npm - @pyric/cli - Versions diffs - 0.1.0-alpha.9 - Mend

@pyric/cli 0.1.0-alpha.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1169) hide show

package/dist/serve/docs-ui/docs/pyric-rules-reference-lint-rules/index.html ADDED Viewed

@@ -0,0 +1,148 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Lint rules · Pyric Studio</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.CQYSemvw.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/"> Overview </a><details class="docs-nav-group"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/" aria-current="true"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/" id="nav-group-overview"> Overview </a><details class="docs-nav-group" id="nav-group-run-locally"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-develop-with-firebase-apis"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-inspect-and-correct"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-inspect-the-sandbox"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-correct-security-rules"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-work-with-an-agent"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-verify-the-boundary"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-unchanged"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/" aria-current="true"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/pyric-rules/">pyric / rules</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span>Reference</span> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">Lint rules</span> </li> </ol> </nav>  <article class="prose">  <h1 id="lint-rules">Lint rules</h1>
+<p>This page lists every lint rule emitted by <code>lint(source)</code> and <code>firestoreRules(source).lint()</code>, both from <code>pyric/rules</code>. Each rule surfaces as a <code>RuleIssue</code> with <code>origin: 'lint'</code> and <code>code</code> set to the rule name below. Each entry gives the rule code, default severity, what it detects, and the suggested fix.</p>
+<p>Severities have two values:</p>
+<ul>
+<li><code>error</code>: treat as a hard gate before shipping (CI / <code>firebase deploy</code>).</li>
+<li><code>warning</code>: advisory; does not block.</li>
+</ul>
+<p>Some rules adjust severity by threshold band; those entries note the bands explicitly.</p>
+<h2 id="compilation-limit-rules">Compilation-limit rules</h2>
+<p>These catch sources that Firebase will reject with <code>400 INVALID_ARGUMENT</code> at deploy.</p>
+<h3 id="source_size"><code>SOURCE_SIZE</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Threshold</strong>: source length > 256 × 1024 bytes (262 144).</li>
+<li><strong>Detection</strong>: byte length of the input string.</li>
+<li><strong>Fix</strong>: split into smaller match blocks, reduce string literals.</li>
+</ul>
+<h3 id="chain_depth"><code>CHAIN_DEPTH</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>warning</code> at chain depth ≥ 85, <code>error</code> at ≥ 95, <code>error</code> at ≥ 98.</li>
+<li><strong>Threshold</strong>: 98 (the exact compile limit).</li>
+<li><strong>Detection</strong>: the deepest flat <code>&#x26;&#x26;</code> or <code>||</code> chain in any function body or let value.</li>
+<li><strong>Fix</strong>: nest into groups. <code>a &#x26;&#x26; b &#x26;&#x26; c &#x26;&#x26; d</code> → <code>(a &#x26;&#x26; b) &#x26;&#x26; (c &#x26;&#x26; d)</code> halves the chain depth.</li>
+</ul>
+<h3 id="let_limit"><code>LET_LIMIT</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Threshold</strong>: 11 let bindings per function (12 fails the compile).</li>
+<li><strong>Fix</strong>: inline some let expressions into the return, or split the function in two.</li>
+</ul>
+<h2 id="runtime-budget-rules">Runtime-budget rules</h2>
+<p>These catch sources that compile fine but exhaust the runtime evaluation budget for some inputs (silent <code>403</code>).</p>
+<h3 id="shared_gate"><code>SHARED_GATE</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>warning</code>.</li>
+<li><strong>Detection</strong>: two or more <code>allow</code> rules in the same match block whose first expression is structurally identical.</li>
+<li><strong>Fix</strong>: give each rule a unique discriminator (different <code>moveType</code>, different status check) so the engine can route to one rule and short-circuit out of the others.</li>
+</ul>
+<h3 id="expression_budget"><code>EXPRESSION_BUDGET</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>warning</code> (never <code>error</code>, because the runtime budget is non-deterministic).</li>
+<li><strong>Threshold</strong>: depends on function-call count, with conservative bands:
+<ul>
+<li>1 or 2 function calls → warn at ~100 total expression nodes.</li>
+<li>3 function calls → warn at ~60.</li>
+<li>4+ function calls → warn at ~40.</li>
+</ul>
+</li>
+<li><strong>Detection</strong>: walk the rule’s condition counting expression nodes, follow function calls transitively (each call visited at most once). Multiply by a discount factor for rules with many top-level <code>||</code> branches to avoid false positives on well-gated trees.</li>
+<li><strong>Fix</strong>: reduce the number of function calls, or restructure the predicate so fewer nodes are evaluated per request.</li>
+</ul>
+<h3 id="call_depth"><code>CALL_DEPTH</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>warning</code> at depth ≥ 6, <code>error</code> at ≥ 10.</li>
+<li><strong>Detection</strong>: the deepest function-call chain reachable from a rule’s condition through the static call graph.</li>
+<li><strong>Fix</strong>: inline intermediate helpers.</li>
+</ul>
+<h3 id="get_count"><code>GET_COUNT</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>warning</code> at ≥ 5, <code>error</code> at ≥ 10 (documented Firestore limit).</li>
+<li><strong>Detection</strong>: count of <code>get()</code> and <code>exists()</code> calls reachable from a rule’s condition.</li>
+<li><strong>Fix</strong>: cache results via a <code>let</code> in a wrapper function. Same-path calls are cached by Firestore.</li>
+</ul>
+<h3 id="get_duplication"><code>GET_DUPLICATION</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>warning</code>.</li>
+<li><strong>Detection</strong>: a single function that contains a <code>get()</code> or <code>exists()</code> call is invoked two or more times from one rule.</li>
+<li><strong>Fix</strong>: wrap the calls in a helper that caches the result in a <code>let</code>.</li>
+</ul>
+<h2 id="security-critical-rules">Security-critical rules</h2>
+<p>These flag patterns that <em>compile</em> but are almost always wrong.</p>
+<h3 id="permissive_rule"><code>PERMISSIVE_RULE</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Detection</strong>: a write rule (<code>write</code>, <code>create</code>, <code>update</code>, or <code>delete</code>) whose predicate folds to constant <code>true</code>. Folding handles boolean literals, <code>&#x26;&#x26;</code>/<code>||</code> of booleans, and <code>!</code> of a boolean. It does not try to prove <code>1 == 1</code> or follow function calls.</li>
+<li><strong>Why error</strong>: the most common agent failure mode is escaping a denial with <code>if true</code>. Blocking the deploy forces fixing the real denial.</li>
+<li><strong>Fix</strong>: replace the always-true predicate with a request-shape check.</li>
+</ul>
+<p><code>allow read: if true</code> on a <em>read</em> rule is <strong>not</strong> flagged. It’s a legitimate “public read” pattern.</p>
+<h3 id="recursive_wildcard_open"><code>RECURSIVE_WILDCARD_OPEN</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Detection</strong>: a match path containing a recursive wildcard (<code>{document=**}</code>) combined with an allow rule whose predicate folds to constant <code>true</code>.</li>
+<li><strong>Why a separate code</strong>: distinct from <code>PERMISSIVE_RULE</code> so the diagnostic names the specific anti-pattern.</li>
+<li><strong>Fix</strong>: narrow the match path, or supply a real predicate.</li>
+</ul>
+<h2 id="differential-rules-require-previoussource">Differential rules (require <code>previousSource</code>)</h2>
+<h3 id="rules_weakened"><code>RULES_WEAKENED</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>warning</code>.</li>
+<li><strong>Activation</strong>: only fires when <code>options.previousSource</code> is passed.</li>
+<li><strong>Detection</strong>: per match block (matched by normalised path), per allow rule (matched by op-set), extract top-level conjuncts (split only on <code>&#x26;&#x26;</code>), and report every conjunct that existed before but is missing now.</li>
+<li><strong>Limitations</strong>: does not descend into <code>||</code> sub-trees, does not compare function bodies, does not detect “changed” predicates (a change reads as one removal plus a silent addition).</li>
+<li><strong>Fix</strong>: confirm the removal was intentional, then ignore the warning, or restore the predicate.</li>
+</ul>
+<h2 id="test-suite-coupled-rules-require-testcases">Test-suite-coupled rules (require <code>testCases</code>)</h2>
+<h3 id="request_time_not_pinned"><code>REQUEST_TIME_NOT_PINNED</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>warning</code>.</li>
+<li><strong>Activation</strong>: only fires when <code>options.testCases</code> is passed.</li>
+<li><strong>Detection</strong>: for each rule that transitively reads <code>request.time</code>, emit one warning per <code>TestCase</code> whose <code>path</code> matches the rule’s match path and which does not set <code>requestTime</code>.</li>
+<li><strong>Fix</strong>: set <code>requestTime</code> on the test case to an ISO-8601 string.</li>
+</ul>
+<p>See <a href="../pyric-rules-how-to-pin-request-time/">Pin <code>request.time</code> for deterministic tests</a>.</p>
+<h2 id="hallucination-and-syntax-hint-rules">Hallucination and syntax-hint rules</h2>
+<p>These catch JS-style code or look-alike syntax that parses (or fails to parse) with unhelpful messages.</p>
+<h3 id="invalid_operator"><code>INVALID_OPERATOR</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Detection</strong>: source contains a JS-style operator that has no Firestore equivalent: <code>===</code>, <code>!==</code>, <code>?.</code>, <code>??</code>, backtick template literals.</li>
+<li><strong>Runs</strong>: pre-parse. Fires even on unparseable input so the diagnostic is precise instead of “expected <code>)</code>”.</li>
+</ul>
+<h3 id="hallucinated_method"><code>HALLUCINATED_METHOD</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Detection</strong>: a method call that doesn’t exist in the Firestore rules surface (e.g. <code>.filter()</code>, <code>.map()</code>, <code>.toLowerCase()</code> on a string).</li>
+<li><strong>Fix</strong>: replace with the supported equivalent or restructure the predicate.</li>
+</ul>
+<h3 id="hallucinated_global"><code>HALLUCINATED_GLOBAL</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Detection</strong>: reference to a global identifier the engine doesn’t expose (e.g. <code>Math</code>, <code>JSON</code>).</li>
+<li><strong>Fix</strong>: remove the reference; the predicate has to use what <code>request</code>, <code>resource</code>, and the namespaces actually offer.</li>
+</ul>
+<h3 id="wrong_context_path"><code>WRONG_CONTEXT_PATH</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Detection</strong>: a <code>get()</code> or <code>exists()</code> whose path doesn’t start with <code>/databases/$(database)/documents/</code> or whose interpolation uses the wrong context.</li>
+<li><strong>Fix</strong>: use the standard form <code>get(/databases/$(database)/documents/&#x3C;collection>/$(id))</code>.</li>
+</ul>
+<h3 id="length_property"><code>LENGTH_PROPERTY</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Detection</strong>: <code>.length</code> access on a string or list (Firestore rules uses <code>.size()</code>).</li>
+<li><strong>Fix</strong>: replace <code>s.length</code> with <code>s.size()</code>.</li>
+</ul>
+<h3 id="invalid_path_interpolation"><code>INVALID_PATH_INTERPOLATION</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>error</code>.</li>
+<li><strong>Detection</strong>: a path literal segment in the form <code>{ident}</code>, a match-style binding used outside a match block. Firestore requires <code>$(ident)</code> for interpolation inside path literals.</li>
+<li><strong>Fix</strong>: replace <code>/users/{uid}</code> inside <code>get(...)</code> with <code>/users/$(uid)</code>.</li>
+</ul>
+<h3 id="method_missing_parens"><code>METHOD_MISSING_PARENS</code></h3>
+<ul>
+<li><strong>Severity</strong>: <code>warning</code>.</li>
+<li><strong>Detection</strong>: an identifier in expression position that looks like a method name without parentheses (e.g. <code>request.auth.uid.size</code> when <code>size</code> is a method).</li>
+<li><strong>Fix</strong>: add the parentheses: <code>request.auth.uid.size()</code>.</li>
+</ul>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#compilation-limit-rules">Compilation-limit rules</a> </li><li data-depth="3"> <a href="#source_size">SOURCE_SIZE</a> </li><li data-depth="3"> <a href="#chain_depth">CHAIN_DEPTH</a> </li><li data-depth="3"> <a href="#let_limit">LET_LIMIT</a> </li><li data-depth="2"> <a href="#runtime-budget-rules">Runtime-budget rules</a> </li><li data-depth="3"> <a href="#shared_gate">SHARED_GATE</a> </li><li data-depth="3"> <a href="#expression_budget">EXPRESSION_BUDGET</a> </li><li data-depth="3"> <a href="#call_depth">CALL_DEPTH</a> </li><li data-depth="3"> <a href="#get_count">GET_COUNT</a> </li><li data-depth="3"> <a href="#get_duplication">GET_DUPLICATION</a> </li><li data-depth="2"> <a href="#security-critical-rules">Security-critical rules</a> </li><li data-depth="3"> <a href="#permissive_rule">PERMISSIVE_RULE</a> </li><li data-depth="3"> <a href="#recursive_wildcard_open">RECURSIVE_WILDCARD_OPEN</a> </li><li data-depth="2"> <a href="#differential-rules-require-previoussource">Differential rules (require previousSource)</a> </li><li data-depth="3"> <a href="#rules_weakened">RULES_WEAKENED</a> </li><li data-depth="2"> <a href="#test-suite-coupled-rules-require-testcases">Test-suite-coupled rules (require testCases)</a> </li><li data-depth="3"> <a href="#request_time_not_pinned">REQUEST_TIME_NOT_PINNED</a> </li><li data-depth="2"> <a href="#hallucination-and-syntax-hint-rules">Hallucination and syntax-hint rules</a> </li><li data-depth="3"> <a href="#invalid_operator">INVALID_OPERATOR</a> </li><li data-depth="3"> <a href="#hallucinated_method">HALLUCINATED_METHOD</a> </li><li data-depth="3"> <a href="#hallucinated_global">HALLUCINATED_GLOBAL</a> </li><li data-depth="3"> <a href="#wrong_context_path">WRONG_CONTEXT_PATH</a> </li><li data-depth="3"> <a href="#length_property">LENGTH_PROPERTY</a> </li><li data-depth="3"> <a href="#invalid_path_interpolation">INVALID_PATH_INTERPOLATION</a> </li><li data-depth="3"> <a href="#method_missing_parens">METHOD_MISSING_PARENS</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script> </body> </html>

package/dist/serve/docs-ui/docs/pyric-rules-reference-lint-rules.md ADDED Viewed

@@ -0,0 +1,159 @@
+# Lint rules
+This page lists every lint rule emitted by `lint(source)` and `firestoreRules(source).lint()`, both from `pyric/rules`. Each rule surfaces as a `RuleIssue` with `origin: 'lint'` and `code` set to the rule name below. Each entry gives the rule code, default severity, what it detects, and the suggested fix.
+Severities have two values:
+- `error`: treat as a hard gate before shipping (CI / `firebase deploy`).
+- `warning`: advisory; does not block.
+Some rules adjust severity by threshold band; those entries note the bands explicitly.
+## Compilation-limit rules
+These catch sources that Firebase will reject with `400 INVALID_ARGUMENT` at deploy.
+### `SOURCE_SIZE`
+- **Severity**: `error`.
+- **Threshold**: source length > 256 × 1024 bytes (262 144).
+- **Detection**: byte length of the input string.
+- **Fix**: split into smaller match blocks, reduce string literals.
+### `CHAIN_DEPTH`
+- **Severity**: `warning` at chain depth ≥ 85, `error` at ≥ 95, `error` at ≥ 98.
+- **Threshold**: 98 (the exact compile limit).
+- **Detection**: the deepest flat `&&` or `||` chain in any function body or let value.
+- **Fix**: nest into groups. `a && b && c && d` → `(a && b) && (c && d)` halves the chain depth.
+### `LET_LIMIT`
+- **Severity**: `error`.
+- **Threshold**: 11 let bindings per function (12 fails the compile).
+- **Fix**: inline some let expressions into the return, or split the function in two.
+## Runtime-budget rules
+These catch sources that compile fine but exhaust the runtime evaluation budget for some inputs (silent `403`).
+### `SHARED_GATE`
+- **Severity**: `warning`.
+- **Detection**: two or more `allow` rules in the same match block whose first expression is structurally identical.
+- **Fix**: give each rule a unique discriminator (different `moveType`, different status check) so the engine can route to one rule and short-circuit out of the others.
+### `EXPRESSION_BUDGET`
+- **Severity**: `warning` (never `error`, because the runtime budget is non-deterministic).
+- **Threshold**: depends on function-call count, with conservative bands:
+  - 1 or 2 function calls → warn at ~100 total expression nodes.
+  - 3 function calls → warn at ~60.
+  - 4+ function calls → warn at ~40.
+- **Detection**: walk the rule's condition counting expression nodes, follow function calls transitively (each call visited at most once). Multiply by a discount factor for rules with many top-level `||` branches to avoid false positives on well-gated trees.
+- **Fix**: reduce the number of function calls, or restructure the predicate so fewer nodes are evaluated per request.
+### `CALL_DEPTH`
+- **Severity**: `warning` at depth ≥ 6, `error` at ≥ 10.
+- **Detection**: the deepest function-call chain reachable from a rule's condition through the static call graph.
+- **Fix**: inline intermediate helpers.
+### `GET_COUNT`
+- **Severity**: `warning` at ≥ 5, `error` at ≥ 10 (documented Firestore limit).
+- **Detection**: count of `get()` and `exists()` calls reachable from a rule's condition.
+- **Fix**: cache results via a `let` in a wrapper function. Same-path calls are cached by Firestore.
+### `GET_DUPLICATION`
+- **Severity**: `warning`.
+- **Detection**: a single function that contains a `get()` or `exists()` call is invoked two or more times from one rule.
+- **Fix**: wrap the calls in a helper that caches the result in a `let`.
+## Security-critical rules
+These flag patterns that *compile* but are almost always wrong.
+### `PERMISSIVE_RULE`
+- **Severity**: `error`.
+- **Detection**: a write rule (`write`, `create`, `update`, or `delete`) whose predicate folds to constant `true`. Folding handles boolean literals, `&&`/`||` of booleans, and `!` of a boolean. It does not try to prove `1 == 1` or follow function calls.
+- **Why error**: the most common agent failure mode is escaping a denial with `if true`. Blocking the deploy forces fixing the real denial.
+- **Fix**: replace the always-true predicate with a request-shape check.
+`allow read: if true` on a *read* rule is **not** flagged. It's a legitimate "public read" pattern.
+### `RECURSIVE_WILDCARD_OPEN`
+- **Severity**: `error`.
+- **Detection**: a match path containing a recursive wildcard (`{document=**}`) combined with an allow rule whose predicate folds to constant `true`.
+- **Why a separate code**: distinct from `PERMISSIVE_RULE` so the diagnostic names the specific anti-pattern.
+- **Fix**: narrow the match path, or supply a real predicate.
+## Differential rules (require `previousSource`)
+### `RULES_WEAKENED`
+- **Severity**: `warning`.
+- **Activation**: only fires when `options.previousSource` is passed.
+- **Detection**: per match block (matched by normalised path), per allow rule (matched by op-set), extract top-level conjuncts (split only on `&&`), and report every conjunct that existed before but is missing now.
+- **Limitations**: does not descend into `||` sub-trees, does not compare function bodies, does not detect "changed" predicates (a change reads as one removal plus a silent addition).
+- **Fix**: confirm the removal was intentional, then ignore the warning, or restore the predicate.
+## Test-suite-coupled rules (require `testCases`)
+### `REQUEST_TIME_NOT_PINNED`
+- **Severity**: `warning`.
+- **Activation**: only fires when `options.testCases` is passed.
+- **Detection**: for each rule that transitively reads `request.time`, emit one warning per `TestCase` whose `path` matches the rule's match path and which does not set `requestTime`.
+- **Fix**: set `requestTime` on the test case to an ISO-8601 string.
+See [Pin `request.time` for deterministic tests](../pyric-rules-how-to-pin-request-time/).
+## Hallucination and syntax-hint rules
+These catch JS-style code or look-alike syntax that parses (or fails to parse) with unhelpful messages.
+### `INVALID_OPERATOR`
+- **Severity**: `error`.
+- **Detection**: source contains a JS-style operator that has no Firestore equivalent: `===`, `!==`, `?.`, `??`, backtick template literals.
+- **Runs**: pre-parse. Fires even on unparseable input so the diagnostic is precise instead of "expected `)`".
+### `HALLUCINATED_METHOD`
+- **Severity**: `error`.
+- **Detection**: a method call that doesn't exist in the Firestore rules surface (e.g. `.filter()`, `.map()`, `.toLowerCase()` on a string).
+- **Fix**: replace with the supported equivalent or restructure the predicate.
+### `HALLUCINATED_GLOBAL`
+- **Severity**: `error`.
+- **Detection**: reference to a global identifier the engine doesn't expose (e.g. `Math`, `JSON`).
+- **Fix**: remove the reference; the predicate has to use what `request`, `resource`, and the namespaces actually offer.
+### `WRONG_CONTEXT_PATH`
+- **Severity**: `error`.
+- **Detection**: a `get()` or `exists()` whose path doesn't start with `/databases/$(database)/documents/` or whose interpolation uses the wrong context.
+- **Fix**: use the standard form `get(/databases/$(database)/documents/<collection>/$(id))`.
+### `LENGTH_PROPERTY`
+- **Severity**: `error`.
+- **Detection**: `.length` access on a string or list (Firestore rules uses `.size()`).
+- **Fix**: replace `s.length` with `s.size()`.
+### `INVALID_PATH_INTERPOLATION`
+- **Severity**: `error`.
+- **Detection**: a path literal segment in the form `{ident}`, a match-style binding used outside a match block. Firestore requires `$(ident)` for interpolation inside path literals.
+- **Fix**: replace `/users/{uid}` inside `get(...)` with `/users/$(uid)`.
+### `METHOD_MISSING_PARENS`
+- **Severity**: `warning`.
+- **Detection**: an identifier in expression position that looks like a method name without parentheses (e.g. `request.auth.uid.size` when `size` is a method).
+- **Fix**: add the parentheses: `request.auth.uid.size()`.

package/dist/serve/docs-ui/docs/pyric-rules-reference-simulator-context/index.html ADDED Viewed

@@ -0,0 +1,66 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Simulator context and result states · Pyric Studio</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.CQYSemvw.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/"> Overview </a><details class="docs-nav-group"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/" aria-current="true"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/" id="nav-group-overview"> Overview </a><details class="docs-nav-group" id="nav-group-run-locally"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-develop-with-firebase-apis"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-inspect-and-correct"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-inspect-the-sandbox"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-correct-security-rules"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-work-with-an-agent"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-verify-the-boundary"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-unchanged"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/" aria-current="true"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/pyric-rules/">pyric / rules</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span>Reference</span> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">Simulator context</span> </li> </ol> </nav>  <article class="prose">  <h1 id="simulator-context-and-result-states">Simulator context and result states</h1>
+<p>The simulator evaluates expressions against a <code>SimulationContext</code>. This page describes its shape and the three result states a test case can land in. <code>SimulationContext</code> and <code>evaluate</code> are engine-internal, reached through <code>pyric/rules/internal</code>; the public front door is <code>firestoreRules(source).simulate(cases)</code> / <code>.explain(oneCase)</code>, which builds and consumes this context internally and returns a <code>CaseResult</code> / <code>Explanation</code> instead. This page documents the internals for callers who need them directly, and to explain what the public result fields mean underneath.</p>
+<h2 id="simulationcontext"><code>SimulationContext</code></h2>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">interface</span><span style="color:#E5C07B"> SimulationContext</span><span style="color:#ABB2BF"> {</span></span>
+<span class="line"><span style="color:#E06C75">  request</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">SimRequest</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  resource</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">SimResource</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  mockDocuments</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Map</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">>>;</span></span>
+<span class="line"><span style="color:#E06C75">  pathVariables</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">>;</span></span>
+<span class="line"><span style="color:#E06C75">  functions</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Map</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">FunctionDef</span><span style="color:#ABB2BF">>;</span></span>
+<span class="line"><span style="color:#E06C75">  database</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  afterStatePath</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Path</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  afterState</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">> | </span><span style="color:#E5C07B">null</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  existsAfter</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">boolean</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p>You don’t construct this directly. <code>SimulateFirestoreRulesHandler.simulate</code> builds it from each case. The shape is documented because <code>evaluate(expression, ctx)</code> is exported from <code>pyric/rules/internal</code>, so callers writing custom evaluators do need to build it.</p>
+<h3 id="request-simrequest"><code>request: SimRequest</code></h3>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">interface</span><span style="color:#E5C07B"> SimRequest</span><span style="color:#ABB2BF"> {</span></span>
+<span class="line"><span style="color:#E06C75">  auth</span><span style="color:#ABB2BF">: { </span><span style="color:#E06C75">uid</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">; </span><span style="color:#E06C75">token</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">> } | </span><span style="color:#E5C07B">null</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  resource</span><span style="color:#ABB2BF">: { </span><span style="color:#E06C75">data</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">> };   </span><span style="color:#7F848E;font-style:italic">// proposed write payload</span></span>
+<span class="line"><span style="color:#E06C75">  method</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  path</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Path</span><span style="color:#ABB2BF">;          </span><span style="color:#7F848E;font-style:italic">// full Path including /databases/(default)/documents</span></span>
+<span class="line"><span style="color:#E06C75">  query</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">>;</span></span>
+<span class="line"><span style="color:#E06C75">  time</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Timestamp</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p>The rule sees this as <code>request</code>. <code>request.auth</code> is <code>null</code> for unauthenticated cases.</p>
+<h3 id="resource-simresource"><code>resource: SimResource</code></h3>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">interface</span><span style="color:#E5C07B"> SimResource</span><span style="color:#ABB2BF"> {</span></span>
+<span class="line"><span style="color:#E06C75">  data</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Record</span><span style="color:#ABB2BF">&#x3C;</span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">, </span><span style="color:#E5C07B">unknown</span><span style="color:#ABB2BF">>;   </span><span style="color:#7F848E;font-style:italic">// existing document data</span></span>
+<span class="line"><span style="color:#E06C75">  id</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;                      </span><span style="color:#7F848E;font-style:italic">// last segment of the path</span></span>
+<span class="line"><span style="color:#E06C75">  __name__</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">Path</span><span style="color:#ABB2BF">;                  </span><span style="color:#7F848E;font-style:italic">// full Path</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p>The rule sees this as <code>resource</code>. On <code>create</code>, <code>resource.data</code> is <code>{}</code> and <code>existsAfter</code> is <code>true</code> for the post-write doc.</p>
+<h3 id="mockdocuments"><code>mockDocuments</code></h3>
+<p>Keyed by the <em>full</em> document path (including the database prefix). <code>get()</code> and <code>exists()</code> look here first. Built from <code>TestCase.functionMocks</code>.</p>
+<h3 id="pathvariables"><code>pathVariables</code></h3>
+<p>The match-block wildcard bindings (e.g. <code>{ uid: 'alice' }</code> when matching <code>/users/{uid}</code> against <code>/users/alice</code>). Plus an injected <code>database: '(default)'</code>.</p>
+<h3 id="functions"><code>functions</code></h3>
+<p>Function definitions visible at the matched scope: parent-match functions, this-match functions, and any inlined modules.</p>
+<h3 id="afterstatepath-afterstate-existsafter"><code>afterStatePath</code>, <code>afterState</code>, <code>existsAfter</code></h3>
+<p>The projected post-write document for <code>getAfter()</code> / <code>existsAfter()</code>. When the rule calls those built-ins with <code>request.path</code>, they return <code>afterState</code> / <code>existsAfter</code>. With any other path they fall through to <code>get()</code> / <code>exists()</code> against the same data. Unrelated docs aren’t mutated by the write under evaluation.</p>
+<h2 id="result-states">Result states</h2>
+<p>Every case lands in one of three states. Internally these are the engine’s <code>PASSED</code> / <code>FAILED</code> / <code>UNSUPPORTED</code> <code>TestResult.state</code> values; on the public <code>CaseResult</code> (from <code>firestoreRules(source).simulate(cases)</code>) they show up as the <code>passed</code> and <code>unsupported</code> booleans plus a <code>decision: 'ALLOW' | 'DENY' | 'UNSUPPORTED'</code> field, and <code>SimulationSummary</code> tallies them into <code>passed</code> / <code>failed</code> / <code>unsupported</code> counts.</p>
+<h3 id="passed"><code>PASSED</code></h3>
+<p>The simulator’s decision matched the case’s <code>expectation</code>. The expected outcome was reached. On the public result: <code>passed: true</code>.</p>
+<h3 id="failed"><code>FAILED</code></h3>
+<p>The simulator’s decision was the opposite of <code>expectation</code>. The rule allowed when you expected deny, or denied when you expected allow. The <code>trace</code> field on the public <code>CaseResult</code> carries the rule-by-rule account of which rule decided.</p>
+<h3 id="unsupported"><code>UNSUPPORTED</code></h3>
+<p>The simulator encountered a feature it does not yet implement and chose to abstain rather than guess. <strong><code>UNSUPPORTED</code> is not <code>FAILED</code></strong>. The simulator is saying “the gap is on my side”. On the public result: <code>unsupported: true</code>, <code>passed: false</code>, tallied separately from <code>failed</code> in <code>SimulationSummary</code>.</p>
+<p>When you see <code>UNSUPPORTED</code>, you have three options:</p>
+<ol>
+<li>Trust the rule and skip the case in local CI.</li>
+<li>Reformulate the rule to avoid the unsupported feature.</li>
+<li>Route only the unsupported cases to the Firebase Rules Test API. See <a href="../pyric-rules-how-to-test-rules-against-firebase/">How to test rules against the Firebase Rules Test API</a>.</li>
+</ol>
+<p>The live Rules Test API never returns <code>UNSUPPORTED</code>. It uses the production engine and decides every case.</p>
+<h2 id="decision-precedence-within-a-match-block">Decision precedence within a match block</h2>
+<p>Multiple <code>allow</code> rules in the same match block use <strong>OR semantics</strong>:</p>
+<ul>
+<li>Any rule decides <code>ALLOW</code> → final decision is <code>ALLOW</code> (evaluation short-circuits).</li>
+<li>Otherwise, if any rule threw <code>UnsupportedError</code> → final decision is <code>UNSUPPORTED</code>.</li>
+<li>Otherwise → <code>DENY</code>.</li>
+</ul>
+<p>Real evaluation errors (<code>EvalError</code>, type mismatches) are caught and treated as that rule denying, matching production’s behaviour where runtime errors deny the request.</p>
+<h2 id="path-resolution">Path resolution</h2>
+<p>The simulator walks the AST from the root match (<code>/databases/{database}/documents</code>), trying each child’s path pattern against the test case’s path segments. The first child that consumes all segments wins. Recursive wildcards (<code>{x=**}</code>) consume every remaining segment in one bite.</p>
+<p>When no match block accepts the path, the case is treated as a deny (<code>PASSED</code> if <code>expectation === 'DENY'</code>, otherwise <code>FAILED</code>). The debug messages note <code>No match block found</code>.</p>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#simulationcontext">SimulationContext</a> </li><li data-depth="3"> <a href="#request-simrequest">request: SimRequest</a> </li><li data-depth="3"> <a href="#resource-simresource">resource: SimResource</a> </li><li data-depth="3"> <a href="#mockdocuments">mockDocuments</a> </li><li data-depth="3"> <a href="#pathvariables">pathVariables</a> </li><li data-depth="3"> <a href="#functions">functions</a> </li><li data-depth="3"> <a href="#afterstatepath-afterstate-existsafter">afterStatePath, afterState, existsAfter</a> </li><li data-depth="2"> <a href="#result-states">Result states</a> </li><li data-depth="3"> <a href="#passed">PASSED</a> </li><li data-depth="3"> <a href="#failed">FAILED</a> </li><li data-depth="3"> <a href="#unsupported">UNSUPPORTED</a> </li><li data-depth="2"> <a href="#decision-precedence-within-a-match-block">Decision precedence within a match block</a> </li><li data-depth="2"> <a href="#path-resolution">Path resolution</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script> </body> </html>