pyric 0.0.1 → 0.1.0-alpha.7

package/dist/database/tools.js

@@ -0,0 +1,272 @@
+import { buildRuleExpression } from './mapper.js';
+import { getRtdbTools } from './resolver.js';
+/** JSON Schema for the optional per-call `auth` argument shared by
+ *  every data tool. When supplied, the operation goes through
+ *  `host.getClientForUser(auth)` so rules are enforced; when omitted,
+ *  admin access is used. */
+const AUTH_SCHEMA = {
+    description: 'When provided, request is made as this user with security rules enforced. When omitted, uses admin access (rules bypassed). Requires FIREBASE_API_KEY env var on the host.',
+    type: 'object',
+    properties: {
+        uid: { type: 'string', description: 'User ID to act as' },
+        claims: { type: 'object', description: 'Custom claims for the user', additionalProperties: true },
+    },
+    required: ['uid'],
+};
+/** Reject a crawl path that could steer the underlying REST fetch off
+ *  the database origin. `fetchDatabase` origin-pins as the real backstop;
+ *  this rejects the obvious cases at the agent-facing boundary with a
+ *  clear error instead of letting them reach the network layer. */
+function assertSafeCrawlPath(path) {
+    // Protocol-relative (`//host`), backslashes, whitespace, and control
+    // chars are never valid in an RTDB path and are the SSRF-shaped inputs.
+    if (/^\s*\/\//.test(path) || /[\\\s\u0000-\u001F\u007F]/.test(path)) {
+        throw new Error(`Invalid crawl path '${path}': RTDB paths cannot contain '//', backslashes, whitespace, or control characters.`);
+    }
+}
+export function createRtdbRulesTools(deps) {
+    const { host } = deps;
+    const db = getRtdbTools(host);
+    return [
+        {
+            name: 'rtdb_build_expression',
+            description: 'Construct a validated Realtime Database rule expression from a raw string. Returns the expression with parse results, validation errors, linter warnings, and referenced identifiers. Use this when building or modifying security rules to ensure expressions are correct before deploying.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    expression: { type: 'string', description: 'The rule expression, e.g. "auth.uid === $userId"' },
+                    context: { type: 'string', enum: ['read', 'write', 'validate'], description: 'Which rule type this expression is for' },
+                    pathVariables: { type: 'array', items: { type: 'string' }, description: 'Path variables in scope, e.g. ["$userId"]' },
+                },
+                required: ['expression', 'context'],
+            },
+            async execute(args) {
+                const { expression, context, pathVariables } = args;
+                const data = buildRuleExpression(expression, context, pathVariables);
+                return { ok: true, summary: `Built ${context} expression`, data };
+            },
+        },
+        {
+            name: 'rtdb_get_rules',
+            description: 'Fetch and parse the security rules for this Realtime Database. Returns a tree of rule expressions with validation results, linter warnings, and referenced variables. Use this to understand access controls before modifying them.',
+            parameters: { type: 'object', properties: {} },
+            async execute() {
+                const result = await db.generateIR();
+                return {
+                    ok: result.success,
+                    summary: result.success ? 'Generated rule IR' : `IR generation failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'rtdb_simulate_access',
+            description: 'Test whether a user with given auth credentials would be allowed to read, write, or validate at a specific database path. Evaluates security rules locally against mock data without touching the live database. Requires `rtdb_get_rules` to be called first to load the rules.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    path: { type: 'string' },
+                    operation: { type: 'string', enum: ['read', 'write', 'validate'] },
+                    auth: AUTH_SCHEMA,
+                    data: { description: 'Mock value at the path (or proposed value for write)' },
+                },
+                required: ['path', 'operation'],
+            },
+            async execute(args) {
+                const result = db.simulate(args);
+                return {
+                    ok: result.success,
+                    summary: result.success ? `Simulation: ${result.data.allowed ? 'allowed' : 'denied'}` : `Simulation failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'rtdb_deploy_rules',
+            description: 'Deploy security rules to the Realtime Database via REST API. Takes a complete rules IR and writes it. Always use `rtdb_simulate_access` first to verify rules behave correctly before deploying.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    service: { type: 'string', enum: ['realtime-database'] },
+                    databaseUrl: { type: 'string' },
+                    rules: { description: 'Rule tree' },
+                },
+                required: ['service', 'databaseUrl', 'rules'],
+            },
+            async execute(args) {
+                const result = await db.writeRules(args);
+                return {
+                    ok: result.success,
+                    summary: result.success ? 'Rules deployed' : `Deploy failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+    ];
+}
+export function createRtdbDataTools(deps) {
+    const { host } = deps;
+    const db = getRtdbTools(host);
+    return [
+        {
+            name: 'rtdb_crawl_structure',
+            description: 'Discover the shape of the Realtime Database by recursively fetching paths without downloading values. Returns a tree of paths with child counts. Use this to understand what data exists before generating code or writing rules.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    path: { type: 'string', description: 'Starting path, defaults to root /' },
+                    maxDepth: { type: 'number', description: 'How many levels deep to crawl, defaults to 10' },
+                    maxChildren: { type: 'number', description: 'Max children to explore per node, defaults to 100' },
+                },
+            },
+            async execute(args) {
+                const params = (args ?? {});
+                if (params.path !== undefined)
+                    assertSafeCrawlPath(params.path);
+                const result = await db.crawlStructure(params);
+                return {
+                    ok: result.success,
+                    summary: result.success ? 'Crawled structure' : `Crawl failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'rtdb_get',
+            description: 'Read data at a database path. Returns the value stored at that location, or null if the path is empty. Use this to inspect actual data values, not just structure. Pass `auth` to read as a specific user with security rules enforced.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    path: { type: 'string', description: 'Database path to read, e.g. "/users/alice"' },
+                    auth: AUTH_SCHEMA,
+                },
+                required: ['path'],
+            },
+            async execute(args) {
+                const { path, auth } = args;
+                const result = await db.readData(path, { auth });
+                return {
+                    ok: result.success,
+                    summary: result.success ? `Read ${path}` : `Read failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'rtdb_set',
+            description: 'Replace data at a database path. Overwrites everything at that location with the provided value. Use `rtdb_update` instead if you only want to change specific fields. Pass `auth` to write as a specific user with security rules enforced.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    path: { type: 'string', description: 'Database path to write to, e.g. "/users/alice"' },
+                    data: { description: 'The data to write (replaces existing)' },
+                    auth: AUTH_SCHEMA,
+                },
+                required: ['path', 'data'],
+            },
+            async execute(args) {
+                const { path, data, auth } = args;
+                const result = await db.setData(path, data, { auth });
+                return {
+                    ok: result.success,
+                    summary: result.success ? `Set ${path}` : `Set failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'rtdb_update',
+            description: 'Merge data at a database path, or perform an atomic multi-location update. When path is "/" and keys are root-relative paths, all paths are written atomically — the fan-out write mechanism for keeping denormalized data consistent. When path is a specific location, only the specified keys at that location are merged. Pass `auth` to write as a specific user with security rules enforced.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    path: { type: 'string', description: 'Use "/" with root-relative keys for atomic multi-location updates, or a specific path like "/users/alice" for a merge.' },
+                    data: { type: 'object', description: 'Key-value pairs to merge', additionalProperties: true },
+                    auth: AUTH_SCHEMA,
+                },
+                required: ['path', 'data'],
+            },
+            async execute(args) {
+                const { path, data, auth } = args;
+                const result = await db.updateData(path, data, { auth });
+                return {
+                    ok: result.success,
+                    summary: result.success ? `Updated ${path}` : `Update failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'rtdb_push',
+            description: 'Create a new child at a database path with an auto-generated unique key. Returns the generated key name. Use this for list-like data (e.g. adding a new post to /posts). Pass `auth` to write as a specific user with security rules enforced.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    path: { type: 'string', description: 'Database path to push to, e.g. "/posts"' },
+                    data: { description: 'The data for the new child entry' },
+                    auth: AUTH_SCHEMA,
+                },
+                required: ['path', 'data'],
+            },
+            async execute(args) {
+                const { path, data, auth } = args;
+                const result = await db.pushData(path, data, { auth });
+                return {
+                    ok: result.success,
+                    summary: result.success ? `Pushed to ${path}` : `Push failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'rtdb_delete',
+            description: 'Delete data at a database path. Removes the value and all children at that location. Pass `auth` to delete as a specific user with security rules enforced.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    path: { type: 'string', description: 'Database path to delete, e.g. "/users/alice"' },
+                    auth: AUTH_SCHEMA,
+                },
+                required: ['path'],
+            },
+            async execute(args) {
+                const { path, auth } = args;
+                const result = await db.removeData(path, { auth });
+                return {
+                    ok: result.success,
+                    summary: result.success ? `Deleted ${path}` : `Delete failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'rtdb_validated_write',
+            description: 'Write data with pre-flight safety checks. Infers the schema at the target path, validates that your data matches the expected types, simulates security rules to verify permission, then executes the write. The `auth` param controls mode: when provided, the write enforces real security rules (simulation is advisory since cross-path lookups use empty mock data). When omitted, uses admin access and simulation denial blocks the write. Returns schema warnings and simulation results alongside the write outcome.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    path: { type: 'string' },
+                    operation: { type: 'string', enum: ['set', 'update', 'push'] },
+                    data: { description: 'The write payload' },
+                    auth: AUTH_SCHEMA,
+                },
+                required: ['path', 'operation', 'data'],
+            },
+            async execute(args) {
+                const result = await db.validatedWrite(args);
+                return {
+                    ok: result.success,
+                    summary: result.success ? 'Validated write committed' : `Validated write failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+    ];
+}
+export function createRtdbAdminTools(deps) {
+    return [
+        ...createRtdbRulesTools(deps),
+        ...createRtdbDataTools(deps),
+    ];
+}
+//# sourceMappingURL=tools.js.map

package/dist/database/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/database/tools.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAa7C;;;4BAG4B;AAC5B,MAAM,WAAW,GAAG;IAClB,WAAW,EACT,4KAA4K;IAC9K,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;QACzD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,IAAI,EAAE;KAClG;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;CAClB,CAAC;AAEF;;;mEAGmE;AACnE,SAAS,mBAAmB,CAAC,IAAY;IACvC,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,oFAAoF,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO;QACL;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EACT,8RAA8R;YAChS,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kDAAkD,EAAE;oBAC/F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE;oBACvH,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE;iBACtH;gBACD,QAAQ,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;aACpC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAI9C,CAAC;gBACF,MAAM,IAAI,GAAG,mBAAmB,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;gBACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,OAAO,aAAa,EAAE,IAAI,EAAE,CAAC;YACpE,CAAC;SACF;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,WAAW,EACT,qOAAqO;YACvO,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAC9C,KAAK,CAAC,OAAO;gBACX,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC;gBACrC,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBAC5F,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EACT,kRAAkR;YACpR,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE;oBAClE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,EAAE,WAAW,EAAE,sDAAsD,EAAE;iBAC9E;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;aAChC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACjC,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBACjI,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,WAAW,EACT,kMAAkM;YACpM,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,mBAAmB,CAAC,EAAE;oBACxD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC/B,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;iBACpC;gBACD,QAAQ,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC;aAC9C;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAc,CAAC,CAAC;gBACnD,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBAClF,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAsB;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO;QACL;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EACT,mOAAmO;YACrO,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;oBAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+CAA+C,EAAE;oBAC1F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mDAAmD,EAAE;iBAClG;aACF;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAA+D,CAAC;gBAC1F,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;oBAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC/C,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBACpF,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,UAAU;YAChB,WAAW,EACT,yOAAyO;YAC3O,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4CAA4C,EAAE;oBACnF,IAAI,EAAE,WAAW;iBAClB;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAyC,CAAC;gBACjE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBAC9E,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,UAAU;YAChB,WAAW,EACT,8OAA8O;YAChP,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gDAAgD,EAAE;oBACvF,IAAI,EAAE,EAAE,WAAW,EAAE,uCAAuC,EAAE;oBAC9D,IAAI,EAAE,WAAW;iBAClB;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;aAC3B;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAwD,CAAC;gBACtF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtD,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBAC5E,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EACT,qYAAqY;YACvY,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wHAAwH,EAAE;oBAC/J,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,IAAI,EAAE;oBAC7F,IAAI,EAAE,WAAW;iBAClB;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;aAC3B;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAwE,CAAC;gBACtG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzD,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBACnF,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,WAAW;YACjB,WAAW,EACT,gPAAgP;YAClP,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;oBAChF,IAAI,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE;oBACzD,IAAI,EAAE,WAAW;iBAClB;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;aAC3B;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAwD,CAAC;gBACtF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBACnF,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EACT,6JAA6J;YAC/J,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8CAA8C,EAAE;oBACrF,IAAI,EAAE,WAAW;iBAClB;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAyC,CAAC;gBACjE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBACnF,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EACT,+fAA+f;YACjgB,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;oBAC9D,IAAI,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;oBAC1C,IAAI,EAAE,WAAW;iBAClB;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC;aACxC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,IAA+C,CAAC,CAAC;gBACxF,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBACtG,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,OAAO;QACL,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAC7B,GAAG,mBAAmB,CAAC,IAAI,CAAC;KAC7B,CAAC;AACJ,CAAC"}

package/dist/database/types.d.ts

@@ -0,0 +1,210 @@
+import { z } from 'zod';
+/** Identity for user-mode RTDB operations. When supplied to a data
+ *  tool, the operation is performed AS this user with security rules
+ *  enforced. Omit for admin access. */
+export interface UserAuth {
+    uid: string;
+    claims?: Record<string, unknown>;
+}
+export declare const RuleErrorSchema: z.ZodObject<{
+    code: z.ZodString;
+    message: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+}, {
+    code: string;
+    message: string;
+}>;
+export declare const RuleLintSchema: z.ZodObject<{
+    code: z.ZodString;
+    message: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+}, {
+    code: string;
+    message: string;
+}>;
+export declare const ParsedExpressionSchema: z.ZodObject<{
+    raw: z.ZodString;
+    valid: z.ZodBoolean;
+    errors: z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        code: string;
+        message: string;
+    }, {
+        code: string;
+        message: string;
+    }>, "many">;
+    warnings: z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        code: string;
+        message: string;
+    }, {
+        code: string;
+        message: string;
+    }>, "many">;
+    referencedIdentifiers: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    valid: boolean;
+    raw: string;
+    warnings: {
+        code: string;
+        message: string;
+    }[];
+    errors: {
+        code: string;
+        message: string;
+    }[];
+    referencedIdentifiers: string[];
+}, {
+    valid: boolean;
+    raw: string;
+    warnings: {
+        code: string;
+        message: string;
+    }[];
+    errors: {
+        code: string;
+        message: string;
+    }[];
+    referencedIdentifiers: string[];
+}>;
+export declare const RtdbRuleExpressionSchema: z.ZodObject<{
+    raw: z.ZodString;
+    parsed: z.ZodObject<{
+        raw: z.ZodString;
+        valid: z.ZodBoolean;
+        errors: z.ZodArray<z.ZodObject<{
+            code: z.ZodString;
+            message: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            code: string;
+            message: string;
+        }, {
+            code: string;
+            message: string;
+        }>, "many">;
+        warnings: z.ZodArray<z.ZodObject<{
+            code: z.ZodString;
+            message: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            code: string;
+            message: string;
+        }, {
+            code: string;
+            message: string;
+        }>, "many">;
+        referencedIdentifiers: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        valid: boolean;
+        raw: string;
+        warnings: {
+            code: string;
+            message: string;
+        }[];
+        errors: {
+            code: string;
+            message: string;
+        }[];
+        referencedIdentifiers: string[];
+    }, {
+        valid: boolean;
+        raw: string;
+        warnings: {
+            code: string;
+            message: string;
+        }[];
+        errors: {
+            code: string;
+            message: string;
+        }[];
+        referencedIdentifiers: string[];
+    }>;
+}, "strip", z.ZodTypeAny, {
+    raw: string;
+    parsed: {
+        valid: boolean;
+        raw: string;
+        warnings: {
+            code: string;
+            message: string;
+        }[];
+        errors: {
+            code: string;
+            message: string;
+        }[];
+        referencedIdentifiers: string[];
+    };
+}, {
+    raw: string;
+    parsed: {
+        valid: boolean;
+        raw: string;
+        warnings: {
+            code: string;
+            message: string;
+        }[];
+        errors: {
+            code: string;
+            message: string;
+        }[];
+        referencedIdentifiers: string[];
+    };
+}>;
+export type RuleError = z.infer<typeof RuleErrorSchema>;
+export type RuleLint = z.infer<typeof RuleLintSchema>;
+export type ParsedExpression = z.infer<typeof ParsedExpressionSchema>;
+export type RtdbRuleExpression = z.infer<typeof RtdbRuleExpressionSchema>;
+export type RtdbNode = {
+    path: string;
+    pathVariables: string[];
+    exists: boolean;
+    read?: RtdbRuleExpression;
+    write?: RtdbRuleExpression;
+    validate?: RtdbRuleExpression;
+    indexOn?: string[];
+    children: RtdbNode[];
+};
+export declare const RtdbIRSchema: z.ZodObject<{
+    service: z.ZodLiteral<"realtime-database">;
+    databaseUrl: z.ZodString;
+    rules: z.ZodAny;
+}, "strip", z.ZodTypeAny, {
+    service: "realtime-database";
+    databaseUrl: string;
+    rules?: any;
+}, {
+    service: "realtime-database";
+    databaseUrl: string;
+    rules?: any;
+}>;
+export type RtdbIR = z.infer<typeof RtdbIRSchema>;
+export interface DataAuthOptions {
+    auth?: UserAuth;
+}
+export interface RtdbTools {
+    generateIR(): Promise<import('./ir/spec.js').GenerateIRResult>;
+    simulate(input: unknown): import('./simulation/spec.js').SimulateResult;
+    writeRules(ir: RtdbIR): Promise<import('./write/spec.js').WriteRulesResult>;
+    crawlStructure(options?: import('./crawl/spec.js').CrawlOptions & DataAuthOptions): Promise<import('./crawl/spec.js').CrawlStructureResult>;
+    readData(path: string, options?: DataAuthOptions): Promise<import('./data/spec.js').DataResult>;
+    setData(path: string, data: unknown, options?: DataAuthOptions): Promise<import('./data/spec.js').DataResult>;
+    updateData(path: string, data: Record<string, unknown>, options?: DataAuthOptions): Promise<import('./data/spec.js').DataResult>;
+    pushData(path: string, data: unknown, options?: DataAuthOptions): Promise<import('./data/spec.js').DataResult>;
+    removeData(path: string, options?: DataAuthOptions): Promise<import('./data/spec.js').DataResult>;
+    validatedWrite(input: import('./data/spec.js').ValidatedWriteInput): Promise<import('./data/spec.js').ValidatedWriteResult>;
+}
+export type GenerateIRResult = import('./ir/spec.js').GenerateIRResult;
+export type SimulateResult = import('./simulation/spec.js').SimulateResult;
+export type SimulationInput = import('./simulation/spec.js').SimulationInput;
+export type WriteRulesResult = import('./write/spec.js').WriteRulesResult;
+export type CrawlStructureResult = import('./crawl/spec.js').CrawlStructureResult;
+export type CrawlOptions = import('./crawl/spec.js').CrawlOptions;
+export type StructureNode = import('./crawl/spec.js').StructureNode;
+//# sourceMappingURL=types.d.ts.map

package/dist/database/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/database/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;uCAEuC;AACvC,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,eAAe;;;;;;;;;EAG1B,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;EAGzB,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMjC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGnC,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,QAAQ,EAAE,CAAC;CACtB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;EAIvB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,IAAI,OAAO,CAAC,OAAO,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,sBAAsB,EAAE,cAAc,CAAC;IACxE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,iBAAiB,EAAE,YAAY,GAAG,eAAe,GAAG,OAAO,CAAC,OAAO,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAC5I,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC9G,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,gBAAgB,EAAE,UAAU,CAAC,CAAC;IACjI,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/G,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAClG,cAAc,CAAC,KAAK,EAAE,OAAO,gBAAgB,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;CAC7H;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,cAAc,EAAE,gBAAgB,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG,OAAO,sBAAsB,EAAE,cAAc,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,OAAO,sBAAsB,EAAE,eAAe,CAAC;AAC7E,MAAM,MAAM,gBAAgB,GAAG,OAAO,iBAAiB,EAAE,gBAAgB,CAAC;AAC1E,MAAM,MAAM,oBAAoB,GAAG,OAAO,iBAAiB,EAAE,oBAAoB,CAAC;AAClF,MAAM,MAAM,YAAY,GAAG,OAAO,iBAAiB,EAAE,YAAY,CAAC;AAClE,MAAM,MAAM,aAAa,GAAG,OAAO,iBAAiB,EAAE,aAAa,CAAC"}

package/dist/database/types.js

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+export const RuleErrorSchema = z.object({
+    code: z.string(),
+    message: z.string(),
+});
+export const RuleLintSchema = z.object({
+    code: z.string(),
+    message: z.string(),
+});
+export const ParsedExpressionSchema = z.object({
+    raw: z.string(),
+    valid: z.boolean(),
+    errors: z.array(RuleErrorSchema),
+    warnings: z.array(RuleLintSchema),
+    referencedIdentifiers: z.array(z.string()),
+});
+export const RtdbRuleExpressionSchema = z.object({
+    raw: z.string(),
+    parsed: ParsedExpressionSchema,
+});
+export const RtdbIRSchema = z.object({
+    service: z.literal('realtime-database'),
+    databaseUrl: z.string().url(),
+    rules: z.any(),
+});
+//# sourceMappingURL=types.js.map

package/dist/database/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/database/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IACjC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,sBAAsB;CAC/B,CAAC,CAAC;AAkBH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE;CACf,CAAC,CAAC"}

package/dist/database/write/handler.d.ts

@@ -0,0 +1,7 @@
+import type { RtdbHost } from '../host.js';
+import type { RtdbIR } from '../types.js';
+import type { WriteRulesResult, WriteRulesSpec } from './spec.js';
+export declare class WriteRulesHandler implements WriteRulesSpec {
+    execute(host: RtdbHost, ir: RtdbIR): Promise<WriteRulesResult>;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/database/write/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/database/write/handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAElE,qBAAa,iBAAkB,YAAW,cAAc;IAChD,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAyCrE"}

package/dist/database/write/handler.js

@@ -0,0 +1,42 @@
+import { RtdbMapper } from '../mapper.js';
+export class WriteRulesHandler {
+    async execute(host, ir) {
+        try {
+            const rulesJson = RtdbMapper.mapToRulesJSON(ir);
+            const token = await host.resolveAdminToken();
+            const url = `${host.databaseUrl}/.settings/rules.json?access_token=${token}`;
+            const res = await fetch(url, {
+                method: 'PUT',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(rulesJson),
+            });
+            if (res.status === 403) {
+                return {
+                    success: false,
+                    error: { code: 'PERMISSION_DENIED', message: `Permission denied: ${res.statusText}`, recoverable: false },
+                };
+            }
+            if (res.status === 400) {
+                const body = await res.text().catch(() => '');
+                return {
+                    success: false,
+                    error: { code: 'INVALID_RULES_JSON', message: `Invalid rules: ${body}`, recoverable: true },
+                };
+            }
+            if (!res.ok) {
+                return {
+                    success: false,
+                    error: { code: 'WRITE_FAILED', message: `Write failed: ${res.status} ${res.statusText}`, recoverable: false },
+                };
+            }
+            return { success: true };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: { code: 'WRITE_FAILED', message: e instanceof Error ? e.message : String(e), recoverable: false },
+            };
+        }
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/database/write/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/database/write/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK1C,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,OAAO,CAAC,IAAc,EAAE,EAAU;QACtC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,sCAAsC,KAAK,EAAE,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;aAChC,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sBAAsB,GAAG,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;iBAC1G,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;iBAC5F,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;iBAC9G,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;aACzG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/database/write/spec.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+import type { RtdbHost } from '../host.js';
+import type { RtdbIR } from '../types.js';
+export declare const WriteRulesErrorCode: z.ZodEnum<["WRITE_FAILED", "PERMISSION_DENIED", "INVALID_RULES_JSON"]>;
+export type WriteRulesResult = {
+    success: true;
+} | {
+    success: false;
+    error: {
+        code: z.infer<typeof WriteRulesErrorCode>;
+        message: string;
+        recoverable: boolean;
+    };
+};
+export interface WriteRulesSpec {
+    execute(host: RtdbHost, ir: RtdbIR): Promise<WriteRulesResult>;
+}
+//# sourceMappingURL=spec.d.ts.map

package/dist/database/write/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/database/write/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,eAAO,MAAM,mBAAmB,wEAI9B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAEpH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAChE"}

package/dist/database/write/spec.js

@@ -0,0 +1,7 @@
+import { z } from 'zod';
+export const WriteRulesErrorCode = z.enum([
+    'WRITE_FAILED',
+    'PERMISSION_DENIED',
+    'INVALID_RULES_JSON',
+]);
+//# sourceMappingURL=spec.js.map

package/dist/database/write/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/database/write/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACxC,cAAc;IACd,mBAAmB;IACnB,oBAAoB;CACrB,CAAC,CAAC"}