pyric 0.0.1 → 0.1.0-alpha.7

package/dist/database/constraints/types.d.ts

@@ -0,0 +1,22 @@
+import type { z } from 'zod';
+/** Type alias for RTDB rule expression strings. */
+export type Expr = string;
+/** A path segment: string for literal, { $: name } for path variable. */
+export type Segment = string | {
+    $: string;
+};
+/** Definition of rules for a single database path. */
+export interface PathDef {
+    read?: Expr;
+    write?: Expr;
+    validate?: Expr;
+    schema?: z.ZodObject<any>;
+    fieldConstraints?: Record<string, Expr[]>;
+    indexOn?: string[];
+    children?: Record<string, PathDef>;
+}
+/** Context passed to the callback overload of ruleset(). */
+export interface RulesetContext {
+    path: (path: string, def: PathDef) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/database/constraints/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/database/constraints/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,mDAAmD;AACnD,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC;AAE1B,yEAAyE;AACzE,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,sDAAsD;AACtD,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C"}

package/dist/database/constraints/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/database/constraints/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/database/constraints/types.ts"],"names":[],"mappings":""}

package/dist/database/crawl/handler.d.ts

@@ -0,0 +1,7 @@
+import type { RtdbHost } from '../host.js';
+import type { CrawlOptions, CrawlStructureResult, CrawlStructureSpec } from './spec.js';
+export declare class CrawlStructureHandler implements CrawlStructureSpec {
+    execute(host: RtdbHost, options?: CrawlOptions, userToken?: string): Promise<CrawlStructureResult>;
+    private crawlNode;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/database/crawl/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/database/crawl/handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAiB,MAAM,WAAW,CAAC;AAQvG,qBAAa,qBAAsB,YAAW,kBAAkB;IACxD,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;YAqB1F,SAAS;CAgFxB"}

package/dist/database/crawl/handler.js

@@ -0,0 +1,91 @@
+import { Semaphore } from './semaphore.js';
+import { CRAWL_DEFAULTS } from './spec.js';
+import { fetchDatabase } from '../host.js';
+class CrawlPermissionError extends Error {
+}
+const EMPTY_NODE = (path) => ({
+    path, childCount: 0, truncated: false, children: [], schema: {},
+});
+export class CrawlStructureHandler {
+    async execute(host, options, userToken) {
+        const opts = { ...CRAWL_DEFAULTS, ...options };
+        const sem = new Semaphore(opts.maxConcurrency);
+        try {
+            const root = await this.crawlNode(host, opts.path, 0, opts, sem, userToken);
+            return { success: true, data: root };
+        }
+        catch (e) {
+            if (e instanceof CrawlPermissionError) {
+                return {
+                    success: false,
+                    error: { code: 'PERMISSION_DENIED', message: e.message, recoverable: false },
+                };
+            }
+            return {
+                success: false,
+                error: { code: 'CRAWL_FAILED', message: e instanceof Error ? e.message : String(e), recoverable: false },
+            };
+        }
+    }
+    async crawlNode(host, path, depth, opts, sem, userToken) {
+        await sem.acquire();
+        let shallowData;
+        try {
+            const jsonPath = path === '/' ? '/.json' : `${path}.json`;
+            const res = await fetchDatabase(host, jsonPath, { shallow: 'true' }, userToken);
+            if (res.status === 401 || res.status === 403) {
+                if (depth === 0)
+                    throw new CrawlPermissionError(`Permission denied at ${path}`);
+                return EMPTY_NODE(path);
+            }
+            shallowData = res.ok ? await res.json().catch(() => null) : null;
+        }
+        finally {
+            sem.release();
+        }
+        // Leaf primitive — this node IS a value, not a container
+        if (shallowData !== null && typeof shallowData !== 'object') {
+            return {
+                path,
+                childCount: 0,
+                truncated: false,
+                children: [],
+                schema: {},
+                valueType: typeof shallowData,
+            };
+        }
+        if (shallowData === null) {
+            return EMPTY_NODE(path);
+        }
+        const data = shallowData;
+        const allKeys = Object.keys(data);
+        const childCount = allKeys.length;
+        const truncated = childCount > opts.maxChildren;
+        // Capture leaf types from the shallow response itself (non-true values)
+        const schema = {};
+        for (const key of allKeys) {
+            const val = data[key];
+            if (val !== true) {
+                schema[key] = val === null ? 'null' : typeof val;
+            }
+        }
+        if (depth >= opts.maxDepth) {
+            return { path, childCount, truncated, children: [], schema };
+        }
+        const objectKeys = allKeys.filter((k) => data[k] === true);
+        const keysToExplore = objectKeys.slice(0, opts.maxChildren);
+        const children = await Promise.all(keysToExplore.map((key) => {
+            const childPath = path === '/' ? `/${key}` : `${path}/${key}`;
+            return this.crawlNode(host, childPath, depth + 1, opts, sem, userToken).catch(() => EMPTY_NODE(childPath));
+        }));
+        // Populate schema from children that turned out to be leaf primitives
+        for (const child of children) {
+            if (child.valueType && child.childCount === 0) {
+                const seg = child.path.split('/').filter(Boolean).pop();
+                schema[seg] = child.valueType;
+            }
+        }
+        return { path, childCount, truncated, children, schema };
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/database/crawl/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/database/crawl/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C,MAAM,oBAAqB,SAAQ,KAAK;CAAG;AAE3C,MAAM,UAAU,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,CAAC;IACnD,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;CAChE,CAAC,CAAC;AAEH,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,OAAO,CAAC,IAAc,EAAE,OAAsB,EAAE,SAAkB;QACtE,MAAM,IAAI,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,oBAAoB,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE;iBAC7E,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;aACzG,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,IAAc,EACd,IAAY,EACZ,KAAa,EACb,IAA4B,EAC5B,GAAc,EACd,SAAkB;QAElB,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,WAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;YAEhF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,IAAI,KAAK,KAAK,CAAC;oBAAE,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;gBAChF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAED,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;QAED,yDAAyD;QACzD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE,CAAC;gBACb,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,EAAE;gBACV,SAAS,EAAE,OAAO,WAAW;aAC9B,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,WAAsC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QAEhD,wEAAwE;QACxE,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;YACnD,CAAC;QACH,CAAC;QAED,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,SAAS,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAC3E,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,sEAAsE;QACtE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAG,CAAC;gBACzD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;CACF"}

package/dist/database/crawl/semaphore.d.ts

@@ -0,0 +1,9 @@
+export declare class Semaphore {
+    private readonly max;
+    private queue;
+    private active;
+    constructor(max: number);
+    acquire(): Promise<void>;
+    release(): void;
+}
+//# sourceMappingURL=semaphore.d.ts.map

package/dist/database/crawl/semaphore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semaphore.d.ts","sourceRoot":"","sources":["../../../src/database/crawl/semaphore.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAS;IAIR,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,MAAM,CAAK;gBAEU,GAAG,EAAE,MAAM;IAElC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAa9B,OAAO,IAAI,IAAI;CAKhB"}

package/dist/database/crawl/semaphore.js

@@ -0,0 +1,27 @@
+export class Semaphore {
+    max;
+    queue = [];
+    active = 0;
+    constructor(max) {
+        this.max = max;
+    }
+    async acquire() {
+        if (this.active < this.max) {
+            this.active++;
+            return;
+        }
+        return new Promise((resolve) => {
+            this.queue.push(() => {
+                this.active++;
+                resolve();
+            });
+        });
+    }
+    release() {
+        this.active = Math.max(0, this.active - 1);
+        const next = this.queue.shift();
+        if (next)
+            next();
+    }
+}
+//# sourceMappingURL=semaphore.js.map

package/dist/database/crawl/semaphore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semaphore.js","sourceRoot":"","sources":["../../../src/database/crawl/semaphore.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,SAAS;IAIS;IAHrB,KAAK,GAAsB,EAAE,CAAC;IAC9B,MAAM,GAAG,CAAC,CAAC;IAEnB,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBACnB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC;IACnB,CAAC;CACF"}

package/dist/database/crawl/spec.d.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+import type { RtdbHost } from '../host.js';
+export type CrawlOptions = {
+    path?: string;
+    maxDepth?: number;
+    maxChildren?: number;
+    maxConcurrency?: number;
+};
+export declare const CRAWL_DEFAULTS: Required<CrawlOptions>;
+export type StructureNode = {
+    path: string;
+    childCount: number;
+    truncated: boolean;
+    children: StructureNode[];
+    schema: Record<string, string>;
+    valueType?: string;
+};
+export declare const CrawlErrorCode: z.ZodEnum<["CRAWL_FAILED", "PERMISSION_DENIED"]>;
+export type CrawlStructureResult = {
+    success: true;
+    data: StructureNode;
+} | {
+    success: false;
+    error: {
+        code: z.infer<typeof CrawlErrorCode>;
+        message: string;
+        recoverable: boolean;
+    };
+};
+export interface CrawlStructureSpec {
+    execute(host: RtdbHost, options?: CrawlOptions): Promise<CrawlStructureResult>;
+}
+//# sourceMappingURL=spec.d.ts.map

package/dist/database/crawl/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/database/crawl/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,YAAY,CAKjD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,cAAc,kDAGzB,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAE/G,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAChF"}

package/dist/database/crawl/spec.js

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+export const CRAWL_DEFAULTS = {
+    path: '/',
+    maxDepth: 10,
+    maxChildren: 100,
+    maxConcurrency: 5,
+};
+export const CrawlErrorCode = z.enum([
+    'CRAWL_FAILED',
+    'PERMISSION_DENIED',
+]);
+//# sourceMappingURL=spec.js.map

package/dist/database/crawl/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/database/crawl/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,GAAG;IAChB,cAAc,EAAE,CAAC;CAClB,CAAC;AAWF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,cAAc;IACd,mBAAmB;CACpB,CAAC,CAAC"}

package/dist/database/data/handler.d.ts

@@ -0,0 +1,9 @@
+import type { RtdbHost } from '../host.js';
+import type { UserAuth } from '../types.js';
+import type { DataOperation, DataResult } from './spec.js';
+export declare class DataHandler {
+    execute(host: RtdbHost, operation: DataOperation, path: string, data?: unknown, auth?: UserAuth): Promise<DataResult>;
+    private executeAsUser;
+    private executeAsAdmin;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/database/data/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/database/data/handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE3D,qBAAa,WAAW;IAChB,OAAO,CACX,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,aAAa,EACxB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAAC,UAAU,CAAC;YAwCR,aAAa;YAkCb,cAAc;CAgC7B"}

package/dist/database/data/handler.js

@@ -0,0 +1,96 @@
+import { get, set, update, push, remove, ref } from 'firebase/database';
+import { getDatabaseWithUrl as getAdminDatabase } from 'firebase-admin/database';
+export class DataHandler {
+    async execute(host, operation, path, data, auth) {
+        try {
+            if (auth) {
+                return await this.executeAsUser(host, operation, path, data, auth);
+            }
+            return await this.executeAsAdmin(host, operation, path, data);
+        }
+        catch (e) {
+            // Preserve PERMISSION_DENIED signal from firebase/database before the
+            // generic READ_FAILED / WRITE_FAILED wrap loses it.
+            //
+            // Two shapes have been observed against the live RTDB (fb-js-sdk 12.13.0):
+            //   - set/get/remove: plain Error with `.code === 'PERMISSION_DENIED'`
+            //     and `.message === 'PERMISSION_DENIED: Permission denied'`
+            //     (oracle: scripts/oracle/observations/rtdb-rules-denied-error-code.json)
+            //   - runTransaction: plain Error with `.message === 'permission_denied'`
+            //     (lowercase) and NO `.code` field
+            //     (oracle: scripts/oracle/observations/rtdb-modular-runtransaction-on-rules-denied-path.json)
+            //
+            // The lowercase message check catches both — the uppercase set/get path
+            // also matches via the message (its message starts with 'PERMISSION_DENIED'),
+            // but we check `.code` first because it's the more reliable signal.
+            const message = e instanceof Error ? e.message : String(e);
+            const errCode = e?.code;
+            const isPermissionDenied = errCode === 'PERMISSION_DENIED' ||
+                message.toLowerCase().includes('permission_denied');
+            if (isPermissionDenied) {
+                return {
+                    success: false,
+                    error: { code: 'PERMISSION_DENIED', message, recoverable: false },
+                };
+            }
+            const code = operation === 'get' ? 'READ_FAILED' : 'WRITE_FAILED';
+            return {
+                success: false,
+                error: { code, message, recoverable: false },
+            };
+        }
+    }
+    async executeAsUser(host, operation, path, data, auth) {
+        const db = await host.getClientForUser(auth);
+        const dbRef = ref(db, path);
+        switch (operation) {
+            case 'get': {
+                const snap = await get(dbRef);
+                return { success: true, data: snap.val() };
+            }
+            case 'set': {
+                await set(dbRef, data);
+                return { success: true, data: null };
+            }
+            case 'update': {
+                await update(dbRef, data);
+                return { success: true, data: null };
+            }
+            case 'push': {
+                const newRef = await push(dbRef, data);
+                return { success: true, data: { key: newRef.key } };
+            }
+            case 'remove': {
+                await remove(dbRef);
+                return { success: true, data: null };
+            }
+        }
+    }
+    async executeAsAdmin(host, operation, path, data) {
+        const db = getAdminDatabase(host.databaseUrl);
+        const dbRef = db.ref(path);
+        switch (operation) {
+            case 'get': {
+                const snap = await dbRef.get();
+                return { success: true, data: snap.val() };
+            }
+            case 'set': {
+                await dbRef.set(data);
+                return { success: true, data: null };
+            }
+            case 'update': {
+                await dbRef.update(data);
+                return { success: true, data: null };
+            }
+            case 'push': {
+                const newRef = await dbRef.push(data);
+                return { success: true, data: { key: newRef.key } };
+            }
+            case 'remove': {
+                await dbRef.remove();
+                return { success: true, data: null };
+            }
+        }
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/database/data/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/database/data/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAiB,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,kBAAkB,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAKjF,MAAM,OAAO,WAAW;IACtB,KAAK,CAAC,OAAO,CACX,IAAc,EACd,SAAwB,EACxB,IAAY,EACZ,IAAc,EACd,IAAe;QAEf,IAAI,CAAC;YACH,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,sEAAsE;YACtE,oDAAoD;YACpD,EAAE;YACF,2EAA2E;YAC3E,uEAAuE;YACvE,gEAAgE;YAChE,8EAA8E;YAC9E,0EAA0E;YAC1E,uCAAuC;YACvC,kGAAkG;YAClG,EAAE;YACF,wEAAwE;YACxE,8EAA8E;YAC9E,oEAAoE;YACpE,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAI,CAA+B,EAAE,IAAI,CAAC;YACvD,MAAM,kBAAkB,GACtB,OAAO,KAAK,mBAAmB;gBAC/B,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YACtD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE;iBAClE,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,IAAc,EACd,SAAwB,EACxB,IAAY,EACZ,IAAa,EACb,IAAc;QAEd,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAE5B,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,CAAC,KAAK,EAAE,IAA+B,CAAC,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,IAAc,EACd,SAAwB,EACxB,IAAY,EACZ,IAAc;QAEd,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE3B,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,CAAC,MAAM,CAAC,IAA+B,CAAC,CAAC;gBACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;gBACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/database/data/spec.d.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+export type DataOperation = 'get' | 'set' | 'update' | 'push' | 'remove';
+export declare const DataErrorCode: z.ZodEnum<["READ_FAILED", "WRITE_FAILED", "PERMISSION_DENIED", "NOT_FOUND"]>;
+export type DataResult = {
+    success: true;
+    data: unknown;
+} | {
+    success: false;
+    error: {
+        code: z.infer<typeof DataErrorCode>;
+        message: string;
+        recoverable: boolean;
+    };
+};
+export type SchemaWarning = {
+    field: string;
+    issue: 'type_mismatch' | 'new_field';
+    expected?: string;
+    actual: string;
+};
+export type ValidatedWriteInput = {
+    path: string;
+    data: unknown;
+    operation: 'set' | 'update' | 'push';
+    auth: {
+        uid: string;
+        token: Record<string, unknown>;
+    } | null;
+};
+export declare const ValidatedWriteInputSchema: z.ZodObject<{
+    path: z.ZodString;
+    data: z.ZodEffects<z.ZodAny, any, any>;
+    operation: z.ZodEnum<["set", "update", "push"]>;
+    auth: z.ZodUnion<[z.ZodObject<{
+        uid: z.ZodString;
+        token: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, "strip", z.ZodTypeAny, {
+        uid: string;
+        token: Record<string, unknown>;
+    }, {
+        uid: string;
+        token: Record<string, unknown>;
+    }>, z.ZodNull]>;
+}, "strip", z.ZodTypeAny, {
+    auth: {
+        uid: string;
+        token: Record<string, unknown>;
+    } | null;
+    path: string;
+    operation: "update" | "push" | "set";
+    data?: any;
+}, {
+    auth: {
+        uid: string;
+        token: Record<string, unknown>;
+    } | null;
+    path: string;
+    operation: "update" | "push" | "set";
+    data?: any;
+}>;
+export type ValidatedWriteResult = {
+    success: true;
+    data: unknown;
+    schemaWarnings: SchemaWarning[];
+    simulationResult: {
+        allowed: boolean;
+        matchedRule: string;
+    } | null;
+} | {
+    success: false;
+    error: {
+        code: string;
+        message: string;
+        recoverable: boolean;
+    };
+};
+//# sourceMappingURL=spec.d.ts.map

package/dist/database/data/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/database/data/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEzE,eAAO,MAAM,aAAa,8EAKxB,CAAC;AAEH,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAChC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAE9G,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,eAAe,GAAG,WAAW,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9D,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQpC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAC5B;IACE,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,gBAAgB,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACpE,GACD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC"}

package/dist/database/data/spec.js

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+export const DataErrorCode = z.enum([
+    'READ_FAILED',
+    'WRITE_FAILED',
+    'PERMISSION_DENIED',
+    'NOT_FOUND',
+]);
+export const ValidatedWriteInputSchema = z.object({
+    path: z.string().describe('Database path to write to'),
+    data: z.any().transform((v) => v ?? null).describe('The data to write'),
+    operation: z.enum(['set', 'update', 'push']).describe('Write operation type'),
+    auth: z.union([
+        z.object({ uid: z.string(), token: z.record(z.unknown()) }),
+        z.null(),
+    ]).describe('Auth context for simulation'),
+});
+//# sourceMappingURL=spec.js.map

package/dist/database/data/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/database/data/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,WAAW;CACZ,CAAC,CAAC;AAoBH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3D,CAAC,CAAC,IAAI,EAAE;KACT,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;CAC3C,CAAC,CAAC"}

package/dist/database/data/validated.d.ts

@@ -0,0 +1,8 @@
+import type { RtdbHost } from '../host.js';
+import type { RtdbTools } from '../types.js';
+import type { ValidatedWriteInput, ValidatedWriteResult } from './spec.js';
+export declare class ValidatedWriteHandler {
+    private dataHandler;
+    execute(host: RtdbHost, db: RtdbTools, input: ValidatedWriteInput): Promise<ValidatedWriteResult>;
+}
+//# sourceMappingURL=validated.d.ts.map

package/dist/database/data/validated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validated.d.ts","sourceRoot":"","sources":["../../../src/database/data/validated.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAiB,MAAM,WAAW,CAAC;AAiC1F,qBAAa,qBAAqB;IAChC,OAAO,CAAC,WAAW,CAAqB;IAElC,OAAO,CACX,IAAI,EAAE,QAAQ,EACd,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC;CA4EjC"}

package/dist/database/data/validated.js

@@ -0,0 +1,99 @@
+import { DataHandler } from './handler.js';
+const WRITE_OP_MAP = { set: 'set', update: 'update', push: 'push' };
+function findNode(node, targetPath) {
+    if (node.path === targetPath)
+        return node;
+    for (const child of node.children) {
+        const found = findNode(child, targetPath);
+        if (found)
+            return found;
+    }
+    return null;
+}
+function validateSchema(data, schema) {
+    if (typeof data !== 'object' || data === null)
+        return [];
+    const warnings = [];
+    for (const [key, value] of Object.entries(data)) {
+        const actualType = value === null ? 'null' : typeof value;
+        if (key in schema) {
+            if (schema[key] !== actualType) {
+                warnings.push({ field: key, issue: 'type_mismatch', expected: schema[key], actual: actualType });
+            }
+        }
+        else {
+            warnings.push({ field: key, issue: 'new_field', actual: actualType });
+        }
+    }
+    return warnings;
+}
+export class ValidatedWriteHandler {
+    dataHandler = new DataHandler();
+    async execute(host, db, input) {
+        try {
+            // 1. Infer schema at target path
+            let schemaWarnings = [];
+            const crawlResult = await db.crawlStructure({ path: '/', maxDepth: 10 });
+            if (crawlResult.success) {
+                const node = findNode(crawlResult.data, input.path);
+                if (node && Object.keys(node.schema).length > 0) {
+                    schemaWarnings = validateSchema(input.data, node.schema);
+                }
+            }
+            // 2. Simulate security rules
+            // Note: simulation uses empty mockData, so cross-path rule lookups
+            // (e.g., root.child("team-members").child(auth.uid).exists()) will
+            // evaluate as false. When user auth is provided, the live write
+            // enforces real rules — simulation is advisory only in that case.
+            let simulationResult = null;
+            const simResult = db.simulate({
+                operation: 'write',
+                path: input.path,
+                auth: input.auth,
+                mockData: {},
+                newData: input.data,
+            });
+            if (simResult.success) {
+                simulationResult = { allowed: simResult.data.allowed, matchedRule: simResult.data.matchedRule };
+                // Only block on simulation denial when NOT using user auth (admin mode).
+                // In user mode, the live write enforces real rules against the actual database.
+                if (!simResult.data.allowed && !input.auth) {
+                    return {
+                        success: false,
+                        error: {
+                            code: 'SIMULATION_DENIED',
+                            message: `Security rules deny write at ${input.path}: ${simResult.data.reason}`,
+                            recoverable: true,
+                        },
+                    };
+                }
+            }
+            // If simulation fails (e.g., IR not generated), proceed without it
+            // 3. Execute the write (respect user auth if provided)
+            const writeResult = await this.dataHandler.execute(host, WRITE_OP_MAP[input.operation], input.path, input.data, input.auth ? input.auth : undefined);
+            if (!writeResult.success) {
+                return {
+                    success: false,
+                    error: writeResult.error,
+                };
+            }
+            return {
+                success: true,
+                data: writeResult.data,
+                schemaWarnings,
+                simulationResult,
+            };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: {
+                    code: 'WRITE_FAILED',
+                    message: e instanceof Error ? e.message : String(e),
+                    recoverable: false,
+                },
+            };
+        }
+    }
+}
+//# sourceMappingURL=validated.js.map

package/dist/database/data/validated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validated.js","sourceRoot":"","sources":["../../../src/database/data/validated.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAO3C,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAW,CAAC;AAE7E,SAAS,QAAQ,CAAC,IAAmB,EAAE,UAAkB;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC1C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,IAAa,EACb,MAA8B;IAE9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QAC3E,MAAM,UAAU,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;QAC1D,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;YAClB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,qBAAqB;IACxB,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAExC,KAAK,CAAC,OAAO,CACX,IAAc,EACd,EAAa,EACb,KAA0B;QAE1B,IAAI,CAAC;YACH,iCAAiC;YACjC,IAAI,cAAc,GAAoB,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACzE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpD,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChD,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,6BAA6B;YAC7B,mEAAmE;YACnE,mEAAmE;YACnE,gEAAgE;YAChE,kEAAkE;YAClE,IAAI,gBAAgB,GAAqD,IAAI,CAAC;YAC9E,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC;gBAC5B,SAAS,EAAE,OAAO;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,KAAK,CAAC,IAAI;aACpB,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACtB,gBAAgB,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAChG,yEAAyE;gBACzE,gFAAgF;gBAChF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBAC3C,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE;4BACL,IAAI,EAAE,mBAAmB;4BACzB,OAAO,EAAE,gCAAgC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE;4BAC/E,WAAW,EAAE,IAAI;yBAClB;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,mEAAmE;YAEnE,uDAAuD;YACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAChD,IAAI,EACJ,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,EAC7B,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAgB,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;YAEF,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,WAAW,CAAC,KAAK;iBACzB,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,cAAc;gBACd,gBAAgB;aACjB,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBACnD,WAAW,EAAE,KAAK;iBACnB;aACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}