pyric 0.0.1 → 0.1.0-alpha.10

package/dist/rules/inspect/handler.js

@@ -0,0 +1,144 @@
+import { parseToASTOrError } from '../grammar/FirestoreParser.js';
+import { validateFirestoreRules } from '../grammar/FirestoreValidator.js';
+const RULES_API = 'https://firebaserules.googleapis.com/v1';
+export class InspectFirestoreRulesHandler {
+    async execute(scope) {
+        try {
+            const token = await scope.resolveToken();
+            // 1. List rulesets to find the latest Firestore ruleset
+            const listRes = await fetch(`${RULES_API}/projects/${scope.projectId}/rulesets?pageSize=10`, {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            if (listRes.status === 403) {
+                return {
+                    success: false,
+                    error: { code: 'PERMISSION_DENIED', message: 'Service account lacks permission to read Firestore rules', recoverable: false },
+                };
+            }
+            if (!listRes.ok) {
+                return {
+                    success: false,
+                    error: { code: 'FETCH_FAILED', message: `Failed to list rulesets: ${listRes.status}`, recoverable: false },
+                };
+            }
+            const listData = await listRes.json();
+            const rulesets = (listData.rulesets || []).filter(r => r.metadata?.services?.includes('cloud.firestore'));
+            if (rulesets.length === 0) {
+                return {
+                    success: false,
+                    error: { code: 'NO_RULESETS', message: 'No Firestore rulesets found for this project', recoverable: false },
+                };
+            }
+            // 2. Get the most recent ruleset
+            const latest = rulesets[0];
+            const rulesetId = latest.name.split('/').pop();
+            const getRes = await fetch(`${RULES_API}/${latest.name}`, {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            if (!getRes.ok) {
+                return {
+                    success: false,
+                    error: { code: 'FETCH_FAILED', message: `Failed to get ruleset: ${getRes.status}`, recoverable: false },
+                };
+            }
+            const rulesetData = await getRes.json();
+            const source = rulesetData.source.files[0]?.content || '';
+            // 3. Parse the rules — surface line/col so a deployed-but-broken
+            // ruleset is easy to locate even when it came from outside this SDK.
+            const parsed = parseToASTOrError(source);
+            if (!parsed.ok) {
+                return {
+                    success: false,
+                    error: {
+                        code: 'PARSE_FAILED',
+                        message: `Failed to parse deployed Firestore rules at line ${parsed.error.line}, col ${parsed.error.column}: expected ${parsed.error.expected || '<unknown>'}`,
+                        recoverable: false,
+                        parseError: parsed.error,
+                    },
+                };
+            }
+            const ast = parsed.ast;
+            // 4. Build summary + validate
+            const summary = buildSummary(ast.service.match);
+            const findings = validateFirestoreRules(ast);
+            return {
+                success: true,
+                data: {
+                    rules: ast,
+                    source,
+                    rulesetId,
+                    createdAt: latest.createTime,
+                    summary,
+                    findings,
+                },
+            };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: { code: 'FETCH_FAILED', message: e instanceof Error ? e.message : String(e), recoverable: false },
+            };
+        }
+    }
+}
+function buildSummary(rootMatch) {
+    const matchPaths = [];
+    const functionNames = [];
+    const operationCounts = {};
+    let totalAllowRules = 0;
+    const publicReadPaths = [];
+    const publicWritePaths = [];
+    function walkMatch(match) {
+        // Collect match path
+        matchPaths.push(match.path.raw);
+        // Collect functions
+        for (const fn of match.functions) {
+            functionNames.push(fn.name);
+        }
+        // Collect allow rules
+        for (const allow of match.allows) {
+            totalAllowRules++;
+            for (const op of allow.operations) {
+                operationCounts[op] = (operationCounts[op] || 0) + 1;
+            }
+            // Check for public access (condition is literal true)
+            if (isLiteralTrue(allow.condition)) {
+                for (const op of allow.operations) {
+                    if (op === 'read' || op === 'get' || op === 'list') {
+                        if (!publicReadPaths.includes(match.path.raw)) {
+                            publicReadPaths.push(match.path.raw);
+                        }
+                    }
+                    if (op === 'write' || op === 'create' || op === 'update' || op === 'delete') {
+                        if (!publicWritePaths.includes(match.path.raw)) {
+                            publicWritePaths.push(match.path.raw);
+                        }
+                    }
+                }
+            }
+        }
+        // Recurse into children
+        for (const child of match.children) {
+            walkMatch(child);
+        }
+    }
+    // Walk children of the documents match (skip the /databases/{database}/documents root)
+    for (const fn of rootMatch.functions) {
+        functionNames.push(fn.name);
+    }
+    for (const child of rootMatch.children) {
+        walkMatch(child);
+    }
+    // Also count root-level allows
+    for (const allow of rootMatch.allows) {
+        totalAllowRules++;
+        for (const op of allow.operations) {
+            operationCounts[op] = (operationCounts[op] || 0) + 1;
+        }
+    }
+    return { matchPaths, functionNames, operationCounts, totalAllowRules, publicReadPaths, publicWritePaths };
+}
+function isLiteralTrue(expr) {
+    return expr.type === 'literal' && expr.value === true;
+}
+//# sourceMappingURL=handler.js.map

package/dist/rules/inspect/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/rules/inspect/handler.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D,MAAM,OAAO,4BAA4B;IACvC,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;YAEzC,wDAAwD;YACxD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,aAAa,KAAK,CAAC,SAAS,uBAAuB,EAAE;gBAC3F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,0DAA0D,EAAE,WAAW,EAAE,KAAK,EAAE;iBAC9H,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4BAA4B,OAAO,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;iBAC3G,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAoG,CAAC;YACxI,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACpD,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAClD,CAAC;YAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,KAAK,EAAE;iBAC5G,CAAC;YACJ,CAAC;YAED,iCAAiC;YACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;YAEhD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE;gBACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,MAAM,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;iBACxG,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,EAGpC,CAAC;YAEF,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;YAE1D,iEAAiE;YACjE,qEAAqE;YACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,oDAAoD,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,CAAC,KAAK,CAAC,MAAM,cAAc,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,WAAW,EAAE;wBAC9J,WAAW,EAAE,KAAK;wBAClB,UAAU,EAAE,MAAM,CAAC,KAAK;qBACzB;iBACF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YAEvB,8BAA8B;YAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAE7C,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,KAAK,EAAE,GAAG;oBACV,MAAM;oBACN,SAAS;oBACT,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,OAAO;oBACP,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;aACzG,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,SAAS,YAAY,CAAC,SAAqB;IACzC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,SAAS,SAAS,CAAC,KAAiB;QAClC,qBAAqB;QACrB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,oBAAoB;QACpB,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,sBAAsB;QACtB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,eAAe,EAAE,CAAC;YAClB,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBAClC,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,sDAAsD;YACtD,IAAI,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;oBAClC,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;wBACnD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC9C,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACvC,CAAC;oBACH,CAAC;oBACD,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;wBAC5E,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC/C,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACxC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACrC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,+BAA+B;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,eAAe,EAAE,CAAC;QAClB,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAClC,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;AAC5G,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;AACxD,CAAC"}

package/dist/rules/inspect/spec.d.ts

@@ -0,0 +1,37 @@
+import type { FirestoreRules } from '../grammar/FirestoreAST.js';
+import type { ValidationFinding } from '../grammar/FirestoreValidator.js';
+import type { ParseError } from '../grammar/FirestoreParser.js';
+export type InspectFirestoreRulesResult = {
+    success: true;
+    data: {
+        rules: FirestoreRules;
+        source: string;
+        rulesetId: string;
+        createdAt: string;
+        summary: RulesSummary;
+        findings: ValidationFinding[];
+    };
+} | {
+    success: false;
+    error: {
+        code: string;
+        message: string;
+        recoverable: boolean;
+        parseError?: ParseError;
+    };
+};
+export interface RulesSummary {
+    /** All match paths in the rules (e.g., '/users/{userId}', '/posts/{postId}') */
+    matchPaths: string[];
+    /** All function names defined in the rules */
+    functionNames: string[];
+    /** Count of allow rules by operation type */
+    operationCounts: Record<string, number>;
+    /** Total number of allow rules */
+    totalAllowRules: number;
+    /** Paths with public read (allow read: if true) */
+    publicReadPaths: string[];
+    /** Paths with public write (allow write: if true or allow create/update/delete: if true) */
+    publicWritePaths: string[];
+}
+//# sourceMappingURL=spec.d.ts.map

package/dist/rules/inspect/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/rules/inspect/spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,MAAM,MAAM,2BAA2B,GACnC;IACE,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE;QACJ,KAAK,EAAE,cAAc,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,YAAY,CAAC;QACtB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;KAC/B,CAAC;CACH,GACD;IACE,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,CAAC;CACzF,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,6CAA6C;IAC7C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,kCAAkC;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,4FAA4F;IAC5F,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B"}

package/dist/rules/inspect/spec.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spec.js.map

package/dist/rules/inspect/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/rules/inspect/spec.ts"],"names":[],"mappings":""}

package/dist/rules/inspect/tools.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Browser-safe `firestore_inspect_rules` factory. Returns a single
+ * `ToolHandler` that, given a `ProjectScope`, fetches + parses the
+ * currently deployed Firestore ruleset.
+ *
+ * Split from the main `createFirestoreRulesTools` factory (which is
+ * Node-only — it wraps the disk-reading modules resolver) so browser
+ * callers (the playground, debug surfaces) can opt into just the
+ * inspect tool without dragging in `node:fs`.
+ *
+ * Server-side callers should use `createFirestoreRulesTools({ scope })`
+ * (Node entry) which includes this tool + the rest of the rules
+ * lifecycle (test, simulate, lint, resolve-modules).
+ */
+import type { ToolHandler } from '@inbrowser/agent';
+import type { ProjectScope } from '../../project-scope.js';
+export interface FirestoreInspectToolDeps {
+    scope: ProjectScope;
+}
+export declare function createFirestoreInspectTool(deps: FirestoreInspectToolDeps): ToolHandler;
+//# sourceMappingURL=tools.d.ts.map

package/dist/rules/inspect/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/rules/inspect/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,WAAW,CAmBtF"}

package/dist/rules/inspect/tools.js

@@ -0,0 +1,21 @@
+import { InspectFirestoreRulesHandler } from './handler.js';
+export function createFirestoreInspectTool(deps) {
+    const { scope } = deps;
+    const handler = new InspectFirestoreRulesHandler();
+    return {
+        name: 'firestore_inspect_rules',
+        description: 'Fetch and parse the currently deployed Firestore security rules for this project. Returns the parsed AST with match blocks, functions, allow rules, and a summary including public paths, operation counts, and function names. Use this to understand the security model before generating code or modifying rules.',
+        parameters: { type: 'object', properties: {} },
+        async execute() {
+            const result = await handler.execute(scope);
+            return {
+                ok: result.success,
+                summary: result.success
+                    ? `${result.data.summary.totalAllowRules} allow rule(s) across ${result.data.summary.matchPaths.length} match path(s)`
+                    : `Inspect failed: ${result.error.message}`,
+                data: result,
+            };
+        },
+    };
+}
+//# sourceMappingURL=tools.js.map

package/dist/rules/inspect/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/rules/inspect/tools.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAM5D,MAAM,UAAU,0BAA0B,CAAC,IAA8B;IACvE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,4BAA4B,EAAE,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,sTAAsT;QACxT,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;QAC9C,KAAK,CAAC,OAAO;YACX,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5C,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,OAAO;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACrB,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,yBAAyB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,gBAAgB;oBACtH,CAAC,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC7C,IAAI,EAAE,MAAM;aACb,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/rules/internal/extract.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `pyric/rules/extract`: composite-index extractor entry.
+ *
+ * The extractor statically analyzes JS/TS source (via the TypeScript compiler)
+ * for the modular Firestore client's `query(collection(...), where(...),
+ * orderBy(...))` pattern. The TS compiler is large (~10MB) and optimizer-
+ * hostile, so it lives on its OWN subpath rather than the `pyric/rules` root
+ * barrel.
+ *
+ * Why a subpath and not the root: every app that imports `firebase/firestore`
+ * reaches `pyric/rules` (via `pyric/firestore`), and Vite's dep optimizer
+ * bundles a bare-specifier dep WHOLESALE, so it cannot tree-shake an entry's
+ * exports, and it follows dynamic imports; a root re-export (static OR
+ * lazy) drags the whole TS compiler into every browser bundle and trips the
+ * optimizer. Keeping the extractor here means `pyric/rules` stays compiler-free
+ * for apps that never extract; browser callers that DO extract (the playground)
+ * and Node callers (the MCP) opt in by importing `pyric/rules/extract`.
+ *
+ * (The erasable extractor TYPES stay re-exported from the root barrel too, since
+ * type-only exports compile away and never reach a bundle.)
+ */
+export { extractIndexes } from '../indexes/extract/extractor.js';
+export { ExtractFirestoreIndexesHandler } from '../indexes/extractHandler.js';
+export { createFirestoreExtractTool } from '../indexes/extractTool.js';
+export type { ExtractIndexesOptions } from '../indexes/extractHandler.js';
+export type { ExtractResult, ExtractionWarning, ExtractionSignal, ExtractOptions, QueryShape, Filter as IndexFilter, Order as IndexOrder, Fragment as IndexFragment, QueryBaseDecl, AnnotationApplied, } from '../indexes/extract/types.js';
+export type { ApiScope, ArrayConfig, Density, Index, IndexField, IndexFieldOrder, IndexOperation, IndexState, IndexesConfig, IndexesConfigEntry, QueryScope, VectorConfig, } from '../indexes/types.js';
+//# sourceMappingURL=extract.d.ts.map

package/dist/rules/internal/extract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../../../src/rules/internal/extract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,YAAY,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,MAAM,IAAI,WAAW,EACrB,KAAK,IAAI,UAAU,EACnB,QAAQ,IAAI,aAAa,EACzB,aAAa,EACb,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,QAAQ,EACR,WAAW,EACX,OAAO,EACP,KAAK,EACL,UAAU,EACV,eAAe,EACf,cAAc,EACd,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,YAAY,GACb,MAAM,qBAAqB,CAAC"}

package/dist/rules/internal/extract.js

@@ -0,0 +1,25 @@
+/**
+ * `pyric/rules/extract`: composite-index extractor entry.
+ *
+ * The extractor statically analyzes JS/TS source (via the TypeScript compiler)
+ * for the modular Firestore client's `query(collection(...), where(...),
+ * orderBy(...))` pattern. The TS compiler is large (~10MB) and optimizer-
+ * hostile, so it lives on its OWN subpath rather than the `pyric/rules` root
+ * barrel.
+ *
+ * Why a subpath and not the root: every app that imports `firebase/firestore`
+ * reaches `pyric/rules` (via `pyric/firestore`), and Vite's dep optimizer
+ * bundles a bare-specifier dep WHOLESALE, so it cannot tree-shake an entry's
+ * exports, and it follows dynamic imports; a root re-export (static OR
+ * lazy) drags the whole TS compiler into every browser bundle and trips the
+ * optimizer. Keeping the extractor here means `pyric/rules` stays compiler-free
+ * for apps that never extract; browser callers that DO extract (the playground)
+ * and Node callers (the MCP) opt in by importing `pyric/rules/extract`.
+ *
+ * (The erasable extractor TYPES stay re-exported from the root barrel too, since
+ * type-only exports compile away and never reach a bundle.)
+ */
+export { extractIndexes } from '../indexes/extract/extractor.js';
+export { ExtractFirestoreIndexesHandler } from '../indexes/extractHandler.js';
+export { createFirestoreExtractTool } from '../indexes/extractTool.js';
+//# sourceMappingURL=extract.js.map

package/dist/rules/internal/extract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../../src/rules/internal/extract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/rules/internal/index.d.ts

@@ -0,0 +1,82 @@
+/**
+ * `pyric/rules/internal` — the low-level rules engine seam.
+ *
+ * NOT part of the public `pyric/rules` contract. The public front door
+ * (`firestoreRules`, `rtdbRules`, `lint`, the assertion adapters, the
+ * value helpers, and the RTDB constraints DSL) lives in `../index.ts`
+ * and is a thin layer over the primitives re-exported here.
+ *
+ * This seam exists so the package's own deep consumers (the sandbox
+ * simulator, the test suites) and the sibling tooling packages
+ * (`@pyric/cli`) can reach the engine primitives — parser, linter,
+ * simulator handler, resolver, wrappers, RTDB machinery — without those
+ * primitives leaking onto the curated public surface. Mirrors the
+ * established `pyric/sandbox/internal` / `pyric/storage/internal` pattern.
+ *
+ * Browser-safe: no `node:` builtins, no TypeScript compiler. Node-only
+ * additions (the fs module resolver, agent-tool factories) live on
+ * `./node`; the composite-index extractor (TS compiler) is isolated on
+ * `./extract`.
+ *
+ * Surface:
+ *   - Parser + AST (parser/AST/validator/assembler)
+ *   - Linter (`lintFirestoreRules` + warning/metrics types)
+ *   - 2+modules resolver (`resolveModules`) + stdlib
+ *   - Rules simulator (`SimulateFirestoreRulesHandler` + value
+ *     wrappers — `Timestamp`, `Path`, etc.)
+ *   - Rules Test API client (`TestFirestoreRulesHandler`, takes
+ *     `ProjectScope` per F3)
+ *   - Sentinel expression engine (used by sandbox for $expr
+ *     resolution in declarative transactions)
+ */
+export { parseToAST, parseToASTOrError, parseFunctions, } from '../grammar/FirestoreParser.js';
+export type { ParseError, ParseResult } from '../grammar/FirestoreParser.js';
+export { assembleRules, assembleExpression as printExpression } from '../grammar/FirestoreAssembler.js';
+export { validateFirestoreRules } from '../grammar/FirestoreValidator.js';
+export type { ValidationFinding } from '../grammar/FirestoreValidator.js';
+export type { FirestoreRules, MatchBlock, AllowRule, FunctionDef, Expression, PathSegment, SourceLoc, } from '../grammar/FirestoreAST.js';
+export { lintFirestoreRules } from '../linter/linter.js';
+export type { LintResult, LintWarning, LintOptions, RulesMetrics, } from '../linter/linter.js';
+export type { ResolveResult, ResolveOptions } from '../modules/resolver.js';
+export { SimulateFirestoreRulesHandler, SERVER_TIMESTAMP } from '../simulator/handler.js';
+export { evaluate, UnsupportedError, TraceRecorder } from '../simulator/evaluator.js';
+export type { SimulationContext, ExprTraceEntry } from '../simulator/evaluator.js';
+export { projectAfterState } from '../simulator/project-after-state.js';
+export { MapDiff, FirestoreSet } from '../simulator/mapdiff.js';
+export { tokenize } from '../simulator/expression/lexer.js';
+export { parse } from '../simulator/expression/parser.js';
+export { Timestamp } from '../simulator/wrappers/timestamp.js';
+export { Path } from '../simulator/wrappers/path.js';
+export { Reference, referenceToResourceName } from '../simulator/wrappers/reference.js';
+export { Vector } from '../simulator/wrappers/vector.js';
+export { Bytes } from '../simulator/wrappers/bytes.js';
+export { Duration } from '../simulator/wrappers/duration.js';
+export { LatLng } from '../simulator/wrappers/latlng.js';
+export { RulesValue, NO_OP } from '../simulator/wrappers/base.js';
+export { TestFirestoreRulesHandler } from '../test/handler.js';
+export type { FirestoreMethod, TestCase, TestIdentity, TestResult, TestFirestoreRulesResult, FunctionMock, ExpressionReportLevel, ListQuery, RulesTestApiResultDetails, RulesTestIssue, RuleEvaluation, PathResolutionEntry, PathResolutionTrace, } from '../test/spec.js';
+export { FIRESTORE_METHODS, TestCaseSchema, TestIdentitySchema, renderLegacyDebugMessages, projectEvaluatedRule, } from '../test/spec.js';
+export type { EvaluatedRuleInfo } from '../test/spec.js';
+export { resolveExpressionsInData, ExpressionWalkError } from '../simulator/expression/walk-data.js';
+export { EvalError } from '../simulator/expression/eval-errors.js';
+export { ExpressionLexError, ExpressionParseError, } from '../simulator/expression/types.js';
+export type { FirestoreRulesToolDeps, FirestoreSimulatorToolDeps, } from '../tools.js';
+export { STDLIB_MODULES, findModuleByKey, allModuleKeys, suggestKey, } from '../stdlib-modules.js';
+export type { StdlibModule, StdlibEntry, ModuleKind, } from '../stdlib-modules.js';
+export { createFirestoreRulesStdlibTools } from '../stdlib-tools.js';
+export { resolveModulesBrowser, STDLIB_INLINE } from '../modules/resolver-browser.js';
+export type { ExtractIndexesOptions } from '../indexes/extractHandler.js';
+export type { ExtractResult, ExtractionWarning, ExtractionSignal, ExtractOptions, QueryShape, Filter as IndexFilter, Order as IndexOrder, Fragment as IndexFragment, QueryBaseDecl, AnnotationApplied, } from '../indexes/extract/types.js';
+export type { ApiScope, ArrayConfig, Density, Index, IndexField, IndexFieldOrder, IndexOperation, IndexState, IndexesConfig, IndexesConfigEntry, QueryScope, VectorConfig, } from '../indexes/types.js';
+export { WriteFirestoreRulesHandler } from '../write/handler.js';
+export type { WriteFirestoreRulesResult } from '../write/spec.js';
+export { InspectFirestoreRulesHandler } from '../inspect/handler.js';
+export type { InspectFirestoreRulesResult, RulesSummary } from '../inspect/spec.js';
+export { createFirestoreInspectTool } from '../inspect/tools.js';
+export type { FirestoreInspectToolDeps } from '../inspect/tools.js';
+export { assembleGameRules, type GameConfig, } from '../generators/assembler.js';
+export { generateWinLines, defaultCellName, indexToColRow, emptyBoard, type GridConfig, } from '../generators/grid.js';
+export * from '../generators/expressions.js';
+export { parseExpression as parseRtdbExpression } from '../rtdb/grammar/RtdbExprParser.js';
+export type { ParsedExpression as ParsedRtdbExpression } from '../rtdb/types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/internal/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/internal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,kBAAkB,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,YAAY,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,YAAY,EACV,cAAc,EACd,UAAU,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,YAAY,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,YAAY,GACb,MAAM,qBAAqB,CAAC;AAM7B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG5E,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACtF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAG1D,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AAGlE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,YAAY,EACV,eAAe,EACf,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,wBAAwB,EACxB,YAAY,EACZ,qBAAqB,EACrB,SAAS,EACT,yBAAyB,EACzB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAQ1C,YAAY,EACV,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAOrB,OAAO,EACL,cAAc,EACd,eAAe,EACf,aAAa,EACb,UAAU,GACX,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,UAAU,GACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAOrE,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAWtF,YAAY,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,MAAM,IAAI,WAAW,EACrB,KAAK,IAAI,UAAU,EACnB,QAAQ,IAAI,aAAa,EACzB,aAAa,EACb,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,QAAQ,EACR,WAAW,EACX,OAAO,EACP,KAAK,EACL,UAAU,EACV,eAAe,EACf,cAAc,EACd,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,YAAY,GACb,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAOlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,2BAA2B,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,YAAY,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAKpE,OAAO,EACL,iBAAiB,EACjB,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,UAAU,EACV,KAAK,UAAU,GAChB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAW7C,OAAO,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,YAAY,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/rules/internal/index.js

@@ -0,0 +1,103 @@
+/**
+ * `pyric/rules/internal` — the low-level rules engine seam.
+ *
+ * NOT part of the public `pyric/rules` contract. The public front door
+ * (`firestoreRules`, `rtdbRules`, `lint`, the assertion adapters, the
+ * value helpers, and the RTDB constraints DSL) lives in `../index.ts`
+ * and is a thin layer over the primitives re-exported here.
+ *
+ * This seam exists so the package's own deep consumers (the sandbox
+ * simulator, the test suites) and the sibling tooling packages
+ * (`@pyric/cli`) can reach the engine primitives — parser, linter,
+ * simulator handler, resolver, wrappers, RTDB machinery — without those
+ * primitives leaking onto the curated public surface. Mirrors the
+ * established `pyric/sandbox/internal` / `pyric/storage/internal` pattern.
+ *
+ * Browser-safe: no `node:` builtins, no TypeScript compiler. Node-only
+ * additions (the fs module resolver, agent-tool factories) live on
+ * `./node`; the composite-index extractor (TS compiler) is isolated on
+ * `./extract`.
+ *
+ * Surface:
+ *   - Parser + AST (parser/AST/validator/assembler)
+ *   - Linter (`lintFirestoreRules` + warning/metrics types)
+ *   - 2+modules resolver (`resolveModules`) + stdlib
+ *   - Rules simulator (`SimulateFirestoreRulesHandler` + value
+ *     wrappers — `Timestamp`, `Path`, etc.)
+ *   - Rules Test API client (`TestFirestoreRulesHandler`, takes
+ *     `ProjectScope` per F3)
+ *   - Sentinel expression engine (used by sandbox for $expr
+ *     resolution in declarative transactions)
+ */
+// ─── Parser + AST ────────────────────────────────────────────────────
+export { parseToAST, parseToASTOrError, parseFunctions, } from '../grammar/FirestoreParser.js';
+export { assembleRules, assembleExpression as printExpression } from '../grammar/FirestoreAssembler.js';
+export { validateFirestoreRules } from '../grammar/FirestoreValidator.js';
+// ─── Linter ──────────────────────────────────────────────────────────
+export { lintFirestoreRules } from '../linter/linter.js';
+// ─── Rules simulator ─────────────────────────────────────────────────
+export { SimulateFirestoreRulesHandler, SERVER_TIMESTAMP } from '../simulator/handler.js';
+export { evaluate, UnsupportedError, TraceRecorder } from '../simulator/evaluator.js';
+export { projectAfterState } from '../simulator/project-after-state.js';
+export { MapDiff, FirestoreSet } from '../simulator/mapdiff.js';
+// ─── Expression DSL primitives (used by sdk's transaction probe + tests)
+export { tokenize } from '../simulator/expression/lexer.js';
+export { parse } from '../simulator/expression/parser.js';
+// ─── Value wrappers ──────────────────────────────────────────────────
+export { Timestamp } from '../simulator/wrappers/timestamp.js';
+export { Path } from '../simulator/wrappers/path.js';
+export { Reference, referenceToResourceName } from '../simulator/wrappers/reference.js';
+export { Vector } from '../simulator/wrappers/vector.js';
+export { Bytes } from '../simulator/wrappers/bytes.js';
+export { Duration } from '../simulator/wrappers/duration.js';
+export { LatLng } from '../simulator/wrappers/latlng.js';
+export { RulesValue, NO_OP } from '../simulator/wrappers/base.js';
+// ─── Rules Test API client ───────────────────────────────────────────
+export { TestFirestoreRulesHandler } from '../test/handler.js';
+export { FIRESTORE_METHODS, TestCaseSchema, TestIdentitySchema, renderLegacyDebugMessages, projectEvaluatedRule, } from '../test/spec.js';
+// ─── Sentinel expression engine ──────────────────────────────────────
+export { resolveExpressionsInData, ExpressionWalkError } from '../simulator/expression/walk-data.js';
+export { EvalError } from '../simulator/expression/eval-errors.js';
+export { ExpressionLexError, ExpressionParseError, } from '../simulator/expression/types.js';
+// ─── Stdlib reference (browser-safe — pure data) ─────────────────────
+// Module-organized reference an agent can call before writing rules.
+// Exposed via the `firestore_rules_stdlib_list` + `_get` tools in
+// `createFirestoreRulesStdlibTools()`; also importable directly for
+// non-agent consumers (docs generators, lint integrations).
+export { STDLIB_MODULES, findModuleByKey, allModuleKeys, suggestKey, } from '../stdlib-modules.js';
+export { createFirestoreRulesStdlibTools } from '../stdlib-tools.js';
+// Browser-safe `2+modules` resolver — pre-supplies the inlined stdlib
+// content so it works without `node:fs`. Node consumers should keep
+// importing `resolveModules` from `pyric/rules/node`,
+// which falls back to disk reads for stdlib modules and picks up
+// `.rules` edits between builds without re-running the inliner.
+export { resolveModulesBrowser, STDLIB_INLINE } from '../modules/resolver-browser.js';
+// ─── Rules deploy (write) — Firebase Rules API client ─────────────────
+// Takes ProjectScope (per F3). Pairs with `firestore_test_rules`
+// (also takes ProjectScope) and `lintFirestoreRules` / `validateFirestoreRules`
+// in the same package — full rules lifecycle on one surface.
+export { WriteFirestoreRulesHandler } from '../write/handler.js';
+// ─── Rules inspect (read) — Firebase Rules API client ─────────────────
+// Fetches + parses the deployed Firestore ruleset (list + get latest),
+// returns AST + summary + validator findings. Takes ProjectScope (per
+// F3). Browser-safe — REST + Bearer token only, no firebase-admin.
+// Pairs with WriteFirestoreRulesHandler on the write side.
+export { InspectFirestoreRulesHandler } from '../inspect/handler.js';
+export { createFirestoreInspectTool } from '../inspect/tools.js';
+// ─── Game-rules generators — declarative rules assembly ───────────────
+// Used by playground game scaffolding to emit Firestore rules for grid
+// games (TTT, C4, Gomoku) without hand-writing the boilerplate.
+export { assembleGameRules, } from '../generators/assembler.js';
+export { generateWinLines, defaultCellName, indexToColRow, emptyBoard, } from '../generators/grid.js';
+export * from '../generators/expressions.js';
+// ─── RTDB rules engine ───────────────────────────────────────────────
+// The Realtime Database rules compiler and simulator live on the sibling
+// `./rtdb` entry, NOT here. This browser-safe seam excludes the engine. The public
+// front door re-exports the (browser-safe) RTDB constraints DSL directly
+// from `../rtdb/constraints`; node consumers that need the engine
+// import from `pyric/rules/internal/rtdb`.
+//
+// The expression parser is the exception because the browser assurance runtime
+// needs to classify individual expressions without importing the full engine.
+export { parseExpression as parseRtdbExpression } from '../rtdb/grammar/RtdbExprParser.js';
+//# sourceMappingURL=index.js.map

package/dist/rules/internal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/internal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,wEAAwE;AACxE,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,GACf,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,kBAAkB,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAY1E,wEAAwE;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAczD,wEAAwE;AACxE,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEhE,0EAA0E;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAE1D,wEAAwE;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AAElE,wEAAwE;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAgB/D,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAGzB,wEAAwE;AACxE,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAa1C,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAClE,oEAAoE;AACpE,4DAA4D;AAC5D,OAAO,EACL,cAAc,EACd,eAAe,EACf,aAAa,EACb,UAAU,GACX,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAErE,sEAAsE;AACtE,oEAAoE;AACpE,sDAAsD;AACtD,iEAAiE;AACjE,gEAAgE;AAChE,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAuCtF,yEAAyE;AACzE,iEAAiE;AACjE,gFAAgF;AAChF,6DAA6D;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGjE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAGjE,yEAAyE;AACzE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,UAAU,GAEX,MAAM,uBAAuB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAE7C,wEAAwE;AACxE,yEAAyE;AACzE,mFAAmF;AACnF,yEAAyE;AACzE,kEAAkE;AAClE,2CAA2C;AAC3C,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,OAAO,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/rules/internal/node.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Node-only entry point.
+ *
+ * Anything that imports `node:fs` / `node:path` / `node:url` at
+ * module-init lives here, so the browser-facing root entry stays
+ * free of Node builtins. Consumers running in Node (admin tools,
+ * SDK agent definitions, tests) import from `pyric/rules/node`.
+ *
+ * Today the only Node-only surface is the modules resolver — it
+ * reads stdlib files off disk via `readFileSync`.
+ */
+export { resolveModules, sanitizeModuleName, loadModule, prefixPrivateFunctions, rewriteCalls, } from '../modules/resolver.js';
+export type { ResolveResult, ResolveOptions } from '../modules/resolver.js';
+export { createFirestoreRulesTools, createFirestoreSimulatorTools, } from '../tools.js';
+export type { FirestoreRulesToolDeps, FirestoreSimulatorToolDeps, } from '../tools.js';
+export { createFirestoreRulesStdlibTools } from '../stdlib-tools.js';
+export { writeRtdbRulesFile } from '../rtdb/constraints/write-rules-file.js';
+//# sourceMappingURL=node.d.ts.map

package/dist/rules/internal/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../../src/rules/internal/node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,sBAAsB,EACtB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAK5E,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAKrB,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAOrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/rules/internal/node.js

@@ -0,0 +1,27 @@
+/**
+ * Node-only entry point.
+ *
+ * Anything that imports `node:fs` / `node:path` / `node:url` at
+ * module-init lives here, so the browser-facing root entry stays
+ * free of Node builtins. Consumers running in Node (admin tools,
+ * SDK agent definitions, tests) import from `pyric/rules/node`.
+ *
+ * Today the only Node-only surface is the modules resolver — it
+ * reads stdlib files off disk via `readFileSync`.
+ */
+export { resolveModules, sanitizeModuleName, loadModule, prefixPrivateFunctions, rewriteCalls, } from '../modules/resolver.js';
+// Tool factories — `createFirestoreRulesTools` wraps resolver +
+// linter + simulator + test handlers into agent-runtime tools.
+// Lives on /node because the resolver dep is Node-only.
+export { createFirestoreRulesTools, createFirestoreSimulatorTools, } from '../tools.js';
+// Stdlib discovery tools — `firestore_rules_stdlib_list` +
+// `firestore_rules_stdlib_get`. Live on /node because the stdlib
+// modules ship as files the resolver loads from disk.
+export { createFirestoreRulesStdlibTools } from '../stdlib-tools.js';
+// RTDB rules generation — `writeRtdbRulesFile` writes a compiled
+// `defineRtdbRules(...).toJSON()` result to a static
+// `database.rules.json` file. Lives on /node because it touches disk;
+// the compilation itself stays in the isomorphic `pyric/rules/rtdb`
+// entry (serializeRtdbRules via RtdbRulesDocument#toJSON).
+export { writeRtdbRulesFile } from '../rtdb/constraints/write-rules-file.js';
+//# sourceMappingURL=node.js.map

package/dist/rules/internal/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../../src/rules/internal/node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,sBAAsB,EACtB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAGhC,gEAAgE;AAChE,+DAA+D;AAC/D,wDAAwD;AACxD,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AAMrB,2DAA2D;AAC3D,iEAAiE;AACjE,sDAAsD;AACtD,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAErE,iEAAiE;AACjE,qDAAqD;AACrD,sEAAsE;AACtE,oEAAoE;AACpE,2DAA2D;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/rules/internal/rtdb.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Internal RTDB rules-engine seam.
+ *
+ * `pyric/database` is reserved for the Firebase-shaped sandbox mirror. This
+ * unstable internal subpath exposes the pure rules parser, simulator,
+ * replay engine, and constraints DSL used by pyric's tooling packages.
+ */
+export { replay } from '../../database/replay.js';
+export type { RtdbReplayDivergence, RtdbReplayOptions, RtdbReplayResult, } from '../../database/replay.js';
+export { buildRuleExpression, compileRtdbRules, serializeRtdbRules, simulateRtdbRules, } from '../rtdb/compiled-rules.js';
+export type { CompiledRtdbRules } from '../rtdb/compiled-rules.js';
+export { parseExpression } from '../rtdb/grammar/RtdbExprParser.js';
+export { validateExpression } from '../rtdb/grammar/validator.js';
+export { lintExpression } from '../rtdb/grammar/linter.js';
+export { SimulationInputSchema, SimulateErrorCode, SimulationResultSchema, } from '../rtdb/simulation/spec.js';
+export type { SimulationInput, SimulationResult, SimulateResult, } from '../rtdb/simulation/spec.js';
+export type { ParsedExpression, ParsedExpression as RtdbExpressionParseResult, RtdbNode, RtdbRuleExpression, RuleError, RuleLint, } from '../rtdb/types.js';
+export { expr, all, any, not, deny, always, allow, authenticated, ownPath, ownField, isNew, hasChildren, hasChild, fieldIsString, fieldIsNumber, fieldIsBoolean, fieldEnum, immutable, immutableSelf, rootExists, rootEquals, pathOwnerOnly, fieldOwnerOnly, ownerOrNew, hasRole, isMember, required, transition, dataVal, newDataVal, dataExists, newDataExists, newDataIs, dataParentVal, newDataParentVal, newDataParentExists, eq, neq, gt, lte, AUTH_UID, turnGuard, flip, winCheckHelper, schemaRules, ruleset, defineRtdbRules, } from '../rtdb/constraints/index.js';
+export type { Expr, PathDef, RtdbRulesCheckResult, RtdbRulesDefinition, RtdbRulesDocumentInternal as RtdbRulesDocument, RtdbRulesFinding, RtdbRulesFindingRule, RtdbRulesJson, RtdbRulesSimulationAuth, RtdbRulesSimulationInput, RulesetContext, SchemaRulesResult, Segment, } from '../rtdb/constraints/index.js';
+//# sourceMappingURL=rtdb.d.ts.map

package/dist/rules/internal/rtdb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rtdb.d.ts","sourceRoot":"","sources":["../../../src/rules/internal/rtdb.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,gBAAgB,EAChB,gBAAgB,IAAI,yBAAyB,EAC7C,QAAQ,EACR,kBAAkB,EAClB,SAAS,EACT,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,IAAI,EACJ,GAAG,EACH,GAAG,EACH,GAAG,EACH,IAAI,EACJ,MAAM,EACN,KAAK,EACL,aAAa,EACb,OAAO,EACP,QAAQ,EACR,KAAK,EACL,WAAW,EACX,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,SAAS,EACT,SAAS,EACT,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,aAAa,EACb,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,EAAE,EACF,GAAG,EACH,EAAE,EACF,GAAG,EACH,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,IAAI,EACJ,OAAO,EACP,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,IAAI,iBAAiB,EAC9C,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,EACd,iBAAiB,EACjB,OAAO,GACR,MAAM,8BAA8B,CAAC"}