@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/src/bridge/surface/methods/messaging/send.ts

@@ -2,7 +2,7 @@
 import { z } from 'zod';
 import { BrokerSendError, type BrokerMessage } from 'pyric/messaging/internal';
 import { messageArgument, RENAMES, TARGET_FIELDS } from '../../arguments/messaging.js';
-import { operationFailure } from '../../context.js';
+import { operationFailure } from '../../sandbox-context.js';
 import { messagingBrokerFor } from '../../service-handles.js';
 import type { Args, InvalidArguments, MethodRecord, MethodValidationContext } from '../../method-types.js';
 
@@ -28,6 +28,7 @@ function refuseAmbiguousTarget(args: Args, ctx: MethodValidationContext): Invali
 export default {
   tool: 'messaging',
   method: 'send',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-admin',
   effect: 'write',
   signature: 'send(message{token?, topic?, condition?, notification?, data?})',

package/src/bridge/surface/methods/messaging/subscribeToTopic.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'messaging',
   method: 'subscribeToTopic',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-admin',
   effect: 'write',
   signature: 'subscribeToTopic(tokens[], topic)',

package/src/bridge/surface/methods/messaging/tokens.ts

@@ -6,6 +6,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'messaging',
   method: 'tokens',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: 'tokens()',

package/src/bridge/surface/methods/messaging/unsubscribeFromTopic.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'messaging',
   method: 'unsubscribeFromTopic',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-admin',
   effect: 'write',
   signature: 'unsubscribeFromTopic(tokens[], topic)',

package/src/bridge/surface/methods/registry.ts

@@ -10,24 +10,14 @@
  * and auditable under neither.
  */
 import { METHOD_RECORDS, TOOL_RECORDS } from '../manifest.generated.js';
-import { operationIds, type Method, type Tool } from '../method-types.js';
+import { operationIds, stampRecord, type Method, type Tool } from '../method-types.js';
 
 /** Methods of one tool, in the order the manifest lists them. */
 function methodsOf(tool: string): Method[] {
   const loaded: Method[] = [];
   for (const [owner, name, record] of METHOD_RECORDS) {
     if (owner !== tool) continue;
-    if (record.tool !== owner) {
-      throw new Error(
-        `method record methods/${owner}/${name}.ts declares tool '${record.tool}'`,
-      );
-    }
-    if (record.method !== name) {
-      throw new Error(
-        `method record methods/${owner}/${name}.ts declares method '${record.method}'`,
-      );
-    }
-    loaded.push({ ...record, key: `${owner}.${name}` });
+    loaded.push(stampRecord(owner, name, record));
   }
   return loaded;
 }

package/src/bridge/surface/methods/rules/explainDenial.ts

@@ -30,6 +30,7 @@ const EXPLAINED_SERVICES = ['firestore', 'database'] as const;
 export default {
   tool: 'rules',
   method: 'explainDenial',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: `explainDenial(operation: ${REQUEST_METHODS.join('|')}, path, service?: ${EXPLAINED_SERVICES.join('|')}, uid?, data?, query?, rules?, source?, instance?)`,

package/src/bridge/surface/methods/rules/getStdlib.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'rules',
   method: 'getStdlib',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: `getStdlib(module, service?: ${SERVICES.join('|')})`,

package/src/bridge/surface/methods/rules/lint.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'rules',
   method: 'lint',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: `lint(service: ${SERVICES.join('|')}, rules?, instance?)`,

package/src/bridge/surface/methods/rules/listStdlib.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'rules',
   method: 'listStdlib',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: `listStdlib(service?: ${SERVICES.join('|')})`,

package/src/bridge/surface/methods/rules/set.ts

@@ -16,6 +16,7 @@ const EXAMPLE_RULES = [
 export default {
   tool: 'rules',
   method: 'set',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: `set(service: ${SERVICES.join('|')}, rules, instance?)`,

package/src/bridge/surface/methods/rules/simulate.ts

@@ -70,6 +70,7 @@ function checkInstants(args: Args, fail: Fail): InvalidArguments | null {
 export default {
   tool: 'rules',
   method: 'simulate',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: `simulate(service: ${SERVICES.join('|')}, operation?: ${REQUEST_METHODS.join('|')}, path?, uid?, data?, query?, cases?, rules?, instance?, requestTime?)`,

package/src/bridge/surface/methods/sandbox/activity.ts

@@ -15,7 +15,7 @@
 import { z } from 'zod';
 import { monitorFirebaseActivity, type ActivityFeed, type ActivityIncident } from 'pyric/firestore/internal';
 import type { SandboxEvent } from 'pyric/sandbox';
-import { operationFailure } from '../../context.js';
+import { operationFailure } from '../../sandbox-context.js';
 import type { MethodRecord } from '../../method-types.js';
 
 const PATTERNS = ['repeated-read', 'duplicate-listener', 'listener-churn'] as const;
@@ -41,6 +41,7 @@ function idsAtOrAfter(events: readonly SandboxEvent[], since: string): { ids: Se
 export default {
   tool: 'sandbox',
   method: 'activity',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: `activity(since?, pattern?: ${PATTERNS.join('|')})`,

package/src/bridge/surface/methods/sandbox/advanceClock.ts

@@ -6,6 +6,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'advanceClock',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'advanceClock(ms)',

package/src/bridge/surface/methods/sandbox/apply.ts

@@ -48,6 +48,7 @@ function eventsFor(args: Record<string, unknown>, projectDir: string): EventSour
 export default {
   tool: 'sandbox',
   method: 'apply',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'apply(branch, events? | sessionPath?)',

package/src/bridge/surface/methods/sandbox/checkpoint.ts

@@ -6,6 +6,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'checkpoint',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'checkpoint(name)',

package/src/bridge/surface/methods/sandbox/deleteCapture.ts

@@ -3,7 +3,7 @@ import { runCaptureMethod } from '../../../../serve/rate-capture-service.js';
 import type { MethodRecord } from '../../method-types.js';
 
 export default {
-  tool: 'sandbox', method: 'deleteCapture', sdkOrigin: 'pyric', effect: 'destructive',
+  tool: 'sandbox', method: 'deleteCapture', runsIn: 'bridge', sdkOrigin: 'pyric', effect: 'destructive',
   signature: 'deleteCapture(id, confirm)', description: 'Delete a capture.',
   args: z.object({ id: z.string(), confirm: z.boolean().describe('Must be true to remove this saved snapshot.') }), operation: 'delete_rate_capture', example: { id: '00000000-0000-4000-8000-000000000000', confirm: true },
   async handler(args, ctx) { return runCaptureMethod('deleteCapture', args, ctx.projectDir); },

package/src/bridge/surface/methods/sandbox/deleteCheckpoint.ts

@@ -17,6 +17,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'deleteCheckpoint',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'destructive',
   signature: 'deleteCheckpoint(name, confirm)',

package/src/bridge/surface/methods/sandbox/diff.ts

@@ -27,6 +27,7 @@ import type { OperationResult } from '../../types.js';
 export default {
   tool: 'sandbox',
   method: 'diff',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: 'diff(branch, against?: live|<checkpoint name>)',

package/src/bridge/surface/methods/sandbox/discard.ts

@@ -16,6 +16,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'discard',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'discard(branch)',

package/src/bridge/surface/methods/sandbox/events.ts

@@ -9,7 +9,7 @@
 import { z } from 'zod';
 import { toListenerRecord, toOperationRecord, type OperationRecord } from 'pyric/sandbox';
 import type { SandboxEvent } from 'pyric/sandbox';
-import { operationFailure } from '../../context.js';
+import { operationFailure } from '../../sandbox-context.js';
 import type { MethodRecord } from '../../method-types.js';
 
 /** Methods the log carries that read state rather than change it. */
@@ -42,6 +42,7 @@ function recordForKind(event: SandboxEvent, kind: string): OperationRecord | nul
 export default {
   tool: 'sandbox',
   method: 'events',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: 'events(since?, limit?, kind?: all|denials|writes|listeners)',

package/src/bridge/surface/methods/sandbox/exportFixture.ts

@@ -20,6 +20,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'exportFixture',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'exportFixture(path, excludePasswords?)',

package/src/bridge/surface/methods/sandbox/fork.ts

@@ -22,6 +22,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'fork',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'fork(branch, candidateRules?: string | {firestore?, database?, storage?})',

package/src/bridge/surface/methods/sandbox/inspect.ts

@@ -1,12 +1,13 @@
 /** Report what the sandbox holds. */
 import { z } from 'zod';
 import { getClock } from 'pyric/sandbox';
-import { callSandboxTool } from '../../context.js';
+import { callSandboxTool } from '../../sandbox-context.js';
 import type { MethodRecord } from '../../method-types.js';
 
 export default {
   tool: 'sandbox',
   method: 'inspect',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: 'inspect()',

package/src/bridge/surface/methods/sandbox/listBranches.ts

@@ -37,6 +37,7 @@ function countsByService(divergences: readonly BranchDivergence[]): Record<strin
 export default {
   tool: 'sandbox',
   method: 'listBranches',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: 'listBranches()',

package/src/bridge/surface/methods/sandbox/listCaptures.ts

@@ -3,7 +3,7 @@ import { runCaptureMethod } from '../../../../serve/rate-capture-service.js';
 import type { MethodRecord } from '../../method-types.js';
 
 export default {
-  tool: 'sandbox', method: 'listCaptures', sdkOrigin: 'pyric', effect: 'read',
+  tool: 'sandbox', method: 'listCaptures', runsIn: 'bridge', sdkOrigin: 'pyric', effect: 'read',
   signature: 'listCaptures()', description: 'List rate captures.',
   args: z.object({}), operation: 'list_rate_captures', example: {},
   async handler(args, ctx) {

package/src/bridge/surface/methods/sandbox/listCheckpoints.ts

@@ -6,6 +6,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'listCheckpoints',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: 'listCheckpoints()',

package/src/bridge/surface/methods/sandbox/listeners.ts

@@ -40,6 +40,7 @@ function totalsFor(listeners: readonly ActiveListener[]): Record<string, number>
 export default {
   tool: 'sandbox',
   method: 'listeners',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'read',
   signature: `listeners(service?: ${SERVICES.join('|')}, target?)`,

package/src/bridge/surface/methods/sandbox/openCapture.ts

@@ -3,7 +3,7 @@ import { runCaptureMethod } from '../../../../serve/rate-capture-service.js';
 import type { MethodRecord } from '../../method-types.js';
 
 export default {
-  tool: 'sandbox', method: 'openCapture', sdkOrigin: 'pyric', effect: 'read',
+  tool: 'sandbox', method: 'openCapture', runsIn: 'bridge', sdkOrigin: 'pyric', effect: 'read',
   signature: 'openCapture(id?)', description: 'Inspect rate capture.',
   args: z.object({ id: z.string().optional().describe('Capture id. Omit to open the latest saved capture. Read-only; does not restore or replay.') }), operation: 'open_rate_capture', example: {},
   async handler(args, ctx) {

package/src/bridge/surface/methods/sandbox/promote.ts

@@ -36,6 +36,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'promote',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'destructive',
   signature: 'promote(branch, confirm)',

package/src/bridge/surface/methods/sandbox/renameCapture.ts

@@ -3,7 +3,7 @@ import { runCaptureMethod } from '../../../../serve/rate-capture-service.js';
 import type { MethodRecord } from '../../method-types.js';
 
 export default {
-  tool: 'sandbox', method: 'renameCapture', sdkOrigin: 'pyric', effect: 'write',
+  tool: 'sandbox', method: 'renameCapture', runsIn: 'bridge', sdkOrigin: 'pyric', effect: 'write',
   signature: 'renameCapture(id, name)', description: 'Name a capture.',
   args: z.object({ id: z.string(), name: z.string().max(80).describe('Capture name. Empty clears the name.') }), operation: 'rename_rate_capture', example: { id: '00000000-0000-4000-8000-000000000000', name: 'Message burst' },
   async handler(args, ctx) { return runCaptureMethod('renameCapture', args, ctx.projectDir); },

package/src/bridge/surface/methods/sandbox/reset.ts

@@ -18,13 +18,13 @@ import { getAdminStorageSandbox } from 'pyric/storage/internal';
 import { getAuth, sandbox as authSandbox } from 'pyric/auth';
 import { listStoredPaths } from '../../storage-state.js';
 import type { MethodRecord } from '../../method-types.js';
-import type { SurfaceContext } from '../../types.js';
+import type { SandboxSurfaceContext } from '../../types.js';
 
 /** The services a reset can be narrowed to, and `all` for every one of them. */
 export const RESET_SCOPES = ['all', 'firestore', 'database', 'storage', 'auth'] as const;
 type Scope = (typeof RESET_SCOPES)[number];
 
-async function resetScope(scope: Scope, ctx: SurfaceContext): Promise<void> {
+async function resetScope(scope: Scope, ctx: SandboxSurfaceContext): Promise<void> {
   if (scope === 'firestore') {
     const db = getAdminFirestore(ctx.sandbox);
     for (const path of Object.keys(snapshotDocuments(ctx.sandbox))) {
@@ -49,6 +49,7 @@ async function resetScope(scope: Scope, ctx: SurfaceContext): Promise<void> {
 export default {
   tool: 'sandbox',
   method: 'reset',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'destructive',
   signature: `reset(scope?: ${RESET_SCOPES.join('|')}, confirm)`,

package/src/bridge/surface/methods/sandbox/resetClock.ts

@@ -6,6 +6,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'resetClock',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'resetClock()',

package/src/bridge/surface/methods/sandbox/restore.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'restore',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'destructive',
   signature: 'restore(name, confirm)',

package/src/bridge/surface/methods/sandbox/saveCapture.ts

@@ -3,7 +3,7 @@ import { runCaptureMethod } from '../../../../serve/rate-capture-service.js';
 import type { MethodRecord } from '../../method-types.js';
 
 export default {
-  tool: 'sandbox', method: 'saveCapture', sdkOrigin: 'pyric', effect: 'write',
+  tool: 'sandbox', method: 'saveCapture', runsIn: 'bridge', sdkOrigin: 'pyric', effect: 'write',
   signature: 'saveCapture(capture)', description: 'Save rate capture JSON.',
   args: z.object({ capture: z.string().max(32 * 1024 * 1024).describe('JSON from a runtime rate capture, including its measured interval.') }), operation: 'save_rate_capture', example: { capture: "{\"schema\":\"pyric.rate-capture.v1\",\"createdAt\":\"2026-09-15T00:00:00Z\",\"frame\":{\"service\":{\"service\":\"rtdb\",\"coverage\":\"partial\",\"observed\":true,\"untrackedMethods\":[],\"methods\":[]},\"points\":[{\"second\":10,\"reads\":2,\"writes\":4,\"deletes\":0,\"deliveries\":1}],\"to\":10,\"duration\":1,\"clockOffset\":1000,\"totals\":{\"reads\":2,\"writes\":4,\"deletes\":0,\"deliveries\":1},\"peaks\":{\"reads\":2,\"writes\":4,\"deletes\":0,\"deliveries\":1},\"from\":10},\"thresholds\":{}}" },
   async handler(args, ctx) {

package/src/bridge/surface/methods/sandbox/seed.ts

@@ -6,14 +6,15 @@
  * path.
  */
 import { z } from 'zod';
-import { checkUserFields, storageObjectSeed, userSeed } from '../../arguments/sandbox.js';
-import { operationFailure } from '../../context.js';
+import { checkUserFields, storageObjectSeed, userSeed } from '../../arguments/seed.js';
+import { operationFailure } from '../../sandbox-context.js';
 import { applyData, applyRules, type SandboxSeed } from '../../seed-apply.js';
 import type { MethodRecord } from '../../method-types.js';
 
 export default {
   tool: 'sandbox',
   method: 'seed',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature:

package/src/bridge/surface/methods/sandbox/seedFromFixture.ts

@@ -9,6 +9,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'seedFromFixture',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'seedFromFixture(path)',

package/src/bridge/surface/methods/sandbox/setClock.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'setClock',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'setClock(isoTime)',

package/src/bridge/surface/methods/sandbox-registry.ts

@@ -0,0 +1,24 @@
+/**
+ * The records that run wherever the sandbox lives, for a host that keeps its
+ * sandbox in a browser.
+ *
+ * `scripts/generate-surface-manifest.ts` renders `../manifest.sandbox.generated.ts`
+ * from the records that declare `runsIn: 'sandbox'`. This module imports only
+ * that manifest, never `./registry.ts`, so a browser bundle that loads it
+ * reaches none of the bridge's records or the Node modules they import.
+ */
+import { SANDBOX_METHOD_RECORDS } from '../manifest.sandbox.generated.js';
+import { stampRecord, type SandboxMethod } from '../method-types.js';
+
+/** Every sandbox-side method by `<tool>.<method>`. */
+export const SANDBOX_METHODS_BY_KEY: ReadonlyMap<string, SandboxMethod> = new Map(
+  SANDBOX_METHOD_RECORDS.map(([owner, name, record]) => {
+    const method = stampRecord(owner, name, record);
+    return [method.key, method];
+  }),
+);
+
+/** One sandbox-side method by key, or undefined when it runs only in the bridge process. */
+export function sandboxMethodByKey(key: string): SandboxMethod | undefined {
+  return SANDBOX_METHODS_BY_KEY.get(key);
+}

package/src/bridge/surface/methods/storage/deleteObject.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'deleteObject',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'write',
   signature: 'deleteObject(path)',

package/src/bridge/surface/methods/storage/getBytes.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'getBytes',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'read',
   signature: 'getBytes(path)',

package/src/bridge/surface/methods/storage/getDownloadURL.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'getDownloadURL',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'read',
   signature: 'getDownloadURL(path)',

package/src/bridge/surface/methods/storage/getMetadata.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'getMetadata',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'read',
   signature: 'getMetadata(path)',

package/src/bridge/surface/methods/storage/listAll.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'listAll',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'read',
   signature: 'listAll(prefix?)',

package/src/bridge/surface/methods/storage/provision.ts

@@ -15,6 +15,7 @@ function inputFor(args: Args): ProvisionStorageInput {
 export default {
   tool: 'storage',
   method: 'provision',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'production',
   signature: 'provision(bucket?, confirm)',

package/src/bridge/surface/methods/storage/setCrossServiceIam.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'setCrossServiceIam',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'setCrossServiceIam(mode: granted|denied)',

package/src/bridge/surface/methods/storage/status.ts

@@ -7,6 +7,7 @@ import type { OperationResult } from '../../types.js';
 export default {
   tool: 'storage',
   method: 'status',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'production',
   signature: 'status(confirm)',

package/src/bridge/surface/methods/storage/updateMetadata.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'updateMetadata',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'write',
   signature:

package/src/bridge/surface/methods/storage/uploadBytes.ts

@@ -71,6 +71,7 @@ function payloadFor(args: Args, ctx: SurfaceContext): Uint8Array | InvalidArgume
 export default {
   tool: 'storage',
   method: 'uploadBytes',
+  runsIn: 'bridge',
   sdkOrigin: 'firebase-js',
   effect: 'write',
   signature: 'uploadBytes(path, contentBase64? | sourcePath?, metadata?)',

package/src/bridge/surface/request-instant.ts

@@ -15,14 +15,14 @@
  * would have got by naming no instant at all.
  */
 import { getClock } from 'pyric/sandbox';
-import type { SurfaceContext } from './types.js';
+import type { SandboxSurfaceContext } from './types.js';
 
 /**
  * The instant `request.time` (Firestore, Storage) or `now` (database) reads,
  * in epoch milliseconds: the caller's `requestTime` when it names a parsable
  * one, and the sandbox clock's own instant otherwise.
  */
-export function requestInstant(ctx: SurfaceContext, requestTime: string | undefined): number {
+export function requestInstant(ctx: SandboxSurfaceContext, requestTime: string | undefined): number {
   if (requestTime === undefined) return getClock(ctx.sandbox).now();
   const named = Date.parse(requestTime);
   if (Number.isNaN(named)) return getClock(ctx.sandbox).now();

package/src/bridge/surface/rules-engines/database.ts

@@ -5,7 +5,6 @@ import type { RtdbCase, RtdbRulesJson } from 'pyric/rules';
 import { resolveDatabaseInstance } from 'pyric/sandbox/internal';
 import { getActiveRules, setRules, snapshotState } from 'pyric/sandbox/database';
 import { rtdbRulesSourceRejection } from 'pyric/rules/internal/rtdb';
-import { projectDatabaseInstances } from '../database-instance-catalog.js';
 import { instanceSelector, onInstance } from '../database-instance.js';
 import { databaseRulesSource, installDatabaseRules } from '../database-rules-load.js';
 import { databaseFor } from '../service-handles.js';
@@ -67,7 +66,7 @@ async function deploySelector(ctx: SurfaceContext, raw: unknown): Promise<string
   if (raw === undefined) return undefined;
   const instance = resolveDatabaseInstance(String(raw));
   if (instance === undefined) return undefined;
-  const catalog = ctx.databaseInstances ?? (await projectDatabaseInstances(ctx.sandbox, ctx.projectDir));
+  const catalog = await ctx.databaseInstances();
   return catalog.select(instance.name) === undefined ? undefined : instance.name;
 }