pyric 0.0.1 → 0.1.0-alpha.11

package/dist/rules/simulator/query-proof.js

@@ -0,0 +1,367 @@
+/**
+ * Decide whether `listCondition` is PROVABLE for every doc the query could
+ * return, given its `constraints`. Pure — no evaluation context, no I/O.
+ *
+ * @param listCondition the `allow list/read` rule's condition AST (already the
+ *   specific list rule; OR-of-rules is the caller's concern — it asks per rule).
+ * @param constraints   the query's where/limit/offset/orderBy.
+ * @param fnMap         user-defined functions, inlined during both the
+ *   doc-dependence check and the required-equality extraction.
+ * @param authUid       the caller's uid, so a rule pinning `resource.data.F ==
+ *   request.auth.uid` (directly or through a helper) is dischargeable by a
+ *   `where(F, '==', <that uid>)` clause. Absent (unauthenticated) → an
+ *   `== request.auth.uid` predicate is not recognized as a required equality.
+ */
+export function evaluateQueryProof(listCondition, constraints, fnMap = new Map(), authUid) {
+    // 1. Doc-independent rule → any query is provable. This is the common
+    //    `allow list: if request.auth != null` / `if true` case. The check is the
+    //    fail-closed classifier: the rule counts as doc-independent only when
+    //    every node is positively known not to touch the candidate doc.
+    if (isProvablyDocIndependent(listCondition, fnMap)) {
+        return {
+            provable: true,
+            reason: 'list rule does not depend on per-document data; every doc is equally readable',
+        };
+    }
+    // 2. Doc-dependent rule. Walk the full inlined `&&` spine: extract the
+    //    per-doc equality predicates the rule REQUIRES and verify they fully
+    //    account for the rule's doc-dependence — every conjunct must be either
+    //    doc-independent or an extracted equality. Any doc-dependent conjunct
+    //    that is not an equality makes the whole rule out of scope, no matter
+    //    how many equalities the query discharges: the residual simulate() run
+    //    evaluates against a synthetic resource carrying only the where-pinned
+    //    fields, and absent-tolerant predicates (`in`, negated `in`, `get(...,
+    //    default)`, `keys().hasOnly`, `is`) pass vacuously on it — a false allow.
+    const extraction = extractRequiredDataEqualities(listCondition, fnMap, authUid);
+    if (!extraction.ok || extraction.required.length === 0) {
+        const outOfScope = 'list rule depends on per-document data through a predicate the query cannot discharge ' +
+            '(a rule is provable only when its entire doc-dependence reduces to top-level ' +
+            '`resource.data.field == value` conjunctions, including through inlined helpers — ' +
+            'disjunctions, ranges, `in`, membership/type checks, and nested paths are not provable)';
+        return {
+            provable: false,
+            reason: `${outOfScope} — prod rejects the whole query rather than filtering`,
+            residual: { missing: [], mismatched: [], outOfScope },
+        };
+    }
+    const required = extraction.required;
+    const wheres = constraints.where ?? [];
+    const missing = [];
+    const mismatched = [];
+    for (const req of required) {
+        const discharged = wheres.some(w => w.field === req.field && w.op === '==' && valuesEqual(w.value, req.value));
+        if (discharged)
+            continue;
+        // A `where(field, '==', other)` on the same field with a different value is
+        // a mismatch (actionable: the wrong value); anything else is simply missing.
+        const conflict = wheres.find(w => w.field === req.field && w.op === '==');
+        if (conflict) {
+            mismatched.push({ field: req.field, expectedValue: req.value, actualValue: conflict.value });
+        }
+        else {
+            missing.push({ field: req.field, expectedValue: req.value, fromAuthUid: req.fromAuthUid });
+        }
+    }
+    if (missing.length === 0 && mismatched.length === 0) {
+        return {
+            provable: true,
+            reason: 'every per-document predicate the rule requires is guaranteed by a query where(...) constraint',
+        };
+    }
+    return {
+        provable: false,
+        reason: buildResidualReason(missing, mismatched),
+        residual: { missing, mismatched },
+    };
+}
+/** Prose derived from the structured residual, for logs and legacy consumers. */
+function buildResidualReason(missing, mismatched) {
+    const parts = [];
+    if (missing.length > 0) {
+        const list = missing
+            .map(m => `resource.data.${m.field} == ${m.fromAuthUid ? 'request.auth.uid' : JSON.stringify(m.expectedValue)}`)
+            .join(', ');
+        parts.push(`the query has no matching where(...) equality for [${list}]`);
+    }
+    if (mismatched.length > 0) {
+        const list = mismatched
+            .map(m => `resource.data.${m.field} == ${JSON.stringify(m.expectedValue)} but the query pins ${JSON.stringify(m.actualValue)}`)
+            .join(', ');
+        parts.push(`the query where(...) value does not match [${list}]`);
+    }
+    return `${parts.join('; ')} — prod rejects the query ("rules are not filters")`;
+}
+/**
+ * True if the expression depends on `resource.data` (the per-document data of
+ * the candidate doc) — directly or via an inlined user function. Mirrors the
+ * shape of `referencesRequestTime` in linter/ast-utils. `request.resource.data`
+ * (the WRITE payload) is NOT per-doc-read data, so it's intentionally excluded.
+ *
+ * Polarity warning: this detector fails OPEN (an unrecognized shape reads as
+ * "no reference"), so it must only gate deny-safe decisions — e.g. whether the
+ * provable path injects a synthetic resource (a miss there under-populates the
+ * test case and the rule denies). Anything that gates an ALLOW must use the
+ * fail-closed {@link isProvablyDocIndependent} instead.
+ */
+export function referencesResourceData(expr, fnMap = new Map(), visited = new Set()) {
+    const check = (e) => {
+        switch (e.type) {
+            case 'memberAccess':
+                // `resource.data` (the bare `resource` identifier, not `request.resource`).
+                if (e.property === 'data' && e.object.type === 'identifier' && e.object.name === 'resource') {
+                    return true;
+                }
+                return check(e.object);
+            case 'bracketAccess':
+                return check(e.object) || check(e.index);
+            case 'functionCall':
+                if (fnMap.has(e.name) && !visited.has(e.name)) {
+                    visited.add(e.name);
+                    const fn = fnMap.get(e.name);
+                    if (referencesResourceData(fn.body, fnMap, visited))
+                        return true;
+                    if (fn.lets.some(b => referencesResourceData(b.value, fnMap, visited)))
+                        return true;
+                }
+                return e.args.some(check);
+            case 'binaryOp': return check(e.left) || check(e.right);
+            case 'unaryOp': return check(e.operand);
+            case 'methodCall': return check(e.object) || e.args.some(check);
+            case 'ternary': return check(e.condition) || check(e.consequent) || check(e.alternate);
+            case 'inExpr': return check(e.element) || check(e.collection);
+            case 'isExpr': return check(e.value);
+            case 'listLiteral': return e.elements.some(check);
+            case 'mapLiteral': return e.entries.some(en => check(en.key) || check(en.value));
+            default: return false;
+        }
+    };
+    return check(expr);
+}
+/**
+ * Fail-closed doc-independence classifier — the polarity opposite of
+ * {@link referencesResourceData}, and the only check allowed to gate an ALLOW.
+ *
+ * Returns true only for expressions positively known not to depend on the
+ * candidate document: literals, `request.*` chains (including
+ * `request.resource.data`, the write payload), path-variable and stdlib
+ * identifiers, and boolean/comparison/arithmetic/method/call compositions
+ * whose every child is itself provably doc-independent. Every child position
+ * is walked — bracket-access object and index, slice-access object/start/end,
+ * path-literal segment expressions, method and function arguments, user
+ * function bodies and `let` bindings (recursion-guarded; a cycle fails
+ * closed).
+ *
+ * Any touch of the `resource` root — `resource.data` in every syntactic form
+ * (`resource['data']`, inside a path literal, sliced), and also `resource.id`
+ * / `resource.__name__` (per-doc identity) — classifies doc-dependent. So
+ * does any node type this switch doesn't enumerate: a future AST addition is
+ * doc-dependent (deny) until this classifier positively learns it, never
+ * silently doc-independent (allow). Consequence for callers: document lookups
+ * (`exists`/`get`/`getAfter`/`existsAfter`) whose path argument touches
+ * `resource` classify doc-dependent via the walked path-literal segments —
+ * such predicates can never be discharged by a `where` filter.
+ */
+export function isProvablyDocIndependent(expr, fnMap = new Map(), visited = new Set()) {
+    const safe = (e) => {
+        switch (e.type) {
+            case 'literal':
+                return true;
+            case 'identifier':
+                // The bare `resource` root is the candidate doc; every other
+                // identifier (request, path variables, stdlib namespaces, function
+                // params — already substituted away when inlined) is doc-independent.
+                return e.name !== 'resource';
+            case 'memberAccess':
+                return safe(e.object);
+            case 'bracketAccess':
+                return safe(e.object) && safe(e.index);
+            case 'sliceAccess':
+                return safe(e.object) && safe(e.start) && safe(e.end);
+            case 'binaryOp':
+                return safe(e.left) && safe(e.right);
+            case 'unaryOp':
+                return safe(e.operand);
+            case 'ternary':
+                return safe(e.condition) && safe(e.consequent) && safe(e.alternate);
+            case 'inExpr':
+                return safe(e.element) && safe(e.collection);
+            case 'isExpr':
+                return safe(e.value);
+            case 'listLiteral':
+                return e.elements.every(safe);
+            case 'mapLiteral':
+                return e.entries.every((en) => safe(en.key) && safe(en.value));
+            case 'pathLiteral':
+                return e.segments.every((s) => typeof s === 'string' || safe(s));
+            case 'methodCall':
+                return safe(e.object) && e.args.every(safe);
+            case 'functionCall': {
+                if (!e.args.every(safe))
+                    return false;
+                const fn = fnMap.get(e.name);
+                // Unknown name → a builtin (exists/get/debug/…): its verdict is the
+                // same for every candidate doc as long as its arguments are
+                // doc-independent, which was just checked.
+                if (!fn)
+                    return true;
+                // Recursive helper → fail closed.
+                if (visited.has(e.name))
+                    return false;
+                const nextVisited = new Set(visited).add(e.name);
+                return (isProvablyDocIndependent(fn.body, fnMap, nextVisited) &&
+                    fn.lets.every((b) => isProvablyDocIndependent(b.value, fnMap, nextVisited)));
+            }
+            default:
+                // Unknown node shape → doc-dependent (fail closed).
+                return false;
+        }
+    };
+    return safe(expr);
+}
+/**
+ * Pull out the per-doc EQUALITY predicates the rule requires — top-level `&&`
+ * conjuncts shaped `resource.data.<field> == <literal>` or `resource.data.<field>
+ * == request.auth.uid` (either operand order) — and verify those equalities
+ * fully account for the rule's doc-dependence. User functions on the spine are
+ * INLINED — a `functionCall` in `fnMap` has its argument expressions substituted
+ * for the function's parameters (and its `let` bindings resolved in that scope),
+ * then the inlined body's own `&&` spine is walked. A `visited` set guards
+ * against recursion (helper calling helper, or a self-referential helper).
+ *
+ * Full accounting: every leaf conjunct must be either (a) provably
+ * doc-independent per the fail-closed {@link isProvablyDocIndependent}
+ * classifier or (b) an extracted data equality. A conjunct that is neither (a
+ * disjunction, range, `in`, membership/type/default-tolerant check, nested
+ * path, a call the guard refused to inline, or any unrecognized shape) fails
+ * the whole extraction (`ok: false`), and the caller conservatively rejects
+ * the query.
+ */
+function extractRequiredDataEqualities(expr, fnMap, authUid) {
+    const required = [];
+    const walkAnd = (e, visited) => {
+        if (e.type === 'binaryOp' && e.op === '&&') {
+            return walkAnd(e.left, visited) && walkAnd(e.right, visited);
+        }
+        if (e.type === 'functionCall' && fnMap.has(e.name) && !visited.has(e.name)) {
+            const fn = fnMap.get(e.name);
+            // Bind parameters to the call's argument expressions, then resolve `let`
+            // bindings in that scope (a let can reference params + earlier lets).
+            const bindings = new Map();
+            fn.parameters.forEach((p, i) => {
+                const arg = e.args[i];
+                if (arg)
+                    bindings.set(p, arg);
+            });
+            for (const b of fn.lets)
+                bindings.set(b.name, substituteIdentifiers(b.value, bindings));
+            const inlined = substituteIdentifiers(fn.body, bindings);
+            const nextVisited = new Set(visited).add(e.name);
+            return walkAnd(inlined, nextVisited);
+        }
+        const eq = asDataEquality(e, authUid);
+        if (eq) {
+            required.push(eq);
+            return true;
+        }
+        // Not an equality: acceptable only when the conjunct is provably
+        // doc-independent — the residual simulate() run evaluates those
+        // faithfully (auth / time / request.query). Anything else, including any
+        // node shape the classifier doesn't positively recognize, fails the
+        // extraction (fail closed).
+        return isProvablyDocIndependent(e, fnMap);
+    };
+    return walkAnd(expr, new Set()) ? { ok: true, required } : { ok: false };
+}
+/**
+ * Match `resource.data.<field> == <literal>` or `resource.data.<field> ==
+ * request.auth.uid` (either operand order) → the required equality. The auth
+ * form is only recognized when `authUid` is known; its value is that uid and
+ * `fromAuthUid` is set so remediation can suggest `request.auth.uid`.
+ */
+function asDataEquality(e, authUid) {
+    if (e.type !== 'binaryOp' || e.op !== '==')
+        return null;
+    const fromSide = (data, other) => {
+        const field = dataFieldPath(data);
+        if (field === null)
+            return null;
+        if (other.type === 'literal')
+            return { field, value: other.value, fromAuthUid: false };
+        if (authUid !== undefined && isRequestAuthUid(other))
+            return { field, value: authUid, fromAuthUid: true };
+        return null;
+    };
+    return fromSide(e.left, e.right) ?? fromSide(e.right, e.left);
+}
+/** True for the exact member chain `request.auth.uid`. */
+function isRequestAuthUid(e) {
+    return (e.type === 'memberAccess' &&
+        e.property === 'uid' &&
+        e.object.type === 'memberAccess' &&
+        e.object.property === 'auth' &&
+        e.object.object.type === 'identifier' &&
+        e.object.object.name === 'request');
+}
+/**
+ * Return a copy of `expr` with every free `identifier` whose name is a key in
+ * `bindings` replaced by the bound expression. Used to inline a function body:
+ * its parameters and `let` names are identifiers, and this substitutes the
+ * call's argument expressions for them. Pure structural map — the shared AST is
+ * never mutated.
+ */
+function substituteIdentifiers(expr, bindings) {
+    const sub = (e) => {
+        switch (e.type) {
+            case 'identifier':
+                return bindings.get(e.name) ?? e;
+            case 'literal':
+                return e;
+            case 'memberAccess':
+                return { ...e, object: sub(e.object) };
+            case 'methodCall':
+                return { ...e, object: sub(e.object), args: e.args.map(sub) };
+            case 'bracketAccess':
+                return { ...e, object: sub(e.object), index: sub(e.index) };
+            case 'sliceAccess':
+                return { ...e, object: sub(e.object), start: sub(e.start), end: sub(e.end) };
+            case 'binaryOp':
+                return { ...e, left: sub(e.left), right: sub(e.right) };
+            case 'unaryOp':
+                return { ...e, operand: sub(e.operand) };
+            case 'ternary':
+                return { ...e, condition: sub(e.condition), consequent: sub(e.consequent), alternate: sub(e.alternate) };
+            case 'inExpr':
+                return { ...e, element: sub(e.element), collection: sub(e.collection) };
+            case 'isExpr':
+                return { ...e, value: sub(e.value) };
+            case 'listLiteral':
+                return { ...e, elements: e.elements.map(sub) };
+            case 'mapLiteral':
+                return { ...e, entries: e.entries.map((en) => ({ key: sub(en.key), value: sub(en.value) })) };
+            case 'pathLiteral':
+                return { ...e, segments: e.segments.map((s) => (typeof s === 'string' ? s : sub(s))) };
+            case 'functionCall':
+                return { ...e, args: e.args.map(sub) };
+        }
+    };
+    return sub(expr);
+}
+/**
+ * If `e` is a single-segment `resource.data.<field>` access, return `<field>`;
+ * otherwise null. Nested paths (`resource.data.a.b`) aren't dischargeable by a
+ * flat `where('a.b', ...)` equality here, so they return null → reject.
+ */
+function dataFieldPath(e) {
+    if (e.type === 'memberAccess' &&
+        e.object.type === 'memberAccess' &&
+        e.object.property === 'data' &&
+        e.object.object.type === 'identifier' &&
+        e.object.object.name === 'resource') {
+        return e.property;
+    }
+    return null;
+}
+function valuesEqual(a, b) {
+    return a === b;
+}
+//# sourceMappingURL=query-proof.js.map

package/dist/rules/simulator/query-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-proof.js","sourceRoot":"","sources":["../../../src/rules/simulator/query-proof.ts"],"names":[],"mappings":"AAmGA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAAyB,EACzB,WAA6B,EAC7B,QAAkC,IAAI,GAAG,EAAE,EAC3C,OAAgB;IAEhB,sEAAsE;IACtE,8EAA8E;IAC9E,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,wBAAwB,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,+EAA+E;SACxF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,UAAU,GAAG,6BAA6B,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChF,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,UAAU,GACd,wFAAwF;YACxF,+EAA+E;YAC/E,mFAAmF;YACnF,wFAAwF,CAAC;QAC3F,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,GAAG,UAAU,uDAAuD;YAC5E,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE;SACtD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IAErC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAC/E,CAAC;QACF,IAAI,UAAU;YAAE,SAAS;QACzB,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QAC1E,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,+FAA+F;SACxG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC;QAChD,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE;KAClC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,mBAAmB,CAAC,OAA4B,EAAE,UAAgC;IACzF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;aAC/G,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,sDAAsD,IAAI,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,UAAU;aACpB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;aAC9H,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,8CAA8C,IAAI,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAgB,EAChB,QAAkC,IAAI,GAAG,EAAE,EAC3C,UAAU,IAAI,GAAG,EAAU;IAE3B,MAAM,KAAK,GAAG,CAAC,CAAa,EAAW,EAAE;QACvC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,cAAc;gBACjB,4EAA4E;gBAC5E,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC5F,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzB,KAAK,eAAe;gBAClB,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3C,KAAK,cAAc;gBACjB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACpB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC;oBAC9B,IAAI,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACjE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtF,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,KAAK,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACxD,KAAK,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACxC,KAAK,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChE,KAAK,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvF,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC9D,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACrC,KAAK,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClD,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAgB,EAChB,QAAkC,IAAI,GAAG,EAAE,EAC3C,UAAU,IAAI,GAAG,EAAU;IAE3B,MAAM,IAAI,GAAG,CAAC,CAAa,EAAW,EAAE;QACtC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC;YACd,KAAK,YAAY;gBACf,6DAA6D;gBAC7D,mEAAmE;gBACnE,sEAAsE;gBACtE,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;YAC/B,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACxB,KAAK,eAAe;gBAClB,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACzC,KAAK,aAAa;gBAChB,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxD,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACvC,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACzB,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtE,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC/C,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACvB,KAAK,aAAa;gBAChB,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,KAAK,YAAY;gBACf,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,KAAK,aAAa;gBAChB,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACtC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7B,oEAAoE;gBACpE,4DAA4D;gBAC5D,2CAA2C;gBAC3C,IAAI,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC;gBACrB,kCAAkC;gBAClC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACtC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjD,OAAO,CACL,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC;oBACrD,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAC5E,CAAC;YACJ,CAAC;YACD;gBACE,oDAAoD;gBACpD,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAwBD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,6BAA6B,CACpC,IAAgB,EAChB,KAA+B,EAC/B,OAA2B;IAE3B,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,CAAa,EAAE,OAAoB,EAAW,EAAE;QAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC;YAC9B,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;YAC/C,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,GAAG;oBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,EAAE,EAAE,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,iEAAiE;QACjE,gEAAgE;QAChE,yEAAyE;QACzE,oEAAoE;QACpE,4BAA4B;QAC5B,OAAO,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,CAAa,EAAE,OAA2B;IAChE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAE,KAAiB,EAA2B,EAAE;QAChF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACvF,IAAI,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,0DAA0D;AAC1D,SAAS,gBAAgB,CAAC,CAAa;IACrC,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,cAAc;QACzB,CAAC,CAAC,QAAQ,KAAK,KAAK;QACpB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc;QAChC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM;QAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;QACrC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CACnC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,IAAgB,EAAE,QAAiC;IAChF,MAAM,GAAG,GAAG,CAAC,CAAa,EAAc,EAAE;QACxC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,YAAY;gBACf,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,KAAK,SAAS;gBACZ,OAAO,CAAC,CAAC;YACX,KAAK,cAAc;gBACjB,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,KAAK,YAAY;gBACf,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,KAAK,eAAe;gBAClB,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,KAAK,aAAa;gBAChB,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/E,KAAK,UAAU;gBACb,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,KAAK,SAAS;gBACZ,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,KAAK,SAAS;gBACZ,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3G,KAAK,QAAQ;gBACX,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,KAAK,QAAQ;gBACX,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,KAAK,aAAa;gBAChB,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,KAAK,YAAY;gBACf,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAChG,KAAK,aAAa;gBAChB,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,KAAK,cAAc;gBACjB,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,CAAa;IAClC,IACE,CAAC,CAAC,IAAI,KAAK,cAAc;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc;QAChC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM;QAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;QACrC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EACnC,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,CAAU,EAAE,CAAU;IACzC,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC"}

package/dist/rules/simulator/value-equality.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Firestore Rules value equality.
+ *
+ * Rules wrappers and FirestoreSet own equality; lists and maps compare
+ * structurally, with map key order ignored.
+ */
+export declare function rulesValuesEqual(a: unknown, b: unknown): boolean;
+//# sourceMappingURL=value-equality.d.ts.map

package/dist/rules/simulator/value-equality.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"value-equality.d.ts","sourceRoot":"","sources":["../../../src/rules/simulator/value-equality.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAiBhE"}

package/dist/rules/simulator/value-equality.js

@@ -0,0 +1,40 @@
+import { FirestoreSet } from './firestore-set.js';
+import { RulesValue } from './wrappers/base.js';
+/**
+ * Firestore Rules value equality.
+ *
+ * Rules wrappers and FirestoreSet own equality; lists and maps compare
+ * structurally, with map key order ignored.
+ */
+export function rulesValuesEqual(a, b) {
+    if (Object.is(a, b))
+        return true;
+    if (a instanceof RulesValue)
+        return a.equals(b);
+    if (b instanceof RulesValue)
+        return b.equals(a);
+    if (a instanceof FirestoreSet || b instanceof FirestoreSet) {
+        return a instanceof FirestoreSet && a.equals(b);
+    }
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b))
+            return false;
+        if (a.length !== b.length)
+            return false;
+        return a.every((value, index) => rulesValuesEqual(value, b[index]));
+    }
+    if (!isRulesMapValue(a) || !isRulesMapValue(b))
+        return false;
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length)
+        return false;
+    return aKeys.every((key) => key in b && rulesValuesEqual(a[key], b[key]));
+}
+function isRulesMapValue(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+//# sourceMappingURL=value-equality.js.map

package/dist/rules/simulator/value-equality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"value-equality.js","sourceRoot":"","sources":["../../../src/rules/simulator/value-equality.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAU,EAAE,CAAU;IACrD,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,YAAY,YAAY,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;QAC3D,OAAO,CAAC,YAAY,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC"}

package/dist/rules/simulator/wrappers/base.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Wrapper class contract for Firestore Rules value types — see
+ * REBUILD_PLAN.md Item 0.B + Item 1.
+ *
+ * Why an abstract base instead of duck typing: the evaluator dispatches
+ * through six different code paths (rulesValuesEqual, memberAccess,
+ * bracketAccess, evaluateMethodCall, evaluateBinaryOp, isExpr, inExpr).
+ * Without a single base class, every new wrapper would have to be
+ * registered at six sites — and forgetting one is the exact failure mode
+ * 0.B is designed to prevent ("two `Timestamp` instances wrapping the
+ * same millis weren't `===`, so `request.time == otherTime` always
+ * denied in sim"). With this base class, every wrapper inherits all six
+ * dispatch hooks for free.
+ *
+ * Concrete subclasses (Timestamp, Duration, Bytes, LatLng) land in
+ * Item 1.1–1.4. Path lands in Item 5. This file is intentionally
+ * dead code until 1.1 — landing it first makes each wrapper sub-task
+ * a "fill in the blanks" exercise instead of a structural change.
+ */
+/**
+ * Sentinel returned by `binaryOp` / `callMethod` when the wrapper does
+ * not handle the requested operation/method. The evaluator interprets
+ * NO_OP as "fall through" — for `binaryOp` that means try the generic
+ * numeric path; for `callMethod` it means throw `UnsupportedError`.
+ *
+ * `Symbol.for` (registered symbol) survives module duplication that
+ * can happen across bun + esbuild + node test runners — `===` checks
+ * stay reliable even if `base.ts` is loaded under two different module
+ * specifiers.
+ */
+export declare const NO_OP: unique symbol;
+export type NoOp = typeof NO_OP;
+export declare abstract class RulesValue {
+    /**
+     * Stable type tag for `isExpr` dispatch — must match the names emitted
+     * by the parser for `is timestamp`, `is duration`, `is bytes`,
+     * `is latlng`, `is path`. Lowercase, single token.
+     */
+    abstract readonly typeName: string;
+    /**
+     * Numeric coercion for any code path that bypasses `binaryOp` and
+     * casts to number (legacy `as number` sites in evaluator.ts and any
+     * future `String(x)` / `Number(x)` calls). The 0.B per-wrapper table
+     * documents what each type returns:
+     *   Timestamp / Duration → seconds*1000 + Math.round(nanos/1e6) (millis)
+     *   Bytes                → data.length (byte count)
+     *   LatLng / Path        → NaN (no meaningful numeric coercion)
+     *
+     * Returning NaN for LatLng/Path is intentional — any rule that does
+     * arithmetic on them is buggy, and NaN propagation makes the failure
+     * loud rather than silent. The binary op hook (`binaryOp`) catches
+     * the supported cases above this fallback.
+     */
+    abstract valueOf(): number;
+    /**
+     * String coercion for map keys, regex args, path segments, the
+     * `string()` builtin, and template-style concatenation. Must
+     * round-trip through value-equality where the wrapper has a literal
+     * form: `parseRules(toString(x)).equals(x)` for Timestamp/Duration/
+     * LatLng/Path. Bytes is exempt (literal form is the base64 string,
+     * but the parser side will land with hashing.* in Item 5).
+     */
+    abstract toString(): string;
+    /**
+     * JSON-serializable form for debug output and any consumer that
+     * runs `JSON.stringify` on a TestResult. Returns a plain object with
+     * a `__type` discriminator so the serialized form is stable across
+     * releases — crucial for the parity stress harness's debugMessages.
+     */
+    abstract toJSON(): unknown;
+    /**
+     * Value equality. THE single source of truth for `==` / `!=` /
+     * `rulesValuesEqual`. `===` reference equality is intentionally
+     * insufficient (the 0.B failure: two `timestamp.value(1234)` calls
+     * produce two distinct instances; `===` is false; rule denies).
+     */
+    abstract equals(other: unknown): boolean;
+    /**
+     * Property access for `x.field` and `x[field]`. Default returns null
+     * (no such field) — the same shape Firestore rules use for missing
+     * map keys, so denial behavior is consistent.
+     *
+     * Wrappers override only for named properties they expose. Methods
+     * are NOT exposed via `field` — `x.size` evaluates the property to
+     * `null`, and `x.size()` goes through `callMethod` instead.
+     */
+    field(_name: string): unknown;
+    /**
+     * Method dispatch for `x.method(args)`. Default returns NO_OP — the
+     * evaluator turns NO_OP into `UnsupportedError`, which the handler
+     * maps to TestResult.state = 'UNSUPPORTED' (Item 0.A). That gives
+     * agents a clear "sim gap" signal rather than a silent DENY when a
+     * wrapper hasn't implemented a method yet.
+     *
+     * Wrappers override with a switch on `method` and dispatch to their
+     * own private methods. The dispatch table is intentionally not a
+     * `Record<string, Function>` — keeping it as a switch lets each
+     * wrapper apply its own arg validation and return-type promises
+     * inline rather than forcing a uniform signature.
+     */
+    callMethod(_method: string, _args: unknown[]): unknown | NoOp;
+    /**
+     * Cross-type binary operator dispatch. Default returns NO_OP — the
+     * evaluator falls through to generic numeric ops via `valueOf()`.
+     *
+     * Wrappers override for the operators they support. The 0.B
+     * "Required dispatch changes" table specifies the cross-type
+     * arithmetic each wrapper claims:
+     *   Timestamp + Duration → Timestamp
+     *   Timestamp - Timestamp → Duration
+     *   Timestamp - Duration → Timestamp
+     *   Duration ± Duration → Duration
+     *   Bytes < <= > >= Bytes → lexicographic byte compare
+     *
+     * `==` and `!=` do NOT route through this hook — they go through
+     * `rulesValuesEqual` which calls `equals()`. This split keeps the
+     * "is this the same value?" question separate from "what does
+     * `lhs OP rhs` evaluate to?".
+     *
+     * Dispatch is left-operand-only. For commutative ops where the
+     * right operand is a wrapper but the left isn't (e.g. `1 + duration`),
+     * the wrapper is responsible for handling reversed arguments via
+     * its own `binaryOp` when called from the right — the evaluator
+     * detects this by re-dispatching when `lv` isn't a wrapper but
+     * `rv` is, for the symmetric ops `==`, `!=`, `+`, `*`.
+     */
+    binaryOp(_op: string, _other: unknown): unknown | NoOp;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/rules/simulator/wrappers/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/rules/simulator/wrappers/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,KAAK,EAAE,OAAO,MAAsD,CAAC;AAClF,MAAM,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC;AAEhC,8BAAsB,UAAU;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAEnC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,OAAO,IAAI,MAAM;IAE1B;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,IAAI,MAAM;IAE3B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,IAAI,OAAO;IAE1B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAExC;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI7B;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI;IAI7D;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI;CAGvD"}