@pyric/cli 0.1.0-alpha.9

package/dist/serve/docs-ui/docs/pyric-database-reference-rules-tooling.md

@@ -0,0 +1,303 @@
+# RTDB rules tooling
+
+The RTDB constraints DSL (`defineRtdbRules` and the combinators) is public,
+re-exported directly from `pyric/rules`. The engine underneath it (expression
+parser, validator, linter, compile/simulate/serialize, and replay) is
+engine-internal, on the `pyric/rules/internal/rtdb` subpath. That subpath isn't
+covered by the public `pyric/rules` contract and may change without notice.
+
+```ts
+import { defineRtdbRules, rtdbRules } from 'pyric/rules';
+import {
+  compileRtdbRules,
+  simulateRtdbRules,
+  serializeRtdbRules,
+  replay,
+  parseExpression,
+} from 'pyric/rules/internal/rtdb';
+```
+
+## Constraints authoring
+
+### `defineRtdbRules(definition): RtdbRulesDocument`
+
+Create an in-memory RTDB rules document from path constraints.
+
+```ts
+import { defineRtdbRules, deny, pathOwnerOnly } from 'pyric/rules';
+
+const rules = defineRtdbRules({
+  paths: {
+    '/': { read: deny(), write: deny() },
+    '/profiles/$uid': {
+      read: pathOwnerOnly('$uid'),
+      write: pathOwnerOnly('$uid'),
+    },
+  },
+});
+```
+
+`definition`:
+
+```ts
+type RtdbRulesDefinition = {
+  paths: Record<string, PathDef> | ((ctx: RulesetContext) => void);
+};
+```
+
+There is no `databaseUrl` on the definition. Compilation is
+environment-independent; the database URL is a Firebase project concern when
+you ship with `firebase-tools`, not part of the authored artifact.
+
+### `RtdbRulesDocument`
+
+The value `defineRtdbRules` returns. On the public surface it is an inert
+authored artifact: the type exposes no methods. You hand it to `rtdbRules()`,
+which is the one analysis surface.
+
+```ts
+import { rtdbRules } from 'pyric/rules';
+
+const ruleset = rtdbRules(rules);
+
+const issues = ruleset.lint();   // RuleIssue[]
+const summary = ruleset.simulate([
+  {
+    description: 'owner reads their profile',
+    expectation: 'ALLOW',
+    operation: 'read',
+    path: '/profiles/alice',
+    auth: 'alice',
+  },
+]);
+const json = ruleset.toJSON();   // { rules: {...} }
+```
+
+`lint()` folds the document's parser and linter findings into one
+`RuleIssue[]` list; a compile failure arrives as a `COMPILE_ERROR` issue
+rather than a throw. `simulate(cases)` takes `RtdbCase[]` and returns
+`{ passed, failed, unsupported, cases }`. `toJSON()` compiles to Firebase
+RTDB rules JSON.
+
+The method-bearing document interface (`toJSON` / `compile` / `check` /
+`simulate` on the document itself) is internal. Engine consumers reach it via
+`pyric/rules/internal/rtdb`, which exports it under the same
+`RtdbRulesDocument` name; it is not covered by the public contract.
+
+`RtdbRulesSimulationInput` is the input shape of the internal document
+`simulate` method (the public `rtdbRules().simulate` takes `RtdbCase[]`
+instead). It accepts the existing simulation fields plus these authoring
+conveniences:
+
+```ts
+type RtdbRulesSimulationInput = {
+  operation: 'read' | 'write' | 'validate';
+  path: string;
+  auth?: string | { uid: string; token?: Record<string, unknown> } | null;
+  data?: Record<string, unknown>;
+  mockData?: Record<string, unknown>;
+  newData?: unknown;
+};
+```
+
+`auth: 'alice'` becomes `{ uid: 'alice', token: {} }`. `data` is an alias for
+`mockData`; if both are supplied, `mockData` is used.
+
+`RtdbRulesCheckResult`:
+
+```ts
+type RtdbRulesCheckResult = {
+  ok: boolean;
+  errors: RtdbRulesFinding[];
+  warnings: RtdbRulesFinding[];
+};
+```
+
+Compile failures return an error finding with code `COMPILE_ERROR`.
+
+### Generating `database.rules.json`
+
+`rtdbRules(rules).toJSON()` compiles a constraints document to the exact
+`{ rules: {...} }` shape Firebase expects in `database.rules.json`. Everything
+that writes the file — the CLI, the MCP library tool, and this helper — runs
+the same compilation and never recompiles the rules a second time.
+
+For scripts running in Node, `pyric/rules/internal/node` exports a helper that
+writes the file directly:
+
+```ts
+import { writeRtdbRulesFile } from 'pyric/rules/internal/node';
+import { rules } from './database.rules.js';
+
+const path = await writeRtdbRulesFile(rules, 'database.rules.json');
+```
+
+#### `writeRtdbRulesFile(doc, path): Promise<string>`
+
+Compiles `doc` and writes the rules JSON as pretty-printed output to `path`,
+creating parent directories as needed, and returns the resolved absolute path
+written. It is Node-only (imports `node:fs`), so it lives on the internal
+`pyric/rules/internal/node` entry rather than alongside the compilation
+itself: `rtdbRules(rules).toJSON()`, from the public `pyric/rules`, never
+pulls in Node builtins.
+
+#### CLI
+
+```sh
+pyric database rules generate [--config <path>] [--out <path>]
+```
+
+Loads a constraints module (default `database.rules.ts`, or the `--config`
+path), looks for a named `rules` export or a default export produced by
+`defineRtdbRules(...)`, compiles it to rules JSON, and writes it to `--out`
+(default: the `database.rules` path from `firebase.json`, or
+`database.rules.json`). This is a local artifact step only — inspect, diff,
+and commit the file, then ship with `firebase-tools` / Console.
+
+#### MCP / library
+
+The `rtdb_generate_rules` tool (library; not on the default bridge) takes the
+same `configPath` (and an optional `cwd`), loads the module the same way, and
+returns the compiled `{ rulesJson }` without contacting a Firebase project.
+
+### Verifying captured sessions
+
+Constraints documents can be passed directly to `@pyric/cli/verify` as
+candidate RTDB rules:
+
+```ts
+import { verifyFixture } from '@pyric/cli/verify';
+import { rules } from './database.rules.js';
+
+const fixture = JSON.parse(await Bun.file('.pyric/last-session.json').text());
+
+const result = await verifyFixture(fixture, {
+  engines: ['sandbox'],
+  rules: { rtdb: rules },
+});
+```
+
+For CLI verification, generate JSON first and pass it as the RTDB rules file:
+
+```ts
+await Bun.write('database.rules.json', JSON.stringify(rtdbRules(rules).toJSON(), null, 2));
+```
+
+```sh
+pyric verify --service rtdb --rules rtdb=database.rules.json
+```
+
+Verification lives in `@pyric/cli/verify` because constraints are an authoring
+surface and captured-session replay is local tooling around an app session.
+The Firebase Rules Test API engine is Firestore-only; RTDB constraints verify by
+compiling to RTDB rules JSON and replaying captured RTDB commits locally.
+
+## Compiled rules (internal)
+
+### `compileRtdbRules(rulesJson): CompiledRtdbRules`
+
+Convert Firebase RTDB rules JSON into the compiled tree the simulator uses
+(`CompiledRtdbRules` is the `RtdbNode` root).
+
+### `serializeRtdbRules(compiled): { rules: Record<string, unknown> }`
+
+Convert a compiled tree back to Firebase RTDB rules JSON.
+
+### `simulateRtdbRules(compiled, input): SimulateResult`
+
+Evaluate one operation against a compiled rules tree.
+
+```ts
+const compiled = compileRtdbRules({
+  rules: {
+    profiles: {
+      $uid: {
+        '.read': 'auth.uid === $uid',
+      },
+    },
+  },
+});
+
+const result = simulateRtdbRules(compiled, {
+  operation: 'read',
+  path: '/profiles/alice',
+  auth: { uid: 'alice', token: {} },
+  mockData: {},
+});
+```
+
+`SimulationInput`:
+
+```ts
+type SimulationInput = {
+  operation: 'read' | 'write' | 'validate';
+  path: string;
+  auth: { uid: string; token: Record<string, unknown> } | null;
+  mockData: Record<string, unknown>;
+  newData?: unknown;
+};
+```
+
+### `replay` / expression helpers
+
+Also on `pyric/rules/internal/rtdb`:
+
+- `replay` — replay captured RTDB commits against candidate rules
+- `parseExpression` / `validateExpression` / `lintExpression` /
+  `buildRuleExpression` — expression-level parse, validate, and lint
+
+## Production deployment
+
+The rules engine performs no production reads or writes. Generate and inspect
+rules locally (`pyric database rules generate`, `rtdbRules(doc).toJSON()`), then
+ship with `firebase-tools` / Console (`firebase deploy --only database`).
+Production operations never live on the Firebase-shaped `pyric/database` mirror
+or this internal engine seam.
+
+## Constraint helpers
+
+The RTDB rule constraint helpers are re-exported directly from `pyric/rules`,
+the public front door. The previous dedicated subpaths (`pyric/rules/rtdb`,
+`pyric/rules/rtdb/constraints`, `pyric/rules/rtdb-constraints`) no longer
+exist; there is one place to import the DSL from now.
+
+The complete builder catalog, with the exact expression each helper
+produces, lives in [constraints.md](../pyric-database-reference-constraints/). At a glance the
+groups are:
+
+- boolean composition: `expr`, `all`, `any`, `not`, `deny`, `always`, `allow`
+- auth, ownership, and state atoms: `authenticated`, `ownPath`, `ownField`,
+  `isNew`, `immutable`, `immutableSelf`, `rootExists`, `rootEquals`
+- schema predicates: `hasChildren`, `hasChild`, `fieldIsString`,
+  `fieldIsNumber`, `fieldIsBoolean`, `fieldEnum`
+- data navigation and comparison: `dataVal`, `newDataVal`, `dataExists`,
+  `newDataExists`, `newDataIs`, `dataParentVal`, `newDataParentVal`,
+  `newDataParentExists`, `eq`, `neq`, `gt`, `lte`, and the `AUTH_UID`
+  segment constant
+- policy helpers: `pathOwnerOnly`, `fieldOwnerOnly`, `ownerOrNew`,
+  `hasRole`, `isMember`, `required`, `transition`
+- game primitives: `turnGuard`, `flip`, `winCheckHelper`
+- assembly: `defineRtdbRules`, `ruleset`, `schemaRules`
+
+### `PathDef`
+
+```ts
+interface PathDef {
+  read?: Expr;
+  write?: Expr;
+  validate?: Expr;
+  schema?: z.ZodObject<any>;
+  fieldConstraints?: Record<string, Expr[]>;
+  indexOn?: string[];
+  children?: Record<string, PathDef>;
+}
+```
+
+`schema` supports Zod object fields composed from strings, numbers, booleans,
+enums, literals, unions of supported types, nested objects, and optional fields.
+Unsupported Zod types throw during compilation.
+
+The game primitives (`turnGuard`, `flip`, `winCheckHelper`) are
+first-class exports with spec-pinned output; the deployed tic-tac-toe
+ruleset is built on them. Their semantics are in
+[constraints.md](../pyric-database-reference-constraints/).

package/dist/serve/docs-ui/docs/pyric-database-tutorials-01-author-rtdb-rules-with-constraints/index.html

@@ -0,0 +1,125 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Author your first RTDB rules with constraints · Pyric Studio</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.CQYSemvw.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/"> Overview </a><details class="docs-nav-group"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/" aria-current="true"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/" id="nav-group-overview"> Overview </a><details class="docs-nav-group" id="nav-group-run-locally"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-develop-with-firebase-apis"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-inspect-and-correct"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-inspect-the-sandbox"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-correct-security-rules"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-work-with-an-agent"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-verify-the-boundary"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-unchanged"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/" aria-current="true"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/pyric-database/">pyric / database</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span>Tutorials</span> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">Author RTDB rules</span> </li> </ol> </nav>  <article class="prose">  <h1 id="author-your-first-rtdb-rules-with-constraints">Author your first RTDB rules with constraints</h1>
+<p>This tutorial creates a small Realtime Database rules document in memory, checks
+it, and simulates one write before you hand the generated JSON to deploy
+tooling.</p>
+<p>You will build rules for room messages:</p>
+<ul>
+<li>nobody can read or write at the root</li>
+<li>signed-in room members can write messages</li>
+<li>each message must include <code>author</code>, <code>text</code>, and <code>createdAt</code></li>
+<li><code>createdAt</code> cannot change after creation</li>
+</ul>
+<h2 id="create-the-rules-document">Create the rules document</h2>
+<p>Create <code>database.rules.ts</code>:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">z</span><span style="color:#ABB2BF"> } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> 'zod'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> {</span></span>
+<span class="line"><span style="color:#E06C75">  AUTH_UID</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  all</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  authenticated</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  defineRtdbRules</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  deny</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  eq</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  immutable</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  newDataVal</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  rootExists</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#ABB2BF">} </span><span style="color:#C678DD">from</span><span style="color:#98C379"> 'pyric/rules'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">const</span><span style="color:#E5C07B"> isRoomMember</span><span style="color:#56B6C2"> =</span><span style="color:#61AFEF"> rootExists</span><span style="color:#ABB2BF">([</span><span style="color:#98C379">'members'</span><span style="color:#ABB2BF">, { </span><span style="color:#E06C75">$</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">'$roomId'</span><span style="color:#ABB2BF"> }, { </span><span style="color:#E06C75">$</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">'auth.uid'</span><span style="color:#ABB2BF"> }]);</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">export</span><span style="color:#C678DD"> const</span><span style="color:#E5C07B"> rules</span><span style="color:#56B6C2"> =</span><span style="color:#61AFEF"> defineRtdbRules</span><span style="color:#ABB2BF">({</span></span>
+<span class="line"><span style="color:#E06C75">  paths</span><span style="color:#ABB2BF">: {</span></span>
+<span class="line"><span style="color:#98C379">    '/'</span><span style="color:#ABB2BF">: { </span><span style="color:#E06C75">read</span><span style="color:#ABB2BF">: </span><span style="color:#61AFEF">deny</span><span style="color:#ABB2BF">(), </span><span style="color:#E06C75">write</span><span style="color:#ABB2BF">: </span><span style="color:#61AFEF">deny</span><span style="color:#ABB2BF">() },</span></span>
+<span class="line"><span style="color:#98C379">    '/rooms/$roomId/messages/$messageId'</span><span style="color:#ABB2BF">: {</span></span>
+<span class="line"><span style="color:#E06C75">      read</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">isRoomMember</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">      write</span><span style="color:#ABB2BF">: </span><span style="color:#61AFEF">all</span><span style="color:#ABB2BF">(</span></span>
+<span class="line"><span style="color:#61AFEF">        authenticated</span><span style="color:#ABB2BF">(),</span></span>
+<span class="line"><span style="color:#E06C75">        isRoomMember</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#61AFEF">        eq</span><span style="color:#ABB2BF">(</span><span style="color:#61AFEF">newDataVal</span><span style="color:#ABB2BF">(</span><span style="color:#98C379">'author'</span><span style="color:#ABB2BF">), </span><span style="color:#E5C07B">AUTH_UID</span><span style="color:#ABB2BF">),</span></span>
+<span class="line"><span style="color:#61AFEF">        immutable</span><span style="color:#ABB2BF">(</span><span style="color:#98C379">'createdAt'</span><span style="color:#ABB2BF">),</span></span>
+<span class="line"><span style="color:#ABB2BF">      ),</span></span>
+<span class="line"><span style="color:#E06C75">      schema</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">z</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">object</span><span style="color:#ABB2BF">({</span></span>
+<span class="line"><span style="color:#E06C75">        author</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">z</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">string</span><span style="color:#ABB2BF">(),</span></span>
+<span class="line"><span style="color:#E06C75">        text</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">z</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">string</span><span style="color:#ABB2BF">(),</span></span>
+<span class="line"><span style="color:#E06C75">        createdAt</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">z</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">number</span><span style="color:#ABB2BF">(),</span></span>
+<span class="line"><span style="color:#ABB2BF">      }),</span></span>
+<span class="line"><span style="color:#E06C75">      indexOn</span><span style="color:#ABB2BF">: [</span><span style="color:#98C379">'createdAt'</span><span style="color:#ABB2BF">],</span></span>
+<span class="line"><span style="color:#ABB2BF">    },</span></span>
+<span class="line"><span style="color:#ABB2BF">  },</span></span>
+<span class="line"><span style="color:#ABB2BF">});</span></span></code></pre>
+<h2 id="check-the-document">Check the document</h2>
+<p>Save a small check script as <code>database.rules.check.ts</code>:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">rtdbRules</span><span style="color:#ABB2BF"> } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> 'pyric/rules'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">rules</span><span style="color:#ABB2BF"> } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> './database.rules.js'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">const</span><span style="color:#E5C07B"> ruleset</span><span style="color:#56B6C2"> =</span><span style="color:#61AFEF"> rtdbRules</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">rules</span><span style="color:#ABB2BF">);</span></span>
+<span class="line"><span style="color:#C678DD">const</span><span style="color:#E5C07B"> issues</span><span style="color:#56B6C2"> =</span><span style="color:#E5C07B"> ruleset</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">lint</span><span style="color:#ABB2BF">();</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">if</span><span style="color:#ABB2BF"> (</span><span style="color:#E5C07B">issues</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">some</span><span style="color:#ABB2BF">((</span><span style="color:#E06C75;font-style:italic">i</span><span style="color:#ABB2BF">) </span><span style="color:#C678DD">=></span><span style="color:#E5C07B"> i</span><span style="color:#ABB2BF">.</span><span style="color:#E06C75">severity</span><span style="color:#56B6C2"> ===</span><span style="color:#98C379"> 'error'</span><span style="color:#ABB2BF">)) {</span></span>
+<span class="line"><span style="color:#E5C07B">  console</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">error</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">issues</span><span style="color:#ABB2BF">);</span></span>
+<span class="line"><span style="color:#E5C07B">  process</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">exit</span><span style="color:#ABB2BF">(</span><span style="color:#D19A66">1</span><span style="color:#ABB2BF">);</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#E5C07B">console</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">log</span><span style="color:#ABB2BF">(</span><span style="color:#E5C07B">ruleset</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">toJSON</span><span style="color:#ABB2BF">());</span></span></code></pre>
+<p>Run it:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#61AFEF">bun</span><span style="color:#98C379"> database.rules.check.ts</span></span></code></pre>
+<p>You will see a complete Firebase RTDB rules JSON object. The <code>lint()</code> call
+returns warnings alongside errors (one flat <code>RuleIssue[]</code>), so you can decide
+whether to fail your own workflow on warnings.</p>
+<h2 id="simulate-a-write">Simulate a write</h2>
+<p>Save one simulation as <code>database.rules.simulate.ts</code>:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">rtdbRules</span><span style="color:#ABB2BF"> } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> 'pyric/rules'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">rules</span><span style="color:#ABB2BF"> } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> './database.rules.js'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">const</span><span style="color:#E5C07B"> result</span><span style="color:#56B6C2"> =</span><span style="color:#61AFEF"> rtdbRules</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">rules</span><span style="color:#ABB2BF">).</span><span style="color:#61AFEF">explain</span><span style="color:#ABB2BF">({</span></span>
+<span class="line"><span style="color:#E06C75">  expectation</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">'ALLOW'</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  operation</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">'write'</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  path</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">'/rooms/r1/messages/m1'</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  auth</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">'alice'</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">  data</span><span style="color:#ABB2BF">: {</span></span>
+<span class="line"><span style="color:#E06C75">    members</span><span style="color:#ABB2BF">: {</span></span>
+<span class="line"><span style="color:#E06C75">      r1</span><span style="color:#ABB2BF">: { </span><span style="color:#E06C75">alice</span><span style="color:#ABB2BF">: </span><span style="color:#D19A66">true</span><span style="color:#ABB2BF"> },</span></span>
+<span class="line"><span style="color:#ABB2BF">    },</span></span>
+<span class="line"><span style="color:#ABB2BF">  },</span></span>
+<span class="line"><span style="color:#E06C75">  newData</span><span style="color:#ABB2BF">: {</span></span>
+<span class="line"><span style="color:#E06C75">    author</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">'alice'</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">    text</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">'hello'</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#E06C75">    createdAt</span><span style="color:#ABB2BF">: </span><span style="color:#D19A66">1</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#ABB2BF">  },</span></span>
+<span class="line"><span style="color:#ABB2BF">});</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#E5C07B">console</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">log</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">result</span><span style="color:#ABB2BF">);</span></span></code></pre>
+<p>Run it:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#61AFEF">bun</span><span style="color:#98C379"> database.rules.simulate.ts</span></span></code></pre>
+<p>The result is allowed. Change <code>auth</code> to <code>'bob'</code> or change <code>newData.author</code> to a
+different uid and run it again; the same rule document now denies the write.</p>
+<h2 id="generate-json-for-deployment">Generate JSON for deployment</h2>
+<p>Write the compiled JSON with the Node helper:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">writeRtdbRulesFile</span><span style="color:#ABB2BF"> } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> 'pyric/rules/internal/node'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">rules</span><span style="color:#ABB2BF"> } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> './database.rules.js'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">await</span><span style="color:#61AFEF"> writeRtdbRulesFile</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">rules</span><span style="color:#ABB2BF">, </span><span style="color:#98C379">'database.rules.json'</span><span style="color:#ABB2BF">);</span></span></code></pre>
+<p>or from the CLI, without writing a script at all:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="sh"><code><span class="line"><span style="color:#61AFEF">pyric</span><span style="color:#98C379"> database</span><span style="color:#98C379"> rules</span><span style="color:#98C379"> generate</span><span style="color:#D19A66"> --config</span><span style="color:#98C379"> database.rules.ts</span><span style="color:#D19A66"> --out</span><span style="color:#98C379"> database.rules.json</span></span></code></pre>
+<p>Both routes run the same compilation <code>rtdbRules(rules).toJSON()</code> performs. See
+<a href="../pyric-database-reference-rules-tooling/#generating-databaserulesjson">RTDB rules tooling</a>
+for the full reference, including the <code>rtdb_generate_rules</code> MCP tool.</p>
+<p>You have built an in-memory rules document, checked it, simulated it, and
+generated the JSON expected by Firebase Realtime Database.</p>
+<h2 id="verify-a-captured-app-journey">Verify a captured app journey</h2>
+<p>After running <code>pyric dev</code> and exercising the app, the latest session is saved
+to <code>.pyric/last-session.json</code>. You can verify that capture against the in-memory
+rules document before generating JSON:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">verifyFixture</span><span style="color:#ABB2BF"> } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> '@pyric/cli/verify'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { </span><span style="color:#E06C75">rules</span><span style="color:#ABB2BF"> } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> './database.rules.js'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">const</span><span style="color:#E5C07B"> fixture</span><span style="color:#56B6C2"> =</span><span style="color:#E5C07B"> JSON</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">parse</span><span style="color:#ABB2BF">(</span><span style="color:#C678DD">await</span><span style="color:#E5C07B"> Bun</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">file</span><span style="color:#ABB2BF">(</span><span style="color:#98C379">'.pyric/last-session.json'</span><span style="color:#ABB2BF">).</span><span style="color:#61AFEF">text</span><span style="color:#ABB2BF">());</span></span>
+<span class="line"><span style="color:#C678DD">const</span><span style="color:#E5C07B"> result</span><span style="color:#56B6C2"> =</span><span style="color:#C678DD"> await</span><span style="color:#61AFEF"> verifyFixture</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">fixture</span><span style="color:#ABB2BF">, {</span></span>
+<span class="line"><span style="color:#E06C75">  rules</span><span style="color:#ABB2BF">: { </span><span style="color:#E06C75">rtdb</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">rules</span><span style="color:#ABB2BF"> },</span></span>
+<span class="line"><span style="color:#ABB2BF">});</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">if</span><span style="color:#ABB2BF"> (</span><span style="color:#56B6C2">!</span><span style="color:#E5C07B">result</span><span style="color:#ABB2BF">.</span><span style="color:#E06C75">ok</span><span style="color:#ABB2BF">) {</span></span>
+<span class="line"><span style="color:#E5C07B">  console</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">error</span><span style="color:#ABB2BF">(</span><span style="color:#E5C07B">result</span><span style="color:#ABB2BF">.</span><span style="color:#E5C07B">services</span><span style="color:#ABB2BF">.</span><span style="color:#E5C07B">rtdb</span><span style="color:#ABB2BF">?.</span><span style="color:#E06C75">divergences</span><span style="color:#ABB2BF">);</span></span>
+<span class="line"><span style="color:#E5C07B">  process</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">exit</span><span style="color:#ABB2BF">(</span><span style="color:#D19A66">1</span><span style="color:#ABB2BF">);</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p>For the CLI path, use the JSON file from the previous step:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#61AFEF">pyric</span><span style="color:#98C379"> verify</span><span style="color:#D19A66"> --service</span><span style="color:#98C379"> rtdb</span><span style="color:#D19A66"> --rules</span><span style="color:#98C379"> rtdb=database.rules.json</span></span></code></pre>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#create-the-rules-document">Create the rules document</a> </li><li data-depth="2"> <a href="#check-the-document">Check the document</a> </li><li data-depth="2"> <a href="#simulate-a-write">Simulate a write</a> </li><li data-depth="2"> <a href="#generate-json-for-deployment">Generate JSON for deployment</a> </li><li data-depth="2"> <a href="#verify-a-captured-app-journey">Verify a captured app journey</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script> </body> </html>