@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/src/bridge/surface/methods/sandbox/setClock.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'sandbox',
   method: 'setClock',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'setClock(isoTime)',

package/src/bridge/surface/methods/sandbox-registry.ts

@@ -0,0 +1,24 @@
+/**
+ * The records that run wherever the sandbox lives, for a host that keeps its
+ * sandbox in a browser.
+ *
+ * `scripts/generate-surface-manifest.ts` renders `../manifest.sandbox.generated.ts`
+ * from the records that declare `runsIn: 'sandbox'`. This module imports only
+ * that manifest, never `./registry.ts`, so a browser bundle that loads it
+ * reaches none of the bridge's records or the Node modules they import.
+ */
+import { SANDBOX_METHOD_RECORDS } from '../manifest.sandbox.generated.js';
+import { stampRecord, type SandboxMethod } from '../method-types.js';
+
+/** Every sandbox-side method by `<tool>.<method>`. */
+export const SANDBOX_METHODS_BY_KEY: ReadonlyMap<string, SandboxMethod> = new Map(
+  SANDBOX_METHOD_RECORDS.map(([owner, name, record]) => {
+    const method = stampRecord(owner, name, record);
+    return [method.key, method];
+  }),
+);
+
+/** One sandbox-side method by key, or undefined when it runs only in the bridge process. */
+export function sandboxMethodByKey(key: string): SandboxMethod | undefined {
+  return SANDBOX_METHODS_BY_KEY.get(key);
+}

package/src/bridge/surface/methods/storage/deleteObject.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'deleteObject',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'write',
   signature: 'deleteObject(path)',

package/src/bridge/surface/methods/storage/getBytes.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'getBytes',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'read',
   signature: 'getBytes(path)',

package/src/bridge/surface/methods/storage/getDownloadURL.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'getDownloadURL',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'read',
   signature: 'getDownloadURL(path)',

package/src/bridge/surface/methods/storage/getMetadata.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'getMetadata',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'read',
   signature: 'getMetadata(path)',

package/src/bridge/surface/methods/storage/listAll.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'listAll',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'read',
   signature: 'listAll(prefix?)',

package/src/bridge/surface/methods/storage/provision.ts

@@ -15,6 +15,7 @@ function inputFor(args: Args): ProvisionStorageInput {
 export default {
   tool: 'storage',
   method: 'provision',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'production',
   signature: 'provision(bucket?, confirm)',

package/src/bridge/surface/methods/storage/setCrossServiceIam.ts

@@ -7,6 +7,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'setCrossServiceIam',
+  runsIn: 'sandbox',
   sdkOrigin: 'pyric',
   effect: 'write',
   signature: 'setCrossServiceIam(mode: granted|denied)',

package/src/bridge/surface/methods/storage/status.ts

@@ -7,6 +7,7 @@ import type { OperationResult } from '../../types.js';
 export default {
   tool: 'storage',
   method: 'status',
+  runsIn: 'bridge',
   sdkOrigin: 'pyric',
   effect: 'production',
   signature: 'status(confirm)',

package/src/bridge/surface/methods/storage/updateMetadata.ts

@@ -8,6 +8,7 @@ import type { MethodRecord } from '../../method-types.js';
 export default {
   tool: 'storage',
   method: 'updateMetadata',
+  runsIn: 'sandbox',
   sdkOrigin: 'firebase-js',
   effect: 'write',
   signature:

package/src/bridge/surface/methods/storage/uploadBytes.ts

@@ -71,6 +71,7 @@ function payloadFor(args: Args, ctx: SurfaceContext): Uint8Array | InvalidArgume
 export default {
   tool: 'storage',
   method: 'uploadBytes',
+  runsIn: 'bridge',
   sdkOrigin: 'firebase-js',
   effect: 'write',
   signature: 'uploadBytes(path, contentBase64? | sourcePath?, metadata?)',

package/src/bridge/surface/request-instant.ts

@@ -15,14 +15,14 @@
  * would have got by naming no instant at all.
  */
 import { getClock } from 'pyric/sandbox';
-import type { SurfaceContext } from './types.js';
+import type { SandboxSurfaceContext } from './types.js';
 
 /**
  * The instant `request.time` (Firestore, Storage) or `now` (database) reads,
  * in epoch milliseconds: the caller's `requestTime` when it names a parsable
  * one, and the sandbox clock's own instant otherwise.
  */
-export function requestInstant(ctx: SurfaceContext, requestTime: string | undefined): number {
+export function requestInstant(ctx: SandboxSurfaceContext, requestTime: string | undefined): number {
   if (requestTime === undefined) return getClock(ctx.sandbox).now();
   const named = Date.parse(requestTime);
   if (Number.isNaN(named)) return getClock(ctx.sandbox).now();

package/src/bridge/surface/rules-engines/database.ts

@@ -5,7 +5,6 @@ import type { RtdbCase, RtdbRulesJson } from 'pyric/rules';
 import { resolveDatabaseInstance } from 'pyric/sandbox/internal';
 import { getActiveRules, setRules, snapshotState } from 'pyric/sandbox/database';
 import { rtdbRulesSourceRejection } from 'pyric/rules/internal/rtdb';
-import { projectDatabaseInstances } from '../database-instance-catalog.js';
 import { instanceSelector, onInstance } from '../database-instance.js';
 import { databaseRulesSource, installDatabaseRules } from '../database-rules-load.js';
 import { databaseFor } from '../service-handles.js';
@@ -67,7 +66,7 @@ async function deploySelector(ctx: SurfaceContext, raw: unknown): Promise<string
   if (raw === undefined) return undefined;
   const instance = resolveDatabaseInstance(String(raw));
   if (instance === undefined) return undefined;
-  const catalog = ctx.databaseInstances ?? (await projectDatabaseInstances(ctx.sandbox, ctx.projectDir));
+  const catalog = await ctx.databaseInstances();
   return catalog.select(instance.name) === undefined ? undefined : instance.name;
 }
 

package/src/bridge/surface/rules-engines/storage-request-resource.ts

@@ -0,0 +1,275 @@
+/**
+ * The `request.resource` a Storage simulate case builds, by verb, as the live
+ * planes build it.
+ *
+ * - `create` (and the `write` umbrella) is an upload. An upload replaces the
+ *   object, so its `request.resource` carries only what the case sends, with
+ *   an upload's defaults for the rest. A stored object at the path is
+ *   `resource`, never a source of `request.resource` fields.
+ * - `update` is a metadata update: the stored object patched with the case's
+ *   fields. Production builds it whether or not the call changes anything, so
+ *   it is present when the case passes no `data`. With no stored object there
+ *   is nothing to update, and the live request carries none.
+ * - `get`, `list`, `delete` and the `read` umbrella carry none, so a case that
+ *   passes `data` with one is refused rather than evaluated against a binding
+ *   the live request would not have.
+ *
+ * Every field of `data` is checked against `StorageRequestResource`. An
+ * unknown or wrong-typed field is refused by name, because a default in its
+ * place would answer a different question than the one asked.
+ */
+import { requestResourceFor, type StoredMetadata } from 'pyric/storage/internal';
+import type { StorageReference, StorageRequest } from 'pyric/storage';
+
+type RequestResource = NonNullable<StorageRequest['resource']>;
+
+/** What a case's verb and data build: a binding, or why the case is refused. */
+export type RequestResourceOutcome =
+  | { ok: true; resource: RequestResource | undefined }
+  | { ok: false; reason: string };
+
+/** The fields a case's `data` can carry, in the order a refusal lists them. */
+const FIELDS = [
+  'name',
+  'bucket',
+  'size',
+  'contentType',
+  'contentDisposition',
+  'contentEncoding',
+  'contentLanguage',
+  'cacheControl',
+  'metadata',
+  'customMetadata',
+  'generation',
+  'metageneration',
+  'etag',
+] as const;
+
+type Field = (typeof FIELDS)[number];
+
+/** The content fields a case may set to `null`, which the binding then reads as `null`. */
+const NULLABLE_CONTENT = ['contentDisposition', 'contentEncoding', 'contentLanguage', 'cacheControl'] as const;
+
+/** A case's `data`, checked and typed. `null` means the binding reads the field as `null`. */
+interface CaseFields {
+  name?: string;
+  bucket?: string;
+  size?: number;
+  contentType?: string;
+  contentDisposition?: string | null;
+  contentEncoding?: string | null;
+  contentLanguage?: string | null;
+  cacheControl?: string | null;
+  metadata?: Record<string, string> | null;
+  generation?: number | null;
+  metageneration?: number | null;
+  etag?: null;
+}
+
+type Checked<T> = { ok: true; value: T } | { ok: false; reason: string };
+
+const NUMERIC = /^\d+$/;
+
+function refuse<T>(reason: string): Checked<T> {
+  return { ok: false, reason };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function typeName(value: unknown): string {
+  if (value === null) return 'null';
+  if (Array.isArray(value)) return 'an array';
+  return `a ${typeof value}`;
+}
+
+/**
+ * A count field: a whole number, or a numeric string as the Rules Test API
+ * tolerates. No object has a negative or fractional size or version.
+ */
+function countOf(field: string, value: unknown): Checked<number> {
+  if (typeof value === 'string' && NUMERIC.test(value)) return { ok: true, value: Number(value) };
+  if (typeof value !== 'number') {
+    return refuse(`data.${field} must be a number or a numeric string, and it is ${typeName(value)}.`);
+  }
+  const whole = Number.isSafeInteger(value) && value >= 0;
+  if (!whole) return refuse(`data.${field} must be a whole number of 0 or more, and it is ${value}.`);
+  return { ok: true, value };
+}
+
+function stringOf(field: string, value: unknown): Checked<string> {
+  if (typeof value === 'string') return { ok: true, value };
+  return refuse(`data.${field} must be a string, and it is ${typeName(value)}.`);
+}
+
+/** Custom metadata: a map of strings, or `null` for none. */
+function metadataOf(field: string, value: unknown): Checked<Record<string, string> | null> {
+  if (value === null) return { ok: true, value: null };
+  if (!isRecord(value)) return refuse(`data.${field} must be a map of strings, and it is ${typeName(value)}.`);
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof entry !== 'string') {
+      return refuse(`data.${field}.${key} must be a string, and it is ${typeName(entry)}.`);
+    }
+  }
+  return { ok: true, value: value as Record<string, string> };
+}
+
+function isField(key: string): key is Field {
+  return (FIELDS as readonly string[]).includes(key);
+}
+
+/** Check one field and write it onto `out`, or say why it is refused. */
+function checkField(out: CaseFields, field: Field, value: unknown): string | null {
+  const nullable = (NULLABLE_CONTENT as readonly string[]).includes(field);
+  if (nullable && value === null) {
+    out[field as (typeof NULLABLE_CONTENT)[number]] = null;
+    return null;
+  }
+  switch (field) {
+    case 'size': {
+      const checked = countOf(field, value);
+      if (!checked.ok) return checked.reason;
+      out.size = checked.value;
+      return null;
+    }
+    case 'generation':
+    case 'metageneration': {
+      if (value === null) {
+        out[field] = null;
+        return null;
+      }
+      const checked = countOf(field, value);
+      if (!checked.ok) return checked.reason;
+      out[field] = checked.value;
+      return null;
+    }
+    case 'metadata':
+    case 'customMetadata': {
+      if (out.metadata !== undefined) return 'Pass data.metadata or data.customMetadata, not both.';
+      const checked = metadataOf(field, value);
+      if (!checked.ok) return checked.reason;
+      out.metadata = checked.value;
+      return null;
+    }
+    case 'etag':
+      if (value !== null) return `data.etag can only be null, and it is ${typeName(value)}.`;
+      out.etag = null;
+      return null;
+    default: {
+      const checked = stringOf(field, value);
+      if (!checked.ok) return checked.reason;
+      out[field] = checked.value;
+      return null;
+    }
+  }
+}
+
+/** Check a case's `data` against the fields `request.resource` has. */
+function caseFieldsOf(data: unknown): Checked<CaseFields> {
+  if (data === undefined) return { ok: true, value: {} };
+  if (!isRecord(data)) return refuse(`data must be an object, and it is ${typeName(data)}.`);
+  const out: CaseFields = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (!isField(key)) {
+      return refuse(`data.${key} is not a field of request.resource. Its fields are ${FIELDS.join(', ')}.`);
+    }
+    const reason = checkField(out, key, value);
+    if (reason !== null) return refuse(reason);
+  }
+  return { ok: true, value: out };
+}
+
+/** Whether a verb writes, and which write builds its binding. */
+function writeOf(operation: string): 'upload' | 'metadataUpdate' | null {
+  if (operation === 'create' || operation === 'write') return 'upload';
+  if (operation === 'update') return 'metadataUpdate';
+  return null;
+}
+
+function presentOrUndefined<T>(value: T | null | undefined): T | undefined {
+  return value === null ? undefined : value;
+}
+
+/**
+ * The binding an upload builds from the case alone, with an upload's defaults.
+ * An empty `contentType` takes the default too, as a live upload's does.
+ */
+function uploadResource(object: StorageReference, fields: CaseFields): RequestResource {
+  return requestResourceFor(
+    {
+      fullPath: fields.name ?? object.fullPath,
+      bucket: fields.bucket ?? object.bucket,
+      size: fields.size ?? 0,
+      contentType: fields.contentType || 'application/octet-stream',
+      customMetadata: presentOrUndefined(fields.metadata),
+      cacheControl: presentOrUndefined(fields.cacheControl),
+      contentDisposition: presentOrUndefined(fields.contentDisposition),
+      contentEncoding: presentOrUndefined(fields.contentEncoding),
+      contentLanguage: presentOrUndefined(fields.contentLanguage),
+    },
+    'upload',
+  );
+}
+
+/** A field the case names wins; one it leaves out keeps the stored value. */
+function patched<T>(set: T | null | undefined, stored: T | undefined): T | undefined {
+  if (set === null) return undefined;
+  return set ?? stored;
+}
+
+/** The binding a metadata update builds: the stored object patched with the case. */
+function updateResource(fields: CaseFields, existing: StoredMetadata): RequestResource {
+  return requestResourceFor(
+    {
+      fullPath: fields.name ?? existing.fullPath,
+      bucket: fields.bucket ?? existing.bucket,
+      size: fields.size ?? existing.size,
+      contentType: fields.contentType ?? existing.contentType,
+      customMetadata: patched(fields.metadata, existing.customMetadata),
+      cacheControl: patched(fields.cacheControl, existing.cacheControl),
+      contentDisposition: patched(fields.contentDisposition, existing.contentDisposition),
+      contentEncoding: patched(fields.contentEncoding, existing.contentEncoding),
+      contentLanguage: patched(fields.contentLanguage, existing.contentLanguage),
+      generation: existing.generation,
+      metageneration: existing.metageneration,
+    },
+    'metadataUpdate',
+  );
+}
+
+/** Fields a case sets to `null` read as `null`, whatever the write's default. */
+function applyNulls(resource: RequestResource, fields: CaseFields): RequestResource {
+  for (const field of NULLABLE_CONTENT) {
+    if (fields[field] === null) resource[field] = null;
+  }
+  if (fields.metadata === null) resource.metadata = null;
+  if (fields.generation !== undefined) resource.generation = fields.generation;
+  if (fields.metageneration !== undefined) resource.metageneration = fields.metageneration;
+  if (fields.etag === null) resource.etag = null;
+  return resource;
+}
+
+/**
+ * The `request.resource` one simulate case builds for its verb, or why the
+ * case is refused.
+ */
+export function simulatedRequestResource(
+  object: StorageReference,
+  operation: string,
+  data: unknown,
+  existing: StoredMetadata | undefined,
+): RequestResourceOutcome {
+  const write = writeOf(operation);
+  if (write === null) {
+    if (data === undefined) return { ok: true, resource: undefined };
+    return { ok: false, reason: `a ${operation} request carries no request.resource; remove 'data'.` };
+  }
+  const fields = caseFieldsOf(data);
+  if (!fields.ok) return fields;
+  if (write === 'upload') return { ok: true, resource: applyNulls(uploadResource(object, fields.value), fields.value) };
+  // An update of an object that is not stored carries none, as the live
+  // metadata update builds none before it reports the object missing.
+  if (existing === undefined) return { ok: true, resource: undefined };
+  return { ok: true, resource: applyNulls(updateResource(fields.value, existing), fields.value) };
+}

package/src/bridge/surface/rules-engines/storage.ts

@@ -5,20 +5,23 @@ import {
   compileStorageRules,
   getStorageCrossServiceIam,
   getStorageService,
+  bindRulesBucket,
   replaceStorageRules,
-  requestResourceFor,
   resourceFromStored,
+  rulesBucketName,
+  targetOf,
   storageFirestoreLookup,
-  type StoredMetadata,
 } from 'pyric/storage/internal';
 import { asSentence } from 'pyric/sandbox/internal';
+import { lint as lintRules, type RuleIssue } from 'pyric/rules';
 import { describeCompileLimitViolations, sourceCompileLimitViolations } from 'pyric/rules/internal';
 import { operationFailure } from '../context.js';
 import { requestInstant } from '../request-instant.js';
 import { storageFor } from '../service-handles.js';
-import { activeStorageRules, rulesRequestPath } from '../storage-rules.js';
-import type { SurfaceContext } from '../types.js';
+import { activeStorageRules } from '../storage-rules.js';
+import type { OperationResult, SurfaceContext } from '../types.js';
 import { markLintFindings } from '../rules-verdict.js';
+import { simulatedRequestResource } from './storage-request-resource.js';
 import type { RulesEngine, RulesSourceProblem } from './types.js';
 
 /** What a call has to do when it named no source and the sandbox holds none. */
@@ -39,72 +42,6 @@ function identityFor(
   return { uid: held.uid, token: held.token ?? {} };
 }
 
-function requestResourceFromData(
-  object: StorageReference,
-  operation: string,
-  data: unknown,
-  existing: StoredMetadata | undefined,
-) {
-  if (data === undefined || typeof data !== 'object' || data === null || Array.isArray(data)) {
-    return undefined;
-  }
-  const raw = data as Record<string, unknown>;
-  const writeKind = operation === 'update' ? 'metadataUpdate' : 'upload';
-  const customMetadata =
-    raw.metadata !== undefined &&
-    typeof raw.metadata === 'object' &&
-    raw.metadata !== null &&
-    !Array.isArray(raw.metadata)
-      ? (raw.metadata as Record<string, string>)
-      : raw.customMetadata !== undefined &&
-          typeof raw.customMetadata === 'object' &&
-          raw.customMetadata !== null &&
-          !Array.isArray(raw.customMetadata)
-        ? (raw.customMetadata as Record<string, string>)
-        : existing?.customMetadata;
-  const base = requestResourceFor(
-    {
-      fullPath: typeof raw.name === 'string' ? raw.name : object.fullPath,
-      bucket: typeof raw.bucket === 'string' ? raw.bucket : object.bucket,
-      size: typeof raw.size === 'number' ? raw.size : (existing?.size ?? 0),
-      contentType:
-        typeof raw.contentType === 'string'
-          ? raw.contentType
-          : (existing?.contentType ?? 'application/octet-stream'),
-      customMetadata,
-      cacheControl: typeof raw.cacheControl === 'string' ? raw.cacheControl : existing?.cacheControl,
-      contentDisposition:
-        typeof raw.contentDisposition === 'string'
-          ? raw.contentDisposition
-          : existing?.contentDisposition,
-      contentEncoding:
-        typeof raw.contentEncoding === 'string' ? raw.contentEncoding : existing?.contentEncoding,
-      contentLanguage:
-        typeof raw.contentLanguage === 'string' ? raw.contentLanguage : existing?.contentLanguage,
-      generation:
-        typeof raw.generation === 'number' || typeof raw.generation === 'string'
-          ? String(raw.generation)
-          : existing?.generation,
-      metageneration:
-        typeof raw.metageneration === 'number' || typeof raw.metageneration === 'string'
-          ? String(raw.metageneration)
-          : existing?.metageneration,
-    },
-    writeKind,
-  );
-  if (raw.metadata === null || raw.customMetadata === null) base.metadata = null;
-  if (raw.contentDisposition === null) base.contentDisposition = null;
-  if (raw.contentEncoding === null) base.contentEncoding = null;
-  if (raw.contentLanguage === null) base.contentLanguage = null;
-  if (raw.cacheControl === null) base.cacheControl = null;
-  if (typeof raw.generation === 'number' || raw.generation === null) base.generation = raw.generation;
-  if (typeof raw.metageneration === 'number' || raw.metageneration === null) {
-    base.metageneration = raw.metageneration;
-  }
-  if (raw.etag === null) base.etag = null;
-  return base;
-}
-
 /**
  * Why `compileStorageRules` refused a source: production's compile rejections
  * when the source parses and breaks a compile limit, otherwise the failure it
@@ -125,6 +62,33 @@ function sourceProblem(source: string, error: unknown): RulesSourceProblem {
   };
 }
 
+/** One finding as a line: its code, where it is, and what it says. */
+function findingLine(issue: RuleIssue): string {
+  const where = issue.path === undefined ? '' : ` at ${issue.path}`;
+  return `${issue.code}${where}: ${issue.message}`;
+}
+
+/**
+ * A compiled source's lint result. An error-severity finding fails the lint,
+ * as a security hole or a construct production reads differently is a reason
+ * not to deploy; warnings alone pass, and are listed.
+ */
+function lintResult(issues: RuleIssue[]): OperationResult {
+  const errors = issues.filter((issue) => issue.severity === 'error');
+  const warnings = issues.filter((issue) => issue.severity !== 'error');
+  const warningNote =
+    warnings.length === 0 ? '' : ` Warnings: ${warnings.map((issue) => issue.code).join(', ')}.`;
+  const data = { errors: errors.map(findingLine), issues };
+  if (errors.length > 0) {
+    return markLintFindings({
+      ok: false,
+      summary: `Storage rules lint found ${errors.length} error(s). ${errors.map(findingLine).join(' ')}${warningNote}`,
+      data,
+    });
+  }
+  return { ok: true, summary: `Storage rules compiled with no lint errors.${warningNote}`, data };
+}
+
 export const STORAGE_RULES: RulesEngine = {
   requestMethods: ['get', 'list', 'create', 'update', 'delete', 'read', 'write'],
 
@@ -142,6 +106,9 @@ export const STORAGE_RULES: RulesEngine = {
     if (source === null) {
       return operationFailure(NO_RULES_LOADED);
     }
+    // The shared linter is what `lint()` from `pyric/rules` runs, so both
+    // report the same findings for one source.
+    const issues = lintRules(source);
     try {
       compileStorageRules(source);
     } catch (error) {
@@ -149,10 +116,10 @@ export const STORAGE_RULES: RulesEngine = {
       return markLintFindings({
         ok: false,
         summary: `${message} ${sourceProblem(source, error).fix}`,
-        data: { errors: [message] },
+        data: { errors: [message], issues },
       });
     }
-    return { ok: true, summary: 'Storage rules parsed with no errors.', data: { errors: [] } };
+    return lintResult(issues);
   },
 
   async simulate(ctx, request) {
@@ -173,23 +140,29 @@ export const STORAGE_RULES: RulesEngine = {
     const existing = object.fullPath
       ? await service.backend.getMetadata(object.fullPath, object.bucket)
       : undefined;
-    const requestResource = requestResourceFromData(
-      object,
-      request.operation,
-      request.data,
-      existing,
-    );
-    const evaluated = evaluateStorageRules(
-      parsed,
+    const built = simulatedRequestResource(object, request.operation, request.data, existing);
+    if (!built.ok) {
+      return operationFailure(`${request.operation} ${request.path}: ${built.reason}`);
+    }
+    const requestResource = built.resource;
+    // Rules see the bucket under the name the app knows it by, as the live
+    // planes bind it (ST-H2-4).
+    const input = bindRulesBucket(
       {
         request: {
           auth: identityFor(ctx, request.uid),
           method: request.operation as StorageRequestMethod,
-          path: rulesRequestPath(object),
+          path: object.fullPath,
           ...(requestResource !== undefined ? { resource: requestResource } : {}),
         },
         resource: resourceFromStored(existing),
       },
+      object.bucket,
+      rulesBucketName(object.bucket, targetOf(object.storage).bucketName),
+    );
+    const evaluated = evaluateStorageRules(
+      parsed,
+      input,
       new Date(requestInstant(ctx, request.requestTime)),
       // A rule reaching into Firestore is answered here the way the
       // enforcement path answers it, under the posture the sandbox is in, so a