pyric 0.0.1 → 0.1.0-alpha.10

package/dist/rules/rtdb/compiled-rules.js

@@ -0,0 +1,95 @@
+import { parseExpression } from './grammar/RtdbExprParser.js';
+import { lintExpression } from './grammar/linter.js';
+import { validateExpression } from './grammar/validator.js';
+import { SimulateHandler } from './simulation/handler.js';
+const SYSTEM_KEYS = new Set(['.read', '.write', '.validate', '.indexOn']);
+export function buildRuleExpression(raw, context, pathVariables = []) {
+    const parsed = parseExpression(raw);
+    const errors = parsed.valid ? validateExpression(raw, context, pathVariables) : parsed.errors;
+    const warnings = parsed.valid ? lintExpression(raw, context) : [];
+    return {
+        raw,
+        parsed: {
+            ...parsed,
+            errors,
+            warnings,
+        },
+    };
+}
+function compileNode(rulesObj, path, pathVariables) {
+    const node = {
+        path,
+        pathVariables: [...pathVariables],
+        children: [],
+    };
+    for (const [key, context] of [
+        ['.read', 'read'],
+        ['.write', 'write'],
+        ['.validate', 'validate'],
+    ]) {
+        const value = rulesObj[key];
+        if (value !== undefined) {
+            node[context] = buildRuleExpression(String(value), context, pathVariables);
+        }
+    }
+    const indexOn = rulesObj['.indexOn'];
+    if (indexOn !== undefined) {
+        node.indexOn = Array.isArray(indexOn) ? indexOn.map(String) : [String(indexOn)];
+    }
+    for (const [key, child] of Object.entries(rulesObj)) {
+        if (SYSTEM_KEYS.has(key) || typeof child !== 'object' || child === null)
+            continue;
+        const childPath = path === '/' ? `/${key}` : `${path}/${key}`;
+        const childPathVariables = key.startsWith('$')
+            ? [...pathVariables, key]
+            : [...pathVariables];
+        node.children.push(compileNode(child, childPath, childPathVariables));
+    }
+    return node;
+}
+export function compileRtdbRules(rulesJson) {
+    if (!rulesJson || typeof rulesJson !== 'object') {
+        throw new Error('Invalid rules JSON: expected an object');
+    }
+    const document = rulesJson;
+    if (!('rules' in document)) {
+        throw new Error('Invalid rules JSON: missing top-level "rules" key');
+    }
+    if (typeof document.rules !== 'object' || document.rules === null) {
+        throw new Error('Invalid rules JSON: "rules" must be an object');
+    }
+    return compileNode(document.rules, '/', []);
+}
+function rawToRuleValue(raw) {
+    if (raw === 'true')
+        return true;
+    if (raw === 'false')
+        return false;
+    return raw;
+}
+function serializeNode(node) {
+    const result = {};
+    if (node.read)
+        result['.read'] = rawToRuleValue(node.read.raw);
+    if (node.write)
+        result['.write'] = rawToRuleValue(node.write.raw);
+    if (node.validate)
+        result['.validate'] = rawToRuleValue(node.validate.raw);
+    if (node.indexOn)
+        result['.indexOn'] = node.indexOn;
+    for (const child of node.children) {
+        const segments = child.path.split('/').filter(Boolean);
+        result[segments[segments.length - 1]] = serializeNode(child);
+    }
+    return result;
+}
+export function serializeRtdbRules(compiled) {
+    if (!compiled || typeof compiled !== 'object' || !('path' in compiled)) {
+        throw new Error("Invalid compiled rules: expected a rules node with a 'path' property");
+    }
+    return { rules: serializeNode(compiled) };
+}
+export function simulateRtdbRules(compiled, input) {
+    return new SimulateHandler().execute(compiled, input);
+}
+//# sourceMappingURL=compiled-rules.js.map

package/dist/rules/rtdb/compiled-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiled-rules.js","sourceRoot":"","sources":["../../../src/rules/rtdb/compiled-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI1D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAK1E,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,OAAsC,EACtC,gBAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,GAAG,MAAM;YACT,MAAM;YACN,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,QAAiC,EACjC,IAAY,EACZ,aAAuB;IAEvB,MAAM,IAAI,GAAa;QACrB,IAAI;QACJ,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC;QACjC,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI;QAC3B,CAAC,OAAO,EAAE,MAAM,CAAC;QACjB,CAAC,QAAQ,EAAE,OAAO,CAAC;QACnB,CAAC,WAAW,EAAE,UAAU,CAAC;KACjB,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAClF,MAAM,SAAS,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QAC9D,MAAM,kBAAkB,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC;YACzB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChB,WAAW,CAAC,KAAgC,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAC7E,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAkB;IACjD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,SAAoC,CAAC;IACtD,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAgC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,WAAW,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IAEpD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA2B;IAE3B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAA2B,EAC3B,KAAsB;IAEtB,OAAO,IAAI,eAAe,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC"}

package/dist/rules/rtdb/constraints/atoms.d.ts

@@ -0,0 +1,29 @@
+import type { Expr, Segment } from './types.js';
+export declare const authenticated: () => Expr;
+/** Path-based ownership: auth.uid matches a URL path variable */
+export declare const ownPath: (pathVar: string) => Expr;
+/** Field-based ownership: auth.uid matches a value stored in a data field */
+export declare const ownField: (field: string) => Expr;
+/** Data at this path doesn't exist yet (creation check) */
+export declare const isNew: () => Expr;
+/** Incoming data must be an object with at least one child */
+export declare const hasChildren: () => Expr;
+/** Incoming data must have a specific child field */
+export declare const hasChild: (field: string) => Expr;
+/** Field must be a string */
+export declare const fieldIsString: (field: string) => Expr;
+/** Field must be a number */
+export declare const fieldIsNumber: (field: string) => Expr;
+/** Field must be a boolean */
+export declare const fieldIsBoolean: (field: string) => Expr;
+/** Field must be one of the allowed string values */
+export declare const fieldEnum: (field: string, values: string[]) => Expr;
+/** Field can be set on creation but never changed after */
+export declare const immutable: (field: string) => Expr;
+/** This node's own value can be set on creation but never changed */
+export declare const immutableSelf: () => Expr;
+/** Check if a path exists in the database (via root) */
+export declare const rootExists: (segments: Segment[]) => Expr;
+/** Check if a path's value equals a specific string (via root) */
+export declare const rootEquals: (segments: Segment[], value: string) => Expr;
+//# sourceMappingURL=atoms.d.ts.map

package/dist/rules/rtdb/constraints/atoms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atoms.d.ts","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/atoms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAchD,eAAO,MAAM,aAAa,QAAO,IAA0B,CAAC;AAI5D,iEAAiE;AACjE,eAAO,MAAM,OAAO,GAAI,SAAS,MAAM,KAAG,IAAoC,CAAC;AAE/E,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,KAAG,IAAsD,CAAC;AAIhG,2DAA2D;AAC3D,eAAO,MAAM,KAAK,QAAO,IAA2B,CAAC;AAIrD,8DAA8D;AAC9D,eAAO,MAAM,WAAW,QAAO,IAAkC,CAAC;AAElE,qDAAqD;AACrD,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,KAAG,IAAyC,CAAC;AAEnF,6BAA6B;AAC7B,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,IAAiD,CAAC;AAEhG,6BAA6B;AAC7B,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,IAAiD,CAAC;AAEhG,8BAA8B;AAC9B,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,IAAkD,CAAC;AAElG,qDAAqD;AACrD,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,EAAE,KAAG,IACmB,CAAC;AAIhF,2DAA2D;AAC3D,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,KAAG,IAC+C,CAAC;AAE1F,qEAAqE;AACrE,eAAO,MAAM,aAAa,QAAO,IACoB,CAAC;AAItD,wDAAwD;AACxD,eAAO,MAAM,UAAU,GAAI,UAAU,OAAO,EAAE,KAAG,IACN,CAAC;AAE5C,kEAAkE;AAClE,eAAO,MAAM,UAAU,GAAI,UAAU,OAAO,EAAE,EAAE,OAAO,MAAM,KAAG,IACT,CAAC"}

package/dist/rules/rtdb/constraints/atoms.js

@@ -0,0 +1,43 @@
+const e = (raw) => raw;
+function buildPath(segments) {
+    return segments.map(s => {
+        if (typeof s === 'string')
+            return `child("${s}")`;
+        // Unquoted reference: path variable ($teamId) or runtime (auth.uid)
+        return `child(${s.$})`;
+    }).join('.');
+}
+// --- Authentication ---
+export const authenticated = () => e('auth !== null');
+// --- Ownership ---
+/** Path-based ownership: auth.uid matches a URL path variable */
+export const ownPath = (pathVar) => e(`auth.uid === ${pathVar}`);
+/** Field-based ownership: auth.uid matches a value stored in a data field */
+export const ownField = (field) => e(`auth.uid === data.child("${field}").val()`);
+// --- Existence ---
+/** Data at this path doesn't exist yet (creation check) */
+export const isNew = () => e('!data.exists()');
+// --- Schema ---
+/** Incoming data must be an object with at least one child */
+export const hasChildren = () => e('newData.hasChildren()');
+/** Incoming data must have a specific child field */
+export const hasChild = (field) => e(`newData.hasChild("${field}")`);
+/** Field must be a string */
+export const fieldIsString = (field) => e(`newData.child("${field}").isString()`);
+/** Field must be a number */
+export const fieldIsNumber = (field) => e(`newData.child("${field}").isNumber()`);
+/** Field must be a boolean */
+export const fieldIsBoolean = (field) => e(`newData.child("${field}").isBoolean()`);
+/** Field must be one of the allowed string values */
+export const fieldEnum = (field, values) => e(values.map(v => `newData.child("${field}").val() === "${v}"`).join(' || '));
+// --- Immutability ---
+/** Field can be set on creation but never changed after */
+export const immutable = (field) => e(`!data.exists() || newData.child("${field}").val() === data.child("${field}").val()`);
+/** This node's own value can be set on creation but never changed */
+export const immutableSelf = () => e('!data.exists() || newData.val() === data.val()');
+// --- Cross-path lookups ---
+/** Check if a path exists in the database (via root) */
+export const rootExists = (segments) => e(`root.${buildPath(segments)}.exists()`);
+/** Check if a path's value equals a specific string (via root) */
+export const rootEquals = (segments, value) => e(`root.${buildPath(segments)}.val() === "${value}"`);
+//# sourceMappingURL=atoms.js.map

package/dist/rules/rtdb/constraints/atoms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atoms.js","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/atoms.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,GAAG,CAAC,GAAW,EAAQ,EAAE,CAAC,GAAW,CAAC;AAE7C,SAAS,SAAS,CAAC,QAAmB;IACpC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC;QAClD,oEAAoE;QACpE,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;IACzB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,yBAAyB;AAEzB,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AAE5D,oBAAoB;AAEpB,iEAAiE;AACjE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,CAAC,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;AAE/E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAQ,EAAE,CAAC,CAAC,CAAC,4BAA4B,KAAK,UAAU,CAAC,CAAC;AAEhG,oBAAoB;AAEpB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;AAErD,iBAAiB;AAEjB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,GAAS,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;AAElE,qDAAqD;AACrD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAQ,EAAE,CAAC,CAAC,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAC;AAEnF,6BAA6B;AAC7B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAQ,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,eAAe,CAAC,CAAC;AAEhG,6BAA6B;AAC7B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAQ,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,eAAe,CAAC,CAAC;AAEhG,8BAA8B;AAC9B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAQ,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,CAAC;AAElG,qDAAqD;AACrD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,MAAgB,EAAQ,EAAE,CACjE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,KAAK,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAEhF,uBAAuB;AAEvB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAQ,EAAE,CAC/C,CAAC,CAAC,oCAAoC,KAAK,4BAA4B,KAAK,UAAU,CAAC,CAAC;AAE1F,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE,CACtC,CAAC,CAAC,gDAAgD,CAAC,CAAC;AAEtD,6BAA6B;AAE7B,wDAAwD;AACxD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAmB,EAAQ,EAAE,CACtD,CAAC,CAAC,QAAQ,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE5C,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAmB,EAAE,KAAa,EAAQ,EAAE,CACrE,CAAC,CAAC,QAAQ,SAAS,CAAC,QAAQ,CAAC,eAAe,KAAK,GAAG,CAAC,CAAC"}

package/dist/rules/rtdb/constraints/compose.d.ts

@@ -0,0 +1,16 @@
+import type { Expr } from './types.js';
+/** Create an Expr from a raw expression string. */
+export declare const expr: (raw: string) => Expr;
+/** All conditions must be true (AND). */
+export declare const all: (...exprs: Expr[]) => Expr;
+/** At least one condition must be true (OR). */
+export declare const any: (...exprs: Expr[]) => Expr;
+/** Negate a condition. */
+export declare const not: (e: Expr) => Expr;
+/** Always deny (false). */
+export declare const deny: () => Expr;
+/** Always allow (true). */
+export declare const always: () => Expr;
+/** Always allow (true). Readable alias for always(). */
+export declare const allow: () => Expr;
+//# sourceMappingURL=compose.d.ts.map

package/dist/rules/rtdb/constraints/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/compose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,mDAAmD;AACnD,eAAO,MAAM,IAAI,GAAI,KAAK,MAAM,KAAG,IAAmB,CAAC;AAEvD,yCAAyC;AACzC,eAAO,MAAM,GAAG,GAAI,GAAG,OAAO,IAAI,EAAE,KAAG,IACM,CAAC;AAE9C,gDAAgD;AAChD,eAAO,MAAM,GAAG,GAAI,GAAG,OAAO,IAAI,EAAE,KAAG,IACM,CAAC;AAE9C,0BAA0B;AAC1B,eAAO,MAAM,GAAG,GAAI,GAAG,IAAI,KAAG,IAAuB,CAAC;AAEtD,2BAA2B;AAC3B,eAAO,MAAM,IAAI,QAAO,IAAqB,CAAC;AAE9C,2BAA2B;AAC3B,eAAO,MAAM,MAAM,QAAO,IAAoB,CAAC;AAE/C,wDAAwD;AACxD,eAAO,MAAM,KAAK,QAHQ,IAGC,CAAC"}

package/dist/rules/rtdb/constraints/compose.js

@@ -0,0 +1,15 @@
+/** Create an Expr from a raw expression string. */
+export const expr = (raw) => raw;
+/** All conditions must be true (AND). */
+export const all = (...exprs) => expr(exprs.map(e => `(${e})`).join(' && '));
+/** At least one condition must be true (OR). */
+export const any = (...exprs) => expr(exprs.map(e => `(${e})`).join(' || '));
+/** Negate a condition. */
+export const not = (e) => expr(`!(${e})`);
+/** Always deny (false). */
+export const deny = () => expr('false');
+/** Always allow (true). */
+export const always = () => expr('true');
+/** Always allow (true). Readable alias for always(). */
+export const allow = always;
+//# sourceMappingURL=compose.js.map

package/dist/rules/rtdb/constraints/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/compose.ts"],"names":[],"mappings":"AAEA,mDAAmD;AACnD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE,CAAC,GAAW,CAAC;AAEvD,yCAAyC;AACzC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,KAAa,EAAQ,EAAE,CAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9C,gDAAgD;AAChD,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,KAAa,EAAQ,EAAE,CAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9C,0BAA0B;AAC1B,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAO,EAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAEtD,2BAA2B;AAC3B,MAAM,CAAC,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAE9C,2BAA2B;AAC3B,MAAM,CAAC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAE/C,wDAAwD;AACxD,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC"}

package/dist/rules/rtdb/constraints/data.d.ts

@@ -0,0 +1,30 @@
+import type { Expr, Segment } from './types.js';
+type CompareValue = string | number | boolean | null | Segment;
+/** Read data value at current node or a child path (pre-write state) */
+export declare const dataVal: (path?: string) => Expr;
+/** Read incoming data value at current node or a child path (post-write state) */
+export declare const newDataVal: (path?: string) => Expr;
+/** Check if data exists at current node or a child path */
+export declare const dataExists: (path?: string) => Expr;
+/** Check if incoming data exists at current node or a child path */
+export declare const newDataExists: (path?: string) => Expr;
+/** Check incoming data type at current node */
+export declare const newDataIs: (type: "String" | "Number" | "Boolean") => Expr;
+/** Navigate up from data snapshot, then read a child field's value */
+export declare const dataParentVal: (depth: number, field: string) => Expr;
+/** Navigate up from newData snapshot, then read a child field's value */
+export declare const newDataParentVal: (depth: number, field: string) => Expr;
+/** Navigate up from newData snapshot, then check if a child field exists */
+export declare const newDataParentExists: (depth: number, field: string) => Expr;
+/** Strict equality: left === right (right is a literal value or runtime ref) */
+export declare const eq: (left: Expr, right: CompareValue) => Expr;
+/** Strict inequality: left !== right */
+export declare const neq: (left: Expr, right: CompareValue) => Expr;
+/** Greater than: left > right */
+export declare const gt: (left: Expr, right: number) => Expr;
+/** Less than or equal: left <= right */
+export declare const lte: (left: Expr, right: number) => Expr;
+/** auth.uid as a comparison value (unquoted in expressions) */
+export declare const AUTH_UID: Segment;
+export {};
+//# sourceMappingURL=data.d.ts.map

package/dist/rules/rtdb/constraints/data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAIhD,KAAK,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC;AAW/D,wEAAwE;AACxE,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,KAAG,IACmB,CAAC;AAE5D,kFAAkF;AAClF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,KAAG,IACsB,CAAC;AAIlE,2DAA2D;AAC3D,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,KAAG,IACsB,CAAC;AAElE,oEAAoE;AACpE,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,IACyB,CAAC;AAIxE,+CAA+C;AAC/C,eAAO,MAAM,SAAS,GAAI,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,KAAG,IACxC,CAAC;AAQ3B,sEAAsE;AACtE,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,IACD,CAAC;AAE7D,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,IACD,CAAC;AAEhE,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,IACD,CAAC;AAInE,gFAAgF;AAChF,eAAO,MAAM,EAAE,GAAI,MAAM,IAAI,EAAE,OAAO,YAAY,KAAG,IACb,CAAC;AAEzC,wCAAwC;AACxC,eAAO,MAAM,GAAG,GAAI,MAAM,IAAI,EAAE,OAAO,YAAY,KAAG,IACd,CAAC;AAEzC,iCAAiC;AACjC,eAAO,MAAM,EAAE,GAAI,MAAM,IAAI,EAAE,OAAO,MAAM,KAAG,IACtB,CAAC;AAE1B,wCAAwC;AACxC,eAAO,MAAM,GAAG,GAAI,MAAM,IAAI,EAAE,OAAO,MAAM,KAAG,IACtB,CAAC;AAI3B,+DAA+D;AAC/D,eAAO,MAAM,QAAQ,EAAE,OAA2B,CAAC"}

package/dist/rules/rtdb/constraints/data.js

@@ -0,0 +1,46 @@
+const e = (raw) => raw;
+function formatRight(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'object' && '$' in value)
+        return value.$;
+    if (typeof value === 'string')
+        return `"${value}"`;
+    return String(value);
+}
+// ---- Value access ----
+/** Read data value at current node or a child path (pre-write state) */
+export const dataVal = (path) => path ? e(`data.child("${path}").val()`) : e('data.val()');
+/** Read incoming data value at current node or a child path (post-write state) */
+export const newDataVal = (path) => path ? e(`newData.child("${path}").val()`) : e('newData.val()');
+// ---- Existence ----
+/** Check if data exists at current node or a child path */
+export const dataExists = (path) => path ? e(`data.child("${path}").exists()`) : e('data.exists()');
+/** Check if incoming data exists at current node or a child path */
+export const newDataExists = (path) => path ? e(`newData.child("${path}").exists()`) : e('newData.exists()');
+// ---- Type checks ----
+/** Check incoming data type at current node */
+export const newDataIs = (type) => e(`newData.is${type}()`);
+// ---- Parent navigation ----
+function parentChain(base, depth) {
+    return base + '.parent()'.repeat(depth);
+}
+/** Navigate up from data snapshot, then read a child field's value */
+export const dataParentVal = (depth, field) => e(`${parentChain('data', depth)}.child("${field}").val()`);
+/** Navigate up from newData snapshot, then read a child field's value */
+export const newDataParentVal = (depth, field) => e(`${parentChain('newData', depth)}.child("${field}").val()`);
+/** Navigate up from newData snapshot, then check if a child field exists */
+export const newDataParentExists = (depth, field) => e(`${parentChain('newData', depth)}.child("${field}").exists()`);
+// ---- Comparisons ----
+/** Strict equality: left === right (right is a literal value or runtime ref) */
+export const eq = (left, right) => e(`${left} === ${formatRight(right)}`);
+/** Strict inequality: left !== right */
+export const neq = (left, right) => e(`${left} !== ${formatRight(right)}`);
+/** Greater than: left > right */
+export const gt = (left, right) => e(`${left} > ${right}`);
+/** Less than or equal: left <= right */
+export const lte = (left, right) => e(`${left} <= ${right}`);
+// ---- Constants ----
+/** auth.uid as a comparison value (unquoted in expressions) */
+export const AUTH_UID = { $: 'auth.uid' };
+//# sourceMappingURL=data.js.map

package/dist/rules/rtdb/constraints/data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.js","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/data.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,GAAG,CAAC,GAAW,EAAQ,EAAE,CAAC,GAAW,CAAC;AAI7C,SAAS,WAAW,CAAC,KAAmB;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,KAAK,GAAG,CAAC;IACnD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,yBAAyB;AAEzB,wEAAwE;AACxE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAa,EAAQ,EAAE,CAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AAE5D,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAa,EAAQ,EAAE,CAChD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AAElE,sBAAsB;AAEtB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAa,EAAQ,EAAE,CAChD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AAElE,oEAAoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAa,EAAQ,EAAE,CACnD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAExE,wBAAwB;AAExB,+CAA+C;AAC/C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAqC,EAAQ,EAAE,CACvE,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;AAE3B,8BAA8B;AAE9B,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,OAAO,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,KAAa,EAAQ,EAAE,CAClE,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;AAE7D,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,KAAa,EAAQ,EAAE,CACrE,CAAC,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAE,KAAa,EAAQ,EAAE,CACxE,CAAC,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC;AAEnE,wBAAwB;AAExB,gFAAgF;AAChF,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAU,EAAE,KAAmB,EAAQ,EAAE,CAC1D,CAAC,CAAC,GAAG,IAAI,QAAQ,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEzC,wCAAwC;AACxC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,KAAmB,EAAQ,EAAE,CAC3D,CAAC,CAAC,GAAG,IAAI,QAAQ,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEzC,iCAAiC;AACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAU,EAAE,KAAa,EAAQ,EAAE,CACpD,CAAC,CAAC,GAAG,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC;AAE1B,wCAAwC;AACxC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,KAAa,EAAQ,EAAE,CACrD,CAAC,CAAC,GAAG,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC;AAE3B,sBAAsB;AAEtB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,QAAQ,GAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC"}

package/dist/rules/rtdb/constraints/document.d.ts

@@ -0,0 +1,57 @@
+import { type CompiledRtdbRules } from '../compiled-rules.js';
+import type { SimulationInput, SimulateResult } from '../simulation/spec.js';
+import type { PathDef, RulesetContext } from './types.js';
+export interface RtdbRulesDefinition {
+    paths: Record<string, PathDef> | ((ctx: RulesetContext) => void);
+}
+export type RtdbRulesJson = {
+    rules: Record<string, unknown>;
+};
+export type RtdbRulesFindingRule = '.read' | '.write' | '.validate' | 'ruleset';
+export interface RtdbRulesFinding {
+    path: string;
+    rule: RtdbRulesFindingRule;
+    code: string;
+    message: string;
+}
+export interface RtdbRulesCheckResult {
+    ok: boolean;
+    errors: RtdbRulesFinding[];
+    warnings: RtdbRulesFinding[];
+}
+export type RtdbRulesSimulationAuth = string | {
+    uid: string;
+    token?: Record<string, unknown>;
+} | null;
+export type RtdbRulesSimulationInput = Omit<SimulationInput, 'auth' | 'mockData'> & {
+    auth?: RtdbRulesSimulationAuth;
+    data?: Record<string, unknown>;
+    mockData?: Record<string, unknown>;
+};
+declare const RTDB_RULES_DOCUMENT_BRAND: unique symbol;
+/**
+ * The authored RTDB rules artifact `defineRtdbRules` returns.
+ *
+ * Deliberately INERT on the public surface: it exposes no methods. It is a
+ * value you author and hand to `rtdbRules()`, which is the one analysis
+ * surface (`lint` / `simulate` / `explain` / `toJSON`). The brand is
+ * type-level only; nothing exists at runtime.
+ */
+export interface RtdbRulesDocument {
+    readonly [RTDB_RULES_DOCUMENT_BRAND]?: never;
+}
+/**
+ * The method-bearing document interface — INTERNAL. The runtime object
+ * behind {@link RtdbRulesDocument} implements this; the engine seams
+ * (`pyric/rules/internal/rtdb`) and the `rtdbRules()` implementation call
+ * through it. Not part of the public `pyric/rules` contract.
+ */
+export interface RtdbRulesDocumentInternal extends RtdbRulesDocument {
+    toJSON(): RtdbRulesJson;
+    compile(): CompiledRtdbRules;
+    check(): RtdbRulesCheckResult;
+    simulate(input: RtdbRulesSimulationInput): SimulateResult;
+}
+export declare function defineRtdbRules(definition: RtdbRulesDefinition): RtdbRulesDocument;
+export {};
+//# sourceMappingURL=document.d.ts.map

package/dist/rules/rtdb/constraints/document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/document.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG7E,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,uBAAuB,GAC/B,MAAM,GACN;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAChD,IAAI,CAAC;AAET,MAAM,MAAM,wBAAwB,GAClC,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;IAC3C,IAAI,CAAC,EAAE,uBAAuB,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEJ,OAAO,CAAC,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,CAAC,yBAAyB,CAAC,CAAC,EAAE,KAAK,CAAC;CAC9C;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,iBAAiB;IAClE,MAAM,IAAI,aAAa,CAAC;IACxB,OAAO,IAAI,iBAAiB,CAAC;IAC7B,KAAK,IAAI,oBAAoB,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,wBAAwB,GAAG,cAAc,CAAC;CAC3D;AAsFD,wBAAgB,eAAe,CAAC,UAAU,EAAE,mBAAmB,GAAG,iBAAiB,CAOlF"}

package/dist/rules/rtdb/constraints/document.js

@@ -0,0 +1,85 @@
+import { serializeRtdbRules, simulateRtdbRules, } from '../compiled-rules.js';
+import { ruleset } from './ruleset.js';
+function normalizeAuth(auth) {
+    if (auth === undefined || auth === null)
+        return null;
+    if (typeof auth === 'string')
+        return { uid: auth, token: {} };
+    return { uid: auth.uid, token: auth.token ?? {} };
+}
+function normalizeSimulationInput(input) {
+    return {
+        operation: input.operation,
+        path: input.path,
+        auth: normalizeAuth(input.auth),
+        mockData: input.mockData ?? input.data ?? {},
+        ...(input.newData !== undefined ? { newData: input.newData } : {}),
+    };
+}
+function collectExpressionFindings(path, rule, expr, kind) {
+    return (expr?.parsed[kind] ?? []).map((finding) => ({
+        path,
+        rule,
+        code: finding.code,
+        message: finding.message,
+    }));
+}
+function collectFindings(node, kind) {
+    const findings = [
+        ...collectExpressionFindings(node.path, '.read', node.read, kind),
+        ...collectExpressionFindings(node.path, '.write', node.write, kind),
+        ...collectExpressionFindings(node.path, '.validate', node.validate, kind),
+    ];
+    for (const child of node.children) {
+        findings.push(...collectFindings(child, kind));
+    }
+    return findings;
+}
+class DefinedRtdbRulesDocument {
+    definition;
+    constructor(definition) {
+        this.definition = definition;
+    }
+    compile() {
+        return ruleset(this.definition.paths);
+    }
+    toJSON() {
+        return serializeRtdbRules(this.compile());
+    }
+    check() {
+        try {
+            const compiled = this.compile();
+            const errors = collectFindings(compiled, 'errors');
+            const warnings = collectFindings(compiled, 'warnings');
+            return {
+                ok: errors.length === 0,
+                errors,
+                warnings,
+            };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                errors: [{
+                        path: '/',
+                        rule: 'ruleset',
+                        code: 'COMPILE_ERROR',
+                        message: e instanceof Error ? e.message : String(e),
+                    }],
+                warnings: [],
+            };
+        }
+    }
+    simulate(input) {
+        return simulateRtdbRules(this.compile(), normalizeSimulationInput(input));
+    }
+}
+export function defineRtdbRules(definition) {
+    // The runtime object carries the full method surface; the declared return
+    // type is the inert public artifact. Route the assignment through the
+    // internal interface (a declared subtype) so the brand-only weak type
+    // accepts it.
+    const doc = new DefinedRtdbRulesDocument(definition);
+    return doc;
+}
+//# sourceMappingURL=document.js.map

package/dist/rules/rtdb/constraints/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/document.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AA+DvC,SAAS,aAAa,CAAC,IAAyC;IAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,wBAAwB,CAAC,KAA+B;IAC/D,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;QAC5C,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAY,EACZ,IAA8C,EAC9C,IAAoC,EACpC,IAA2B;IAE3B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI;QACJ,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,IAAc,EAAE,IAA2B;IAClE,MAAM,QAAQ,GAAuB;QACnC,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QACjE,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QACnE,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC1E,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,wBAAwB;IACC;IAA7B,YAA6B,UAA+B;QAA/B,eAAU,GAAV,UAAU,CAAqB;IAAG,CAAC;IAEhE,OAAO;QACL,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM;QACJ,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACvD,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;gBACvB,MAAM;gBACN,QAAQ;aACT,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,CAAC;wBACP,IAAI,EAAE,GAAG;wBACT,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,eAAe;wBACrB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;qBACpD,CAAC;gBACF,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,KAA+B;QACtC,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,UAA+B;IAC7D,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,cAAc;IACd,MAAM,GAAG,GAA8B,IAAI,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/rules/rtdb/constraints/game.d.ts

@@ -0,0 +1,30 @@
+import type { Expr } from './types.js';
+/**
+ * Turn enforcement: only the current turn's player can write.
+ * Uses data (pre-write) for the turn check — NOT newData.
+ *
+ * @param turnField - the field that stores whose turn it is (e.g., "currentTurn")
+ * @param players - map of mark → player field (e.g., { X: "playerX", O: "playerO" })
+ * @param statusField - optional field that must equal playingValue for moves to be allowed
+ * @param playingValue - the value of statusField during active play (e.g., "playing")
+ */
+export declare function turnGuard(turnField: string, players: Record<string, string>, statusField?: string, playingValue?: string): Expr;
+/**
+ * Turn flip: validates a turn field alternates between marks.
+ * First mark is the initial value on creation.
+ * Supports 2+ players with circular rotation.
+ *
+ * @param marks - ordered list of marks (e.g., ["X", "O"])
+ */
+export declare function flip(marks: string[]): Expr;
+/**
+ * Win check helper: validates a boolean field against winning lines on a board.
+ * If true, at least one winning line must exist. If false, no winning line can exist.
+ * Uses the "client claims, rules verify" pattern.
+ *
+ * @param mark - the player mark to check (e.g., "X")
+ * @param lines - array of winning line coordinates (e.g., [[0,1,2], [3,4,5], ...])
+ * @param boardPath - the path to the board relative to the parent (default "board")
+ */
+export declare function winCheckHelper(mark: string, lines: number[][], boardPath?: string): Expr;
+//# sourceMappingURL=game.d.ts.map

package/dist/rules/rtdb/constraints/game.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"game.d.ts","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/game.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAIvC;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,IAAI,CAUN;AAED;;;;;;GAMG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAO1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EAAE,EAAE,EACjB,SAAS,GAAE,MAAgB,GAC1B,IAAI,CAUN"}

package/dist/rules/rtdb/constraints/game.js

@@ -0,0 +1,49 @@
+import { all, any, not, expr } from './compose.js';
+import { dataVal, newDataVal, newDataParentVal, newDataIs, eq, neq, AUTH_UID } from './data.js';
+/**
+ * Turn enforcement: only the current turn's player can write.
+ * Uses data (pre-write) for the turn check — NOT newData.
+ *
+ * @param turnField - the field that stores whose turn it is (e.g., "currentTurn")
+ * @param players - map of mark → player field (e.g., { X: "playerX", O: "playerO" })
+ * @param statusField - optional field that must equal playingValue for moves to be allowed
+ * @param playingValue - the value of statusField during active play (e.g., "playing")
+ */
+export function turnGuard(turnField, players, statusField, playingValue) {
+    const branches = Object.entries(players).map(([mark, playerField]) => `${eq(dataVal(turnField), mark)} && ${eq(dataVal(playerField), AUTH_UID)}`);
+    const playerCheck = branches.join(' || ');
+    if (statusField && playingValue) {
+        return all(eq(dataVal(statusField), playingValue), playerCheck);
+    }
+    return playerCheck;
+}
+/**
+ * Turn flip: validates a turn field alternates between marks.
+ * First mark is the initial value on creation.
+ * Supports 2+ players with circular rotation.
+ *
+ * @param marks - ordered list of marks (e.g., ["X", "O"])
+ */
+export function flip(marks) {
+    const creation = all(not(expr('data.exists()')), eq(newDataVal(), marks[0]));
+    const transitions = marks.map((mark, i) => {
+        const next = marks[(i + 1) % marks.length];
+        return all(eq(dataVal(), mark), eq(newDataVal(), next));
+    });
+    return any(creation, ...transitions);
+}
+/**
+ * Win check helper: validates a boolean field against winning lines on a board.
+ * If true, at least one winning line must exist. If false, no winning line can exist.
+ * Uses the "client claims, rules verify" pattern.
+ *
+ * @param mark - the player mark to check (e.g., "X")
+ * @param lines - array of winning line coordinates (e.g., [[0,1,2], [3,4,5], ...])
+ * @param boardPath - the path to the board relative to the parent (default "board")
+ */
+export function winCheckHelper(mark, lines, boardPath = 'board') {
+    const lineCheck = (line) => all(...line.map(n => eq(newDataParentVal(1, `${boardPath}/${n}`), mark)));
+    const anyLine = any(...lines.map(lineCheck));
+    return all(newDataIs('Boolean'), any(neq(newDataVal(), true), anyLine), any(neq(newDataVal(), false), not(anyLine)));
+}
+//# sourceMappingURL=game.js.map

package/dist/rules/rtdb/constraints/game.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"game.js","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/game.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEhG;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CACvB,SAAiB,EACjB,OAA+B,EAC/B,WAAoB,EACpB,YAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CACnE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,CAC3E,CAAC;IACF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAS,CAAC;IAElD,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,IAAI,CAAC,KAAe;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,KAAiB,EACjB,YAAoB,OAAO;IAE3B,MAAM,SAAS,GAAG,CAAC,IAAc,EAAE,EAAE,CACnC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,GAAG,SAAS,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAE7C,OAAO,GAAG,CACR,SAAS,CAAC,SAAS,CAAC,EACpB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,EACrC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAC5C,CAAC;AACJ,CAAC"}

package/dist/rules/rtdb/constraints/index.d.ts

@@ -0,0 +1,12 @@
+export type { Expr, Segment, PathDef, RulesetContext } from './types.js';
+export { expr, all, any, not, deny, always, allow } from './compose.js';
+export { authenticated, ownPath, ownField, isNew, hasChildren, hasChild, fieldIsString, fieldIsNumber, fieldIsBoolean, fieldEnum, immutable, immutableSelf, rootExists, rootEquals, } from './atoms.js';
+export { pathOwnerOnly, fieldOwnerOnly, ownerOrNew, hasRole, isMember, required, transition, } from './policies.js';
+export { dataVal, newDataVal, dataExists, newDataExists, newDataIs, dataParentVal, newDataParentVal, newDataParentExists, eq, neq, gt, lte, AUTH_UID, } from './data.js';
+export { turnGuard, flip, winCheckHelper } from './game.js';
+export { schemaRules } from './schema.js';
+export type { SchemaRulesResult } from './schema.js';
+export { ruleset } from './ruleset.js';
+export { defineRtdbRules } from './document.js';
+export type { RtdbRulesCheckResult, RtdbRulesDefinition, RtdbRulesDocument, RtdbRulesDocumentInternal, RtdbRulesFinding, RtdbRulesFindingRule, RtdbRulesJson, RtdbRulesSimulationAuth, RtdbRulesSimulationInput, } from './document.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/rtdb/constraints/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EACL,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EACvC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAC9E,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,GACjD,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,aAAa,EAAE,cAAc,EAAE,UAAU,EACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,GACxC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAC9C,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAC/D,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,GAC3B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,eAAe,CAAC"}

package/dist/rules/rtdb/constraints/index.js

@@ -0,0 +1,9 @@
+export { expr, all, any, not, deny, always, allow } from './compose.js';
+export { authenticated, ownPath, ownField, isNew, hasChildren, hasChild, fieldIsString, fieldIsNumber, fieldIsBoolean, fieldEnum, immutable, immutableSelf, rootExists, rootEquals, } from './atoms.js';
+export { pathOwnerOnly, fieldOwnerOnly, ownerOrNew, hasRole, isMember, required, transition, } from './policies.js';
+export { dataVal, newDataVal, dataExists, newDataExists, newDataIs, dataParentVal, newDataParentVal, newDataParentExists, eq, neq, gt, lte, AUTH_UID, } from './data.js';
+export { turnGuard, flip, winCheckHelper } from './game.js';
+export { schemaRules } from './schema.js';
+export { ruleset } from './ruleset.js';
+export { defineRtdbRules } from './document.js';
+//# sourceMappingURL=index.js.map

package/dist/rules/rtdb/constraints/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/rtdb/constraints/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EACL,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EACvC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAC9E,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,GACjD,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,aAAa,EAAE,cAAc,EAAE,UAAU,EACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,GACxC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAC9C,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAC/D,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,GAC3B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/rules/rtdb/constraints/policies.d.ts

@@ -0,0 +1,16 @@
+import type { Expr, Segment } from './types.js';
+/** Only the path owner (auth.uid === $pathVar) can access */
+export declare const pathOwnerOnly: (pathVar: string) => Expr;
+/** Only the field owner (auth.uid === data.child(field).val()) can access */
+export declare const fieldOwnerOnly: (field: string) => Expr;
+/** Anyone authenticated can create; only the field owner can edit */
+export declare const ownerOrNew: (field: string) => Expr;
+/** Cross-path role check via root lookup */
+export declare const hasRole: (segments: Segment[], role: string) => Expr;
+/** Cross-path membership check: root.child(list).child($var).child(auth.uid).exists() */
+export declare const isMember: (listName: string, pathVarName: string) => Expr;
+/** All specified fields must be present in the incoming data */
+export declare const required: (...fields: string[]) => Expr;
+/** State machine: only allowed transitions on a field */
+export declare const transition: (field: string, allowed: Array<[string, string]>) => Expr;
+//# sourceMappingURL=policies.d.ts.map