@pyric/cli 0.1.0-alpha.9

package/dist/assurance/attachment.js

@@ -0,0 +1,138 @@
+import { getAuth, sandbox as authSandbox } from "pyric/auth";
+import { getAdminDatabase, sandbox as rtdbSandbox, } from "pyric/database";
+import { ASSURANCE_TARGET_SCHEMA, AssuranceInputError, } from "./types.js";
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.toLowerCase().replace(/\.$/, "");
+    if (normalized === "localhost" ||
+        normalized === "[::1]" ||
+        normalized === "::1")
+        return true;
+    const parts = normalized.split(".");
+    return (parts.length === 4 &&
+        parts[0] === "127" &&
+        parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255));
+}
+function parseLocalOrigin(rawUrl, runtimeOrigin) {
+    let requested;
+    let current;
+    try {
+        requested = new URL(rawUrl);
+        current = new URL(runtimeOrigin);
+    }
+    catch {
+        throw new AssuranceInputError(`'${rawUrl}' is not a valid absolute Pyric URL.`);
+    }
+    if ((requested.protocol !== "http:" && requested.protocol !== "https:") ||
+        !isLoopbackHostname(requested.hostname) ||
+        requested.username ||
+        requested.password) {
+        throw new AssuranceInputError("firebase_assurance_attach accepts only credential-free HTTP(S) loopback URLs.");
+    }
+    if (requested.origin !== current.origin) {
+        throw new AssuranceInputError(`attachment URL origin '${requested.origin}' does not match the connected Pyric sandbox origin '${current.origin}'.`);
+    }
+    return requested;
+}
+function hasRtdbState(value) {
+    if (value === null || value === undefined)
+        return false;
+    if (typeof value !== "object")
+        return true;
+    return Object.keys(value).length > 0;
+}
+/**
+ * Clone the sandbox currently hosting the connected bridge peer. The URL is an
+ * origin assertion and source for explicit rules metadata; no arbitrary host is
+ * contacted and the returned campaign target itself keeps networking forbidden.
+ */
+export function createSandboxAttachmentProvider(sandbox, options = {}) {
+    return async ({ url }) => {
+        const runtimeOrigin = options.origin ??
+            (typeof globalThis.location !== "undefined"
+                ? globalThis.location.origin
+                : "");
+        if (!runtimeOrigin) {
+            throw new AssuranceInputError("localhost attachment is available only inside a served Pyric sandbox peer.");
+        }
+        const requested = parseLocalOrigin(url, runtimeOrigin);
+        const origin = requested.origin;
+        const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+        if (!fetchImpl) {
+            throw new AssuranceInputError("localhost attachment requires the Fetch API.");
+        }
+        const response = await fetchImpl(`${origin}/__pyric/init.json`, {
+            redirect: "error",
+        });
+        if (!response.ok) {
+            throw new AssuranceInputError(`Pyric initialization metadata returned HTTP ${response.status} at '${origin}'.`);
+        }
+        const payload = (await response.json());
+        if (!payload || typeof payload !== "object" || !payload.bridgeUrl) {
+            throw new AssuranceInputError(`No active Pyric bridge was advertised by '${origin}/__pyric/init.json'.`);
+        }
+        const snapshot = sandbox.snapshot();
+        const rtdbState = rtdbSandbox.snapshotState(getAdminDatabase(sandbox));
+        const authUsers = authSandbox.exportUsers(getAuth(sandbox));
+        const rules = {};
+        if (typeof payload.rules === "string" && payload.rules.trim()) {
+            rules.firestore = payload.rules;
+        }
+        if (payload.databaseRules?.rules)
+            rules.rtdb = payload.databaseRules;
+        const coverageGaps = [
+            {
+                service: "storage",
+                code: "storage-attachment-unavailable",
+                reason: "The served runtime does not yet expose Storage rules or complete object enumeration; provide explicit Storage rules and objects in a fixture campaign.",
+            },
+        ];
+        if (!rules.firestore && Object.keys(snapshot.firestore).length > 0) {
+            coverageGaps.push({
+                service: "firestore",
+                code: "firestore-rules-unavailable",
+                reason: "The running sandbox has Firestore data but no explicit project rules source.",
+            });
+        }
+        if (!rules.rtdb && hasRtdbState(rtdbState)) {
+            coverageGaps.push({
+                service: "rtdb",
+                code: "rtdb-rules-unavailable",
+                reason: "The running sandbox has RTDB data but no explicit database rules source.",
+            });
+        }
+        return {
+            target: {
+                schema: ASSURANCE_TARGET_SCHEMA,
+                network: "forbid",
+                rules,
+                state: {
+                    firestore: snapshot.firestore,
+                    ...(rules.rtdb || hasRtdbState(rtdbState) ? { rtdb: rtdbState } : {}),
+                    auth: {
+                        users: authUsers.map((user) => ({
+                            uid: user.uid,
+                            email: user.email,
+                            password: user.password,
+                            ...(user.customClaims ? { customClaims: user.customClaims } : {}),
+                        })),
+                    },
+                },
+            },
+            source: {
+                requestedUrl: url,
+                origin,
+                transport: "same-origin-shared-worker",
+                readOnly: true,
+                studioUrl: `${origin}/__pyric/ui/assurance`,
+            },
+            inventory: {
+                firestoreDocuments: Object.keys(snapshot.firestore).length,
+                rtdbPresent: hasRtdbState(rtdbState),
+                authUsers: authUsers.length,
+                storageObjects: 0,
+            },
+            coverageGaps,
+        };
+    };
+}
+//# sourceMappingURL=attachment.js.map

package/dist/assurance/attachment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment.js","sourceRoot":"","sources":["../../src/assurance/attachment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,OAAO,IAAI,WAAW,GACvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AAkCpB,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,IACE,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,OAAO;QACtB,UAAU,KAAK,KAAK;QAEpB,OAAO,IAAI,CAAC;IACd,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,aAAqB;IAC7D,IAAI,SAAc,CAAC;IACnB,IAAI,OAAY,CAAC;IACjB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAC3B,IAAI,MAAM,sCAAsC,CACjD,CAAC;IACJ,CAAC;IACD,IACE,CAAC,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACnE,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC;QACvC,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,QAAQ,EAClB,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAC3B,0BAA0B,SAAS,CAAC,MAAM,wDAAwD,OAAO,CAAC,MAAM,IAAI,CACrH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAAgB,EAChB,UAA4C,EAAE;IAE9C,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,MAAM,aAAa,GACjB,OAAO,CAAC,MAAM;YACd,CAAC,OAAO,UAAU,CAAC,QAAQ,KAAK,WAAW;gBACzC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM;gBAC5B,CAAC,CAAC,EAAE,CAAC,CAAC;QACV,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAC3B,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAChC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAC3B,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,oBAAoB,EAAE;YAC9D,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,QAAQ,CAAC,MAAM,QAAQ,MAAM,IAAI,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;QAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,mBAAmB,CAC3B,6CAA6C,MAAM,sBAAsB,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,WAAW,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAiC,EAAE,CAAC;QAC/C,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9D,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,KAAK;YAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;QAErE,MAAM,YAAY,GAA2B;YAC3C;gBACE,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EACJ,wJAAwJ;aAC3J;SACF,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnE,YAAY,CAAC,IAAI,CAAC;gBAChB,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EACJ,8EAA8E;aACjF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,YAAY,CAAC,IAAI,CAAC;gBAChB,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EACJ,0EAA0E;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM,EAAE;gBACN,MAAM,EAAE,uBAAuB;gBAC/B,OAAO,EAAE,QAAQ;gBACjB,KAAK;gBACL,KAAK,EAAE;oBACL,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,IAAI,EAAE;wBACJ,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BAC9B,GAAG,EAAE,IAAI,CAAC,GAAG;4BACb,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAClE,CAAC,CAAC;qBACJ;iBACF;aACF;YACD,MAAM,EAAE;gBACN,YAAY,EAAE,GAAG;gBACjB,MAAM;gBACN,SAAS,EAAE,2BAA2B;gBACtC,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,GAAG,MAAM,uBAAuB;aAC5C;YACD,SAAS,EAAE;gBACT,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM;gBAC1D,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC;gBACpC,SAAS,EAAE,SAAS,CAAC,MAAM;gBAC3B,cAAc,EAAE,CAAC;aAClB;YACD,YAAY;SACb,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/assurance/browser.d.ts

@@ -0,0 +1,7 @@
+import type { AssuranceVisualizationSnapshot } from "./types.js";
+export declare const ASSURANCE_BROWSER_EVENT = "pyric:assurance-campaign";
+export declare const ASSURANCE_BROADCAST_CHANNEL = "pyric-assurance-v1";
+export declare function subscribeAssuranceVisualizations(listener: (snapshot: AssuranceVisualizationSnapshot) => void): () => void;
+export declare function publishAssuranceVisualization(snapshot: AssuranceVisualizationSnapshot): void;
+export type { AssuranceVisualizationSnapshot } from "./types.js";
+//# sourceMappingURL=browser.d.ts.map

package/dist/assurance/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/assurance/browser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAEjE,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAClE,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAqChE,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,CAAC,QAAQ,EAAE,8BAA8B,KAAK,IAAI,GAC3D,MAAM,IAAI,CAIZ;AAED,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,8BAA8B,GACvC,IAAI,CA2BN;AAED,YAAY,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC"}

package/dist/assurance/browser.js

@@ -0,0 +1,68 @@
+export const ASSURANCE_BROWSER_EVENT = "pyric:assurance-campaign";
+export const ASSURANCE_BROADCAST_CHANNEL = "pyric-assurance-v1";
+const listeners = new Set();
+let installed = false;
+let channel;
+function receive(snapshot) {
+    for (const listener of listeners)
+        listener(snapshot);
+}
+function isSnapshot(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        value.schema ===
+            "pyric.assurance.visualization.v1" &&
+        typeof value.campaignId === "string");
+}
+function installBrowserReceivers() {
+    if (installed || typeof document === "undefined")
+        return;
+    installed = true;
+    globalThis.addEventListener(ASSURANCE_BROWSER_EVENT, (event) => {
+        const detail = event.detail;
+        if (isSnapshot(detail))
+            receive(detail);
+    });
+    try {
+        channel = new BroadcastChannel(ASSURANCE_BROADCAST_CHANNEL);
+        channel.onmessage = (event) => {
+            if (isSnapshot(event.data))
+                receive(event.data);
+        };
+    }
+    catch {
+        // BroadcastChannel is optional in constrained browser contexts.
+    }
+}
+export function subscribeAssuranceVisualizations(listener) {
+    installBrowserReceivers();
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+}
+export function publishAssuranceVisualization(snapshot) {
+    receive(snapshot);
+    const globalKind = globalThis.constructor?.name ?? "";
+    const isBrowserWorker = globalKind.endsWith("WorkerGlobalScope");
+    if (typeof document !== "undefined") {
+        try {
+            globalThis.dispatchEvent(new CustomEvent(ASSURANCE_BROWSER_EVENT, {
+                detail: snapshot,
+            }));
+        }
+        catch {
+            // Visualization delivery is observational; campaign execution already succeeded.
+        }
+    }
+    if (typeof document === "undefined" && !isBrowserWorker)
+        return;
+    try {
+        const target = channel ?? new BroadcastChannel(ASSURANCE_BROADCAST_CHANNEL);
+        target.postMessage(snapshot);
+        if (target !== channel)
+            target.close();
+    }
+    catch {
+        // BroadcastChannel is optional (SSR and constrained browser contexts).
+    }
+}
+//# sourceMappingURL=browser.js.map

package/dist/assurance/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/assurance/browser.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAEhE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsD,CAAC;AAChF,IAAI,SAAS,GAAG,KAAK,CAAC;AACtB,IAAI,OAAqC,CAAC;AAE1C,SAAS,OAAO,CAAC,QAAwC;IACvD,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,CACL,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACxB,KAA8B,CAAC,MAAM;YACpC,kCAAkC;QACpC,OAAQ,KAAkC,CAAC,UAAU,KAAK,QAAQ,CACnE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,IAAI,SAAS,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO;IACzD,SAAS,GAAG,IAAI,CAAC;IACjB,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7D,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;QACtD,IAAI,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,OAAO,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,QAA4D;IAE5D,uBAAuB,EAAE,CAAC;IAC1B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAwC;IAExC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClB,MAAM,UAAU,GACb,UAAkD,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;IAC9E,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,UAAU,CAAC,aAAa,CACtB,IAAI,WAAW,CACb,uBAAuB,EACvB;gBACE,MAAM,EAAE,QAAQ;aACjB,CACF,CACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,iFAAiF;QACnF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,CAAC,eAAe;QAAE,OAAO;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,IAAI,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;QAC5E,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,OAAO;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC"}

package/dist/assurance/campaign.d.ts

@@ -0,0 +1,41 @@
+import { type AssuranceActor, type AssuranceCampaignContext, type AssuranceObservation, type AssuranceProbe, type AssuranceProbeResult, type AssuranceVisualizationSnapshot, type AuthorizationCampaignReport, type AuthorizationCampaignSpec, type CampaignExport, type LocalFirebaseTarget, type MinimizationResult, type ProposalInput, type SecurityCase, type SecurityInvariant } from "./types.js";
+export interface CreateAuthorizationCampaignOptions {
+    id: string;
+    target: LocalFirebaseTarget;
+    context?: AssuranceCampaignContext;
+    safety?: {
+        network?: "forbid";
+        maxRuns?: number;
+    };
+}
+export declare class AuthorizationCampaign {
+    #private;
+    readonly id: string;
+    readonly target: LocalFirebaseTarget;
+    readonly context: AssuranceCampaignContext | undefined;
+    readonly maxRuns: number;
+    constructor(options: CreateAuthorizationCampaignOptions);
+    addActor(actor: AssuranceActor): AssuranceActor;
+    addInvariant(invariant: SecurityInvariant): SecurityInvariant;
+    addObservation(observation: AssuranceObservation): AssuranceObservation;
+    addProbe(probe: AssuranceProbe): AssuranceProbe;
+    propose(input: ProposalInput): AssuranceProbe[];
+    spec(probeIds?: string[]): AuthorizationCampaignSpec;
+    run(probeIds?: string[]): Promise<AuthorizationCampaignReport>;
+    inspect(probeId: string): AssuranceProbeResult;
+    minimize(probeId: string): Promise<MinimizationResult>;
+    exportSecurityCases(options?: {
+        includeCandidates?: boolean;
+    }): SecurityCase[];
+    verifyRules(options: {
+        rules: LocalFirebaseTarget["rules"];
+        includeCandidates?: boolean;
+        id?: string;
+    }): Promise<AuthorizationCampaignReport>;
+    export(): CampaignExport;
+    visualization(): AssuranceVisualizationSnapshot;
+    get report(): AuthorizationCampaignReport | undefined;
+    get observations(): AssuranceObservation[];
+}
+export declare function createAuthorizationCampaign(options: CreateAuthorizationCampaignOptions): AuthorizationCampaign;
+//# sourceMappingURL=campaign.d.ts.map

package/dist/assurance/campaign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign.d.ts","sourceRoot":"","sources":["../../src/assurance/campaign.ts"],"names":[],"mappings":"AASA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,kCAAkC;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,QAAQ,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,qBAAa,qBAAqB;;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAUb,OAAO,EAAE,kCAAkC;IAgBvD,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc;IAM/C,YAAY,CAAC,SAAS,EAAE,iBAAiB,GAAG,iBAAiB;IAM7D,cAAc,CAAC,WAAW,EAAE,oBAAoB,GAAG,oBAAoB;IAWvE,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc;IAyB/C,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,EAAE;IAkD/C,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,yBAAyB;IAkB9C,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAapE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB;IAYxC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+F5D,mBAAmB,CACjB,OAAO,GAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAO,GAC5C,YAAY,EAAE;IAuBX,WAAW,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA+BxC,MAAM,IAAI,cAAc;IAcxB,aAAa,IAAI,8BAA8B;IAc/C,IAAI,MAAM,IAAI,2BAA2B,GAAG,SAAS,CAEpD;IAED,IAAI,YAAY,IAAI,oBAAoB,EAAE,CAEzC;CAqBF;AAwED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,kCAAkC,GAC1C,qBAAqB,CAEvB"}

package/dist/assurance/campaign.js

@@ -0,0 +1,364 @@
+import { runAuthorizationCampaign } from "./runner.js";
+import { runSecurityCases } from "./cases.js";
+import { assertActor, assertInvariant, assertObservation, assertProbe, assertTarget, } from "./validation.js";
+import { ASSURANCE_CAMPAIGN_SCHEMA, AssuranceInputError, } from "./types.js";
+export class AuthorizationCampaign {
+    id;
+    target;
+    context;
+    maxRuns;
+    #actors = new Map();
+    #invariants = new Map();
+    #observations = new Map();
+    #probes = new Map();
+    #report;
+    #verifications = [];
+    #runs = 0;
+    constructor(options) {
+        if (!options.id.trim())
+            throw new AssuranceInputError("campaign id is required.");
+        assertTarget(options.target);
+        this.id = options.id;
+        this.target = options.target;
+        this.context = options.context;
+        const maxRuns = options.safety?.maxRuns ?? 200;
+        if (!Number.isInteger(maxRuns) || maxRuns <= 0) {
+            throw new AssuranceInputError("campaign maxRuns must be a positive integer.");
+        }
+        this.maxRuns = maxRuns;
+    }
+    addActor(actor) {
+        assertActor(actor);
+        this.#addUnique(this.#actors, actor, "actor");
+        return actor;
+    }
+    addInvariant(invariant) {
+        assertInvariant(invariant);
+        this.#addUnique(this.#invariants, invariant, "invariant");
+        return invariant;
+    }
+    addObservation(observation) {
+        assertObservation(observation);
+        if (!this.#actors.has(observation.actorId)) {
+            throw new AssuranceInputError(`observation '${observation.id}' references unknown actor '${observation.actorId}'.`);
+        }
+        this.#addUnique(this.#observations, observation, "observation");
+        return observation;
+    }
+    addProbe(probe) {
+        assertProbe(probe);
+        if (!this.#actors.has(probe.actorId)) {
+            throw new AssuranceInputError(`probe '${probe.id}' references unknown actor '${probe.actorId}'.`);
+        }
+        const invariant = this.#invariants.get(probe.invariantId);
+        if (!invariant) {
+            throw new AssuranceInputError(`probe '${probe.id}' references unknown invariant '${probe.invariantId}'.`);
+        }
+        if (invariant.service !== "cross-service" &&
+            invariant.service !== probe.control.service) {
+            throw new AssuranceInputError(`probe '${probe.id}' service does not match invariant '${invariant.id}'.`);
+        }
+        this.#addUnique(this.#probes, probe, "probe");
+        return probe;
+    }
+    propose(input) {
+        if (!input || typeof input !== "object") {
+            throw new AssuranceInputError("proposal input must be an object.");
+        }
+        if (typeof input.observationId !== "string" ||
+            !input.observationId.trim()) {
+            throw new AssuranceInputError("proposal observationId is required.");
+        }
+        if (typeof input.invariantId !== "string" || !input.invariantId.trim()) {
+            throw new AssuranceInputError("proposal invariantId is required.");
+        }
+        if (!Array.isArray(input.mutations)) {
+            throw new AssuranceInputError("proposal mutations must be an array.");
+        }
+        const observation = this.#observations.get(input.observationId);
+        if (!observation) {
+            throw new AssuranceInputError(`unknown observation '${input.observationId}'.`);
+        }
+        if (!this.#invariants.has(input.invariantId)) {
+            throw new AssuranceInputError(`unknown invariant '${input.invariantId}'.`);
+        }
+        if (input.mutations.length === 0) {
+            throw new AssuranceInputError("at least one mutation is required.");
+        }
+        return input.mutations.map((mutation, index) => {
+            const id = mutation.id ??
+                `${input.observationId}-${mutation.dimension}-${index + 1}`;
+            const probe = {
+                id,
+                actorId: observation.actorId,
+                invariantId: input.invariantId,
+                control: observation.operation,
+                mutation: {
+                    dimension: mutation.dimension,
+                    description: mutation.description,
+                    operation: mutation.operation,
+                },
+            };
+            return this.addProbe(probe);
+        });
+    }
+    spec(probeIds) {
+        const probes = probeIds
+            ? probeIds.map((id) => {
+                const probe = this.#probes.get(id);
+                if (!probe)
+                    throw new AssuranceInputError(`unknown probe '${id}'.`);
+                return probe;
+            })
+            : [...this.#probes.values()];
+        return {
+            schema: ASSURANCE_CAMPAIGN_SCHEMA,
+            id: this.id,
+            target: this.target,
+            actors: [...this.#actors.values()],
+            invariants: [...this.#invariants.values()],
+            probes,
+        };
+    }
+    async run(probeIds) {
+        const count = probeIds?.length ?? this.#probes.size;
+        this.#assertRunBudget(count);
+        const report = await runAuthorizationCampaign(this.spec(probeIds));
+        this.#runs += count;
+        if (!probeIds) {
+            this.#report = report;
+        }
+        else {
+            this.#report = mergeReports(this.#report, report, this.#probes.size);
+        }
+        return report;
+    }
+    inspect(probeId) {
+        const result = this.#report?.results.find((item) => item.probeId === probeId);
+        if (!result) {
+            throw new AssuranceInputError(`probe '${probeId}' has no completed run to inspect.`);
+        }
+        return result;
+    }
+    async minimize(probeId) {
+        const original = this.#probes.get(probeId);
+        if (!original)
+            throw new AssuranceInputError(`unknown probe '${probeId}'.`);
+        const originalResult = this.inspect(probeId);
+        if (originalResult.classification !== "local-counterexample" &&
+            originalResult.classification !== "candidate-signal") {
+            throw new AssuranceInputError(`probe '${probeId}' has no counterexample to minimize.`);
+        }
+        const operation = original.mutation.operation;
+        const data = "data" in operation ? operation.data : undefined;
+        if (original.mutation.dimension !== "payload" ||
+            !data ||
+            typeof data !== "object" ||
+            Array.isArray(data)) {
+            return {
+                probeId,
+                changed: false,
+                removedPayloadFields: [],
+                probe: original,
+                result: originalResult,
+            };
+        }
+        let kept = { ...data };
+        const controlData = "data" in original.control &&
+            original.control.data &&
+            typeof original.control.data === "object" &&
+            !Array.isArray(original.control.data)
+            ? original.control.data
+            : {};
+        const retainsPayloadDelta = (candidate) => Object.keys(candidate).some((field) => stableValue(candidate[field]) !== stableValue(controlData[field]));
+        if (!retainsPayloadDelta(kept)) {
+            return {
+                probeId,
+                changed: false,
+                removedPayloadFields: [],
+                probe: original,
+                result: originalResult,
+            };
+        }
+        this.#assertRunBudget(Object.keys(kept).length);
+        const removedPayloadFields = [];
+        let bestProbe = original;
+        let bestResult = originalResult;
+        for (const field of Object.keys(kept)) {
+            if (Object.keys(kept).length === 1)
+                break;
+            const candidateData = { ...kept };
+            delete candidateData[field];
+            if (!retainsPayloadDelta(candidateData))
+                continue;
+            const candidate = {
+                ...original,
+                id: `${original.id}--min-${field}`,
+                mutation: {
+                    ...original.mutation,
+                    operation: { ...operation, data: candidateData },
+                },
+            };
+            const report = await runAuthorizationCampaign({
+                ...this.spec([probeId]),
+                probes: [candidate],
+            });
+            this.#runs++;
+            const result = report.results[0];
+            if (result.classification === originalResult.classification) {
+                kept = candidateData;
+                removedPayloadFields.push(field);
+                bestProbe = { ...candidate, id: original.id };
+                bestResult = { ...result, probeId: original.id };
+            }
+        }
+        if (removedPayloadFields.length > 0) {
+            this.#probes.set(probeId, bestProbe);
+            this.#report = replaceResult(this.#report, bestResult);
+        }
+        return {
+            probeId,
+            changed: removedPayloadFields.length > 0,
+            removedPayloadFields,
+            probe: bestProbe,
+            result: bestResult,
+        };
+    }
+    exportSecurityCases(options = {}) {
+        if (!this.#report)
+            throw new AssuranceInputError("campaign has not been run.");
+        return this.#report.results
+            .filter((result) => result.classification === "local-counterexample" ||
+            (options.includeCandidates &&
+                result.classification === "candidate-signal"))
+            .map((result) => ({
+            schema: "pyric.assurance.case.v1",
+            id: result.probeId,
+            campaignId: this.id,
+            actorId: result.actorEvidence.actorId,
+            invariant: result.invariant,
+            control: result.control.operation,
+            mutation: result.mutationSpec,
+            expect: result.invariant.expected,
+            qualification: result.qualification,
+        }));
+    }
+    async verifyRules(options) {
+        if (!options.rules || Object.keys(options.rules).length === 0) {
+            throw new AssuranceInputError("candidate rules must include at least one service.");
+        }
+        const cases = this.exportSecurityCases({
+            includeCandidates: options.includeCandidates,
+        });
+        if (cases.length === 0) {
+            throw new AssuranceInputError("campaign has no qualified regression cases to verify.");
+        }
+        this.#assertRunBudget(cases.length);
+        const report = await runSecurityCases({
+            campaignId: options.id ??
+                `${this.id}-verification-${this.#verifications.length + 1}`,
+            target: {
+                ...this.target,
+                rules: { ...this.target.rules, ...options.rules },
+            },
+            actors: [...this.#actors.values()],
+            cases,
+        });
+        this.#runs += cases.length;
+        this.#verifications.push(report);
+        return report;
+    }
+    export() {
+        return {
+            schema: "pyric.assurance.export.v1",
+            campaign: this.spec(),
+            ...(this.context ? { context: this.context } : {}),
+            observations: [...this.#observations.values()],
+            ...(this.#report ? { report: this.#report } : {}),
+            cases: this.#report ? this.exportSecurityCases() : [],
+            ...(this.#verifications.length > 0
+                ? { verifications: [...this.#verifications] }
+                : {}),
+        };
+    }
+    visualization() {
+        return {
+            schema: "pyric.assurance.visualization.v1",
+            campaignId: this.id,
+            ...(this.context ? { context: this.context } : {}),
+            observations: [...this.#observations.values()],
+            probes: [...this.#probes.values()],
+            ...(this.#report ? { report: this.#report } : {}),
+            ...(this.#verifications.length > 0
+                ? { verifications: [...this.#verifications] }
+                : {}),
+        };
+    }
+    get report() {
+        return this.#report;
+    }
+    get observations() {
+        return [...this.#observations.values()];
+    }
+    #addUnique(map, value, label) {
+        if (!value.id.trim())
+            throw new AssuranceInputError(`${label} id is required.`);
+        if (map.has(value.id))
+            throw new AssuranceInputError(`duplicate ${label} id '${value.id}'.`);
+        map.set(value.id, value);
+    }
+    #assertRunBudget(count) {
+        if (this.#runs + count > this.maxRuns) {
+            throw new AssuranceInputError(`campaign run budget exceeded: ${this.#runs + count}/${this.maxRuns} probes.`);
+        }
+    }
+}
+function stableValue(value) {
+    if (value === undefined)
+        return "undefined";
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableValue).join(",")}]`;
+    const record = value;
+    return `{${Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableValue(record[key])}`)
+        .join(",")}}`;
+}
+function mergeReports(existing, incoming, totalProbes) {
+    if (!existing)
+        return incoming;
+    const byId = new Map(existing.results.map((result) => [result.probeId, result]));
+    for (const result of incoming.results)
+        byId.set(result.probeId, result);
+    const results = [...byId.values()];
+    return {
+        ...incoming,
+        results,
+        summary: summarizeResults(results, totalProbes),
+    };
+}
+function replaceResult(report, replacement) {
+    const results = report.results.map((result) => result.probeId === replacement.probeId ? replacement : result);
+    return {
+        ...report,
+        results,
+        summary: summarizeResults(results, results.length),
+    };
+}
+function summarizeResults(results, totalProbes) {
+    return {
+        probes: totalProbes,
+        controlsPassed: results.filter((result) => result.control.decision === "ALLOW").length,
+        localCounterexamples: results.filter((result) => result.classification === "local-counterexample").length,
+        candidateSignals: results.filter((result) => result.classification === "candidate-signal").length,
+        noCounterexamples: results.filter((result) => result.classification === "no-counterexample").length,
+        engineGaps: results.filter((result) => result.classification === "engine-gap").length,
+        invalidProbes: results.filter((result) => result.classification === "invalid-probe").length,
+    };
+}
+export function createAuthorizationCampaign(options) {
+    return new AuthorizationCampaign(options);
+}
+//# sourceMappingURL=campaign.js.map