@pyric/cli 0.1.0-alpha.9

package/dist/serve/docs-ui/docs/rtdb-rules-in-typescript.md

@@ -0,0 +1,101 @@
+
+# Write Realtime Database rules in TypeScript
+
+> Realtime Database support is experimental. [What that costs you](../whats-experimental/).
+
+Realtime Database rules are strings inside a JSON tree. Pyric lets you write them as TypeScript instead: typed builders compose into expressions, the expressions assemble into a ruleset, and the ruleset checks itself, simulates requests, and compiles to the exact JSON Firebase deploys. A typo becomes a compile error instead of a production surprise.
+
+## Define the rules in code
+
+```ts
+import {
+  defineRtdbRules, all, authenticated,
+  fieldOwnerOnly, ownerOrNew, immutable,
+} from 'pyric/rules/rtdb/constraints';
+
+const rules = defineRtdbRules({
+  paths: {
+    '/notes/$noteId': {
+      read: authenticated(),
+      write: ownerOrNew('ownerId'),
+      validate: immutable('createdAt'),
+    },
+  },
+});
+```
+
+`$noteId` is a real wildcard. `ownerOrNew('ownerId')` compiles to the signed-in-and-owner-or-new expression you would have written by hand, and `immutable('createdAt')` pins a field after creation. Every builder's output is pinned by tests, so what you compose is what deploys.
+
+## Check it before anything runs
+
+```ts
+const result = rules.check();
+// { ok: true, errors: [], warnings: [] }
+```
+
+`check()` parses, validates, and lints every expression in the tree. A `==` where you meant `===` comes back as a `LOOSE_EQUALITY` warning with its path and rule. An unsupported schema type is a `COMPILE_ERROR`. No deploy, no network.
+
+## Simulate a request
+
+```ts
+const verdict = rules.simulate({
+  operation: 'write',
+  path: '/notes/n1',
+  auth: 'alice',
+  data: { ownerId: 'alice', createdAt: 1 },
+  newData: { ownerId: 'alice', createdAt: 1, title: 'edited' },
+});
+```
+
+The simulator runs in-process against the same grammar the sandbox enforces. `auth: 'alice'` is shorthand for `{ uid: 'alice', token: {} }`. Ask the denial question the same way: change `auth` to `'mallory'` and read the verdict.
+
+## Ship the JSON
+
+```ts
+import { writeFileSync } from 'node:fs';
+writeFileSync('database.rules.json', JSON.stringify(rules.toJSON(), null, 2));
+```
+
+```bash
+pyric database rules lint database.rules.json
+# or: pyric database rules generate
+firebase deploy --only database
+```
+
+`toJSON()` emits the `{ rules: ... }` document Firebase expects. Generate or write that file locally (`pyric database rules generate`), then ship it with `firebase-tools` (or the Console) using the path your `firebase.json` points at. The CLI's `database rules lint`, `database rules validate`, and `database rules simulate` operations run the same checks against the JSON file, so CI can gate on them without TypeScript in the loop.
+
+## Turn enforcement, from a deployed game
+
+The tic-tac-toe [case study](../whats-possible/) is built from these same parts, deployed and playable:
+
+```ts
+import {
+  ruleset, deny, any, isNew, authenticated,
+  turnGuard, flip, winCheckHelper,
+} from 'pyric/rules';
+
+const LINES = [[0,1,2],[3,4,5],[6,7,8],[0,3,6],[1,4,7],[2,5,8],[0,4,8],[2,4,6]];
+
+const game = ruleset({
+  '/': { read: deny(), write: deny() },
+  '/games/$gameId': {
+    read: authenticated(),
+    write: any(isNew(), turnGuard('currentTurn', { X: 'playerX', O: 'playerO' }, 'status', 'playing')),
+    children: {
+      '/currentTurn': { validate: flip(['X', 'O']) },
+      '/xWins': { validate: winCheckHelper('X', LINES) },
+      '/oWins': { validate: winCheckHelper('O', LINES) },
+    },
+  },
+});
+```
+
+Three constraints carry the whole game. `turnGuard` reads stored state, never the incoming write, so a player cannot hand themselves the turn. `flip` makes turn order a validation rule. And `winCheckHelper` verifies a win claim against the actual board, so the winner field only accepts the truth.
+
+## And from an agent
+
+An agent authors and checks the same way you do: lint and simulate locally (`pyric database rules lint`, `pyric database rules simulate`, or `rtdb_simulate_access` against the connected sandbox), generate JSON with `pyric database rules generate` / `rtdb_generate_rules`, then ship with `firebase-tools`. The [rtdb-security-rules skill](../skills/) packages the whole discipline.
+
+## Where to go next
+
+The full builder catalog, with the exact expression each one produces, is in the [constraints reference](../pyric-database-reference-constraints/). For the data side of RTDB, see [Sync realtime data](../sync-realtime-data/).

package/dist/serve/docs-ui/docs/rules-patterns/index.html

@@ -0,0 +1,68 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Apply production-tested Firestore Rules patterns · Pyric Studio</title><meta name="description" content="Learn the five moves that turn &#34;rules can't do that&#34; into a ruleset that deploys."><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.CQYSemvw.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/"> Overview </a><details class="docs-nav-group"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" open> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/" aria-current="page"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group"> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/" id="nav-group-overview"> Overview </a><details class="docs-nav-group" id="nav-group-run-locally"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-develop-with-firebase-apis"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-inspect-and-correct" open> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-inspect-the-sandbox"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-correct-security-rules"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/" aria-current="page"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-work-with-an-agent"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-verify-the-boundary"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-unchanged"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference"> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="#nav-group-inspect-and-correct">Inspect and correct</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <a href="#nav-section-inspect-and-correct-correct-security-rules">Correct Security Rules</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">Rules patterns</span> </li> </ol> </nav>  <article class="prose">  <h1 id="apply-production-tested-firestore-rules-patterns">Apply production-tested Firestore Rules patterns</h1>
+<p>The rules language cannot loop. It cannot build a map key out of strings. And it evaluates under budgets that are real but invisible. Every hard ruleset that exists anyway, chess included, is built from a small set of moves that work with those constraints instead of against them. Here they are, generalized from the game rules where they were proven against production.</p>
+<h2 id="move-the-logic-into-a-document">Move the logic into a document</h2>
+<p><strong>The problem.</strong> Validating a transition like “a knight on b1 may reach a3 or c3” looks like it needs one hand-written OR branch per legal pair. For checkers that was 49 branches per direction per piece type. For chess, thousands.</p>
+<p><strong>The move.</strong> Store the legal transitions as data in a config document. Rules read it once with <code>get()</code> and validate with nested dynamic access:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="rules"><code><span class="line"><span style="color:#C678DD">function</span><span style="color:#ABB2BF"> config() {</span></span>
+<span class="line"><span style="color:#C678DD">  return</span><span style="color:#56B6C2"> get</span><span style="color:#ABB2BF">(/databases/$(database)/documents/gameConfig/checkers).data;</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">function</span><span style="color:#ABB2BF"> validGeometry() {</span></span>
+<span class="line"><span style="color:#C678DD">  let</span><span style="color:#ABB2BF"> mf = </span><span style="color:#E5C07B">request</span><span style="color:#ABB2BF">.</span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data.moveFrom;</span></span>
+<span class="line"><span style="color:#C678DD">  let</span><span style="color:#ABB2BF"> mt = </span><span style="color:#E5C07B">request</span><span style="color:#ABB2BF">.</span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data.moveTo;</span></span>
+<span class="line"><span style="color:#C678DD">  let</span><span style="color:#ABB2BF"> piece = </span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data[mf];</span></span>
+<span class="line"><span style="color:#C678DD">  return</span><span style="color:#ABB2BF"> config().moves[piece][mf][mt] == </span><span style="color:#D19A66">true</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p>Three expressions replace hundreds of branches. It works because of three engine facts:</p>
+<ul>
+<li>Dynamic map access is legal when the key is a stored field value. Computed strings are not.</li>
+<li><code>get()</code> results are cached per request, so every function sharing <code>config()</code> costs one read of the ten-read budget.</li>
+<li>A key absent from the map evaluates as a non-match, so absence is the deny. That default is the security property.</li>
+</ul>
+<p><strong>The receipt.</strong> Rewriting checkers from hardcoded branches to a lookup document took the ruleset from 30 KB and 611 lines to 7 KB and 86 lines, a 77 percent reduction, and removed the budget pressure the hardcoded version needed extra scaffolding to survive.</p>
+<p>One operational note: the config document must exist before the rules go live. If it does not, <code>get()</code> returns null and every move denies.</p>
+<h2 id="block-the-path-with-data">Block the path with data</h2>
+<p><strong>The problem.</strong> Some transitions are valid only when everything between two points is clear. A rook moving a1 to e1 requires b1, c1, and d1 empty. Hardcoded, every from-to pair needs its own emptiness checks.</p>
+<p><strong>The move.</strong> Store the between-cells in the config document, where <code>paths[from][to]</code> holds a length and the cell names, then check them with short-circuit OR:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="rules"><code><span class="line"><span style="color:#C678DD">function</span><span style="color:#ABB2BF"> pathClear() {</span></span>
+<span class="line"><span style="color:#C678DD">  let</span><span style="color:#ABB2BF"> mf = </span><span style="color:#E5C07B">request</span><span style="color:#ABB2BF">.</span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data.moveFrom;</span></span>
+<span class="line"><span style="color:#C678DD">  let</span><span style="color:#ABB2BF"> mt = </span><span style="color:#E5C07B">request</span><span style="color:#ABB2BF">.</span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data.moveTo;</span></span>
+<span class="line"><span style="color:#C678DD">  let</span><span style="color:#ABB2BF"> path = config().paths[mf][mt];</span></span>
+<span class="line"><span style="color:#C678DD">  return</span><span style="color:#ABB2BF"> (path.len &#x3C; </span><span style="color:#D19A66">1</span><span style="color:#ABB2BF"> || </span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data[path.c0] == </span><span style="color:#98C379">''</span><span style="color:#ABB2BF">)</span></span>
+<span class="line"><span style="color:#ABB2BF">      &#x26;&#x26; (path.len &#x3C; </span><span style="color:#D19A66">2</span><span style="color:#ABB2BF"> || </span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data[path.c1] == </span><span style="color:#98C379">''</span><span style="color:#ABB2BF">)</span></span>
+<span class="line"><span style="color:#ABB2BF">      &#x26;&#x26; (path.len &#x3C; </span><span style="color:#D19A66">3</span><span style="color:#ABB2BF"> || </span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data[path.c2] == </span><span style="color:#98C379">''</span><span style="color:#ABB2BF">);</span></span>
+<span class="line"><span style="color:#7F848E;font-style:italic">      // ...continue to c5 for the longest path on an 8x8 board</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p><code>path.len &#x3C; 2</code> is true for short paths, so the check skips cells the path does not have. The discovery that makes this expressible at all: a value retrieved from <code>get()</code> can be used as a dynamic key into <code>resource.data</code>. That one fact was probed and confirmed against production, and it is what sliding pieces stand on.</p>
+<h2 id="look-up-by-type-dont-branch-by-type">Look up by type, don’t branch by type</h2>
+<p><strong>The problem.</strong> Chess has twelve piece types that move differently. Twelve validation functions, each with its own branch lists, is more code than the compiler will accept.</p>
+<p><strong>The move.</strong> Read the type from pre-write state and make it the first key of the lookup. In <code>config().moves[piece][from][to]</code>, <code>piece</code> is <code>resource.data[moveFrom]</code>. One function covers every type.</p>
+<p>The load-bearing detail is which side of the write the type comes from:</p>
+<ul>
+<li>The client declares where the piece moves, in <code>request.resource.data</code>.</li>
+<li>The rules read what piece sits there from <code>resource.data</code>, the existing board the client does not control.</li>
+</ul>
+<p>A client cannot claim a pawn moved like a queen, because the pawn’s identity was never in its hands.</p>
+<h2 id="give-every-rule-a-unique-first-expression">Give every rule a unique first expression</h2>
+<p><strong>The problem.</strong> Firestore evaluates the allow rules of a match block in order, against a shared per-request expression budget. When several rules open with the same check, the non-matching rules evaluate deep and burn the budget before the matching rule is reached. The matching rule then fails as a silent 403.</p>
+<p>This was discovered the hard way, debugging chess: pawn moves denied while every rule tested fine in isolation, and reordering the rules changed which category failed.</p>
+<p><strong>The move.</strong> Open every allow rule with a cheap discriminator that is unique to it:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="rules"><code><span class="line"><span style="color:#C678DD">allow</span><span style="color:#61AFEF"> update</span><span style="color:#ABB2BF">: </span><span style="color:#C678DD">if</span><span style="color:#E5C07B"> request</span><span style="color:#ABB2BF">.</span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data.moveType == </span><span style="color:#98C379">'pawn_forward'</span></span>
+<span class="line"><span style="color:#ABB2BF">  &#x26;&#x26; isMyTurn() &#x26;&#x26; validPawnForward(config());</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">allow</span><span style="color:#61AFEF"> update</span><span style="color:#ABB2BF">: </span><span style="color:#C678DD">if</span><span style="color:#E5C07B"> request</span><span style="color:#ABB2BF">.</span><span style="color:#E5C07B">resource</span><span style="color:#ABB2BF">.data.moveType == </span><span style="color:#98C379">'capture'</span></span>
+<span class="line"><span style="color:#ABB2BF">  &#x26;&#x26; isMyTurn() &#x26;&#x26; validCapture(config()) &#x26;&#x26; pathClear();</span></span></code></pre>
+<p>A non-matching write now fails each foreign rule in one expression. Chess ships eleven distinct <code>moveType</code> values for exactly this reason. Pyric’s linter flags the violation as SHARED_GATE when two rules in a match block open with the same gate expression.</p>
+<h2 id="data-over-code-the-pattern-under-the-patterns">Data over code, the pattern under the patterns</h2>
+<p>Every move above is one idea wearing different clothes. When the rules language cannot compute something, move the computation out, and make the rules verify instead.</p>
+<p>There are three places the computation can go:</p>
+<ul>
+<li><strong>Into a config document, ahead of time.</strong> Move geometry, path cells, win lines, tax bracket boundaries. A generator computes it once, and the rules look it up.</li>
+<li><strong>Into the client, verified per write.</strong> The client declares which cell changed, and the rules verify the declaration against the board. The client claims a win, and the rules check the claimed line. Neither side trusts the other.</li>
+<li><strong>Into counter fields, kept honest by arithmetic.</strong> Scanning a board for “no opponent pieces left” costs 64 expressions. A <code>guestCount</code> field that every capture must decrement by exactly one makes the win check a single expression: <code>guestCount == 0</code>.</li>
+</ul>
+<p>The US tax example takes this the whole way. The client computes its own tax return, and the rules verify every intermediate figure against the bracket config. A return that lies about its math is a permission denial.</p>
+<h2 id="load-the-patterns-through-an-agent">Load the patterns through an agent</h2>
+<p>The patterns with stable shapes ship as standard library modules an agent imports instead of re-deriving: <code>geometry</code> for the config-document lookup, <code>counters</code> for the honest arithmetic, <code>timing</code> for cooldowns. <code>firestore_rules_stdlib_get</code> serves each with its gotchas attached, and <code>firestore_lint_rules</code> catches a shared gate before it costs a debugging session. See <a href="../skills/">skills</a>.</p>
+<h2 id="where-to-go-next">Where to go next</h2>
+<p>These techniques run up against real budgets, and the exact numbers are in <a href="../firestore-rules-limits/">the measured limits</a>. To see how far the techniques reach, read the <a href="../whats-possible/">case studies</a>.</p>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#move-the-logic-into-a-document">Move the logic into a document</a> </li><li data-depth="2"> <a href="#block-the-path-with-data">Block the path with data</a> </li><li data-depth="2"> <a href="#look-up-by-type-dont-branch-by-type">Look up by type, don’t branch by type</a> </li><li data-depth="2"> <a href="#give-every-rule-a-unique-first-expression">Give every rule a unique first expression</a> </li><li data-depth="2"> <a href="#data-over-code-the-pattern-under-the-patterns">Data over code, the pattern under the patterns</a> </li><li data-depth="2"> <a href="#load-the-patterns-through-an-agent">Load the patterns through an agent</a> </li><li data-depth="2"> <a href="#where-to-go-next">Where to go next</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script> </body> </html>

package/dist/serve/docs-ui/docs/rules-patterns.md

@@ -0,0 +1,104 @@
+
+# Apply production-tested Firestore Rules patterns
+
+The rules language cannot loop. It cannot build a map key out of strings. And it evaluates under budgets that are real but invisible. Every hard ruleset that exists anyway, chess included, is built from a small set of moves that work with those constraints instead of against them. Here they are, generalized from the game rules where they were proven against production.
+
+## Move the logic into a document
+
+**The problem.** Validating a transition like "a knight on b1 may reach a3 or c3" looks like it needs one hand-written OR branch per legal pair. For checkers that was 49 branches per direction per piece type. For chess, thousands.
+
+**The move.** Store the legal transitions as data in a config document. Rules read it once with `get()` and validate with nested dynamic access:
+
+```rules
+function config() {
+  return get(/databases/$(database)/documents/gameConfig/checkers).data;
+}
+
+function validGeometry() {
+  let mf = request.resource.data.moveFrom;
+  let mt = request.resource.data.moveTo;
+  let piece = resource.data[mf];
+  return config().moves[piece][mf][mt] == true;
+}
+```
+
+Three expressions replace hundreds of branches. It works because of three engine facts:
+
+- Dynamic map access is legal when the key is a stored field value. Computed strings are not.
+- `get()` results are cached per request, so every function sharing `config()` costs one read of the ten-read budget.
+- A key absent from the map evaluates as a non-match, so absence is the deny. That default is the security property.
+
+**The receipt.** Rewriting checkers from hardcoded branches to a lookup document took the ruleset from 30 KB and 611 lines to 7 KB and 86 lines, a 77 percent reduction, and removed the budget pressure the hardcoded version needed extra scaffolding to survive.
+
+One operational note: the config document must exist before the rules go live. If it does not, `get()` returns null and every move denies.
+
+## Block the path with data
+
+**The problem.** Some transitions are valid only when everything between two points is clear. A rook moving a1 to e1 requires b1, c1, and d1 empty. Hardcoded, every from-to pair needs its own emptiness checks.
+
+**The move.** Store the between-cells in the config document, where `paths[from][to]` holds a length and the cell names, then check them with short-circuit OR:
+
+```rules
+function pathClear() {
+  let mf = request.resource.data.moveFrom;
+  let mt = request.resource.data.moveTo;
+  let path = config().paths[mf][mt];
+  return (path.len < 1 || resource.data[path.c0] == '')
+      && (path.len < 2 || resource.data[path.c1] == '')
+      && (path.len < 3 || resource.data[path.c2] == '');
+      // ...continue to c5 for the longest path on an 8x8 board
+}
+```
+
+`path.len < 2` is true for short paths, so the check skips cells the path does not have. The discovery that makes this expressible at all: a value retrieved from `get()` can be used as a dynamic key into `resource.data`. That one fact was probed and confirmed against production, and it is what sliding pieces stand on.
+
+## Look up by type, don't branch by type
+
+**The problem.** Chess has twelve piece types that move differently. Twelve validation functions, each with its own branch lists, is more code than the compiler will accept.
+
+**The move.** Read the type from pre-write state and make it the first key of the lookup. In `config().moves[piece][from][to]`, `piece` is `resource.data[moveFrom]`. One function covers every type.
+
+The load-bearing detail is which side of the write the type comes from:
+
+- The client declares where the piece moves, in `request.resource.data`.
+- The rules read what piece sits there from `resource.data`, the existing board the client does not control.
+
+A client cannot claim a pawn moved like a queen, because the pawn's identity was never in its hands.
+
+## Give every rule a unique first expression
+
+**The problem.** Firestore evaluates the allow rules of a match block in order, against a shared per-request expression budget. When several rules open with the same check, the non-matching rules evaluate deep and burn the budget before the matching rule is reached. The matching rule then fails as a silent 403.
+
+This was discovered the hard way, debugging chess: pawn moves denied while every rule tested fine in isolation, and reordering the rules changed which category failed.
+
+**The move.** Open every allow rule with a cheap discriminator that is unique to it:
+
+```rules
+allow update: if request.resource.data.moveType == 'pawn_forward'
+  && isMyTurn() && validPawnForward(config());
+
+allow update: if request.resource.data.moveType == 'capture'
+  && isMyTurn() && validCapture(config()) && pathClear();
+```
+
+A non-matching write now fails each foreign rule in one expression. Chess ships eleven distinct `moveType` values for exactly this reason. Pyric's linter flags the violation as SHARED_GATE when two rules in a match block open with the same gate expression.
+
+## Data over code, the pattern under the patterns
+
+Every move above is one idea wearing different clothes. When the rules language cannot compute something, move the computation out, and make the rules verify instead.
+
+There are three places the computation can go:
+
+- **Into a config document, ahead of time.** Move geometry, path cells, win lines, tax bracket boundaries. A generator computes it once, and the rules look it up.
+- **Into the client, verified per write.** The client declares which cell changed, and the rules verify the declaration against the board. The client claims a win, and the rules check the claimed line. Neither side trusts the other.
+- **Into counter fields, kept honest by arithmetic.** Scanning a board for "no opponent pieces left" costs 64 expressions. A `guestCount` field that every capture must decrement by exactly one makes the win check a single expression: `guestCount == 0`.
+
+The US tax example takes this the whole way. The client computes its own tax return, and the rules verify every intermediate figure against the bracket config. A return that lies about its math is a permission denial.
+
+## Load the patterns through an agent
+
+The patterns with stable shapes ship as standard library modules an agent imports instead of re-deriving: `geometry` for the config-document lookup, `counters` for the honest arithmetic, `timing` for cooldowns. `firestore_rules_stdlib_get` serves each with its gotchas attached, and `firestore_lint_rules` catches a shared gate before it costs a debugging session. See [skills](../skills/).
+
+## Where to go next
+
+These techniques run up against real budgets, and the exact numbers are in [the measured limits](../firestore-rules-limits/). To see how far the techniques reach, read the [case studies](../whats-possible/).

package/dist/serve/docs-ui/docs/rules-standard-library/index.html

@@ -0,0 +1,87 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Build Firestore Rules from tested modules · Pyric Studio</title><meta name="description" content="Compose security rules from tested modules, with an import system that compiles away before Firebase ever sees it."><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.CQYSemvw.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/"> Overview </a><details class="docs-nav-group"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" open> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/" aria-current="page"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group"> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <a class="docs-nav-toplink" href="/__pyric/ui/docs/overview/" id="nav-group-overview"> Overview </a><details class="docs-nav-group" id="nav-group-run-locally"> <summary>Run locally</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/start-building/"> Quickstart </a> </li><li> <a href="/__pyric/ui/docs/how-the-swap-works/"> How the swap works </a> </li><li> <a href="/__pyric/ui/docs/set-up-your-agent/"> Connect an agent </a> </li><li> <a href="/__pyric/ui/docs/test-in-node/"> Test in Node </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-develop-with-firebase-apis"> <summary>Develop with Firebase APIs</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/sign-in-and-manage-users/"> Sign in and manage users </a> </li><li> <a href="/__pyric/ui/docs/store-and-query-data/"> Store and query data </a> </li><li> <a href="/__pyric/ui/docs/sync-realtime-data/"> Sync realtime data </a> </li><li> <a href="/__pyric/ui/docs/store-files/"> Store files </a> </li><li> <a href="/__pyric/ui/docs/receive-messages/"> Receive messages </a> </li><li> <a href="/__pyric/ui/docs/run-ai-logic-locally/"> Run AI Logic locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-how-to-run-rtdb-onvaluecreated/"> Run an RTDB function locally </a> </li><li> <a href="/__pyric/ui/docs/which-data-service/"> Which data service? </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-inspect-and-correct" open> <summary>Inspect and correct</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-inspect-the-sandbox"> Inspect the sandbox </h2> <ul> <li> <a href="/__pyric/ui/docs/see-whats-happening/"> Traffic &amp; rule verdicts </a> </li><li> <a href="/__pyric/ui/docs/read-a-denial/"> Read a denial and understand it </a> </li><li> <a href="/__pyric/ui/docs/shape-your-data/"> Seed, snapshot, replay </a> </li><li> <a href="/__pyric/ui/docs/watch-and-review/"> Review agent activity </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-correct-security-rules"> Correct Security Rules </h2> <ul> <li> <a href="/__pyric/ui/docs/secure-it-with-rules/"> Security Rules </a> </li><li> <a href="/__pyric/ui/docs/simulate-and-lint/"> Simulate and lint before you deploy </a> </li><li> <a href="/__pyric/ui/docs/rules-patterns/"> Rules patterns </a> </li><li> <a href="/__pyric/ui/docs/rules-standard-library/" aria-current="page"> The rules standard library </a> </li><li> <a href="/__pyric/ui/docs/rtdb-rules-in-typescript/"> RTDB rules in TypeScript </a> </li><li> <a href="/__pyric/ui/docs/firestore-rules-limits/"> Rules limits </a> </li><li> <a href="/__pyric/ui/docs/whats-possible/"> Case studies </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-inspect-and-correct-work-with-an-agent"> Work with an agent </h2> <ul> <li> <a href="/__pyric/ui/docs/what-your-agent-can-do/"> Work through an agent </a> </li><li> <a href="/__pyric/ui/docs/skills/"> Agent skills </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-verify-the-boundary"> <summary>Verify the boundary</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-cli-how-to-verify-against-a-captured-session/"> Verify a captured session </a> </li><li> <a href="/__pyric/ui/docs/write-a-rules-test-suite/"> Write a rules test suite </a> </li><li> <a href="/__pyric/ui/docs/audit-your-rules/"> Audit rules and data </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-ship-unchanged"> <summary>Ship unchanged</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ship-to-production/"> Ship to production </a> </li><li> <a href="/__pyric/ui/docs/set-up-the-project/"> Set up the Firebase project </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-conformance"> <summary>Conformance</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/how-we-know-it-matches-firebase/"> Conformance </a> </li><li> <a href="/__pyric/ui/docs/whats-experimental/"> What&#39;s experimental </a> </li><li> <a href="/__pyric/ui/docs/pyric-conformance-scores/"> Conformance scores </a> </li><li> <a href="/__pyric/ui/docs/pyric-app-compat/"> App </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Realtime Database </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-compat/"> Rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-messaging-compat/"> Messaging </a> </li><li> <a href="/__pyric/ui/docs/pyric-ai-compat/"> AI Logic </a> </li><li> <a href="/__pyric/ui/docs/pyric-cli-functions-rtdb-compat/"> Functions · RTDB </a> </li> </ul> </div> </div> </details> <details class="docs-nav-group" id="nav-group-reference"> <summary>Reference</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section"> <ul> <li> <a href="/__pyric/ui/docs/pyric-cli/"> @pyric/cli </a> </li><li> <a href="/__pyric/ui/docs/pyric-explanation-versioning-and-compatibility/"> pyric </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore/"> pyric / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules/"> pyric / rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox/"> pyric / sandbox </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage/"> pyric / storage </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth/"> pyric / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-database/"> pyric / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-app/"> pyric-admin / app </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> pyric-admin / firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-auth/"> pyric-admin / auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-database/"> pyric-admin / database </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-storage/"> pyric-admin / storage </a> </li><li> <a href="/__pyric/ui/docs/ui/"> @pyric/ui </a> </li><li> <a href="/__pyric/ui/docs/api-reference/"> API reference </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="#nav-group-inspect-and-correct">Inspect and correct</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <a href="#nav-section-inspect-and-correct-correct-security-rules">Correct Security Rules</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">The rules standard library</span> </li> </ol> </nav>  <article class="prose">  <h1 id="build-firestore-rules-from-tested-modules">Build Firestore Rules from tested modules</h1>
+<p>This is a Firestore rules file:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="rules"><code><span class="line"><span style="color:#C678DD">rules_version</span><span style="color:#ABB2BF"> = </span><span style="color:#98C379">'2+modules'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { isMyTurn, turnFlipped } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> 'turns'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#C678DD">service</span><span style="color:#ABB2BF"> cloud.firestore {</span></span>
+<span class="line"><span style="color:#C678DD">  match</span><span style="color:#ABB2BF"> /databases/</span><span style="color:#E06C75;font-style:italic">{database}</span><span style="color:#ABB2BF">/documents {</span></span>
+<span class="line"><span style="color:#C678DD">    match</span><span style="color:#ABB2BF"> /games/</span><span style="color:#E06C75;font-style:italic">{gameId}</span><span style="color:#ABB2BF"> {</span></span>
+<span class="line"><span style="color:#C678DD">      allow</span><span style="color:#61AFEF"> update</span><span style="color:#ABB2BF">: </span><span style="color:#C678DD">if</span><span style="color:#ABB2BF"> isMyTurn() &#x26;&#x26; turnFlipped();</span></span>
+<span class="line"><span style="color:#ABB2BF">    }</span></span>
+<span class="line"><span style="color:#ABB2BF">  }</span></span>
+<span class="line"><span style="color:#ABB2BF">}</span></span></code></pre>
+<p>The rules language has no import statement. This file deploys anyway, and what lands on Firebase is stock <code>rules_version = '2'</code> with the two functions inlined at the top of the match tree. <code>isMyTurn</code> and <code>turnFlipped</code> are not snippets you pasted. They are functions from a tested module, pulled in by name.</p>
+<h2 id="an-import-system-that-compiles-away">An import system that compiles away</h2>
+<p>Declare <code>rules_version = '2+modules'</code> instead of <code>'2'</code> and the import syntax becomes legal. When you lint, simulate, or deploy, the resolver:</p>
+<ul>
+<li>reads each import and pulls in the functions you named, plus anything they call</li>
+<li>prefixes each module’s private helpers with the module name, so two modules can never collide</li>
+<li>orders dependencies before dependents and injects the result into your ruleset</li>
+<li>rewrites the version back to <code>'2'</code></li>
+</ul>
+<p>The output is byte-valid stock Firestore rules. Firebase never sees the module system.</p>
+<p>Two things to know once you are inside it:</p>
+<ul>
+<li>Imports resolve to flat names. You call <code>hasRequired([...])</code>, never <code>validation.hasRequired(...)</code>.</li>
+<li>If an imported function collides with one your file already defines, resolution fails loudly instead of shadowing anything.</li>
+</ul>
+<h2 id="rate-limits-atomic-pairs-and-state-machines">Rate limits, atomic pairs, and state machines</h2>
+<p>Fifteen modules ship with Pyric. A few exist specifically because the received wisdom says they can’t.</p>
+<p><strong>Rules can rate-limit.</strong> <code>timing.cooldownElapsed('lastMoveAt', 2)</code> allows an update only when the stored timestamp is more than two seconds old. On its own that is forgeable, because the client writes the timestamp and could write one from last week. So pair it with <code>isServerTimestamp('lastMoveAt')</code> from <code>lifecycle</code> on the same write, which forces the field to be the server’s own clock:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="rules"><code><span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { cooldownElapsed } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> 'timing'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"><span style="color:#C678DD">import</span><span style="color:#ABB2BF"> { isServerTimestamp } </span><span style="color:#C678DD">from</span><span style="color:#98C379"> 'lifecycle'</span><span style="color:#ABB2BF">;</span></span>
+<span class="line"></span>
+<span class="line"><span style="color:#7F848E;font-style:italic">// At most one move every 2 seconds</span></span>
+<span class="line"><span style="color:#C678DD">allow</span><span style="color:#61AFEF"> update</span><span style="color:#ABB2BF">: </span><span style="color:#C678DD">if</span><span style="color:#ABB2BF"> cooldownElapsed(</span><span style="color:#98C379">'lastMoveAt'</span><span style="color:#ABB2BF">, </span><span style="color:#D19A66">2</span><span style="color:#ABB2BF">)</span></span>
+<span class="line"><span style="color:#ABB2BF">  &#x26;&#x26; isServerTimestamp(</span><span style="color:#98C379">'lastMoveAt'</span><span style="color:#ABB2BF">);</span></span></code></pre>
+<p>A missing or non-timestamp field errors, and an error denies. Verified against the production rules engine, not a simulation of it.</p>
+<p><strong>Rules can enforce integrity across a batch.</strong> The <code>atomic</code> module uses the <code>get()</code>/<code>getAfter()</code> pair, where <code>getAfter()</code> reads another document as it will be after the current batch commits. <code>companionChangedBy(before, after, 'taskCount', 1)</code> allows a write only if a companion document’s counter moved by exactly one in the same batch.</p>
+<p>A solo write denies by construction: outside a batch, <code>getAfter()</code> equals <code>get()</code>, so the delta is zero. <code>consumedFlag</code> handles single-use invites the same way, pre-batch false and post-batch true, so a replay of the consuming write denies.</p>
+<p>Live-verified against a real production database, rules deployed and batch commits issued as a signed-in user. One thing to remember: every write in a batch is evaluated, so the companion write needs its own allow rule.</p>
+<p><strong>Rules can be a state machine.</strong> <code>transitions.validTransition('status', 'pending', 'paid')</code> names exactly which edge a write may traverse, and nothing else.</p>
+<p><strong>Membership can change safely with no backend.</strong> <code>spaces</code> gates a subcollection through its parent document’s members field, list-shaped or map-shaped, and fails closed when the field or the parent document is missing.</p>
+<p><code>joining</code> covers the write side. <code>onlyAddedSelf('members', 'editor')</code> uses set equality on the map diff, so the write adds exactly the caller at exactly that role. Nobody else changed, nobody removed, no self-granted admin.</p>
+<p>Compose it with <code>lifecycle.onlyFieldsChanged(['members'])</code> and a join cannot touch anything else on the document. Production-verified, ten scenarios of ten.</p>
+<p>One gotcha worth taking from <code>membership</code> even if you never import it: custom claims live at <code>request.auth.token.admin</code>, not <code>request.auth.admin</code>. The second form reads null and quietly denies forever.</p>
+<h2 id="the-everyday-modules">The everyday modules</h2>
+<p>The rest of the shelf covers the common shapes.</p>
+<div class="table-scroll">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+<table><thead><tr><th>Module</th><th>What it covers</th></tr></thead><tbody><tr><td><code>auth</code></td><td>the two checks every app writes first</td></tr><tr><td><code>validation</code></td><td>field shape and enum checks</td></tr><tr><td><code>lifecycle</code></td><td><code>onlyFieldsChanged</code>, the single most common update guard: users may edit these fields and nothing else</td></tr><tr><td><code>content</code></td><td>author-owned documents with draft visibility and soft delete</td></tr><tr><td><code>counters</code></td><td>client-maintained numbers that may only change by known steps</td></tr><tr><td><code>lobby</code>, <code>turns</code>, <code>state</code>, <code>geometry</code></td><td>the game set the case studies are built from</td></tr></tbody></table></div>
+<p>Every module ships with test fixtures that execute against the rules engine in CI, and each case must decide allow or deny as expected. The modules making the boldest claims, <code>timing</code>, <code>atomic</code>, <code>spaces</code>, <code>joining</code>, and <code>geometry</code>, are verified against production Firebase as well.</p>
+<p>This page is a guide, not the catalog. The full module list, every signature with its gotchas, lives in the module manifest until the reference section lands.</p>
+<h2 id="load-standard-modules-through-an-agent">Load standard modules through an agent</h2>
+<p>An agent does not memorize any of this. <code>firestore_rules_stdlib_get({ key: 'timing' })</code> returns a module’s signatures, examples, and gotchas, and the resolver runs in-process, so the agent composes a ruleset from modules, lints it, and simulates verdicts before anything deploys. See <a href="../skills/">skills</a>.</p>
+<h2 id="where-to-go-next">Where to go next</h2>
+<p>The modules are built from techniques you can use directly, in <a href="../rules-patterns/">rules patterns</a>. To prove a composed ruleset behaves before it ships, go to <a href="../simulate-and-lint/">simulate and lint before you deploy</a>.</p>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#an-import-system-that-compiles-away">An import system that compiles away</a> </li><li data-depth="2"> <a href="#rate-limits-atomic-pairs-and-state-machines">Rate limits, atomic pairs, and state machines</a> </li><li data-depth="2"> <a href="#the-everyday-modules">The everyday modules</a> </li><li data-depth="2"> <a href="#load-standard-modules-through-an-agent">Load standard modules through an agent</a> </li><li data-depth="2"> <a href="#where-to-go-next">Where to go next</a> </li> </ul> </aside> </div> <script type="module">const a=document.querySelector("[data-api-symbol-filter]"),d=[...document.querySelectorAll("[data-api-symbol-group]")],n=document.querySelector("[data-api-symbol-empty]");a?.addEventListener("input",()=>{const t=a.value.trim().toLowerCase();let o=0;for(const i of d){let e=0;i.querySelectorAll("[data-api-symbol]").forEach(l=>{const r=!t||(l.dataset.apiSymbol??"").includes(t);l.hidden=!r,r&&e++}),i.hidden=e===0,o+=e}n&&(n.hidden=o>0)});</script> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> <script type="module">document.querySelector('.studio__nav [aria-current="page"]')?.scrollIntoView({block:"nearest",inline:"center"});</script> </body> </html>