pyric 0.0.1 → 0.1.0-alpha.10

package/dist/rules/rtdb/simulation/handler.js

@@ -0,0 +1,325 @@
+import { DataSnapshot, evaluateRtdbExpression } from '../grammar/simulator.js';
+import { SimulationInputSchema } from './spec.js';
+/** Own-enumerable keys of a snapshot's object value; empty for non-objects. */
+function snapshotChildKeys(snap) {
+    const value = snap.val();
+    if (value === null || typeof value !== 'object')
+        return [];
+    return Object.keys(value);
+}
+/**
+ * `.validate` enforcement for a write. RTDB evaluates every rule on the path
+ * from the root to the write location, then every descendant rule present in
+ * the written value. Each rule sees the merged post-write snapshot rooted at
+ * its own location. Unlike `.read`/`.write`, validation never grants: ALL
+ * applicable rules must evaluate true. Null proposed values are skipped.
+ *
+ * An unparseable `.validate` expression is a simulator gap, not a pass:
+ * production would still evaluate it and may reject the write, so treating
+ * it as "no rule" would be a fidelity lie. It is reported as `unsupported`
+ * (an abstention) rather than fabricated as either ALLOW or DENY — mirrors
+ * the Firestore simulator's posture where an `UnsupportedError` never
+ * counts as a real evaluation. A genuine `false` found anywhere in the
+ * tree still wins over an unsupported node elsewhere (a confirmed DENY is
+ * stronger evidence than an abstention). Returns the first real failure, else
+ * the first unsupported node, else `null` when every applicable `.validate`
+ * passes.
+ */
+function findFailingValidate(node, data, newData, bindings, buildContext, pathToWrite) {
+    let firstUnsupported = null;
+    function walk(node, data, newData, bindings, remainingPath) {
+        // A null proposed value is a delete — RTDB does not validate deletes.
+        if (!newData.exists())
+            return null;
+        const rule = node.validate;
+        if (rule) {
+            if (!rule.parsed.valid) {
+                if (!firstUnsupported) {
+                    firstUnsupported = { node, rule, bindings, unsupported: true };
+                }
+            }
+            else {
+                const result = evaluateRtdbExpression(rule.raw, buildContext(data, newData, bindings));
+                if (!result)
+                    return { node, rule, bindings };
+            }
+        }
+        for (const child of node.children) {
+            const childSegments = child.path.split('/').filter(Boolean);
+            if (childSegments.length === 0)
+                continue;
+            const lastSegment = childSegments[childSegments.length - 1];
+            const isPathVar = lastSegment.startsWith('$');
+            // Above the write location, validation follows only the operation path.
+            // Once the write location is reached, it fans out through every child
+            // present in the proposed value.
+            if (remainingPath.length > 0) {
+                if (!isPathVar && remainingPath[0] !== lastSegment)
+                    continue;
+                return walk(child, data.child(remainingPath[0]), newData.child(remainingPath[0]), isPathVar ? { ...bindings, [lastSegment]: remainingPath[0] } : bindings, remainingPath.slice(1));
+            }
+            if (isPathVar) {
+                // Bind the path variable to each key actually present in the new
+                // data — a `$var` node validates every child of the written value.
+                for (const key of snapshotChildKeys(newData)) {
+                    const failure = walk(child, data.child(key), newData.child(key), { ...bindings, [lastSegment]: key }, []);
+                    if (failure)
+                        return failure;
+                }
+            }
+            else {
+                const failure = walk(child, data.child(lastSegment), newData.child(lastSegment), bindings, []);
+                if (failure)
+                    return failure;
+            }
+        }
+        return null;
+    }
+    const realFailure = walk(node, data, newData, bindings, pathToWrite);
+    return realFailure ?? firstUnsupported;
+}
+/**
+ * Walk from root toward the target path, collecting every ancestor node
+ * along the way (including the deepest match). Firebase RTDB evaluates
+ * rules from root down — a `true` at any ancestor grants access.
+ */
+function collectAncestors(node, pathSegments, bindings, depth = 0) {
+    const ancestors = [{ node, pathVariableBindings: { ...bindings }, depth }];
+    if (pathSegments.length === 0)
+        return ancestors;
+    for (const child of node.children) {
+        const childSegments = child.path.split('/').filter(Boolean);
+        if (childSegments.length === 0)
+            continue;
+        const lastSegment = childSegments[childSegments.length - 1];
+        const isPathVar = lastSegment.startsWith('$');
+        if (isPathVar || pathSegments[0] === lastSegment) {
+            const newBindings = isPathVar
+                ? { ...bindings, [lastSegment]: pathSegments[0] }
+                : { ...bindings };
+            const deeper = collectAncestors(child, pathSegments.slice(1), newBindings, depth + 1);
+            ancestors.push(...deeper);
+            return ancestors;
+        }
+    }
+    return ancestors;
+}
+/**
+ * Return a new tree equal to `root` but with the value at `segments`
+ * replaced by `value` (a `null`/`undefined` value deletes the node, same
+ * as an RTDB write of `null`). Used to build the post-write tree so that
+ * `newData` at an ANCESTOR of the write location reflects the merged
+ * result at that ancestor's own path, not just the raw payload at the
+ * deepest write path.
+ */
+function withValueAt(root, segments, value) {
+    if (segments.length === 0)
+        return value ?? null;
+    const [head, ...rest] = segments;
+    const currentObj = root !== null && typeof root === 'object' && !Array.isArray(root)
+        ? { ...root }
+        : {};
+    const existingChild = Object.hasOwn(currentObj, head) ? currentObj[head] : null;
+    const childValue = withValueAt(existingChild, rest, value);
+    if (childValue === null || childValue === undefined) {
+        delete currentObj[head];
+    }
+    else {
+        currentObj[head] = childValue;
+    }
+    return currentObj;
+}
+/**
+ * Build the single post-write tree that a write/validate evaluation sees as
+ * `newData`.
+ *
+ * For a single-path write this is just `withValueAt(base, targetSegments,
+ * targetNewData)`. For an atomic multi-path `update()` — where `updates`
+ * lists every path written together — this folds `withValueAt` over EVERY
+ * listed path so the projection reflects the ENTIRE update applied at once.
+ * Each written path's rules are then evaluated against this shared tree,
+ * matching production RTDB: a multi-path update is atomic, so a rule on one
+ * written path sees `newData` for its sibling paths in the same update.
+ *
+ * Evaluating each path leaf-by-leaf against only its own new value (the old
+ * behavior) is a wrong-verdict bug: a rule that depends on a sibling path
+ * written in the same update sees that sibling as absent, flipping legal
+ * writes to a false DENY (and the reverse for `!exists()`-style escape
+ * hatches, a false ALLOW).
+ */
+function projectPostWriteTree(base, targetSegments, targetNewData, updates) {
+    if (!updates || updates.length === 0) {
+        return withValueAt(base, targetSegments, targetNewData ?? null);
+    }
+    let root = base;
+    for (const update of updates) {
+        const segments = update.path.split('/').filter(Boolean);
+        root = withValueAt(root, segments, update.value ?? null);
+    }
+    return root;
+}
+export class SimulateHandler {
+    execute(compiled, rawInput) {
+        const parsed = SimulationInputSchema.safeParse(rawInput);
+        if (!parsed.success) {
+            return {
+                success: false,
+                error: {
+                    code: 'INVALID_INPUT',
+                    message: parsed.error.message,
+                    recoverable: true,
+                },
+            };
+        }
+        const { operation, path, auth, mockData, newData, updates } = parsed.data;
+        try {
+            const pathSegments = path.split('/').filter(Boolean);
+            const rootNode = compiled;
+            const ancestors = collectAncestors(rootNode, pathSegments, {});
+            // Walk from root down. First ancestor whose rule evaluates to true wins.
+            //
+            // `data`/`newData` must be rooted at EACH ancestor's own location —
+            // not at the operation's target path — matching live RTDB semantics:
+            // a rule declared at `/rooms/$roomId` sees `data`/`newData` as the
+            // snapshot AT `/rooms/$roomId`, even when the write is deeper (e.g.
+            // `/rooms/$roomId/title`). Rooting everything at the deepest write
+            // path instead makes ancestor rules see "no data" (since the
+            // deepest path usually doesn't exist yet), which silently satisfies
+            // `!data.exists()`-style escape hatches and produces a false ALLOW.
+            const rootData = new DataSnapshot(mockData, '/');
+            // Post-write tree: mockData with the proposed write merged in. Reads
+            // don't have a "post-write" state, so leave it as-is. For an atomic
+            // multi-path `update()` (`updates` present) the projection reflects
+            // EVERY path written together, so this path's rules see `newData` for
+            // its sibling paths in the same update.
+            const mergedRoot = operation === 'read'
+                ? mockData
+                : projectPostWriteTree(mockData, pathSegments, newData, updates);
+            const mergedRootData = new DataSnapshot(mergedRoot, '/');
+            const buildContext = (data, newDataArg, bindings) => {
+                const pvBindings = {};
+                for (const [k, v] of Object.entries(bindings)) {
+                    pvBindings[k] = v;
+                    pvBindings[k.slice(1)] = v;
+                }
+                return {
+                    auth: auth ? { uid: auth.uid, token: auth.token } : null,
+                    data,
+                    newData: newDataArg,
+                    root: rootData,
+                    now: Date.now(),
+                    pathVariableBindings: pvBindings,
+                };
+            };
+            // Tracks the first ancestor whose `.write`/`.read` rule the grammar
+            // couldn't parse. Unlike `.validate`, `.write`/`.read` rules cascade
+            // (any ancestor granting `true` wins), so an unparseable rule is not
+            // simply "no rule here" — production would still evaluate it and
+            // might grant on it. If no ancestor grants and no real deny is
+            // found either, this reported as `unsupported` rather than a
+            // fabricated deny.
+            let firstUnsupportedAncestor;
+            for (const ancestor of ancestors) {
+                const ruleExpr = ancestor.node[operation];
+                if (!ruleExpr)
+                    continue;
+                if (!ruleExpr.parsed.valid) {
+                    if (!firstUnsupportedAncestor)
+                        firstUnsupportedAncestor = ancestor;
+                    continue;
+                }
+                const ancestorSegments = pathSegments.slice(0, ancestor.depth).join('/');
+                const dataAtAncestor = rootData.child(ancestorSegments);
+                const newDataAtAncestor = mergedRootData.child(ancestorSegments);
+                const result = evaluateRtdbExpression(ruleExpr.raw, buildContext(dataAtAncestor, newDataAtAncestor, ancestor.pathVariableBindings));
+                if (Boolean(result)) {
+                    // A granting `.write` is necessary but not sufficient: RTDB also
+                    // enforces every `.validate` rule from the root through the write
+                    // location and through every present descendant.
+                    // Unlike `.read`/`.write`, `.validate` does NOT cascade — all must
+                    // pass (a single failure denies the write). Read ops have no
+                    // validate phase.
+                    if (operation === 'write') {
+                        const failure = findFailingValidate(rootNode, rootData, mergedRootData, {}, buildContext, pathSegments);
+                        if (failure) {
+                            return {
+                                success: true,
+                                data: {
+                                    allowed: false,
+                                    unsupported: failure.unsupported === true,
+                                    matchedPath: failure.node.path,
+                                    matchedRule: failure.rule.raw,
+                                    reason: failure.unsupported
+                                        ? `Validation rule at '${failure.node.path}' contains an expression the simulator cannot evaluate: ${failure.rule.raw} — not evaluated; production may reject this write.`
+                                        : 'Validation rule evaluated to false',
+                                    pathVariableBindings: failure.bindings,
+                                },
+                            };
+                        }
+                    }
+                    return {
+                        success: true,
+                        data: {
+                            allowed: true,
+                            matchedPath: ancestor.node.path,
+                            matchedRule: ruleExpr.raw,
+                            reason: 'Rule expression evaluated to true',
+                            pathVariableBindings: ancestor.pathVariableBindings,
+                        },
+                    };
+                }
+            }
+            // No ancestor rule evaluated to true. If an ancestor's rule couldn't
+            // be parsed, we can't rule out that production would have granted on
+            // it — report the gap instead of fabricating a deny.
+            if (firstUnsupportedAncestor) {
+                const rule = firstUnsupportedAncestor.node[operation];
+                return {
+                    success: true,
+                    data: {
+                        allowed: false,
+                        unsupported: true,
+                        matchedPath: firstUnsupportedAncestor.node.path,
+                        matchedRule: rule.raw,
+                        reason: `'${operation}' rule at '${firstUnsupportedAncestor.node.path}' contains an expression the simulator cannot evaluate: ${rule.raw} — not evaluated; production may reject or allow this ${operation}.`,
+                        pathVariableBindings: firstUnsupportedAncestor.pathVariableBindings,
+                    },
+                };
+            }
+            // Use the deepest match for the denial.
+            const deepest = ancestors[ancestors.length - 1];
+            const deepestRule = deepest.node[operation];
+            if (!deepestRule) {
+                return {
+                    success: false,
+                    error: {
+                        code: 'NO_MATCHING_RULE',
+                        message: `No '${operation}' rule found for path '${path}'`,
+                        recoverable: true,
+                    },
+                };
+            }
+            return {
+                success: true,
+                data: {
+                    allowed: false,
+                    matchedPath: deepest.node.path,
+                    matchedRule: deepestRule.raw,
+                    reason: 'Rule expression evaluated to false',
+                    pathVariableBindings: deepest.pathVariableBindings,
+                },
+            };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: {
+                    code: 'EVALUATION_ERROR',
+                    message: e instanceof Error ? e.message : String(e),
+                    recoverable: false,
+                },
+            };
+        }
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/rules/rtdb/simulation/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../../src/rules/rtdb/simulation/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAG/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAgClD,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,IAAkB;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,mBAAmB,CAC1B,IAAc,EACd,IAAkB,EAClB,OAAqB,EACrB,QAAgC,EAChC,YAA4B,EAC5B,WAAqB;IAErB,IAAI,gBAAgB,GAA2B,IAAI,CAAC;IAEpD,SAAS,IAAI,CACX,IAAc,EACd,IAAkB,EAClB,OAAqB,EACrB,QAAgC,EAChC,aAAuB;QAEvB,sEAAsE;QACtE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,gBAAgB,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBACjE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACvF,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEzC,MAAM,WAAW,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAE9C,wEAAwE;YACxE,sEAAsE;YACtE,iCAAiC;YACjC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,WAAW;oBAAE,SAAS;gBAC7D,OAAO,IAAI,CACT,KAAK,EACL,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAC5B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAC/B,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EACvE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CACvB,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,iEAAiE;gBACjE,mEAAmE;gBACnE,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7C,MAAM,OAAO,GAAG,IAAI,CAClB,KAAK,EACL,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAClB,EAAE,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EACnC,EAAE,CACH,CAAC;oBACF,IAAI,OAAO;wBAAE,OAAO,OAAO,CAAC;gBAC9B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,IAAI,CAClB,KAAK,EACL,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EACvB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAC1B,QAAQ,EACR,EAAE,CACH,CAAC;gBACF,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrE,OAAO,WAAW,IAAI,gBAAgB,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,IAAc,EACd,YAAsB,EACtB,QAAgC,EAChC,KAAK,GAAG,CAAC;IAET,MAAM,SAAS,GAAoB,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEzC,MAAM,WAAW,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE;gBACjD,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACtF,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,IAAa,EAAE,QAAkB,EAAE,KAAc;IACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,IAAI,IAAI,CAAC;IAEhD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjC,MAAM,UAAU,GACd,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/D,CAAC,CAAC,EAAE,GAAI,IAAgC,EAAE;QAC1C,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAE3D,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,oBAAoB,CAC3B,IAAa,EACb,cAAwB,EACxB,aAAsB,EACtB,OAAiE;IAEjE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,IAAI,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,eAAe;IAC1B,OAAO,CAAC,QAAkB,EAAE,QAAiB;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;oBAC7B,WAAW,EAAE,IAAI;iBAClB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAE1E,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC;YAE1B,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YAE/D,yEAAyE;YACzE,EAAE;YACF,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,6DAA6D;YAC7D,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjD,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,wCAAwC;YACxC,MAAM,UAAU,GACd,SAAS,KAAK,MAAM;gBAClB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,IAAI,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAEzD,MAAM,YAAY,GAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE;gBAClE,MAAM,UAAU,GAA2B,EAAE,CAAC;gBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9C,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAClB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;oBACxD,IAAI;oBACJ,OAAO,EAAE,UAAU;oBACnB,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;oBACf,oBAAoB,EAAE,UAAU;iBACjC,CAAC;YACJ,CAAC,CAAC;YAEF,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,+DAA+D;YAC/D,6DAA6D;YAC7D,mBAAmB;YACnB,IAAI,wBAAmD,CAAC;YAExD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAmC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1E,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC3B,IAAI,CAAC,wBAAwB;wBAAE,wBAAwB,GAAG,QAAQ,CAAC;oBACnE,SAAS;gBACX,CAAC;gBAED,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzE,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACxD,MAAM,iBAAiB,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAEjE,MAAM,MAAM,GAAG,sBAAsB,CACnC,QAAQ,CAAC,GAAG,EACZ,YAAY,CAAC,cAAc,EAAE,iBAAiB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAC/E,CAAC;gBAEF,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpB,iEAAiE;oBACjE,kEAAkE;oBAClE,iDAAiD;oBACjD,mEAAmE;oBACnE,6DAA6D;oBAC7D,kBAAkB;oBAClB,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;wBAC1B,MAAM,OAAO,GAAG,mBAAmB,CACjC,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,EAAE,EACF,YAAY,EACZ,YAAY,CACb,CAAC;wBACF,IAAI,OAAO,EAAE,CAAC;4BACZ,OAAO;gCACL,OAAO,EAAE,IAAI;gCACb,IAAI,EAAE;oCACJ,OAAO,EAAE,KAAK;oCACd,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI;oCACzC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;oCAC9B,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;oCAC7B,MAAM,EAAE,OAAO,CAAC,WAAW;wCACzB,CAAC,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,2DAA2D,OAAO,CAAC,IAAI,CAAC,GAAG,qDAAqD;wCAC1K,CAAC,CAAC,oCAAoC;oCACxC,oBAAoB,EAAE,OAAO,CAAC,QAAQ;iCACvC;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;oBACD,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACJ,OAAO,EAAE,IAAI;4BACb,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;4BAC/B,WAAW,EAAE,QAAQ,CAAC,GAAG;4BACzB,MAAM,EAAE,mCAAmC;4BAC3C,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;yBACpD;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,qDAAqD;YACrD,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAuB,CAAC;gBAC5E,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE;wBACJ,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,IAAI;wBACjB,WAAW,EAAE,wBAAwB,CAAC,IAAI,CAAC,IAAI;wBAC/C,WAAW,EAAE,IAAI,CAAC,GAAG;wBACrB,MAAM,EAAE,IAAI,SAAS,cAAc,wBAAwB,CAAC,IAAI,CAAC,IAAI,2DAA2D,IAAI,CAAC,GAAG,yDAAyD,SAAS,GAAG;wBAC7M,oBAAoB,EAAE,wBAAwB,CAAC,oBAAoB;qBACpE;iBACF,CAAC;YACJ,CAAC;YAED,wCAAwC;YACxC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE5C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,OAAO,SAAS,0BAA0B,IAAI,GAAG;wBAC1D,WAAW,EAAE,IAAI;qBAClB;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;oBAC9B,WAAW,EAAE,WAAW,CAAC,GAAG;oBAC5B,MAAM,EAAE,oCAAoC;oBAC5C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;iBACnD;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBACnD,WAAW,EAAE,KAAK;iBACnB;aACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/rules/rtdb/simulation/spec.d.ts

@@ -0,0 +1,102 @@
+import { z } from 'zod';
+export declare const SimulationInputSchema: z.ZodObject<{
+    operation: z.ZodEnum<["read", "write", "validate"]>;
+    path: z.ZodString;
+    auth: z.ZodUnion<[z.ZodObject<{
+        uid: z.ZodString;
+        token: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, "strip", z.ZodTypeAny, {
+        uid: string;
+        token: Record<string, unknown>;
+    }, {
+        uid: string;
+        token: Record<string, unknown>;
+    }>, z.ZodNull]>;
+    mockData: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    newData: z.ZodOptional<z.ZodUnknown>;
+    /**
+     * The full set of paths written together in one atomic multi-path
+     * `update()` (the `{ "/a/b": 1, "/c/d": 2 }` shape). When present, the
+     * simulator projects EVERY listed path onto a single post-write tree and
+     * evaluates `path`'s rules against that shared projection — so a rule on
+     * one written path sees `newData` reflecting its sibling paths in the
+     * same update. Omit for single-path writes (the simulator then projects
+     * only `path`/`newData`). Each path is absolute (root-relative).
+     */
+    updates: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        value: z.ZodUnknown;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        value?: unknown;
+    }, {
+        path: string;
+        value?: unknown;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    auth: {
+        uid: string;
+        token: Record<string, unknown>;
+    } | null;
+    path: string;
+    operation: "read" | "write" | "validate";
+    mockData: Record<string, unknown>;
+    newData?: unknown;
+    updates?: {
+        path: string;
+        value?: unknown;
+    }[] | undefined;
+}, {
+    auth: {
+        uid: string;
+        token: Record<string, unknown>;
+    } | null;
+    path: string;
+    operation: "read" | "write" | "validate";
+    mockData: Record<string, unknown>;
+    newData?: unknown;
+    updates?: {
+        path: string;
+        value?: unknown;
+    }[] | undefined;
+}>;
+export type SimulationInput = z.infer<typeof SimulationInputSchema>;
+export declare const SimulateErrorCode: z.ZodEnum<["INVALID_INPUT", "NO_MATCHING_RULE", "EVALUATION_ERROR"]>;
+export declare const SimulationResultSchema: z.ZodObject<{
+    allowed: z.ZodBoolean;
+    /** True when this outcome is a simulator gap — an unparseable/unevaluable
+     *  rule expression the engine abstained on rather than genuinely denied.
+     *  `allowed` is always `false` alongside this (abstain, never grant). */
+    unsupported: z.ZodOptional<z.ZodBoolean>;
+    matchedPath: z.ZodString;
+    matchedRule: z.ZodString;
+    reason: z.ZodString;
+    pathVariableBindings: z.ZodRecord<z.ZodString, z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    reason: string;
+    matchedRule: string;
+    allowed: boolean;
+    matchedPath: string;
+    pathVariableBindings: Record<string, string>;
+    unsupported?: boolean | undefined;
+}, {
+    reason: string;
+    matchedRule: string;
+    allowed: boolean;
+    matchedPath: string;
+    pathVariableBindings: Record<string, string>;
+    unsupported?: boolean | undefined;
+}>;
+export type SimulationResult = z.infer<typeof SimulationResultSchema>;
+export type SimulateResult = {
+    success: true;
+    data: SimulationResult;
+} | {
+    success: false;
+    error: {
+        code: z.infer<typeof SimulateErrorCode>;
+        message: string;
+        recoverable: boolean;
+    };
+};
+//# sourceMappingURL=spec.d.ts.map

package/dist/rules/rtdb/simulation/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../../src/rules/rtdb/simulation/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;IAShC;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIH,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB,sEAI5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;IAEjC;;6EAEyE;;;;;;;;;;;;;;;;;;;;EAMzE,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,cAAc,GACtB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACzC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC"}

package/dist/rules/rtdb/simulation/spec.js

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+export const SimulationInputSchema = z.object({
+    operation: z.enum(['read', 'write', 'validate']),
+    path: z.string().min(1).startsWith('/'),
+    auth: z.union([
+        z.object({ uid: z.string(), token: z.record(z.unknown()) }),
+        z.null(),
+    ]),
+    mockData: z.record(z.unknown()),
+    newData: z.unknown().optional(),
+    /**
+     * The full set of paths written together in one atomic multi-path
+     * `update()` (the `{ "/a/b": 1, "/c/d": 2 }` shape). When present, the
+     * simulator projects EVERY listed path onto a single post-write tree and
+     * evaluates `path`'s rules against that shared projection — so a rule on
+     * one written path sees `newData` reflecting its sibling paths in the
+     * same update. Omit for single-path writes (the simulator then projects
+     * only `path`/`newData`). Each path is absolute (root-relative).
+     */
+    updates: z
+        .array(z.object({ path: z.string().min(1).startsWith('/'), value: z.unknown() }))
+        .optional(),
+});
+export const SimulateErrorCode = z.enum([
+    'INVALID_INPUT',
+    'NO_MATCHING_RULE',
+    'EVALUATION_ERROR',
+]);
+export const SimulationResultSchema = z.object({
+    allowed: z.boolean(),
+    /** True when this outcome is a simulator gap — an unparseable/unevaluable
+     *  rule expression the engine abstained on rather than genuinely denied.
+     *  `allowed` is always `false` alongside this (abstain, never grant). */
+    unsupported: z.boolean().optional(),
+    matchedPath: z.string(),
+    matchedRule: z.string(),
+    reason: z.string(),
+    pathVariableBindings: z.record(z.string()),
+});
+//# sourceMappingURL=spec.js.map

package/dist/rules/rtdb/simulation/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../../src/rules/rtdb/simulation/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3D,CAAC,CAAC,IAAI,EAAE;KACT,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;SAChF,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,eAAe;IACf,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB;;6EAEyE;IACzE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3C,CAAC,CAAC"}

package/dist/rules/rtdb/types.d.ts

@@ -0,0 +1,166 @@
+import { z } from 'zod';
+export declare const RuleErrorSchema: z.ZodObject<{
+    code: z.ZodString;
+    message: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+}, {
+    code: string;
+    message: string;
+}>;
+export declare const RuleLintSchema: z.ZodObject<{
+    code: z.ZodString;
+    message: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+}, {
+    code: string;
+    message: string;
+}>;
+export declare const ParsedExpressionSchema: z.ZodObject<{
+    raw: z.ZodString;
+    valid: z.ZodBoolean;
+    errors: z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        code: string;
+        message: string;
+    }, {
+        code: string;
+        message: string;
+    }>, "many">;
+    warnings: z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        code: string;
+        message: string;
+    }, {
+        code: string;
+        message: string;
+    }>, "many">;
+    referencedIdentifiers: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    valid: boolean;
+    raw: string;
+    warnings: {
+        code: string;
+        message: string;
+    }[];
+    errors: {
+        code: string;
+        message: string;
+    }[];
+    referencedIdentifiers: string[];
+}, {
+    valid: boolean;
+    raw: string;
+    warnings: {
+        code: string;
+        message: string;
+    }[];
+    errors: {
+        code: string;
+        message: string;
+    }[];
+    referencedIdentifiers: string[];
+}>;
+export declare const RtdbRuleExpressionSchema: z.ZodObject<{
+    raw: z.ZodString;
+    parsed: z.ZodObject<{
+        raw: z.ZodString;
+        valid: z.ZodBoolean;
+        errors: z.ZodArray<z.ZodObject<{
+            code: z.ZodString;
+            message: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            code: string;
+            message: string;
+        }, {
+            code: string;
+            message: string;
+        }>, "many">;
+        warnings: z.ZodArray<z.ZodObject<{
+            code: z.ZodString;
+            message: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            code: string;
+            message: string;
+        }, {
+            code: string;
+            message: string;
+        }>, "many">;
+        referencedIdentifiers: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        valid: boolean;
+        raw: string;
+        warnings: {
+            code: string;
+            message: string;
+        }[];
+        errors: {
+            code: string;
+            message: string;
+        }[];
+        referencedIdentifiers: string[];
+    }, {
+        valid: boolean;
+        raw: string;
+        warnings: {
+            code: string;
+            message: string;
+        }[];
+        errors: {
+            code: string;
+            message: string;
+        }[];
+        referencedIdentifiers: string[];
+    }>;
+}, "strip", z.ZodTypeAny, {
+    raw: string;
+    parsed: {
+        valid: boolean;
+        raw: string;
+        warnings: {
+            code: string;
+            message: string;
+        }[];
+        errors: {
+            code: string;
+            message: string;
+        }[];
+        referencedIdentifiers: string[];
+    };
+}, {
+    raw: string;
+    parsed: {
+        valid: boolean;
+        raw: string;
+        warnings: {
+            code: string;
+            message: string;
+        }[];
+        errors: {
+            code: string;
+            message: string;
+        }[];
+        referencedIdentifiers: string[];
+    };
+}>;
+export type RuleError = z.infer<typeof RuleErrorSchema>;
+export type RuleLint = z.infer<typeof RuleLintSchema>;
+export type ParsedExpression = z.infer<typeof ParsedExpressionSchema>;
+export type RtdbRuleExpression = z.infer<typeof RtdbRuleExpressionSchema>;
+export type RtdbNode = {
+    path: string;
+    pathVariables: string[];
+    read?: RtdbRuleExpression;
+    write?: RtdbRuleExpression;
+    validate?: RtdbRuleExpression;
+    indexOn?: string[];
+    children: RtdbNode[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/rules/rtdb/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/rules/rtdb/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;;;;;;;;EAG1B,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;EAGzB,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMjC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGnC,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,QAAQ,EAAE,CAAC;CACtB,CAAC"}