@pyric/ui 0.1.0-alpha.10

package/dist/rtdb/values.js

@@ -0,0 +1,186 @@
+/**
+ * RTDB path + value helpers (pure). Paths are ALWAYS normalized to the
+ * `'/'`-rooted form (`'/'` for the root, `'/a/b'` otherwise) so every module in
+ * this package — the tree reducer, the path bar, the viewer components — agrees
+ * on what a path is.
+ */
+export function normalizeRtdbPath(path) {
+    const segments = path.split('/').filter(Boolean);
+    return segments.length === 0 ? '/' : `/${segments.join('/')}`;
+}
+export function rtdbPathSegments(path) {
+    return normalizeRtdbPath(path).split('/').filter(Boolean);
+}
+export function joinRtdbPath(base, child) {
+    return normalizeRtdbPath([...rtdbPathSegments(base), ...child.split('/').filter(Boolean)].join('/'));
+}
+export function parentRtdbPath(path) {
+    const segments = rtdbPathSegments(path);
+    if (segments.length <= 1)
+        return '/';
+    return `/${segments.slice(0, -1).join('/')}`;
+}
+/**
+ * The path of `target` RELATIVE to `base`, or `null` when `target` is not
+ * `base` or one of its descendants. `'/'` means "target IS base". Lets the
+ * tree address nodes by absolute database path while the loaded value sits at
+ * the view root.
+ */
+export function relativeRtdbPath(base, target) {
+    const baseSegs = rtdbPathSegments(base);
+    const targetSegs = rtdbPathSegments(target);
+    if (targetSegs.length < baseSegs.length)
+        return null;
+    for (let i = 0; i < baseSegs.length; i++) {
+        if (targetSegs[i] !== baseSegs[i])
+            return null;
+    }
+    const rest = targetSegs.slice(baseSegs.length);
+    return rest.length === 0 ? '/' : `/${rest.join('/')}`;
+}
+export function isRtdbObjectValue(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Normalize a snapshot value to RTDB semantics before it enters tree state:
+ * an empty object IS null (RTDB has no empty containers — the server prunes
+ * them), so `{}` — and any object whose children all normalize away — becomes
+ * `null`. Without this, an empty database's root value `{}` fails
+ * `hasRtdbChildren` and renders as a scalar leaf (`String({})` →
+ * `"[object Object]"`). Reuses the input object when nothing changed.
+ */
+export function normalizeRtdbSnapshotValue(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== 'object')
+        return value;
+    const record = value;
+    let changed = false;
+    const next = {};
+    for (const [key, child] of Object.entries(record)) {
+        const normalized = normalizeRtdbSnapshotValue(child);
+        if (normalized === null) {
+            changed = true;
+            continue;
+        }
+        if (normalized !== child)
+            changed = true;
+        next[key] = normalized;
+    }
+    if (Object.keys(next).length === 0)
+        return null;
+    return changed ? next : value;
+}
+/** Leaf value text, console style: strings quoted, primitives literal.
+ *  Defensive on objects: never `String`-coerce (that's `[object Object]`) —
+ *  fall back to JSON. Object values should have been normalized/expanded away
+ *  before reaching a leaf label; this keeps the label honest if one slips in. */
+export function formatRtdbValueLabel(value) {
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (value === null || value === undefined)
+        return 'null';
+    if (typeof value === 'object') {
+        try {
+            return JSON.stringify(value) ?? 'null';
+        }
+        catch {
+            return 'null';
+        }
+    }
+    return String(value);
+}
+/** Does this value render as a PARENT node (has child keys)? RTDB has no true
+ *  arrays — an array is an object with numeric keys, and renders as one. */
+export function hasRtdbChildren(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    return Object.keys(value).length > 0;
+}
+/** Child entries sorted RTDB-console style: numeric-aware key order
+ *  (`2` before `10`), then lexicographic. */
+export function rtdbChildEntries(value) {
+    if (value === null || typeof value !== 'object')
+        return [];
+    return Object.entries(value).sort(([a], [b]) => a.localeCompare(b, undefined, { numeric: true }));
+}
+export function rtdbValueAt(root, path) {
+    let value = root ?? null;
+    for (const segment of rtdbPathSegments(path)) {
+        if (value === null || typeof value !== 'object')
+            return null;
+        value = value[segment] ?? null;
+    }
+    return value;
+}
+export function formatRtdbJson(value) {
+    return JSON.stringify(value ?? null, null, 2);
+}
+export function parseRtdbJson(value) {
+    const text = value.trim();
+    return text.length === 0 ? null : JSON.parse(text);
+}
+export function rtdbValueKind(value) {
+    if (value === null || value === undefined)
+        return 'null';
+    if (Array.isArray(value))
+        return 'array';
+    return typeof value;
+}
+/** Structural equality for JSON-shaped RTDB snapshots and row fingerprints. */
+export function rtdbValuesEqual(previous, next) {
+    if (Object.is(previous, next))
+        return true;
+    if (Array.isArray(previous) || Array.isArray(next)) {
+        if (!Array.isArray(previous) || !Array.isArray(next))
+            return false;
+        if (previous.length !== next.length)
+            return false;
+        return previous.every((value, index) => rtdbValuesEqual(value, next[index]));
+    }
+    if (previous === null ||
+        next === null ||
+        typeof previous !== 'object' ||
+        typeof next !== 'object') {
+        return false;
+    }
+    const previousRecord = previous;
+    const nextRecord = next;
+    const previousKeys = Object.keys(previousRecord);
+    const nextKeys = Object.keys(nextRecord);
+    if (previousKeys.length !== nextKeys.length)
+        return false;
+    return previousKeys.every((key) => key in nextRecord && rtdbValuesEqual(previousRecord[key], nextRecord[key]));
+}
+/** One comparison fingerprint per RTDB row. Parent fingerprints contain only
+ * direct child keys, so leaf changes remain local while additions/removals
+ * also light the immediate parent. */
+export function rtdbUpdateEntries(value, rootPath) {
+    const entries = new Map();
+    const visit = (current, path) => {
+        if (!hasRtdbChildren(current)) {
+            entries.set(path, ['leaf', current ?? null]);
+            return;
+        }
+        const children = rtdbChildEntries(current);
+        entries.set(path, ['parent', children.map(([key]) => key)]);
+        for (const [key, child] of children)
+            visit(child, joinRtdbPath(path, key));
+    };
+    visit(value, normalizeRtdbPath(rootPath));
+    return entries;
+}
+export function previewRtdbValue(value) {
+    if (value === null || value === undefined)
+        return 'null';
+    if (Array.isArray(value))
+        return `${value.length} items`;
+    if (isRtdbObjectValue(value)) {
+        const count = Object.keys(value).length;
+        return count === 1 ? '1 child' : `${count} children`;
+    }
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    return String(value);
+}
+//# sourceMappingURL=values.js.map

package/dist/rtdb/values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.js","sourceRoot":"","sources":["../../src/rtdb/values.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACtD,OAAO,iBAAiB,CAAC,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC3D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,UAAU,KAAK,KAAK;YAAE,OAAO,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAChC,CAAC;AAED;;;iFAGiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;6CAC6C;AAC7C,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACxE,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,IAAY;IACrD,IAAI,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7D,KAAK,GAAI,KAAiC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAiB,EAAE,IAAa;IAC9D,IAAI,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAClD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IACE,QAAQ,KAAK,IAAI;QACjB,IAAI,KAAK,IAAI;QACb,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,IAAI,KAAK,QAAQ,EACxB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,cAAc,GAAG,QAAmC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAA+B,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,YAAY,CAAC,KAAK,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,UAAU,IAAI,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED;;sCAEsC;AACtC,MAAM,UAAU,iBAAiB,CAC/B,KAAc,EACd,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAE,EAAE;QAC/C,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ;YAAE,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,MAAM,QAAQ,CAAC;IACzD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QACxC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/rules/components/DenialInspector.d.ts

@@ -0,0 +1,18 @@
+import type { DenialInspectorProps } from '../types.js';
+/**
+ * Headless inspector for a single denied Firestore request. Renders, per
+ * the `denial-inspector-spec`:
+ *   - the plain-language reason (`data-pyric-denial-reason`)
+ *   - the rule source, line-marked (`data-pyric-rule-source`, per-line
+ *     `data-pyric-line-verdict="deny|allow|skip"`)
+ *   - the expression step-through (`data-pyric-trace` + per-node hooks)
+ *   - data in scope (`data-pyric-scope`, `-scope-var`, `-scope-hit`)
+ *   - the re-run / verify loop (`data-pyric-rerun`)
+ *   - the cluster of sibling denials (`data-pyric-denial-cluster`)
+ *   - path resolution for no-match denials (`data-pyric-path-resolution`)
+ *
+ * Zero styling — every visual decision is a consumer's via the
+ * `data-pyric-*` hooks. `mocks/c-debug.html` is the CSS spec.
+ */
+export declare function DenialInspector({ denial, cluster, onRerunAs, onTestEditedRule, onSelectCluster, className, }: DenialInspectorProps): import("react").JSX.Element;
+//# sourceMappingURL=DenialInspector.d.ts.map

package/dist/rules/components/DenialInspector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DenialInspector.d.ts","sourceRoot":"","sources":["../../../src/rules/components/DenialInspector.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAU,oBAAoB,EAAkB,MAAM,aAAa,CAAC;AAyEhF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,SAAS,GACV,EAAE,oBAAoB,+BAkItB"}

package/dist/rules/components/DenialInspector.js

@@ -0,0 +1,58 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { denialReason, markRuleLines, decidingEvaluation, formatValue, traceDepth, } from './format.js';
+import { scopeVars } from './scope.js';
+function lensUid(denial) {
+    const lens = denial.lens;
+    if (lens && typeof lens === 'object' && 'as' in lens)
+        return lens.as;
+    return denial.auth?.uid;
+}
+/** Render one scope value, underlining the keys the rule read. */
+function ScopeValue({ value, hits }) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return _jsx(_Fragment, { children: formatValue(value) });
+    }
+    const entries = Object.entries(value);
+    const hitSet = new Set(hits);
+    return (_jsxs(_Fragment, { children: ['{ ', entries.map(([k, v], i) => (_jsxs("span", { children: [i > 0 ? ', ' : '', k, ":", ' ', hitSet.has(k) ? (_jsx("span", { "data-pyric-scope-hit": "", children: formatValue(v) })) : (formatValue(v))] }, k))), ' }'] }));
+}
+/** The step-through evaluation: each sub-expression and its real value. */
+function EvaluationTrace({ trace }) {
+    return (_jsx("div", { "data-pyric-trace": "", children: trace.map((node, i) => {
+            const depth = traceDepth(trace, i);
+            const isFalse = node.value === false;
+            return (_jsxs("div", { "data-pyric-trace-node": "", "data-pyric-depth": depth, ...(node.skipped ? { 'data-pyric-skipped': '' } : {}), ...(node.letBinding ? { 'data-pyric-let': node.letBinding.name } : {}), ...(node.inlinedFrom ? { 'data-pyric-frame': node.inlinedFrom.name } : {}), children: [_jsx("span", { "data-pyric-trace-source": "", children: node.source }), _jsx("span", { "data-pyric-trace-value": "", ...(isFalse ? { 'data-pyric-false': '' } : {}), children: node.skipped
+                            ? 'skipped'
+                            : node.error != null
+                                ? `error: ${node.error}`
+                                : formatValue(node.value) })] }, i));
+        }) }));
+}
+/**
+ * Headless inspector for a single denied Firestore request. Renders, per
+ * the `denial-inspector-spec`:
+ *   - the plain-language reason (`data-pyric-denial-reason`)
+ *   - the rule source, line-marked (`data-pyric-rule-source`, per-line
+ *     `data-pyric-line-verdict="deny|allow|skip"`)
+ *   - the expression step-through (`data-pyric-trace` + per-node hooks)
+ *   - data in scope (`data-pyric-scope`, `-scope-var`, `-scope-hit`)
+ *   - the re-run / verify loop (`data-pyric-rerun`)
+ *   - the cluster of sibling denials (`data-pyric-denial-cluster`)
+ *   - path resolution for no-match denials (`data-pyric-path-resolution`)
+ *
+ * Zero styling — every visual decision is a consumer's via the
+ * `data-pyric-*` hooks. `mocks/c-debug.html` is the CSS spec.
+ */
+export function DenialInspector({ denial, cluster, onRerunAs, onTestEditedRule, onSelectCluster, className, }) {
+    const deciding = decidingEvaluation(denial.evaluation);
+    const lines = markRuleLines(denial.rulesSource, denial.evaluation, denial.method);
+    const scope = scopeVars(denial);
+    const rerunUid = lensUid(denial);
+    const isNoMatch = denial.evaluation.length === 0;
+    return (_jsxs("div", { className: className, "data-pyric-ui": "denial-inspector", children: [_jsxs("header", { "data-pyric-denial-header": "", children: [_jsxs("p", { "data-pyric-denial-title": "", children: ["Denied: ", _jsx("span", { "data-pyric-denial-method": "", children: denial.method }), ' ', _jsx("span", { "data-pyric-denial-path": "", children: denial.path })] }), _jsxs("p", { "data-pyric-denial-context": "", children: [denial.auth ? `by ${denial.auth.uid}` : 'unauthenticated', denial.lens && typeof denial.lens === 'object' && 'as' in denial.lens
+                                ? ` · acting as ${denial.lens.as}`
+                                : denial.lens === 'admin'
+                                    ? ' · admin'
+                                    : ''] })] }), _jsx("p", { "data-pyric-denial-reason": "", children: denialReason(denial.evaluation, denial.method, denial.path) }), _jsx("section", { "data-pyric-rule-source": "", children: lines.map((line) => (_jsxs("div", { "data-pyric-rule-line": "", "data-pyric-line-number": line.number, ...(line.verdict ? { 'data-pyric-line-verdict': line.verdict } : {}), children: [_jsx("span", { "data-pyric-line-gutter": "", children: line.number }), _jsx("span", { "data-pyric-line-text": "", children: line.text }), line.note ? _jsx("span", { "data-pyric-line-note": "", children: line.note }) : null, line.verdict === 'deny' ? (_jsx("span", { "data-pyric-line-badge": "", children: "denied" })) : null] }, line.number))) }), deciding?.expressionTrace && deciding.expressionTrace.length > 0 ? (_jsx(EvaluationTrace, { trace: deciding.expressionTrace })) : null, scope.length > 0 ? (_jsx("section", { "data-pyric-scope": "", children: scope.map((v) => (_jsxs("div", { "data-pyric-scope-var": v.name, children: [_jsx("span", { "data-pyric-scope-name": "", children: v.name }), _jsx("span", { "data-pyric-scope-tag": "", children: v.tag }), _jsx("span", { "data-pyric-scope-value": "", children: _jsx(ScopeValue, { value: v.value, hits: v.hits }) })] }, v.name))) })) : null, isNoMatch && denial.pathResolution ? (_jsx("section", { "data-pyric-path-resolution": "", children: denial.pathResolution.attempts.map((attempt, i) => (_jsxs("div", { "data-pyric-path-attempt": "", "data-pyric-matched-segments": `${attempt.matchedSegments}/${attempt.totalSegments}`, ...(attempt.matched ? { 'data-pyric-matched': '' } : {}), ...(attempt.reason ? { 'data-pyric-reason': attempt.reason } : {}), children: [_jsx("span", { "data-pyric-attempt-path": "", children: attempt.blockPath }), attempt.reason ? (_jsx("span", { "data-pyric-attempt-reason": "", children: attempt.reason })) : null] }, i))) })) : null, onRerunAs || onTestEditedRule ? (_jsxs("section", { "data-pyric-rerun": "", children: [onRerunAs && rerunUid ? (_jsxs("button", { type: "button", "data-pyric-rerun-as": "", "data-pyric-rerun-uid": rerunUid, onClick: () => onRerunAs(rerunUid), children: ["Re-run as ", rerunUid] })) : null, onTestEditedRule ? (_jsx("button", { type: "button", "data-pyric-test-edited-rule": "", onClick: () => onTestEditedRule(), children: "Test against an edited rule" })) : null] })) : null, cluster && cluster.length > 0 ? (_jsx("section", { "data-pyric-denial-cluster": "", children: cluster.map((sibling, i) => (_jsx("button", { type: "button", "data-pyric-cluster-item": "", onClick: () => onSelectCluster?.(sibling), children: _jsx("span", { "data-pyric-cluster-path": "", children: sibling.path }) }, i))) })) : null] }));
+}
+//# sourceMappingURL=DenialInspector.js.map

package/dist/rules/components/DenialInspector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DenialInspector.js","sourceRoot":"","sources":["../../../src/rules/components/DenialInspector.tsx"],"names":[],"mappings":";AAEA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC;IACrE,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;AAC1B,CAAC;AAED,kEAAkE;AAClE,SAAS,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAsC;IACrE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,4BAAG,WAAW,CAAC,KAAK,CAAC,GAAI,CAAC;IACnC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CACL,8BACG,IAAI,EACJ,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAC1B,2BACG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EACjB,CAAC,OAAG,GAAG,EACP,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACf,uCAA2B,EAAE,YAAE,WAAW,CAAC,CAAC,CAAC,GAAQ,CACtD,CAAC,CAAC,CAAC,CACF,WAAW,CAAC,CAAC,CAAC,CACf,KAPQ,CAAC,CAQL,CACR,CAAC,EACD,IAAI,IACJ,CACJ,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,EAAE,KAAK,EAA+B;IAC7D,OAAO,CACL,kCAAsB,EAAE,YACrB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACrB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;YACrC,OAAO,CACL,wCAEwB,EAAE,sBACN,KAAK,KACnB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAClD,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACnE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAE3E,0CAA8B,EAAE,YAAE,IAAI,CAAC,MAAM,GAAQ,EACrD,yCAA6B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YAC5E,IAAI,CAAC,OAAO;4BACX,CAAC,CAAC,SAAS;4BACX,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;gCAClB,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE;gCACxB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GACxB,KAdF,CAAC,CAeF,CACP,CAAC;QACJ,CAAC,CAAC,GACE,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,SAAS,GACY;IACrB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IAEjD,OAAO,CACL,eAAK,SAAS,EAAE,SAAS,mBAAgB,kBAAkB,aACzD,8CAAiC,EAAE,aACjC,wCAA2B,EAAE,yBACnB,2CAA+B,EAAE,YAAE,MAAM,CAAC,MAAM,GAAQ,EAAC,GAAG,EACpE,yCAA6B,EAAE,YAAE,MAAM,CAAC,IAAI,GAAQ,IAClD,EACJ,0CAA6B,EAAE,aAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,iBAAiB,EACzD,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI;gCACpE,CAAC,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;gCAClC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;oCACvB,CAAC,CAAC,UAAU;oCACZ,CAAC,CAAC,EAAE,IACN,IACG,EAGT,wCAA4B,EAAE,YAC3B,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAC1D,EAGJ,4CAAgC,EAAE,YAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,uCAEuB,EAAE,4BACC,IAAI,CAAC,MAAM,KAC/B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAErE,yCAA6B,EAAE,YAAE,IAAI,CAAC,MAAM,GAAQ,EACpD,uCAA2B,EAAE,YAAE,IAAI,CAAC,IAAI,GAAQ,EAC/C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,uCAA2B,EAAE,YAAE,IAAI,CAAC,IAAI,GAAQ,CAAC,CAAC,CAAC,IAAI,EACnE,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CACzB,wCAA4B,EAAE,uBAAc,CAC7C,CAAC,CAAC,CAAC,IAAI,KAVH,IAAI,CAAC,MAAM,CAWZ,CACP,CAAC,GACM,EAGT,QAAQ,EAAE,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAClE,KAAC,eAAe,IAAC,KAAK,EAAE,QAAQ,CAAC,eAAe,GAAI,CACrD,CAAC,CAAC,CAAC,IAAI,EAGP,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAClB,sCAA0B,EAAE,YACzB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAChB,uCAAwC,CAAC,CAAC,IAAI,aAC5C,wCAA4B,EAAE,YAAE,CAAC,CAAC,IAAI,GAAQ,EAC9C,uCAA2B,EAAE,YAAE,CAAC,CAAC,GAAG,GAAQ,EAC5C,yCAA6B,EAAE,YAC7B,KAAC,UAAU,IAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,GAAI,GACvC,KALC,CAAC,CAAC,IAAI,CAMV,CACP,CAAC,GACM,CACX,CAAC,CAAC,CAAC,IAAI,EAGP,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CACpC,gDAAoC,EAAE,YACnC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAClD,0CAE0B,EAAE,iCACG,GAAG,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,aAAa,EAAE,KAC9E,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACrD,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAEnE,0CAA8B,EAAE,YAAE,OAAO,CAAC,SAAS,GAAQ,EAC1D,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAChB,4CAAgC,EAAE,YAAE,OAAO,CAAC,MAAM,GAAQ,CAC3D,CAAC,CAAC,CAAC,IAAI,KATH,CAAC,CAUF,CACP,CAAC,GACM,CACX,CAAC,CAAC,CAAC,IAAI,EAGP,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAC/B,uCAA0B,EAAE,aACzB,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,CACvB,kBACE,IAAI,EAAC,QAAQ,yBACO,EAAE,0BACA,QAAQ,EAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,2BAEvB,QAAQ,IACZ,CACV,CAAC,CAAC,CAAC,IAAI,EACP,gBAAgB,CAAC,CAAC,CAAC,CAClB,iBACE,IAAI,EAAC,QAAQ,iCACe,EAAE,EAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,4CAG1B,CACV,CAAC,CAAC,CAAC,IAAI,IACA,CACX,CAAC,CAAC,CAAC,IAAI,EAGP,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/B,+CAAmC,EAAE,YAClC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAC3B,iBAEE,IAAI,EAAC,QAAQ,6BACW,EAAE,EAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,YAEzC,0CAA8B,EAAE,YAAE,OAAO,CAAC,IAAI,GAAQ,IALjD,CAAC,CAMC,CACV,CAAC,GACM,CACX,CAAC,CAAC,CAAC,IAAI,IACJ,CACP,CAAC;AACJ,CAAC"}

package/dist/rules/components/format.d.ts

@@ -0,0 +1,56 @@
+import type { RuleEvaluation, ExprTraceEntry, LineVerdict, FirestoreMethod } from '../types.js';
+/** Operations a request method satisfies — `update` matches `update` and
+ *  `write`, etc. Mirrors the simulator's `methodToOperations`. */
+export declare function methodOperations(method: FirestoreMethod): string[];
+/**
+ * The allow rule that decided the denial: the last rule actually
+ * evaluated (DENY/ERROR). Under OR semantics the simulator stops at the
+ * first ALLOW; on a denial no rule allowed, so the deciding rule is the
+ * last evaluated one — the closest miss the user should reason about.
+ */
+export declare function decidingEvaluation(evaluation: RuleEvaluation[]): RuleEvaluation | undefined;
+/**
+ * A plain-language reason for the denial, derived from the deciding
+ * `RuleEvaluation`. Falls back to a no-match explanation when no allow
+ * rule was evaluated.
+ */
+export declare function denialReason(evaluation: RuleEvaluation[], method: FirestoreMethod, path: string): string;
+export interface RuleLine {
+    number: number;
+    text: string;
+    verdict?: LineVerdict;
+    /** A short note for skipped lines, e.g. "not checked, this is an update". */
+    note?: string;
+}
+/**
+ * Split the rules source into numbered lines and mark each `allow` line
+ * with a verdict per the spec:
+ *   - the deciding rule's line  → `deny`
+ *   - an allow line whose operations don't include the method → `skip`
+ *   - any other allow line      → `allow`
+ *
+ * Verdicts are matched to source lines via `RuleEvaluation.line` (1-indexed
+ * `allow` keyword). Lines without a matching evaluation entry get no verdict.
+ */
+export declare function markRuleLines(rulesSource: string, evaluation: RuleEvaluation[], method: FirestoreMethod): RuleLine[];
+/** Render a trace value the way the mock shows it: JSON-ish, quoted
+ *  strings, `false`/`true`/`null` bare. */
+export declare function formatValue(value: unknown): string;
+/** Depth of a trace node from its `parent` chain (0 for roots). */
+export declare function traceDepth(entries: ExprTraceEntry[], index: number): number;
+/**
+ * The set of scope variable roots whose deciding values appear in the
+ * trace — `request.auth`, `request.resource.data`, `resource.data`.
+ * Used to underline the values the rule actually read.
+ */
+export interface ScopeVar {
+    /** The dotted path, e.g. `request.auth`. */
+    name: string;
+    /** A short human tag, e.g. "who made the request". */
+    tag: string;
+    /** The value to render. */
+    value: unknown;
+    /** Leaf keys whose values the rule read (for the `hit` underline). */
+    hits: string[];
+}
+//# sourceMappingURL=format.d.ts.map

package/dist/rules/components/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../../src/rules/components/format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGhG;kEACkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,EAAE,CASlE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,cAAc,GAAG,SAAS,CAM3F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,cAAc,EAAE,EAC5B,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,GACX,MAAM,CAuBR;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,cAAc,EAAE,EAC5B,MAAM,EAAE,eAAe,GACtB,QAAQ,EAAE,CAsCZ;AAED;2CAC2C;AAC3C,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYlD;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAW3E;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,sEAAsE;IACtE,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB"}

package/dist/rules/components/format.js

@@ -0,0 +1,137 @@
+import { truncateVectorsForDisplay } from '../../firestore/index.js';
+/** Operations a request method satisfies — `update` matches `update` and
+ *  `write`, etc. Mirrors the simulator's `methodToOperations`. */
+export function methodOperations(method) {
+    switch (method) {
+        case 'get': return ['get', 'read'];
+        case 'list': return ['list', 'read'];
+        case 'create': return ['create', 'write'];
+        case 'update': return ['update', 'write'];
+        case 'delete': return ['delete', 'write'];
+        default: return [method];
+    }
+}
+/**
+ * The allow rule that decided the denial: the last rule actually
+ * evaluated (DENY/ERROR). Under OR semantics the simulator stops at the
+ * first ALLOW; on a denial no rule allowed, so the deciding rule is the
+ * last evaluated one — the closest miss the user should reason about.
+ */
+export function decidingEvaluation(evaluation) {
+    if (evaluation.length === 0)
+        return undefined;
+    // Prefer the last non-skipped (i.e. actually-evaluated) entry. Every
+    // entry in `evaluation` was matched by method, so they're all
+    // evaluated; the last is the deciding one.
+    return evaluation[evaluation.length - 1];
+}
+/**
+ * A plain-language reason for the denial, derived from the deciding
+ * `RuleEvaluation`. Falls back to a no-match explanation when no allow
+ * rule was evaluated.
+ */
+export function denialReason(evaluation, method, path) {
+    const deciding = decidingEvaluation(evaluation);
+    if (!deciding) {
+        return `No security rule matched ${method} ${path}, so the request was denied by default.`;
+    }
+    if (deciding.verdict === 'UNSUPPORTED') {
+        return (`The simulator couldn't evaluate the ${deciding.operations.join('/')} rule` +
+            (deciding.message ? ` (${deciding.message})` : '') +
+            ' — this is a gap in the local simulator, not necessarily your rule.');
+    }
+    if (deciding.verdict === 'ERROR') {
+        return (`The ${deciding.operations.join('/')} rule threw while evaluating` +
+            (deciding.message ? `: ${deciding.message}` : '') +
+            ', which denies the request.');
+    }
+    const cond = deciding.conditionText
+        ? `The ${deciding.operations.join('/')} rule requires ${deciding.conditionText}, which evaluated to false`
+        : `The ${deciding.operations.join('/')} rule's condition evaluated to false`;
+    return `${cond}, so the request was denied.`;
+}
+/**
+ * Split the rules source into numbered lines and mark each `allow` line
+ * with a verdict per the spec:
+ *   - the deciding rule's line  → `deny`
+ *   - an allow line whose operations don't include the method → `skip`
+ *   - any other allow line      → `allow`
+ *
+ * Verdicts are matched to source lines via `RuleEvaluation.line` (1-indexed
+ * `allow` keyword). Lines without a matching evaluation entry get no verdict.
+ */
+export function markRuleLines(rulesSource, evaluation, method) {
+    const deciding = decidingEvaluation(evaluation);
+    const ops = methodOperations(method);
+    // line → verdict, from the evaluated rules.
+    const byLine = new Map();
+    const noteByLine = new Map();
+    for (const e of evaluation) {
+        if (e.line == null)
+            continue;
+        if (e === deciding)
+            byLine.set(e.line, 'deny');
+        else
+            byLine.set(e.line, 'allow');
+    }
+    // Detect skipped allow lines by scanning the source for `allow <ops>:`
+    // declarations whose operations don't intersect the request method.
+    const rawLines = rulesSource.split('\n');
+    const allowRe = /^\s*allow\s+([a-z,\s]+?)\s*:/;
+    return rawLines.map((text, i) => {
+        const number = i + 1;
+        const line = { number, text };
+        const fromEval = byLine.get(number);
+        if (fromEval) {
+            line.verdict = fromEval;
+            return line;
+        }
+        const m = allowRe.exec(text);
+        if (m) {
+            const declared = m[1].split(',').map(s => s.trim()).filter(Boolean);
+            const matches = declared.some(op => ops.includes(op));
+            if (!matches) {
+                line.verdict = 'skip';
+                line.note = `not checked, this is a ${method}`;
+            }
+            else {
+                // Declared for this method but not in the evaluation trace
+                // (e.g. a different match block). Treat as a normal allow line.
+                line.verdict = 'allow';
+            }
+        }
+        return line;
+    });
+}
+/** Render a trace value the way the mock shows it: JSON-ish, quoted
+ *  strings, `false`/`true`/`null` bare. */
+export function formatValue(value) {
+    if (value === undefined)
+        return '∅';
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (value === null || typeof value === 'boolean' || typeof value === 'number') {
+        return String(value);
+    }
+    try {
+        // Truncate vectors so a real embedding never dumps its full array into a trace.
+        return JSON.stringify(truncateVectorsForDisplay(value));
+    }
+    catch {
+        return String(value);
+    }
+}
+/** Depth of a trace node from its `parent` chain (0 for roots). */
+export function traceDepth(entries, index) {
+    let depth = 0;
+    let cur = entries[index]?.parent ?? null;
+    // Guard against malformed chains.
+    let guard = 0;
+    while (cur != null && guard < entries.length + 1) {
+        depth++;
+        cur = entries[cur]?.parent ?? null;
+        guard++;
+    }
+    return depth;
+}
+//# sourceMappingURL=format.js.map

package/dist/rules/components/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../../src/rules/components/format.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAErE;kEACkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,MAAuB;IACtD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA4B;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,qEAAqE;IACrE,8DAA8D;IAC9D,2CAA2C;IAC3C,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA4B,EAC5B,MAAuB,EACvB,IAAY;IAEZ,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,4BAA4B,MAAM,IAAI,IAAI,yCAAyC,CAAC;IAC7F,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACvC,OAAO,CACL,uCAAuC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAC3E,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,CACL,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,8BAA8B;YAClE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa;QACjC,CAAC,CAAC,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CAAC,aAAa,4BAA4B;QAC1G,CAAC,CAAC,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,sCAAsC,CAAC;IAC/E,OAAO,GAAG,IAAI,8BAA8B,CAAC;AAC/C,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,UAA4B,EAC5B,MAAuB;IAEvB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,4CAA4C;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI;YAAE,SAAS;QAC7B,IAAI,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;;YAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,8BAA8B,CAAC;IAC/C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,IAAI,GAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;gBACtB,IAAI,CAAC,IAAI,GAAG,0BAA0B,MAAM,EAAE,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,gEAAgE;gBAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;2CAC2C;AAC3C,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,CAAC;QACH,gFAAgF;QAChF,OAAO,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,OAAyB,EAAE,KAAa;IACjE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IACzC,kCAAkC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,KAAK,EAAE,CAAC;QACR,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;QACnC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/rules/components/index.d.ts

@@ -0,0 +1,4 @@
+export { DenialInspector } from './DenialInspector.js';
+export { denialReason, markRuleLines, decidingEvaluation, methodOperations, formatValue, traceDepth, type RuleLine, type ScopeVar, } from './format.js';
+export { scopeVars } from './scope.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/components/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/components/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,KAAK,QAAQ,EACb,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/rules/components/index.js

@@ -0,0 +1,4 @@
+export { DenialInspector } from './DenialInspector.js';
+export { denialReason, markRuleLines, decidingEvaluation, methodOperations, formatValue, traceDepth, } from './format.js';
+export { scopeVars } from './scope.js';
+//# sourceMappingURL=index.js.map

package/dist/rules/components/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/components/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,EACX,UAAU,GAGX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/rules/components/scope.d.ts

@@ -0,0 +1,10 @@
+import type { Denial } from '../types.js';
+import { type ScopeVar } from './format.js';
+/**
+ * Build the "data in scope" rows for a denial: `request.auth`,
+ * `request.resource.data`, and `resource.data` — each present only when
+ * the denial carries that payload. `hits` marks the leaf keys the
+ * deciding rule actually read.
+ */
+export declare function scopeVars(denial: Denial): ScopeVar[];
+//# sourceMappingURL=scope.d.ts.map

package/dist/rules/components/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/rules/components/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAsB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAqChE;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CA8BpD"}

package/dist/rules/components/scope.js

@@ -0,0 +1,72 @@
+import { decidingEvaluation } from './format.js';
+/**
+ * Leaf keys the rule read off each scope root, discovered from the
+ * deciding rule's expression trace. We scan every trace node's `source`
+ * for accessors rooted at one of the three scope roots and record the
+ * first segment after the root (e.g. `request.auth.uid` → root
+ * `request.auth`, hit `uid`). These drive the `data-pyric-scope-hit`
+ * underline so the user sees exactly which fields the rule compared.
+ */
+const SCOPE_ROOTS = [
+    { root: 'request.resource.data', key: 'requestData' },
+    { root: 'resource.data', key: 'resourceData' },
+    { root: 'request.auth', key: 'auth' },
+];
+function collectHits(entries) {
+    const hits = new Map();
+    for (const entry of entries) {
+        const src = entry.source;
+        // Longest root first so `request.resource.data` wins over a bare
+        // `request` prefix.
+        for (const { root } of SCOPE_ROOTS) {
+            if (src === root || src.startsWith(root + '.')) {
+                const rest = src.slice(root.length).replace(/^\./, '');
+                const leaf = rest.split(/[.[]/)[0];
+                if (leaf) {
+                    if (!hits.has(root))
+                        hits.set(root, new Set());
+                    hits.get(root).add(leaf);
+                }
+                break;
+            }
+        }
+    }
+    return hits;
+}
+/**
+ * Build the "data in scope" rows for a denial: `request.auth`,
+ * `request.resource.data`, and `resource.data` — each present only when
+ * the denial carries that payload. `hits` marks the leaf keys the
+ * deciding rule actually read.
+ */
+export function scopeVars(denial) {
+    const deciding = decidingEvaluation(denial.evaluation);
+    const hits = deciding?.expressionTrace ? collectHits(deciding.expressionTrace) : new Map();
+    const rows = [];
+    if (denial.auth !== null) {
+        rows.push({
+            name: 'request.auth',
+            tag: 'who made the request',
+            value: denial.auth,
+            hits: [...(hits.get('request.auth') ?? [])],
+        });
+    }
+    if (denial.requestData !== undefined) {
+        rows.push({
+            name: 'request.resource.data',
+            tag: 'what was written',
+            value: denial.requestData,
+            hits: [...(hits.get('request.resource.data') ?? [])],
+        });
+    }
+    if (denial.resourceData != null) {
+        rows.push({
+            name: 'resource.data',
+            tag: 'the existing document',
+            value: denial.resourceData,
+            hits: [...(hits.get('resource.data') ?? [])],
+        });
+    }
+    return rows;
+}
+//# sourceMappingURL=scope.js.map

package/dist/rules/components/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../src/rules/components/scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAiB,MAAM,aAAa,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,GAAmD;IAClE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,aAAa,EAAE;IACrD,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE;IAC9C,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE;CACtC,CAAC;AAEF,SAAS,WAAW,CAAC,OAAyB;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;QACzB,iEAAiE;QACjE,oBAAoB;QACpB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;oBAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IAE3F,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,cAAc;YACpB,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,uBAAuB;YAC7B,GAAG,EAAE,kBAAkB;YACvB,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,eAAe;YACrB,GAAG,EAAE,uBAAuB;YAC5B,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/rules/hooks/index.d.ts

@@ -0,0 +1,2 @@
+export { useDenialTrace, type DenialRequest, type DenialTrace, } from './useDenialTrace.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/hooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC"}

package/dist/rules/hooks/index.js

@@ -0,0 +1,2 @@
+export { useDenialTrace, } from './useDenialTrace.js';
+//# sourceMappingURL=index.js.map

package/dist/rules/hooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,GAGf,MAAM,qBAAqB,CAAC"}