</code></td><td align="left">{ <code>users</code>: <a href="#authfixtureuser"><code>AuthFixtureUser</code></a>[]; }</td></tr><tr><td align="left"><code>state.auth.users</code></td><td align="left"><a href="#authfixtureuser"><code>AuthFixtureUser</code></a>[]</td></tr><tr><td align="left"><code>state.firestore?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>>></td></tr><tr><td align="left"><code>state.rtdb?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>state.rtdbInstances?</code></td><td align="left"><code>Record</code>&#x3C;<code>string</code>, <code>unknown</code>></td></tr><tr><td align="left"><code>state.storage?</code></td><td align="left"><a href="#storageobjectfixture"><code>StorageObjectFixture</code></a>[]</td></tr></tbody></table></div>
 <hr>
 <p><a id="minimizationresult"></a></p>
 <h3 id="minimizationresult">MinimizationResult</h3>
@@ -1812,7 +1827,11 @@ observation may name an actor that arrives beside it.</p>
 
 
 
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="data-1"></a> <code>data?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="method-2"></a> <code>method</code></td><td align="left"><code>"get"</code> | <code>"update"</code> | <code>"set"</code> | <code>"remove"</code></td></tr><tr><td align="left"><a id="path-2"></a> <code>path</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="query-1"></a> <code>query?</code></td><td align="left">{ <code>endAt?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; <code>endBefore?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; <code>equalTo?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; <code>limitToFirst?</code>: <code>number</code>; <code>limitToLast?</code>: <code>number</code>; <code>orderBy?</code>: | { <code>kind</code>: <code>"child"</code>; <code>path</code>: <code>string</code>; } | { <code>kind</code>: <code>"key"</code>; } | { <code>kind</code>: <code>"value"</code>; }; <code>startAfter?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; <code>startAt?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; }</td></tr><tr><td align="left"><code>query.endAt?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.endAt.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.endAt.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>query.endBefore?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.endBefore.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.endBefore.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>query.equalTo?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.equalTo.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.equalTo.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>query.limitToFirst?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><code>query.limitToLast?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><code>query.orderBy?</code></td><td align="left">| { <code>kind</code>: <code>"child"</code>; <code>path</code>: <code>string</code>; } | { <code>kind</code>: <code>"key"</code>; } | { <code>kind</code>: <code>"value"</code>; }</td></tr><tr><td align="left"><code>query.startAfter?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.startAfter.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.startAfter.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>query.startAt?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.startAt.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.startAt.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="service-3"></a> <code>service</code></td><td align="left"><code>"rtdb"</code></td></tr></tbody></table></div>
+
+
+
+
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="data-1"></a> <code>data?</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="instance"></a> <code>instance?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="method-2"></a> <code>method</code></td><td align="left"><code>"get"</code> | <code>"update"</code> | <code>"set"</code> | <code>"remove"</code></td></tr><tr><td align="left"><a id="path-2"></a> <code>path</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><a id="query-1"></a> <code>query?</code></td><td align="left">{ <code>endAt?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; <code>endBefore?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; <code>equalTo?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; <code>limitToFirst?</code>: <code>number</code>; <code>limitToLast?</code>: <code>number</code>; <code>orderBy?</code>: | { <code>kind</code>: <code>"child"</code>; <code>path</code>: <code>string</code>; } | { <code>kind</code>: <code>"key"</code>; } | { <code>kind</code>: <code>"value"</code>; }; <code>startAfter?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; <code>startAt?</code>: { <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }; }</td></tr><tr><td align="left"><code>query.endAt?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.endAt.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.endAt.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>query.endBefore?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.endBefore.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.endBefore.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>query.equalTo?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.equalTo.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.equalTo.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>query.limitToFirst?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><code>query.limitToLast?</code></td><td align="left"><code>number</code></td></tr><tr><td align="left"><code>query.orderBy?</code></td><td align="left">| { <code>kind</code>: <code>"child"</code>; <code>path</code>: <code>string</code>; } | { <code>kind</code>: <code>"key"</code>; } | { <code>kind</code>: <code>"value"</code>; }</td></tr><tr><td align="left"><code>query.startAfter?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.startAfter.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.startAfter.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><code>query.startAt?</code></td><td align="left">{ <code>key?</code>: <code>string</code>; <code>value</code>: <code>unknown</code>; }</td></tr><tr><td align="left"><code>query.startAt.key?</code></td><td align="left"><code>string</code></td></tr><tr><td align="left"><code>query.startAt.value</code></td><td align="left"><code>unknown</code></td></tr><tr><td align="left"><a id="service-3"></a> <code>service</code></td><td align="left"><code>"rtdb"</code></td></tr></tbody></table></div>
 <hr>
 <p><a id="runsecuritycasesinput"></a></p>
 <h3 id="runsecuritycasesinput">RunSecurityCasesInput</h3>

package/dist/serve/site-ui/docs/pyric-cli-assurance-reference-api.md

@@ -492,6 +492,9 @@ verifyRules(options: {
      rtdb?: {
         rules: Record<string, unknown>;
      };
+     rtdbInstances?: Record<string, {
+        rules: Record<string, unknown>;
+     }>;
      storage?: string;
   };
 }): Promise<AuthorizationCampaignReport>;
@@ -501,13 +504,14 @@ verifyRules(options: {
 
 | Parameter | Type |
 | :------ | :------ |
-| `options` | \{ `id?`: `string`; `includeCandidates?`: `boolean`; `rules`: \{ `firestore?`: `string`; `rtdb?`: \{ `rules`: `Record`\<`string`, `unknown`\>; \}; `storage?`: `string`; \}; \} |
+| `options` | \{ `id?`: `string`; `includeCandidates?`: `boolean`; `rules`: \{ `firestore?`: `string`; `rtdb?`: \{ `rules`: `Record`\<`string`, `unknown`\>; \}; `rtdbInstances?`: `Record`\<`string`, \{ `rules`: `Record`\<`string`, `unknown`\>; \}\>; `storage?`: `string`; \}; \} |
 | `options.id?` | `string` |
 | `options.includeCandidates?` | `boolean` |
-| `options.rules` | \{ `firestore?`: `string`; `rtdb?`: \{ `rules`: `Record`\<`string`, `unknown`\>; \}; `storage?`: `string`; \} |
+| `options.rules` | \{ `firestore?`: `string`; `rtdb?`: \{ `rules`: `Record`\<`string`, `unknown`\>; \}; `rtdbInstances?`: `Record`\<`string`, \{ `rules`: `Record`\<`string`, `unknown`\>; \}\>; `storage?`: `string`; \} |
 | `options.rules.firestore?` | `string` |
 | `options.rules.rtdb?` | \{ `rules`: `Record`\<`string`, `unknown`\>; \} |
 | `options.rules.rtdb.rules` | `Record`\<`string`, `unknown`\> |
+| `options.rules.rtdbInstances?` | `Record`\<`string`, \{ `rules`: `Record`\<`string`, `unknown`\>; \}\> |
 | `options.rules.storage?` | `string` |
 
 ###### Returns
@@ -941,17 +945,19 @@ Credential-free projection safe to hand to Studio visualization code.
 | Property | Type |
 | :------ | :------ |
 | <a id="network"></a> `network` | `"forbid"` |
-| <a id="rules-1"></a> `rules` | \{ `firestore?`: `string`; `rtdb?`: \{ `rules`: `Record`\<`string`, `unknown`\>; \}; `storage?`: `string`; \} |
+| <a id="rules-1"></a> `rules` | \{ `firestore?`: `string`; `rtdb?`: \{ `rules`: `Record`\<`string`, `unknown`\>; \}; `rtdbInstances?`: `Record`\<`string`, \{ `rules`: `Record`\<`string`, `unknown`\>; \}\>; `storage?`: `string`; \} |
 | `rules.firestore?` | `string` |
 | `rules.rtdb?` | \{ `rules`: `Record`\<`string`, `unknown`\>; \} |
 | `rules.rtdb.rules` | `Record`\<`string`, `unknown`\> |
+| `rules.rtdbInstances?` | `Record`\<`string`, \{ `rules`: `Record`\<`string`, `unknown`\>; \}\> |
 | `rules.storage?` | `string` |
 | <a id="schema-4"></a> `schema` | `"pyric.assurance.target.v1"` |
-| <a id="state"></a> `state` | \{ `auth?`: \{ `users`: [`AuthFixtureUser`](#authfixtureuser)[]; \}; `firestore?`: `Record`\<`string`, `Record`\<`string`, `unknown`\>\>; `rtdb?`: `unknown`; `storage?`: [`StorageObjectFixture`](#storageobjectfixture)[]; \} |
+| <a id="state"></a> `state` | \{ `auth?`: \{ `users`: [`AuthFixtureUser`](#authfixtureuser)[]; \}; `firestore?`: `Record`\<`string`, `Record`\<`string`, `unknown`\>\>; `rtdb?`: `unknown`; `rtdbInstances?`: `Record`\<`string`, `unknown`\>; `storage?`: [`StorageObjectFixture`](#storageobjectfixture)[]; \} |
 | `state.auth?` | \{ `users`: [`AuthFixtureUser`](#authfixtureuser)[]; \} |
 | `state.auth.users` | [`AuthFixtureUser`](#authfixtureuser)[] |
 | `state.firestore?` | `Record`\<`string`, `Record`\<`string`, `unknown`\>\> |
 | `state.rtdb?` | `unknown` |
+| `state.rtdbInstances?` | `Record`\<`string`, `unknown`\> |
 | `state.storage?` | [`StorageObjectFixture`](#storageobjectfixture)[] |
 
 ***
@@ -1050,6 +1056,7 @@ Credential-free projection safe to hand to Studio visualization code.
 | Property | Type |
 | :------ | :------ |
 | <a id="data-1"></a> `data?` | `unknown` |
+| <a id="instance"></a> `instance?` | `string` |
 | <a id="method-2"></a> `method` | `"get"` \| `"update"` \| `"set"` \| `"remove"` |
 | <a id="path-2"></a> `path` | `string` |
 | <a id="query-1"></a> `query?` | \{ `endAt?`: \{ `key?`: `string`; `value`: `unknown`; \}; `endBefore?`: \{ `key?`: `string`; `value`: `unknown`; \}; `equalTo?`: \{ `key?`: `string`; `value`: `unknown`; \}; `limitToFirst?`: `number`; `limitToLast?`: `number`; `orderBy?`: \| \{ `kind`: `"child"`; `path`: `string`; \} \| \{ `kind`: `"key"`; \} \| \{ `kind`: `"value"`; \}; `startAfter?`: \{ `key?`: `string`; `value`: `unknown`; \}; `startAt?`: \{ `key?`: `string`; `value`: `unknown`; \}; \} |

package/dist/serve/site-ui/docs/pyric-cli-verify-reference-api/index.html

@@ -598,7 +598,20 @@ Generated from the TypeScript declarations shipped at this import path.
 
 
 
-<table><thead><tr><th align="left">Property</th><th align="left">Type</th></tr></thead><tbody><tr><td align="left"><a id="casederivation"></a> <code>caseDerivation?</code></td><td align="left"><code>Omit</code>&#x3C;<a href="#deriverulestestcasesoptions"><code>DeriveRulesTestCasesOptions</code></a>, <code>"service"</code>></td></tr><tr><td align="left"><a id="engines"></a> <code>engines?</code></td><td align="left"><a href="#verifyengine"><code>VerifyEngine</code></a>[]</td></tr><tr><td align="left"><a id="rules"></a> <code>rules</code></td><td align="left"><a href="#verifyrulesinput"><code>VerifyRulesInput</code></a></td></tr><tr><td align="left"><a id="rulestestapi"></a> <code>rulesTestApi?</code></td><td align="left">{ <code>expressionReportLevel?</code>: <code>ExpressionReportLevel</code>; <code>scope</code>: <code>ProjectScope</code>; }</td></tr><tr><td align="left"><code>rulesTestApi.expressionReportLevel?</code></td><td align="left"><code>ExpressionReportLevel</code></td></tr><tr><td align="left"><code>rulesTestApi.scope</code></td><td align="left"><code>ProjectScope</code></td></tr><tr><td align="left"><a id="services-1"></a> <code>services?</code></td><td align="left"><a href="#verifiableservice"><code>VerifiableService</code></a>[]</td></tr></tbody></table></div>
+
+
+
+
+
+
+
+
+
+
+
+
+
+<table><thead><tr><th align="left">Property</th><th align="left">Type</th><th align="left">Description</th></tr></thead><tbody><tr><td align="left"><a id="casederivation"></a> <code>caseDerivation?</code></td><td align="left"><code>Omit</code>&#x3C;<a href="#deriverulestestcasesoptions"><code>DeriveRulesTestCasesOptions</code></a>, <code>"service"</code>></td><td align="left">-</td></tr><tr><td align="left"><a id="engines"></a> <code>engines?</code></td><td align="left"><a href="#verifyengine"><code>VerifyEngine</code></a>[]</td><td align="left">-</td></tr><tr><td align="left"><a id="rules"></a> <code>rules</code></td><td align="left"><a href="#verifyrulesinput"><code>VerifyRulesInput</code></a></td><td align="left">-</td></tr><tr><td align="left"><a id="rulestestapi"></a> <code>rulesTestApi?</code></td><td align="left">{ <code>expressionReportLevel?</code>: <code>ExpressionReportLevel</code>; <code>scope</code>: <code>ProjectScope</code>; }</td><td align="left">-</td></tr><tr><td align="left"><code>rulesTestApi.expressionReportLevel?</code></td><td align="left"><code>ExpressionReportLevel</code></td><td align="left">-</td></tr><tr><td align="left"><code>rulesTestApi.scope</code></td><td align="left"><code>ProjectScope</code></td><td align="left">-</td></tr><tr><td align="left"><a id="services-1"></a> <code>services?</code></td><td align="left"><a href="#verifiableservice"><code>VerifiableService</code></a>[]</td><td align="left">-</td></tr><tr><td align="left"><a id="staging"></a> <code>staging?</code></td><td align="left">{ <code>client</code>: <code>RtdbRestClient</code>; <code>projectId</code>: <code>string</code>; } &#x26; <code>StagingRunHooks</code></td><td align="left">The staging engine’s instance: a client for a dedicated RTDB instance enrolled with <code>pyric verify staging init</code>, and the project it is enrolled for. Required when <code>engines</code> includes <code>staging</code>.</td></tr></tbody></table></div>
 <hr>
 <p><a id="verifyresult"></a></p>
 <h3 id="verifyresult">VerifyResult</h3>
@@ -826,7 +839,7 @@ Generated from the TypeScript declarations shipped at this import path.
 <hr>
 <p><a id="verifyengine"></a></p>
 <h3 id="verifyengine">VerifyEngine</h3>
-<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">type</span><span style="color:#E5C07B"> VerifyEngine</span><span style="color:#56B6C2"> =</span><span style="color:#98C379"> "sandbox"</span><span style="color:#ABB2BF"> | </span><span style="color:#98C379">"rulesTestApi"</span><span style="color:#ABB2BF">;</span></span></code></pre>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">type</span><span style="color:#E5C07B"> VerifyEngine</span><span style="color:#56B6C2"> =</span><span style="color:#98C379"> "sandbox"</span><span style="color:#ABB2BF"> | </span><span style="color:#98C379">"rulesTestApi"</span><span style="color:#ABB2BF"> | </span><span style="color:#98C379">"staging"</span><span style="color:#ABB2BF">;</span></span></code></pre>
 <hr>
 <p><a id="verifyfixturewarning"></a></p>
 <h3 id="verifyfixturewarning">VerifyFixtureWarning</h3>

package/dist/serve/site-ui/docs/pyric-cli-verify-reference-api.md

@@ -245,15 +245,16 @@ No credentials were found, with the sources that were checked for one.
 
 #### Properties
 
-| Property | Type |
-| :------ | :------ |
-| <a id="casederivation"></a> `caseDerivation?` | `Omit`\<[`DeriveRulesTestCasesOptions`](#deriverulestestcasesoptions), `"service"`\> |
-| <a id="engines"></a> `engines?` | [`VerifyEngine`](#verifyengine)[] |
-| <a id="rules"></a> `rules` | [`VerifyRulesInput`](#verifyrulesinput) |
-| <a id="rulestestapi"></a> `rulesTestApi?` | \{ `expressionReportLevel?`: `ExpressionReportLevel`; `scope`: `ProjectScope`; \} |
-| `rulesTestApi.expressionReportLevel?` | `ExpressionReportLevel` |
-| `rulesTestApi.scope` | `ProjectScope` |
-| <a id="services-1"></a> `services?` | [`VerifiableService`](#verifiableservice)[] |
+| Property | Type | Description |
+| :------ | :------ | :------ |
+| <a id="casederivation"></a> `caseDerivation?` | `Omit`\<[`DeriveRulesTestCasesOptions`](#deriverulestestcasesoptions), `"service"`\> | - |
+| <a id="engines"></a> `engines?` | [`VerifyEngine`](#verifyengine)[] | - |
+| <a id="rules"></a> `rules` | [`VerifyRulesInput`](#verifyrulesinput) | - |
+| <a id="rulestestapi"></a> `rulesTestApi?` | \{ `expressionReportLevel?`: `ExpressionReportLevel`; `scope`: `ProjectScope`; \} | - |
+| `rulesTestApi.expressionReportLevel?` | `ExpressionReportLevel` | - |
+| `rulesTestApi.scope` | `ProjectScope` | - |
+| <a id="services-1"></a> `services?` | [`VerifiableService`](#verifiableservice)[] | - |
+| <a id="staging"></a> `staging?` | \{ `client`: `RtdbRestClient`; `projectId`: `string`; \} & `StagingRunHooks` | The staging engine's instance: a client for a dedicated RTDB instance enrolled with `pyric verify staging init`, and the project it is enrolled for. Required when `engines` includes `staging`. |
 
 ***
 
@@ -424,7 +425,7 @@ optional instance: string;
 ### VerifyEngine
 
 ```ts
-type VerifyEngine = "sandbox" | "rulesTestApi";
+type VerifyEngine = "sandbox" | "rulesTestApi" | "staging";
 ```
 
 ***

package/dist/serve/site-ui/docs/secure/write-a-rules-test-suite/index.html

@@ -256,7 +256,7 @@ html{scrollbar-gutter:stable}
 <h3 id="replay-a-captured-session-against-new-rules">Replay a captured session against new rules</h3>
 <p><code>pyric verify</code> replays a session captured during development against a candidate ruleset and reports each operation whose verdict changed:</p>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#61AFEF">pyric</span><span style="color:#98C379"> verify</span><span style="color:#D19A66"> --service</span><span style="color:#98C379"> rtdb</span><span style="color:#D19A66"> --rules</span><span style="color:#98C379"> rtdb=database.rules.json</span></span></code></pre>
-<p>RTDB verification runs on the sandbox engine only. The hosted Rules Test API evaluates Firestore rules, so <code>--engine rules-test-api</code> is refused for <code>rtdb</code>. See <a href="../../ship/ship-to-production/">ship to production</a>.</p>
+<p>RTDB verification runs on the sandbox engine by default. The hosted Rules Test API evaluates Firestore rules, so <code>--engine rules-test-api</code> is refused for <code>rtdb</code>. For Realtime Database, run <code>--engine staging</code> to test the session against a real instance you provide, enrolled with <code>pyric verify staging init</code>. See <a href="../../ship/ship-to-production/">ship to production</a>.</p>
 <h2 id="run-the-suite-through-an-agent">Run the suite through an agent</h2>
 <p>An agent can run the local loop through <code>firestore_simulate_rules</code>, which means the rules it writes can arrive with explicit passing cases instead of a promise. For Realtime Database, the agent calls <code>rtdb_simulate_access</code> with an <code>operation</code> (<code>read</code>, <code>write</code>, <code>update</code>, or <code>validate</code>), a <code>path</code>, and optionally an <code>auth</code> of <code>{ uid, claims }</code>, a <code>newData</code> value, a <code>query</code>, and a <code>now</code>. The tool evaluates against the rules and data currently loaded in the sandbox, so it needs no separate rules-loading call. It uses the sandbox clock for <code>now</code> unless you pass one, and it returns <code>decision</code>, <code>matchedPath</code>, <code>matchedRule</code>, <code>reason</code>, and the <code>trace</code>. See <a href="../../agent/work-with-an-agent/">Work with an agent</a>.</p>
 <h2 id="where-to-go-next">Where to go next</h2>

package/dist/serve/site-ui/docs/secure/write-a-rules-test-suite.md

@@ -287,7 +287,7 @@ This layer also covers listeners, transactions, and `.indexOn` behavior, which a
 ```bash
 pyric verify --service rtdb --rules rtdb=database.rules.json
 ```
-RTDB verification runs on the sandbox engine only. The hosted Rules Test API evaluates Firestore rules, so `--engine rules-test-api` is refused for `rtdb`. See [ship to production](../ship/ship-to-production.md).
+RTDB verification runs on the sandbox engine by default. The hosted Rules Test API evaluates Firestore rules, so `--engine rules-test-api` is refused for `rtdb`. For Realtime Database, run `--engine staging` to test the session against a real instance you provide, enrolled with `pyric verify staging init`. See [ship to production](../ship/ship-to-production.md).
 
 ## Run the suite through an agent
 

package/dist/serve/site-ui/docs/ship/ship-to-production/index.html

@@ -20,7 +20,7 @@ html{scrollbar-gutter:stable}
 <p>The output names each operation whose verdict changed:</p>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>✗ chat - rtdb: 1 failure(s)</span></span>
 <span class="line"><span>    [rtdb] now-denied: set /rooms/r1/messages/m1 (PERMISSION_DENIED)</span></span></code></pre>
-<p><code>now-denied</code> means a write that succeeded during development would be rejected under the new rules. <code>now-allowed</code> means the reverse, a loosening. Auto-id aliases and timestamp drift are reported as informational, not failures, because replaying generated values is supposed to produce them. The exit code is 1 on any real divergence, which makes the CI gate one line:</p>
+<p><code>now-denied</code> means a read, listener, <code>onDisconnect</code> registration, or write that succeeded during development would be rejected under the new rules. <code>now-allowed</code> means a loosening where a captured denial is now permitted. Auto-id aliases and timestamp drift are reported as informational, not failures, because replaying generated values is supposed to produce them. The exit code is 1 on any real divergence, which makes the CI gate one line:</p>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="yaml"><code><span class="line"><span style="color:#ABB2BF">- </span><span style="color:#E06C75">run</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">pyric verify journeys/ --rules firestore=firestore.rules</span></span></code></pre>
 <p>If your app uses more than one Realtime Database instance, <code>pyric verify</code> checks each instance the session used against that instance’s own rules, read from <code>firebase.json</code> the way <code>firebase deploy</code> reads them. To try different rules on one instance, name it with <code>rtdb:&#x3C;instance></code>; <code>rtdb=</code> stays the default instance:</p>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#61AFEF">pyric</span><span style="color:#98C379"> verify</span><span style="color:#D19A66"> --rules</span><span style="color:#98C379"> rtdb:shard-00=shard.rules.json</span></span></code></pre>
@@ -30,6 +30,9 @@ html{scrollbar-gutter:stable}
 <p>By default verification runs on the local sandbox engine. For Firestore you can also send the derived cases to Firebase’s hosted Rules Test API, or run both:</p>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#61AFEF">pyric</span><span style="color:#98C379"> verify</span><span style="color:#D19A66"> --service</span><span style="color:#98C379"> firestore</span><span style="color:#D19A66"> --engine</span><span style="color:#98C379"> both</span><span style="color:#D19A66"> --project</span><span style="color:#98C379"> my-app</span><span style="color:#D19A66"> --rules</span><span style="color:#98C379"> firestore=firestore.rules</span></span></code></pre>
 <p><code>both</code> cross-checks the two engines against each other and flags any disagreement. That checks your rules and, at the same time, checks Pyric’s own engine against Google’s answer for your exact traffic. The Rules Test API evaluates cases only: it does not deploy rules or change a project. Hosted verification needs a project id plus <code>FIREBASE_SA_BASE64</code> or <code>GOOGLE_APPLICATION_CREDENTIALS</code> (or ADC); build a <code>ProjectScope</code> programmatically with <code>@pyric/cli/credentials/node</code> (<code>fromServiceAccount</code> / <code>fromAdc</code>).</p>
+<p>For Realtime Database, run <code>--engine staging</code> to test the session against a real instance you provide, enrolled with <code>pyric verify staging init</code>:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#61AFEF">pyric</span><span style="color:#98C379"> verify</span><span style="color:#D19A66"> --engine</span><span style="color:#98C379"> sandbox</span><span style="color:#D19A66"> --engine</span><span style="color:#98C379"> staging</span><span style="color:#D19A66"> --rules</span><span style="color:#98C379"> rtdb=open.rules.json</span></span></code></pre>
+<p>This deploys the rules to your enrolled instance, replays the session via the REST API, and compares production’s verdicts to the local sandbox replay.</p>
 <h2 id="deploy-hosting-and-functions">Deploy hosting and functions</h2>
 <pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#61AFEF">firebase</span><span style="color:#98C379"> deploy</span><span style="color:#D19A66"> --only</span><span style="color:#98C379"> hosting</span><span style="color:#7F848E;font-style:italic">                      # preview channels via firebase hosting:channel:deploy</span></span>
 <span class="line"><span style="color:#61AFEF">firebase</span><span style="color:#98C379"> deploy</span><span style="color:#D19A66"> --only</span><span style="color:#98C379"> functions</span></span></code></pre>

package/dist/serve/site-ui/docs/ship/ship-to-production.md

@@ -33,7 +33,7 @@ The output names each operation whose verdict changed:
 ✗ chat - rtdb: 1 failure(s)
     [rtdb] now-denied: set /rooms/r1/messages/m1 (PERMISSION_DENIED)
 ```
-`now-denied` means a write that succeeded during development would be rejected under the new rules. `now-allowed` means the reverse, a loosening. Auto-id aliases and timestamp drift are reported as informational, not failures, because replaying generated values is supposed to produce them. The exit code is 1 on any real divergence, which makes the CI gate one line:
+`now-denied` means a read, listener, `onDisconnect` registration, or write that succeeded during development would be rejected under the new rules. `now-allowed` means a loosening where a captured denial is now permitted. Auto-id aliases and timestamp drift are reported as informational, not failures, because replaying generated values is supposed to produce them. The exit code is 1 on any real divergence, which makes the CI gate one line:
 ```yaml
 - run: pyric verify journeys/ --rules firestore=firestore.rules
 ```
@@ -53,6 +53,12 @@ pyric verify --service firestore --engine both --project my-app --rules firestor
 ```
 `both` cross-checks the two engines against each other and flags any disagreement. That checks your rules and, at the same time, checks Pyric's own engine against Google's answer for your exact traffic. The Rules Test API evaluates cases only: it does not deploy rules or change a project. Hosted verification needs a project id plus `FIREBASE_SA_BASE64` or `GOOGLE_APPLICATION_CREDENTIALS` (or ADC); build a `ProjectScope` programmatically with `@pyric/cli/credentials/node` (`fromServiceAccount` / `fromAdc`).
 
+For Realtime Database, run `--engine staging` to test the session against a real instance you provide, enrolled with `pyric verify staging init`:
+```bash
+pyric verify --engine sandbox --engine staging --rules rtdb=open.rules.json
+```
+This deploys the rules to your enrolled instance, replays the session via the REST API, and compares production's verdicts to the local sandbox replay.
+
 ## Deploy hosting and functions
 ```bash
 firebase deploy --only hosting                      # preview channels via firebase hosting:channel:deploy

package/dist/serve/site-ui/examples/chess/index.html

@@ -1,4 +1,4 @@
 <!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover"><title>Play chess against Security Rules</title><link rel="icon" type="image/svg+xml" href="/__pyric/ui/pyric-logo.svg"><link rel="preconnect" href="https://use.typekit.net" crossorigin><link rel="stylesheet" href="https://use.typekit.net/jwb3ycu.css"><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><style>html{scrollbar-gutter:stable}
 </style>
 <link rel="stylesheet" href="/__pyric/ui/_astro/_example_.B9DG9HLJ.css">
-<link rel="stylesheet" href="/__pyric/ui/_astro/app.8TtSeQQX.css"></head> <body>  <style>astro-island,astro-slot,astro-static-slot{display:contents}</style><script>(()=>{var e=async t=>{await(await t())()};(self.Astro||(self.Astro={})).only=e;window.dispatchEvent(new Event("astro:only"));})();</script><script>(()=>{var A=Object.defineProperty;var g=(i,o,a)=>o in i?A(i,o,{enumerable:!0,configurable:!0,writable:!0,value:a}):i[o]=a;var d=(i,o,a)=>g(i,typeof o!="symbol"?o+"":o,a);{let i={0:t=>m(t),1:t=>a(t),2:t=>new RegExp(t),3:t=>new Date(t),4:t=>new Map(a(t)),5:t=>new Set(a(t)),6:t=>BigInt(t),7:t=>new URL(t),8:t=>new Uint8Array(t),9:t=>new Uint16Array(t),10:t=>new Uint32Array(t),11:t=>1/0*t},o=t=>{let[l,e]=t;return l in i?i[l](e):void 0},a=t=>t.map(o),m=t=>typeof t!="object"||t===null?t:Object.fromEntries(Object.entries(t).map(([l,e])=>[l,o(e)]));class y extends HTMLElement{constructor(){super(...arguments);d(this,"Component");d(this,"hydrator");d(this,"hydrate",async()=>{var b;if(!this.hydrator||!this.isConnected)return;let e=(b=this.parentElement)==null?void 0:b.closest("astro-island[ssr]");if(e){e.addEventListener("astro:hydrate",this.hydrate,{once:!0});return}let c=this.querySelectorAll("astro-slot"),n={},h=this.querySelectorAll("template[data-astro-template]");for(let r of h){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("data-astro-template")||"default"]=r.innerHTML,r.remove())}for(let r of c){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("name")||"default"]=r.innerHTML)}let p;try{p=this.hasAttribute("props")?m(JSON.parse(this.getAttribute("props"))):{}}catch(r){let s=this.getAttribute("component-url")||"<unknown>",v=this.getAttribute("component-export");throw v&&(s+=` (export ${v})`),console.error(`[hydrate] Error parsing props for component ${s}`,this.getAttribute("props"),r),r}let u;await this.hydrator(this)(this.Component,p,n,{client:this.getAttribute("client")}),this.removeAttribute("ssr"),this.dispatchEvent(new CustomEvent("astro:hydrate"))});d(this,"unmount",()=>{this.isConnected||this.dispatchEvent(new CustomEvent("astro:unmount"))})}disconnectedCallback(){document.removeEventListener("astro:after-swap",this.unmount),document.addEventListener("astro:after-swap",this.unmount,{once:!0})}connectedCallback(){if(!this.hasAttribute("await-children")||document.readyState==="interactive"||document.readyState==="complete")this.childrenConnectedCallback();else{let e=()=>{document.removeEventListener("DOMContentLoaded",e),c.disconnect(),this.childrenConnectedCallback()},c=new MutationObserver(()=>{var n;((n=this.lastChild)==null?void 0:n.nodeType)===Node.COMMENT_NODE&&this.lastChild.nodeValue==="astro:end"&&(this.lastChild.remove(),e())});c.observe(this,{childList:!0}),document.addEventListener("DOMContentLoaded",e)}}async childrenConnectedCallback(){let e=this.getAttribute("before-hydration-url");e&&await import(e),this.start()}async start(){let e=JSON.parse(this.getAttribute("opts")),c=this.getAttribute("client");if(Astro[c]===void 0){window.addEventListener(`astro:${c}`,()=>this.start(),{once:!0});return}try{await Astro[c](async()=>{let n=this.getAttribute("renderer-url"),[h,{default:p}]=await Promise.all([import(this.getAttribute("component-url")),n?import(n):()=>()=>{}]),u=this.getAttribute("component-export")||"default";if(!u.includes("."))this.Component=h[u];else{this.Component=h;for(let f of u.split("."))this.Component=this.Component[f]}return this.hydrator=p,this.hydrate},e,this)}catch(n){console.error(`[astro-island] Error hydrating ${this.getAttribute("component-url")}`,n)}}attributeChangedCallback(){this.hydrate()}}d(y,"observedAttributes",["props"]),customElements.get("astro-island")||customElements.define("astro-island",y)}})();</script><astro-island uid="sFXys" component-url="/__pyric/ui/_astro/chess-showcase.CZe_3fJZ.js" component-export="ChessShowcase" renderer-url="/__pyric/ui/_astro/client.D2ORs4B-.js" props="{}" ssr client="only" opts="{&quot;name&quot;:&quot;ChessShowcase&quot;,&quot;value&quot;:&quot;react&quot;}"></astro-island>  </body></html> 
+<link rel="stylesheet" href="/__pyric/ui/_astro/app.8TtSeQQX.css"></head> <body>  <style>astro-island,astro-slot,astro-static-slot{display:contents}</style><script>(()=>{var e=async t=>{await(await t())()};(self.Astro||(self.Astro={})).only=e;window.dispatchEvent(new Event("astro:only"));})();</script><script>(()=>{var A=Object.defineProperty;var g=(i,o,a)=>o in i?A(i,o,{enumerable:!0,configurable:!0,writable:!0,value:a}):i[o]=a;var d=(i,o,a)=>g(i,typeof o!="symbol"?o+"":o,a);{let i={0:t=>m(t),1:t=>a(t),2:t=>new RegExp(t),3:t=>new Date(t),4:t=>new Map(a(t)),5:t=>new Set(a(t)),6:t=>BigInt(t),7:t=>new URL(t),8:t=>new Uint8Array(t),9:t=>new Uint16Array(t),10:t=>new Uint32Array(t),11:t=>1/0*t},o=t=>{let[l,e]=t;return l in i?i[l](e):void 0},a=t=>t.map(o),m=t=>typeof t!="object"||t===null?t:Object.fromEntries(Object.entries(t).map(([l,e])=>[l,o(e)]));class y extends HTMLElement{constructor(){super(...arguments);d(this,"Component");d(this,"hydrator");d(this,"hydrate",async()=>{var b;if(!this.hydrator||!this.isConnected)return;let e=(b=this.parentElement)==null?void 0:b.closest("astro-island[ssr]");if(e){e.addEventListener("astro:hydrate",this.hydrate,{once:!0});return}let c=this.querySelectorAll("astro-slot"),n={},h=this.querySelectorAll("template[data-astro-template]");for(let r of h){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("data-astro-template")||"default"]=r.innerHTML,r.remove())}for(let r of c){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("name")||"default"]=r.innerHTML)}let p;try{p=this.hasAttribute("props")?m(JSON.parse(this.getAttribute("props"))):{}}catch(r){let s=this.getAttribute("component-url")||"<unknown>",v=this.getAttribute("component-export");throw v&&(s+=` (export ${v})`),console.error(`[hydrate] Error parsing props for component ${s}`,this.getAttribute("props"),r),r}let u;await this.hydrator(this)(this.Component,p,n,{client:this.getAttribute("client")}),this.removeAttribute("ssr"),this.dispatchEvent(new CustomEvent("astro:hydrate"))});d(this,"unmount",()=>{this.isConnected||this.dispatchEvent(new CustomEvent("astro:unmount"))})}disconnectedCallback(){document.removeEventListener("astro:after-swap",this.unmount),document.addEventListener("astro:after-swap",this.unmount,{once:!0})}connectedCallback(){if(!this.hasAttribute("await-children")||document.readyState==="interactive"||document.readyState==="complete")this.childrenConnectedCallback();else{let e=()=>{document.removeEventListener("DOMContentLoaded",e),c.disconnect(),this.childrenConnectedCallback()},c=new MutationObserver(()=>{var n;((n=this.lastChild)==null?void 0:n.nodeType)===Node.COMMENT_NODE&&this.lastChild.nodeValue==="astro:end"&&(this.lastChild.remove(),e())});c.observe(this,{childList:!0}),document.addEventListener("DOMContentLoaded",e)}}async childrenConnectedCallback(){let e=this.getAttribute("before-hydration-url");e&&await import(e),this.start()}async start(){let e=JSON.parse(this.getAttribute("opts")),c=this.getAttribute("client");if(Astro[c]===void 0){window.addEventListener(`astro:${c}`,()=>this.start(),{once:!0});return}try{await Astro[c](async()=>{let n=this.getAttribute("renderer-url"),[h,{default:p}]=await Promise.all([import(this.getAttribute("component-url")),n?import(n):()=>()=>{}]),u=this.getAttribute("component-export")||"default";if(!u.includes("."))this.Component=h[u];else{this.Component=h;for(let f of u.split("."))this.Component=this.Component[f]}return this.hydrator=p,this.hydrate},e,this)}catch(n){console.error(`[astro-island] Error hydrating ${this.getAttribute("component-url")}`,n)}}attributeChangedCallback(){this.hydrate()}}d(y,"observedAttributes",["props"]),customElements.get("astro-island")||customElements.define("astro-island",y)}})();</script><astro-island uid="1ddy8K" component-url="/__pyric/ui/_astro/chess-showcase.CZe_3fJZ.js" component-export="ChessShowcase" renderer-url="/__pyric/ui/_astro/client.D2ORs4B-.js" props="{}" ssr client="only" opts="{&quot;name&quot;:&quot;ChessShowcase&quot;,&quot;value&quot;:&quot;react&quot;}"></astro-island>  </body></html> 

package/dist/serve/site-ui/firestore/index.html

@@ -6,7 +6,7 @@
         </script><link rel="preconnect" href="https://use.typekit.net" crossorigin><link rel="stylesheet" href="https://use.typekit.net/jwb3ycu.css"><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_studio_.CzyEuvVS.css">
 <style>html{scrollbar-gutter:stable}
 </style>
-<link rel="stylesheet" href="/__pyric/ui/_astro/app.8TtSeQQX.css"></head> <body>  <div id="root" data-astro-cid-w5sm6wlz> <style>astro-island,astro-slot,astro-static-slot{display:contents}</style><script>(()=>{var e=async t=>{await(await t())()};(self.Astro||(self.Astro={})).only=e;window.dispatchEvent(new Event("astro:only"));})();</script><script>(()=>{var A=Object.defineProperty;var g=(i,o,a)=>o in i?A(i,o,{enumerable:!0,configurable:!0,writable:!0,value:a}):i[o]=a;var d=(i,o,a)=>g(i,typeof o!="symbol"?o+"":o,a);{let i={0:t=>m(t),1:t=>a(t),2:t=>new RegExp(t),3:t=>new Date(t),4:t=>new Map(a(t)),5:t=>new Set(a(t)),6:t=>BigInt(t),7:t=>new URL(t),8:t=>new Uint8Array(t),9:t=>new Uint16Array(t),10:t=>new Uint32Array(t),11:t=>1/0*t},o=t=>{let[l,e]=t;return l in i?i[l](e):void 0},a=t=>t.map(o),m=t=>typeof t!="object"||t===null?t:Object.fromEntries(Object.entries(t).map(([l,e])=>[l,o(e)]));class y extends HTMLElement{constructor(){super(...arguments);d(this,"Component");d(this,"hydrator");d(this,"hydrate",async()=>{var b;if(!this.hydrator||!this.isConnected)return;let e=(b=this.parentElement)==null?void 0:b.closest("astro-island[ssr]");if(e){e.addEventListener("astro:hydrate",this.hydrate,{once:!0});return}let c=this.querySelectorAll("astro-slot"),n={},h=this.querySelectorAll("template[data-astro-template]");for(let r of h){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("data-astro-template")||"default"]=r.innerHTML,r.remove())}for(let r of c){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("name")||"default"]=r.innerHTML)}let p;try{p=this.hasAttribute("props")?m(JSON.parse(this.getAttribute("props"))):{}}catch(r){let s=this.getAttribute("component-url")||"<unknown>",v=this.getAttribute("component-export");throw v&&(s+=` (export ${v})`),console.error(`[hydrate] Error parsing props for component ${s}`,this.getAttribute("props"),r),r}let u;await this.hydrator(this)(this.Component,p,n,{client:this.getAttribute("client")}),this.removeAttribute("ssr"),this.dispatchEvent(new CustomEvent("astro:hydrate"))});d(this,"unmount",()=>{this.isConnected||this.dispatchEvent(new CustomEvent("astro:unmount"))})}disconnectedCallback(){document.removeEventListener("astro:after-swap",this.unmount),document.addEventListener("astro:after-swap",this.unmount,{once:!0})}connectedCallback(){if(!this.hasAttribute("await-children")||document.readyState==="interactive"||document.readyState==="complete")this.childrenConnectedCallback();else{let e=()=>{document.removeEventListener("DOMContentLoaded",e),c.disconnect(),this.childrenConnectedCallback()},c=new MutationObserver(()=>{var n;((n=this.lastChild)==null?void 0:n.nodeType)===Node.COMMENT_NODE&&this.lastChild.nodeValue==="astro:end"&&(this.lastChild.remove(),e())});c.observe(this,{childList:!0}),document.addEventListener("DOMContentLoaded",e)}}async childrenConnectedCallback(){let e=this.getAttribute("before-hydration-url");e&&await import(e),this.start()}async start(){let e=JSON.parse(this.getAttribute("opts")),c=this.getAttribute("client");if(Astro[c]===void 0){window.addEventListener(`astro:${c}`,()=>this.start(),{once:!0});return}try{await Astro[c](async()=>{let n=this.getAttribute("renderer-url"),[h,{default:p}]=await Promise.all([import(this.getAttribute("component-url")),n?import(n):()=>()=>{}]),u=this.getAttribute("component-export")||"default";if(!u.includes("."))this.Component=h[u];else{this.Component=h;for(let f of u.split("."))this.Component=this.Component[f]}return this.hydrator=p,this.hydrate},e,this)}catch(n){console.error(`[astro-island] Error hydrating ${this.getAttribute("component-url")}`,n)}}attributeChangedCallback(){this.hydrate()}}d(y,"observedAttributes",["props"]),customElements.get("astro-island")||customElements.define("astro-island",y)}})();</script><astro-island uid="b1btC" component-url="/__pyric/ui/_astro/app.DFdWhpVY.js" component-export="StudioApp" renderer-url="/__pyric/ui/_astro/client.D2ORs4B-.js" props="{&quot;data-astro-cid-w5sm6wlz&quot;:[0,true]}" ssr client="only" opts="{&quot;name&quot;:&quot;StudioApp&quot;,&quot;value&quot;:&quot;react&quot;}" await-children><p class="studio-loading" aria-live="polite" data-astro-cid-w5sm6wlz>
+<link rel="stylesheet" href="/__pyric/ui/_astro/app.8TtSeQQX.css"></head> <body>  <div id="root" data-astro-cid-w5sm6wlz> <style>astro-island,astro-slot,astro-static-slot{display:contents}</style><script>(()=>{var e=async t=>{await(await t())()};(self.Astro||(self.Astro={})).only=e;window.dispatchEvent(new Event("astro:only"));})();</script><script>(()=>{var A=Object.defineProperty;var g=(i,o,a)=>o in i?A(i,o,{enumerable:!0,configurable:!0,writable:!0,value:a}):i[o]=a;var d=(i,o,a)=>g(i,typeof o!="symbol"?o+"":o,a);{let i={0:t=>m(t),1:t=>a(t),2:t=>new RegExp(t),3:t=>new Date(t),4:t=>new Map(a(t)),5:t=>new Set(a(t)),6:t=>BigInt(t),7:t=>new URL(t),8:t=>new Uint8Array(t),9:t=>new Uint16Array(t),10:t=>new Uint32Array(t),11:t=>1/0*t},o=t=>{let[l,e]=t;return l in i?i[l](e):void 0},a=t=>t.map(o),m=t=>typeof t!="object"||t===null?t:Object.fromEntries(Object.entries(t).map(([l,e])=>[l,o(e)]));class y extends HTMLElement{constructor(){super(...arguments);d(this,"Component");d(this,"hydrator");d(this,"hydrate",async()=>{var b;if(!this.hydrator||!this.isConnected)return;let e=(b=this.parentElement)==null?void 0:b.closest("astro-island[ssr]");if(e){e.addEventListener("astro:hydrate",this.hydrate,{once:!0});return}let c=this.querySelectorAll("astro-slot"),n={},h=this.querySelectorAll("template[data-astro-template]");for(let r of h){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("data-astro-template")||"default"]=r.innerHTML,r.remove())}for(let r of c){let s=r.closest(this.tagName);s!=null&&s.isSameNode(this)&&(n[r.getAttribute("name")||"default"]=r.innerHTML)}let p;try{p=this.hasAttribute("props")?m(JSON.parse(this.getAttribute("props"))):{}}catch(r){let s=this.getAttribute("component-url")||"<unknown>",v=this.getAttribute("component-export");throw v&&(s+=` (export ${v})`),console.error(`[hydrate] Error parsing props for component ${s}`,this.getAttribute("props"),r),r}let u;await this.hydrator(this)(this.Component,p,n,{client:this.getAttribute("client")}),this.removeAttribute("ssr"),this.dispatchEvent(new CustomEvent("astro:hydrate"))});d(this,"unmount",()=>{this.isConnected||this.dispatchEvent(new CustomEvent("astro:unmount"))})}disconnectedCallback(){document.removeEventListener("astro:after-swap",this.unmount),document.addEventListener("astro:after-swap",this.unmount,{once:!0})}connectedCallback(){if(!this.hasAttribute("await-children")||document.readyState==="interactive"||document.readyState==="complete")this.childrenConnectedCallback();else{let e=()=>{document.removeEventListener("DOMContentLoaded",e),c.disconnect(),this.childrenConnectedCallback()},c=new MutationObserver(()=>{var n;((n=this.lastChild)==null?void 0:n.nodeType)===Node.COMMENT_NODE&&this.lastChild.nodeValue==="astro:end"&&(this.lastChild.remove(),e())});c.observe(this,{childList:!0}),document.addEventListener("DOMContentLoaded",e)}}async childrenConnectedCallback(){let e=this.getAttribute("before-hydration-url");e&&await import(e),this.start()}async start(){let e=JSON.parse(this.getAttribute("opts")),c=this.getAttribute("client");if(Astro[c]===void 0){window.addEventListener(`astro:${c}`,()=>this.start(),{once:!0});return}try{await Astro[c](async()=>{let n=this.getAttribute("renderer-url"),[h,{default:p}]=await Promise.all([import(this.getAttribute("component-url")),n?import(n):()=>()=>{}]),u=this.getAttribute("component-export")||"default";if(!u.includes("."))this.Component=h[u];else{this.Component=h;for(let f of u.split("."))this.Component=this.Component[f]}return this.hydrator=p,this.hydrate},e,this)}catch(n){console.error(`[astro-island] Error hydrating ${this.getAttribute("component-url")}`,n)}}attributeChangedCallback(){this.hydrate()}}d(y,"observedAttributes",["props"]),customElements.get("astro-island")||customElements.define("astro-island",y)}})();</script><astro-island uid="b1btC" component-url="/__pyric/ui/_astro/app.DpzsBfos.js" component-export="StudioApp" renderer-url="/__pyric/ui/_astro/client.D2ORs4B-.js" props="{&quot;data-astro-cid-w5sm6wlz&quot;:[0,true]}" ssr client="only" opts="{&quot;name&quot;:&quot;StudioApp&quot;,&quot;value&quot;:&quot;react&quot;}" await-children><p class="studio-loading" aria-live="polite" data-astro-cid-w5sm6wlz>
 Starting Pyric Studio…
 </p><template data-astro-template="fallback"><p class="studio-loading" aria-live="polite" data-astro-cid-w5sm6wlz>
 Starting Pyric Studio…