pyric 0.0.1 → 0.1.0-alpha.7

package/dist/storage/upload.js

@@ -0,0 +1,235 @@
+/**
+ * Upload operations: `uploadBytes`, `uploadString`.
+ *
+ * Both delegate to the same internal pipeline:
+ *   1. Normalize the incoming payload to a `Blob` (`toBlob`).
+ *   2. Build a `StoredMetadata` record with server-set fields
+ *      populated and client-settable fields merged in.
+ *   3. Atomically `put` the blob + metadata via the persistence
+ *      backend.
+ *   4. Return `{ ref, metadata: toFullMetadata(stored) }`.
+ *
+ * Slice 5 ships the upload surface without rule evaluation —
+ * Slice 8 will wrap this pipeline so denials throw before the IDB
+ * write happens.
+ *
+ * Survey alignment (Section 4):
+ *   - `uploadBytes` accepts `Blob | Uint8Array | ArrayBuffer` per
+ *     the JS SDK's input contract.
+ *   - `uploadString` accepts `raw` | `base64` | `data_url` formats;
+ *     the data-url variant pulls `contentType` from the prefix
+ *     unless explicitly overridden.
+ *   - `contentType` precedence: caller's `metadata.contentType` →
+ *     payload's intrinsic type (`Blob.type`, data-url prefix) →
+ *     `application/octet-stream`. Matches the JS SDK.
+ */
+import * as fb from 'firebase/storage';
+import { emitSandboxEvent, makeServiceMutationEvent } from 'pyric/sandbox/internal';
+import { getStorageService, targetOf } from './service.js';
+import { enforceRules } from './enforce.js';
+import { resourceFromStored, requestResourceFor } from './rules.js';
+import { toFullMetadata } from './metadata.js';
+import { invalidRootOperation, invalidFormat } from './errors.js';
+import { fbRefOf } from './reference.js';
+const OCTET = 'application/octet-stream';
+/**
+ * Upload bytes to the reference's `fullPath`. Replaces any existing
+ * object at the path. Returns the populated `FullMetadata` and the
+ * same `ref` for chaining.
+ *
+ * Throws when the reference targets the root (`fullPath === ''`) —
+ * uploads need a non-empty path, matching Firebase's
+ * `invalid-root-operation` precondition.
+ */
+export async function uploadBytes(ref, data, metadata) {
+    guardNonRoot(ref, 'uploadBytes');
+    const target = targetOf(ref.storage);
+    if (target.kind === 'prod') {
+        const result = await fb.uploadBytes(fbRefOf(ref), data, metadata);
+        // `fb.UploadResult.metadata` shape matches our `FullMetadata`
+        // structurally; the `ref` field is the prod fb ref, replace it
+        // with ours so the public type stays stable.
+        return { ref, metadata: result.metadata };
+    }
+    // Sandbox path.
+    const blob = toBlob(data, metadata?.contentType);
+    const stored = buildStoredMetadata({ ref, blob, settable: metadata });
+    const service = await getStorageService(ref.storage);
+    const existing = await service.backend.getMetadata(ref.fullPath);
+    enforceRules(service, {
+        request: {
+            auth: target.context.auth,
+            method: 'write',
+            path: ref.fullPath,
+            resource: requestResourceFor({
+                size: stored.size,
+                contentType: stored.contentType,
+                customMetadata: stored.customMetadata,
+            }),
+        },
+        resource: resourceFromStored(existing),
+    }, target);
+    await service.backend.put(ref.fullPath, blob, stored);
+    // Land the put on the unified Studio stream. Best-effort: a throw from
+    // the emit path must not fail the upload the caller just completed.
+    try {
+        emitSandboxEvent(target.sandbox, makeServiceMutationEvent({
+            service: 'storage',
+            op: 'object_put',
+            path: ref.fullPath,
+            auth: target.context.auth,
+            before: existing ?? undefined,
+            after: stored,
+            detail: {
+                bucket: ref.bucket,
+                size: stored.size,
+                contentType: stored.contentType,
+                overwrite: existing != null,
+            },
+        }), { service: 'storage' });
+    }
+    catch {
+        // Observational — never let event emission break a storage write.
+    }
+    return { ref, metadata: toFullMetadata(stored) };
+}
+/**
+ * Upload a string in one of three formats:
+ *
+ *   - `raw` (default): UTF-8 text. Defaults `contentType` to
+ *     `text/plain;charset=utf-8` if neither metadata nor the data
+ *     specify one.
+ *   - `base64`: standard base64-encoded bytes.
+ *   - `data_url`: a `data:` URL — the MIME prefix is honored as
+ *     `contentType` unless the caller overrides it explicitly.
+ */
+export async function uploadString(ref, value, format = 'raw', metadata) {
+    const { bytes, inferredType } = decodeString(value, format);
+    const effective = {
+        ...metadata,
+        contentType: metadata?.contentType ?? inferredType ?? defaultRawContentType(format),
+    };
+    return uploadBytes(ref, bytes, effective);
+}
+/**
+ * Build the `StoredMetadata` record we'll persist alongside the
+ * blob. Server-set fields are populated here in one place so
+ * Slice 6's `getMetadata` reads a consistent shape.
+ *
+ * Exported for the rare cases where Slice 8's rule pre-check needs
+ * to materialize the about-to-write metadata to feed into the
+ * evaluator (specifically `request.resource.size` /
+ * `.contentType`).
+ */
+export function buildStoredMetadata(args) {
+    const { ref, blob, settable } = args;
+    const now = (args.now ?? new Date()).toISOString();
+    const generation = generationFromTime(args.now ?? new Date());
+    const name = ref.name;
+    return {
+        fullPath: ref.fullPath,
+        name,
+        bucket: ref.bucket,
+        generation,
+        metageneration: '1',
+        timeCreated: now,
+        updated: now,
+        size: blob.size,
+        // `??` doesn't fold an empty `blob.type` into the fallback; `||`
+        // does. `Blob` returns `''` for "no type set" rather than
+        // `undefined`, so without this an unhinted Uint8Array upload
+        // would land with `contentType: ''` instead of the documented
+        // `application/octet-stream` default.
+        contentType: settable?.contentType || blob.type || OCTET,
+        cacheControl: settable?.cacheControl,
+        contentDisposition: settable?.contentDisposition,
+        contentEncoding: settable?.contentEncoding,
+        contentLanguage: settable?.contentLanguage,
+        customMetadata: settable?.customMetadata,
+    };
+}
+// ─── Helpers ──────────────────────────────────────────────────────
+/**
+ * Normalize the user's input to a `Blob`. The `contentType` hint
+ * (from caller-supplied `SettableMetadata`) takes precedence over
+ * any intrinsic type on the source — matching Firebase's "caller
+ * → blob.type → octet-stream" precedence (survey Section 4).
+ *
+ * The case where `data` is already a `Blob` and `contentTypeHint`
+ * is undefined preserves the blob's intrinsic type, so users
+ * passing `new Blob([...], { type: 'application/json' })` don't
+ * lose the type info.
+ */
+function toBlob(data, contentTypeHint) {
+    if (data instanceof Blob) {
+        if (contentTypeHint && contentTypeHint !== data.type) {
+            // Force the caller's hint by rewrapping. Same bytes, new type.
+            return new Blob([data], { type: contentTypeHint });
+        }
+        return data;
+    }
+    // Uint8Array / ArrayBuffer → Blob. ArrayBuffer-passing through
+    // the Blob constructor's BlobPart accepts both shapes natively.
+    return new Blob([data], { type: contentTypeHint ?? '' });
+}
+/**
+ * Decode an `uploadString` payload into bytes + inferred MIME.
+ * `inferredType` is set only for `data_url` (which carries one
+ * structurally); the other formats return `undefined` and let the
+ * caller's metadata + the default-raw fallback win.
+ */
+function decodeString(value, format) {
+    if (format === 'raw') {
+        return { bytes: new TextEncoder().encode(value), inferredType: undefined };
+    }
+    if (format === 'base64') {
+        return { bytes: base64ToBytes(value), inferredType: undefined };
+    }
+    if (format !== 'data_url') {
+        // A JS caller can pass a string the `StringFormat` type rules out
+        // (`'base64url'`, `'hex'`, …). Divergence, oracle-locked by
+        // `storage-uploadstring-unknown-format.json`: prod ACCEPTS
+        // `base64url` (uploads succeed) and throws `storage/unknown` for a
+        // genuinely-unrecognized format. The sandbox instead throws
+        // `storage/invalid-format` for anything outside the v1 scope's
+        // `raw`/`base64`/`data_url`, naming the bad format rather than
+        // mis-parsing it as a data_url. See storage#41 in COMPAT.md.
+        throw invalidFormat(String(format), `unknown uploadString format — expected "raw", "base64", or "data_url".`);
+    }
+    // data_url — split on the first comma. Mime+params live before
+    // the comma; payload (raw or `;base64`-prefixed) lives after.
+    const comma = value.indexOf(',');
+    if (!value.startsWith('data:') || comma === -1) {
+        throw invalidFormat('data_url', 'data_url requires a string starting with "data:" and containing a comma.');
+    }
+    const header = value.slice(5, comma); // strip leading "data:"
+    const payload = value.slice(comma + 1);
+    const isB64 = header.endsWith(';base64');
+    const mime = (isB64 ? header.slice(0, -7) : header) || 'application/octet-stream';
+    const bytes = isB64 ? base64ToBytes(payload) : new TextEncoder().encode(decodeURIComponent(payload));
+    return { bytes, inferredType: mime };
+}
+function base64ToBytes(b64) {
+    // `atob` is universally available in both browsers and Bun.
+    const binary = atob(b64);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        out[i] = binary.charCodeAt(i);
+    return out;
+}
+function defaultRawContentType(format) {
+    return format === 'raw' ? 'text/plain;charset=utf-8' : OCTET;
+}
+function generationFromTime(now) {
+    // Generation is a stringified counter in production. We mint a
+    // unique-enough value from the wallclock — collisions are
+    // tolerable for the v1 scope (single-process IDB; no cross-tab
+    // contention contract).
+    return String(now.getTime());
+}
+function guardNonRoot(ref, op) {
+    if (ref.fullPath === '') {
+        throw invalidRootOperation(op);
+    }
+}
+//# sourceMappingURL=upload.js.map

package/dist/storage/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../src/storage/upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,cAAc,EAA4C,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,OAAO,EAAyB,MAAM,gBAAgB,CAAC;AAEhE,MAAM,KAAK,GAAG,0BAA0B,CAAC;AAKzC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAqB,EACrB,IAAqC,EACrC,QAA2B;IAE3B,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClE,8DAA8D;QAC9D,+DAA+D;QAC/D,6CAA6C;QAC7C,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAA+C,EAAE,CAAC;IACnF,CAAC;IACD,gBAAgB;IAChB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjE,YAAY,CAAC,OAAO,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,QAAQ,EAAE,kBAAkB,CAAC;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC;SACH;QACD,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC;KACvC,EAAE,MAAM,CAAC,CAAC;IACX,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtD,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC;QACH,gBAAgB,CACd,MAAM,CAAC,OAAO,EACd,wBAAwB,CAAC;YACvB,OAAO,EAAE,SAAS;YAClB,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,QAAQ,IAAI,SAAS;YAC7B,KAAK,EAAE,MAAM;YACb,MAAM,EAAE;gBACN,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,QAAQ,IAAI,IAAI;aAC5B;SACF,CAAC,EACF,EAAE,OAAO,EAAE,SAAS,EAAE,CACvB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAqB,EACrB,KAAa,EACb,SAAuB,KAAK,EAC5B,QAA2B;IAE3B,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAqB;QAClC,GAAG,QAAQ;QACX,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,YAAY,IAAI,qBAAqB,CAAC,MAAM,CAAC;KACpF,CAAC;IACF,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,IAAI;QACJ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU;QACV,cAAc,EAAE,GAAG;QACnB,WAAW,EAAE,GAAG;QAChB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,iEAAiE;QACjE,0DAA0D;QAC1D,6DAA6D;QAC7D,8DAA8D;QAC9D,sCAAsC;QACtC,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK;QACxD,YAAY,EAAE,QAAQ,EAAE,YAAY;QACpC,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB;QAChD,eAAe,EAAE,QAAQ,EAAE,eAAe;QAC1C,eAAe,EAAE,QAAQ,EAAE,eAAe;QAC1C,cAAc,EAAE,QAAQ,EAAE,cAAc;KACzC,CAAC;AACJ,CAAC;AAED,qEAAqE;AAErE;;;;;;;;;;GAUG;AACH,SAAS,MAAM,CACb,IAAqC,EACrC,eAAmC;IAEnC,IAAI,IAAI,YAAY,IAAI,EAAE,CAAC;QACzB,IAAI,eAAe,IAAI,eAAe,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACrD,+DAA+D;YAC/D,OAAO,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,+DAA+D;IAC/D,gEAAgE;IAChE,OAAO,IAAI,IAAI,CAAC,CAAC,IAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,KAAa,EACb,MAAoB;IAEpB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,kEAAkE;QAClE,4DAA4D;QAC5D,2DAA2D;QAC3D,mEAAmE;QACnE,4DAA4D;QAC5D,+DAA+D;QAC/D,+DAA+D;QAC/D,6DAA6D;QAC7D,MAAM,aAAa,CACjB,MAAM,CAAC,MAAM,CAAC,EACd,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,+DAA+D;IAC/D,8DAA8D;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,aAAa,CACjB,UAAU,EACV,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,wBAAwB;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC;IAClF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrG,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,4DAA4D;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAS;IACnC,+DAA+D;IAC/D,0DAA0D;IAC1D,+DAA+D;IAC/D,wBAAwB;IACxB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,GAAqB,EAAE,EAAU;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,112 @@
 {
   "name": "pyric",
-  "version": "0.0.1",
-  "description": "Reserved.",
-  "license": "MIT"
+  "version": "0.1.0-alpha.7",
+  "description": "Firebase for agents — modular Web SDK adapters (firestore, auth, database, storage) with swappable sandbox/prod backends, plus rules tooling and in-process sandbox. Mirrors firebase.",
+  "type": "module",
+  "exports": {
+    "./app": {
+      "types": "./dist/app/index.d.ts",
+      "import": "./dist/app/index.js"
+    },
+    "./firestore": {
+      "types": "./dist/firestore/index.d.ts",
+      "import": "./dist/firestore/index.js"
+    },
+    "./auth": {
+      "types": "./dist/auth/index.d.ts",
+      "import": "./dist/auth/index.js"
+    },
+    "./database": {
+      "types": "./dist/database/index.d.ts",
+      "import": "./dist/database/index.js"
+    },
+    "./database/modular": {
+      "types": "./dist/database/modular.d.ts",
+      "import": "./dist/database/modular.js"
+    },
+    "./storage": {
+      "types": "./dist/storage/index.d.ts",
+      "import": "./dist/storage/index.js"
+    },
+    "./storage/internal": {
+      "types": "./dist/storage/internal.d.ts",
+      "import": "./dist/storage/internal.js"
+    },
+    "./rules": {
+      "types": "./dist/rules/index.d.ts",
+      "import": "./dist/rules/index.js"
+    },
+    "./firestore-values": {
+      "types": "./dist/firestore-values/index.d.ts",
+      "import": "./dist/firestore-values/index.js"
+    },
+    "./rules/node": {
+      "types": "./dist/rules/node.d.ts",
+      "import": "./dist/rules/node.js"
+    },
+    "./rules/extract": {
+      "types": "./dist/rules/extract.d.ts",
+      "import": "./dist/rules/extract.js"
+    },
+    "./rules/rtdb": {
+      "types": "./dist/rules/rtdb.d.ts",
+      "import": "./dist/rules/rtdb.js"
+    },
+    "./rules/rtdb/constraints": {
+      "types": "./dist/database/constraints/index.d.ts",
+      "import": "./dist/database/constraints/index.js"
+    },
+    "./rules/rtdb-constraints": {
+      "types": "./dist/database/constraints/index.d.ts",
+      "import": "./dist/database/constraints/index.js"
+    },
+    "./sandbox": {
+      "types": "./dist/sandbox/index.d.ts",
+      "import": "./dist/sandbox/index.js"
+    },
+    "./sandbox/internal": {
+      "types": "./dist/sandbox/internal/index.d.ts",
+      "import": "./dist/sandbox/internal/index.js"
+    },
+    "./sandbox/admin-compat": {
+      "types": "./dist/sandbox/admin-compat.d.ts",
+      "import": "./dist/sandbox/admin-compat.js"
+    },
+    "./sandbox/admin-firestore": {
+      "types": "./dist/sandbox/admin-firestore/index.d.ts",
+      "import": "./dist/sandbox/admin-firestore/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "inline-grammar": "bun run scripts/inline-grammar.ts",
+    "inline-stdlib": "bun run scripts/inline-stdlib.ts",
+    "prebuild": "(bun run inline-grammar 2>/dev/null || true) && (bun run inline-stdlib 2>/dev/null || true)",
+    "build": "tsc && bun run scripts/copy-assets.ts 2>/dev/null || tsc",
+    "test": "bun test",
+    "typecheck": "bun x tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@inbrowser/agent": "0.4.1",
+    "fake-indexeddb": "^6.0.0",
+    "firebase": "^12.12.0",
+    "firebase-admin": "^13.0.0",
+    "js-md5": "^0.8.3",
+    "js-sha256": "^0.11.0",
+    "ohm-js": "^17.1.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }