@pyric/cli 0.1.0-alpha.9

package/dist/cli/mcp-proxy.js

@@ -0,0 +1,129 @@
+import { discoverServe, SCAN_PORTS } from '../serve/discovery.js';
+// Discovery (pointer + identity-pinned health probing) lives in
+// `serve/discovery.ts` — shared with the Node remote-sandbox client
+// (`remote/index.ts`). Re-exported here for existing consumers.
+export { discoverServe } from '../serve/discovery.js';
+/** A relayed request with no response within this window is failed with a
+ *  JSON-RPC error rather than hanging forever. Sits just above the bridge's
+ *  own 30s `callTimeoutMs` so a legitimately-slow tool still completes. */
+const REQUEST_TIMEOUT_MS = 35_000;
+/** JSON-RPC error code for proxy-synthesized failures (server-defined range). */
+const PROXY_ERROR_CODE = -32001;
+// ── JSON-RPC shape helpers (relay-level; no SDK runtime import) ──────────────
+function msgId(m) {
+    return 'id' in m && m.id != null ? m.id : null;
+}
+/** A request expects a response (has both `id` and `method`). */
+function isRequest(m) {
+    return 'method' in m && msgId(m) != null;
+}
+/** A response/error answers a request (has `id`, no `method`). */
+function isResponse(m) {
+    return !('method' in m) && msgId(m) != null;
+}
+export async function runMcpProxy(_parsed, cwd = process.cwd(), deps = {}) {
+    // NB: stdout is the MCP stdio channel — diagnostics go to stderr ONLY.
+    const log = (m) => {
+        process.stderr.write(`[pyric mcp-proxy] ${m}\n`);
+    };
+    const found = await (deps.discover ?? discoverServe)(cwd, log);
+    if (!found) {
+        // Hybrid mode (design rationale): no dev server to attach to, so host the
+        // sandbox IN this process. Zero setup, no browser tab required. A running
+        // `pyric dev --bridge` upgrades to the shared-live experience on reconnect.
+        log('no running `pyric dev --bridge` found (looked for .pyric/serve.json and ports ' +
+            `${SCAN_PORTS.join(', ')}); starting a headless in-process sandbox (zero-setup).\n` +
+            '  Data persists to .pyric/state/headless.json. For a shared-live Studio\n' +
+            '  session, start `pyric dev --bridge` BEFORE connecting the agent (a dev server\n' +
+            '  started mid-session does not yet adopt this headless data).');
+        const headless = deps.headless ??
+            ((c) => import('../bridge/server/headless.js').then((m) => m.runHeadlessMcp(c)));
+        return await headless(cwd);
+    }
+    log(`relaying stdio ↔ ${found.mcpUrl} (via ${found.source}; attached to a running serve)`);
+    // Late, dynamic imports: the SDK is heavy and only needed here.
+    const { StdioServerTransport } = await import('@modelcontextprotocol/sdk/server/stdio.js');
+    const { StreamableHTTPClientTransport } = await import('@modelcontextprotocol/sdk/client/streamableHttp.js');
+    const http = new StreamableHTTPClientTransport(new URL(found.mcpUrl));
+    const stdio = new StdioServerTransport();
+    return await new Promise((resolveExit) => {
+        let closing = false;
+        /** In-flight relayed requests → their timeout timers. */
+        const pending = new Map();
+        /** Ids already failed by a timeout — used to SWALLOW a late real response so
+         *  Claude Code never sees a duplicate (error frame, then result frame). */
+        const settled = new Set();
+        const sendStdio = (m) => {
+            void stdio.send(m).catch((e) => log(`→client send failed: ${e}`));
+        };
+        const failRequest = (id, message) => {
+            const timer = pending.get(id);
+            if (timer)
+                clearTimeout(timer);
+            pending.delete(id);
+            settled.add(id);
+            sendStdio({ jsonrpc: '2.0', id, error: { code: PROXY_ERROR_CODE, message } });
+        };
+        const shutdown = (code) => {
+            if (closing)
+                return; // re-entrancy guard: close() fires onclose → shutdown → …
+            closing = true;
+            process.stdin.off('end', onStdinEnd);
+            for (const t of pending.values())
+                clearTimeout(t);
+            pending.clear();
+            void Promise.allSettled([stdio.close(), http.close()]).then(() => resolveExit(code));
+        };
+        // ── relay: stdio (Claude Code) → http (serve) ──
+        stdio.onmessage = (msg) => {
+            if (isRequest(msg)) {
+                const id = msgId(msg);
+                const timer = setTimeout(() => {
+                    failRequest(id, `pyric mcp-proxy: no response from serve within ${REQUEST_TIMEOUT_MS / 1000}s ` +
+                        `(the server may have stopped, or no browser tab is connected). ` +
+                        `Reopen the dev URL and retry.`);
+                }, REQUEST_TIMEOUT_MS);
+                pending.set(id, timer);
+            }
+            void http.send(msg).catch((e) => {
+                log(`→serve send failed: ${e}`);
+                const id = msgId(msg);
+                if (id != null && pending.has(id))
+                    failRequest(id, 'pyric mcp-proxy: failed to reach serve — retry.');
+            });
+        };
+        // ── relay: http (serve) → stdio (Claude Code) ──
+        http.onmessage = (msg) => {
+            if (isResponse(msg)) {
+                const id = msgId(msg);
+                const timer = pending.get(id);
+                if (timer) {
+                    clearTimeout(timer);
+                    pending.delete(id);
+                }
+                else if (settled.has(id)) {
+                    // A response that lost the race to its timeout — already failed to the
+                    // client. Swallow it so the client never sees a duplicate frame.
+                    settled.delete(id);
+                    return;
+                }
+            }
+            sendStdio(msg);
+        };
+        http.onerror = (e) => log(`serve transport error: ${e instanceof Error ? e.message : String(e)}`);
+        http.onclose = () => {
+            log('serve closed the connection (did serve stop?)');
+            shutdown(0);
+        };
+        stdio.onclose = () => shutdown(0); // Claude Code disconnected
+        const onStdinEnd = () => shutdown(0);
+        process.stdin.once('end', onStdinEnd);
+        process.once('SIGINT', () => shutdown(0));
+        process.once('SIGTERM', () => shutdown(0));
+        Promise.all([http.start(), stdio.start()]).catch((e) => {
+            log(`failed to start relay: ${e instanceof Error ? e.message : String(e)}`);
+            shutdown(1);
+        });
+    });
+}
+//# sourceMappingURL=mcp-proxy.js.map

package/dist/cli/mcp-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-proxy.js","sourceRoot":"","sources":["../../src/cli/mcp-proxy.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAElE,gEAAgE;AAChE,oEAAoE;AACpE,gEAAgE;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD;;2EAE2E;AAC3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAEhC,gFAAgF;AAChF,SAAS,KAAK,CAAC,CAAiB;IAC9B,OAAO,IAAI,IAAI,CAAC,IAAK,CAAsB,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAE,CAA6B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AACD,iEAAiE;AACjE,SAAS,SAAS,CAAC,CAAiB;IAClC,OAAO,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC3C,CAAC;AACD,kEAAkE;AAClE,SAAS,UAAU,CAAC,CAAiB;IACnC,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAmB,EACnB,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAAqB,EAAE;IAEvB,uEAAuE;IACvE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,GAAG,CACD,gFAAgF;YAC9E,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,2DAA2D;YACnF,2EAA2E;YAC3E,mFAAmF;YACnF,+DAA+D,CAClE,CAAC;QACF,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ;YACb,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,OAAO,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,GAAG,CAAC,oBAAoB,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,MAAM,gCAAgC,CAAC,CAAC;IAE3F,gEAAgE;IAChE,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;IAC3F,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CACpD,oDAAoD,CACrD,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEzC,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,WAAW,EAAE,EAAE;QAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkD,CAAC;QAC1E;mFAC2E;QAC3E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;QAE3C,MAAM,SAAS,GAAG,CAAC,CAAiB,EAAQ,EAAE;YAC5C,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,CAAC,EAAmB,EAAE,OAAe,EAAQ,EAAE;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAoB,CAAC,CAAC;QAClG,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO,CAAC,0DAA0D;YAC/E,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE;gBAAE,YAAY,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QACvF,CAAC,CAAC;QAEF,kDAAkD;QAClD,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,WAAW,CACT,EAAE,EACF,kDAAkD,kBAAkB,GAAG,IAAI,IAAI;wBAC7E,iEAAiE;wBACjE,+BAA+B,CAClC,CAAC;gBACJ,CAAC,EAAE,kBAAkB,CAAC,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;YACD,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC9B,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;gBAChC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,EAAE,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,WAAW,CAAC,EAAE,EAAE,iDAAiD,CAAC,CAAC;YACxG,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,kDAAkD;QAClD,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE;YACvB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,KAAK,EAAE,CAAC;oBACV,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACrB,CAAC;qBAAM,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC3B,uEAAuE;oBACvE,iEAAiE;oBACjE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACnB,OAAO;gBACT,CAAC;YACH,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC,CAAC;QAEF,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE;YAClB,GAAG,CAAC,+CAA+C,CAAC,CAAC;YACrD,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC;QACF,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B;QAC9D,MAAM,UAAU,GAAG,GAAS,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAEtC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3C,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YACrD,GAAG,CAAC,0BAA0B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5E,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/parse-args.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Minimal CLI argument parser shared across subcommands.
+ *
+ * Intentionally tiny — no `commander` / `yargs` dependency. The parser
+ * is biased toward Firebase-style flag syntax (`--flag value` and
+ * `--flag=value`); short flags are single-char booleans. Anything
+ * beyond a "command + positionals + flags" model belongs in a
+ * dedicated subcommand handler, not here.
+ */
+export interface ParsedArgs {
+    subcommand: string | null;
+    flags: Map<string, FlagValue>;
+    positional: string[];
+    /** Everything after a bare `--`, verbatim (e.g. `pyric dev -- npm start`).
+     *  Optional so hand-built ParsedArgs literals stay valid. */
+    passthrough?: string[];
+}
+export type FlagValue = string | boolean | Array<string | boolean>;
+export declare function parseArgs(argv: string[]): ParsedArgs;
+//# sourceMappingURL=parse-args.d.ts.map

package/dist/cli/parse-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-args.d.ts","sourceRoot":"","sources":["../../src/cli/parse-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;iEAC6D;IAC7D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;AAEnE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAyCpD"}

package/dist/cli/parse-args.js

@@ -0,0 +1,69 @@
+/**
+ * Minimal CLI argument parser shared across subcommands.
+ *
+ * Intentionally tiny — no `commander` / `yargs` dependency. The parser
+ * is biased toward Firebase-style flag syntax (`--flag value` and
+ * `--flag=value`); short flags are single-char booleans. Anything
+ * beyond a "command + positionals + flags" model belongs in a
+ * dedicated subcommand handler, not here.
+ */
+export function parseArgs(argv) {
+    const flags = new Map();
+    const positional = [];
+    const passthrough = [];
+    let subcommand = null;
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        if (arg === undefined) {
+            i += 1;
+            continue;
+        }
+        if (arg === '--') {
+            // Everything after a bare `--` belongs to the child command, verbatim
+            // — never parsed as flags (`pyric dev -- npm start --port 3000`).
+            passthrough.push(...argv.slice(i + 1).filter((a) => a !== undefined));
+            break;
+        }
+        if (arg.startsWith('--')) {
+            const eq = arg.indexOf('=');
+            if (eq !== -1) {
+                setFlag(flags, arg.slice(2, eq), arg.slice(eq + 1));
+            }
+            else {
+                const next = argv[i + 1];
+                if (next && !next.startsWith('-')) {
+                    setFlag(flags, arg.slice(2), next);
+                    i += 1;
+                }
+                else {
+                    setFlag(flags, arg.slice(2), true);
+                }
+            }
+        }
+        else if (arg.startsWith('-')) {
+            setFlag(flags, arg.slice(1), true);
+        }
+        else if (subcommand === null) {
+            subcommand = arg;
+        }
+        else {
+            positional.push(arg);
+        }
+        i += 1;
+    }
+    return { subcommand, flags, positional, passthrough };
+}
+function setFlag(flags, key, value) {
+    const current = flags.get(key);
+    if (current === undefined) {
+        flags.set(key, value);
+    }
+    else if (Array.isArray(current)) {
+        current.push(value);
+    }
+    else {
+        flags.set(key, [current, value]);
+    }
+}
+//# sourceMappingURL=parse-args.js.map

package/dist/cli/parse-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-args.js","sourceRoot":"","sources":["../../src/cli/parse-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,sEAAsE;YACtE,kEAAkE;YAClE,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;YACnF,MAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzB,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBACnC,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YAC/B,UAAU,GAAG,GAAG,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,OAAO,CAAC,KAA6B,EAAE,GAAW,EAAE,KAAuB;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC"}

package/dist/cli/rules.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `pyric firestore rules *` subcommands — thin wrappers over `pyric/rules`.
+ *
+ *   - `firestore rules lint <path>` runs the AST linter, prints findings JSON.
+ *   - `firestore rules validate <path>` runs the structural validator, prints
+ *     findings JSON.
+ *   - `firestore rules simulate` runs the local simulator. With no flags it
+ *     reads `firebase.json` for the rules path and runs a single
+ *     allow-anonymous sanity test. With `--stdin` it reads a JSON
+ *     request `{ source?, testCases }` from stdin instead — the way
+ *     CI pipes in a fully scripted simulation.
+ *
+ * All three exit 0 on success, 1 on usage / file-read error, 2 on
+ * library failure (parse error etc.).
+ */
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { lintFirestoreRules, validateFirestoreRules, type TestCase, type TestFirestoreRulesResult } from 'pyric/rules/internal';
+import { resolveModules } from 'pyric/rules/internal/node';
+import type { ParsedArgs } from './parse-args.js';
+import { type FirebaseJson } from './firebase-json.js';
+export interface RulesDeps {
+    readFile?: typeof readFile;
+    readFirebaseJson?: (cwd: string) => Promise<FirebaseJson>;
+    lintFirestoreRules?: typeof lintFirestoreRules;
+    validateFirestoreRules?: typeof validateFirestoreRules;
+    simulate?: (source: string, cases: TestCase[]) => TestFirestoreRulesResult;
+    /** Override cwd — used in tests. */
+    cwd?: string;
+    /** Override stdin reader — used in tests. */
+    readStdin?: () => Promise<string>;
+    stdout?: {
+        write(s: string): void;
+    };
+    stderr?: {
+        write(s: string): void;
+    };
+}
+export interface ResolveRulesDeps {
+    readFile?: typeof readFile;
+    writeFile?: typeof writeFile;
+    mkdir?: typeof mkdir;
+    resolveModules?: typeof resolveModules;
+    cwd?: string;
+    stdout?: {
+        write(s: string): void;
+    };
+    stderr?: {
+        write(s: string): void;
+    };
+}
+export declare function runRulesLint(parsed: ParsedArgs, deps?: RulesDeps): Promise<number>;
+export declare function runRulesValidate(parsed: ParsedArgs, deps?: RulesDeps): Promise<number>;
+export declare function runRulesResolve(parsed: ParsedArgs, deps?: ResolveRulesDeps): Promise<number>;
+export declare function runRulesSimulate(parsed: ParsedArgs, deps?: RulesDeps): Promise<number>;
+//# sourceMappingURL=rules.d.ts.map

package/dist/cli/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/cli/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EAGtB,KAAK,QAAQ,EAGb,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC;IAC3B,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACvD,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,wBAAwB,CAAC;IAC3E,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,cAAc,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACrC;AAcD,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyB5F;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BhG;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,CA8CjB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CAgFjB"}

package/dist/cli/rules.js

@@ -0,0 +1,199 @@
+/**
+ * `pyric firestore rules *` subcommands — thin wrappers over `pyric/rules`.
+ *
+ *   - `firestore rules lint <path>` runs the AST linter, prints findings JSON.
+ *   - `firestore rules validate <path>` runs the structural validator, prints
+ *     findings JSON.
+ *   - `firestore rules simulate` runs the local simulator. With no flags it
+ *     reads `firebase.json` for the rules path and runs a single
+ *     allow-anonymous sanity test. With `--stdin` it reads a JSON
+ *     request `{ source?, testCases }` from stdin instead — the way
+ *     CI pipes in a fully scripted simulation.
+ *
+ * All three exit 0 on success, 1 on usage / file-read error, 2 on
+ * library failure (parse error etc.).
+ */
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, resolve as resolvePath } from 'node:path';
+import { lintFirestoreRules, validateFirestoreRules, parseToAST, SimulateFirestoreRulesHandler, } from 'pyric/rules/internal';
+import { resolveModules } from 'pyric/rules/internal/node';
+import { readFirebaseJson } from './firebase-json.js';
+function defaultReadStdin() {
+    return new Promise((resolve, reject) => {
+        let data = '';
+        process.stdin.setEncoding('utf-8');
+        process.stdin.on('data', (chunk) => {
+            data += chunk;
+        });
+        process.stdin.on('end', () => resolve(data));
+        process.stdin.on('error', reject);
+    });
+}
+export async function runRulesLint(parsed, deps = {}) {
+    const out = deps.stdout ?? process.stdout;
+    const err = deps.stderr ?? process.stderr;
+    const cwd = deps.cwd ?? process.cwd();
+    const readFileFn = deps.readFile ?? readFile;
+    const lintFn = deps.lintFirestoreRules ?? lintFirestoreRules;
+    const path = parsed.positional[0];
+    if (!path) {
+        err.write('pyric firestore rules lint: missing rules-file path. Usage: pyric firestore rules lint <path>\n');
+        return 1;
+    }
+    let source;
+    try {
+        source = await readFileFn(resolvePath(cwd, path), 'utf-8');
+    }
+    catch (e) {
+        err.write(`pyric firestore rules lint: ${e instanceof Error ? e.message : String(e)}\n`);
+        return 1;
+    }
+    const result = lintFn(source);
+    out.write(`${JSON.stringify(result, null, 2)}\n`);
+    // Non-zero only when the linter signals a hard parse error. Warnings
+    // are informational — exit 0 keeps `pyric firestore rules lint` chainable in
+    // build pipelines without `|| true`.
+    return result.parseError ? 2 : 0;
+}
+export async function runRulesValidate(parsed, deps = {}) {
+    const out = deps.stdout ?? process.stdout;
+    const err = deps.stderr ?? process.stderr;
+    const cwd = deps.cwd ?? process.cwd();
+    const readFileFn = deps.readFile ?? readFile;
+    const validateFn = deps.validateFirestoreRules ?? validateFirestoreRules;
+    const path = parsed.positional[0];
+    if (!path) {
+        err.write('pyric firestore rules validate: missing rules-file path. Usage: pyric firestore rules validate <path>\n');
+        return 1;
+    }
+    let source;
+    try {
+        source = await readFileFn(resolvePath(cwd, path), 'utf-8');
+    }
+    catch (e) {
+        err.write(`pyric firestore rules validate: ${e instanceof Error ? e.message : String(e)}\n`);
+        return 1;
+    }
+    const ast = parseToAST(source);
+    if (!ast) {
+        err.write('pyric firestore rules validate: failed to parse rules source.\n');
+        return 2;
+    }
+    const findings = validateFn(ast);
+    out.write(`${JSON.stringify(findings, null, 2)}\n`);
+    return 0;
+}
+export async function runRulesResolve(parsed, deps = {}) {
+    const out = deps.stdout ?? process.stdout;
+    const err = deps.stderr ?? process.stderr;
+    const cwd = deps.cwd ?? process.cwd();
+    const sourcePath = parsed.positional[0];
+    if (!sourcePath) {
+        err.write('pyric firestore rules resolve: missing rules-file path. Usage: pyric firestore rules resolve <path> [--out <path>]\n');
+        return 1;
+    }
+    const absoluteSourcePath = resolvePath(cwd, sourcePath);
+    let source;
+    try {
+        source = await (deps.readFile ?? readFile)(absoluteSourcePath, 'utf-8');
+    }
+    catch (error) {
+        err.write(`pyric firestore rules resolve: ${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+    const result = (deps.resolveModules ?? resolveModules)(source, {
+        basePath: dirname(absoluteSourcePath),
+    });
+    if (!result.success) {
+        err.write(`pyric firestore rules resolve: ${result.error.message}\n`);
+        return 2;
+    }
+    const outFlag = parsed.flags.get('out');
+    if (typeof outFlag !== 'string') {
+        out.write(result.data.resolved.endsWith('\n') ? result.data.resolved : `${result.data.resolved}\n`);
+        return 0;
+    }
+    const outputPath = resolvePath(cwd, outFlag);
+    await (deps.mkdir ?? mkdir)(dirname(outputPath), { recursive: true });
+    await (deps.writeFile ?? writeFile)(outputPath, result.data.resolved.endsWith('\n') ? result.data.resolved : `${result.data.resolved}\n`, 'utf-8');
+    out.write(`pyric firestore rules resolve: wrote ${outputPath}\n`);
+    return 0;
+}
+export async function runRulesSimulate(parsed, deps = {}) {
+    const out = deps.stdout ?? process.stdout;
+    const err = deps.stderr ?? process.stderr;
+    const cwd = deps.cwd ?? process.cwd();
+    const readFileFn = deps.readFile ?? readFile;
+    const fjRead = deps.readFirebaseJson ?? readFirebaseJson;
+    const simulateFn = deps.simulate ??
+        ((source, cases) => new SimulateFirestoreRulesHandler().simulate(source, cases));
+    let source;
+    let testCases;
+    if (parsed.flags.get('stdin') === true) {
+        const readStdinFn = deps.readStdin ?? defaultReadStdin;
+        const raw = await readStdinFn();
+        let payload;
+        try {
+            payload = JSON.parse(raw);
+        }
+        catch (e) {
+            err.write(`pyric firestore rules simulate: failed to parse stdin JSON: ${e instanceof Error ? e.message : String(e)}\n`);
+            return 1;
+        }
+        if (!payload.testCases || !Array.isArray(payload.testCases)) {
+            err.write('pyric firestore rules simulate: stdin payload must include `testCases: TestCase[]`.\n');
+            return 1;
+        }
+        testCases = payload.testCases;
+        if (payload.source) {
+            source = payload.source;
+        }
+        else {
+            const firebaseJson = await fjRead(cwd);
+            const rulesPath = firebaseJson.firestore?.rules;
+            if (!rulesPath) {
+                err.write('pyric firestore rules simulate: stdin payload omitted `source` and firebase.json has no firestore.rules path.\n');
+                return 1;
+            }
+            source = await readFileFn(resolvePath(cwd, rulesPath), 'utf-8');
+        }
+    }
+    else {
+        let firebaseJson;
+        try {
+            firebaseJson = await fjRead(cwd);
+        }
+        catch (e) {
+            err.write(`${e instanceof Error ? e.message : String(e)}\n`);
+            return 1;
+        }
+        const rulesPath = firebaseJson.firestore?.rules;
+        if (!rulesPath) {
+            err.write('pyric firestore rules simulate: firebase.json has no `firestore.rules` path.\n');
+            return 1;
+        }
+        try {
+            source = await readFileFn(resolvePath(cwd, rulesPath), 'utf-8');
+        }
+        catch (e) {
+            err.write(`pyric firestore rules simulate: ${e instanceof Error ? e.message : String(e)}\n`);
+            return 1;
+        }
+        // Default sample test — anonymous read on /sample/x. Useful as a
+        // smoke-test that proves the rules file at least parses + an
+        // anonymous reader is correctly denied/allowed.
+        testCases = [
+            {
+                description: 'sample anonymous read',
+                expectation: 'DENY',
+                method: 'get',
+                path: 'sample/x',
+                auth: null,
+            },
+        ];
+    }
+    const result = simulateFn(source, testCases);
+    out.write(`${JSON.stringify(result, null, 2)}\n`);
+    return result.success ? 0 : 2;
+}
+//# sourceMappingURL=rules.js.map

package/dist/cli/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/cli/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,6BAA6B,GAK9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAqB,MAAM,oBAAoB,CAAC;AA0BzE,SAAS,gBAAgB;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,OAAkB,EAAE;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC;IAE7D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,iGAAiG,CAAC,CAAC;QAC7G,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAe,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAClD,qEAAqE;IACrE,6EAA6E;IAC7E,qCAAqC;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAkB,EAAE,OAAkB,EAAE;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC;IAEzE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,yGAAyG,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,mCAAmC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAwB,UAAU,CAAC,GAAG,CAAC,CAAC;IACtD,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CACP,sHAAsH,CACvH,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CACP,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC7F,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,CAAC,MAAM,EAAE;QAC7D,QAAQ,EAAE,OAAO,CAAC,kBAAkB,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CACjC,UAAU,EACV,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EACxF,OAAO,CACR,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,wCAAwC,UAAU,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,OAAkB,EAAE;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC;IACzD,MAAM,UAAU,GACd,IAAI,CAAC,QAAQ;QACb,CAAC,CAAC,MAAc,EAAE,KAAiB,EAAE,EAAE,CACrC,IAAI,6BAA6B,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAEjE,IAAI,MAAc,CAAC;IACnB,IAAI,SAAqB,CAAC;IAE1B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;QAChC,IAAI,OAAoD,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgD,CAAC;QAC3E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CACP,+DAA+D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAC9G,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;YACnG,OAAO,CAAC,CAAC;QACX,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,KAAK,CACP,iHAAiH,CAClH,CAAC;gBACF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,YAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;YAC5F,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,mCAAmC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7F,OAAO,CAAC,CAAC;QACX,CAAC;QACD,iEAAiE;QACjE,6DAA6D;QAC7D,gDAAgD;QAChD,SAAS,GAAG;YACV;gBACE,WAAW,EAAE,uBAAuB;gBACpC,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,IAAI;aACX;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/dist/cli/scope.d.ts

@@ -0,0 +1,12 @@
+import type { ProjectScope } from '../credentials/core/types.js';
+export interface ResolvedScope {
+    scope: ProjectScope;
+    source: 'FIREBASE_SA_BASE64' | 'GOOGLE_APPLICATION_CREDENTIALS' | 'adc';
+}
+export interface ResolveScopeOptions {
+    projectId?: string | undefined;
+    env?: NodeJS.ProcessEnv;
+    adc?: (projectId: string, env: NodeJS.ProcessEnv) => Promise<ProjectScope | null>;
+}
+export declare function resolveScope(options?: ResolveScopeOptions): Promise<ResolvedScope>;
+//# sourceMappingURL=scope.d.ts.map

package/dist/cli/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/cli/scope.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,oBAAoB,GAAG,gCAAgC,GAAG,KAAK,CAAC;CACzE;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACnF;AAED,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB5F"}

package/dist/cli/scope.js

@@ -0,0 +1,44 @@
+/**
+ * `resolveScope` — build a `ProjectScope` for hosted Rules Test API verification.
+ *
+ * Credential sources, in precedence order:
+ *   1. `FIREBASE_SA_BASE64` — base64 service-account JSON (CI). Grants all scopes.
+ *   2. `GOOGLE_APPLICATION_CREDENTIALS` — path to a service-account JSON file.
+ *   3. ADC (`gcloud auth application-default login` / workload identity) — the
+ *      ambient keyless fallback.
+ *
+ * Service accounts win so CI is deterministic. ADC user credentials are not
+ * bound to a project, so they need `--project` / `.firebaserc`.
+ */
+import { fromAdc } from '../credentials/node/from-adc.js';
+import { fromServiceAccount } from '../credentials/node/from-service-account.js';
+export async function resolveScope(options = {}) {
+    const env = options.env ?? process.env;
+    // 1 + 2. Service-account env (CI) — highest precedence; grants all scopes.
+    const saBase64 = env.FIREBASE_SA_BASE64;
+    if (saBase64 && saBase64.trim() !== '') {
+        return withProject(await fromServiceAccount(`base64:${saBase64}`), 'FIREBASE_SA_BASE64', options, env);
+    }
+    const gac = env.GOOGLE_APPLICATION_CREDENTIALS;
+    if (gac && gac.trim() !== '') {
+        return withProject(await fromServiceAccount(gac), 'GOOGLE_APPLICATION_CREDENTIALS', options, env);
+    }
+    // ADC user credentials are not bound to a project.
+    const projectId = options.projectId ?? env.PYRIC_PROJECT;
+    if (projectId) {
+        const adcScope = await (options.adc ?? fromAdc)(projectId, env);
+        if (adcScope)
+            return { scope: adcScope, source: 'adc' };
+    }
+    throw new Error('pyric: Rules Test API verification requires FIREBASE_SA_BASE64, ' +
+        'GOOGLE_APPLICATION_CREDENTIALS, or Application Default Credentials from ' +
+        '`gcloud auth application-default login`.');
+}
+function withProject(baseScope, source, options, env) {
+    const overrideProjectId = options.projectId ?? env.PYRIC_PROJECT;
+    const scope = overrideProjectId && overrideProjectId !== baseScope.projectId
+        ? Object.freeze({ projectId: overrideProjectId, resolveToken: baseScope.resolveToken })
+        : baseScope;
+    return { scope, source };
+}
+//# sourceMappingURL=scope.js.map

package/dist/cli/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/cli/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAcjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAA+B,EAAE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,OAAO,WAAW,CAAC,MAAM,kBAAkB,CAAC,UAAU,QAAQ,EAAE,CAAC,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,8BAA8B,CAAC;IAC/C,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,gCAAgC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,mDAAmD;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,KAAK,CACb,kEAAkE;QAChE,0EAA0E;QAC1E,0CAA0C,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,SAAuB,EACvB,MAA+B,EAC/B,OAA4B,EAC5B,GAAsB;IAEtB,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,CAAC;IACjE,MAAM,KAAK,GACT,iBAAiB,IAAI,iBAAiB,KAAK,SAAS,CAAC,SAAS;QAC5D,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;QACvF,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC"}