pyric 0.0.1 → 0.1.0-alpha.10

package/dist/rules/write/handler.js

@@ -0,0 +1,126 @@
+import { parseToASTOrError } from '../grammar/FirestoreParser.js';
+import { validateFirestoreRules } from '../grammar/FirestoreValidator.js';
+import { lintFirestoreRules } from '../linter/linter.js';
+const RULES_API = 'https://firebaserules.googleapis.com/v1';
+export class WriteFirestoreRulesHandler {
+    async execute(scope, source) {
+        // 1. Parse — surface line/col on failure so the caller (often an agent)
+        // can locate the syntax error instead of getting an opaque PARSE_FAILED.
+        const parsed = parseToASTOrError(source);
+        if (!parsed.ok) {
+            return {
+                success: false,
+                error: {
+                    code: 'PARSE_FAILED',
+                    message: `Failed to parse Firestore rules at line ${parsed.error.line}, col ${parsed.error.column}: expected ${parsed.error.expected || '<unknown>'}`,
+                    recoverable: true,
+                    parseError: parsed.error,
+                },
+            };
+        }
+        const ast = parsed.ast;
+        // 2. Check version
+        if (ast.version !== '2') {
+            return {
+                success: false,
+                error: { code: 'PARSE_FAILED', message: `Unsupported rules_version '${ast.version}' — only version '2' is supported`, recoverable: true },
+            };
+        }
+        // 3. Validate — surface security findings (SEC-1 public write, SEC-2
+        // public read at recursive wildcard) before lint. The validator and
+        // linter both catch `allow … if true`, so whichever runs first wins.
+        // Validate wins because CRITICAL findings carry the security taxonomy
+        // (SEC-1/SEC-2 codes, path+operation) that callers actually
+        // remediate against; the linter's PERMISSIVE_RULE/RECURSIVE_WILDCARD
+        // notes are stylistic and would mask the security signal if they
+        // gated first. Compute lint first so its warnings ride along on
+        // the CRITICAL response for completeness.
+        const lint = lintFirestoreRules(source);
+        const findings = validateFirestoreRules(ast);
+        const critical = findings.filter(f => f.severity === 'critical');
+        if (critical.length > 0) {
+            return {
+                success: false,
+                error: {
+                    code: 'CRITICAL_FINDINGS',
+                    message: `${critical.length} critical finding(s) — fix before deploying`,
+                    recoverable: true,
+                    findings,
+                    lint,
+                },
+            };
+        }
+        // 4. Lint — catch remaining structural issues before deploying
+        const lintErrors = lint.warnings.filter(w => w.severity === 'error');
+        if (lintErrors.length > 0) {
+            return {
+                success: false,
+                error: {
+                    code: 'LINT_ERRORS',
+                    message: `${lintErrors.length} lint error(s) — fix before deploying: ${lintErrors.map(e => e.message).join('; ')}`,
+                    recoverable: true,
+                    lint,
+                },
+            };
+        }
+        try {
+            const token = await scope.resolveToken();
+            const headers = { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' };
+            // 3. Create ruleset
+            const createRes = await fetch(`${RULES_API}/projects/${scope.projectId}/rulesets`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({ source: { files: [{ name: 'firestore.rules', content: source }] } }),
+            });
+            if (createRes.status === 403) {
+                return {
+                    success: false,
+                    error: { code: 'PERMISSION_DENIED', message: 'Service account lacks permission to create Firestore rulesets', recoverable: false },
+                };
+            }
+            if (!createRes.ok) {
+                const body = await createRes.text().catch(() => '');
+                return {
+                    success: false,
+                    error: { code: 'CREATE_RULESET_FAILED', message: `Failed to create ruleset: ${createRes.status} ${body}`, recoverable: createRes.status === 400 },
+                };
+            }
+            const createData = await createRes.json();
+            const rulesetName = createData.name;
+            const rulesetId = rulesetName.split('/').pop();
+            // 4. Update the cloud.firestore release to point at the new ruleset.
+            // The body MUST include `release.name`. Without it the API responds
+            // 200 OK but the active release is left pointing at the previous
+            // ruleset — a silent failure where the tool reports success but
+            // production rules never change. The release name in the URL path
+            // is not enough; the body field is what the API actually reads.
+            const releaseName = `projects/${scope.projectId}/releases/cloud.firestore`;
+            const releaseRes = await fetch(`${RULES_API}/${releaseName}`, {
+                method: 'PATCH',
+                headers,
+                body: JSON.stringify({ release: { name: releaseName, rulesetName } }),
+            });
+            if (releaseRes.status === 403) {
+                return {
+                    success: false,
+                    error: { code: 'PERMISSION_DENIED', message: 'Service account lacks permission to create Firestore releases', recoverable: false },
+                };
+            }
+            if (!releaseRes.ok) {
+                const body = await releaseRes.text().catch(() => '');
+                return {
+                    success: false,
+                    error: { code: 'CREATE_RELEASE_FAILED', message: `Failed to create release: ${releaseRes.status} ${body}`, recoverable: false },
+                };
+            }
+            return { success: true, data: { rulesetId, findings, lint } };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: { code: 'DEPLOY_FAILED', message: e instanceof Error ? e.message : String(e), recoverable: false },
+            };
+        }
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/rules/write/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/rules/write/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAC,OAAO,CAAC,KAAmB,EAAE,MAAc;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,2CAA2C,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,CAAC,KAAK,CAAC,MAAM,cAAc,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,WAAW,EAAE;oBACrJ,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,MAAM,CAAC,KAAK;iBACzB;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAEvB,mBAAmB;QACnB,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,8BAA8B,GAAG,CAAC,OAAO,mCAAmC,EAAE,WAAW,EAAE,IAAI,EAAE;aAC1I,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,sEAAsE;QACtE,4DAA4D;QAC5D,qEAAqE;QACrE,iEAAiE;QACjE,gEAAgE;QAChE,0CAA0C;QAC1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,6CAA6C;oBACxE,WAAW,EAAE,IAAI;oBACjB,QAAQ;oBACR,IAAI;iBACL;aACF,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACrE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,0CAA0C,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAClH,WAAW,EAAE,IAAI;oBACjB,IAAI;iBACL;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YAEzF,oBAAoB;YACpB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,aAAa,KAAK,CAAC,SAAS,WAAW,EAAE;gBACjF,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;aAC5F,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,+DAA+D,EAAE,WAAW,EAAE,KAAK,EAAE;iBACnI,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,SAAS,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE;iBAClJ,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,EAAsB,CAAC;YAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;YACpC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;YAEhD,qEAAqE;YACrE,oEAAoE;YACpE,iEAAiE;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,gEAAgE;YAChE,MAAM,WAAW,GAAG,YAAY,KAAK,CAAC,SAAS,2BAA2B,CAAC;YAC3E,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,IAAI,WAAW,EAAE,EAAE;gBAC5D,MAAM,EAAE,OAAO;gBACf,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC;aACtE,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,+DAA+D,EAAE,WAAW,EAAE,KAAK,EAAE;iBACnI,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACrD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;iBAChI,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;aAC1G,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/rules/write/spec.d.ts

@@ -0,0 +1,28 @@
+import type { ValidationFinding } from '../grammar/FirestoreValidator.js';
+import type { LintWarning, RulesMetrics } from '../linter/linter.js';
+import type { ParseError } from '../grammar/FirestoreParser.js';
+export type WriteFirestoreRulesResult = {
+    success: true;
+    data: {
+        rulesetId: string;
+        findings: ValidationFinding[];
+        lint: {
+            warnings: LintWarning[];
+            metrics: RulesMetrics;
+        };
+    };
+} | {
+    success: false;
+    error: {
+        code: string;
+        message: string;
+        recoverable: boolean;
+        findings?: ValidationFinding[];
+        lint?: {
+            warnings: LintWarning[];
+            metrics: RulesMetrics;
+        };
+        parseError?: ParseError;
+    };
+};
+//# sourceMappingURL=spec.d.ts.map

package/dist/rules/write/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/rules/write/spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QAAC,IAAI,EAAE;YAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;YAAC,OAAO,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,GACvI;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;YAAC,OAAO,EAAE,YAAY,CAAA;SAAE,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,CAAA;CAAE,CAAC"}

package/dist/rules/write/spec.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spec.js.map

package/dist/rules/write/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/rules/write/spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/admin-compat.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `pyric/sandbox/admin-compat` — chainable Admin-shaped Firestore
+ * wrapper backed by `LocalEnvironment`.
+ *
+ * This is the surface that mirrors `firebase-admin/firestore` (the
+ * Admin Node SDK) so test + agent code that's written against the
+ * chainable Admin shape — `db.collection('x').doc('y').get()` etc. —
+ * can run unmodified against the in-process sandbox.
+ *
+ * `pyric-admin` imports from here directly rather than reaching across
+ * packages for its substrate.
+ *
+ * Exported as a separate subpath (not via `/internal`) because the
+ * admin-compat surface has its own `DocumentData` / `Transaction` /
+ * etc. types that would collide with the local-environment exports
+ * already on `/internal`.
+ */
+export * from './firestore/admin-compat/index.js';
+export type { DocumentSnapshot as LiveDocumentSnapshot, QueryDocumentSnapshot as LiveQueryDocumentSnapshot, QuerySnapshot as LiveQuerySnapshot, DocumentChange, DocumentChangeType, DocChangesOptions, SnapshotMetadata, SnapshotDocRef, SnapshotQueryRef, SnapshotTarget, QueryConstraintApplier, SnapshotListenerOptions, } from './internal/index.js';
+//# sourceMappingURL=admin-compat.d.ts.map

package/dist/sandbox/admin-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-compat.d.ts","sourceRoot":"","sources":["../../src/sandbox/admin-compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,cAAc,mCAAmC,CAAC;AAOlD,YAAY,EACV,gBAAgB,IAAI,oBAAoB,EACxC,qBAAqB,IAAI,yBAAyB,EAClD,aAAa,IAAI,iBAAiB,EAClC,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC"}

package/dist/sandbox/admin-compat.js

@@ -0,0 +1,19 @@
+/**
+ * `pyric/sandbox/admin-compat` — chainable Admin-shaped Firestore
+ * wrapper backed by `LocalEnvironment`.
+ *
+ * This is the surface that mirrors `firebase-admin/firestore` (the
+ * Admin Node SDK) so test + agent code that's written against the
+ * chainable Admin shape — `db.collection('x').doc('y').get()` etc. —
+ * can run unmodified against the in-process sandbox.
+ *
+ * `pyric-admin` imports from here directly rather than reaching across
+ * packages for its substrate.
+ *
+ * Exported as a separate subpath (not via `/internal`) because the
+ * admin-compat surface has its own `DocumentData` / `Transaction` /
+ * etc. types that would collide with the local-environment exports
+ * already on `/internal`.
+ */
+export * from './firestore/admin-compat/index.js';
+//# sourceMappingURL=admin-compat.js.map

package/dist/sandbox/admin-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-compat.js","sourceRoot":"","sources":["../../src/sandbox/admin-compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,cAAc,mCAAmC,CAAC"}

package/dist/sandbox/admin-firestore/error-translation.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Translate compat-layer errors (`FirestoreCompatError`) into the
+ * sandbox layer's unified `SandboxError`, attaching whatever structured
+ * `denialContext` is recoverable from the underlying simulator output.
+ *
+ * Why a translation layer at all:
+ *
+ *   The compat impl throws `FirestoreCompatError` because it has to
+ *   look like an Admin SDK `FirestoreError` for the production-shaped
+ *   surface to feel right. The sandbox layer wants one error class
+ *   (`SandboxError`) covering every service so callers can write
+ *   `if (err instanceof SandboxError && err.code === 'permission-
+ *   denied') { ... }` regardless of which service produced the throw.
+ *
+ *   The translation also stitches sandbox-known context (the active
+ *   auth identity, sourced from `SandboxContext`) and best-effort
+ *   recovered context (the underlying `debugMessages`, recovered from
+ *   the error's stitched-together message) into `denialContext`.
+ *
+ * `denialContext.rule` (line + expression) is left undefined: the
+ * rules AST does not currently carry source positions, so neither line
+ * numbers nor the original expression string are reliably available
+ * after evaluation.
+ *
+ * The recursive `wrapWithErrorTranslation` Proxy applies translation
+ * uniformly across the Firestore handle and every object returned from
+ * its methods (DocumentRef, Query, WriteBatch, Transaction). It also
+ * stashes the owning {@link SandboxContext} on every wrapped value via
+ * the {@link CONTEXT_SYMBOL} hidden property — `onSnapshot` reads it
+ * back to capture the right auth at listener registration.
+ */
+import type { SandboxContext } from 'pyric/sandbox';
+/**
+ * Hidden property on every wrapped object that returns the
+ * `SandboxContext` that produced it. Used by `onSnapshot` to recover
+ * the right auth from a ref produced via `db.doc(path)` /
+ * `db.collection(path)` regardless of how many contexts share the
+ * underlying sandbox. Symbol so it never collides with a real property.
+ */
+export declare const CONTEXT_SYMBOL: unique symbol;
+/** Hidden property carried by wrapped local admin handles and every ref/query
+ * they produce. Snapshot listeners read it back so the rules-bypass contract
+ * survives registration and every later listener re-evaluation. */
+export declare const BYPASS_RULES_SYMBOL: unique symbol;
+/**
+ * Late-bound reference to the free `onSnapshot(ref, ...args)` function
+ * from `index.ts`. Synthesized into wrapped refs as a `.onSnapshot(...)`
+ * chainable method (see {@link wrapWithErrorTranslation}).
+ *
+ * Why late binding: the Proxy wrapper here is consumed from `index.ts`,
+ * and that's where the free `onSnapshot` is defined. Statically
+ * importing it back would create a circular module init order. The
+ * registration call lives at the bottom of `index.ts`, after
+ * `onSnapshot` is fully declared.
+ */
+type OnSnapshotImpl = (ref: unknown, ...args: unknown[]) => () => void;
+/**
+ * Register the free `onSnapshot` function so wrapped refs can synthesize
+ * a chainable `.onSnapshot(...)` method that delegates to it. Called
+ * once at module init from `index.ts`.
+ */
+export declare function registerOnSnapshotImpl(fn: OnSnapshotImpl): void;
+/**
+ * Convert a compat error into a `SandboxError` with attached
+ * `denialContext`. Non-compat errors fall through unchanged so callers
+ * still see (e.g.) a TypeError thrown from user code.
+ */
+export declare function toSandboxError(err: unknown, ctx: SandboxContext): unknown;
+/**
+ * Wrap an object so that every function call on it (and on its
+ * function-call returns) gets `try/catch` and `Promise.catch`
+ * translation through {@link toSandboxError}.
+ *
+ * Property reads that aren't functions pass through. Function returns
+ * that aren't objects pass through. Object returns are recursively
+ * wrapped — this is what makes `db.doc('x').get()` translate even
+ * though the wrapper only directly intercepts `db`'s own methods.
+ *
+ * Method-chaining identity (`b.set(x).update(y)`) is preserved through
+ * a per-call fresh proxy: each chain step returns a wrapped view of
+ * the underlying impl's `this`, which has the same delegate behavior.
+ *
+ * Every wrapped object also exposes `[CONTEXT_SYMBOL]` returning the
+ * owning {@link SandboxContext}; `onSnapshot` reads this to recover
+ * the right auth at registration regardless of how many contexts
+ * share the underlying sandbox.
+ */
+export declare function wrapWithErrorTranslation<T extends object>(target: T, ctx: SandboxContext, bypassRules?: boolean): T;
+export {};
+//# sourceMappingURL=error-translation.d.ts.map

package/dist/sandbox/admin-firestore/error-translation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-translation.d.ts","sourceRoot":"","sources":["../../../src/sandbox/admin-firestore/error-translation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAQpD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,OAAO,MAAwC,CAAC;AAE7E;;mEAEmE;AACnE,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAA4C,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,KAAK,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,MAAM,IAAI,CAAC;AAGvE;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,CAE/D;AAsDD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAyBzE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,MAAM,EACvD,MAAM,EAAE,CAAC,EACT,GAAG,EAAE,cAAc,EACnB,WAAW,UAAQ,GAClB,CAAC,CA4DH"}

package/dist/sandbox/admin-firestore/error-translation.js

@@ -0,0 +1,214 @@
+/**
+ * Translate compat-layer errors (`FirestoreCompatError`) into the
+ * sandbox layer's unified `SandboxError`, attaching whatever structured
+ * `denialContext` is recoverable from the underlying simulator output.
+ *
+ * Why a translation layer at all:
+ *
+ *   The compat impl throws `FirestoreCompatError` because it has to
+ *   look like an Admin SDK `FirestoreError` for the production-shaped
+ *   surface to feel right. The sandbox layer wants one error class
+ *   (`SandboxError`) covering every service so callers can write
+ *   `if (err instanceof SandboxError && err.code === 'permission-
+ *   denied') { ... }` regardless of which service produced the throw.
+ *
+ *   The translation also stitches sandbox-known context (the active
+ *   auth identity, sourced from `SandboxContext`) and best-effort
+ *   recovered context (the underlying `debugMessages`, recovered from
+ *   the error's stitched-together message) into `denialContext`.
+ *
+ * `denialContext.rule` (line + expression) is left undefined: the
+ * rules AST does not currently carry source positions, so neither line
+ * numbers nor the original expression string are reliably available
+ * after evaluation.
+ *
+ * The recursive `wrapWithErrorTranslation` Proxy applies translation
+ * uniformly across the Firestore handle and every object returned from
+ * its methods (DocumentRef, Query, WriteBatch, Transaction). It also
+ * stashes the owning {@link SandboxContext} on every wrapped value via
+ * the {@link CONTEXT_SYMBOL} hidden property — `onSnapshot` reads it
+ * back to capture the right auth at listener registration.
+ */
+import { FirestoreCompatError } from 'pyric/sandbox/admin-compat';
+import { SandboxError, } from 'pyric/sandbox';
+import { provenanceForOperationContext } from 'pyric/sandbox/internal';
+/**
+ * Hidden property on every wrapped object that returns the
+ * `SandboxContext` that produced it. Used by `onSnapshot` to recover
+ * the right auth from a ref produced via `db.doc(path)` /
+ * `db.collection(path)` regardless of how many contexts share the
+ * underlying sandbox. Symbol so it never collides with a real property.
+ */
+export const CONTEXT_SYMBOL = Symbol('pyric/sandbox/context');
+/** Hidden property carried by wrapped local admin handles and every ref/query
+ * they produce. Snapshot listeners read it back so the rules-bypass contract
+ * survives registration and every later listener re-evaluation. */
+export const BYPASS_RULES_SYMBOL = Symbol('pyric/sandbox/bypassRules');
+let onSnapshotImpl = null;
+/**
+ * Register the free `onSnapshot` function so wrapped refs can synthesize
+ * a chainable `.onSnapshot(...)` method that delegates to it. Called
+ * once at module init from `index.ts`.
+ */
+export function registerOnSnapshotImpl(fn) {
+    onSnapshotImpl = fn;
+}
+/**
+ * Heuristic: the wrapped object is a Firestore ref
+ * (DocumentReference, CollectionReference, or chained Query). Used
+ * to gate the synthesized `.onSnapshot` shim so the method only
+ * appears on values where a chainable `.onSnapshot` actually makes
+ * sense.
+ *
+ * - `DocumentReference` exposes `path` publicly.
+ * - `CollectionReference` exposes `path` publicly.
+ * - Chained `Query` (the result of `.where()/.orderBy()/.limit()`)
+ *   keeps `collectionPath` as a TypeScript-protected field on the
+ *   underlying `QueryImpl`. Protected is a TS-only restriction; at
+ *   runtime the field is readable, so the lookup matches.
+ *
+ * Snapshots, batches, transactions, and the Firestore handle itself
+ * carry neither, so the shim correctly skips them.
+ */
+function isRefLike(obj) {
+    const o = obj;
+    return (typeof o.path === 'string' && o.path.length > 0)
+        || (typeof o.collectionPath === 'string' && o.collectionPath.length > 0);
+}
+/**
+ * Pull a list of denial reasons out of a compat-error message. Two
+ * formats produced by the underlying SDK are handled:
+ *
+ *   1. Stitched-multi  — `"get denied: Rule #0 → deny; Simulated: DENY"`.
+ *      Produced by the `throwFromDenial` fallback path when the
+ *      simulator didn't attach a typed `error` (rare today; reserved
+ *      for future use). Split after the first `": "` and on `"; "`.
+ *
+ *   2. Plain typed     — `"get tickets/T-1 denied by rules"`. Produced
+ *      when the simulator returns a typed `error` (`makeError(...)`).
+ *      No structured sub-reasons; surface the whole message as a
+ *      single-element list so callers get something machine-readable.
+ *
+ * The list is never empty for a non-empty error message, so callers
+ * don't need to special-case "no reasons available."
+ */
+function recoverReasons(message) {
+    const trimmed = message.trim();
+    if (!trimmed)
+        return [];
+    const firstColon = trimmed.indexOf(': ');
+    if (firstColon !== -1) {
+        const tail = trimmed.slice(firstColon + 2).trim();
+        const parts = tail.split('; ').map(s => s.trim()).filter(s => s.length > 0);
+        if (parts.length > 0)
+            return parts;
+    }
+    return [trimmed];
+}
+/**
+ * Convert a compat error into a `SandboxError` with attached
+ * `denialContext`. Non-compat errors fall through unchanged so callers
+ * still see (e.g.) a TypeError thrown from user code.
+ */
+export function toSandboxError(err, ctx) {
+    if (!(err instanceof FirestoreCompatError))
+        return err;
+    const code = err.code;
+    if (code !== 'permission-denied') {
+        return new SandboxError(code, err.message);
+    }
+    const denialContext = {
+        auth: ctx.auth,
+        reasons: recoverReasons(err.message),
+    };
+    const sim = err.simError;
+    if (sim?.request) {
+        const r = sim.request;
+        denialContext.request = {
+            method: r.method,
+            path: r.path,
+            ...(r.resourceData ? { resourceData: r.resourceData } : {}),
+        };
+    }
+    if (sim?.resource) {
+        denialContext.resource = { data: sim.resource.data, exists: sim.resource.exists };
+    }
+    return new SandboxError(code, err.message, denialContext);
+}
+/**
+ * Wrap an object so that every function call on it (and on its
+ * function-call returns) gets `try/catch` and `Promise.catch`
+ * translation through {@link toSandboxError}.
+ *
+ * Property reads that aren't functions pass through. Function returns
+ * that aren't objects pass through. Object returns are recursively
+ * wrapped — this is what makes `db.doc('x').get()` translate even
+ * though the wrapper only directly intercepts `db`'s own methods.
+ *
+ * Method-chaining identity (`b.set(x).update(y)`) is preserved through
+ * a per-call fresh proxy: each chain step returns a wrapped view of
+ * the underlying impl's `this`, which has the same delegate behavior.
+ *
+ * Every wrapped object also exposes `[CONTEXT_SYMBOL]` returning the
+ * owning {@link SandboxContext}; `onSnapshot` reads this to recover
+ * the right auth at registration regardless of how many contexts
+ * share the underlying sandbox.
+ */
+export function wrapWithErrorTranslation(target, ctx, bypassRules = false) {
+    return new Proxy(target, {
+        get(t, prop, receiver) {
+            // Hidden context recovery — must come before any other property
+            // resolution. Symbol-keyed so it can't collide with real props.
+            if (prop === CONTEXT_SYMBOL)
+                return ctx;
+            if (prop === BYPASS_RULES_SYMBOL)
+                return bypassRules;
+            // Synthesize a chainable `.onSnapshot(...)` method on every
+            // ref-shaped wrapped value. The underlying compat ref doesn't
+            // define this method (the package's canonical surface is the
+            // free `onSnapshot(ref, ...)` function); the shim is here so
+            // `db.collection(path).where(...).onSnapshot(cb)` style chains
+            // work too. Both forms route through the same listener.
+            //
+            // Gate: only when (a) the impl is registered, (b) the underlying
+            // doesn't already define `onSnapshot`, and (c) the underlying is
+            // ref-like — so we don't accidentally attach the method to
+            // snapshots, batches, transactions, the Firestore handle, etc.
+            if (prop === 'onSnapshot' &&
+                onSnapshotImpl !== null &&
+                !(prop in t) &&
+                isRefLike(t)) {
+                // Pass `receiver` (the Proxy) rather than `t` so the free
+                // `onSnapshot` reads CONTEXT_SYMBOL through the wrapper.
+                return (...args) => onSnapshotImpl(receiver, ...args);
+            }
+            const value = Reflect.get(t, prop, receiver);
+            if (typeof value !== 'function')
+                return value;
+            // Bind to the original `t` so internal `this` references inside
+            // the delegate stay coherent.
+            return function (...args) {
+                let result;
+                try {
+                    const invoke = () => value.apply(t, args);
+                    result = ctx.sandbox.runWithProvenance?.(provenanceForOperationContext(ctx.operationContext), invoke) ?? invoke();
+                }
+                catch (e) {
+                    throw toSandboxError(e, ctx);
+                }
+                if (result instanceof Promise) {
+                    return result
+                        .then((v) => (v && typeof v === 'object'
+                        ? wrapWithErrorTranslation(v, ctx, bypassRules)
+                        : v))
+                        .catch((e) => { throw toSandboxError(e, ctx); });
+                }
+                if (result && typeof result === 'object') {
+                    return wrapWithErrorTranslation(result, ctx, bypassRules);
+                }
+                return result;
+            };
+        },
+    });
+}
+//# sourceMappingURL=error-translation.js.map

package/dist/sandbox/admin-firestore/error-translation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-translation.js","sourceRoot":"","sources":["../../../src/sandbox/admin-firestore/error-translation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EACL,YAAY,GAGb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAkB,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAE7E;;mEAEmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAkB,MAAM,CAAC,2BAA2B,CAAC,CAAC;AActF,IAAI,cAAc,GAA0B,IAAI,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAkB;IACvD,cAAc,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,CAAC,GAAG,GAAmD,CAAC;IAC9D,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;WACjD,CAAC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,GAAmB;IAC9D,IAAI,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC;QAAE,OAAO,GAAG,CAAC;IAEvD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAwB,CAAC;IAC1C,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,aAAa,GAAkB;QACnC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;KACrC,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;IACzB,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;QACtB,aAAa,CAAC,OAAO,GAAG;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;QAClB,aAAa,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAS,EACT,GAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ;YACnB,gEAAgE;YAChE,gEAAgE;YAChE,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO,GAAG,CAAC;YACxC,IAAI,IAAI,KAAK,mBAAmB;gBAAE,OAAO,WAAW,CAAC;YAErD,4DAA4D;YAC5D,8DAA8D;YAC9D,6DAA6D;YAC7D,6DAA6D;YAC7D,+DAA+D;YAC/D,wDAAwD;YACxD,EAAE;YACF,iEAAiE;YACjE,iEAAiE;YACjE,2DAA2D;YAC3D,+DAA+D;YAC/D,IACE,IAAI,KAAK,YAAY;gBACrB,cAAc,KAAK,IAAI;gBACvB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBACZ,SAAS,CAAC,CAAC,CAAC,EACZ,CAAC;gBACD,0DAA0D;gBAC1D,yDAAyD;gBACzD,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,cAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9C,gEAAgE;YAChE,8BAA8B;YAC9B,OAAO,UAAyB,GAAG,IAAe;gBAChD,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,GAAG,EAAE,CAAE,KAAsC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBAC5E,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,CACtC,6BAA6B,CAAC,GAAG,CAAC,gBAAgB,CAAC,EACnD,MAAM,CACP,IAAI,MAAM,EAAE,CAAC;gBAChB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;oBAC9B,OAAO,MAAM;yBACV,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;wBACtC,CAAC,CAAC,wBAAwB,CAAC,CAAW,EAAE,GAAG,EAAE,WAAW,CAAC;wBACzD,CAAC,CAAC,CAAC,CAAC,CAAC;yBACN,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzC,OAAO,wBAAwB,CAAC,MAAgB,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/sandbox/admin-firestore/get-admin-firestore.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `getAdminFirestore(target)` — the rules-bypassing `SandboxFirestore`
+ * resolver (the Pyric Studio admin lens, Gap #2).
+ */
+import { type Sandbox, type SandboxContext } from 'pyric/sandbox';
+import type { SandboxFirestore } from './types.js';
+/**
+ * Resolve a **rules-bypassing** Firestore handle for a context — the
+ * Pyric Studio admin lens (Gap #2). Same chainable `SandboxFirestore`
+ * surface as `getFirestore`, but every operation it issues (reads,
+ * writes, queries, batches, transactions) SKIPS security-rule evaluation
+ * and is treated as ALLOW. This is the modular/chainable-shaped sibling of
+ * the path-string `sandbox.admin.*` bypass — it reuses the exact same
+ * `LocalEnvironment` bypass execution path (`bypassRules` on the op),
+ * rather than reimplementing it.
+ *
+ * Storage preconditions still apply (a `create` on an existing doc still
+ * fails `already-exists`, matching real Firestore admin), and the same
+ * `request`/`write` events fire + listeners wake, so the change shows up
+ * live and on the traffic log (stamped as an admin-bypass read/write).
+ *
+ * Use for "edit anything as admin" surfaces (Studio F2). For rules-applied
+ * impersonation ("act as this user"), use `getFirestore(sandbox.withAuth({
+ * uid }))` instead — that path is unchanged.
+ *
+ * @example
+ * ```ts
+ * import { initializeSandbox } from 'pyric/sandbox';
+ * import { getFirestore, getAdminFirestore } from 'pyric-admin/firestore';
+ *
+ * const sandbox = initializeSandbox();
+ * getFirestore(sandbox.withAuth(null)).setRules('...deny everything...');
+ *
+ * // Denied under rules:
+ * await getFirestore(sandbox.withAuth({ uid: 'alice' }))
+ *   .doc('locked/x').set({ a: 1 }); // throws permission-denied
+ *
+ * // Bypasses rules:
+ * await getAdminFirestore(sandbox).doc('locked/x').set({ a: 1 }); // ok
+ * ```
+ */
+export declare function getAdminFirestore(ctx: SandboxContext): SandboxFirestore;
+export declare function getAdminFirestore(sandbox: Sandbox): SandboxFirestore;
+//# sourceMappingURL=get-admin-firestore.d.ts.map

package/dist/sandbox/admin-firestore/get-admin-firestore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-admin-firestore.d.ts","sourceRoot":"","sources":["../../../src/sandbox/admin-firestore/get-admin-firestore.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAmB,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAKnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAWnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,gBAAgB,CAAC;AACzE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAAC"}