@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/src/serve/worker/host-auth.ts

@@ -40,12 +40,13 @@ import {
   remintSessionWithClaims,
   applyProfileToUser,
   resolveOAuthCredentialUser,
-  type OAuthCredentialPayload,
 } from './host/auth-session-seeder.js';
-import { withoutJwtClaims } from 'pyric/sandbox/internal';
+import { signInWithCredentialPayload, type CredentialPayload } from './host/auth-credential-sign-in.js';
+import { rulesTokenFromIdToken } from 'pyric/sandbox/internal';
 
 import { linkSessionProvider } from './host/auth-linking.js';
 import { reauthenticateSession } from './host/auth-reauthentication.js';
+import { createStagedSignInResults, type StagedSignInResults } from './host/staged-sign-in-results.js';
 
 // ─── Auth: per-port sessions + port-scoped fan-out ────────────────────────
 
@@ -71,6 +72,18 @@ export function authSubsFor(ctx: HostCtx): Map<PortLike, Map<string, 'authState'
   return m;
 }
 
+const _stagedSignInResults = new WeakMap<HostCtx, StagedSignInResults>();
+
+/** The sign-in results each of this host's ports staged (`auth.mockSignInResult`). */
+export function stagedSignInResultsFor(ctx: HostCtx): StagedSignInResults {
+  let staged = _stagedSignInResults.get(ctx);
+  if (!staged) {
+    staged = createStagedSignInResults();
+    _stagedSignInResults.set(ctx, staged);
+  }
+  return staged;
+}
+
 function portTenantsFor(ctx: HostCtx): Map<PortLike, string | null> {
   let m = _portTenants.get(ctx);
   if (!m) {
@@ -231,9 +244,9 @@ function refreshPortAuthorization(
   session: MintedSession,
   claims: Record<string, unknown>,
 ): void {
-  // Rules read the token's claim set without the JWT registered claims, as
-  // the in-process session does.
-  session.state.token = withoutJwtClaims(claims);
+  // Rules read the token's full claim set, JWT registered claims included,
+  // as the in-process session does.
+  session.state.token = rulesTokenFromIdToken(claims);
 
   // Frozen sandbox.withAuth handles capture the old token. Clear all
   // session-handle caches so this port and any same-uid sibling rebuild from
@@ -257,6 +270,7 @@ export function cleanupPortSession(ctx: HostCtx, port: PortLike): void {
   ctx.portSessions?.delete(port);
   portTenantsFor(ctx).delete(port);
   _lastAuthStateUid.delete(port);
+  stagedSignInResultsFor(ctx).clear(port);
 }
 
 // ─── Auth op handlers ─────────────────────────────────────────────────────
@@ -533,24 +547,20 @@ export async function handleAuthOp(ctx: HostCtx, port: PortLike, msg: OpMessage)
         const rawMsg: Record<string, unknown> = msg;
         const hasProvider = typeof rawMsg.providerId === 'string';
         const cred = (msg.credential ?? (hasProvider ? rawMsg : undefined)) as
-          | OAuthCredentialPayload
+          | CredentialPayload
           | undefined;
         const hasNoCredential = cred === undefined || !cred.providerId;
         if (hasNoCredential) {
           throw new Error('auth.signInWithCredential requires credential payload or providerId');
         }
         const tenantId = resolveSignInTenant(ctx, port, msg.tenantId);
-        const { uid, isNewUser } = resolveOAuthCredentialUser(auth, cred);
-        const session = authSandboxOps.mintSession(auth, {
-          kind: 'provider',
-          uid,
-          providerId: cred.providerId,
-          tenantId,
-          ...portOriginScope(port),
-        });
+        const takeStaged = (providerId: string) => stagedSignInResultsFor(ctx).take(port, providerId);
+        const { session, providerId, isNewUser } = signInWithCredentialPayload(auth, cred, {
+          tenantId, ...portOriginScope(port),
+        }, takeStaged);
         setPortSession(ctx, port, session);
         await bestEffortFlush(ctx, msg.method);
-        ok(port, msg.id, credReply(session, cred.providerId, isNewUser));
+        ok(port, msg.id, credReply(session, providerId, isNewUser));
       } catch (e) { fail(port, msg.id, e); }
       break;
     }
@@ -572,6 +582,14 @@ export async function handleAuthOp(ctx: HostCtx, port: PortLike, msg: OpMessage)
       break;
     }
 
+    case 'auth.mockSignInResult': {
+      try {
+        stagedSignInResultsFor(ctx).stage(port, msg.identity);
+        ok(port, msg.id, null);
+      } catch (e) { fail(port, msg.id, e); }
+      break;
+    }
+
     case 'auth.listUsers': {
       try {
         ok(port, msg.id, authSandboxOps.listUsers(auth));

package/src/serve/worker/inbound-validation/operation-arguments.ts

@@ -7,6 +7,7 @@ import { assertQueryStructure } from '../host/query-structure.js';
 import { isMessageRecord, requireShape, requireRecord, requireString, requireOptionalString,
   requireOptionalBoolean, requireOptionalRecord, requireNumber, requireOptionalNumber } from './fields.js';
 import { assertRtdbQuery } from './rtdb-query.js';
+import { updateValuesShapeError } from '../client/rtdb-value-validation.js';
 export { isMessageRecord } from './fields.js';
 
 function assertRequiredPath(message: Record<string, unknown>): void {
@@ -26,6 +27,19 @@ function assertRequiredPath(message: Record<string, unknown>): void {
   }
 }
 
+/** The `ResolvedIdentity` the picker hands over and a served test stages. */
+function requireResolvedIdentity(identity: unknown): void {
+  requireRecord(identity, 'identity');
+  requireString(identity.uid, 'identity.uid');
+  requireString(identity.providerId, 'identity.providerId');
+  for (const field of ['email', 'displayName', 'photoURL']) {
+    const value = identity[field];
+    const isNullableString = value === undefined || value === null || typeof value === 'string';
+    requireShape(isNullableString, `identity.${field}`);
+  }
+  requireOptionalRecord(identity.customClaims, 'identity.customClaims');
+}
+
 function assertSharedAuthFields(message: Record<string, unknown>): void {
   const method = message.method;
   const isAuthMethod = typeof method === 'string' && method.startsWith('auth.');
@@ -143,8 +157,10 @@ export function assertOperationArguments(message: Record<string, unknown>): void
     case 'rtdb.update':
     case 'rtdb.onDisconnectUpdate': {
       const hasValues = isMessageRecord(message.values);
-      requireShape(hasValues, 'values');
-      return;
+      if (hasValues) return;
+      // The served client refuses this first; the host keeps the SDK's text as its second line.
+      const fnName = message.method === 'rtdb.update' ? 'update' : 'OnDisconnect.update';
+      throw new FirebaseError('invalid-argument', updateValuesShapeError(fnName).message);
     }
     case 'rtdb.push': {
       const hasValidKey = message.key === undefined || typeof message.key === 'string';
@@ -373,21 +389,18 @@ export function assertOperationArguments(message: Record<string, unknown>): void
         const isNullableString = value === undefined || value === null || typeof value === 'string';
         requireShape(isNullableString, `credential.${field}`);
       }
-      return;
-    }
-    case 'auth.acceptIdentity': {
-      const identity = message.identity;
-      requireRecord(identity, 'identity');
-      requireString(identity.uid, 'identity.uid');
-      requireString(identity.providerId, 'identity.providerId');
-      for (const field of ['email', 'displayName', 'photoURL']) {
-        const value = identity[field];
-        const isNullableString = value === undefined || value === null || typeof value === 'string';
-        requireShape(isNullableString, `identity.${field}`);
+      // An email credential's method and secret; the engine decides a missing one.
+      for (const field of ['signInMethod', 'password']) {
+        const value = credential[field];
+        const isOptionalString = value === undefined || typeof value === 'string';
+        requireShape(isOptionalString, `credential.${field}`);
       }
-      requireOptionalRecord(identity.customClaims, 'identity.customClaims');
       return;
     }
+    case 'auth.acceptIdentity':
+    case 'auth.mockSignInResult':
+      requireResolvedIdentity(message.identity);
+      return;
     case 'auth.adminCreateUser':
       requireRecord(message.request, 'request');
       return;

package/src/serve/worker/operation-persistence.ts

@@ -73,6 +73,7 @@ export const operationPersistence = {
   'auth.confirmPasswordReset': true,
   'auth.restorePortSession': false,
   'auth.acceptIdentity': true,
+  'auth.mockSignInResult': false,
   'auth.listUsers': false,
   'auth.adminCreateUser': true,
   'auth.adminUpdateUser': true,

package/src/serve/worker/protocol.ts

@@ -204,7 +204,8 @@ export type OpMessage = (
       t: 'op';
       id: string;
       method: 'auth.signInWithCredential';
-      credential?: {
+      /** An email credential carries its secret (`toJSON()`), which the host verifies with the engine. */
+      credential?: SerializedAuthCredential | {
         providerId: string;
         idToken?: string | null;
         accessToken?: string | null;
@@ -215,6 +216,8 @@ export type OpMessage = (
         uid?: string | null;
       };
       providerId?: string;
+      signInMethod?: string;
+      password?: string;
       idToken?: string | null;
       accessToken?: string | null;
       rawNonce?: string | null;
@@ -244,6 +247,9 @@ export type OpMessage = (
   | { t: 'op'; id: string; method: 'auth.confirmPasswordReset'; code: string; newPassword: string }
   | { t: 'op'; id: string; method: 'auth.restorePortSession'; uid: string; tenantId?: string | null }
   | { t: 'op'; id: string; method: 'auth.acceptIdentity'; identity: ResolvedIdentity; tenantId?: string | null }
+  // Stage the identity the port's next federated `signInWithCredential` for
+  // `identity.providerId` signs in as (served `sandbox.mockSignInResult`).
+  | { t: 'op'; id: string; method: 'auth.mockSignInResult'; identity: ResolvedIdentity }
   | { t: 'op'; id: string; method: 'auth.listUsers' }
   | { t: 'op'; id: string; method: 'auth.adminCreateUser'; request: Record<string, unknown> }
   | { t: 'op'; id: string; method: 'auth.adminUpdateUser'; uid: string; request: Record<string, unknown> }

package/src/serve/worker/rtdb-value-equality.ts

@@ -2,9 +2,11 @@
 export function sameRtdbValue(left: unknown, right: unknown): boolean {
   if (Object.is(left, right)) return true;
   if (Array.isArray(left) || Array.isArray(right)) {
+    // A hole and a `null` are the same RTDB value: the hosted transport's JSON
+    // writes a sparse array's holes as `null` (RT-6, #1371).
     return Array.isArray(left) && Array.isArray(right)
       && left.length === right.length
-      && left.every((value, index) => sameRtdbValue(value, right[index]));
+      && Array.from(left, (value, index) => sameRtdbValue(value ?? null, right[index] ?? null)).every(Boolean);
   }
   if (!left || !right || typeof left !== 'object' || typeof right !== 'object') return false;
   const leftRecord = left as Record<string, unknown>;

package/src/serve/worker/serve-init.ts

@@ -31,7 +31,7 @@ import { SERVE_HISTORY_LIMITS } from '../observation-limits.js';
 
 import { getFirestore } from 'pyric/firestore';
 import { seedDocuments, setRules, snapshotDocuments } from 'pyric/sandbox/firestore';
-import { parseToASTOrError, rulesSourceRejection } from 'pyric/rules/internal';
+import { rulesSourceRejection } from 'pyric/rules/internal';
 import { rtdbRulesSourceRejection } from 'pyric/rules/internal/rtdb';
 import { getDatabase, sandbox as rtdbSandbox } from 'pyric/database';
 import { getAuth, sandbox as authOps, type SeedUser } from 'pyric/auth';
@@ -270,14 +270,8 @@ export function applyServeInit(
   //    rules, surface loudly.
   if (payload.rules) {
     const rejection = rulesSourceRejection(payload.rules);
-    const parsed = rejection === null ? parseToASTOrError(payload.rules) : null;
-    const wrongService = parsed !== null && parsed.ok && parsed.ast.service && parsed.ast.service.name !== 'cloud.firestore'
-      ? parsed.ast.service
-      : null;
-    if (rejection !== null || wrongService !== null) {
-      result.rulesParseError = wrongService !== null
-        ? `Firestore rules did not compile: Expected 'service cloud.firestore', got 'service ${wrongService.name}'.`
-        : `Firestore ${rejection!.message}`;
+    if (rejection !== null) {
+      result.rulesParseError = `Firestore ${rejection.message}`;
       console.error(
         '[pyric worker] firestore.rules not loaded, running WITHOUT your rules:',
         result.rulesParseError,

package/src/serve/worker-build-lock.ts

@@ -0,0 +1,207 @@
+/**
+ * A lock directory that lets one process at a time build into a shared
+ * SharedWorker cache directory (see `worker-bundle-cache.ts`).
+ *
+ * The holder writes `owner.json` (pid, host, token) and refreshes the lock
+ * directory's mtime every `heartbeatMs` while it holds the lock. A waiter
+ * takes the lock over when:
+ * - its owner is on this host and that pid has exited, or
+ * - its mtime has not moved for `staleMs`: a crashed holder on another host,
+ *   a holder that died between creating the directory and writing
+ *   `owner.json`, or one whose event loop stalled past `staleMs`.
+ *
+ * The pid check is a fast path, not a guarantee. A reused pid looks alive, so
+ * that lock waits for `staleMs`. A process in another pid namespace (a
+ * container sharing the home directory) reports the same host name but a pid
+ * this process cannot see, so the owner also records its pid namespace, and
+ * the pid check runs only for an owner in this one. A lock from another pid
+ * namespace, or from the Windows side of a WSL share, which records none, is
+ * taken over only once it goes stale. Should a lock still be taken from a
+ * live builder, that builder does not publish (`isHeld()`) and retries.
+ *
+ * `waitMs` is longer than `staleMs` on purpose: a waiter outlasts any lock
+ * whose holder stopped refreshing it, so the wait limit fires only when a
+ * live holder keeps its lock for longer than `waitMs`.
+ */
+import { randomBytes } from 'node:crypto';
+import { mkdirSync, readFileSync, readlinkSync, renameSync, rmSync, statSync, utimesSync, writeFileSync } from 'node:fs';
+import { hostname } from 'node:os';
+import { join } from 'node:path';
+
+export const LOCK_DIR = '.worker-build.lock';
+export const ABANDONED_LOCK_PREFIX = `${LOCK_DIR}.abandoned-`;
+const LOCK_OWNER_FILE = 'owner.json';
+
+export interface WorkerBuildLockOptions {
+  /** A lock whose mtime has not moved for this long is abandoned. */
+  staleMs?: number;
+  /** How often the holder refreshes the lock's mtime. */
+  heartbeatMs?: number;
+  /** How long to wait for another builder before failing. */
+  waitMs?: number;
+  pollMs?: number;
+  /** Test seam for the rename that moves an abandoned lock aside. */
+  renameLock?: (from: string, to: string) => void;
+}
+
+/** What the work running under the lock can ask of it. */
+export interface WorkerBuildLock {
+  /** False once another process has taken the lock over as abandoned. */
+  isHeld(): boolean;
+}
+
+interface LockOwner {
+  pid: number;
+  host: string;
+  /** `/proc/self/ns/pid` where there is one; the pid means nothing outside it. */
+  pidNamespace?: string;
+  token: string;
+}
+
+/** A lock, or a staging directory, untouched for this long belongs to a builder that is gone. */
+export const WORKER_BUILD_STALE_MS = 60_000;
+const DEFAULT_STALE_MS = WORKER_BUILD_STALE_MS;
+const DEFAULT_HEARTBEAT_MS = 10_000;
+const DEFAULT_WAIT_MS = 150_000;
+const DEFAULT_POLL_MS = 50;
+
+/** Run `work` while holding the build lock of `outDir`. */
+export async function withWorkerBuildLock<T>(
+  outDir: string,
+  work: (lock: WorkerBuildLock) => Promise<T>,
+  options: WorkerBuildLockOptions = {},
+): Promise<T> {
+  mkdirSync(outDir, { recursive: true });
+  const lockDir = join(outDir, LOCK_DIR);
+  const owner = await acquire(lockDir, options);
+  const heartbeat = startHeartbeat(lockDir, owner.token, options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS);
+  try {
+    return await work({ isHeld: () => isOwnedBy(lockDir, owner.token) });
+  } finally {
+    clearInterval(heartbeat);
+    release(lockDir, owner.token);
+  }
+}
+
+async function acquire(lockDir: string, options: WorkerBuildLockOptions): Promise<LockOwner> {
+  const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+  const waitMs = options.waitMs ?? DEFAULT_WAIT_MS;
+  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;
+  const owner: LockOwner = { pid: process.pid, host: hostname(), pidNamespace: PID_NAMESPACE, token: randomBytes(8).toString('hex') };
+  const deadline = Date.now() + waitMs;
+  for (;;) {
+    if (tryCreate(lockDir, owner)) return owner;
+    const brokeAbandonedLock = isAbandoned(lockDir, staleMs) && breakLock(lockDir, options.renameLock ?? renameSync);
+    if (brokeAbandonedLock) continue;
+    const hasWaitedTooLong = Date.now() >= deadline;
+    if (hasWaitedTooLong) {
+      throw new Error(
+        `pyric sandbox: waited ${Math.round(waitMs / 1000)}s for another process to build the SharedWorker bundle; remove ${lockDir} if no pyric process is running.`,
+      );
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+}
+
+function tryCreate(lockDir: string, owner: LockOwner): boolean {
+  try {
+    mkdirSync(lockDir);
+  } catch (error) {
+    const isHeld = (error as NodeJS.ErrnoException).code === 'EEXIST';
+    if (isHeld) return false;
+    throw error;
+  }
+  try {
+    writeFileSync(join(lockDir, LOCK_OWNER_FILE), JSON.stringify(owner));
+  } catch (error) {
+    rmSync(lockDir, { recursive: true, force: true });
+    throw error;
+  }
+  return true;
+}
+
+function readOwner(lockDir: string): LockOwner | null {
+  try {
+    return JSON.parse(readFileSync(join(lockDir, LOCK_OWNER_FILE), 'utf8')) as LockOwner;
+  } catch {
+    return null;
+  }
+}
+
+function isOwnedBy(lockDir: string, token: string): boolean {
+  return readOwner(lockDir)?.token === token;
+}
+
+/** This process's pid namespace on Linux; undefined where there is no `/proc`, as on macOS. */
+function readPidNamespace(): string | undefined {
+  try {
+    return readlinkSync('/proc/self/ns/pid');
+  } catch {
+    return undefined;
+  }
+}
+
+const PID_NAMESPACE = readPidNamespace();
+
+function isProcessAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+function isAbandoned(lockDir: string, staleMs: number): boolean {
+  const owner = readOwner(lockDir);
+  const seesOwnerPid = owner !== null && owner.host === hostname() && owner.pidNamespace === PID_NAMESPACE;
+  if (seesOwnerPid && !isProcessAlive(owner.pid)) return true;
+  try {
+    return Date.now() - statSync(lockDir).mtimeMs > staleMs;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Move an abandoned lock aside, then remove it, so two breakers never both
+ * delete. Returns whether this call moved it. A lock that is already gone
+ * returns false, and the caller waits a poll before trying again. Any other
+ * failure (a cache directory this user cannot write) cannot be waited out.
+ */
+function breakLock(lockDir: string, rename: (from: string, to: string) => void): boolean {
+  const aside = `${lockDir}.abandoned-${randomBytes(4).toString('hex')}`;
+  try {
+    rename(lockDir, aside);
+  } catch (error) {
+    const isAlreadyGone = (error as NodeJS.ErrnoException).code === 'ENOENT';
+    if (isAlreadyGone) return false;
+    throw new Error(`pyric sandbox: cannot remove the abandoned SharedWorker build lock ${lockDir}: ${String(error)}`);
+  }
+  rmSync(aside, { recursive: true, force: true });
+  return true;
+}
+
+function startHeartbeat(lockDir: string, token: string, heartbeatMs: number): ReturnType<typeof setInterval> {
+  const timer = setInterval(() => {
+    if (!isOwnedBy(lockDir, token)) return;
+    const now = new Date();
+    try {
+      utimesSync(lockDir, now, now);
+    } catch {
+      // The lock was taken over; isHeld() reports it.
+    }
+  }, heartbeatMs);
+  timer.unref?.();
+  return timer;
+}
+
+/** Remove the lock if it is still ours. A failure here never hides a finished build. */
+function release(lockDir: string, token: string): void {
+  if (!isOwnedBy(lockDir, token)) return;
+  try {
+    rmSync(lockDir, { recursive: true, force: true });
+  } catch {
+    // Left behind, it is taken over once its pid has exited or it goes stale.
+  }
+}

package/src/serve/worker-bundle-cache.ts

@@ -0,0 +1,90 @@
+/**
+ * The on-disk cache of the SharedWorker bundle, safe to share between processes.
+ *
+ * The Vite plugin caches the worker under `~/.pyric/vite-worker/<hash>`, one
+ * directory for every project, worktree and test run on the machine that has
+ * the same CLI source. Builders used to write `worker.js`, its epoch and its
+ * marker in place, so two builders in one directory read each other's
+ * half-written output: one failed with "omitted its epoch placeholder", and
+ * another returned an epoch that matched no `worker.js` on disk (#1214).
+ *
+ * Three rules keep a shared directory consistent:
+ * - one builder at a time, under the lock in `worker-build-lock.ts`;
+ * - each build writes into a private staging directory, then renames its
+ *   files into place;
+ * - a reader trusts the cache only when `worker.js` carries the epoch the
+ *   epoch file names, so any torn pair reads as a miss and is rebuilt.
+ *
+ * The last rule is what keeps readers consistent. The marker only records
+ * which source hash the bundle was built from; removing it before a publish
+ * and writing it last narrows the window in which it names a half-published
+ * bundle, but a reader does not rely on that.
+ */
+import { existsSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+
+import { ABANDONED_LOCK_PREFIX, WORKER_BUILD_STALE_MS } from './worker-build-lock.js';
+
+export const WORKER_FILE = 'worker.js';
+export const WORKER_EPOCH_FILE = '.worker-epoch';
+const WORKER_MARKER_FILE = '.worker-complete';
+const WORKER_MAP_FILE = 'worker.js.map';
+const EPOCH_PATTERN = /^[a-f0-9]{16}$/;
+
+/** The epoch of a complete, self-consistent bundle for `hash`, or null. */
+export function readCompletedWorkerBundle(outDir: string, hash: string): string | null {
+  try {
+    const hasMatchingMarker = readFileSync(join(outDir, WORKER_MARKER_FILE), 'utf8') === hash;
+    if (!hasMatchingMarker) return null;
+    const epoch = readFileSync(join(outDir, WORKER_EPOCH_FILE), 'utf8').trim();
+    const hasValidEpoch = EPOCH_PATTERN.test(epoch);
+    if (!hasValidEpoch) return null;
+    const workerCarriesEpoch = readFileSync(join(outDir, WORKER_FILE), 'utf8').includes(epoch);
+    return workerCarriesEpoch ? epoch : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The prefix of the staging directories builds of `outDir` use, beside it. */
+function stagingPrefix(outDir: string): string {
+  return `.${basename(outDir)}.worker-`;
+}
+
+/** Where a build of `outDir` writes before it publishes: a sibling, so sourcemap paths stay correct. */
+export function stagingPathPrefix(outDir: string): string {
+  return join(dirname(outDir), stagingPrefix(outDir));
+}
+
+/**
+ * Remove what earlier builders left when they were killed: staging
+ * directories beside `outDir` and abandoned locks inside it. Only the lock
+ * holder calls this. A staging directory is removed only once it is older
+ * than the stale time: a builder whose lock was taken while it still runs (a
+ * process in another pid namespace looks exited) may still be writing to one.
+ */
+export function removeBuildLeftovers(outDir: string): void {
+  const parent = dirname(outDir);
+  const staged = readdirSync(parent).filter((name) => name.startsWith(stagingPrefix(outDir)));
+  for (const name of staged) {
+    const path = join(parent, name);
+    if (isOlderThan(path, WORKER_BUILD_STALE_MS)) rmSync(path, { recursive: true, force: true });
+  }
+  const abandoned = readdirSync(outDir).filter((name) => name.startsWith(ABANDONED_LOCK_PREFIX));
+  for (const name of abandoned) rmSync(join(outDir, name), { recursive: true, force: true });
+}
+
+function isOlderThan(path: string, ms: number): boolean {
+  const stats = statSync(path, { throwIfNoEntry: false });
+  return stats !== undefined && Date.now() - stats.mtimeMs > ms;
+}
+
+/** Move a finished build into `outDir`. Each rename replaces one file whole. */
+export function publishWorkerBundle(stagingDir: string, outDir: string, hash: string): void {
+  rmSync(join(outDir, WORKER_MARKER_FILE), { force: true });
+  writeFileSync(join(stagingDir, WORKER_MARKER_FILE), hash);
+  for (const name of [WORKER_FILE, WORKER_MAP_FILE, WORKER_EPOCH_FILE, WORKER_MARKER_FILE]) {
+    const staged = join(stagingDir, name);
+    if (existsSync(staged)) renameSync(staged, join(outDir, name));
+  }
+}

package/src/verify/cases.ts

@@ -163,9 +163,12 @@ function buildTestCase(
     requestTime: new Date(event.at).toISOString(),
   };
 
-  if (event.resourceBefore?.exists && event.resourceBefore.data !== null) {
-    testCase.resource = event.resourceBefore.data;
-  }
+  // A create's rules see no existing resource, as the simulator and the
+  // bridge bind it, even when the recorded create hit an existing document.
+  // The Rules Test API would bind one, so a case carrying it is refused.
+  const existing = event.resourceBefore?.exists ? event.resourceBefore.data : null;
+  const bindsExisting = existing !== null && method !== 'create';
+  if (bindsExisting) testCase.resource = existing;
 
   if (isWriteMethod(method)) {
     if (method !== 'delete') {

package/src/verify/index.ts

@@ -8,6 +8,7 @@ import {
 } from 'pyric/sandbox';
 import { evaluateStorageRules, type StorageRequestMethod } from 'pyric/storage';
 import {
+  bindRulesBucket,
   compileStorageRules,
   DEFAULT_BUCKET,
   requestResourceFor,
@@ -858,18 +859,23 @@ async function verifyStorage(
           );
     }
 
-    const rulesPath = objectPath === '' ? `b/${bucket}/o` : `b/${bucket}/o/${objectPath}`;
-    const evaluated = evaluateStorageRules(
-      compiled.rules,
+    // The rules saw the bucket under the name the live op recorded (ST-H2-4).
+    const input = bindRulesBucket(
       {
         request: {
           auth: opEvent.auth ?? null,
           method: opEvent.method as StorageRequestMethod,
-          path: rulesPath,
+          path: objectPath,
           ...(requestResource !== undefined ? { resource: requestResource } : {}),
         },
         resource: resourceFromStored(existing),
       },
+      bucket,
+      recordedBucketName(opEvent, bucket),
+    );
+    const evaluated = evaluateStorageRules(
+      compiled.rules,
+      input,
       typeof opEvent.at === 'number' && Number.isFinite(opEvent.at)
         ? new Date(opEvent.at)
         : new Date(),
@@ -929,6 +935,12 @@ function storageOperationBucket(opEvent: SandboxOperationEvent): string | undefi
   return undefined;
 }
 
+/** The bucket name the live op's rules saw, as its event recorded it; the store key for an event from before it was recorded. */
+function recordedBucketName(opEvent: SandboxOperationEvent, bucket: string): string {
+  const named = (opEvent.detail as { bucketName?: unknown } | undefined)?.bucketName;
+  return typeof named === 'string' && named !== '' ? named : bucket;
+}
+
 function resolveStorageOperationBucket(
   opEvent: SandboxOperationEvent,
   pairedMutation: ServiceMutationEvent | undefined,

package/dist/functions-rtdb/child.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"child.d.ts","sourceRoot":"","sources":["../../src/functions-rtdb/child.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAuB9D,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,WAAW,CAAC;CACrB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,4BAA4B,CAAC;CACrC,GACD;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,4BAA4B,CAAC;CACrC,CAAC;AAEN,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,2BAA2B,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACxC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAyBD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAKtE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAQ5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAAC,UAAU,CAyB3F;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,8BAA8B,GACtC,wBAAwB,CAgG1B"}