pyric 0.0.1 → 0.1.0-alpha.10

package/dist/rules/grammar/FirestoreValidator.js

@@ -0,0 +1,482 @@
+const WRITE_OPS = new Set(['write', 'create', 'update', 'delete']);
+const READ_OPS = new Set(['read', 'get', 'list']);
+const DATA_WRITE_OPS = new Set(['create', 'update']);
+const BUILTIN_FUNCTIONS = new Set(['get', 'exists', 'getAfter', 'debug']);
+export function validateFirestoreRules(ast) {
+    const findings = [];
+    const rootMatch = ast.service.match;
+    // Collect all function names and calls
+    const allFunctions = collectAllFunctions(rootMatch);
+    const allCalls = collectAllCallsInRules(rootMatch);
+    // SEC-4: Check for default deny
+    checkDefaultDeny(rootMatch, findings);
+    // QUA-3: Duplicate function names
+    checkDuplicateFunctions(rootMatch, findings);
+    // QUA-4: Unused functions
+    checkUnusedFunctions(rootMatch, allCalls, findings);
+    // STR-3: Overlapping match paths
+    checkOverlappingPaths(rootMatch.children, findings);
+    // Walk all match blocks
+    walkMatch(rootMatch, findings, allFunctions, rootMatch.functions);
+    return findings;
+}
+function walkMatch(match, findings, allFunctions, scopeFunctions) {
+    const isRecursiveWildcard = match.path.segments.some(s => s.type === 'recursive');
+    const pathStr = match.path.raw;
+    // Merge scope: parent functions + this match's functions
+    const localScope = [...scopeFunctions, ...match.functions];
+    for (const allow of match.allows) {
+        const ops = allow.operations;
+        // Fold semantically-constant conditions (e.g. `X || true`, `X && false`,
+        // `!true`, ternaries with literal conditions) before the literal checks and
+        // the auth/data-reference walks, so tautological rules can't evade SEC-1/2/3
+        // and QUA-1 by being written as a binaryOp instead of a bare `true`/`false`.
+        const cond = foldConstants(allow.condition);
+        const isWrite = ops.some(op => WRITE_OPS.has(op));
+        const isRead = ops.some(op => READ_OPS.has(op));
+        const isDataWrite = ops.some(op => DATA_WRITE_OPS.has(op));
+        const isLiteralTrue = cond.type === 'literal' && cond.value === true;
+        const isLiteralFalse = cond.type === 'literal' && cond.value === false;
+        const opStr = ops.join(', ');
+        // SEC-1: Public write
+        if (isWrite && isLiteralTrue) {
+            findings.push({
+                code: 'SEC-1', severity: 'critical', path: pathStr, operation: opStr,
+                message: `Public write at ${pathStr} — anyone can ${opStr} without authentication`,
+            });
+        }
+        // SEC-2: Public read at recursive wildcard
+        if (isRead && isLiteralTrue && isRecursiveWildcard) {
+            findings.push({
+                code: 'SEC-2', severity: 'critical', path: pathStr, operation: opStr,
+                message: `Public read at recursive wildcard ${pathStr} — entire database is readable`,
+            });
+        }
+        // SEC-5: Overly permissive recursive wildcard
+        if (isRecursiveWildcard && !isLiteralFalse) {
+            findings.push({
+                code: 'SEC-5', severity: 'high', path: pathStr, operation: opStr,
+                message: `Recursive wildcard ${pathStr} has a non-deny rule — overrides all specific rules`,
+            });
+        }
+        // SEC-3: No auth check on write (follows function calls transitively)
+        const fnMap = new Map(localScope.map(f => [f.name, f]));
+        if (isWrite && !isLiteralTrue && !isLiteralFalse && !referencesAuthTransitive(cond, fnMap)) {
+            findings.push({
+                code: 'SEC-3', severity: 'high', path: pathStr, operation: opStr,
+                message: `Write rule at ${pathStr} does not check request.auth`,
+            });
+        }
+        // SEC-6: Write without data validation (follows function calls transitively)
+        if (isDataWrite && !isLiteralFalse && !referencesRequestDataTransitive(cond, fnMap)) {
+            findings.push({
+                code: 'SEC-6', severity: 'high', path: pathStr, operation: opStr,
+                message: `${opStr} at ${pathStr} does not validate request.resource.data — any data shape accepted`,
+            });
+        }
+        // SEM-1: request.resource.data in read rule
+        if (isRead && !isWrite && referencesRequestData(cond)) {
+            findings.push({
+                code: 'SEM-1', severity: 'high', path: pathStr, operation: opStr,
+                message: `Read rule at ${pathStr} references request.resource.data which is not available on reads`,
+            });
+        }
+        // SEM-2: resource.data in create rule
+        if (ops.includes('create') && !ops.includes('update') && referencesResourceData(cond)) {
+            findings.push({
+                code: 'SEM-2', severity: 'high', path: pathStr, operation: opStr,
+                message: `Create rule at ${pathStr} references resource.data but document doesn't exist yet on create`,
+            });
+        }
+        // SEM-3: get()/exists() budget exceeded
+        const docReads = countDocReads(cond, new Map(localScope.map(f => [f.name, f])));
+        if (docReads > 10) {
+            findings.push({
+                code: 'SEM-3', severity: 'high', path: pathStr, operation: opStr,
+                message: `Rule at ${pathStr} has ${docReads} document reads (get/exists) — exceeds the 10-call budget`,
+            });
+        }
+        // SEM-4: Undefined function call
+        const calls = collectFunctionCalls(cond);
+        for (const fnName of calls) {
+            if (!allFunctions.has(fnName) && !BUILTIN_FUNCTIONS.has(fnName)) {
+                findings.push({
+                    code: 'SEM-4', severity: 'high', path: pathStr, operation: opStr,
+                    message: `Rule at ${pathStr} calls undefined function '${fnName}'`,
+                });
+            }
+        }
+        // QUA-1: Hardcoded true
+        if (isLiteralTrue) {
+            const severity = isWrite ? 'critical' : 'low';
+            findings.push({
+                code: 'QUA-1', severity, path: pathStr, operation: opStr,
+                message: `Hardcoded 'true' at ${pathStr} for ${opStr}`,
+            });
+        }
+        // QUA-5: Complex condition
+        if (exprDepth(cond) > 10) {
+            findings.push({
+                code: 'QUA-5', severity: 'low', path: pathStr, operation: opStr,
+                message: `Condition at ${pathStr} has depth ${exprDepth(cond)} — consider splitting into functions`,
+            });
+        }
+    }
+    // QUA-2: Empty match block
+    if (match.allows.length === 0 && match.children.length === 0 && match.functions.length === 0) {
+        findings.push({
+            code: 'QUA-2', severity: 'low', path: pathStr,
+            message: `Match block at ${pathStr} is empty — no allows, children, or functions`,
+        });
+    }
+    // STR-1: Match without wildcard
+    if (match.path.segments.every(s => s.type === 'literal')) {
+        findings.push({
+            code: 'STR-1', severity: 'low', path: pathStr,
+            message: `Match at ${pathStr} has no wildcard — matches exactly one document`,
+        });
+    }
+    // STR-2: Nested match without parent rules (skip the root /databases match)
+    const isRoot = match.path.raw.includes('databases') && match.path.raw.includes('documents');
+    if (match.children.length > 0 && match.allows.length === 0 && !isRoot) {
+        findings.push({
+            code: 'STR-2', severity: 'medium', path: pathStr,
+            message: `Match at ${pathStr} has nested children but no allows — parent collection is locked`,
+        });
+    }
+    // Recurse into children
+    for (const child of match.children) {
+        walkMatch(child, findings, allFunctions, localScope);
+    }
+}
+// ---- SEC-4: Default deny ----
+function checkDefaultDeny(rootMatch, findings) {
+    const hasDefaultDeny = rootMatch.children.some(child => {
+        const isRecursive = child.path.segments.some(s => s.type === 'recursive');
+        if (!isRecursive)
+            return false;
+        return child.allows.some(a => {
+            const hasBothOps = a.operations.includes('read') && a.operations.includes('write');
+            const isDeny = a.condition.type === 'literal' && a.condition.value === false;
+            return hasBothOps && isDeny;
+        });
+    });
+    if (!hasDefaultDeny) {
+        findings.push({
+            code: 'SEC-4', severity: 'medium', path: '/',
+            message: 'No default deny rule (match /{document=**} { allow read, write: if false; })',
+        });
+    }
+}
+// ---- Constant folding / simplification ----
+function boolLiteral(value) {
+    return { type: 'literal', value, raw: String(value) };
+}
+function isLitBool(expr, value) {
+    return expr.type === 'literal' && expr.value === value;
+}
+/**
+ * Simplify semantically-constant conditions so the literal checks and the
+ * auth/data-reference walks operate on the reduced form. Recurses into nested
+ * nodes so `X || (Y || true)` folds to `true`. Non-constant subexpressions are
+ * preserved intact so the downstream walks still see real auth/data references.
+ */
+function foldConstants(expr) {
+    switch (expr.type) {
+        case 'binaryOp': {
+            const left = foldConstants(expr.left);
+            const right = foldConstants(expr.right);
+            if (expr.op === '||') {
+                // X || true / true || X -> true
+                if (isLitBool(left, true) || isLitBool(right, true))
+                    return boolLiteral(true);
+                // X || false / false || X -> X
+                if (isLitBool(left, false))
+                    return right;
+                if (isLitBool(right, false))
+                    return left;
+            }
+            else if (expr.op === '&&') {
+                // X && false / false && X -> false
+                if (isLitBool(left, false) || isLitBool(right, false))
+                    return boolLiteral(false);
+                // X && true / true && X -> X
+                if (isLitBool(left, true))
+                    return right;
+                if (isLitBool(right, true))
+                    return left;
+            }
+            return { type: 'binaryOp', op: expr.op, left, right };
+        }
+        case 'unaryOp': {
+            const operand = foldConstants(expr.operand);
+            if (expr.op === '!' && operand.type === 'literal' && typeof operand.value === 'boolean') {
+                return boolLiteral(!operand.value);
+            }
+            return { type: 'unaryOp', op: expr.op, operand };
+        }
+        case 'ternary': {
+            const condition = foldConstants(expr.condition);
+            const consequent = foldConstants(expr.consequent);
+            const alternate = foldConstants(expr.alternate);
+            // Literal condition -> the taken branch
+            if (condition.type === 'literal' && typeof condition.value === 'boolean') {
+                return condition.value ? consequent : alternate;
+            }
+            return { type: 'ternary', condition, consequent, alternate };
+        }
+        default:
+            return expr;
+    }
+}
+// ---- Expression tree walkers ----
+function referencesAuth(expr) {
+    return exprContains(expr, e => e.type === 'memberAccess' && e.property === 'auth' &&
+        e.object.type === 'identifier' && e.object.name === 'request');
+}
+function referencesAuthTransitive(expr, fns, visited = new Set()) {
+    if (referencesAuth(expr))
+        return true;
+    // Follow function calls
+    let found = false;
+    walkExpr(expr, e => {
+        if (found)
+            return;
+        if (e.type === 'functionCall' && fns.has(e.name) && !visited.has(e.name)) {
+            visited.add(e.name);
+            if (referencesAuthTransitive(fns.get(e.name).body, fns, visited))
+                found = true;
+        }
+    });
+    return found;
+}
+function referencesRequestData(expr) {
+    return exprContains(expr, e => e.type === 'memberAccess' && e.property === 'data' &&
+        e.object.type === 'memberAccess' && e.object.property === 'resource' &&
+        e.object.object.type === 'identifier' && e.object.object.name === 'request');
+}
+function referencesRequestDataTransitive(expr, fns, visited = new Set()) {
+    if (referencesRequestData(expr))
+        return true;
+    let found = false;
+    walkExpr(expr, e => {
+        if (found)
+            return;
+        if (e.type === 'functionCall' && fns.has(e.name) && !visited.has(e.name)) {
+            visited.add(e.name);
+            if (referencesRequestDataTransitive(fns.get(e.name).body, fns, visited))
+                found = true;
+        }
+    });
+    return found;
+}
+function referencesResourceData(expr) {
+    return exprContains(expr, e => e.type === 'memberAccess' && e.property === 'data' &&
+        e.object.type === 'identifier' && e.object.name === 'resource');
+}
+function countDocReads(expr, functions, visited = new Set()) {
+    let count = 0;
+    walkExpr(expr, e => {
+        if (e.type === 'functionCall' && (e.name === 'get' || e.name === 'exists' || e.name === 'getAfter')) {
+            count++;
+        }
+        // Follow user-defined function calls
+        if (e.type === 'functionCall' && functions.has(e.name) && !visited.has(e.name)) {
+            visited.add(e.name);
+            count += countDocReads(functions.get(e.name).body, functions, visited);
+        }
+    });
+    return count;
+}
+function collectFunctionCalls(expr) {
+    const calls = [];
+    walkExpr(expr, e => {
+        if (e.type === 'functionCall')
+            calls.push(e.name);
+    });
+    return calls;
+}
+function collectAllFunctions(match) {
+    const names = new Set();
+    function walk(m) {
+        for (const fn of m.functions)
+            names.add(fn.name);
+        for (const child of m.children)
+            walk(child);
+    }
+    walk(match);
+    return names;
+}
+// ---- QUA-3: Duplicate functions ----
+function checkDuplicateFunctions(match, findings) {
+    checkDupsInScope(match.functions, match.path.raw, findings);
+    for (const child of match.children)
+        checkDuplicateFunctions(child, findings);
+}
+function checkDupsInScope(fns, path, findings) {
+    const seen = new Set();
+    for (const fn of fns) {
+        if (seen.has(fn.name)) {
+            findings.push({
+                code: 'QUA-3', severity: 'medium', path,
+                message: `Duplicate function '${fn.name}' in scope at ${path}`,
+            });
+        }
+        seen.add(fn.name);
+    }
+}
+// ---- QUA-4: Unused functions ----
+function checkUnusedFunctions(rootMatch, allCalls, findings) {
+    function walk(match) {
+        for (const fn of match.functions) {
+            if (!allCalls.has(fn.name)) {
+                findings.push({
+                    code: 'QUA-4', severity: 'low', path: match.path.raw,
+                    message: `Function '${fn.name}' is defined but never called`,
+                });
+            }
+        }
+        for (const child of match.children)
+            walk(child);
+    }
+    walk(rootMatch);
+}
+function collectAllCallsInRules(match) {
+    const calls = new Set();
+    function walkM(m) {
+        for (const allow of m.allows) {
+            for (const name of collectFunctionCalls(allow.condition))
+                calls.add(name);
+        }
+        for (const fn of m.functions) {
+            for (const name of collectFunctionCalls(fn.body))
+                calls.add(name);
+        }
+        for (const child of m.children)
+            walkM(child);
+    }
+    walkM(match);
+    return calls;
+}
+// ---- STR-3: Overlapping paths ----
+function checkOverlappingPaths(siblings, findings) {
+    for (let i = 0; i < siblings.length; i++) {
+        for (let j = i + 1; j < siblings.length; j++) {
+            if (pathsOverlap(siblings[i], siblings[j])) {
+                findings.push({
+                    code: 'STR-3', severity: 'low', path: siblings[i].path.raw,
+                    message: `Match paths '${siblings[i].path.raw}' and '${siblings[j].path.raw}' may overlap — the more permissive one wins`,
+                });
+            }
+        }
+        // Recurse into each sibling's children
+        checkOverlappingPaths(siblings[i].children, findings);
+    }
+}
+function pathsOverlap(a, b) {
+    const segsA = a.path.segments;
+    const segsB = b.path.segments;
+    if (segsA.length !== segsB.length)
+        return false;
+    // If one has a wildcard and the other has a literal at the same position, they overlap
+    for (let i = 0; i < segsA.length; i++) {
+        const sa = segsA[i], sb = segsB[i];
+        if (sa.type === 'literal' && sb.type === 'literal' && sa.value !== sb.value)
+            return false;
+        // wildcard + literal at same position = overlap
+        if ((sa.type === 'wildcard' || sa.type === 'recursive') && sb.type === 'literal')
+            return true;
+        if (sa.type === 'literal' && (sb.type === 'wildcard' || sb.type === 'recursive'))
+            return true;
+    }
+    return false;
+}
+// ---- Expression depth ----
+function exprDepth(expr) {
+    switch (expr.type) {
+        case 'binaryOp': return 1 + Math.max(exprDepth(expr.left), exprDepth(expr.right));
+        case 'unaryOp': return 1 + exprDepth(expr.operand);
+        case 'ternary': return 1 + Math.max(exprDepth(expr.condition), exprDepth(expr.consequent), exprDepth(expr.alternate));
+        case 'methodCall': return 1 + Math.max(exprDepth(expr.object), ...expr.args.map(exprDepth));
+        case 'functionCall': return 1 + Math.max(0, ...expr.args.map(exprDepth));
+        case 'bracketAccess': return 1 + Math.max(exprDepth(expr.object), exprDepth(expr.index));
+        case 'sliceAccess': return 1 + Math.max(exprDepth(expr.object), exprDepth(expr.start), exprDepth(expr.end));
+        case 'memberAccess': return 1 + exprDepth(expr.object);
+        case 'inExpr': return 1 + Math.max(exprDepth(expr.element), exprDepth(expr.collection));
+        case 'isExpr': return 1 + exprDepth(expr.value);
+        default: return 0;
+    }
+}
+// ---- Generic expression walker ----
+function exprContains(expr, predicate) {
+    if (predicate(expr))
+        return true;
+    return walkExprSome(expr, predicate);
+}
+function walkExprSome(expr, predicate) {
+    switch (expr.type) {
+        case 'binaryOp': return exprContains(expr.left, predicate) || exprContains(expr.right, predicate);
+        case 'unaryOp': return exprContains(expr.operand, predicate);
+        case 'ternary': return exprContains(expr.condition, predicate) || exprContains(expr.consequent, predicate) || exprContains(expr.alternate, predicate);
+        case 'methodCall': return exprContains(expr.object, predicate) || expr.args.some(a => exprContains(a, predicate));
+        case 'functionCall': return expr.args.some(a => exprContains(a, predicate));
+        case 'bracketAccess': return exprContains(expr.object, predicate) || exprContains(expr.index, predicate);
+        case 'sliceAccess': return exprContains(expr.object, predicate) || exprContains(expr.start, predicate) || exprContains(expr.end, predicate);
+        case 'memberAccess': return exprContains(expr.object, predicate);
+        case 'inExpr': return exprContains(expr.element, predicate) || exprContains(expr.collection, predicate);
+        case 'isExpr': return exprContains(expr.value, predicate);
+        case 'listLiteral': return expr.elements.some(e => exprContains(e, predicate));
+        case 'mapLiteral': return expr.entries.some(e => exprContains(e.key, predicate) || exprContains(e.value, predicate));
+        default: return false;
+    }
+}
+function walkExpr(expr, visitor) {
+    visitor(expr);
+    switch (expr.type) {
+        case 'binaryOp':
+            walkExpr(expr.left, visitor);
+            walkExpr(expr.right, visitor);
+            break;
+        case 'unaryOp':
+            walkExpr(expr.operand, visitor);
+            break;
+        case 'ternary':
+            walkExpr(expr.condition, visitor);
+            walkExpr(expr.consequent, visitor);
+            walkExpr(expr.alternate, visitor);
+            break;
+        case 'methodCall':
+            walkExpr(expr.object, visitor);
+            expr.args.forEach(a => walkExpr(a, visitor));
+            break;
+        case 'functionCall':
+            expr.args.forEach(a => walkExpr(a, visitor));
+            break;
+        case 'bracketAccess':
+            walkExpr(expr.object, visitor);
+            walkExpr(expr.index, visitor);
+            break;
+        case 'sliceAccess':
+            walkExpr(expr.object, visitor);
+            walkExpr(expr.start, visitor);
+            walkExpr(expr.end, visitor);
+            break;
+        case 'memberAccess':
+            walkExpr(expr.object, visitor);
+            break;
+        case 'inExpr':
+            walkExpr(expr.element, visitor);
+            walkExpr(expr.collection, visitor);
+            break;
+        case 'isExpr':
+            walkExpr(expr.value, visitor);
+            break;
+        case 'listLiteral':
+            expr.elements.forEach(e => walkExpr(e, visitor));
+            break;
+        case 'mapLiteral':
+            expr.entries.forEach(e => { walkExpr(e.key, visitor); walkExpr(e.value, visitor); });
+            break;
+    }
+}
+//# sourceMappingURL=FirestoreValidator.js.map

package/dist/rules/grammar/FirestoreValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FirestoreValidator.js","sourceRoot":"","sources":["../../../src/rules/grammar/FirestoreValidator.ts"],"names":[],"mappings":"AAYA,MAAM,SAAS,GAAmB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnF,MAAM,QAAQ,GAAmB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,MAAM,cAAc,GAAmB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAE1E,MAAM,UAAU,sBAAsB,CAAC,GAAmB;IACxD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,uCAAuC;IACvC,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAEnD,gCAAgC;IAChC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEtC,kCAAkC;IAClC,uBAAuB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE7C,0BAA0B;IAC1B,oBAAoB,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEpD,iCAAiC;IACjC,qBAAqB,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEpD,wBAAwB;IACxB,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAElE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAChB,KAAiB,EACjB,QAA6B,EAC7B,YAAyB,EACzB,cAA6B;IAE7B,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;IAE/B,yDAAyD;IACzD,MAAM,UAAU,GAAG,CAAC,GAAG,cAAc,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAE3D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;QAC7B,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;QACrE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;QACvE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7B,sBAAsB;QACtB,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBACpE,OAAO,EAAE,mBAAmB,OAAO,iBAAiB,KAAK,yBAAyB;aACnF,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,IAAI,MAAM,IAAI,aAAa,IAAI,mBAAmB,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBACpE,OAAO,EAAE,qCAAqC,OAAO,gCAAgC;aACtF,CAAC,CAAC;QACL,CAAC;QAED,8CAA8C;QAC9C,IAAI,mBAAmB,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBAChE,OAAO,EAAE,sBAAsB,OAAO,qDAAqD;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3F,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBAChE,OAAO,EAAE,iBAAiB,OAAO,8BAA8B;aAChE,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,IAAI,WAAW,IAAI,CAAC,cAAc,IAAI,CAAC,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBAChE,OAAO,EAAE,GAAG,KAAK,OAAO,OAAO,oEAAoE;aACpG,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,IAAI,MAAM,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBAChE,OAAO,EAAE,gBAAgB,OAAO,mEAAmE;aACpG,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBAChE,OAAO,EAAE,kBAAkB,OAAO,oEAAoE;aACvG,CAAC,CAAC;QACL,CAAC;QAED,wCAAwC;QACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBAChE,OAAO,EAAE,WAAW,OAAO,QAAQ,QAAQ,2DAA2D;aACvG,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACzC,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;oBAChE,OAAO,EAAE,WAAW,OAAO,8BAA8B,MAAM,GAAG;iBACnE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,UAAmB,CAAC,CAAC,CAAC,KAAc,CAAC;YAChE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBACxD,OAAO,EAAE,uBAAuB,OAAO,QAAQ,KAAK,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK;gBAC/D,OAAO,EAAE,gBAAgB,OAAO,cAAc,SAAS,CAAC,IAAI,CAAC,sCAAsC;aACpG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7F,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO;YAC7C,OAAO,EAAE,kBAAkB,OAAO,+CAA+C;SAClF,CAAC,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO;YAC7C,OAAO,EAAE,YAAY,OAAO,iDAAiD;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACtE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO;YAChD,OAAO,EAAE,YAAY,OAAO,kEAAkE;SAC/F,CAAC,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC,SAAS,gBAAgB,CAAC,SAAqB,EAAE,QAA6B;IAC5E,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACrD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC3B,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC;YAC7E,OAAO,UAAU,IAAI,MAAM,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG;YAC5C,OAAO,EAAE,8EAA8E;SACxF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8CAA8C;AAE9C,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,IAAgB,EAAE,KAAc;IACjD,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAgB;IACrC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBACrB,gCAAgC;gBAChC,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;oBAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC9E,+BAA+B;gBAC/B,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACzC,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC3C,CAAC;iBAAM,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC5B,mCAAmC;gBACnC,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;oBAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;gBACjF,6BAA6B;gBAC7B,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACxC,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxD,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxF,OAAO,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;QACnD,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChD,wCAAwC;YACxC,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClD,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAC/D,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,oCAAoC;AAEpC,SAAS,cAAc,CAAC,IAAgB;IACtC,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAC5B,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;QAClD,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAgB,EAAE,GAA6B,EAAE,UAAU,IAAI,GAAG,EAAU;IAC5G,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,wBAAwB;IACxB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE;QACjB,IAAI,KAAK;YAAE,OAAO;QAClB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAgB;IAC7C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAC5B,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;QAClD,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU;QACpE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,IAAgB,EAAE,GAA6B,EAAE,UAAU,IAAI,GAAG,EAAU;IACnH,IAAI,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE;QACjB,IAAI,KAAK;YAAE,OAAO;QAClB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,+BAA+B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC;QACzF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAgB;IAC9C,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAC5B,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;QAClD,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB,EAAE,SAAmC,EAAE,UAAU,IAAI,GAAG,EAAU;IACvG,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE;QACjB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;YACpG,KAAK,EAAE,CAAC;QACV,CAAC;QACD,qCAAqC;QACrC,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpB,KAAK,IAAI,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAgB;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE;QACjB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAiB;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,SAAS,IAAI,CAAC,CAAa;QACzB,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACjD,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC;IACZ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uCAAuC;AAEvC,SAAS,uBAAuB,CAAC,KAAiB,EAAE,QAA6B;IAC/E,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ;QAAE,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAkB,EAAE,IAAY,EAAE,QAA6B;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI;gBACvC,OAAO,EAAE,uBAAuB,EAAE,CAAC,IAAI,iBAAiB,IAAI,EAAE;aAC/D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,oCAAoC;AAEpC,SAAS,oBAAoB,CAAC,SAAqB,EAAE,QAAqB,EAAE,QAA6B;IACvG,SAAS,IAAI,CAAC,KAAiB;QAC7B,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG;oBACpD,OAAO,EAAE,aAAa,EAAE,CAAC,IAAI,+BAA+B;iBAC7D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAiB;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,SAAS,KAAK,CAAC,CAAa;QAC1B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,QAAQ;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,CAAC;IACb,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qCAAqC;AAErC,SAAS,qBAAqB,CAAC,QAAsB,EAAE,QAA6B;IAClF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG;oBAC1D,OAAO,EAAE,gBAAgB,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,8CAA8C;iBAC1H,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,uCAAuC;QACvC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAa,EAAE,CAAa;IAChD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChD,uFAAuF;IACvF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC1F,gDAAgD;QAChD,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC9F,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;IAChG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6BAA6B;AAE7B,SAAS,SAAS,CAAC,IAAgB;IACjC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACtH,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5F,KAAK,cAAc,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,KAAK,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzF,KAAK,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5G,KAAK,cAAc,CAAC,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACxF,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,sCAAsC;AAEtC,SAAS,YAAY,CAAC,IAAgB,EAAE,SAAqC;IAC3E,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB,EAAE,SAAqC;IAC3E,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAClG,KAAK,SAAS,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7D,KAAK,SAAS,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtJ,KAAK,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAClH,KAAK,cAAc,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5E,KAAK,eAAe,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACzG,KAAK,aAAa,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5I,KAAK,cAAc,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjE,KAAK,QAAQ,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACxG,KAAK,QAAQ,CAAC,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1D,KAAK,aAAa,CAAC,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/E,KAAK,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB,EAAE,OAAgC;IAClE,OAAO,CAAC,IAAI,CAAC,CAAC;IACd,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM;QACpF,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM;QACvD,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM;QAChI,KAAK,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,MAAM;QACvG,KAAK,cAAc;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,MAAM;QACzE,KAAK,eAAe;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM;QAC3F,KAAK,aAAa;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM;QACtH,KAAK,cAAc;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM;QAC3D,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM;QAC1F,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM;QACpD,KAAK,aAAa;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,MAAM;QAC5E,KAAK,YAAY;YAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM;IACjH,CAAC;AACH,CAAC"}

package/dist/rules/index.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `pyric/rules` — author, lint, simulate, and assert Firebase security
+ * rules, in process, without a deployment.
+ *
+ * The surface is small on purpose. Two named constructors return deep,
+ * safe-by-default handles:
+ *
+ *   firestoreRules(source) → lint() · simulate(cases) · explain(case) · toJSON()
+ *   rtdbRules(defOrDocOrJson) → lint() · simulate(cases) · explain(case) · toJSON()
+ *
+ * Compiling unparseable source throws {@link RulesCompileError}; past that,
+ * the handles never throw on a rule outcome — a denied or abstained case is
+ * returned as data. `lint(source)` is the tolerant front door for AI
+ * authoring: it accepts anything, never throws, and returns every issue as a
+ * unified {@link RuleIssue}. The assertion adapter (`assertCase`, with
+ * `explainCase` as its trace renderer) is the seam to a throwing test
+ * runner: `for (const c of cases) test(c.description, () => assertCase(ruleset, c))`.
+ *
+ * The Realtime Database constraints DSL (`defineRtdbRules` + combinators) and
+ * the value helpers (`serverTimestamp`, `timestamp`, …) are re-exported here
+ * as siblings.
+ *
+ * Storage rules are not covered here (yet). The lower-level engine —
+ * simulator handlers, parser/AST, resolver, wrappers — is engine-internal;
+ * package-internal consumers reach it through `pyric/rules/internal`.
+ */
+export { firestoreRules } from './api/firestore.js';
+export type { FirestoreRuleset } from './api/firestore.js';
+export { rtdbRules } from './api/rtdb.js';
+export type { RtdbRuleset } from './api/rtdb.js';
+export { lint } from './api/lint.js';
+export { assertCase, explainCase } from './api/assert.js';
+export { RulesCompileError, RulesAssertionError, RulesUnsupportedError, } from './api/errors.js';
+export type { RuleIssue, RuleIssueSeverity, RuleIssueOrigin, } from './api/issue.js';
+export type { FirestoreCase, CaseResult, Explanation, SimulationSummary, RtdbCase, RtdbCaseResult, RtdbExplanation, RtdbSimulationSummary, } from './api/case-types.js';
+export type { RuleEvaluation, PathResolutionEntry, PathResolutionTrace, EvaluatedRuleInfo, FirestoreMethod, } from './test/spec.js';
+export type { ExprTraceEntry } from './simulator/evaluator.js';
+export { serverTimestamp, timestamp, bytes, latlng, duration, reference, vector, } from './api/values.js';
+export { expr, all, any, not, deny, always, allow, authenticated, ownPath, ownField, isNew, hasChildren, hasChild, fieldIsString, fieldIsNumber, fieldIsBoolean, fieldEnum, immutable, immutableSelf, rootExists, rootEquals, pathOwnerOnly, fieldOwnerOnly, ownerOrNew, hasRole, isMember, required, transition, dataVal, newDataVal, dataExists, newDataExists, newDataIs, dataParentVal, newDataParentVal, newDataParentExists, eq, neq, gt, lte, AUTH_UID, turnGuard, flip, winCheckHelper, schemaRules, ruleset, defineRtdbRules, } from './rtdb/constraints/index.js';
+export type { Expr, PathDef, Segment, RulesetContext, SchemaRulesResult, RtdbRulesDefinition, RtdbRulesDocument, RtdbRulesJson, RtdbRulesCheckResult, RtdbRulesFinding, RtdbRulesFindingRule, RtdbRulesSimulationAuth, RtdbRulesSimulationInput, } from './rtdb/constraints/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EACV,aAAa,EACb,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,QAAQ,EACR,cAAc,EACd,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,OAAO,EACL,eAAe,EACf,SAAS,EACT,KAAK,EACL,MAAM,EACN,QAAQ,EACR,SAAS,EACT,MAAM,GACP,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,IAAI,EACJ,GAAG,EACH,GAAG,EACH,GAAG,EACH,IAAI,EACJ,MAAM,EACN,KAAK,EACL,aAAa,EACb,OAAO,EACP,QAAQ,EACR,KAAK,EACL,WAAW,EACX,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,SAAS,EACT,SAAS,EACT,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,aAAa,EACb,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,EAAE,EACF,GAAG,EACH,EAAE,EACF,GAAG,EACH,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,GAChB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,IAAI,EACJ,OAAO,EACP,OAAO,EACP,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC"}

package/dist/rules/index.js

@@ -0,0 +1,40 @@
+/**
+ * `pyric/rules` — author, lint, simulate, and assert Firebase security
+ * rules, in process, without a deployment.
+ *
+ * The surface is small on purpose. Two named constructors return deep,
+ * safe-by-default handles:
+ *
+ *   firestoreRules(source) → lint() · simulate(cases) · explain(case) · toJSON()
+ *   rtdbRules(defOrDocOrJson) → lint() · simulate(cases) · explain(case) · toJSON()
+ *
+ * Compiling unparseable source throws {@link RulesCompileError}; past that,
+ * the handles never throw on a rule outcome — a denied or abstained case is
+ * returned as data. `lint(source)` is the tolerant front door for AI
+ * authoring: it accepts anything, never throws, and returns every issue as a
+ * unified {@link RuleIssue}. The assertion adapter (`assertCase`, with
+ * `explainCase` as its trace renderer) is the seam to a throwing test
+ * runner: `for (const c of cases) test(c.description, () => assertCase(ruleset, c))`.
+ *
+ * The Realtime Database constraints DSL (`defineRtdbRules` + combinators) and
+ * the value helpers (`serverTimestamp`, `timestamp`, …) are re-exported here
+ * as siblings.
+ *
+ * Storage rules are not covered here (yet). The lower-level engine —
+ * simulator handlers, parser/AST, resolver, wrappers — is engine-internal;
+ * package-internal consumers reach it through `pyric/rules/internal`.
+ */
+// ─── Constructors ────────────────────────────────────────────────────
+export { firestoreRules } from './api/firestore.js';
+export { rtdbRules } from './api/rtdb.js';
+// ─── Tolerant lint (the AI-authoring front door) ─────────────────────
+export { lint } from './api/lint.js';
+// ─── Assertion adapter (the only throwing verb beyond constructors) ──
+export { assertCase, explainCase } from './api/assert.js';
+// ─── Errors ──────────────────────────────────────────────────────────
+export { RulesCompileError, RulesAssertionError, RulesUnsupportedError, } from './api/errors.js';
+// ─── Value helpers ───────────────────────────────────────────────────
+export { serverTimestamp, timestamp, bytes, latlng, duration, reference, vector, } from './api/values.js';
+// ─── RTDB constraints DSL (re-exported unchanged as siblings) ────────
+export { expr, all, any, not, deny, always, allow, authenticated, ownPath, ownField, isNew, hasChildren, hasChild, fieldIsString, fieldIsNumber, fieldIsBoolean, fieldEnum, immutable, immutableSelf, rootExists, rootEquals, pathOwnerOnly, fieldOwnerOnly, ownerOrNew, hasRole, isMember, required, transition, dataVal, newDataVal, dataExists, newDataExists, newDataIs, dataParentVal, newDataParentVal, newDataParentExists, eq, neq, gt, lte, AUTH_UID, turnGuard, flip, winCheckHelper, schemaRules, ruleset, defineRtdbRules, } from './rtdb/constraints/index.js';
+//# sourceMappingURL=index.js.map

package/dist/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,wEAAwE;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG1C,wEAAwE;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,wEAAwE;AACxE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE1D,wEAAwE;AACxE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AA+BzB,wEAAwE;AACxE,OAAO,EACL,eAAe,EACf,SAAS,EACT,KAAK,EACL,MAAM,EACN,QAAQ,EACR,SAAS,EACT,MAAM,GACP,MAAM,iBAAiB,CAAC;AAEzB,wEAAwE;AACxE,OAAO,EACL,IAAI,EACJ,GAAG,EACH,GAAG,EACH,GAAG,EACH,IAAI,EACJ,MAAM,EACN,KAAK,EACL,aAAa,EACb,OAAO,EACP,QAAQ,EACR,KAAK,EACL,WAAW,EACX,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,SAAS,EACT,SAAS,EACT,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,aAAa,EACb,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,EAAE,EACF,GAAG,EACH,EAAE,EACF,GAAG,EACH,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,GAChB,MAAM,6BAA6B,CAAC"}