pyric 0.0.1 → 0.1.0-alpha.8

package/dist/database/sandbox/sentinels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinels.js","sourceRoot":"","sources":["../../../src/database/sandbox/sentinels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAiBtD,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CAAC,CAAU;IAClD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC;AACpC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,EAAE,GAAI,CAA6B,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CACL,EAAE,KAAK,IAAI;QACX,OAAO,EAAE,KAAK,QAAQ;QACtB,OAAQ,EAA8B,CAAC,SAAS,KAAK,QAAQ,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,GAAW,EAAE,OAAiB;IAC7E,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACjD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAI,KAA2B,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;QAC5D,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,IAAI,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxB,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACxE,CAAC,CAAE,OAAmC;QACtC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/database/simulation/handler.d.ts

@@ -0,0 +1,6 @@
+import type { RtdbIR } from '../types.js';
+import type { SimulateResult } from './spec.js';
+export declare class SimulateHandler {
+    execute(ir: RtdbIR | null, rawInput: unknown): SimulateResult;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/database/simulation/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/database/simulation/handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAgC,MAAM,aAAa,CAAC;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA+JhD,qBAAa,eAAe;IAC1B,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAG,cAAc;CA+I9D"}

package/dist/database/simulation/handler.js

@@ -0,0 +1,236 @@
+import { grammar } from '../grammar/RtdbExprParser.js';
+import { DataSnapshot, evaluateExpression } from '../grammar/simulator.js';
+import { SimulationInputSchema } from './spec.js';
+/** Own-enumerable keys of a snapshot's object value; empty for non-objects. */
+function snapshotChildKeys(snap) {
+    const value = snap.val();
+    if (value === null || typeof value !== 'object')
+        return [];
+    return Object.keys(value);
+}
+/**
+ * Descend the rule tree to the node sitting exactly at the write location,
+ * accumulating `$pathVar` bindings along the way. Returns `null` when the
+ * write path runs deeper than the rule tree — i.e. there is no rule node
+ * at or below the write location, so nothing to validate. (Mirrors
+ * {@link collectAncestors}' first-match descent so bindings stay
+ * consistent.)
+ */
+function findWriteLocationNode(node, segments, bindings) {
+    if (segments.length === 0)
+        return { node, bindings };
+    for (const child of node.children) {
+        const childSegments = child.path.split('/').filter(Boolean);
+        if (childSegments.length === 0)
+            continue;
+        const lastSegment = childSegments[childSegments.length - 1];
+        const isPathVar = lastSegment.startsWith('$');
+        if (isPathVar || segments[0] === lastSegment) {
+            const newBindings = isPathVar
+                ? { ...bindings, [lastSegment]: segments[0] }
+                : { ...bindings };
+            return findWriteLocationNode(child, segments.slice(1), newBindings);
+        }
+    }
+    return null;
+}
+/**
+ * Non-cascading `.validate` enforcement for a write. RTDB evaluates
+ * `.validate` on the post-write value at the write location and at every
+ * descendant present in that value; unlike `.read`/`.write` these rules do
+ * NOT cascade — ALL must evaluate true, and a single failure denies the
+ * whole write. Nodes whose proposed value is null (a delete) are skipped,
+ * and an unparseable `.validate` expression is skipped rather than denied
+ * (never flip a prod-legal write to a sandbox denial over a rule the
+ * grammar can't reason about). Ancestor `.validate` rules ABOVE the write
+ * location are not evaluated. Returns the first failing node, or `null`
+ * when every applicable `.validate` passes.
+ */
+function findFailingValidate(node, data, newData, bindings, buildContext) {
+    // A null proposed value is a delete — RTDB does not validate deletes.
+    if (!newData.exists())
+        return null;
+    const rule = node.validate;
+    if (rule && rule.parsed.valid) {
+        const match = grammar.match(rule.raw.trim());
+        const result = evaluateExpression(match, buildContext(data, newData, bindings));
+        if (!result)
+            return { node, rule, bindings };
+    }
+    for (const child of node.children) {
+        const childSegments = child.path.split('/').filter(Boolean);
+        if (childSegments.length === 0)
+            continue;
+        const lastSegment = childSegments[childSegments.length - 1];
+        const isPathVar = lastSegment.startsWith('$');
+        if (isPathVar) {
+            // Bind the path variable to each key actually present in the new
+            // data — a `$var` node validates every child of the written value.
+            for (const key of snapshotChildKeys(newData)) {
+                const failure = findFailingValidate(child, data.child(key), newData.child(key), { ...bindings, [lastSegment]: key }, buildContext);
+                if (failure)
+                    return failure;
+            }
+        }
+        else {
+            const failure = findFailingValidate(child, data.child(lastSegment), newData.child(lastSegment), bindings, buildContext);
+            if (failure)
+                return failure;
+        }
+    }
+    return null;
+}
+/**
+ * Walk from root toward the target path, collecting every ancestor node
+ * along the way (including the deepest match). Firebase RTDB evaluates
+ * rules from root down — a `true` at any ancestor grants access.
+ */
+function collectAncestors(node, pathSegments, bindings) {
+    const ancestors = [{ node, pathVariableBindings: { ...bindings } }];
+    if (pathSegments.length === 0)
+        return ancestors;
+    for (const child of node.children) {
+        const childSegments = child.path.split('/').filter(Boolean);
+        if (childSegments.length === 0)
+            continue;
+        const lastSegment = childSegments[childSegments.length - 1];
+        const isPathVar = lastSegment.startsWith('$');
+        if (isPathVar || pathSegments[0] === lastSegment) {
+            const newBindings = isPathVar
+                ? { ...bindings, [lastSegment]: pathSegments[0] }
+                : { ...bindings };
+            const deeper = collectAncestors(child, pathSegments.slice(1), newBindings);
+            ancestors.push(...deeper);
+            return ancestors;
+        }
+    }
+    return ancestors;
+}
+export class SimulateHandler {
+    execute(ir, rawInput) {
+        if (!ir) {
+            return {
+                success: false,
+                error: {
+                    code: 'IR_NOT_GENERATED',
+                    message: 'Call generateIR() before simulate()',
+                    recoverable: true,
+                },
+            };
+        }
+        const parsed = SimulationInputSchema.safeParse(rawInput);
+        if (!parsed.success) {
+            return {
+                success: false,
+                error: {
+                    code: 'INVALID_INPUT',
+                    message: parsed.error.message,
+                    recoverable: true,
+                },
+            };
+        }
+        const { operation, path, auth, mockData, newData } = parsed.data;
+        try {
+            const pathSegments = path.split('/').filter(Boolean);
+            const rootNode = ir.rules;
+            const ancestors = collectAncestors(rootNode, pathSegments, {});
+            // Walk from root down. First ancestor whose rule evaluates to true wins.
+            const rootData = new DataSnapshot(mockData, '/');
+            const dataAtPath = rootData.child(path.slice(1));
+            const newDataSnap = new DataSnapshot(newData ?? null, path);
+            const buildContext = (data, newDataArg, bindings) => {
+                const pvBindings = {};
+                for (const [k, v] of Object.entries(bindings)) {
+                    pvBindings[k] = v;
+                    pvBindings[k.slice(1)] = v;
+                }
+                return {
+                    auth: auth ? { uid: auth.uid, token: auth.token } : null,
+                    data,
+                    newData: newDataArg,
+                    root: rootData,
+                    now: Date.now(),
+                    pathVariableBindings: pvBindings,
+                };
+            };
+            for (const ancestor of ancestors) {
+                const ruleExpr = ancestor.node[operation];
+                if (!ruleExpr)
+                    continue;
+                if (!ruleExpr.parsed.valid)
+                    continue;
+                const match = grammar.match(ruleExpr.raw.trim());
+                const result = evaluateExpression(match, buildContext(dataAtPath, newDataSnap, ancestor.pathVariableBindings));
+                if (Boolean(result)) {
+                    // A granting `.write` is necessary but not sufficient: RTDB also
+                    // enforces every `.validate` rule at or below the write location.
+                    // Unlike `.read`/`.write`, `.validate` does NOT cascade — all must
+                    // pass (a single failure denies the write). Read ops have no
+                    // validate phase.
+                    if (operation === 'write') {
+                        const located = findWriteLocationNode(rootNode, pathSegments, {});
+                        const failure = located
+                            ? findFailingValidate(located.node, dataAtPath, newDataSnap, located.bindings, buildContext)
+                            : null;
+                        if (failure) {
+                            return {
+                                success: true,
+                                data: {
+                                    allowed: false,
+                                    matchedPath: failure.node.path,
+                                    matchedRule: failure.rule.raw,
+                                    reason: 'Validation rule evaluated to false',
+                                    pathVariableBindings: failure.bindings,
+                                },
+                            };
+                        }
+                    }
+                    return {
+                        success: true,
+                        data: {
+                            allowed: true,
+                            matchedPath: ancestor.node.path,
+                            matchedRule: ruleExpr.raw,
+                            reason: 'Rule expression evaluated to true',
+                            pathVariableBindings: ancestor.pathVariableBindings,
+                        },
+                    };
+                }
+            }
+            // No ancestor rule evaluated to true. Use the deepest match for the denial.
+            const deepest = ancestors[ancestors.length - 1];
+            const deepestRule = deepest.node[operation];
+            if (!deepestRule) {
+                return {
+                    success: false,
+                    error: {
+                        code: 'NO_MATCHING_RULE',
+                        message: `No '${operation}' rule found for path '${path}'`,
+                        recoverable: true,
+                    },
+                };
+            }
+            return {
+                success: true,
+                data: {
+                    allowed: false,
+                    matchedPath: deepest.node.path,
+                    matchedRule: deepestRule.raw,
+                    reason: 'Rule expression evaluated to false',
+                    pathVariableBindings: deepest.pathVariableBindings,
+                },
+            };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: {
+                    code: 'EVALUATION_ERROR',
+                    message: e instanceof Error ? e.message : String(e),
+                    recoverable: false,
+                },
+            };
+        }
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/database/simulation/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/database/simulation/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAsBlD,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,IAAkB;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAC5B,IAAc,EACd,QAAkB,EAClB,QAAgC;IAEhC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEzC,MAAM,WAAW,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE;gBAC7C,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;YACpB,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAC1B,IAAc,EACd,IAAkB,EAClB,OAAqB,EACrB,QAAgC,EAChC,YAA4B;IAE5B,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEzC,MAAM,WAAW,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,SAAS,EAAE,CAAC;YACd,iEAAiE;YACjE,mEAAmE;YACnE,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,mBAAmB,CACjC,KAAK,EACL,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAClB,EAAE,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EACnC,YAAY,CACb,CAAC;gBACF,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAC9B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,mBAAmB,CACjC,KAAK,EACL,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EACvB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAC1B,QAAQ,EACR,YAAY,CACb,CAAC;YACF,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,IAAc,EACd,YAAsB,EACtB,QAAgC;IAEhC,MAAM,SAAS,GAAoB,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,CAAC,CAAC;IAErF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEzC,MAAM,WAAW,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE;gBACjD,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3E,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,eAAe;IAC1B,OAAO,CAAC,EAAiB,EAAE,QAAiB;QAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,qCAAqC;oBAC9C,WAAW,EAAE,IAAI;iBAClB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;oBAC7B,WAAW,EAAE,IAAI;iBAClB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAEjE,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAiB,CAAC;YAEtC,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YAE/D,yEAAyE;YACzE,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,IAAI,YAAY,CAAC,OAAO,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC;YAE5D,MAAM,YAAY,GAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE;gBAClE,MAAM,UAAU,GAA2B,EAAE,CAAC;gBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9C,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAClB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;oBACxD,IAAI;oBACJ,OAAO,EAAE,UAAU;oBACnB,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;oBACf,oBAAoB,EAAE,UAAU;iBACjC,CAAC;YACJ,CAAC,CAAC;YAEF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAmC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1E,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK;oBAAE,SAAS;gBAErC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,kBAAkB,CAC/B,KAAK,EACL,YAAY,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CACrE,CAAC;gBAEF,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpB,iEAAiE;oBACjE,kEAAkE;oBAClE,mEAAmE;oBACnE,6DAA6D;oBAC7D,kBAAkB;oBAClB,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;wBAC1B,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;wBAClE,MAAM,OAAO,GAAG,OAAO;4BACrB,CAAC,CAAC,mBAAmB,CACjB,OAAO,CAAC,IAAI,EACZ,UAAU,EACV,WAAW,EACX,OAAO,CAAC,QAAQ,EAChB,YAAY,CACb;4BACH,CAAC,CAAC,IAAI,CAAC;wBACT,IAAI,OAAO,EAAE,CAAC;4BACZ,OAAO;gCACL,OAAO,EAAE,IAAI;gCACb,IAAI,EAAE;oCACJ,OAAO,EAAE,KAAK;oCACd,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;oCAC9B,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;oCAC7B,MAAM,EAAE,oCAAoC;oCAC5C,oBAAoB,EAAE,OAAO,CAAC,QAAQ;iCACvC;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;oBACD,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACJ,OAAO,EAAE,IAAI;4BACb,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;4BAC/B,WAAW,EAAE,QAAQ,CAAC,GAAG;4BACzB,MAAM,EAAE,mCAAmC;4BAC3C,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;yBACpD;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE5C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,OAAO,SAAS,0BAA0B,IAAI,GAAG;wBAC1D,WAAW,EAAE,IAAI;qBAClB;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;oBAC9B,WAAW,EAAE,WAAW,CAAC,GAAG;oBAC5B,MAAM,EAAE,oCAAoC;oBAC5C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;iBACnD;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBACnD,WAAW,EAAE,KAAK;iBACnB;aACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/database/simulation/spec.d.ts

@@ -0,0 +1,69 @@
+import { z } from 'zod';
+export declare const SimulationInputSchema: z.ZodObject<{
+    operation: z.ZodEnum<["read", "write", "validate"]>;
+    path: z.ZodString;
+    auth: z.ZodUnion<[z.ZodObject<{
+        uid: z.ZodString;
+        token: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, "strip", z.ZodTypeAny, {
+        uid: string;
+        token: Record<string, unknown>;
+    }, {
+        uid: string;
+        token: Record<string, unknown>;
+    }>, z.ZodNull]>;
+    mockData: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    newData: z.ZodOptional<z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    auth: {
+        uid: string;
+        token: Record<string, unknown>;
+    } | null;
+    path: string;
+    operation: "read" | "write" | "validate";
+    mockData: Record<string, unknown>;
+    newData?: unknown;
+}, {
+    auth: {
+        uid: string;
+        token: Record<string, unknown>;
+    } | null;
+    path: string;
+    operation: "read" | "write" | "validate";
+    mockData: Record<string, unknown>;
+    newData?: unknown;
+}>;
+export type SimulationInput = z.infer<typeof SimulationInputSchema>;
+export declare const SimulateErrorCode: z.ZodEnum<["IR_NOT_GENERATED", "INVALID_INPUT", "NO_MATCHING_RULE", "EVALUATION_ERROR"]>;
+export declare const SimulationResultSchema: z.ZodObject<{
+    allowed: z.ZodBoolean;
+    matchedPath: z.ZodString;
+    matchedRule: z.ZodString;
+    reason: z.ZodString;
+    pathVariableBindings: z.ZodRecord<z.ZodString, z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    reason: string;
+    allowed: boolean;
+    matchedPath: string;
+    matchedRule: string;
+    pathVariableBindings: Record<string, string>;
+}, {
+    reason: string;
+    allowed: boolean;
+    matchedPath: string;
+    matchedRule: string;
+    pathVariableBindings: Record<string, string>;
+}>;
+export type SimulationResult = z.infer<typeof SimulationResultSchema>;
+export type SimulateResult = {
+    success: true;
+    data: SimulationResult;
+} | {
+    success: false;
+    error: {
+        code: z.infer<typeof SimulateErrorCode>;
+        message: string;
+        recoverable: boolean;
+    };
+};
+//# sourceMappingURL=spec.d.ts.map

package/dist/database/simulation/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/database/simulation/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAShC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB,0FAK5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;EAMjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,cAAc,GACtB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACzC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC"}

package/dist/database/simulation/spec.js

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+export const SimulationInputSchema = z.object({
+    operation: z.enum(['read', 'write', 'validate']),
+    path: z.string().min(1).startsWith('/'),
+    auth: z.union([
+        z.object({ uid: z.string(), token: z.record(z.unknown()) }),
+        z.null(),
+    ]),
+    mockData: z.record(z.unknown()),
+    newData: z.unknown().optional(),
+});
+export const SimulateErrorCode = z.enum([
+    'IR_NOT_GENERATED',
+    'INVALID_INPUT',
+    'NO_MATCHING_RULE',
+    'EVALUATION_ERROR',
+]);
+export const SimulationResultSchema = z.object({
+    allowed: z.boolean(),
+    matchedPath: z.string(),
+    matchedRule: z.string(),
+    reason: z.string(),
+    pathVariableBindings: z.record(z.string()),
+});
+//# sourceMappingURL=spec.js.map

package/dist/database/simulation/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/database/simulation/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3D,CAAC,CAAC,IAAI,EAAE;KACT,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,kBAAkB;IAClB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3C,CAAC,CAAC"}

package/dist/database/tools.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Agent-tool factory for the Realtime Database surface.
+ *
+ * `createRtdbAdminTools({ host })` returns the 11 RTDB tools as
+ * `ToolHandler[]`, consumable by `@inbrowser/agent`'s registry —
+ * including by `composeMcpRegistry`. Mirrors the
+ * `createFirestoreRulesTools` / `createStorageAdminTools` factory
+ * shape: a host in, JSON-Schema-typed `ToolHandler`s out.
+ */
+import type { ToolHandler } from '@inbrowser/agent';
+import type { RtdbHost } from './host.js';
+export interface RtdbAdminToolDeps {
+    /** Project identity + token resolvers + client-SDK factory. Factory
+     *  consumers (e.g. `composeMcpRegistry`) pass it directly. */
+    host: RtdbHost;
+}
+export type RtdbRulesToolDeps = RtdbAdminToolDeps;
+export type RtdbDataToolDeps = RtdbAdminToolDeps;
+export declare function createRtdbRulesTools(deps: RtdbRulesToolDeps): ToolHandler[];
+export declare function createRtdbDataTools(deps: RtdbDataToolDeps): ToolHandler[];
+export declare function createRtdbAdminTools(deps: RtdbAdminToolDeps): ToolHandler[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/database/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/database/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,MAAM,WAAW,iBAAiB;IAChC;kEAC8D;IAC9D,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAClD,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AA+BjD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,EAAE,CAwF3E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,EAAE,CAqKzE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,EAAE,CAK3E"}