@pyric/ui 0.1.0-alpha.7

package/dist/rules/components/DenialInspector.js

@@ -0,0 +1,58 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { denialReason, markRuleLines, decidingEvaluation, formatValue, traceDepth, } from './format.js';
+import { scopeVars } from './scope.js';
+function lensUid(denial) {
+    const lens = denial.lens;
+    if (lens && typeof lens === 'object' && 'as' in lens)
+        return lens.as;
+    return denial.auth?.uid;
+}
+/** Render one scope value, underlining the keys the rule read. */
+function ScopeValue({ value, hits }) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return _jsx(_Fragment, { children: formatValue(value) });
+    }
+    const entries = Object.entries(value);
+    const hitSet = new Set(hits);
+    return (_jsxs(_Fragment, { children: ['{ ', entries.map(([k, v], i) => (_jsxs("span", { children: [i > 0 ? ', ' : '', k, ":", ' ', hitSet.has(k) ? (_jsx("span", { "data-pyric-scope-hit": "", children: formatValue(v) })) : (formatValue(v))] }, k))), ' }'] }));
+}
+/** The step-through evaluation: each sub-expression and its real value. */
+function EvaluationTrace({ trace }) {
+    return (_jsx("div", { "data-pyric-trace": "", children: trace.map((node, i) => {
+            const depth = traceDepth(trace, i);
+            const isFalse = node.value === false;
+            return (_jsxs("div", { "data-pyric-trace-node": "", "data-pyric-depth": depth, ...(node.skipped ? { 'data-pyric-skipped': '' } : {}), ...(node.letBinding ? { 'data-pyric-let': node.letBinding.name } : {}), ...(node.inlinedFrom ? { 'data-pyric-frame': node.inlinedFrom.name } : {}), children: [_jsx("span", { "data-pyric-trace-source": "", children: node.source }), _jsx("span", { "data-pyric-trace-value": "", ...(isFalse ? { 'data-pyric-false': '' } : {}), children: node.skipped
+                            ? 'skipped'
+                            : node.error != null
+                                ? `error: ${node.error}`
+                                : formatValue(node.value) })] }, i));
+        }) }));
+}
+/**
+ * Headless inspector for a single denied Firestore request. Renders, per
+ * the `denial-inspector-spec`:
+ *   - the plain-language reason (`data-pyric-denial-reason`)
+ *   - the rule source, line-marked (`data-pyric-rule-source`, per-line
+ *     `data-pyric-line-verdict="deny|allow|skip"`)
+ *   - the expression step-through (`data-pyric-trace` + per-node hooks)
+ *   - data in scope (`data-pyric-scope`, `-scope-var`, `-scope-hit`)
+ *   - the re-run / verify loop (`data-pyric-rerun`)
+ *   - the cluster of sibling denials (`data-pyric-denial-cluster`)
+ *   - path resolution for no-match denials (`data-pyric-path-resolution`)
+ *
+ * Zero styling — every visual decision is a consumer's via the
+ * `data-pyric-*` hooks. `mocks/c-debug.html` is the CSS spec.
+ */
+export function DenialInspector({ denial, cluster, onRerunAs, onTestEditedRule, onSelectCluster, className, }) {
+    const deciding = decidingEvaluation(denial.evaluation);
+    const lines = markRuleLines(denial.rulesSource, denial.evaluation, denial.method);
+    const scope = scopeVars(denial);
+    const rerunUid = lensUid(denial);
+    const isNoMatch = denial.evaluation.length === 0;
+    return (_jsxs("div", { className: className, "data-pyric-ui": "denial-inspector", children: [_jsxs("header", { "data-pyric-denial-header": "", children: [_jsxs("p", { "data-pyric-denial-title": "", children: ["Denied: ", _jsx("span", { "data-pyric-denial-method": "", children: denial.method }), ' ', _jsx("span", { "data-pyric-denial-path": "", children: denial.path })] }), _jsxs("p", { "data-pyric-denial-context": "", children: [denial.auth ? `by ${denial.auth.uid}` : 'unauthenticated', denial.lens && typeof denial.lens === 'object' && 'as' in denial.lens
+                                ? ` · acting as ${denial.lens.as}`
+                                : denial.lens === 'admin'
+                                    ? ' · admin'
+                                    : ''] })] }), _jsx("p", { "data-pyric-denial-reason": "", children: denialReason(denial.evaluation, denial.method, denial.path) }), _jsx("section", { "data-pyric-rule-source": "", children: lines.map((line) => (_jsxs("div", { "data-pyric-rule-line": "", "data-pyric-line-number": line.number, ...(line.verdict ? { 'data-pyric-line-verdict': line.verdict } : {}), children: [_jsx("span", { "data-pyric-line-gutter": "", children: line.number }), _jsx("span", { "data-pyric-line-text": "", children: line.text }), line.note ? _jsx("span", { "data-pyric-line-note": "", children: line.note }) : null, line.verdict === 'deny' ? (_jsx("span", { "data-pyric-line-badge": "", children: "denied" })) : null] }, line.number))) }), deciding?.expressionTrace && deciding.expressionTrace.length > 0 ? (_jsx(EvaluationTrace, { trace: deciding.expressionTrace })) : null, scope.length > 0 ? (_jsx("section", { "data-pyric-scope": "", children: scope.map((v) => (_jsxs("div", { "data-pyric-scope-var": v.name, children: [_jsx("span", { "data-pyric-scope-name": "", children: v.name }), _jsx("span", { "data-pyric-scope-tag": "", children: v.tag }), _jsx("span", { "data-pyric-scope-value": "", children: _jsx(ScopeValue, { value: v.value, hits: v.hits }) })] }, v.name))) })) : null, isNoMatch && denial.pathResolution ? (_jsx("section", { "data-pyric-path-resolution": "", children: denial.pathResolution.attempts.map((attempt, i) => (_jsxs("div", { "data-pyric-path-attempt": "", "data-pyric-matched-segments": `${attempt.matchedSegments}/${attempt.totalSegments}`, ...(attempt.matched ? { 'data-pyric-matched': '' } : {}), ...(attempt.reason ? { 'data-pyric-reason': attempt.reason } : {}), children: [_jsx("span", { "data-pyric-attempt-path": "", children: attempt.blockPath }), attempt.reason ? (_jsx("span", { "data-pyric-attempt-reason": "", children: attempt.reason })) : null] }, i))) })) : null, onRerunAs || onTestEditedRule ? (_jsxs("section", { "data-pyric-rerun": "", children: [onRerunAs && rerunUid ? (_jsxs("button", { type: "button", "data-pyric-rerun-as": "", "data-pyric-rerun-uid": rerunUid, onClick: () => onRerunAs(rerunUid), children: ["Re-run as ", rerunUid] })) : null, onTestEditedRule ? (_jsx("button", { type: "button", "data-pyric-test-edited-rule": "", onClick: () => onTestEditedRule(), children: "Test against an edited rule" })) : null] })) : null, cluster && cluster.length > 0 ? (_jsx("section", { "data-pyric-denial-cluster": "", children: cluster.map((sibling, i) => (_jsx("button", { type: "button", "data-pyric-cluster-item": "", onClick: () => onSelectCluster?.(sibling), children: _jsx("span", { "data-pyric-cluster-path": "", children: sibling.path }) }, i))) })) : null] }));
+}
+//# sourceMappingURL=DenialInspector.js.map

package/dist/rules/components/DenialInspector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DenialInspector.js","sourceRoot":"","sources":["../../../src/rules/components/DenialInspector.tsx"],"names":[],"mappings":";AAEA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC;IACrE,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;AAC1B,CAAC;AAED,kEAAkE;AAClE,SAAS,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAsC;IACrE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,4BAAG,WAAW,CAAC,KAAK,CAAC,GAAI,CAAC;IACnC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CACL,8BACG,IAAI,EACJ,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAC1B,2BACG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EACjB,CAAC,OAAG,GAAG,EACP,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACf,uCAA2B,EAAE,YAAE,WAAW,CAAC,CAAC,CAAC,GAAQ,CACtD,CAAC,CAAC,CAAC,CACF,WAAW,CAAC,CAAC,CAAC,CACf,KAPQ,CAAC,CAQL,CACR,CAAC,EACD,IAAI,IACJ,CACJ,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,EAAE,KAAK,EAA+B;IAC7D,OAAO,CACL,kCAAsB,EAAE,YACrB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACrB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;YACrC,OAAO,CACL,wCAEwB,EAAE,sBACN,KAAK,KACnB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAClD,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACnE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAE3E,0CAA8B,EAAE,YAAE,IAAI,CAAC,MAAM,GAAQ,EACrD,yCAA6B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YAC5E,IAAI,CAAC,OAAO;4BACX,CAAC,CAAC,SAAS;4BACX,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;gCAClB,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE;gCACxB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GACxB,KAdF,CAAC,CAeF,CACP,CAAC;QACJ,CAAC,CAAC,GACE,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,SAAS,GACY;IACrB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IAEjD,OAAO,CACL,eAAK,SAAS,EAAE,SAAS,mBAAgB,kBAAkB,aACzD,8CAAiC,EAAE,aACjC,wCAA2B,EAAE,yBACnB,2CAA+B,EAAE,YAAE,MAAM,CAAC,MAAM,GAAQ,EAAC,GAAG,EACpE,yCAA6B,EAAE,YAAE,MAAM,CAAC,IAAI,GAAQ,IAClD,EACJ,0CAA6B,EAAE,aAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,iBAAiB,EACzD,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI;gCACpE,CAAC,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;gCAClC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;oCACvB,CAAC,CAAC,UAAU;oCACZ,CAAC,CAAC,EAAE,IACN,IACG,EAGT,wCAA4B,EAAE,YAC3B,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAC1D,EAGJ,4CAAgC,EAAE,YAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,uCAEuB,EAAE,4BACC,IAAI,CAAC,MAAM,KAC/B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAErE,yCAA6B,EAAE,YAAE,IAAI,CAAC,MAAM,GAAQ,EACpD,uCAA2B,EAAE,YAAE,IAAI,CAAC,IAAI,GAAQ,EAC/C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,uCAA2B,EAAE,YAAE,IAAI,CAAC,IAAI,GAAQ,CAAC,CAAC,CAAC,IAAI,EACnE,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CACzB,wCAA4B,EAAE,uBAAc,CAC7C,CAAC,CAAC,CAAC,IAAI,KAVH,IAAI,CAAC,MAAM,CAWZ,CACP,CAAC,GACM,EAGT,QAAQ,EAAE,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAClE,KAAC,eAAe,IAAC,KAAK,EAAE,QAAQ,CAAC,eAAe,GAAI,CACrD,CAAC,CAAC,CAAC,IAAI,EAGP,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAClB,sCAA0B,EAAE,YACzB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAChB,uCAAwC,CAAC,CAAC,IAAI,aAC5C,wCAA4B,EAAE,YAAE,CAAC,CAAC,IAAI,GAAQ,EAC9C,uCAA2B,EAAE,YAAE,CAAC,CAAC,GAAG,GAAQ,EAC5C,yCAA6B,EAAE,YAC7B,KAAC,UAAU,IAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,GAAI,GACvC,KALC,CAAC,CAAC,IAAI,CAMV,CACP,CAAC,GACM,CACX,CAAC,CAAC,CAAC,IAAI,EAGP,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CACpC,gDAAoC,EAAE,YACnC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAClD,0CAE0B,EAAE,iCACG,GAAG,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,aAAa,EAAE,KAC9E,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACrD,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAEnE,0CAA8B,EAAE,YAAE,OAAO,CAAC,SAAS,GAAQ,EAC1D,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAChB,4CAAgC,EAAE,YAAE,OAAO,CAAC,MAAM,GAAQ,CAC3D,CAAC,CAAC,CAAC,IAAI,KATH,CAAC,CAUF,CACP,CAAC,GACM,CACX,CAAC,CAAC,CAAC,IAAI,EAGP,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAC/B,uCAA0B,EAAE,aACzB,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,CACvB,kBACE,IAAI,EAAC,QAAQ,yBACO,EAAE,0BACA,QAAQ,EAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,2BAEvB,QAAQ,IACZ,CACV,CAAC,CAAC,CAAC,IAAI,EACP,gBAAgB,CAAC,CAAC,CAAC,CAClB,iBACE,IAAI,EAAC,QAAQ,iCACe,EAAE,EAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,4CAG1B,CACV,CAAC,CAAC,CAAC,IAAI,IACA,CACX,CAAC,CAAC,CAAC,IAAI,EAGP,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/B,+CAAmC,EAAE,YAClC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAC3B,iBAEE,IAAI,EAAC,QAAQ,6BACW,EAAE,EAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,YAEzC,0CAA8B,EAAE,YAAE,OAAO,CAAC,IAAI,GAAQ,IALjD,CAAC,CAMC,CACV,CAAC,GACM,CACX,CAAC,CAAC,CAAC,IAAI,IACJ,CACP,CAAC;AACJ,CAAC"}

package/dist/rules/components/format.d.ts

@@ -0,0 +1,56 @@
+import type { RuleEvaluation, ExprTraceEntry, LineVerdict, FirestoreMethod } from '../types.js';
+/** Operations a request method satisfies — `update` matches `update` and
+ *  `write`, etc. Mirrors the simulator's `methodToOperations`. */
+export declare function methodOperations(method: FirestoreMethod): string[];
+/**
+ * The allow rule that decided the denial: the last rule actually
+ * evaluated (DENY/ERROR). Under OR semantics the simulator stops at the
+ * first ALLOW; on a denial no rule allowed, so the deciding rule is the
+ * last evaluated one — the closest miss the user should reason about.
+ */
+export declare function decidingEvaluation(evaluation: RuleEvaluation[]): RuleEvaluation | undefined;
+/**
+ * A plain-language reason for the denial, derived from the deciding
+ * `RuleEvaluation`. Falls back to a no-match explanation when no allow
+ * rule was evaluated.
+ */
+export declare function denialReason(evaluation: RuleEvaluation[], method: FirestoreMethod, path: string): string;
+export interface RuleLine {
+    number: number;
+    text: string;
+    verdict?: LineVerdict;
+    /** A short note for skipped lines, e.g. "not checked, this is an update". */
+    note?: string;
+}
+/**
+ * Split the rules source into numbered lines and mark each `allow` line
+ * with a verdict per the spec:
+ *   - the deciding rule's line  → `deny`
+ *   - an allow line whose operations don't include the method → `skip`
+ *   - any other allow line      → `allow`
+ *
+ * Verdicts are matched to source lines via `RuleEvaluation.line` (1-indexed
+ * `allow` keyword). Lines without a matching evaluation entry get no verdict.
+ */
+export declare function markRuleLines(rulesSource: string, evaluation: RuleEvaluation[], method: FirestoreMethod): RuleLine[];
+/** Render a trace value the way the mock shows it: JSON-ish, quoted
+ *  strings, `false`/`true`/`null` bare. */
+export declare function formatValue(value: unknown): string;
+/** Depth of a trace node from its `parent` chain (0 for roots). */
+export declare function traceDepth(entries: ExprTraceEntry[], index: number): number;
+/**
+ * The set of scope variable roots whose deciding values appear in the
+ * trace — `request.auth`, `request.resource.data`, `resource.data`.
+ * Used to underline the values the rule actually read.
+ */
+export interface ScopeVar {
+    /** The dotted path, e.g. `request.auth`. */
+    name: string;
+    /** A short human tag, e.g. "who made the request". */
+    tag: string;
+    /** The value to render. */
+    value: unknown;
+    /** Leaf keys whose values the rule read (for the `hit` underline). */
+    hits: string[];
+}
+//# sourceMappingURL=format.d.ts.map

package/dist/rules/components/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../../src/rules/components/format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGhG;kEACkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,EAAE,CASlE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,cAAc,GAAG,SAAS,CAM3F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,cAAc,EAAE,EAC5B,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,GACX,MAAM,CAuBR;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,cAAc,EAAE,EAC5B,MAAM,EAAE,eAAe,GACtB,QAAQ,EAAE,CAsCZ;AAED;2CAC2C;AAC3C,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYlD;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAW3E;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,sEAAsE;IACtE,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB"}

package/dist/rules/components/format.js

@@ -0,0 +1,137 @@
+import { truncateVectorsForDisplay } from '../../firestore/index.js';
+/** Operations a request method satisfies — `update` matches `update` and
+ *  `write`, etc. Mirrors the simulator's `methodToOperations`. */
+export function methodOperations(method) {
+    switch (method) {
+        case 'get': return ['get', 'read'];
+        case 'list': return ['list', 'read'];
+        case 'create': return ['create', 'write'];
+        case 'update': return ['update', 'write'];
+        case 'delete': return ['delete', 'write'];
+        default: return [method];
+    }
+}
+/**
+ * The allow rule that decided the denial: the last rule actually
+ * evaluated (DENY/ERROR). Under OR semantics the simulator stops at the
+ * first ALLOW; on a denial no rule allowed, so the deciding rule is the
+ * last evaluated one — the closest miss the user should reason about.
+ */
+export function decidingEvaluation(evaluation) {
+    if (evaluation.length === 0)
+        return undefined;
+    // Prefer the last non-skipped (i.e. actually-evaluated) entry. Every
+    // entry in `evaluation` was matched by method, so they're all
+    // evaluated; the last is the deciding one.
+    return evaluation[evaluation.length - 1];
+}
+/**
+ * A plain-language reason for the denial, derived from the deciding
+ * `RuleEvaluation`. Falls back to a no-match explanation when no allow
+ * rule was evaluated.
+ */
+export function denialReason(evaluation, method, path) {
+    const deciding = decidingEvaluation(evaluation);
+    if (!deciding) {
+        return `No security rule matched ${method} ${path}, so the request was denied by default.`;
+    }
+    if (deciding.verdict === 'UNSUPPORTED') {
+        return (`The simulator couldn't evaluate the ${deciding.operations.join('/')} rule` +
+            (deciding.message ? ` (${deciding.message})` : '') +
+            ' — this is a gap in the local simulator, not necessarily your rule.');
+    }
+    if (deciding.verdict === 'ERROR') {
+        return (`The ${deciding.operations.join('/')} rule threw while evaluating` +
+            (deciding.message ? `: ${deciding.message}` : '') +
+            ', which denies the request.');
+    }
+    const cond = deciding.conditionText
+        ? `The ${deciding.operations.join('/')} rule requires ${deciding.conditionText}, which evaluated to false`
+        : `The ${deciding.operations.join('/')} rule's condition evaluated to false`;
+    return `${cond}, so the request was denied.`;
+}
+/**
+ * Split the rules source into numbered lines and mark each `allow` line
+ * with a verdict per the spec:
+ *   - the deciding rule's line  → `deny`
+ *   - an allow line whose operations don't include the method → `skip`
+ *   - any other allow line      → `allow`
+ *
+ * Verdicts are matched to source lines via `RuleEvaluation.line` (1-indexed
+ * `allow` keyword). Lines without a matching evaluation entry get no verdict.
+ */
+export function markRuleLines(rulesSource, evaluation, method) {
+    const deciding = decidingEvaluation(evaluation);
+    const ops = methodOperations(method);
+    // line → verdict, from the evaluated rules.
+    const byLine = new Map();
+    const noteByLine = new Map();
+    for (const e of evaluation) {
+        if (e.line == null)
+            continue;
+        if (e === deciding)
+            byLine.set(e.line, 'deny');
+        else
+            byLine.set(e.line, 'allow');
+    }
+    // Detect skipped allow lines by scanning the source for `allow <ops>:`
+    // declarations whose operations don't intersect the request method.
+    const rawLines = rulesSource.split('\n');
+    const allowRe = /^\s*allow\s+([a-z,\s]+?)\s*:/;
+    return rawLines.map((text, i) => {
+        const number = i + 1;
+        const line = { number, text };
+        const fromEval = byLine.get(number);
+        if (fromEval) {
+            line.verdict = fromEval;
+            return line;
+        }
+        const m = allowRe.exec(text);
+        if (m) {
+            const declared = m[1].split(',').map(s => s.trim()).filter(Boolean);
+            const matches = declared.some(op => ops.includes(op));
+            if (!matches) {
+                line.verdict = 'skip';
+                line.note = `not checked, this is a ${method}`;
+            }
+            else {
+                // Declared for this method but not in the evaluation trace
+                // (e.g. a different match block). Treat as a normal allow line.
+                line.verdict = 'allow';
+            }
+        }
+        return line;
+    });
+}
+/** Render a trace value the way the mock shows it: JSON-ish, quoted
+ *  strings, `false`/`true`/`null` bare. */
+export function formatValue(value) {
+    if (value === undefined)
+        return '∅';
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (value === null || typeof value === 'boolean' || typeof value === 'number') {
+        return String(value);
+    }
+    try {
+        // Truncate vectors so a real embedding never dumps its full array into a trace.
+        return JSON.stringify(truncateVectorsForDisplay(value));
+    }
+    catch {
+        return String(value);
+    }
+}
+/** Depth of a trace node from its `parent` chain (0 for roots). */
+export function traceDepth(entries, index) {
+    let depth = 0;
+    let cur = entries[index]?.parent ?? null;
+    // Guard against malformed chains.
+    let guard = 0;
+    while (cur != null && guard < entries.length + 1) {
+        depth++;
+        cur = entries[cur]?.parent ?? null;
+        guard++;
+    }
+    return depth;
+}
+//# sourceMappingURL=format.js.map

package/dist/rules/components/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../../src/rules/components/format.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAErE;kEACkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,MAAuB;IACtD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA4B;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,qEAAqE;IACrE,8DAA8D;IAC9D,2CAA2C;IAC3C,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA4B,EAC5B,MAAuB,EACvB,IAAY;IAEZ,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,4BAA4B,MAAM,IAAI,IAAI,yCAAyC,CAAC;IAC7F,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACvC,OAAO,CACL,uCAAuC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAC3E,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,CACL,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,8BAA8B;YAClE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa;QACjC,CAAC,CAAC,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CAAC,aAAa,4BAA4B;QAC1G,CAAC,CAAC,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,sCAAsC,CAAC;IAC/E,OAAO,GAAG,IAAI,8BAA8B,CAAC;AAC/C,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,UAA4B,EAC5B,MAAuB;IAEvB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,4CAA4C;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI;YAAE,SAAS;QAC7B,IAAI,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;;YAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,8BAA8B,CAAC;IAC/C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,IAAI,GAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;gBACtB,IAAI,CAAC,IAAI,GAAG,0BAA0B,MAAM,EAAE,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,gEAAgE;gBAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;2CAC2C;AAC3C,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,CAAC;QACH,gFAAgF;QAChF,OAAO,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,OAAyB,EAAE,KAAa;IACjE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IACzC,kCAAkC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,KAAK,EAAE,CAAC;QACR,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;QACnC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/rules/components/index.d.ts

@@ -0,0 +1,4 @@
+export { DenialInspector } from './DenialInspector.js';
+export { denialReason, markRuleLines, decidingEvaluation, methodOperations, formatValue, traceDepth, type RuleLine, type ScopeVar, } from './format.js';
+export { scopeVars } from './scope.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/components/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/components/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,KAAK,QAAQ,EACb,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/rules/components/index.js

@@ -0,0 +1,4 @@
+export { DenialInspector } from './DenialInspector.js';
+export { denialReason, markRuleLines, decidingEvaluation, methodOperations, formatValue, traceDepth, } from './format.js';
+export { scopeVars } from './scope.js';
+//# sourceMappingURL=index.js.map

package/dist/rules/components/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/components/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,EACX,UAAU,GAGX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/rules/components/scope.d.ts

@@ -0,0 +1,10 @@
+import type { Denial } from '../types.js';
+import { type ScopeVar } from './format.js';
+/**
+ * Build the "data in scope" rows for a denial: `request.auth`,
+ * `request.resource.data`, and `resource.data` — each present only when
+ * the denial carries that payload. `hits` marks the leaf keys the
+ * deciding rule actually read.
+ */
+export declare function scopeVars(denial: Denial): ScopeVar[];
+//# sourceMappingURL=scope.d.ts.map

package/dist/rules/components/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/rules/components/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAsB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAqChE;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CA8BpD"}

package/dist/rules/components/scope.js

@@ -0,0 +1,72 @@
+import { decidingEvaluation } from './format.js';
+/**
+ * Leaf keys the rule read off each scope root, discovered from the
+ * deciding rule's expression trace. We scan every trace node's `source`
+ * for accessors rooted at one of the three scope roots and record the
+ * first segment after the root (e.g. `request.auth.uid` → root
+ * `request.auth`, hit `uid`). These drive the `data-pyric-scope-hit`
+ * underline so the user sees exactly which fields the rule compared.
+ */
+const SCOPE_ROOTS = [
+    { root: 'request.resource.data', key: 'requestData' },
+    { root: 'resource.data', key: 'resourceData' },
+    { root: 'request.auth', key: 'auth' },
+];
+function collectHits(entries) {
+    const hits = new Map();
+    for (const entry of entries) {
+        const src = entry.source;
+        // Longest root first so `request.resource.data` wins over a bare
+        // `request` prefix.
+        for (const { root } of SCOPE_ROOTS) {
+            if (src === root || src.startsWith(root + '.')) {
+                const rest = src.slice(root.length).replace(/^\./, '');
+                const leaf = rest.split(/[.[]/)[0];
+                if (leaf) {
+                    if (!hits.has(root))
+                        hits.set(root, new Set());
+                    hits.get(root).add(leaf);
+                }
+                break;
+            }
+        }
+    }
+    return hits;
+}
+/**
+ * Build the "data in scope" rows for a denial: `request.auth`,
+ * `request.resource.data`, and `resource.data` — each present only when
+ * the denial carries that payload. `hits` marks the leaf keys the
+ * deciding rule actually read.
+ */
+export function scopeVars(denial) {
+    const deciding = decidingEvaluation(denial.evaluation);
+    const hits = deciding?.expressionTrace ? collectHits(deciding.expressionTrace) : new Map();
+    const rows = [];
+    if (denial.auth !== null) {
+        rows.push({
+            name: 'request.auth',
+            tag: 'who made the request',
+            value: denial.auth,
+            hits: [...(hits.get('request.auth') ?? [])],
+        });
+    }
+    if (denial.requestData !== undefined) {
+        rows.push({
+            name: 'request.resource.data',
+            tag: 'what was written',
+            value: denial.requestData,
+            hits: [...(hits.get('request.resource.data') ?? [])],
+        });
+    }
+    if (denial.resourceData != null) {
+        rows.push({
+            name: 'resource.data',
+            tag: 'the existing document',
+            value: denial.resourceData,
+            hits: [...(hits.get('resource.data') ?? [])],
+        });
+    }
+    return rows;
+}
+//# sourceMappingURL=scope.js.map

package/dist/rules/components/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../src/rules/components/scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAiB,MAAM,aAAa,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,GAAmD;IAClE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,aAAa,EAAE;IACrD,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE;IAC9C,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE;CACtC,CAAC;AAEF,SAAS,WAAW,CAAC,OAAyB;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;QACzB,iEAAiE;QACjE,oBAAoB;QACpB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;oBAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IAE3F,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,cAAc;YACpB,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,uBAAuB;YAC7B,GAAG,EAAE,kBAAkB;YACvB,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,eAAe;YACrB,GAAG,EAAE,uBAAuB;YAC5B,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/rules/hooks/index.d.ts

@@ -0,0 +1,2 @@
+export { useDenialTrace, type DenialRequest, type DenialTrace, } from './useDenialTrace.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/hooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC"}

package/dist/rules/hooks/index.js

@@ -0,0 +1,2 @@
+export { useDenialTrace, } from './useDenialTrace.js';
+//# sourceMappingURL=index.js.map

package/dist/rules/hooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,GAGf,MAAM,qBAAqB,CAAC"}

package/dist/rules/hooks/useDenialTrace.d.ts

@@ -0,0 +1,51 @@
+import { type RuleEvaluation, type PathResolutionTrace } from 'pyric/rules';
+import type { FirestoreMethod } from '../types.js';
+/**
+ * The captured request a host re-runs through the simulator to produce a
+ * `Denial`. A subset of the simulator's `TestCase` — no expectation /
+ * description (those are test-runner concerns); the host already knows
+ * the request was denied.
+ */
+export interface DenialRequest {
+    method: FirestoreMethod;
+    /** Resource path, e.g. `notes/3agHoZHZ`. */
+    path: string;
+    /** `request.auth` — `null`/omitted for unauthenticated. */
+    auth?: {
+        uid: string;
+        token?: Record<string, unknown>;
+    } | null;
+    /** `request.resource.data` — for writes. */
+    requestData?: Record<string, unknown>;
+    /** `resource.data` — the existing document. */
+    resourceData?: Record<string, unknown> | null;
+    /** Override `request.time` (ISO-8601). Defaults to wallclock. */
+    requestTime?: string;
+}
+export interface DenialTrace {
+    /** Per allow-rule evaluation, in source order. Empty for no-match denials. */
+    evaluation: RuleEvaluation[];
+    /** Which `match` blocks the resolver tried — present for no-match denials. */
+    pathResolution?: PathResolutionTrace;
+    /** True when the simulator could parse + evaluate. False on a parse error. */
+    ok: boolean;
+    /** Populated when `ok` is false (e.g. the rules source failed to parse). */
+    error?: string;
+}
+/**
+ * Re-run a captured (denied) Firestore request through the local rules
+ * simulator — tracing is always on there — and return the structured
+ * trace a `DenialInspector` renders.
+ *
+ * Memoized on `(request, rulesSource)`; the simulator is pure and
+ * in-process, so this is cheap to call on every render. A host produces
+ * a `Denial` by spreading the request fields alongside the result:
+ *
+ * ```ts
+ * const { evaluation, pathResolution } = useDenialTrace(req, rules);
+ * const denial: Denial = { ...req, decision: 'DENY', rulesSource: rules,
+ *                          at, evaluation, pathResolution };
+ * ```
+ */
+export declare function useDenialTrace(request: DenialRequest, rulesSource: string): DenialTrace;
+//# sourceMappingURL=useDenialTrace.d.ts.map

package/dist/rules/hooks/useDenialTrace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useDenialTrace.d.ts","sourceRoot":"","sources":["../../../src/rules/hooks/useDenialTrace.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/D,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,8EAA8E;IAC9E,EAAE,EAAE,OAAO,CAAC;IACZ,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,MAAM,GAClB,WAAW,CAyBb"}

package/dist/rules/hooks/useDenialTrace.js

@@ -0,0 +1,58 @@
+import { useMemo } from 'react';
+import { SimulateFirestoreRulesHandler, } from 'pyric/rules';
+function toTestCase(req) {
+    return {
+        description: `denial-inspector: ${req.method} ${req.path}`,
+        // The request was denied — we re-run it expecting DENY so the
+        // simulator's PASSED/FAILED bookkeeping stays self-consistent. The
+        // trace (which we actually consume) is independent of expectation.
+        expectation: 'DENY',
+        method: req.method,
+        path: req.path,
+        auth: req.auth ?? null,
+        ...(req.requestData !== undefined ? { data: req.requestData } : {}),
+        ...(req.resourceData != null ? { resource: req.resourceData } : {}),
+        ...(req.requestTime !== undefined ? { requestTime: req.requestTime } : {}),
+    };
+}
+/**
+ * Re-run a captured (denied) Firestore request through the local rules
+ * simulator — tracing is always on there — and return the structured
+ * trace a `DenialInspector` renders.
+ *
+ * Memoized on `(request, rulesSource)`; the simulator is pure and
+ * in-process, so this is cheap to call on every render. A host produces
+ * a `Denial` by spreading the request fields alongside the result:
+ *
+ * ```ts
+ * const { evaluation, pathResolution } = useDenialTrace(req, rules);
+ * const denial: Denial = { ...req, decision: 'DENY', rulesSource: rules,
+ *                          at, evaluation, pathResolution };
+ * ```
+ */
+export function useDenialTrace(request, rulesSource) {
+    // Stable identity key — `request` is often a fresh object literal each
+    // render, so memoize on its content, not its reference.
+    const key = useMemo(() => JSON.stringify(request), [request]);
+    return useMemo(() => {
+        const handler = new SimulateFirestoreRulesHandler();
+        const result = handler.simulate(rulesSource, [toTestCase(request)]);
+        if (!result.success) {
+            return { evaluation: [], ok: false, error: result.error.message };
+        }
+        const first = result.data.results[0];
+        if (!first) {
+            return { evaluation: [], ok: false, error: 'simulator returned no result' };
+        }
+        return {
+            evaluation: first.trace,
+            ...(first.pathResolution ? { pathResolution: first.pathResolution } : {}),
+            ok: true,
+        };
+        // `key` captures the content of `request`; `request` itself is read
+        // inside but intentionally excluded so a new-but-equal object literal
+        // doesn't re-run the simulator.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [key, rulesSource]);
+}
+//# sourceMappingURL=useDenialTrace.js.map

package/dist/rules/hooks/useDenialTrace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useDenialTrace.js","sourceRoot":"","sources":["../../../src/rules/hooks/useDenialTrace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EACL,6BAA6B,GAI9B,MAAM,aAAa,CAAC;AAkCrB,SAAS,UAAU,CAAC,GAAkB;IACpC,OAAO;QACL,WAAW,EAAE,qBAAqB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE;QAC1D,8DAA8D;QAC9D,mEAAmE;QACnE,mEAAmE;QACnE,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAsB,EACtB,WAAmB;IAEnB,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAE9D,OAAO,OAAO,CAAc,GAAG,EAAE;QAC/B,MAAM,OAAO,GAAG,IAAI,6BAA6B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,EAAE,EAAE,IAAI;SACT,CAAC;QACF,oEAAoE;QACpE,sEAAsE;QACtE,gCAAgC;QAChC,uDAAuD;IACzD,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;AACzB,CAAC"}

package/dist/rules/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `@pyric/ui/rules` — headless components for Firestore rules debugging.
+ *
+ * The Studio "Debug a denial" screen (`mocks/c-debug.html`) as a
+ * props-driven, zero-styling component: `DenialInspector` renders *why*
+ * one request was denied (reason, line-marked rule, expression
+ * step-through, data in scope, path resolution) and exposes a re-run /
+ * verify loop. Grounded entirely in the `pyric/rules` simulator trace —
+ * no engine work, pure presentation.
+ */
+export * from './hooks/index.js';
+export * from './components/index.js';
+export type { Denial, DenialLens, DenialInspectorProps, LineVerdict, RuleEvaluation, PathResolutionTrace, PathResolutionEntry, ExprTraceEntry, FirestoreMethod, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AAEtC,YAAY,EACV,MAAM,EACN,UAAU,EACV,oBAAoB,EACpB,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,YAAY,CAAC"}

package/dist/rules/index.js

@@ -0,0 +1,13 @@
+/**
+ * `@pyric/ui/rules` — headless components for Firestore rules debugging.
+ *
+ * The Studio "Debug a denial" screen (`mocks/c-debug.html`) as a
+ * props-driven, zero-styling component: `DenialInspector` renders *why*
+ * one request was denied (reason, line-marked rule, expression
+ * step-through, data in scope, path resolution) and exposes a re-run /
+ * verify loop. Grounded entirely in the `pyric/rules` simulator trace —
+ * no engine work, pure presentation.
+ */
+export * from './hooks/index.js';
+export * from './components/index.js';
+//# sourceMappingURL=index.js.map

package/dist/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC"}