pyric 0.0.1 → 0.1.0-alpha.7

package/dist/rules/test/spec.js

@@ -0,0 +1,227 @@
+import { z } from 'zod';
+// ---- Canonical shared primitives ----
+/**
+ * THE Firestore rules method union — the one canonical declaration.
+ * Everything that talks about per-method access (the simulator's
+ * `TestCase`, the playground's workspace-test runner, the app-spec
+ * access matrix) imports this; nothing redeclares it.
+ *
+ * Note: this is the RULES vocabulary (`request.method`). Data-plane
+ * vocabularies that include `set` (sandbox `RequestEvent`, traffic
+ * types) are deliberately distinct — `set` lowers to create/update at
+ * rules-evaluation time.
+ */
+export const FIRESTORE_METHODS = ['get', 'list', 'create', 'update', 'delete'];
+/**
+ * THE test-identity shape — a signed-in principal for a rules check.
+ * Custom claims live under `token` and read as
+ * `request.auth.token.<name>` in rules. `null` at usage sites means
+ * unauthenticated; the shape itself is always a signed-in identity.
+ */
+export const TestIdentitySchema = z.object({
+    uid: z.string(),
+    token: z.record(z.unknown()).optional(),
+});
+// ---- Simplified agent-friendly types ----
+export const FunctionMockSchema = z.object({
+    function: z.enum(['get', 'exists']).describe('Firestore function to mock'),
+    path: z.string().describe('Document path, e.g. "users/alice"'),
+    result: z.union([z.record(z.unknown()), z.boolean()]).describe('Document data for get, boolean for exists'),
+});
+/**
+ * Item 0.D / Item 7 — typed write-mode discriminator.
+ *
+ * Without this, an `update` test had to pre-merge its payload into the
+ * post-state by hand (because the simulator just used `tc.data` as the
+ * after-state). That works for shallow updates, but for nested-map
+ * updates and dot-path updates it silently produces the wrong shape —
+ * which then makes `request.resource.data.x.y` and `getAfter()` lie.
+ *
+ * The four modes mirror what the Firestore admin SDK actually emits:
+ *   create               → write fails if doc exists; after = payload
+ *   set { merge: false } → full replace; pre-state irrelevant
+ *   set { merge: true }  → recursive merge of pre-state and payload
+ *   update               → top-level keys replace; dot-paths patch nested maps
+ *
+ * `writeMode` is optional. When omitted, the simulator falls back to the
+ * legacy "tc.data IS the full after-state" behavior, which keeps every
+ * existing test passing. New tests SHOULD set writeMode whenever the
+ * rule reads nested maps or calls getAfter()/existsAfter().
+ */
+export const WriteModeSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('create') }),
+    z.object({ kind: z.literal('set'), merge: z.boolean() }),
+    z.object({ kind: z.literal('update') }),
+    z.object({ kind: z.literal('delete') }),
+]);
+/**
+ * Shape of `request.query` — only populated for `list` operations
+ * (REBUILD_PLAN.md Item 6 follow-up). Production exposes:
+ *   - limit:   the requested page size
+ *   - offset:  the start offset within the result set
+ *   - orderBy: the orderBy clause as a string (field name with optional direction)
+ *
+ * Unset fields read as `null` from rules. Tests SHOULD set this whenever the
+ * rule under evaluation references `request.query.<x>`; otherwise the field
+ * read returns null and the rule may silently DENY.
+ */
+export const ListQuerySchema = z.object({
+    limit: z.number().optional(),
+    offset: z.number().optional(),
+    orderBy: z.string().optional(),
+});
+export const TestCaseSchema = z.object({
+    description: z.string().describe('Human-readable description of what this test verifies'),
+    expectation: z.enum(['ALLOW', 'DENY']).describe('Expected outcome'),
+    method: z.enum(FIRESTORE_METHODS).describe('Firestore method to test'),
+    path: z.string().describe('Document path, e.g. "users/alice"'),
+    auth: z.union([TestIdentitySchema, z.null()]).optional().describe('Auth context; null or omitted for unauthenticated'),
+    data: z.record(z.unknown()).optional().describe('request.resource.data for write operations'),
+    resource: z.record(z.unknown()).optional().describe('Existing document data (resource.data)'),
+    functionMocks: z.array(FunctionMockSchema).optional().describe('Mock get()/exists() calls in rules'),
+    /**
+     * Optional `request.query` payload for `list` operations only. Populating
+     * this is the only way to satisfy rules that read `request.query.limit /
+     * .offset / .orderBy` — without it, the field read returns null and a
+     * naive `request.query.limit < 100` evaluates as `null < 100 → false → DENY`.
+     * Ignored for non-list methods.
+     */
+    query: ListQuerySchema.optional().describe('request.query payload (list ops only): limit/offset/orderBy.'),
+    /**
+     * Override for `request.time` (REBUILD_PLAN.md Item 0.F). ISO-8601 string.
+     * Defaults to wallclock when omitted — but date-gated rules then evaluate
+     * non-deterministically across CI runs. Set this whenever the rule under
+     * test references `request.time`.
+     */
+    requestTime: z.string().optional().describe('Override for request.time (ISO-8601). Defaults to wallclock.'),
+    /**
+     * Optional explicit write semantics (REBUILD_PLAN.md Item 0.D / Item 7).
+     * When set, the simulator runs `projectAfterState(writeMode, resource, data)`
+     * to derive both `request.resource.data` AND the value `getAfter(path)`
+     * returns. When omitted, the simulator preserves legacy behavior:
+     * `tc.data` IS the after-state.
+     */
+    writeMode: WriteModeSchema.optional().describe('Optional write-mode override; controls update merge semantics and getAfter() projection.'),
+});
+/**
+ * Project the DECIDING rule from a simulated {@link TestResult}.
+ *
+ * For an ALLOW, picks the `ALLOW` trace entry (evaluation short-circuits on the
+ * first allowing rule, so it's unique). For a DENY, picks the rule the sandbox
+ * would report as responsible: the first `DENY`/`ERROR` entry, falling back to
+ * the last evaluated rule. Returns `undefined` when no rule was evaluated
+ * (implicit deny — no matching `allow`) or the simulator abstained
+ * (`UNSUPPORTED`). Never invents data: a missing line/trace stays absent.
+ */
+export function projectEvaluatedRule(result) {
+    if (result.decision === 'UNSUPPORTED')
+        return undefined;
+    const allowed = result.decision === 'ALLOW';
+    const deciding = allowed
+        ? result.trace.find((t) => t.verdict === 'ALLOW')
+        : (result.trace.find((t) => t.verdict === 'DENY' || t.verdict === 'ERROR') ??
+            result.trace[result.trace.length - 1]);
+    if (!deciding)
+        return undefined;
+    const info = { verdict: allowed ? 'allow' : 'deny' };
+    if (deciding.line !== undefined)
+        info.line = deciding.line;
+    if (deciding.conditionText !== undefined)
+        info.expression = deciding.conditionText;
+    if (deciding.expressionTrace !== undefined)
+        info.expressionTrace = deciding.expressionTrace;
+    return info.line !== undefined || info.expression !== undefined || info.expressionTrace !== undefined
+        ? info
+        : undefined;
+}
+export function renderLegacyDebugMessages(result) {
+    const out = [];
+    for (const note of result.notes)
+        out.push(note);
+    for (const entry of result.trace) {
+        const ops = entry.operations.join(',');
+        const head = `Rule #${entry.ruleIndex} (${ops})`;
+        if (entry.verdict === 'ALLOW') {
+            out.push(`${head} → ALLOW`);
+        }
+        else if (entry.verdict === 'DENY') {
+            out.push(`${head} → deny`);
+        }
+        else if (entry.verdict === 'UNSUPPORTED') {
+            out.push(`${head} → unsupported: ${entry.message ?? ''}`);
+        }
+        else {
+            out.push(`${head} → error: ${entry.message ?? ''}`);
+        }
+    }
+    out.push(`Simulated: ${result.decision}`);
+    return out;
+}
+// ---- Path normalization ----
+const DB_PREFIX = '/databases/(default)/documents/';
+export function normalizeDocPath(path) {
+    const clean = path.startsWith('/') ? path.slice(1) : path;
+    return `${DB_PREFIX}${clean}`;
+}
+export function buildApiTestCase(tc, opts = {}) {
+    const request = {
+        auth: tc.auth === null || tc.auth === undefined
+            ? undefined
+            : { uid: tc.auth.uid, token: tc.auth.token ?? {} },
+        // Firestore rules engine expects request.method as a short verb
+        // ('get' | 'list' | 'create' | 'update' | 'delete'). Sending the full
+        // gRPC method string (firestore.googleapis.com/.../GetDocument) makes
+        // the engine fail to map the request to any allow rule, so every
+        // ALLOW-expectation test case silently returns DENY. Discovered by
+        // the production-parity smoke test against the live Rules Test API.
+        method: tc.method,
+        path: normalizeDocPath(tc.path),
+    };
+    if (tc.data) {
+        request.resource = { data: tc.data };
+    }
+    if (tc.requestTime) {
+        request.time = tc.requestTime;
+    }
+    if (tc.query) {
+        request.query = tc.query;
+    }
+    const result = {
+        expectation: tc.expectation,
+        request,
+    };
+    if (opts.expressionReportLevel) {
+        result.expressionReportLevel = opts.expressionReportLevel;
+    }
+    if (tc.resource) {
+        result.resource = { data: tc.resource };
+    }
+    if (tc.functionMocks && tc.functionMocks.length > 0) {
+        result.functionMocks = tc.functionMocks.map(buildFunctionMock);
+    }
+    return result;
+}
+export function buildFunctionMock(mock) {
+    // Function name must be the short verb ('get' | 'exists') — the same class
+    // of bug as request.method. The Rules Test API rejects 'firestore.get' /
+    // 'firestore.exists' as not matching any service-declared function, so the
+    // mock is ignored and the real get() returns null → rule denies.
+    const fnName = mock.function === 'get' ? 'get' : 'exists';
+    const normalizedPath = normalizeDocPath(mock.path);
+    const result = {
+        function: fnName,
+        args: [{ exactValue: normalizedPath }],
+        result: undefined,
+    };
+    if (mock.function === 'get') {
+        result.result = { value: { data: mock.result } };
+    }
+    else {
+        // exists → true means doc exists (return some data), false means no result
+        result.result = mock.result === true
+            ? { value: { data: {} } }
+            : undefined;
+    }
+    return result;
+}
+//# sourceMappingURL=spec.js.map

package/dist/rules/test/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/rules/test/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,wCAAwC;AAExC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGxF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,4CAA4C;AAE5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IAC1E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CAC5G,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC1D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACxD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;CACxC,CAAC,CAAC;AAIH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAmBH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACzF,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACtE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;IACtH,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC7F,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAC7F,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACpG;;;;;;OAMG;IACH,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAC1G;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAC3G;;;;;;OAMG;IACH,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0FAA0F,CAAC;CAC3I,CAAC,CAAC;AA6KH;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO;QACtB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;QACjD,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;YACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,IAAI,GAAsB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxE,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3D,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC;IACnF,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC5F,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;QACnG,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAkB;IAC1D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,SAAS,KAAK,GAAG,GAAG,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YACpC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC;AA0BD,+BAA+B;AAE/B,MAAM,SAAS,GAAG,iCAAiC,CAAC;AAEpD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,OAAO,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC;AAChC,CAAC;AAQD,MAAM,UAAU,gBAAgB,CAAC,EAAY,EAAE,OAAgC,EAAE;IAC/E,MAAM,OAAO,GAA2B;QACtC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;YAC7C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE;QACpD,gEAAgE;QAChE,sEAAsE;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC,IAAI,CAAC;KAChC,CAAC;IAEF,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC;IAChC,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAC5D,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;QAChB,MAAM,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,aAAa,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAoB;QAC9B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;QACtC,MAAM,EAAE,SAAS;KAClB,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAiC,EAAE,EAAE,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,2EAA2E;QAC3E,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI;YAClC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YACzB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/rules/tools.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Tool factories for `pyric/rules` per F1.
+ *
+ *   - `createFirestoreRulesTools()`: pure-local rules tooling
+ *     (lint, parse, resolve-modules, simulate) + the Rules Test API
+ *     client (test, takes ProjectScope).
+ *   - `createFirestoreSimulatorTools({ resolveSandbox })`: stateful
+ *     simulator tools — create, execute, read, batch, transaction,
+ *     undo, events. Tools operate against a session-scoped
+ *     LocalEnvironment resolved per dispatch.
+ *
+ * Per F2: identity is a value; lifecycle is a resolver. The
+ * `resolveSandbox` resolver returns the session's
+ * LocalEnvironment — handlers call it inside `execute` so reset /
+ * swap is transparent.
+ *
+ * Per F5: handlers are self-contained — only deps + args + ctx;
+ * no globals.
+ */
+import type { ToolHandler } from '@inbrowser/agent';
+import type { ProjectScope } from '../project-scope.js';
+import { type FirestoreSimulatorToolDeps as FirestoreSimulatorToolDepsImpl } from './simulator-tools-impl.js';
+export type FirestoreSimulatorToolDeps = Pick<FirestoreSimulatorToolDepsImpl, 'resolveSandbox'>;
+export interface FirestoreRulesToolDeps {
+    /** Optional ProjectScope for the test-rules tool (calls Google's
+     *  Firebase Rules Test API). When omitted, `firestore_test_rules`
+     *  is dropped from the factory's output. */
+    scope?: ProjectScope;
+}
+/**
+ * Pure-local Firestore rules tooling, plus the optional Rules Test
+ * API client when `scope` is supplied. Bundles:
+ *
+ *   - `firestore_lint_rules`
+ *   - `firestore_resolve_modules`
+ *   - `firestore_simulate_rules`
+ *   - `firestore_test_rules` (only when `scope` is supplied)
+ */
+export declare function createFirestoreRulesTools(deps?: FirestoreRulesToolDeps): ToolHandler[];
+export declare function createFirestoreSimulatorTools(deps: FirestoreSimulatorToolDeps): ToolHandler[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/rules/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/rules/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMxD,OAAO,EAEL,KAAK,0BAA0B,IAAI,8BAA8B,EAClE,MAAM,2BAA2B,CAAC;AAInC,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,8BAA8B,EAC9B,gBAAgB,CACjB,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC;;gDAE4C;IAC5C,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,GAAE,sBAA2B,GAChC,WAAW,EAAE,CAsFf;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,0BAA0B,GAC/B,WAAW,EAAE,CAKf"}

package/dist/rules/tools.js

@@ -0,0 +1,124 @@
+/**
+ * Tool factories for `pyric/rules` per F1.
+ *
+ *   - `createFirestoreRulesTools()`: pure-local rules tooling
+ *     (lint, parse, resolve-modules, simulate) + the Rules Test API
+ *     client (test, takes ProjectScope).
+ *   - `createFirestoreSimulatorTools({ resolveSandbox })`: stateful
+ *     simulator tools — create, execute, read, batch, transaction,
+ *     undo, events. Tools operate against a session-scoped
+ *     LocalEnvironment resolved per dispatch.
+ *
+ * Per F2: identity is a value; lifecycle is a resolver. The
+ * `resolveSandbox` resolver returns the session's
+ * LocalEnvironment — handlers call it inside `execute` so reset /
+ * swap is transparent.
+ *
+ * Per F5: handlers are self-contained — only deps + args + ctx;
+ * no globals.
+ */
+import { resolveModules } from './modules/resolver.js';
+import { SimulateFirestoreRulesHandler } from './simulator/handler.js';
+import { createFirestoreRulesStdlibTools } from './stdlib-tools.js';
+import { TestFirestoreRulesHandler } from './test/handler.js';
+import { createFirestoreSimulatorTools as createFirestoreSimulatorToolsImpl, } from './simulator-tools-impl.js';
+/**
+ * Pure-local Firestore rules tooling, plus the optional Rules Test
+ * API client when `scope` is supplied. Bundles:
+ *
+ *   - `firestore_lint_rules`
+ *   - `firestore_resolve_modules`
+ *   - `firestore_simulate_rules`
+ *   - `firestore_test_rules` (only when `scope` is supplied)
+ */
+export function createFirestoreRulesTools(deps = {}) {
+    const handlers = [
+        // `firestore_lint_rules` + `firestore_resolve_modules` are
+        // provided by `createFirestoreRulesStdlibTools()` (browser-safe;
+        // stdlib content inlined at build time) and spread in below.
+        // Node consumers that need `basePath`-driven relative-import
+        // resolution should call the `resolveModules` function directly
+        // — the public tool surface intentionally keeps the schema
+        // browser-friendly.
+        {
+            name: 'firestore_simulate_rules',
+            description: 'Simulate Firestore security rules locally against a list of test cases. Same shape as `firestore_test_rules` but in-process — no propagation wait, no side effects. Supports get()/exists() via functionMocks.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    source: { type: 'string' },
+                    testCases: { type: 'array' },
+                },
+                required: ['source', 'testCases'],
+            },
+            async execute(args) {
+                const { source, testCases } = args;
+                const handler = new SimulateFirestoreRulesHandler();
+                const result = handler.simulate(source, testCases);
+                return {
+                    ok: result.success,
+                    summary: result.success
+                        ? `${result.data.results.filter((r) => r.state === 'PASSED').length}/${result.data.results.length} test cases passed`
+                        : `Simulation failed: ${result.error.message}`,
+                    data: result,
+                };
+            },
+        },
+        // Stdlib reference tools (list + get) — pure data, browser-safe.
+        // Defined in `./stdlib-tools.ts` so consumers that only need the
+        // reference (the playground, browser docs generators) don't pull
+        // in the Node-only resolver via this Node-only factory.
+        ...createFirestoreRulesStdlibTools(),
+    ];
+    if (deps.scope) {
+        const scope = deps.scope;
+        // Note: `firestore_get_rules` is NOT added here. `pyric-tools/deploy`'s
+        // `createFirestoreDeployTools` already exposes a tool with that
+        // name (returning raw rules source); composeMcpRegistry would
+        // reject the duplicate. Browser callers that want the parsed
+        // inspect (AST + summary + findings) wire `createFirestoreInspectTool`
+        // directly from `pyric/rules` — see playground's
+        // `firestore-rules-inspect.ts`.
+        handlers.push({
+            name: 'firestore_test_rules',
+            description: 'Test Firestore security rules against test cases via the Firebase Rules Test API. Requires a ProjectScope (auth credentials).',
+            parameters: {
+                type: 'object',
+                properties: {
+                    source: { type: 'string' },
+                    testCases: { type: 'array' },
+                    expressionReportLevel: { type: 'string', enum: ['NONE', 'VISITED', 'FULL'] },
+                },
+                required: ['source', 'testCases'],
+            },
+            async execute(args) {
+                const { source, testCases, expressionReportLevel } = args;
+                const handler = new TestFirestoreRulesHandler();
+                const result = await handler.execute(scope, source, testCases, { expressionReportLevel });
+                return {
+                    ok: result.success,
+                    summary: result.success
+                        ? `${result.data.passed}/${result.data.passed + result.data.failed} test cases passed`
+                        : `Rules test failed: ${result.error.message}`,
+                    data: result,
+                };
+            },
+        });
+    }
+    return handlers;
+}
+// ─── createFirestoreSimulatorTools ────────────────────────────────────
+//
+// Implementation lives in ./simulator-tools-impl.ts so the same factory
+// can run in both Node and browser bundles without forcing the Node-only
+// `resolveModules` (disk reads) into the browser. The /node entry below
+// wires `resolveModules` from `./modules/resolver.js`; the browser-safe
+// `/simulator` entry wires `resolveModulesBrowser`. See `./simulator.ts`.
+//
+export function createFirestoreSimulatorTools(deps) {
+    return createFirestoreSimulatorToolsImpl({
+        resolveSandbox: deps.resolveSandbox,
+        resolveModulesFn: resolveModules,
+    });
+}
+//# sourceMappingURL=tools.js.map

package/dist/rules/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/rules/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EACL,6BAA6B,IAAI,iCAAiC,GAEnE,MAAM,2BAA2B,CAAC;AAkBnC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAkB;QAC9B,2DAA2D;QAC3D,iEAAiE;QACjE,6DAA6D;QAC7D,6DAA6D;QAC7D,gEAAgE;QAChE,2DAA2D;QAC3D,oBAAoB;QACpB;YACE,IAAI,EAAE,0BAA0B;YAChC,WAAW,EACT,gNAAgN;YAClN,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;iBAC7B;gBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;aAClC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAG7B,CAAC;gBACF,MAAM,OAAO,GAAG,IAAI,6BAA6B,EAAE,CAAC;gBACpD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACnD,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACrB,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,oBAAoB;wBACrH,CAAC,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;oBAChD,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,wDAAwD;QACxD,GAAG,+BAA+B,EAAE;KACrC,CAAC;IAEF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,wEAAwE;QACxE,gEAAgE;QAChE,8DAA8D;QAC9D,6DAA6D;QAC7D,uEAAuE;QACvE,iDAAiD;QACjD,gCAAgC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EACT,+HAA+H;YACjI,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;oBAC5B,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;iBAC7E;gBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;aAClC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,IAIpD,CAAC;gBACF,MAAM,OAAO,GAAG,IAAI,yBAAyB,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAC1F,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACrB,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,oBAAoB;wBACtF,CAAC,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;oBAChD,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,EAAE;AACF,MAAM,UAAU,6BAA6B,CAC3C,IAAgC;IAEhC,OAAO,iCAAiC,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,gBAAgB,EAAE,cAAc;KACjC,CAAC,CAAC;AACL,CAAC"}

package/dist/rules/write/handler.d.ts

@@ -0,0 +1,6 @@
+import type { ProjectScope } from '../../project-scope.js';
+import type { WriteFirestoreRulesResult } from './spec.js';
+export declare class WriteFirestoreRulesHandler {
+    execute(scope: ProjectScope, source: string): Promise<WriteFirestoreRulesResult>;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/rules/write/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/rules/write/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAO3D,qBAAa,0BAA0B;IAC/B,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAkIvF"}

package/dist/rules/write/handler.js

@@ -0,0 +1,126 @@
+import { parseToASTOrError } from '../grammar/FirestoreParser.js';
+import { validateFirestoreRules } from '../grammar/FirestoreValidator.js';
+import { lintFirestoreRules } from '../linter/linter.js';
+const RULES_API = 'https://firebaserules.googleapis.com/v1';
+export class WriteFirestoreRulesHandler {
+    async execute(scope, source) {
+        // 1. Parse — surface line/col on failure so the caller (often an agent)
+        // can locate the syntax error instead of getting an opaque PARSE_FAILED.
+        const parsed = parseToASTOrError(source);
+        if (!parsed.ok) {
+            return {
+                success: false,
+                error: {
+                    code: 'PARSE_FAILED',
+                    message: `Failed to parse Firestore rules at line ${parsed.error.line}, col ${parsed.error.column}: expected ${parsed.error.expected || '<unknown>'}`,
+                    recoverable: true,
+                    parseError: parsed.error,
+                },
+            };
+        }
+        const ast = parsed.ast;
+        // 2. Check version
+        if (ast.version !== '2') {
+            return {
+                success: false,
+                error: { code: 'PARSE_FAILED', message: `Unsupported rules_version '${ast.version}' — only version '2' is supported`, recoverable: true },
+            };
+        }
+        // 3. Validate — surface security findings (SEC-1 public write, SEC-2
+        // public read at recursive wildcard) before lint. The validator and
+        // linter both catch `allow … if true`, so whichever runs first wins.
+        // Validate wins because CRITICAL findings carry the security taxonomy
+        // (SEC-1/SEC-2 codes, path+operation) that callers actually
+        // remediate against; the linter's PERMISSIVE_RULE/RECURSIVE_WILDCARD
+        // notes are stylistic and would mask the security signal if they
+        // gated first. Compute lint first so its warnings ride along on
+        // the CRITICAL response for completeness.
+        const lint = lintFirestoreRules(source);
+        const findings = validateFirestoreRules(ast);
+        const critical = findings.filter(f => f.severity === 'critical');
+        if (critical.length > 0) {
+            return {
+                success: false,
+                error: {
+                    code: 'CRITICAL_FINDINGS',
+                    message: `${critical.length} critical finding(s) — fix before deploying`,
+                    recoverable: true,
+                    findings,
+                    lint,
+                },
+            };
+        }
+        // 4. Lint — catch remaining structural issues before deploying
+        const lintErrors = lint.warnings.filter(w => w.severity === 'error');
+        if (lintErrors.length > 0) {
+            return {
+                success: false,
+                error: {
+                    code: 'LINT_ERRORS',
+                    message: `${lintErrors.length} lint error(s) — fix before deploying: ${lintErrors.map(e => e.message).join('; ')}`,
+                    recoverable: true,
+                    lint,
+                },
+            };
+        }
+        try {
+            const token = await scope.resolveToken();
+            const headers = { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' };
+            // 3. Create ruleset
+            const createRes = await fetch(`${RULES_API}/projects/${scope.projectId}/rulesets`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({ source: { files: [{ name: 'firestore.rules', content: source }] } }),
+            });
+            if (createRes.status === 403) {
+                return {
+                    success: false,
+                    error: { code: 'PERMISSION_DENIED', message: 'Service account lacks permission to create Firestore rulesets', recoverable: false },
+                };
+            }
+            if (!createRes.ok) {
+                const body = await createRes.text().catch(() => '');
+                return {
+                    success: false,
+                    error: { code: 'CREATE_RULESET_FAILED', message: `Failed to create ruleset: ${createRes.status} ${body}`, recoverable: createRes.status === 400 },
+                };
+            }
+            const createData = await createRes.json();
+            const rulesetName = createData.name;
+            const rulesetId = rulesetName.split('/').pop();
+            // 4. Update the cloud.firestore release to point at the new ruleset.
+            // The body MUST include `release.name`. Without it the API responds
+            // 200 OK but the active release is left pointing at the previous
+            // ruleset — a silent failure where the tool reports success but
+            // production rules never change. The release name in the URL path
+            // is not enough; the body field is what the API actually reads.
+            const releaseName = `projects/${scope.projectId}/releases/cloud.firestore`;
+            const releaseRes = await fetch(`${RULES_API}/${releaseName}`, {
+                method: 'PATCH',
+                headers,
+                body: JSON.stringify({ release: { name: releaseName, rulesetName } }),
+            });
+            if (releaseRes.status === 403) {
+                return {
+                    success: false,
+                    error: { code: 'PERMISSION_DENIED', message: 'Service account lacks permission to create Firestore releases', recoverable: false },
+                };
+            }
+            if (!releaseRes.ok) {
+                const body = await releaseRes.text().catch(() => '');
+                return {
+                    success: false,
+                    error: { code: 'CREATE_RELEASE_FAILED', message: `Failed to create release: ${releaseRes.status} ${body}`, recoverable: false },
+                };
+            }
+            return { success: true, data: { rulesetId, findings, lint } };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: { code: 'DEPLOY_FAILED', message: e instanceof Error ? e.message : String(e), recoverable: false },
+            };
+        }
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/rules/write/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/rules/write/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAC,OAAO,CAAC,KAAmB,EAAE,MAAc;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,2CAA2C,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,CAAC,KAAK,CAAC,MAAM,cAAc,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,WAAW,EAAE;oBACrJ,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,MAAM,CAAC,KAAK;iBACzB;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAEvB,mBAAmB;QACnB,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,8BAA8B,GAAG,CAAC,OAAO,mCAAmC,EAAE,WAAW,EAAE,IAAI,EAAE;aAC1I,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,sEAAsE;QACtE,4DAA4D;QAC5D,qEAAqE;QACrE,iEAAiE;QACjE,gEAAgE;QAChE,0CAA0C;QAC1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,6CAA6C;oBACxE,WAAW,EAAE,IAAI;oBACjB,QAAQ;oBACR,IAAI;iBACL;aACF,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACrE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,0CAA0C,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAClH,WAAW,EAAE,IAAI;oBACjB,IAAI;iBACL;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YAEzF,oBAAoB;YACpB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,aAAa,KAAK,CAAC,SAAS,WAAW,EAAE;gBACjF,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;aAC5F,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,+DAA+D,EAAE,WAAW,EAAE,KAAK,EAAE;iBACnI,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,SAAS,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE;iBAClJ,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,EAAsB,CAAC;YAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;YACpC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;YAEhD,qEAAqE;YACrE,oEAAoE;YACpE,iEAAiE;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,gEAAgE;YAChE,MAAM,WAAW,GAAG,YAAY,KAAK,CAAC,SAAS,2BAA2B,CAAC;YAC3E,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,IAAI,WAAW,EAAE,EAAE;gBAC5D,MAAM,EAAE,OAAO;gBACf,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC;aACtE,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,+DAA+D,EAAE,WAAW,EAAE,KAAK,EAAE;iBACnI,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACrD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;iBAChI,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;aAC1G,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/rules/write/spec.d.ts

@@ -0,0 +1,28 @@
+import type { ValidationFinding } from '../grammar/FirestoreValidator.js';
+import type { LintWarning, RulesMetrics } from '../linter/linter.js';
+import type { ParseError } from '../grammar/FirestoreParser.js';
+export type WriteFirestoreRulesResult = {
+    success: true;
+    data: {
+        rulesetId: string;
+        findings: ValidationFinding[];
+        lint: {
+            warnings: LintWarning[];
+            metrics: RulesMetrics;
+        };
+    };
+} | {
+    success: false;
+    error: {
+        code: string;
+        message: string;
+        recoverable: boolean;
+        findings?: ValidationFinding[];
+        lint?: {
+            warnings: LintWarning[];
+            metrics: RulesMetrics;
+        };
+        parseError?: ParseError;
+    };
+};
+//# sourceMappingURL=spec.d.ts.map

package/dist/rules/write/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/rules/write/spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QAAC,IAAI,EAAE;YAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;YAAC,OAAO,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,GACvI;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;YAAC,OAAO,EAAE,YAAY,CAAA;SAAE,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,CAAA;CAAE,CAAC"}

package/dist/rules/write/spec.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spec.js.map

package/dist/rules/write/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/rules/write/spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/admin-compat.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `pyric/sandbox/admin-compat` — chainable Admin-shaped Firestore
+ * wrapper backed by `LocalEnvironment`.
+ *
+ * This is the surface that mirrors `firebase-admin/firestore` (the
+ * Admin Node SDK) so test + agent code that's written against the
+ * chainable Admin shape — `db.collection('x').doc('y').get()` etc. —
+ * can run unmodified against the in-process sandbox.
+ *
+ * `pyric-admin` imports from here directly rather than reaching across
+ * packages for its substrate.
+ *
+ * Exported as a separate subpath (not via `/internal`) because the
+ * admin-compat surface has its own `DocumentData` / `Transaction` /
+ * etc. types that would collide with the local-environment exports
+ * already on `/internal`.
+ */
+export * from './firestore/admin-compat/index.js';
+export type { DocumentSnapshot as LiveDocumentSnapshot, QueryDocumentSnapshot as LiveQueryDocumentSnapshot, QuerySnapshot as LiveQuerySnapshot, DocumentChange, DocumentChangeType, DocChangesOptions, SnapshotMetadata, SnapshotDocRef, SnapshotQueryRef, SnapshotTarget, QueryConstraintApplier, SnapshotListenerOptions, } from './internal/index.js';
+//# sourceMappingURL=admin-compat.d.ts.map

package/dist/sandbox/admin-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-compat.d.ts","sourceRoot":"","sources":["../../src/sandbox/admin-compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,cAAc,mCAAmC,CAAC;AAOlD,YAAY,EACV,gBAAgB,IAAI,oBAAoB,EACxC,qBAAqB,IAAI,yBAAyB,EAClD,aAAa,IAAI,iBAAiB,EAClC,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC"}