npm - @pyric/cli - Versions diffs - 0.1.0-alpha.9 - Mend

@pyric/cli 0.1.0-alpha.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1169) hide show

package/dist/serve/docs-ui/docs/pyric-rules-reference-conformance-gaps/index.html ADDED Viewed

@@ -0,0 +1,277 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Firestore rules gaps: where pyric and Firebase disagree · Pyric Studio</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.CQYSemvw.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/"> Overview </a><details class="docs-nav-group"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/" aria-current="true"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/" id="nav-group-overview"> Overview </a><details class="docs-nav-group" id="nav-group-run-locally"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-develop-with-firebase-apis"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-inspect-and-correct"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-inspect-the-sandbox"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-correct-security-rules"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-work-with-an-agent"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-verify-the-boundary"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-unchanged"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/" aria-current="true"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/pyric-rules/">pyric / rules</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span>Reference</span> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">Firestore rules gaps</span> </li> </ol> </nav>  <article class="prose">  <h1 id="firestore-rules-gaps-where-pyric-and-firebase-disagree">Firestore rules gaps: where pyric and Firebase disagree</h1>
+<p>A gap is a rule that gets one answer from pyric and a different answer from
+Firebase. You write the rule once. pyric allows the request and Firebase
+denies it, or the other way round. The rule you tested is not the rule you
+shipped.</p>
+<p>Every gap on this page was captured from the production Rules Test API, not
+inferred. There are seven. Skim the headings. If none of them names something
+your rules use, none of them affects you.</p>
+<p>Tracked in <a href="https://github.com/davideast/pyric/issues/135" target="_blank" rel="noopener noreferrer" class="external-link">#135</a>.</p>
+<h2 id="how-to-read-severity">How to read severity</h2>
+<p>Every gap has two facts. A single label hides one of them, so this page
+reports both.</p>
+<p><strong>Fidelity</strong> is the direction of the disagreement. Either pyric allows where
+Firebase denies, or pyric denies where Firebase allows. Either way the verdict
+you get locally is not the verdict you get in production, and the whole point
+of a local mirror is that the two match.</p>
+<p><strong>Production impact</strong> is whether the gap lets a request through in production
+that should not get through. It follows from the direction.</p>
+<ul>
+<li><strong>pyric allows, Firebase denies.</strong> Production is stricter than pyric. Nothing
+pyric wrongly allowed reaches production, so there is no production hole. The
+cost is trust: a local ALLOW you relied on is wrong, and a legitimate
+operation you validated locally can be refused in production.</li>
+<li><strong>pyric denies, Firebase allows.</strong> Production is more permissive than pyric.
+A request your local mirror refused can succeed in production. This is the
+direction that ships a hole: a rule you tested as blocking may not block.</li>
+</ul>
+<p>Read both. A broken verdict with no production hole is still a broken verdict,
+and a narrow trigger in the permissive direction is still the direction that
+leaks. Six of the seven gaps below are pyric-allows-Firebase-denies; the
+seventh runs the other way, and it is the one to watch.</p>
+<h2 id="hashing-built-ins-allow-in-pyric-and-deny-in-firebase">Hashing built-ins allow in pyric and deny in Firebase</h2>
+<p><strong>Fidelity:</strong> pyric allows, Firebase denies.
+<strong>Production impact:</strong> no production hole, because Firebase denies here too. The
+cost is trust: a legitimate write you validated locally is refused in the cloud.</p>
+<h3 id="what-you-would-write">What you would write</h3>
+<p>A rule that gates on a digest. An upload token, a content checksum, a
+signature check:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>match /docs/{id} {</span></span>
+<span class="line"><span>  allow create: if request.auth != null</span></span>
+<span class="line"><span>    &#x26;&#x26; hashing.sha256(request.resource.data.body).toHexString()</span></span>
+<span class="line"><span>       == request.resource.data.checksum;</span></span>
+<span class="line"><span>}</span></span></code></pre>
+<p>Or any use of <code>hashing.md5()</code>, <code>hashing.crc32()</code>, <code>hashing.crc32c()</code>, or
+<code>Bytes.toBase64()</code>.</p>
+<h3 id="what-happens">What happens</h3>
+<p>In pyric the digest comes out equal to the reference value and the write is
+ALLOWED. In Firebase the same comparison is DENIED.</p>
+<p>pyric’s byte encoding and hash output do not agree with production’s. That is
+a verdict-level fact, not a theory about which byte differs. On all five
+captured cases, including the textbook md5 of the empty string and the NIST
+sha256 of <code>abc</code>, pyric says allow and production says deny.</p>
+<p>Any rule whose decision depends on a hash value or a base64 encoding passes
+locally and fails in the cloud.</p>
+<h3 id="what-you-should-do">What you should do</h3>
+<p>Do not gate access on a hash comparison. Compute the digest in your
+application, store it as a field, and let the rule compare fields. That runs
+identically in both engines.</p>
+<p><code>toHexString()</code> and <code>toUtf8().size()</code> agree with production. The digest
+functions and <code>toBase64()</code> do not.</p>
+<h2 id="getafter-and-existsafter-allow-in-pyric-and-deny-in-firebase"><code>getAfter()</code> and <code>existsAfter()</code> allow in pyric and deny in Firebase</h2>
+<p><strong>Fidelity:</strong> pyric allows, Firebase denies.
+<strong>Production impact:</strong> no production hole, because Firebase denies here too. The
+cost is trust: a legitimate write you validated locally is refused in the cloud.</p>
+<h3 id="what-you-would-write-1">What you would write</h3>
+<p>A post-write check, usually to keep two documents consistent:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>match /orders/{id} {</span></span>
+<span class="line"><span>  allow create: if request.auth != null</span></span>
+<span class="line"><span>    &#x26;&#x26; existsAfter(request.path) == true</span></span>
+<span class="line"><span>    &#x26;&#x26; getAfter(request.path).data.total == request.resource.data.total;</span></span>
+<span class="line"><span>}</span></span></code></pre>
+<h3 id="what-happens-1">What happens</h3>
+<p>In pyric the write is ALLOWED. pyric models the post-write state and hands
+back the document you are about to write.</p>
+<p>In Firebase the write is DENIED. A <code>getAfter()</code> result carries no document
+identity in the response, so a comparison against it errors, and an errored
+expression denies. <code>existsAfter()</code> diverges the same way on a create, on a
+delete, and over an unrelated path. All four captured cases: pyric allow,
+production deny.</p>
+<p>The production verdict here comes from a mocked post-write lookup in the Rules
+Test API. That API is the only oracle there is for a rule that reads state the
+request has not committed yet, and it denies where pyric allows.</p>
+<h3 id="what-you-should-do-1">What you should do</h3>
+<p>Do not write rules that depend on <code>getAfter()</code> or <code>existsAfter()</code>. You cannot
+test them here and get an answer that means anything. Where the rule is really
+about the write in front of you, use <code>request.resource.data</code>, which agrees on
+both sides.</p>
+<h2 id="id-and-__name__-on-a-get-result-allow-in-pyric-and-deny-in-firebase"><code>.id</code> and <code>__name__</code> on a <code>get()</code> result allow in pyric and deny in Firebase</h2>
+<p><strong>Fidelity:</strong> pyric allows, Firebase denies.
+<strong>Production impact:</strong> no production hole, because Firebase denies here too. The
+cost is trust: a legitimate write you validated locally is refused in the cloud.</p>
+<h3 id="what-you-would-write-2">What you would write</h3>
+<p>A rule that reads the identity of a document it looked up:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>match /pages/{id} {</span></span>
+<span class="line"><span>  allow create: if get(/databases/$(database)/documents/cfg/site).id == 'site';</span></span>
+<span class="line"><span>}</span></span></code></pre>
+<h3 id="what-happens-2">What happens</h3>
+<p>In pyric the write is ALLOWED. pyric attaches a document identity to the
+<code>get()</code> result, so <code>.id</code> and <code>__name__</code> read back the path you asked for.</p>
+<p>In Firebase the write is DENIED. The looked-up document carries no identity in
+the response, so <code>.id</code> errors with “Property id is undefined on object” and
+the rule denies. <code>__name__</code> behaves the same. The production verdict comes
+from a mocked lookup in the Rules Test API, which is the oracle for every
+cross-document read in these captures.</p>
+<h3 id="what-you-should-do-2">What you should do</h3>
+<p>Read data off a <code>get()</code>, not identity. <code>get(...).data.&#x3C;field></code> matches
+production exactly, and so does <code>exists(...)</code>.</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>allow create: if get(/databases/$(database)/documents/cfg/site).data.open == true;</span></span></code></pre>
+<p>If you need the identity, you already have it. It is the path you passed to
+<code>get()</code>.</p>
+<h2 id="requestquery-allows-in-pyric-and-denies-in-firebase"><code>request.query</code> allows in pyric and denies in Firebase</h2>
+<p><strong>Fidelity:</strong> pyric allows, Firebase denies.
+<strong>Production impact:</strong> no production hole, because Firebase denies here too. The
+cost is trust: a legitimate write you validated locally is refused in the cloud.</p>
+<h3 id="what-you-would-write-3">What you would write</h3>
+<p>A rule that inspects the query on a request that is not a list:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>match /notes/{id} {</span></span>
+<span class="line"><span>  allow create: if request.auth != null</span></span>
+<span class="line"><span>    &#x26;&#x26; request.query is map</span></span>
+<span class="line"><span>    &#x26;&#x26; request.query.size() == 0;</span></span>
+<span class="line"><span>}</span></span></code></pre>
+<h3 id="what-happens-3">What happens</h3>
+<p>In pyric the write is ALLOWED. pyric models <code>request.query</code> as an empty map on
+a <code>get</code>, <code>create</code>, <code>update</code>, or <code>delete</code>. In Firebase the same comparison is
+DENIED.</p>
+<h3 id="what-you-should-do-3">What you should do</h3>
+<p>Only touch <code>request.query</code> inside a <code>list</code> rule, which is the only request
+that has one. On a document request, drop the check.</p>
+<h2 id="out-of-range-slices-allow-in-pyric-and-deny-in-firebase">Out-of-range slices allow in pyric and deny in Firebase</h2>
+<p><strong>Fidelity:</strong> pyric allows, Firebase denies.
+<strong>Production impact:</strong> no production hole, because Firebase denies here too. The
+cost is trust: a legitimate write you validated locally is refused in the cloud.</p>
+<h3 id="what-you-would-write-4">What you would write</h3>
+<p>A slice whose end index runs past the end of the value:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>match /notes/{id} {</span></span>
+<span class="line"><span>  allow create: if request.resource.data.tags[1:99].size() == 3</span></span>
+<span class="line"><span>    &#x26;&#x26; request.resource.data.title[6:99] == 'world';</span></span>
+<span class="line"><span>}</span></span></code></pre>
+<h3 id="what-happens-4">What happens</h3>
+<p>In pyric both slices clamp to the length of the list or the string, the
+comparison succeeds, and the write is ALLOWED. In Firebase an out-of-range
+slice end is DENIED, on lists and on strings alike.</p>
+<h3 id="what-you-should-do-4">What you should do</h3>
+<p>Never slice past the end. Check the size first, or slice with an index you
+know is in range:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>allow create: if request.resource.data.tags.size() >= 4</span></span>
+<span class="line"><span>  &#x26;&#x26; request.resource.data.tags[1:4].size() == 3;</span></span></code></pre>
+<p>In-range slices, empty slices (<code>[i:i]</code>), and full-length slices all agree with
+production.</p>
+<h2 id="path-on-a-value-that-is-already-a-path-allows-in-pyric-and-denies-in-firebase"><code>path()</code> on a value that is already a path allows in pyric and denies in Firebase</h2>
+<p><strong>Fidelity:</strong> pyric allows, Firebase denies.
+<strong>Production impact:</strong> no production hole, because Firebase denies here too. The
+cost is trust: a legitimate write you validated locally is refused in the cloud.</p>
+<h3 id="what-you-would-write-5">What you would write</h3>
+<p>A <code>path()</code> call wrapped around something that is already a <code>Path</code>, usually
+because it came out of a helper:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>function asPath(p) {</span></span>
+<span class="line"><span>  return path(p);</span></span>
+<span class="line"><span>}</span></span>
+<span class="line"><span>match /users/{uid} {</span></span>
+<span class="line"><span>  allow read: if asPath(path('users/alice')) == path('users/alice');</span></span>
+<span class="line"><span>}</span></span></code></pre>
+<h3 id="what-happens-5">What happens</h3>
+<p>In pyric <code>path()</code> is idempotent. Passing it a <code>Path</code> gives the same <code>Path</code>
+back and the read is ALLOWED. In Firebase the same expression is DENIED.</p>
+<h3 id="what-you-should-do-5">What you should do</h3>
+<p>Call <code>path()</code> exactly once, on a string. Everything else about paths matches
+production: <code>path()</code> on a string literal, equality and inequality, <code>bind()</code>,
+numeric indexing, and type checks.</p>
+<h2 id="a-float-in-your-test-data-reads-as-an-int-in-pyric">A float in your test data reads as an int in pyric</h2>
+<p><strong>Fidelity:</strong> pyric denies, Firebase allows.
+<strong>Production impact:</strong> the leaking direction. A request your local mirror
+refused is allowed in production, so a rule you tested as blocking may not
+block. The trigger is narrow: it fires only where a rule tells integral-valued
+floats apart from ints with <code>is float</code> / <code>is int</code>. But this is the one gap on
+the page where production is the more permissive side, so it is the one to
+watch.</p>
+<h3 id="what-you-would-write-6">What you would write</h3>
+<p>A type check on a number in the payload:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>match /readings/{id} {</span></span>
+<span class="line"><span>  allow create: if request.resource.data.x is float</span></span>
+<span class="line"><span>    &#x26;&#x26; !(request.resource.data.x is int);</span></span>
+<span class="line"><span>}</span></span></code></pre>
+<h3 id="what-happens-6">What happens</h3>
+<p>In pyric the write is DENIED. In Firebase it is ALLOWED.</p>
+<p>Firestore stores a type tag next to the number, so a value written as a float
+stays a float. pyric reads test data from JSON, where <code>2.0</code> and <code>2</code> are the
+same number, and narrows it toward int.</p>
+<p>This is the leaking direction. pyric refuses a write production accepts, so a
+rule that leans on <code>is float</code> to keep something out reads as a denial on your
+machine and lets it through in the cloud. You often catch it anyway, because a
+legitimate write fails locally and you go looking. The danger is the case you do
+not run locally: a rule you trusted to block, tested once, and shipped.</p>
+<h3 id="what-you-should-do-6">What you should do</h3>
+<p>Do not use <code>is float</code> or <code>is int</code> to tell payload numbers apart while testing
+locally. Test the property you actually care about, which is usually a range:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>allow create: if request.resource.data.x is number</span></span>
+<span class="line"><span>  &#x26;&#x26; request.resource.data.x >= 0</span></span>
+<span class="line"><span>  &#x26;&#x26; request.resource.data.x &#x3C;= 100;</span></span></code></pre>
+<p>Integer division, truncation, modulo, division by zero, and <code>is int</code> on a
+genuinely integral value all match production.</p>
+<h2 id="everything-else-in-the-simulator-matches-firebase">Everything else in the simulator matches Firebase</h2>
+<p>Sixteen of the twenty-three captured observations replay clean, case for case:
+time and math built-ins, durations and geopoints, cross-type operator
+overloads, error absorption in <code>&#x26;&#x26;</code> and <code>||</code>, user-defined functions and
+recursive rules, list and string methods, <code>List.concat()</code> / <code>removeAll()</code> /
+<code>toSet()</code>, <code>Map.get()</code> with defaults and nested paths, <code>matches()</code> as an
+anchored full-string regex, own-keys-only map membership with no prototype
+leakage, required-field checks and <code>mapDiff</code>, set algebra, string literals and
+regexes, timestamp math and casts, undefined-field access, and the
+unsupported-feature witness.</p>
+<h2 id="how-this-is-checked-and-how-to-check-it-yourself">How this is checked, and how to check it yourself</h2>
+<p>Each gap above is replayed on every test run. The suite loads each captured
+production observation, runs the same ruleset and the same request through the
+local simulator, and compares verdicts case for case.</p>
+<ul>
+<li>Suite: <code>packages/pyric/test/rules/oracle-conformance.test.ts</code>. Run it with
+<code>bun test packages/pyric/test/rules/oracle-conformance.test.ts</code>.</li>
+<li>Captures: <code>packages/conformance/observations/firestore-rules/*.json</code>,
+twenty-three of them.</li>
+<li>Rulesets and cases: <code>packages/conformance/rules-corpus/firestore/</code>.</li>
+</ul>
+<p>The observation and case keys behind each section above:</p>
+<div class="table-scroll">
+<table><thead><tr><th>Gap</th><th>Observation :: cases</th></tr></thead><tbody><tr><td>Hashing built-ins</td><td><code>rules-firestore-bytes-toutf8-and-hashing</code> :: <code>toBase64 round-trip</code>, <code>md5 empty string</code>, <code>sha256 abc</code>, <code>crc32 IEEE 802.3 ref</code>, <code>crc32c Castagnoli ref</code></td></tr><tr><td><code>getAfter()</code> / <code>existsAfter()</code></td><td><code>rules-firestore-get-after-and-exists-after</code> :: <code>getAfter target == request.resource.data</code>, <code>existsAfter create true</code>, <code>existsAfter delete false</code>, <code>existsAfter unrelated mocked path</code></td></tr><tr><td><code>get()</code> result identity</td><td><code>rules-firestore-get-missing-doc</code> :: <code>get(mocked).id == 'site'</code>, <code>get(mocked).__name__ == path literal</code></td></tr><tr><td><code>request.query</code></td><td><code>rules-firestore-globals-request-path-and-resource-id</code> :: <code>request.query empty map</code></td></tr><tr><td>Out-of-range slices</td><td><code>rules-firestore-range-slice-list-and-string</code> :: <code>list slice end OOB clamps to length</code>, <code>string slice end OOB clamps to length</code></td></tr><tr><td><code>path()</code> idempotence</td><td><code>rules-firestore-path-constructor-and-bind</code> :: <code>path() idempotent on Path arg</code></td></tr><tr><td>Float payload reads as int</td><td><code>rules-firestore-int-float-and-division</code> :: <code>float payload is float / not int</code></td></tr></tbody></table></div>
+<p>Every gap is pinned in the suite’s <code>KNOWN_DIVERGENCES</code> table, which asserts
+both sides: production’s captured verdict and the simulator’s live verdict.
+The suite is green while a gap is exactly as described. It fails the moment
+either side moves, including when someone fixes the simulator, which forces
+the fix to delete the pin instead of landing silently beside a stale one. No
+divergent case is skipped.</p>
+<p>A third outcome is not a gap. The simulator can answer UNSUPPORTED, an
+explicit refusal to evaluate a construct it does not model. A refusal is loud
+and you cannot mistake it for a verdict, so those cases are recorded and not
+asserted against production.</p>
+<h2 id="where-to-look-next">Where to look next</h2>
+<ul>
+<li><a href="../pyric-storage-reference-conformance-gaps/">Storage rules gaps</a> for the
+same page on the storage side.</li>
+<li><a href="../pyric-rules-compat/">Compatibility matrix</a> for the row-by-row registry.</li>
+</ul>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#how-to-read-severity">How to read severity</a> </li><li data-depth="2"> <a href="#hashing-built-ins-allow-in-pyric-and-deny-in-firebase">Hashing built-ins allow in pyric and deny in Firebase</a> </li><li data-depth="3"> <a href="#what-you-would-write">What you would write</a> </li><li data-depth="3"> <a href="#what-happens">What happens</a> </li><li data-depth="3"> <a href="#what-you-should-do">What you should do</a> </li><li data-depth="2"> <a href="#getafter-and-existsafter-allow-in-pyric-and-deny-in-firebase">getAfter() and existsAfter() allow in pyric and deny in Firebase</a> </li><li data-depth="3"> <a href="#what-you-would-write-1">What you would write</a> </li><li data-depth="3"> <a href="#what-happens-1">What happens</a> </li><li data-depth="3"> <a href="#what-you-should-do-1">What you should do</a> </li><li data-depth="2"> <a href="#id-and-__name__-on-a-get-result-allow-in-pyric-and-deny-in-firebase">.id and __name__ on a get() result allow in pyric and deny in Firebase</a> </li><li data-depth="3"> <a href="#what-you-would-write-2">What you would write</a> </li><li data-depth="3"> <a href="#what-happens-2">What happens</a> </li><li data-depth="3"> <a href="#what-you-should-do-2">What you should do</a> </li><li data-depth="2"> <a href="#requestquery-allows-in-pyric-and-denies-in-firebase">request.query allows in pyric and denies in Firebase</a> </li><li data-depth="3"> <a href="#what-you-would-write-3">What you would write</a> </li><li data-depth="3"> <a href="#what-happens-3">What happens</a> </li><li data-depth="3"> <a href="#what-you-should-do-3">What you should do</a> </li><li data-depth="2"> <a href="#out-of-range-slices-allow-in-pyric-and-deny-in-firebase">Out-of-range slices allow in pyric and deny in Firebase</a> </li><li data-depth="3"> <a href="#what-you-would-write-4">What you would write</a> </li><li data-depth="3"> <a href="#what-happens-4">What happens</a> </li><li data-depth="3"> <a href="#what-you-should-do-4">What you should do</a> </li><li data-depth="2"> <a href="#path-on-a-value-that-is-already-a-path-allows-in-pyric-and-denies-in-firebase">path() on a value that is already a path allows in pyric and denies in Firebase</a> </li><li data-depth="3"> <a href="#what-you-would-write-5">What you would write</a> </li><li data-depth="3"> <a href="#what-happens-5">What happens</a> </li><li data-depth="3"> <a href="#what-you-should-do-5">What you should do</a> </li><li data-depth="2"> <a href="#a-float-in-your-test-data-reads-as-an-int-in-pyric">A float in your test data reads as an int in pyric</a> </li><li data-depth="3"> <a href="#what-you-would-write-6">What you would write</a> </li><li data-depth="3"> <a href="#what-happens-6">What happens</a> </li><li data-depth="3"> <a href="#what-you-should-do-6">What you should do</a> </li><li data-depth="2"> <a href="#everything-else-in-the-simulator-matches-firebase">Everything else in the simulator matches Firebase</a> </li><li data-depth="2"> <a href="#how-this-is-checked-and-how-to-check-it-yourself">How this is checked, and how to check it yourself</a> </li><li data-depth="2"> <a href="#where-to-look-next">Where to look next</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script> </body> </html>