npm - @pyric/cli - Versions diffs - 0.1.0-alpha.9 - Mend

@pyric/cli 0.1.0-alpha.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1169) hide show

package/dist/serve/docs-ui/docs/pyric-storage-reference-rules-subset/index.html ADDED Viewed

@@ -0,0 +1,96 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Storage rules subset · Pyric Studio</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.CQYSemvw.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/"> Overview </a><details class="docs-nav-group"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/" aria-current="true"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/" id="nav-group-overview"> Overview </a><details class="docs-nav-group" id="nav-group-run-locally"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-develop-with-firebase-apis"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-inspect-and-correct"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-inspect-the-sandbox"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-correct-security-rules"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-work-with-an-agent"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-verify-the-boundary"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-unchanged"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/" aria-current="true"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/pyric-storage/">pyric / storage</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span>Reference</span> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">Storage rules subset</span> </li> </ol> </nav>  <article class="prose">  <h1 id="storage-rules-subset">Storage rules subset</h1>
+<p>The Storage rules grammar in the v1 scope. Anything not listed is out of scope and will produce a parse error.</p>
+<h2 id="service-header">Service header</h2>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="rules"><code><span class="line"><span style="color:#C678DD">service</span><span style="color:#ABB2BF"> firebase.storage {</span></span>
+<span class="line"><span style="color:#7F848E;font-style:italic">  // ...</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p>Required. Anything other than <code>firebase.storage</code> fails parsing.</p>
+<h2 id="path-matching">Path matching</h2>
+<p>Three segment types:</p>
+<ul>
+<li><strong>Static segments</strong>: <code>sessions</code>, <code>images</code>, <code>uploads</code>.</li>
+<li><strong>Single-segment parameters</strong>: <code>{sessionId}</code>, <code>{uid}</code>.</li>
+<li><strong>Multi-segment wildcards</strong>: <code>{allPaths=**}</code> matches the rest of the path.</li>
+</ul>
+<p>Nested <code>match</code> blocks compose naturally:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="rules"><code><span class="line"><span style="color:#C678DD">match</span><span style="color:#ABB2BF"> /b/</span><span style="color:#E06C75;font-style:italic">{bucket}</span><span style="color:#ABB2BF">/o {</span></span>
+<span class="line"><span style="color:#C678DD">  match</span><span style="color:#ABB2BF"> /users/</span><span style="color:#E06C75;font-style:italic">{uid}</span><span style="color:#ABB2BF"> {</span></span>
+<span class="line"><span style="color:#C678DD">    match</span><span style="color:#ABB2BF"> /private/</span><span style="color:#E06C75;font-style:italic">{file=**}</span><span style="color:#ABB2BF"> {</span></span>
+<span class="line"><span style="color:#C678DD">      allow</span><span style="color:#61AFEF"> read</span><span style="color:#ABB2BF">: </span><span style="color:#C678DD">if</span><span style="color:#E5C07B"> request</span><span style="color:#ABB2BF">.auth.uid == uid;</span></span>
+<span class="line"><span style="color:#ABB2BF">    }</span></span>
+<span class="line"><span style="color:#ABB2BF">  }</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p>Path variables bind to the surrounding scope: <code>uid</code> from the parent match is in scope in the inner allow condition.</p>
+<h2 id="allow-conditions">Allow conditions</h2>
+<p>Coarse umbrellas and granular verbs, matching production Storage semantics.</p>
+<ul>
+<li><code>allow read: if &#x3C;expr></code> — the umbrella for <code>get</code> + <code>list</code>.</li>
+<li><code>allow write: if &#x3C;expr></code> — the umbrella for <code>create</code> + <code>update</code> + <code>delete</code>.</li>
+<li><code>allow get</code> — <code>getBlob</code> / <code>getBytes</code> / <code>getMetadata</code>.</li>
+<li><code>allow list</code> — <code>listAll</code>.</li>
+<li><code>allow create</code> — <code>uploadBytes</code> / <code>uploadString</code> to a path with no existing object.</li>
+<li><code>allow update</code> — <code>uploadBytes</code> / <code>uploadString</code> over an existing object, and <code>updateMetadata</code>.</li>
+<li><code>allow delete</code> — <code>deleteObject</code>.</li>
+</ul>
+<p>A granular grant covers only its own verb: <code>allow get</code> does not grant <code>list</code>, and <code>allow create</code> does not grant <code>update</code> or <code>delete</code>. Verbs may be comma-separated in one clause (<code>allow get, list: if &#x3C;expr></code>). A verb with no applicable grant is denied.</p>
+<h2 id="rule-functions">Rule functions</h2>
+<p>User-defined functions are supported, including <code>let</code> bindings:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="rules"><code><span class="line"><span style="color:#C678DD">function</span><span style="color:#ABB2BF"> isOwner(uid) {</span></span>
+<span class="line"><span style="color:#C678DD">  let</span><span style="color:#ABB2BF"> owner = </span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.metadata[</span><span style="color:#98C379">'owner'</span><span style="color:#ABB2BF">];</span></span>
+<span class="line"><span style="color:#C678DD">  return</span><span style="color:#E5C07B"> request</span><span style="color:#ABB2BF">.auth != </span><span style="color:#D19A66">null</span><span style="color:#ABB2BF"> &#x26;&#x26; </span><span style="color:#E5C07B">request</span><span style="color:#ABB2BF">.auth.uid == owner;</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p>Recursion depth is capped; a function that errors mid-evaluation denies rather than throwing past the rule (deny-on-error).</p>
+<h2 id="request-bindings">Request bindings</h2>
+<ul>
+<li><code>request.auth</code>: <code>null</code> for anonymous, otherwise <code>{ uid, token }</code>.</li>
+<li><code>request.auth.uid</code>: string.</li>
+<li><code>request.auth.token['claim']</code>: bracket access on the token object.</li>
+<li><code>request.resource.size</code>: byte count of the proposed upload payload.</li>
+<li><code>request.resource.contentType</code>: MIME string of the proposed upload.</li>
+<li><code>request.method</code>: <code>'get'</code> / <code>'create'</code> / <code>'update'</code> / <code>'delete'</code>.</li>
+<li><code>request.path</code>: full path of the object.</li>
+<li><code>request.time</code>: a <code>Timestamp</code>. Compare with <code>timestamp.date(...)</code> literals or other <code>request.time</code> values.</li>
+</ul>
+<p>For deletes, <code>request.resource == null</code>. The carve-out lets delete rules accept <code>null</code> without confusing the parser. See <a href="../pyric-storage-how-to-enforce-rules/">Enforce Storage rules</a> for the pattern.</p>
+<h2 id="resource-bindings">Resource bindings</h2>
+<p>For existing objects:</p>
+<ul>
+<li><code>resource.size</code>: byte count.</li>
+<li><code>resource.contentType</code>: MIME string.</li>
+<li><code>resource.metadata</code>: custom metadata, accessible both by bracket (<code>resource.metadata['sessionId']</code>) and dotted form (<code>resource.metadata.sessionId</code>).</li>
+<li><code>resource.name</code>: the object’s <strong>full path within the bucket</strong> (<code>uploads/pic.png</code>) — the Cloud Storage object-name convention. This is not the client SDK’s <code>FullMetadata.name</code>, which is only the last path segment.</li>
+<li><code>resource.bucket</code>: the bucket the object resides in.</li>
+<li><code>resource.timeCreated</code> / <code>resource.updated</code>: the object’s creation and last-update timestamps. The update-time field is <code>updated</code>; the language has no <code>resource.timeUpdated</code>.</li>
+</ul>
+<p><code>duration.value(n, unit)</code> builds a duration, so a freshness window reads:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>allow delete: if request.time &#x3C; resource.timeCreated + duration.value(1, 'h');</span></span></code></pre>
+<p>Reading a field an object does not carry is an evaluation error, and an error <strong>denies</strong> — including through a negation, so <code>resource.name != 'x'</code> on an object with no name denies rather than allowing.</p>
+<h2 id="cross-service-lookups">Cross-service lookups</h2>
+<p><code>firestore.get(path)</code> and <code>firestore.exists(path)</code> read a Firestore document from inside a Storage rule, with <code>$(expr)</code> interpolation for dynamic path segments:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="rules"><code><span class="line"><span style="color:#C678DD">allow</span><span style="color:#61AFEF"> write</span><span style="color:#ABB2BF">: </span><span style="color:#C678DD">if</span><span style="color:#ABB2BF"> firestore.</span><span style="color:#56B6C2">exists</span><span style="color:#ABB2BF">(/databases/(default)/documents/sessions/$(</span><span style="color:#E5C07B">request</span><span style="color:#ABB2BF">.auth.uid));</span></span></code></pre>
+<h2 id="string-matching">String matching</h2>
+<p><code>matches()</code> does whole-string-anchored regex matching, evaluated with RE2 semantics. Constructs RE2 can’t express (backreferences, lookahead/lookbehind) are denied at parse time rather than silently mismatching.</p>
+<h2 id="operators">Operators</h2>
+<ul>
+<li><strong>Unary</strong>: <code>!</code>.</li>
+<li><strong>Binary</strong>: <code>&#x26;&#x26;</code>, <code>||</code>, <code>==</code>, <code>!=</code>, <code>&#x3C;</code>, <code>></code>, <code>&#x3C;=</code>, <code>>=</code>, <code>+</code>, <code>-</code>, <code>*</code>, <code>/</code>.</li>
+<li><strong>Parentheses</strong> for grouping.</li>
+<li><strong>Short-circuit</strong> evaluation matches Firestore’s rules engine.</li>
+</ul>
+<h2 id="literal-values">Literal values</h2>
+<p>Strings (<code>'...'</code> or <code>"..."</code>), numbers, booleans (<code>true</code> / <code>false</code>), <code>null</code>, <code>timestamp.date(...)</code>.</p>
+<h2 id="out-of-scope">Out of scope</h2>
+<p>These still produce parse or evaluation errors:</p>
+<ul>
+<li>The content-hash fields (<code>resource.md5Hash</code>, <code>resource.crc32c</code>, <code>resource.etag</code>).</li>
+<li>Regex constructs that RE2 can’t express inside <code>matches()</code>.</li>
+</ul>
+<p>See <a href="../pyric-storage-explanation-implementation-scope/">Implementation scope and deferred features</a> for the reasoning.</p>
+<h2 id="where-to-look-next">Where to look next</h2>
+<ul>
+<li>For testing rule expressions independently, see <a href="../pyric-storage-how-to-test-rule-expressions/">Test rule expressions independently</a>.</li>
+<li>For the engine’s evaluation contract (<code>evaluateStorageRules</code>), see <a href="../pyric-storage-reference-api/">Public API</a>.</li>
+<li>For the one known production-vs-evaluator divergence (a <code>resource == null</code>
+create edge case) and the oracle-capture evidence behind this page’s
+claims, see <a href="../pyric-storage-reference-conformance-gaps/">Storage rules evaluator conformance gaps</a>.</li>
+</ul>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#service-header">Service header</a> </li><li data-depth="2"> <a href="#path-matching">Path matching</a> </li><li data-depth="2"> <a href="#allow-conditions">Allow conditions</a> </li><li data-depth="2"> <a href="#rule-functions">Rule functions</a> </li><li data-depth="2"> <a href="#request-bindings">Request bindings</a> </li><li data-depth="2"> <a href="#resource-bindings">Resource bindings</a> </li><li data-depth="2"> <a href="#cross-service-lookups">Cross-service lookups</a> </li><li data-depth="2"> <a href="#string-matching">String matching</a> </li><li data-depth="2"> <a href="#operators">Operators</a> </li><li data-depth="2"> <a href="#literal-values">Literal values</a> </li><li data-depth="2"> <a href="#out-of-scope">Out of scope</a> </li><li data-depth="2"> <a href="#where-to-look-next">Where to look next</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script> </body> </html>

package/dist/serve/docs-ui/docs/pyric-storage-reference-rules-subset.md ADDED Viewed

@@ -0,0 +1,134 @@
+# Storage rules subset
+The Storage rules grammar in the v1 scope. Anything not listed is out of scope and will produce a parse error.
+## Service header
+```rules
+service firebase.storage {
+  // ...
+}
+```
+Required. Anything other than `firebase.storage` fails parsing.
+## Path matching
+Three segment types:
+- **Static segments**: `sessions`, `images`, `uploads`.
+- **Single-segment parameters**: `{sessionId}`, `{uid}`.
+- **Multi-segment wildcards**: `{allPaths=**}` matches the rest of the path.
+Nested `match` blocks compose naturally:
+```rules
+match /b/{bucket}/o {
+  match /users/{uid} {
+    match /private/{file=**} {
+      allow read: if request.auth.uid == uid;
+    }
+  }
+}
+```
+Path variables bind to the surrounding scope: `uid` from the parent match is in scope in the inner allow condition.
+## Allow conditions
+Coarse umbrellas and granular verbs, matching production Storage semantics.
+- `allow read: if <expr>` — the umbrella for `get` + `list`.
+- `allow write: if <expr>` — the umbrella for `create` + `update` + `delete`.
+- `allow get` — `getBlob` / `getBytes` / `getMetadata`.
+- `allow list` — `listAll`.
+- `allow create` — `uploadBytes` / `uploadString` to a path with no existing object.
+- `allow update` — `uploadBytes` / `uploadString` over an existing object, and `updateMetadata`.
+- `allow delete` — `deleteObject`.
+A granular grant covers only its own verb: `allow get` does not grant `list`, and `allow create` does not grant `update` or `delete`. Verbs may be comma-separated in one clause (`allow get, list: if <expr>`). A verb with no applicable grant is denied.
+## Rule functions
+User-defined functions are supported, including `let` bindings:
+```rules
+function isOwner(uid) {
+  let owner = resource.metadata['owner'];
+  return request.auth != null && request.auth.uid == owner;
+}
+```
+Recursion depth is capped; a function that errors mid-evaluation denies rather than throwing past the rule (deny-on-error).
+## Request bindings
+- `request.auth`: `null` for anonymous, otherwise `{ uid, token }`.
+- `request.auth.uid`: string.
+- `request.auth.token['claim']`: bracket access on the token object.
+- `request.resource.size`: byte count of the proposed upload payload.
+- `request.resource.contentType`: MIME string of the proposed upload.
+- `request.method`: `'get'` / `'create'` / `'update'` / `'delete'`.
+- `request.path`: full path of the object.
+- `request.time`: a `Timestamp`. Compare with `timestamp.date(...)` literals or other `request.time` values.
+For deletes, `request.resource == null`. The carve-out lets delete rules accept `null` without confusing the parser. See [Enforce Storage rules](../pyric-storage-how-to-enforce-rules/) for the pattern.
+## Resource bindings
+For existing objects:
+- `resource.size`: byte count.
+- `resource.contentType`: MIME string.
+- `resource.metadata`: custom metadata, accessible both by bracket (`resource.metadata['sessionId']`) and dotted form (`resource.metadata.sessionId`).
+- `resource.name`: the object's **full path within the bucket** (`uploads/pic.png`) — the Cloud Storage object-name convention. This is not the client SDK's `FullMetadata.name`, which is only the last path segment.
+- `resource.bucket`: the bucket the object resides in.
+- `resource.timeCreated` / `resource.updated`: the object's creation and last-update timestamps. The update-time field is `updated`; the language has no `resource.timeUpdated`.
+`duration.value(n, unit)` builds a duration, so a freshness window reads:
+```
+allow delete: if request.time < resource.timeCreated + duration.value(1, 'h');
+```
+Reading a field an object does not carry is an evaluation error, and an error **denies** — including through a negation, so `resource.name != 'x'` on an object with no name denies rather than allowing.
+## Cross-service lookups
+`firestore.get(path)` and `firestore.exists(path)` read a Firestore document from inside a Storage rule, with `$(expr)` interpolation for dynamic path segments:
+```rules
+allow write: if firestore.exists(/databases/(default)/documents/sessions/$(request.auth.uid));
+```
+## String matching
+`matches()` does whole-string-anchored regex matching, evaluated with RE2 semantics. Constructs RE2 can't express (backreferences, lookahead/lookbehind) are denied at parse time rather than silently mismatching.
+## Operators
+- **Unary**: `!`.
+- **Binary**: `&&`, `||`, `==`, `!=`, `<`, `>`, `<=`, `>=`, `+`, `-`, `*`, `/`.
+- **Parentheses** for grouping.
+- **Short-circuit** evaluation matches Firestore's rules engine.
+## Literal values
+Strings (`'...'` or `"..."`), numbers, booleans (`true` / `false`), `null`, `timestamp.date(...)`.
+## Out of scope
+These still produce parse or evaluation errors:
+- The content-hash fields (`resource.md5Hash`, `resource.crc32c`, `resource.etag`).
+- Regex constructs that RE2 can't express inside `matches()`.
+See [Implementation scope and deferred features](../pyric-storage-explanation-implementation-scope/) for the reasoning.
+## Where to look next
+- For testing rule expressions independently, see [Test rule expressions independently](../pyric-storage-how-to-test-rule-expressions/).
+- For the engine's evaluation contract (`evaluateStorageRules`), see [Public API](../pyric-storage-reference-api/).
+- For the one known production-vs-evaluator divergence (a `resource == null`
+  create edge case) and the oracle-capture evidence behind this page's
+  claims, see [Storage rules evaluator conformance gaps](../pyric-storage-reference-conformance-gaps/).

package/dist/serve/docs-ui/docs/pyric-storage-reference-storage-options/index.html ADDED Viewed

@@ -0,0 +1,39 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>StorageOptions · Pyric Studio</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.CQYSemvw.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/"> Overview </a><details class="docs-nav-group"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/" aria-current="true"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/" id="nav-group-overview"> Overview </a><details class="docs-nav-group" id="nav-group-run-locally"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-develop-with-firebase-apis"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-inspect-and-correct"> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-inspect-the-sandbox"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-correct-security-rules"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-work-with-an-agent"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-verify-the-boundary"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-unchanged"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference" open> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/" aria-current="true"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/pyric-storage/">pyric / storage</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span>Reference</span> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">StorageOptions</span> </li> </ol> </nav>  <article class="prose">  <h1 id="storageoptions"><code>StorageOptions</code></h1>
+<p>The options bag for <code>getStorageSandbox(target, options?)</code>.</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">interface</span><span style="color:#E5C07B"> StorageOptions</span><span style="color:#ABB2BF"> {</span></span>
+<span class="line"><span style="color:#E06C75">  bucket</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  dbName</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#E06C75">  rules</span><span style="color:#C678DD">?</span><span style="color:#ABB2BF">: </span><span style="color:#E5C07B">string</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<h2 id="bucket"><code>bucket</code></h2>
+<p>The bucket identifier recorded in <code>metadata.bucket</code> on upload. v1 has a single implicit bucket: passing different values doesn’t isolate data, but it round-trips through metadata.</p>
+<p>Default: a stable internal value (<code>pyric-default</code> historically).</p>
+<p>When real multi-bucket support lands, this option will partition data. For the v1 scope, treat it as a label, not a partition.</p>
+<h2 id="dbname"><code>dbName</code></h2>
+<p>The IndexedDB database name. Tests pass a per-case unique name so state doesn’t leak between runs:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">const</span><span style="color:#E5C07B"> storage</span><span style="color:#56B6C2"> =</span><span style="color:#61AFEF"> getStorageSandbox</span><span style="color:#ABB2BF">(</span><span style="color:#E5C07B">sandbox</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">withAuth</span><span style="color:#ABB2BF">(</span><span style="color:#D19A66">null</span><span style="color:#ABB2BF">), {</span></span>
+<span class="line"><span style="color:#E06C75">  dbName</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">`test-</span><span style="color:#C678DD">${</span><span style="color:#E5C07B">crypto</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">randomUUID</span><span style="color:#ABB2BF">()</span><span style="color:#C678DD">}</span><span style="color:#98C379">`</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#ABB2BF">});</span></span></code></pre>
+<p>Only takes effect on the <strong>first</strong> <code>getStorageSandbox</code> call per <code>Sandbox</code>. Subsequent calls return the cached handle bound to the original <code>dbName</code>. To change the IndexedDB name, build a new sandbox.</p>
+<h2 id="rules"><code>rules</code></h2>
+<p>Storage rules source, parsed eagerly at config time. Malformed sources throw a <code>SyntaxError</code> from the parser before the handle is returned. Fail fast.</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#C678DD">const</span><span style="color:#E5C07B"> storage</span><span style="color:#56B6C2"> =</span><span style="color:#61AFEF"> getStorageSandbox</span><span style="color:#ABB2BF">(</span><span style="color:#E5C07B">sandbox</span><span style="color:#ABB2BF">.</span><span style="color:#61AFEF">withAuth</span><span style="color:#ABB2BF">({ </span><span style="color:#E06C75">uid</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">'alice'</span><span style="color:#ABB2BF"> }), {</span></span>
+<span class="line"><span style="color:#E06C75">  rules</span><span style="color:#ABB2BF">: </span><span style="color:#98C379">`service firebase.storage {</span></span>
+<span class="line"><span style="color:#98C379">    match /b/{bucket}/o {</span></span>
+<span class="line"><span style="color:#98C379">      match /sessions/{id} {</span></span>
+<span class="line"><span style="color:#98C379">        allow write: if request.auth != null</span></span>
+<span class="line"><span style="color:#98C379">                     &#x26;&#x26; request.resource.size &#x3C; 10 * 1024 * 1024;</span></span>
+<span class="line"><span style="color:#98C379">        allow read: if request.auth != null;</span></span>
+<span class="line"><span style="color:#98C379">      }</span></span>
+<span class="line"><span style="color:#98C379">    }</span></span>
+<span class="line"><span style="color:#98C379">  }`</span><span style="color:#ABB2BF">,</span></span>
+<span class="line"><span style="color:#ABB2BF">});</span></span></code></pre>
+<p>Only takes effect on the <strong>first</strong> call per <code>Sandbox</code>. Subsequent calls return the cached handle with the original rules. To change rules, build a new sandbox.</p>
+<p>If <code>rules</code> is omitted, the storage handle accepts every operation (anonymous and authenticated alike). Useful for non-rule-related tests but explicitly insecure. Set rules whenever the test is about access control.</p>
+<p>See <a href="../pyric-storage-reference-rules-subset/">Storage rules subset</a> for the supported grammar.</p>
+<h2 id="what-is-not-a-storageoptions-field">What is <em>not</em> a <code>StorageOptions</code> field</h2>
+<ul>
+<li><strong>Per-call auth overrides</strong>. The handle’s auth comes from the <code>SandboxContext</code> passed to <code>getStorageSandbox</code>. To act as a different user, derive a new context.</li>
+<li><strong>Per-call bucket overrides</strong>. The bucket is fixed at handle construction. If you need to test multi-bucket scenarios, build multiple handles.</li>
+<li><strong>Persistence settings</strong>. The sandbox uses IndexedDB; the choice is internal.</li>
+</ul>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#bucket">bucket</a> </li><li data-depth="2"> <a href="#dbname">dbName</a> </li><li data-depth="2"> <a href="#rules">rules</a> </li><li data-depth="2"> <a href="#what-is-not-a-storageoptions-field">What is not a StorageOptions field</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script> </body> </html>

package/dist/serve/docs-ui/docs/pyric-storage-reference-storage-options.md ADDED Viewed

@@ -0,0 +1,61 @@
+# `StorageOptions`
+The options bag for `getStorageSandbox(target, options?)`.
+```ts
+interface StorageOptions {
+  bucket?: string;
+  dbName?: string;
+  rules?: string;
+}
+```
+## `bucket`
+The bucket identifier recorded in `metadata.bucket` on upload. v1 has a single implicit bucket: passing different values doesn't isolate data, but it round-trips through metadata.
+Default: a stable internal value (`pyric-default` historically).
+When real multi-bucket support lands, this option will partition data. For the v1 scope, treat it as a label, not a partition.
+## `dbName`
+The IndexedDB database name. Tests pass a per-case unique name so state doesn't leak between runs:
+```ts
+const storage = getStorageSandbox(sandbox.withAuth(null), {
+  dbName: `test-${crypto.randomUUID()}`,
+});
+```
+Only takes effect on the **first** `getStorageSandbox` call per `Sandbox`. Subsequent calls return the cached handle bound to the original `dbName`. To change the IndexedDB name, build a new sandbox.
+## `rules`
+Storage rules source, parsed eagerly at config time. Malformed sources throw a `SyntaxError` from the parser before the handle is returned. Fail fast.
+```ts
+const storage = getStorageSandbox(sandbox.withAuth({ uid: 'alice' }), {
+  rules: `service firebase.storage {
+    match /b/{bucket}/o {
+      match /sessions/{id} {
+        allow write: if request.auth != null
+                     && request.resource.size < 10 * 1024 * 1024;
+        allow read: if request.auth != null;
+      }
+    }
+  }`,
+});
+```
+Only takes effect on the **first** call per `Sandbox`. Subsequent calls return the cached handle with the original rules. To change rules, build a new sandbox.
+If `rules` is omitted, the storage handle accepts every operation (anonymous and authenticated alike). Useful for non-rule-related tests but explicitly insecure. Set rules whenever the test is about access control.
+See [Storage rules subset](../pyric-storage-reference-rules-subset/) for the supported grammar.
+## What is *not* a `StorageOptions` field
+- **Per-call auth overrides**. The handle's auth comes from the `SandboxContext` passed to `getStorageSandbox`. To act as a different user, derive a new context.
+- **Per-call bucket overrides**. The bucket is fixed at handle construction. If you need to test multi-bucket scenarios, build multiple handles.
+- **Persistence settings**. The sandbox uses IndexedDB; the choice is internal.

package/dist/serve/docs-ui/docs/pyric-storage.md ADDED Viewed

@@ -0,0 +1,67 @@
+# `pyric/storage`
+Firebase Storage mirror for the Pyric sandbox. Its modular Web-SDK shape (`getStorage`, `ref`, `uploadBytes`, `getBytes`, `getDownloadURL`, `listAll`, `deleteObject`) is backed by IndexedDB. Production selection happens outside this package: normal builds resolve `firebase/storage`, while Pyric development swaps that import to this sandbox mirror.
+Built for the agent-session-archive use case. The scope is bounded; the architecture validates the broader pattern for adding file-based services to `pyric/sandbox`.
+## V1 scope status
+This package implements a deliberate subset of Firebase Storage. See [Implementation scope and deferred features](../pyric-storage-explanation-implementation-scope/) before adopting in production-style code.
+## Install
+```bash
+bun add pyric/storage pyric/sandbox
+# or
+npm install pyric/storage pyric/sandbox
+```
+## A 30-second example
+```ts
+import { initializeSandbox } from 'pyric/sandbox';
+import { getStorageSandbox, ref, uploadBytes, getBlob } from 'pyric/storage';
+const sandbox = initializeSandbox();
+const storage = getStorageSandbox(sandbox.withAuth({ uid: 'alice' }));
+await uploadBytes(
+  ref(storage, 'sessions/gen-123'),
+  new Blob(['{"task":"build a notes app"}']),
+  { contentType: 'application/json' },
+);
+const blob = await getBlob(ref(storage, 'sessions/gen-123'));
+console.log(await blob.text());
+```
+## Control-plane surface
+Beyond the data-plane adapter, the package exports a control-plane surface for provisioning and managing real Cloud Storage buckets: `provisionStorage`, `getStorageServiceState`, `enableStorageService`, bucket listing, CORS management (`getBucketCors` / `setBucketCors`), and `deployStorageRules`. Alongside those sits `createStorageAdminTools`, a `ToolHandler[]` factory for an `@inbrowser/agent` registry. It also ships a local Storage rules engine (`parseStorageRules` / `evaluateStorageRules`).
+## Where to go next
+This documentation follows the [Diataxis](https://diataxis.fr/) framework:
+| If you want to | Read |
+|---|---|
+| Follow a complete lesson | Tutorials |
+| Accomplish a specific task | How-to guides |
+| Look up signatures and options | Reference |
+| Understand scope and design choices | Explanation |
+### Starting points
+- **Upload + download flow**: [Upload and download a session archive](../store-files/).
+- **Enforcing rules**: [Enforce Storage rules](../pyric-storage-how-to-enforce-rules/).
+- **Knowing what's deferred**: [Implementation scope and deferred features](../pyric-storage-explanation-implementation-scope/).
+## Position in the Pyric stack
+`pyric/storage` is the sandbox **storage data-plane adapter** (plus a thin control plane). It depends on `pyric/sandbox` for identity and lifecycle, `@pyric/cli` for package-level activation, and `@inbrowser/agent` for the tool-factory contract. It exposes the modular Web SDK's Storage surface without importing the production implementation.
+The package's rules engine is local to the package. Storage rules use a different DSL from Firestore rules, so unlike `pyric/firestore` (which depends on `pyric/rules`), this package keeps the Storage-specific parser and evaluator in-tree.
+## Licence
+Same as the parent workspace.