pyric 0.0.1 → 0.1.0-alpha.7

package/dist/database/grammar/RtdbExpr.ohm

@@ -0,0 +1,98 @@
+RtdbExpr {
+  Expr = Ternary
+
+  Ternary
+    = Logical "?" Ternary ":" Ternary  -- ternary
+    | Logical
+
+  Logical
+    = Logical "&&" Comparison  -- and
+    | Logical "||" Comparison  -- or
+    | Comparison
+
+  Comparison
+    = Comparison "===" Additive  -- strictEq
+    | Comparison "!==" Additive  -- strictNeq
+    | Comparison ">=" Additive   -- gte
+    | Comparison "<=" Additive   -- lte
+    | Comparison ">" Additive    -- gt
+    | Comparison "<" Additive    -- lt
+    | Comparison "==" Additive   -- looseEq
+    | Comparison "!=" Additive   -- looseNeq
+    | Additive
+
+  Additive
+    = Additive "+" Multiplicative  -- add
+    | Additive "-" Multiplicative  -- sub
+    | Multiplicative
+
+  Multiplicative
+    = Multiplicative "*" UnaryExpr  -- mul
+    | Multiplicative "/" UnaryExpr  -- div
+    | Multiplicative "%" UnaryExpr  -- mod
+    | UnaryExpr
+
+  UnaryExpr
+    = "!" UnaryExpr  -- not
+    | "-" UnaryExpr  -- neg
+    | CallExpr
+
+  CallExpr
+    = CallExpr "." ident "(" ListOf<Expr, ","> ")"  -- methodCall
+    | CallExpr "." ident                             -- memberAccess
+    | CallExpr "[" Expr "]"                          -- indexAccess
+    | Primary
+
+  Primary
+    = "(" Expr ")"  -- paren
+    | Array
+    | literal
+    | ident
+
+  Array = "[" ListOf<Expr, ","> "]"
+
+  literal
+    = number
+    | string
+    | regex
+    | bool
+    | null
+
+  number
+    = digit+ "." digit+  -- float
+    | digit+              -- int
+
+  string
+    = "\"" doubleStringChar* "\""  -- double
+    | "'" singleStringChar* "'"    -- single
+
+  doubleStringChar
+    = "\\" any  -- escape
+    | ~"\"" any -- char
+
+  singleStringChar
+    = "\\" any  -- escape
+    | ~"'" any  -- char
+
+  regex = "/" regexBody "/" regexFlags
+
+  regexBody = regexChar+
+
+  regexChar
+    = "\\" any     -- escape
+    | ~("/" | "\n") any  -- char
+
+  regexFlags = alnum*
+
+  bool
+    = "true" ~identChar   -- true
+    | "false" ~identChar  -- false
+
+  null = "null" ~identChar
+
+  ident = "$"? identStart identChar*
+
+  identStart = letter | "_"
+
+  identChar = alnum | "_" | "$"
+}

package/dist/database/grammar/RtdbExpr.ohm.generated.d.ts

@@ -0,0 +1,2 @@
+export declare const RTDB_EXPR_OHM_SOURCE = "RtdbExpr {\n  Expr = Ternary\n\n  Ternary\n    = Logical \"?\" Ternary \":\" Ternary  -- ternary\n    | Logical\n\n  Logical\n    = Logical \"&&\" Comparison  -- and\n    | Logical \"||\" Comparison  -- or\n    | Comparison\n\n  Comparison\n    = Comparison \"===\" Additive  -- strictEq\n    | Comparison \"!==\" Additive  -- strictNeq\n    | Comparison \">=\" Additive   -- gte\n    | Comparison \"<=\" Additive   -- lte\n    | Comparison \">\" Additive    -- gt\n    | Comparison \"<\" Additive    -- lt\n    | Comparison \"==\" Additive   -- looseEq\n    | Comparison \"!=\" Additive   -- looseNeq\n    | Additive\n\n  Additive\n    = Additive \"+\" Multiplicative  -- add\n    | Additive \"-\" Multiplicative  -- sub\n    | Multiplicative\n\n  Multiplicative\n    = Multiplicative \"*\" UnaryExpr  -- mul\n    | Multiplicative \"/\" UnaryExpr  -- div\n    | Multiplicative \"%\" UnaryExpr  -- mod\n    | UnaryExpr\n\n  UnaryExpr\n    = \"!\" UnaryExpr  -- not\n    | \"-\" UnaryExpr  -- neg\n    | CallExpr\n\n  CallExpr\n    = CallExpr \".\" ident \"(\" ListOf<Expr, \",\"> \")\"  -- methodCall\n    | CallExpr \".\" ident                             -- memberAccess\n    | CallExpr \"[\" Expr \"]\"                          -- indexAccess\n    | Primary\n\n  Primary\n    = \"(\" Expr \")\"  -- paren\n    | Array\n    | literal\n    | ident\n\n  Array = \"[\" ListOf<Expr, \",\"> \"]\"\n\n  literal\n    = number\n    | string\n    | regex\n    | bool\n    | null\n\n  number\n    = digit+ \".\" digit+  -- float\n    | digit+              -- int\n\n  string\n    = \"\\\"\" doubleStringChar* \"\\\"\"  -- double\n    | \"'\" singleStringChar* \"'\"    -- single\n\n  doubleStringChar\n    = \"\\\\\" any  -- escape\n    | ~\"\\\"\" any -- char\n\n  singleStringChar\n    = \"\\\\\" any  -- escape\n    | ~\"'\" any  -- char\n\n  regex = \"/\" regexBody \"/\" regexFlags\n\n  regexBody = regexChar+\n\n  regexChar\n    = \"\\\\\" any     -- escape\n    | ~(\"/\" | \"\\n\") any  -- char\n\n  regexFlags = alnum*\n\n  bool\n    = \"true\" ~identChar   -- true\n    | \"false\" ~identChar  -- false\n\n  null = \"null\" ~identChar\n\n  ident = \"$\"? identStart identChar*\n\n  identStart = letter | \"_\"\n\n  identChar = alnum | \"_\" | \"$\"\n}\n";
+//# sourceMappingURL=RtdbExpr.ohm.generated.d.ts.map

package/dist/database/grammar/RtdbExpr.ohm.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RtdbExpr.ohm.generated.d.ts","sourceRoot":"","sources":["../../../src/database/grammar/RtdbExpr.ohm.generated.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,oBAAoB,otEAkGhC,CAAC"}

package/dist/database/grammar/RtdbExpr.ohm.generated.js

@@ -0,0 +1,103 @@
+// AUTO-GENERATED — do not edit by hand. Regenerate via:
+//   bun packages/rtdb/scripts/inline-grammar.ts
+// Source: RtdbExpr.ohm
+export const RTDB_EXPR_OHM_SOURCE = `RtdbExpr {
+  Expr = Ternary
+
+  Ternary
+    = Logical "?" Ternary ":" Ternary  -- ternary
+    | Logical
+
+  Logical
+    = Logical "&&" Comparison  -- and
+    | Logical "||" Comparison  -- or
+    | Comparison
+
+  Comparison
+    = Comparison "===" Additive  -- strictEq
+    | Comparison "!==" Additive  -- strictNeq
+    | Comparison ">=" Additive   -- gte
+    | Comparison "<=" Additive   -- lte
+    | Comparison ">" Additive    -- gt
+    | Comparison "<" Additive    -- lt
+    | Comparison "==" Additive   -- looseEq
+    | Comparison "!=" Additive   -- looseNeq
+    | Additive
+
+  Additive
+    = Additive "+" Multiplicative  -- add
+    | Additive "-" Multiplicative  -- sub
+    | Multiplicative
+
+  Multiplicative
+    = Multiplicative "*" UnaryExpr  -- mul
+    | Multiplicative "/" UnaryExpr  -- div
+    | Multiplicative "%" UnaryExpr  -- mod
+    | UnaryExpr
+
+  UnaryExpr
+    = "!" UnaryExpr  -- not
+    | "-" UnaryExpr  -- neg
+    | CallExpr
+
+  CallExpr
+    = CallExpr "." ident "(" ListOf<Expr, ","> ")"  -- methodCall
+    | CallExpr "." ident                             -- memberAccess
+    | CallExpr "[" Expr "]"                          -- indexAccess
+    | Primary
+
+  Primary
+    = "(" Expr ")"  -- paren
+    | Array
+    | literal
+    | ident
+
+  Array = "[" ListOf<Expr, ","> "]"
+
+  literal
+    = number
+    | string
+    | regex
+    | bool
+    | null
+
+  number
+    = digit+ "." digit+  -- float
+    | digit+              -- int
+
+  string
+    = "\\"" doubleStringChar* "\\""  -- double
+    | "'" singleStringChar* "'"    -- single
+
+  doubleStringChar
+    = "\\\\" any  -- escape
+    | ~"\\"" any -- char
+
+  singleStringChar
+    = "\\\\" any  -- escape
+    | ~"'" any  -- char
+
+  regex = "/" regexBody "/" regexFlags
+
+  regexBody = regexChar+
+
+  regexChar
+    = "\\\\" any     -- escape
+    | ~("/" | "\\n") any  -- char
+
+  regexFlags = alnum*
+
+  bool
+    = "true" ~identChar   -- true
+    | "false" ~identChar  -- false
+
+  null = "null" ~identChar
+
+  ident = "$"? identStart identChar*
+
+  identStart = letter | "_"
+
+  identChar = alnum | "_" | "$"
+}
+`;
+//# sourceMappingURL=RtdbExpr.ohm.generated.js.map

package/dist/database/grammar/RtdbExpr.ohm.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RtdbExpr.ohm.generated.js","sourceRoot":"","sources":["../../../src/database/grammar/RtdbExpr.ohm.generated.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,gDAAgD;AAChD,uBAAuB;AAEvB,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkGnC,CAAC"}

package/dist/database/grammar/RtdbExprParser.d.ts

@@ -0,0 +1,5 @@
+import * as ohm from 'ohm-js';
+import type { ParsedExpression } from '../types.js';
+export declare const grammar: ohm.Grammar;
+export declare function parseExpression(raw: string): ParsedExpression;
+//# sourceMappingURL=RtdbExprParser.d.ts.map

package/dist/database/grammar/RtdbExprParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RtdbExprParser.d.ts","sourceRoot":"","sources":["../../../src/database/grammar/RtdbExprParser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,QAAQ,CAAC;AAE9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,eAAO,MAAM,OAAO,aAAoC,CAAC;AA6BzD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAwB7D"}

package/dist/database/grammar/RtdbExprParser.js

@@ -0,0 +1,53 @@
+import * as ohm from 'ohm-js';
+import { RTDB_EXPR_OHM_SOURCE } from './RtdbExpr.ohm.generated.js';
+// Grammar inlined at SDK build time — see scripts/inline-grammar.ts.
+export const grammar = ohm.grammar(RTDB_EXPR_OHM_SOURCE);
+const identifierSemantics = grammar.createSemantics();
+identifierSemantics.addOperation('identifiers', {
+    _nonterminal(...children) {
+        return children.flatMap(c => c.identifiers());
+    },
+    _iter(...children) {
+        return children.flatMap(c => c.identifiers());
+    },
+    _terminal() {
+        return [];
+    },
+    CallExpr_methodCall(receiver, _dot, _methodName, _open, args, _close) {
+        // Skip _methodName — it's a method, not a root identifier
+        return [
+            ...receiver.identifiers(),
+            ...args.asIteration().children.flatMap((a) => a.identifiers()),
+        ];
+    },
+    CallExpr_memberAccess(receiver, _dot, _memberName) {
+        // Skip _memberName — it's a property, not a root identifier
+        return receiver.identifiers();
+    },
+    ident(_dollar, _start, _rest) {
+        return [this.sourceString];
+    },
+});
+export function parseExpression(raw) {
+    const trimmed = raw.trim();
+    const match = grammar.match(trimmed);
+    if (match.failed()) {
+        return {
+            raw,
+            valid: false,
+            errors: [{ code: 'PARSE_ERROR', message: match.message ?? 'Parse failed' }],
+            warnings: [],
+            referencedIdentifiers: [],
+        };
+    }
+    const referencedIdentifiers = identifierSemantics(match).identifiers();
+    const unique = [...new Set(referencedIdentifiers)];
+    return {
+        raw,
+        valid: true,
+        errors: [],
+        warnings: [],
+        referencedIdentifiers: unique,
+    };
+}
+//# sourceMappingURL=RtdbExprParser.js.map

package/dist/database/grammar/RtdbExprParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RtdbExprParser.js","sourceRoot":"","sources":["../../../src/database/grammar/RtdbExprParser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,qEAAqE;AACrE,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEzD,MAAM,mBAAmB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;AACtD,mBAAmB,CAAC,YAAY,CAAW,aAAa,EAAE;IACxD,YAAY,CAAC,GAAG,QAAQ;QACtB,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAE,CAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,GAAG,QAAQ;QACf,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAE,CAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,SAAS;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;QAClE,0DAA0D;QAC1D,OAAO;YACL,GAAI,QAAgB,CAAC,WAAW,EAAE;YAClC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAM,EAAE,EAAE,CAAE,CAAS,CAAC,WAAW,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC;IACD,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW;QAC/C,4DAA4D;QAC5D,OAAQ,QAAgB,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK;QAC1B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAErC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,GAAG;YACH,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;YAC3E,QAAQ,EAAE,EAAE;YACZ,qBAAqB,EAAE,EAAE;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,qBAAqB,GAAI,mBAAmB,CAAC,KAAK,CAAS,CAAC,WAAW,EAAc,CAAC;IAC5F,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAEnD,OAAO;QACL,GAAG;QACH,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,qBAAqB,EAAE,MAAM;KAC9B,CAAC;AACJ,CAAC"}

package/dist/database/grammar/linter.d.ts

@@ -0,0 +1,3 @@
+import type { RuleLint } from '../types.js';
+export declare function lintExpression(raw: string, context?: 'read' | 'write' | 'validate'): RuleLint[];
+//# sourceMappingURL=linter.d.ts.map

package/dist/database/grammar/linter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linter.d.ts","sourceRoot":"","sources":["../../../src/database/grammar/linter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAsD5C,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,GAAG,OAAO,GAAG,UAAmB,GAC9C,QAAQ,EAAE,CAoBZ"}

package/dist/database/grammar/linter.js

@@ -0,0 +1,66 @@
+import { grammar } from './RtdbExprParser.js';
+let _warnings = [];
+let _lintContext = 'read';
+let _hasData = false;
+let _hasNewData = false;
+let _hasDataChildAccess = false;
+const linterSemantics = grammar.createSemantics();
+linterSemantics.addOperation('lint', {
+    _nonterminal(...children) {
+        children.forEach(c => c.lint());
+    },
+    _iter(...children) {
+        children.forEach(c => c.lint());
+    },
+    _terminal() { },
+    CallExpr_methodCall(receiver, _dot, methodName, _open, args, _close) {
+        receiver.lint();
+        args.asIteration().children.forEach((a) => a.lint());
+        // Detect data.child() pattern — indicates intentional data comparison
+        if (methodName.sourceString === 'child' && receiver.sourceString === 'data') {
+            _hasDataChildAccess = true;
+        }
+    },
+    ident(_dollar, _start, _rest) {
+        const name = this.sourceString;
+        if (name === 'data')
+            _hasData = true;
+        if (name === 'newData')
+            _hasNewData = true;
+    },
+    bool_true(_true) {
+        _warnings.push({ code: 'HARDCODED_TRUE', message: 'Rule expression is hardcoded to true' });
+    },
+    bool_false(_false) {
+        _warnings.push({ code: 'HARDCODED_FALSE', message: 'Rule expression is hardcoded to false' });
+    },
+    Comparison_looseEq(left, _op, right) {
+        _warnings.push({ code: 'LOOSE_EQUALITY', message: "Use '===' instead of '=='" });
+        left.lint();
+        right.lint();
+    },
+    Comparison_looseNeq(left, _op, right) {
+        _warnings.push({ code: 'LOOSE_INEQUALITY', message: "Use '!==' instead of '!='" });
+        left.lint();
+        right.lint();
+    },
+});
+export function lintExpression(raw, context = 'read') {
+    const match = grammar.match(raw.trim());
+    if (match.failed())
+        return [];
+    _warnings = [];
+    _lintContext = context;
+    _hasData = false;
+    _hasNewData = false;
+    _hasDataChildAccess = false;
+    linterSemantics(match).lint();
+    if (context === 'write' && _hasData && !_hasNewData && !_hasDataChildAccess) {
+        _warnings.push({
+            code: 'DATA_IN_WRITE',
+            message: "Write rule references 'data' but not 'newData'; consider using 'newData' to check incoming data",
+        });
+    }
+    return [..._warnings];
+}
+//# sourceMappingURL=linter.js.map

package/dist/database/grammar/linter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linter.js","sourceRoot":"","sources":["../../../src/database/grammar/linter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAG9C,IAAI,SAAS,GAAe,EAAE,CAAC;AAC/B,IAAI,YAAY,GAAkC,MAAM,CAAC;AACzD,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,IAAI,WAAW,GAAG,KAAK,CAAC;AACxB,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;AAClD,eAAe,CAAC,YAAY,CAAC,MAAM,EAAE;IACnC,YAAY,CAAC,GAAG,QAAQ;QACtB,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAE,CAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,GAAG,QAAQ;QACf,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAE,CAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,SAAS,KAAI,CAAC;IAEd,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;QAChE,QAAgB,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAM,EAAE,EAAE,CAAE,CAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,sEAAsE;QACtE,IAAI,UAAU,CAAC,YAAY,KAAK,OAAO,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5E,mBAAmB,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/B,IAAI,IAAI,KAAK,MAAM;YAAE,QAAQ,GAAG,IAAI,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS;YAAE,WAAW,GAAG,IAAI,CAAC;IAC7C,CAAC;IAED,SAAS,CAAC,KAAK;QACb,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,UAAU,CAAC,MAAM;QACf,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK;QACjC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAChF,IAAY,CAAC,IAAI,EAAE,CAAC;QACpB,KAAa,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK;QAClC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAClF,IAAY,CAAC,IAAI,EAAE,CAAC;QACpB,KAAa,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,UAAyC,MAAM;IAE/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,CAAC;IAE9B,SAAS,GAAG,EAAE,CAAC;IACf,YAAY,GAAG,OAAO,CAAC;IACvB,QAAQ,GAAG,KAAK,CAAC;IACjB,WAAW,GAAG,KAAK,CAAC;IACpB,mBAAmB,GAAG,KAAK,CAAC;IAE3B,eAAe,CAAC,KAAK,CAAS,CAAC,IAAI,EAAE,CAAC;IAEvC,IAAI,OAAO,KAAK,OAAO,IAAI,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5E,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,iGAAiG;SAC3G,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;AACxB,CAAC"}

package/dist/database/grammar/simulator.d.ts

@@ -0,0 +1,31 @@
+import * as ohm from 'ohm-js';
+export interface SimulatedAuth {
+    uid: string;
+    token: Record<string, unknown>;
+}
+export interface EvalContext {
+    auth: SimulatedAuth | null;
+    data: DataSnapshot;
+    newData: DataSnapshot;
+    root: DataSnapshot;
+    now: number;
+    pathVariableBindings: Record<string, string>;
+}
+export declare class DataSnapshot {
+    private _value;
+    private _path;
+    private _root;
+    constructor(value: unknown, path?: string, root?: unknown);
+    val(): unknown;
+    exists(): boolean;
+    hasChild(path: string): boolean;
+    hasChildren(keys?: readonly unknown[]): boolean;
+    isString(): boolean;
+    isNumber(): boolean;
+    isBoolean(): boolean;
+    child(path: string): DataSnapshot;
+    parent(): DataSnapshot | null;
+    getPriority(): null;
+}
+export declare function evaluateExpression(match: ohm.MatchResult, ctx: EvalContext): unknown;
+//# sourceMappingURL=simulator.d.ts.map

package/dist/database/grammar/simulator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulator.d.ts","sourceRoot":"","sources":["../../../src/database/grammar/simulator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,QAAQ,CAAC;AAG9B,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAsBD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,YAAY,CAAC;IACtB,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,KAAK,CAAU;gBAEX,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,MAAY,EAAE,IAAI,CAAC,EAAE,OAAO;IAM9D,GAAG,IAAI,OAAO;IAId,MAAM,IAAI,OAAO;IAIjB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI/B,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO;IAc/C,QAAQ,IAAI,OAAO;IAInB,QAAQ,IAAI,OAAO;IAInB,SAAS,IAAI,OAAO;IAIpB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY;IAsBjC,MAAM,IAAI,YAAY,GAAG,IAAI;IAU7B,WAAW,IAAI,IAAI;CAGpB;AAyLD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAGpF"}

package/dist/database/grammar/simulator.js

@@ -0,0 +1,255 @@
+import { grammar } from './RtdbExprParser.js';
+/** Property names that must never be read through rule member/index
+ *  access. They expose the JS object graph (`constructor` → `Function`,
+ *  `__proto__`/`prototype` → the prototype chain) and are the gadget
+ *  keys for a sandbox escape. Real RTDB rule data has no such fields. */
+const FORBIDDEN_MEMBERS = new Set(['__proto__', 'prototype', 'constructor']);
+/** Read `key` off a rule value without exposing prototype-chain gadgets
+ *  or inherited properties. Returns null for forbidden or absent keys. */
+function safeMemberRead(recv, key) {
+    if (FORBIDDEN_MEMBERS.has(key))
+        return null;
+    if (typeof recv === 'string') {
+        // RTDB rules expose `.length` on strings as a property; nothing else.
+        return key === 'length' ? recv.length : null;
+    }
+    if (recv === null || typeof recv !== 'object')
+        return null;
+    // Own-property access only — never walk the prototype chain.
+    if (!Object.hasOwn(recv, key))
+        return null;
+    return recv[key] ?? null;
+}
+export class DataSnapshot {
+    _value;
+    _path;
+    _root;
+    constructor(value, path = '/', root) {
+        this._value = value ?? null;
+        this._path = path;
+        this._root = root !== undefined ? root : value;
+    }
+    val() {
+        return this._value;
+    }
+    exists() {
+        return this._value !== null && this._value !== undefined;
+    }
+    hasChild(path) {
+        return this.child(path).exists();
+    }
+    hasChildren(keys) {
+        // `hasChildren(['a', 'b'])` — true only when EVERY listed key is
+        // present (prod semantics). `hasChildren()` — true when the node has
+        // at least one child.
+        if (Array.isArray(keys)) {
+            return keys.every((key) => this.hasChild(String(key)));
+        }
+        return (typeof this._value === 'object' &&
+            this._value !== null &&
+            Object.keys(this._value).length > 0);
+    }
+    isString() {
+        return typeof this._value === 'string';
+    }
+    isNumber() {
+        return typeof this._value === 'number';
+    }
+    isBoolean() {
+        return typeof this._value === 'boolean';
+    }
+    child(path) {
+        const parts = path.split('/').filter(p => p.length > 0);
+        let current = this._value;
+        let currentPath = this._path;
+        for (const part of parts) {
+            if (current === null || current === undefined || typeof current !== 'object') {
+                current = null;
+                currentPath = `${currentPath}/${part}`.replace(/\/+/g, '/');
+                break;
+            }
+            // Own-property access only: a `__proto__`/`constructor` child must
+            // not resolve to the JS prototype chain.
+            current = Object.hasOwn(current, part)
+                ? (current[part] ?? null)
+                : null;
+            currentPath = `${currentPath === '/' ? '' : currentPath}/${part}`;
+        }
+        return new DataSnapshot(current, currentPath, this._root);
+    }
+    parent() {
+        if (this._path === '/')
+            return null;
+        const parts = this._path.split('/').filter(p => p.length > 0);
+        parts.pop();
+        const parentPath = '/' + parts.join('/');
+        const rootSnap = new DataSnapshot(this._root, '/');
+        if (parentPath === '/')
+            return rootSnap;
+        return rootSnap.child(parts.join('/'));
+    }
+    getPriority() {
+        return null;
+    }
+}
+class RtdbString {
+    value;
+    constructor(value) {
+        this.value = value;
+    }
+    matches(pattern) {
+        const r = pattern instanceof RegExp ? pattern : new RegExp(pattern);
+        return r.test(this.value);
+    }
+    contains(other) {
+        return this.value.includes(other);
+    }
+    beginsWith(prefix) {
+        return this.value.startsWith(prefix);
+    }
+    endsWith(suffix) {
+        return this.value.endsWith(suffix);
+    }
+    replace(from, to) {
+        return this.value.replace(from, to);
+    }
+    toLowerCase() {
+        return this.value.toLowerCase();
+    }
+    get length() {
+        return this.value.length;
+    }
+}
+let _evalCtx = {
+    auth: null,
+    data: new DataSnapshot(null),
+    newData: new DataSnapshot(null),
+    root: new DataSnapshot(null),
+    now: Date.now(),
+    pathVariableBindings: {},
+};
+const evalSemantics = grammar.createSemantics();
+evalSemantics.addOperation('eval', {
+    Expr(node) { return node.eval(); },
+    Ternary_ternary(cond, _q, then, _c, els) {
+        return cond.eval() ? then.eval() : els.eval();
+    },
+    Ternary(node) { return node.eval(); },
+    Logical_and(left, _op, right) { return left.eval() && right.eval(); },
+    Logical_or(left, _op, right) { return left.eval() || right.eval(); },
+    Logical(node) { return node.eval(); },
+    Comparison_strictEq(left, _op, right) { return left.eval() === right.eval(); },
+    Comparison_strictNeq(left, _op, right) { return left.eval() !== right.eval(); },
+    Comparison_gte(left, _op, right) { return left.eval() >= right.eval(); },
+    Comparison_lte(left, _op, right) { return left.eval() <= right.eval(); },
+    Comparison_gt(left, _op, right) { return left.eval() > right.eval(); },
+    Comparison_lt(left, _op, right) { return left.eval() < right.eval(); },
+    Comparison_looseEq(left, _op, right) { return left.eval() == right.eval(); },
+    Comparison_looseNeq(left, _op, right) { return left.eval() != right.eval(); },
+    Comparison(node) { return node.eval(); },
+    Additive_add(left, _op, right) { return left.eval() + right.eval(); },
+    Additive_sub(left, _op, right) { return left.eval() - right.eval(); },
+    Additive(node) { return node.eval(); },
+    Multiplicative_mul(left, _op, right) { return left.eval() * right.eval(); },
+    Multiplicative_div(left, _op, right) { return left.eval() / right.eval(); },
+    Multiplicative_mod(left, _op, right) { return left.eval() % right.eval(); },
+    Multiplicative(node) { return node.eval(); },
+    UnaryExpr_not(_op, expr) { return !expr.eval(); },
+    UnaryExpr_neg(_op, expr) { return -expr.eval(); },
+    UnaryExpr(node) { return node.eval(); },
+    CallExpr_methodCall(receiver, _dot, methodName, _open, args, _close) {
+        const recv = receiver.eval();
+        const method = methodName.sourceString;
+        const argValues = args.asIteration().children.map((a) => a.eval());
+        if (recv instanceof DataSnapshot) {
+            switch (method) {
+                case 'val': return recv.val();
+                case 'exists': return recv.exists();
+                case 'hasChild': return recv.hasChild(String(argValues[0]));
+                case 'hasChildren': return recv.hasChildren(argValues.length > 0 ? argValues[0] : undefined);
+                case 'isString': return recv.isString();
+                case 'isNumber': return recv.isNumber();
+                case 'isBoolean': return recv.isBoolean();
+                case 'child': return recv.child(String(argValues[0]));
+                case 'parent': return recv.parent();
+                case 'getPriority': return recv.getPriority();
+                default: throw new Error(`Unknown DataSnapshot method: ${method}`);
+            }
+        }
+        if (typeof recv === 'string') {
+            const str = new RtdbString(recv);
+            switch (method) {
+                case 'matches': return str.matches(argValues[0]);
+                case 'contains': return str.contains(String(argValues[0]));
+                case 'beginsWith': return str.beginsWith(String(argValues[0]));
+                case 'endsWith': return str.endsWith(String(argValues[0]));
+                case 'replace': return str.replace(argValues[0], String(argValues[1]));
+                case 'toLowerCase': return str.toLowerCase();
+                default: throw new Error(`Unknown string method: ${method}`);
+            }
+        }
+        // No generic method-call fallback. Dispatching to an arbitrary JS
+        // method on an arbitrary receiver (`recv[method].apply(recv, ...)`)
+        // is a sandbox-escape primitive: e.g. `(0).constructor.constructor(...)`
+        // reaches the `Function` constructor and executes attacker-supplied
+        // code. Only the RTDB-rules methods explicitly allowlisted above
+        // (DataSnapshot and string methods) may be called.
+        throw new Error(`Unknown method '${method}' for the given value.`);
+    },
+    CallExpr_memberAccess(receiver, _dot, member) {
+        const recv = receiver.eval();
+        if (recv === null || recv === undefined)
+            return null;
+        return safeMemberRead(recv, member.sourceString);
+    },
+    CallExpr_indexAccess(receiver, _open, index, _close) {
+        const recv = receiver.eval();
+        const idx = index.eval();
+        if (recv === null || recv === undefined)
+            return null;
+        return safeMemberRead(recv, String(idx));
+    },
+    CallExpr(node) { return node.eval(); },
+    Primary_paren(_open, expr, _close) { return expr.eval(); },
+    Primary(node) { return node.eval(); },
+    Array(_open, elems, _close) {
+        return elems.asIteration().children.map((e) => e.eval());
+    },
+    literal(node) { return node.eval(); },
+    number_float(_int, _dot, _frac) { return parseFloat(this.sourceString); },
+    number_int(_digits) { return parseInt(this.sourceString, 10); },
+    number(node) { return node.eval(); },
+    string_double(_open, _chars, _close) {
+        return JSON.parse(this.sourceString);
+    },
+    string_single(_open, chars, _close) {
+        return chars.children.map((c) => c.sourceString).join('');
+    },
+    string(node) { return node.eval(); },
+    regex(_slash1, body, _slash2, flags) {
+        return new RegExp(body.sourceString, flags.sourceString);
+    },
+    bool_true(_lit) { return true; },
+    bool_false(_lit) { return false; },
+    bool(node) { return node.eval(); },
+    null(_lit) { return null; },
+    ident(_dollar, _start, _rest) {
+        const name = this.sourceString;
+        if (name in _evalCtx.pathVariableBindings) {
+            return _evalCtx.pathVariableBindings[name];
+        }
+        switch (name) {
+            case 'auth': return _evalCtx.auth;
+            case 'data': return _evalCtx.data;
+            case 'newData': return _evalCtx.newData;
+            case 'root': return _evalCtx.root;
+            case 'now': return _evalCtx.now;
+            default: return undefined;
+        }
+    },
+});
+export function evaluateExpression(match, ctx) {
+    _evalCtx = ctx;
+    return evalSemantics(match).eval();
+}
+//# sourceMappingURL=simulator.js.map