@pyric/cli 0.1.0-alpha.26 → 0.1.0-alpha.28

package/dist/verify/staging/target.js

@@ -0,0 +1,117 @@
+/**
+ * The staging target `pyric verify --engine staging` replays against, from
+ * the project's `pyric.json`:
+ *
+ *   { "verify": { "staging": { "project": "my-staging", "rtdb": "https://my-verify.firebaseio.com" } } }
+ *
+ * `rtdb` is a database URL or an instance name (`my-verify` resolves to
+ * `https://my-verify.firebaseio.com`; an instance outside us-central1 needs
+ * its full URL). The user brings the instance; pyric provisions nothing.
+ *
+ * An instance the app's own `firebase.json` deploys rules to, or the app
+ * project's default instance, is refused: those hold the app's data.
+ */
+import { readFileSync } from 'node:fs';
+import { resolveDatabaseInstance } from 'pyric/sandbox/internal';
+import { firebaseToolsConfigstorePath } from '../../cli/firebase-project.js';
+import { resolveScope, SERVICE_ACCOUNT_BASE64_ENV_KEY, SERVICE_ACCOUNT_FILE_ENV_KEY } from '../../credentials/node/scope.js';
+export class StagingConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'StagingConfigError';
+    }
+}
+const CONFIG_EXAMPLE = '{ "verify": { "staging": { "project": "<staging project id>", "rtdb": "https://<dedicated instance>.firebaseio.com" } } }';
+/** The staging target in a parsed `pyric.json`, or a config error naming what is missing. */
+export function stagingTargetFrom(config) {
+    const staging = config?.verify?.staging;
+    if (staging === undefined) {
+        throw new StagingConfigError(`no staging target. Add one to pyric.json: ${CONFIG_EXAMPLE}`);
+    }
+    const { project, rtdb } = (staging ?? {});
+    if (typeof project !== 'string' || project.trim() === '') {
+        throw new StagingConfigError(`pyric.json verify.staging.project must name the staging project: ${CONFIG_EXAMPLE}`);
+    }
+    if (typeof rtdb !== 'string' || rtdb.trim() === '') {
+        throw new StagingConfigError(`pyric.json verify.staging.rtdb must name the dedicated instance: ${CONFIG_EXAMPLE}`);
+    }
+    const trimmed = rtdb.trim();
+    const databaseUrl = /^[a-z0-9-]+$/i.test(trimmed) ? `https://${trimmed}.firebaseio.com` : trimmed.replace(/\/+$/, '');
+    let instance;
+    try {
+        instance = resolveDatabaseInstance(databaseUrl)?.name;
+    }
+    catch {
+        instance = undefined;
+    }
+    if (instance === undefined) {
+        throw new StagingConfigError(`pyric.json verify.staging.rtdb "${rtdb}" is not a Realtime Database URL or instance name.`);
+    }
+    return { projectId: project.trim(), databaseUrl, instance };
+}
+/**
+ * Refuse a staging instance the app uses: one `firebase.json` deploys rules
+ * to (by instance or by a `.firebaserc` target), or the default instance of
+ * the app's project.
+ */
+export function assertNotAppInstance(target, app) {
+    const declared = new Set(app.targetInstances ?? []);
+    const database = app.firebaseJson?.database;
+    const entries = Array.isArray(database) ? database : database ? [database] : [];
+    for (const entry of entries) {
+        const instance = entry.instance;
+        if (typeof instance === 'string')
+            declared.add(instance);
+    }
+    if (app.appProjectId)
+        declared.add(`${app.appProjectId}-default-rtdb`);
+    if (declared.has(target.instance)) {
+        throw new StagingConfigError(`refusing staging instance ${target.instance}: the app uses it (firebase.json deploys rules to it, or it is the default instance of project ${app.appProjectId}). The staging engine replaces an instance's rules and data, so it needs one dedicated to it.`);
+    }
+}
+/**
+ * An OAuth token for the staging project: a service account or Application
+ * Default Credentials (`resolveScope`), else the Firebase CLI's login
+ * (`firebase login`) while its access token is fresh.
+ */
+export async function stagingToken(projectId, deps = {}) {
+    const env = deps.env ?? process.env;
+    try {
+        const { scope, source } = await (deps.resolve ?? resolveScope)({ projectId, ...(deps.env ? { env: deps.env } : {}) });
+        return { token: () => scope.resolveToken(), source };
+    }
+    catch (resolveError) {
+        // A configured credential that fails is an error to fix, not a reason to
+        // run as the developer's own CLI login instead.
+        if (configuredCredential(env))
+            throw resolveError;
+        const cli = firebaseCliToken(env, (deps.now ?? Date.now)());
+        if (cli !== undefined)
+            return { token: async () => cli, source: 'firebase login' };
+        throw new StagingConfigError(`no credentials for staging project ${projectId}. ${resolveError instanceof Error ? resolveError.message : String(resolveError)} ` +
+            'Or sign in with `firebase login`: its token is used while it has at least 15 minutes left (run any firebase command to refresh it).');
+    }
+}
+/** Whether the environment names a service account (`resolveScope`'s first two sources). */
+function configuredCredential(env) {
+    return [SERVICE_ACCOUNT_BASE64_ENV_KEY, SERVICE_ACCOUNT_FILE_ENV_KEY].some((key) => (env[key] ?? '').trim() !== '');
+}
+/** How long a CLI token must stay valid for a run to start with it; it cannot be refreshed mid-run. */
+export const CLI_TOKEN_MARGIN_MS = 15 * 60_000;
+/** The Firebase CLI's access token, when its configstore holds one with a known expiry at least the margin away. */
+function firebaseCliToken(env, now) {
+    try {
+        const store = JSON.parse(readFileSync(firebaseToolsConfigstorePath(env), 'utf8'));
+        const token = store.tokens?.access_token;
+        const expiresAt = store.tokens?.expires_at;
+        if (typeof token !== 'string' || token === '')
+            return undefined;
+        if (typeof expiresAt !== 'number' || expiresAt - now < CLI_TOKEN_MARGIN_MS)
+            return undefined;
+        return token;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=target.js.map

package/dist/verify/staging/target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../../../src/verify/staging/target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAE7E,OAAO,EAAE,YAAY,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAS7H,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,cAAc,GAAG,2HAA2H,CAAC;AAEnJ,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,MAAM,OAAO,GAAI,MAAoD,EAAE,MAAM,EAAE,OAAO,CAAC;IACvF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAAC,6CAA6C,cAAc,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAA0C,CAAC;IACnF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,kBAAkB,CAAC,oEAAoE,cAAc,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAAC,oEAAoE,cAAc,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,OAAO,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtH,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,uBAAuB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,IAAI,oDAAoD,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAqB,EACrB,GAA6F;IAE7F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,EAAE,QAAmB,CAAC;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAI,KAAgC,CAAC,QAAQ,CAAC;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAG,CAAC,YAAY;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,eAAe,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,kBAAkB,CAC1B,6BAA6B,MAAM,CAAC,QAAQ,kGAAkG,GAAG,CAAC,YAAY,+FAA+F,CAC9P,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,OAAuF,EAAE;IAEzF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACtH,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,YAAY,EAAE,CAAC;QACtB,yEAAyE;QACzE,gDAAgD;QAChD,IAAI,oBAAoB,CAAC,GAAG,CAAC;YAAE,MAAM,YAAY,CAAC;QAClD,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACnF,MAAM,IAAI,kBAAkB,CAC1B,sCAAsC,SAAS,KAAK,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG;YAChI,qIAAqI,CACxI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,oBAAoB,CAAC,GAAsB;IAClD,OAAO,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE/C,oHAAoH;AACpH,SAAS,gBAAgB,CAAC,GAAsB,EAAE,GAAW;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,4BAA4B,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAE/E,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC;QACzC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,GAAG,GAAG,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAC7F,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pyric/cli",
-  "version": "0.1.0-alpha.26",
+  "version": "0.1.0-alpha.28",
   "license": "Apache-2.0",
   "homepage": "https://pyric.dev",
   "repository": {
@@ -77,7 +77,8 @@
     },
     "./vite": {
       "types": "./dist/vite.d.ts",
-      "import": "./dist/vite.js"
+      "import": "./dist/vite.js",
+      "default": "./dist/vite.js"
     },
     "./vite/ssr-loader": {
       "types": "./dist/serve/vite-ssr-loader.d.ts",
@@ -88,7 +89,8 @@
     },
     "./next": {
       "types": "./dist/next/index.d.ts",
-      "import": "./dist/next/index.js"
+      "import": "./dist/next/index.js",
+      "default": "./dist/next/index.js"
     },
     "./bundler": {
       "types": "./dist/bundler/index.d.ts",
@@ -109,7 +111,8 @@
       "types": "./dist/register/index.d.ts",
       "node": {
         "types": "./dist/register/index.d.ts",
-        "import": "./dist/register/index.js"
+        "import": "./dist/register/index.js",
+        "default": "./dist/register/index.js"
       }
     },
     "./register/app-bridge": {
@@ -209,7 +212,8 @@
     },
     "./next/internal/react-hook": {
       "import": "./dist/next/react-hook-entry.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "bin": {
     "pyric": "./dist/cli/index.js"
@@ -245,12 +249,12 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "create-pyric": "^0.1.0-alpha.26",
+    "create-pyric": "^0.1.0-alpha.28",
     "esbuild": "^0.28.0",
     "fake-indexeddb": "^6.0.0",
     "jsonc-parser": "^3.3.1",
-    "pyric": "^0.1.0-alpha.26",
-    "pyric-admin": "^0.1.0-alpha.26",
+    "pyric": "^0.1.0-alpha.28",
+    "pyric-admin": "^0.1.0-alpha.28",
     "ws": "^8.18.0",
     "zod": "^3.23.0"
   },

package/src/assurance/.generated/conformance-verdicts.ts

@@ -1372,9 +1372,14 @@ export const CONFORMANCE_VERDICTS = {
   "rtdb-modular#MI4": "supported",
   "rtdb-modular#MI5": "supported",
   "rtdb-modular#MI6": "supported",
+  "rtdb-modular#MI7": "supported",
   "rtdb-modular#RS1": "qualified",
   "rtdb-modular#RS2": "qualified",
   "rtdb-modular#RS3": "qualified",
+  "rtdb-modular#VR1": "supported",
+  "rtdb-modular#VR2": "supported",
+  "rtdb-modular#VR3": "supported",
+  "rtdb-modular#VR4": "supported",
   "rtdb-rules#1": "supported",
   "rtdb-rules#10": "supported",
   "rtdb-rules#11": "supported",

package/src/assurance/capabilities.ts

@@ -21,6 +21,7 @@ import {
   type PathSegment,
 } from "pyric/rules/internal";
 import { rtdbRulesSourceRejection } from "pyric/rules/internal/rtdb";
+import { resolveDatabaseInstance } from "pyric/sandbox/internal";
 import { compileStorageRules } from "pyric/storage/internal";
 import {
   CONFORMANCE_VERDICTS,
@@ -101,9 +102,17 @@ export function rulesLoadRefusal(
   service: AssuranceProbe["control"]["service"],
 ): string | undefined {
   if (service === "rtdb") {
-    if (!target.rules.rtdb) return undefined;
-    const rejection = rtdbRulesSourceRejection(target.rules.rtdb);
-    return rejection === null ? undefined : rejection.message;
+    if (target.rules.rtdb) {
+      const rejection = rtdbRulesSourceRejection(target.rules.rtdb);
+      if (rejection !== null) return rejection.message;
+    }
+    if (target.rules.rtdbInstances) {
+      for (const [instanceName, instanceRules] of Object.entries(target.rules.rtdbInstances)) {
+        const rejection = rtdbRulesSourceRejection(instanceRules as any);
+        if (rejection !== null) return `instance '${instanceName}': ${rejection.message}`;
+      }
+    }
+    return undefined;
   }
   const source =
     service === "firestore"
@@ -389,7 +398,16 @@ function rtdbRequirements(
   target: LocalFirebaseTarget,
   probe: AssuranceProbe,
 ): CapabilityRequirement[] {
-  const rules = target.rules.rtdb;
+  let rules = target.rules.rtdb;
+  if (probe.control.service === "rtdb" && probe.control.instance && probe.control.instance !== "default") {
+    const resolvedName = resolveDatabaseInstance(probe.control.instance)?.name;
+    if (resolvedName && target.rules.rtdbInstances) {
+      const declaredEntry = Object.entries(target.rules.rtdbInstances).find(([k]) => resolveDatabaseInstance(k)?.name === resolvedName);
+      if (declaredEntry) {
+        rules = declaredEntry[1] as any;
+      }
+    }
+  }
   const operations = [probe.control, probe.mutation.operation];
   const ruleSources = rules
     ? collectRtdbRuleSources(rules.rules).filter((rule) =>

package/src/assurance/runner.ts

@@ -60,15 +60,17 @@ import {
   initializeSandbox,
   type AuthState,
   type LocalSandbox,
+  type SandboxContext,
   type SandboxEvent,
 } from "pyric/sandbox";
-import { getInternalEnv } from "pyric/sandbox/internal";
+import { getInternalEnv, resolveDatabaseInstance } from "pyric/sandbox/internal";
 import { qualifyProbe, rulesLoadRefusal } from "./capabilities.js";
 import {
   assertActor,
   assertInvariant,
   assertProbe,
   assertTarget,
+  assertCampaign,
 } from "./validation.js";
 import {
   ASSURANCE_CAMPAIGN_SCHEMA,
@@ -96,9 +98,12 @@ interface ActorRuntime {
   auth: AuthState | null;
 }
 
+
+
 interface ServiceRuntime {
   sandbox: LocalSandbox;
   actor: ActorRuntime;
+  context: SandboxContext;
   firestore?: Firestore;
   rtdb?: Database;
   rtdbAdmin?: Database;
@@ -114,56 +119,6 @@ interface ExecutedOperation {
 
 let storageRunSequence = 0;
 
-function assertCampaign(spec: AuthorizationCampaignSpec): void {
-  if (spec.schema !== ASSURANCE_CAMPAIGN_SCHEMA) {
-    throw new AssuranceInputError(
-      `campaign schema must be '${ASSURANCE_CAMPAIGN_SCHEMA}'.`,
-    );
-  }
-  if (!spec.id.trim())
-    throw new AssuranceInputError("campaign id is required.");
-  assertTarget(spec.target);
-  if (!Array.isArray(spec.actors)) {
-    throw new AssuranceInputError("campaign actors must be an array.");
-  }
-  if (!Array.isArray(spec.invariants)) {
-    throw new AssuranceInputError("campaign invariants must be an array.");
-  }
-  if (!Array.isArray(spec.probes)) {
-    throw new AssuranceInputError("campaign probes must be an array.");
-  }
-  for (const actor of spec.actors) assertActor(actor);
-  for (const invariant of spec.invariants) assertInvariant(invariant);
-  for (const probe of spec.probes) assertProbe(probe);
-  uniqueIds(spec.actors, "actor");
-  uniqueIds(spec.invariants, "invariant");
-  uniqueIds(spec.probes, "probe");
-
-  for (const probe of spec.probes) {
-    const actor = spec.actors.find((item) => item.id === probe.actorId);
-    const invariant = spec.invariants.find(
-      (item) => item.id === probe.invariantId,
-    );
-    if (!actor)
-      throw new AssuranceInputError(
-        `probe '${probe.id}' references unknown actor '${probe.actorId}'.`,
-      );
-    if (!invariant) {
-      throw new AssuranceInputError(
-        `probe '${probe.id}' references unknown invariant '${probe.invariantId}'.`,
-      );
-    }
-    if (
-      invariant.service !== "cross-service" &&
-      invariant.service !== probe.control.service
-    ) {
-      throw new AssuranceInputError(
-        `probe '${probe.id}' service does not match invariant '${invariant.id}'.`,
-      );
-    }
-  }
-}
-
 function uniqueIds(items: ReadonlyArray<{ id: string }>, label: string): void {
   const seen = new Set<string>();
   for (const item of items) {
@@ -337,7 +292,7 @@ async function createRuntime(
   const sandbox = initializeSandbox();
   seedAuth(sandbox, target);
   const context = sandbox.withAuth(actorRuntime.auth);
-  const runtime: ServiceRuntime = { sandbox, actor: actorRuntime };
+  const runtime: ServiceRuntime = { sandbox, actor: actorRuntime, context };
 
   if (service === "firestore") {
     const firestore = getFirestore(context);
@@ -347,12 +302,34 @@ async function createRuntime(
   } else if (service === "rtdb") {
     const rtdb = getDatabase(context);
     const admin = getAdminDatabase(sandbox);
-    const refusal = rtdbRulesSourceRejection(target.rules.rtdb);
-    if (refusal !== null) throw new Error(`The assurance target's database rules would not deploy. ${refusal.message}`);
-    rtdbSandbox.setRules(rtdb, target.rules.rtdb!);
-    rtdbSandbox.setData(admin, { "/": target.state.rtdb ?? {} });
+    if (target.rules.rtdb) {
+      const refusal = rtdbRulesSourceRejection(target.rules.rtdb as any);
+      if (refusal !== null) throw new Error(`The assurance target's database rules would not deploy. ${refusal.message}`);
+      rtdbSandbox.setRules(rtdb, target.rules.rtdb as any);
+      rtdbSandbox.setData(admin, { "/": target.state.rtdb ?? {} });
+    }
     runtime.rtdb = rtdb;
     runtime.rtdbAdmin = admin;
+
+    if (target.rules.rtdbInstances) {
+      const stateByResolved = new Map<string, unknown>();
+      if (target.state.rtdbInstances) {
+         for (const [k, v] of Object.entries(target.state.rtdbInstances)) {
+            stateByResolved.set(resolveDatabaseInstance(k)!.name, v);
+         }
+      }
+      for (const [instanceName, instanceValue] of Object.entries(target.rules.rtdbInstances)) {
+        const instanceRefusal = rtdbRulesSourceRejection(instanceValue);
+        if (instanceRefusal !== null) throw new Error(`The assurance target's database rules for instance '${instanceName}' would not deploy. ${instanceRefusal.message}`);
+        
+        const resolved = resolveDatabaseInstance(instanceName)!;
+        const instDb = getDatabase(context, resolved.url);
+        const instAdmin = getAdminDatabase(sandbox, resolved.url);
+        rtdbSandbox.setRules(instDb, instanceValue as { rules: Record<string, unknown> });
+        const instData = stateByResolved.get(resolved.name);
+        rtdbSandbox.setData(instAdmin, { "/": instData ?? {} });
+      }
+    }
   } else {
     if (target.state.firestore) {
       seedDocuments(
@@ -678,7 +655,12 @@ async function readState(
     return state[normalizedPath] ?? null;
   }
   if (operation.service === "rtdb") {
-    return (await getRtdb(rtdbRef(runtime.rtdbAdmin!, operation.path))).val();
+    let admin = runtime.rtdbAdmin!;
+    if (operation.instance && operation.instance !== "default") {
+      const url = resolveDatabaseInstance(operation.instance)!.url;
+      admin = getAdminDatabase(runtime.sandbox, url);
+    }
+    return (await getRtdb(rtdbRef(admin, operation.path))).val();
   }
   return readStorageState(operation, runtime.storageAdmin!);
 }
@@ -740,7 +722,7 @@ async function executeOperation(
       operation.service === "firestore"
         ? await executeFirestore(operation, runtime.firestore!, runtime)
         : operation.service === "rtdb"
-          ? await executeRtdb(operation, runtime.rtdb!)
+          ? await executeRtdb(operation, operation.instance && operation.instance !== "default" ? getDatabase(runtime.context, resolveDatabaseInstance(operation.instance)!.url) : runtime.rtdb!)
           : await executeStorage(operation, runtime.storage!);
   } catch (error) {
     const result = errorDecision(error);

package/src/assurance/types.ts

@@ -64,11 +64,13 @@ export interface LocalFirebaseTarget {
   rules: {
     firestore?: string;
     rtdb?: { rules: Record<string, unknown> };
+    rtdbInstances?: Record<string, { rules: Record<string, unknown> }>;
     storage?: string;
   };
   state: {
     firestore?: Record<string, Record<string, unknown>>;
     rtdb?: unknown;
+    rtdbInstances?: Record<string, unknown>;
     storage?: StorageObjectFixture[];
     auth?: { users: AuthFixtureUser[] };
   };
@@ -125,6 +127,7 @@ export interface FirestoreOperation {
 
 export interface RtdbOperation {
   service: "rtdb";
+  instance?: string;
   method: "get" | "set" | "update" | "remove";
   path: string;
   data?: unknown;

package/src/assurance/validation.ts

@@ -13,13 +13,17 @@
  * `observations[0]`, `probes[2]`. A caller that validates one record on its
  * own passes nothing and gets the record's kind instead.
  */
+import { resolveDatabaseInstance } from "pyric/sandbox/internal";
+import { rtdbRulesSourceRejection } from "pyric/rules/internal/rtdb";
 import {
+  ASSURANCE_CAMPAIGN_SCHEMA,
   ASSURANCE_TARGET_SCHEMA,
   AssuranceInputError,
   type AssuranceActor,
   type AssuranceObservation,
   type AssuranceProbe,
   type FirebaseOperation,
+  type AuthorizationCampaignSpec,
   type LocalFirebaseTarget,
   type MutationDimension,
   type SecurityInvariant,
@@ -225,13 +229,56 @@ export function assertTarget(
   if (target.rules.rtdb !== undefined) {
     requiredRecord(target.rules.rtdb, `${where}.rules.rtdb`);
     requiredRecord(target.rules.rtdb.rules, `${where}.rules.rtdb.rules`);
+
+  }
+
+  const declaredRuleInstances = new Map<string, string>();
+  if (target.rules.rtdbInstances !== undefined) {
+    requiredRecord(target.rules.rtdbInstances, `${where}.rules.rtdbInstances`);
+    for (const [instance, rules] of Object.entries(target.rules.rtdbInstances)) {
+      const at = `${where}.rules.rtdbInstances[${JSON.stringify(instance)}]`;
+      requiredRecord(rules, at);
+      requiredRecord((rules as any).rules, `${at}.rules`);
+      try {
+        const resolvedName = resolveDatabaseInstance(instance)!.name;
+        if (declaredRuleInstances.has(resolvedName)) {
+           throw new AssuranceInputError(`${at} declares instance '${resolvedName}' which is already declared by key '${declaredRuleInstances.get(resolvedName)}'`);
+        }
+        declaredRuleInstances.set(resolvedName, instance);
+      } catch (e) {
+        if (e instanceof AssuranceInputError) throw e;
+        throw new AssuranceInputError(`${at} names a malformed RTDB instance: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    }
   }
+
   if (target.state.firestore !== undefined) {
     requiredRecord(target.state.firestore, `${where}.state.firestore`);
     for (const [docPath, docData] of Object.entries(target.state.firestore)) {
       requiredRecord(docData, `${where}.state.firestore[${docPath}]`);
     }
   }
+  if (target.state.rtdbInstances !== undefined) {
+    requiredRecord(target.state.rtdbInstances, `${where}.state.rtdbInstances`);
+    const declaredStateInstances = new Map<string, string>();
+    for (const [instance] of Object.entries(target.state.rtdbInstances)) {
+      const at = `${where}.state.rtdbInstances[${JSON.stringify(instance)}]`;
+      try {
+        const resolvedName = resolveDatabaseInstance(instance)!.name;
+        if (!declaredRuleInstances.has(resolvedName)) {
+           throw new AssuranceInputError(`${at} provides state for instance '${resolvedName}' which has no declared rules`);
+        }
+        if (declaredStateInstances.has(resolvedName)) {
+           throw new AssuranceInputError(`${at} provides state for instance '${resolvedName}' which is already provided by key '${declaredStateInstances.get(resolvedName)}'`);
+        }
+        declaredStateInstances.set(resolvedName, instance);
+      } catch (e) {
+        if (e instanceof AssuranceInputError) throw e;
+        throw new AssuranceInputError(`${at} names a malformed RTDB instance: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    }
+  }
+
   if (target.state.storage !== undefined) {
     if (!Array.isArray(target.state.storage)) {
       throw new AssuranceInputError(
@@ -367,6 +414,9 @@ function assertOperation(
 ): asserts operation is FirebaseOperation {
   requiredRecord(operation, where);
   enumValue(operation.service, OPERATION_SERVICES, where, "service");
+  if (operation.service === "rtdb" && (operation as any).instance !== undefined) {
+    requiredString((operation as any).instance, where, "instance");
+  }
   requiredString(operation.path, where, "path");
   enumValue(
     operation.method,
@@ -507,3 +557,90 @@ export function changedDimensions(
   }
   return changed;
 }
+
+
+export function assertCampaign(spec: AuthorizationCampaignSpec): void {
+  if (spec.schema !== ASSURANCE_CAMPAIGN_SCHEMA) {
+    throw new AssuranceInputError(
+      `campaign schema must be '${ASSURANCE_CAMPAIGN_SCHEMA}'.`,
+    );
+  }
+  if (!spec.id.trim())
+    throw new AssuranceInputError("campaign id is required.");
+  assertTarget(spec.target);
+  if (!Array.isArray(spec.actors)) {
+    throw new AssuranceInputError("campaign actors must be an array.");
+  }
+  if (!Array.isArray(spec.invariants)) {
+    throw new AssuranceInputError("campaign invariants must be an array.");
+  }
+  if (!Array.isArray(spec.probes)) {
+    throw new AssuranceInputError("campaign probes must be an array.");
+  }
+  for (const actor of spec.actors) assertActor(actor);
+  for (const invariant of spec.invariants) assertInvariant(invariant);
+  for (const probe of spec.probes) assertProbe(probe);
+  uniqueIds(spec.actors, "actor");
+  uniqueIds(spec.invariants, "invariant");
+  uniqueIds(spec.probes, "probe");
+
+  const declaredRtdbInstances = spec.target.rules.rtdbInstances ? Object.keys(spec.target.rules.rtdbInstances).map(k => resolveDatabaseInstance(k)!.name) : [];
+  for (const probe of spec.probes) {
+    for (const op of [probe.control, probe.mutation.operation]) {
+      // test what happens to unknown fields (unrecognized keys)
+      const allowedKeys = new Set(["service", "method", "path", "data", "query", "dataBase64", "contentType", "customMetadata", "instance"]);
+      for (const key of Object.keys(op)) {
+        if (!allowedKeys.has(key)) {
+          throw new AssuranceInputError(`operation names unknown field '${key}'`);
+        }
+      }
+      
+      if (op.service === "rtdb" && op.instance !== undefined && op.instance !== "default") {
+        let resolvedName;
+        try {
+          resolvedName = resolveDatabaseInstance(op.instance)!.name;
+        } catch (e) {
+          throw new AssuranceInputError(`invalid RTDB instance '${op.instance}': ${e instanceof Error ? e.message : String(e)}`);
+        }
+        if (!declaredRtdbInstances.includes(resolvedName)) {
+          throw new AssuranceInputError(`probe '${probe.id}' names undeclared RTDB instance '${op.instance}'. Declared instances: ${declaredRtdbInstances.length > 0 ? declaredRtdbInstances.join(", ") : "none"}.`);
+        }
+      }
+    }
+  }
+
+  for (const probe of spec.probes) {
+    const actor = spec.actors.find((item) => item.id === probe.actorId);
+    const invariant = spec.invariants.find(
+      (item) => item.id === probe.invariantId,
+    );
+    if (!actor)
+      throw new AssuranceInputError(
+        `probe '${probe.id}' references unknown actor '${probe.actorId}'.`,
+      );
+    if (!invariant) {
+      throw new AssuranceInputError(
+        `probe '${probe.id}' references unknown invariant '${probe.invariantId}'.`,
+      );
+    }
+    if (
+      invariant.service !== "cross-service" &&
+      invariant.service !== probe.control.service
+    ) {
+      throw new AssuranceInputError(
+        `probe '${probe.id}' service does not match invariant '${invariant.id}'.`,
+      );
+    }
+  }
+}
+
+function uniqueIds(items: ReadonlyArray<{ id: string }>, label: string): void {
+  const seen = new Set<string>();
+  for (const item of items) {
+    if (!item.id.trim())
+      throw new AssuranceInputError(`${label} id is required.`);
+    if (seen.has(item.id))
+      throw new AssuranceInputError(`duplicate ${label} id '${item.id}'.`);
+    seen.add(item.id);
+  }
+}

package/src/bridge/surface/arguments/assurance.ts

@@ -82,6 +82,7 @@ export const OPERATION_METHOD_VALUES: readonly string[] = [
 export const firebaseOperation = z
   .object({
     service: z.enum(OPERATION_SERVICES).describe('The service the operation runs against.'),
+    instance: z.string().optional().describe('The named RTDB instance, if the service is rtdb.'),
     method: z
       .enum(OPERATION_METHOD_VALUES as [string, ...string[]])
       .describe('The request method, from the set the named service evaluates.'),

package/src/cli/database-rules.ts

@@ -236,6 +236,6 @@ export async function runDatabaseRulesGenerate(
   await mkdirFn(dirname(resolvedOut), { recursive: true });
   await writeFileFn(resolvedOut, `${JSON.stringify(rulesJson, null, 2)}\n`, 'utf-8');
 
-  out.write(`pyric database rules generate: wrote ${resolvedOut}\n`);
+  out.write(`pyric database rules generate: wrote ${resolvedOut}\n  Test before deploy: pyric verify --service rtdb --rules rtdb=${outPath}\n`);
   return 0;
 }