pyric 0.1.0-alpha.19 → 0.1.0-alpha.21

package/src/storage/list.ts

@@ -52,7 +52,7 @@ export async function listAll(refIn: StorageReference): Promise<ListResult> {
   // requires `read` on the scanned ref's path. Prefixes have no
   // backing object, so `resource` is null (a list of an unauthorized
   // tree throws `storage/unauthorized`, same as a denied read). When
-  // no rules are configured this is a no-op (open-by-default).
+  // no rules are configured, enforcement fails closed.
   enforceRules(service, {
     request: {
       auth: storageAuth(target),

package/src/storage/persistence.ts

@@ -176,10 +176,61 @@ export interface StorageBackend {
  * production, callers pass nothing and inherit the default
  * `pyric-storage`.
  */
-export function openStorageBackend(
+export async function openStorageBackend(
   dbName: string = DEFAULT_DB_NAME,
 ): Promise<StorageBackend> {
-  return openDatabase(dbName).then((db) => new IndexedDbStorageBackend(db));
+  try {
+    const db = await openDatabase(dbName);
+    return new IndexedDbStorageBackend(db);
+  } catch (err) {
+    return new InMemoryStorageBackend();
+  }
+}
+
+class InMemoryStorageBackend implements StorageBackend {
+  private readonly blobs = new Map<string, Blob>();
+  private readonly metadata = new Map<string, StoredMetadata>();
+
+  async put(path: string, blob: Blob, metadata: StoredMetadata): Promise<void> {
+    this.blobs.set(path, blob);
+    this.metadata.set(path, metadata);
+  }
+
+  async getBlob(path: string): Promise<Blob | undefined> {
+    return this.blobs.get(path);
+  }
+
+  async getMetadata(path: string): Promise<StoredMetadata | undefined> {
+    return this.metadata.get(path);
+  }
+
+  async putMetadata(path: string, metadata: StoredMetadata): Promise<void> {
+    this.metadata.set(path, metadata);
+  }
+
+  async delete(path: string): Promise<void> {
+    this.blobs.delete(path);
+    this.metadata.delete(path);
+  }
+
+  async listByPrefix(prefix: string): Promise<StoredMetadata[]> {
+    const results: StoredMetadata[] = [];
+    const keys = Array.from(this.metadata.keys()).sort();
+    for (const key of keys) {
+      if (key.startsWith(prefix)) {
+        const meta = this.metadata.get(key);
+        if (meta) results.push(meta);
+      }
+    }
+    return results;
+  }
+
+  async reset(): Promise<void> {
+    this.blobs.clear();
+    this.metadata.clear();
+  }
+
+  close(): void {}
 }
 
 // ─── Internal ──────────────────────────────────────────────────────
@@ -246,21 +297,28 @@ class IndexedDbStorageBackend implements StorageBackend {
 
 function openDatabase(dbName: string): Promise<IDBDatabase> {
   return new Promise((resolve, reject) => {
-    const req = indexedDB.open(dbName, SCHEMA_VERSION);
-    req.addEventListener('upgradeneeded', () => {
-      const db = req.result;
-      if (!db.objectStoreNames.contains(BLOBS_STORE)) {
-        db.createObjectStore(BLOBS_STORE);
-      }
-      if (!db.objectStoreNames.contains(METADATA_STORE)) {
-        db.createObjectStore(METADATA_STORE);
+    try {
+      if (typeof indexedDB === 'undefined' || !indexedDB.open) {
+        return reject(new Error('IndexedDB not available'));
       }
-    });
-    req.addEventListener('success', () => resolve(req.result));
-    req.addEventListener('error', () => reject(req.error));
-    req.addEventListener('blocked', () =>
-      reject(new Error(`IndexedDB open blocked for db "${dbName}"`)),
-    );
+      const req = indexedDB.open(dbName, SCHEMA_VERSION);
+      req.addEventListener('upgradeneeded', () => {
+        const db = req.result;
+        if (!db.objectStoreNames.contains(BLOBS_STORE)) {
+          db.createObjectStore(BLOBS_STORE);
+        }
+        if (!db.objectStoreNames.contains(METADATA_STORE)) {
+          db.createObjectStore(METADATA_STORE);
+        }
+      });
+      req.addEventListener('success', () => resolve(req.result));
+      req.addEventListener('error', () => reject(req.error));
+      req.addEventListener('blocked', () =>
+        reject(new Error(`IndexedDB open blocked for db "${dbName}"`)),
+      );
+    } catch (err) {
+      reject(err);
+    }
   });
 }
 

package/src/storage/sandbox/rules-evaluation-error.ts

@@ -1,2 +1,34 @@
 /** Fatal evaluator misuse caught at the allow boundary and converted to a deny. */
 export class RuleEvalError extends Error {}
+
+/**
+ * A construct whose production verdict is unknowable locally: either
+ * production rejects the ruleset at deploy time (undefined function, wrong
+ * arity, unresolved import, unknown namespace method) or the simulator
+ * cannot model the construct at all. Its effect is EVALUATION-WIDE in
+ * production, where a determining `&&`/`||` operand cannot rescue it, so it is
+ * never absorbed and always fails closed.
+ */
+export class RuleUnsupportedError extends RuleEvalError {}
+
+/**
+ * A resource-limit exhaustion (the two-document Firestore lookup cap, the
+ * max call depth). Production fails the WHOLE evaluation closed on these:
+ * they are not CEL error values, so commutative `&&`/`||` absorption must
+ * not turn one into an allow (same posture as the Firestore simulator's
+ * LookupBudgetError precedent).
+ */
+export class RuleResourceLimitError extends RuleEvalError {}
+
+/**
+ * True for the errors that CEL `&&`/`||` absorption may treat as an error
+ * VALUE at an operand boundary: genuine rule-evaluation failures, excluding
+ * the unsupported/compile-reject and resource-limit classes above.
+ */
+export function isAbsorbableEvalError(err: unknown): err is RuleEvalError {
+  return (
+    err instanceof RuleEvalError
+    && !(err instanceof RuleUnsupportedError)
+    && !(err instanceof RuleResourceLimitError)
+  );
+}

package/src/storage/sandbox/rules-evaluator.ts

@@ -12,7 +12,12 @@ import {
 } from './rules.js';
 import { evalMethodCall } from './rules-methods.js';
 import { formatPath, matchSegments, splitPath } from './rules-path-match.js';
-import { RuleEvalError } from './rules-evaluation-error.js';
+import {
+  RuleEvalError,
+  RuleResourceLimitError,
+  RuleUnsupportedError,
+  isAbsorbableEvalError,
+} from './rules-evaluation-error.js';
 import {
   RuleError,
   describeRulesType as describeType,
@@ -92,6 +97,10 @@ export function evaluateStorageRules(
             );
             continue;
           }
+          // Unverified: production's behavior for a non-boolean allow
+          // condition (a CEL type error there, rather than this truthiness
+          // coercion) has not been captured. The coercion stays as written
+          // until a production capture settles it.
           result = truthy(value);
         } catch (err) {
           // Any function-evaluation failure (undefined function, wrong
@@ -186,12 +195,17 @@ export interface EvalCtx {
 /**
  * Walk an `Expr` against the bindings + path params. Missing bindings or
  * members and invalid operations produce `RuleError` values. They propagate
- * unless evaluation short-circuits around them or an explicitly modeled
- * boolean case absorbs them (for example, `<error> || true`). Any `RuleError`
- * that reaches an allow boundary denies with its production-shaped reason.
+ * unless a `&&`/`||` operand that uniquely determines the result absorbs
+ * them COMMUTATIVELY, CEL-style (`<error> || true` → true, and
+ * `<error> && false` → false, see the binary case). Any `RuleError` that
+ * reaches an allow boundary denies with its production-shaped reason.
  *
- * User-defined function failures throw `RuleEvalError`; the allow boundary
- * likewise catches them and denies instead of falling through to a
+ * Function-evaluation failures throw `RuleEvalError`; at a `&&`/`||`
+ * operand boundary the ABSORBABLE ones are converted to error values so
+ * they participate in the same absorption, while unsupported/compile-reject
+ * (`RuleUnsupportedError`) and resource-limit (`RuleResourceLimitError`)
+ * failures re-throw and fail the evaluation closed. The allow boundary
+ * catches whatever still throws and denies instead of falling through to a
  * potentially truthy value.
  */
 export function evalExpr(expr: Expr, ctx: EvalCtx): unknown {
@@ -236,25 +250,37 @@ export function evalExpr(expr: Expr, ctx: EvalCtx): unknown {
     case 'path':
       // A path literal is only meaningful as a `firestore.get()/exists()`
       // argument (handled directly there). Reaching it anywhere else means
-      // the rule used it out of position — deny rather than coerce.
-      throw new RuleEvalError('a Firestore path literal is only valid as an argument to firestore.get()/exists()');
+      // the rule used it out of position, a compile-reject-class failure
+      // (never absorbed): deny rather than coerce.
+      throw new RuleUnsupportedError('a Firestore path literal is only valid as an argument to firestore.get()/exists()');
     case 'unary': {
-      // An error survives negation (production: `!(resource.name == 'x')` with
-      // `name` absent DENIES). Propagate rather than flipping it to `true`.
       const a = evalExpr(expr.arg, ctx);
+      if (expr.op === '!') {
+        if (isErr(a)) {
+          throw new RuleEvalError(a.message);
+        }
+        if (typeof a !== 'boolean') {
+          throw new RuleEvalError(`Unary '!' expects a boolean, got ${describeType(a)}.`);
+        }
+        return !a;
+      }
       if (isErr(a)) return a;
       if (expr.op === '-') {
         if (a instanceof RulesFloat) return new RulesFloat(-a.value);
         if (typeof a !== 'number') return new RuleError(`Unary '-' applied to ${describeType(a)}.`);
         return -a;
       }
-      return !truthy(a);
+      return undefined;
     }
     case 'ternary': {
       const c = evalExpr(expr.cond, ctx);
       // An error condition denies the whole conditional; it must not fall
       // through to the alternate branch and potentially allow.
       if (isErr(c)) return c;
+      // Unverified: production's behavior for a non-boolean ternary
+      // condition (a CEL type error there, rather than this truthiness
+      // coercion) has not been captured. The coercion stays as written
+      // until a production capture settles it.
       return truthy(c) ? evalExpr(expr.then, ctx) : evalExpr(expr.else, ctx);
     }
     case 'in': {
@@ -318,23 +344,12 @@ export function evalExpr(expr: Expr, ctx: EvalCtx): unknown {
       return new RuleError(`Slice applied to ${describeType(t)} (expected a list or string).`);
     }
     case 'binary': {
-      // Short-circuit && / || so half-undefined chains don't trip
-      // (e.g. `request.auth != null && request.auth.uid == 'a'`).
-      if (expr.op === '&&') {
-        const l = evalExpr(expr.left, ctx);
-        if (isErr(l)) return l;
-        return truthy(l) ? evalExpr(expr.right, ctx) : l;
-      }
-      if (expr.op === '||') {
-        const l = evalExpr(expr.left, ctx);
-        if (isErr(l)) {
-          // Production: `<error> || true` ALLOWS — a true disjunct rescues the
-          // error; `<error> || false` stays an error.
-          const r = evalExpr(expr.right, ctx);
-          return truthy(r) ? r : l;
-        }
-        return truthy(l) ? l : evalExpr(expr.right, ctx);
-      }
+      // RULES-B3: && and || are COMMUTATIVE error-absorbing operators in
+      // CEL, not JS left-to-right short-circuit. The two operators differ
+      // only in which operand value uniquely determines the result: false
+      // for &&, true for ||. Both are evaluated by the one helper below.
+      if (expr.op === '&&') return evalAbsorbingOperator(expr.left, expr.right, false, ctx);
+      if (expr.op === '||') return evalAbsorbingOperator(expr.left, expr.right, true, ctx);
       const l = evalExpr(expr.left, ctx);
       if (isErr(l)) return l;
       const r = evalExpr(expr.right, ctx);
@@ -372,6 +387,64 @@ export function evalExpr(expr: Expr, ctx: EvalCtx): unknown {
   }
 }
 
+/**
+ * Evaluate one commutative error-absorbing operator, `&&` or `||`. The two
+ * differ only in `determining`, the operand value that fixes the result on
+ * its own: `false` for `&&`, `true` for `||`.
+ *
+ * If either operand evaluates to `determining`, that is the result and an
+ * error in the other operand is absorbed, whichever side it sits on. So
+ * `error && false` evaluates to false and `error || true` to true, while
+ * `error && true` and `error || false` propagate the error and deny.
+ * Laziness is preserved in the no-error path: a determining left operand
+ * skips the right one entirely.
+ */
+function evalAbsorbingOperator(
+  left: Expr,
+  right: Expr,
+  determining: boolean,
+  ctx: EvalCtx,
+): boolean | RuleError {
+  const l = evalLogicalOperand(left, ctx);
+  if (l === determining) return determining; // left determines; right unevaluated
+  const r = evalLogicalOperand(right, ctx);
+  if (r === determining) return determining; // right determines and absorbs any left error
+  if (isErr(l)) return l;                    // left errored and nothing determined
+  return r;                                  // left was non-determining; right decides
+}
+
+/**
+ * Evaluate one `&&`/`||` operand tri-state: `true`, `false`, or a
+ * {@link RuleError} value the operator may absorb commutatively.
+ *
+ *   - A thrown ABSORBABLE {@link RuleEvalError} (for example
+ *     `firestore.get()` without an injected capability, or `!` on an error)
+ *     is converted to an error VALUE here so a determining sibling operand
+ *     can absorb it: production evaluates these positions to a
+ *     position-local error.
+ *   - {@link RuleUnsupportedError} (compile-reject or unmodelable) and
+ *     {@link RuleResourceLimitError} (lookup cap, call depth) re-throw:
+ *     production fails those closed for the WHOLE evaluation, so no
+ *     determining operand may rescue them (the lookup-budget precedent).
+ *   - A non-boolean, non-error operand is a CEL TYPE error (RULES-B6,
+ *     captured by rules-firestore-strict-boolean-control-flow): it becomes
+ *     an absorbable error value, never a truthy/falsy coercion.
+ */
+function evalLogicalOperand(expr: Expr, ctx: EvalCtx): boolean | RuleError {
+  let v: unknown;
+  try {
+    v = evalExpr(expr, ctx);
+  } catch (err) {
+    if (isAbsorbableEvalError(err)) return new RuleError(err.message);
+    throw err;
+  }
+  if (isErr(v)) return v;
+  if (typeof v !== 'boolean') {
+    return new RuleError(`Expected a boolean '&&'/'||' operand, got ${describeType(v)}.`);
+  }
+  return v;
+}
+
 /**
  * Evaluate a user-defined function call. Arguments are evaluated in the
  * CALLER's context, then bound to the function's parameters; the body
@@ -382,22 +455,26 @@ export function evalExpr(expr: Expr, ctx: EvalCtx): unknown {
  */
 function evalCall(expr: Extract<Expr, { kind: 'call' }>, ctx: EvalCtx): unknown {
   const fn = ctx.funcs.get(expr.name);
+  // Undefined functions, unresolved imports, and arity mismatches are
+  // COMPILE-reject failures in production (the ruleset never deploys), so
+  // they are RuleUnsupportedError: unabsorbable by &&/||, always deny.
   if (!fn) {
-    throw new RuleEvalError(`undefined function ${expr.name}()`);
+    throw new RuleUnsupportedError(`undefined function ${expr.name}()`);
   }
   if (fn.unresolvedImport !== undefined) {
-    throw new RuleEvalError(
+    throw new RuleUnsupportedError(
       `function ${expr.name}() is imported from '${fn.unresolvedImport}', but import module resolution is not implemented`,
     );
   }
   if (fn.params.length !== expr.args.length) {
-    throw new RuleEvalError(
+    throw new RuleUnsupportedError(
       `function ${expr.name}() expects ${fn.params.length} argument(s), got ${expr.args.length}`,
     );
   }
   const depth = ctx.depth + 1;
   if (depth > MAX_CALL_DEPTH) {
-    throw new RuleEvalError(
+    // Resource-limit class: fails the evaluation closed, never absorbed.
+    throw new RuleResourceLimitError(
       `function ${expr.name}() exceeded max call depth ${MAX_CALL_DEPTH}`,
     );
   }

package/src/storage/sandbox/rules-methods.ts

@@ -1,7 +1,11 @@
 import { RulesFloat } from '../../rules/simulator/wrappers/float.js';
 import type { Expr } from './rules.js';
 import { evalExpr, type EvalCtx } from './rules-evaluator.js';
-import { RuleEvalError } from './rules-evaluation-error.js';
+import {
+  RuleEvalError,
+  RuleResourceLimitError,
+  RuleUnsupportedError,
+} from './rules-evaluation-error.js';
 import {
   RuleError,
   describeRulesType as describeType,
@@ -86,7 +90,10 @@ export function evalMethodCall(expr: Extract<Expr, { kind: 'methodcall' }>, ctx:
     return evalMapGet(expr, ctx);
   }
 
-  throw new RuleEvalError(`unsupported method .${expr.method}()`);
+  // An unknown method name is either unmodeled here or rejected by
+  // production's compiler. Its verdict is unknowable locally, so it is
+  // unabsorbable (fails closed even under a determining &&/|| operand).
+  throw new RuleUnsupportedError(`unsupported method .${expr.method}()`);
 }
 
 /**
@@ -111,7 +118,8 @@ function evalFirestoreBuiltin(
   ctx: EvalCtx,
 ): unknown {
   if (expr.method !== 'get' && expr.method !== 'exists') {
-    throw new RuleEvalError(`unsupported method firestore.${expr.method}()`);
+    // Unknown namespace method, compile-reject class, never absorbed.
+    throw new RuleUnsupportedError(`unsupported method firestore.${expr.method}()`);
   }
   if (!ctx.firestoreLookup) {
     // No sandbox-backed capability injected — keep the deny-with-reason
@@ -121,16 +129,20 @@ function evalFirestoreBuiltin(
     );
   }
   if (expr.args.length !== 1) {
-    throw new RuleEvalError(`firestore.${expr.method}() expects a single path argument`);
+    // Wrong call shape: production rejects at compile; never absorbed.
+    throw new RuleUnsupportedError(`firestore.${expr.method}() expects a single path argument`);
   }
   const arg = expr.args[0];
   if (arg.kind !== 'path') {
-    throw new RuleEvalError(`firestore.${expr.method}() requires a /databases/.../documents/... path literal`);
+    throw new RuleUnsupportedError(`firestore.${expr.method}() requires a /databases/.../documents/... path literal`);
   }
   const docPath = buildFirestoreDocPath(arg, ctx);
   if (!ctx.firestoreAccesses.has(docPath)) {
     if (ctx.firestoreAccesses.size >= 2) {
-      throw new RuleEvalError('firestore access limit exceeded: at most two distinct documents');
+      // Resource-limit class, the same posture as the Firestore lookup
+      // budget: production fails the whole evaluation closed, so a
+      // determining &&/|| operand must NOT absorb this into an allow.
+      throw new RuleResourceLimitError('firestore access limit exceeded: at most two distinct documents');
     }
     ctx.firestoreAccesses.add(docPath);
   }
@@ -140,7 +152,9 @@ function evalFirestoreBuiltin(
   const fields = ctx.firestoreLookup.get(docPath);
   if (fields === null) {
     // A missing get is a Rules error VALUE: it denies at the allow boundary,
-    // but participates in CEL error absorption (`error || true` allows).
+    // but participates in COMMUTATIVE CEL error absorption in `&&`/`||`
+    // (`error || true` allows, and `error && false` evaluates to false,
+    // see the tri-state operand handling in rules-evaluator.ts).
     return new RuleError(`firestore.get() targeted a nonexistent document: ${docPath}`);
   }
   return { data: fields };

package/src/storage/service.ts

@@ -92,6 +92,20 @@ export interface FirebaseStorage {
 /** Storage handle returned by Firebase-shaped app overloads. */
 export type AppFirebaseStorage = FirebaseStorage & { readonly app: FirebaseApp };
 
+/**
+ * Cross-service IAM posture for `firestore.get()/exists()` in Storage rules.
+ *
+ * Production Storage rules can read Firestore ONLY when the project's
+ * Storage service agent holds `roles/firebaserules.firestoreServiceAgent`.
+ * `'granted'` (the default, the common configured-project state) serves
+ * lookups from the same-sandbox Firestore store; `'denied'` makes every
+ * EXECUTED lookup fail exactly like production without the role (error →
+ * rule denies), while short-circuited lookups are never executed and stay
+ * unaffected. Captured boundary: conformance observation
+ * `stdlib-realstorage-p3-lookup-budget` (registry row storage-rules#134).
+ */
+export type CrossServiceIam = 'granted' | 'denied';
+
 /**
  * Internal sandbox service — owns the IDB connection + parsed rules.
  * Only constructed inside the sandbox `getStorageSandbox` path.
@@ -100,6 +114,7 @@ export class StorageService {
   constructor(
     readonly backend: StorageBackend,
     readonly rules: StorageRules | null = null,
+    readonly crossServiceIam: CrossServiceIam = 'granted',
   ) {}
 }
 
@@ -124,7 +139,7 @@ export interface StorageOptions {
    * origin-scoped, so without this every project served on the same
    * localhost port shared one storage database (issue #359). Ignored when
    * an explicit `dbName` is given; only honored on the FIRST call per
-   * `Sandbox`. Hosts pass their project identity here (`pyric dev` passes
+   * `Sandbox`. Hosts pass their project identity here (`pyric sandbox` passes
    * the served project's key; app handles pass `options.projectId`).
    */
   projectId?: string;
@@ -134,12 +149,36 @@ export interface StorageOptions {
    * `Sandbox`.
    */
   rules?: string;
+  /**
+   * Model the production Storage→Firestore IAM dependency (see
+   * {@link CrossServiceIam}). Defaults to `'granted'`. Like `rules`,
+   * only honored on the FIRST storage call per `Sandbox`; a LATER,
+   * DIFFERING value throws instead of silently flipping the mode.
+   */
+  crossServiceIam?: CrossServiceIam;
 }
 
 // ─── Caches ─────────────────────────────────────────────────────────
 
-/** One `StorageService` per `Sandbox`. */
-const SERVICES = new WeakMap<Sandbox, Promise<StorageService>>();
+/**
+ * Everything one `Sandbox` opened its storage service WITH, in one record.
+ * These four facts are written together on the first storage call and read
+ * together afterwards, so they live in one map rather than four parallel
+ * ones that can drift out of step.
+ */
+interface OpenStorageService {
+  /** The service itself, resolving once its IndexedDB backend is open. */
+  readonly service: Promise<StorageService>;
+  /** The rules source it was opened with, `null` when opened without rules. */
+  readonly rulesSource: string | null;
+  /** The module-resolution record for that source, `null` without rules. */
+  readonly rulesResolution: StorageRulesResolution | null;
+  /** The cross-service IAM mode it was opened with. */
+  readonly crossServiceIam: CrossServiceIam;
+}
+
+/** One open storage service, with its opening configuration, per `Sandbox`. */
+const OPEN_SERVICES = new WeakMap<Sandbox, OpenStorageService>();
 
 /** One sandbox `FirebaseStorage` handle per `SandboxContext`. */
 const SANDBOX_HANDLES = new WeakMap<SandboxContext, FirebaseStorage>();
@@ -155,15 +194,32 @@ const SANDBOX_HANDLES = new WeakMap<SandboxContext, FirebaseStorage>();
 const BARE_SANDBOX_HANDLES = new WeakMap<Sandbox, FirebaseStorage>();
 
 /**
- * The rules SOURCE each sandbox's service was opened with (`null` when
- * opened without rules). Late-config detection: rules are honored only on
- * the FIRST storage call per `Sandbox`, so silently discarding a LATER,
- * DIFFERENT `rules` option would be a silent rules wipe — {@link
- * ensureService} throws instead. Re-supplying the IDENTICAL source stays
- * fine (idempotent multi-handle construction, e.g. per-user contexts).
+ * Reject a late option that differs from the one the service is already
+ * open with. Both `rules` and `crossServiceIam` are honored only on the
+ * FIRST storage call per `Sandbox`. Silently discarding a later, differing
+ * value would wipe the rules, or reopen the false-ALLOW surface the IAM
+ * mode models, without a word. Re-supplying the IDENTICAL value stays fine
+ * (idempotent multi-handle construction, for example per-user contexts),
+ * and so does omitting it.
  */
-const SERVICE_RULES_SOURCE = new WeakMap<Sandbox, string | null>();
-const SERVICE_RULES_RESOLUTION = new WeakMap<Sandbox, StorageRulesResolution | null>();
+function rejectDifferingLateConfig(
+  option: string,
+  descriptor: string,
+  supplied: string | undefined,
+  openedWith: string | null,
+  caller: string,
+): void {
+  if (supplied === undefined || supplied === openedWith) return;
+  const openedDescription = openedWith === null
+    ? `without ${option}`
+    : `with a different ${descriptor}`;
+  throw new Error(
+    `pyric/storage: ${caller} received a ${descriptor}, but this sandbox's storage service ` +
+      `is already open ${openedDescription}. ${option} is honored only on the FIRST storage ` +
+      'call per Sandbox, so this value would be silently discarded. Configure it on the first ' +
+      'storage call for this sandbox.',
+  );
+}
 
 /**
  * Get (or open) the ONE per-sandbox `StorageService`. Loud on the
@@ -177,18 +233,23 @@ function ensureService(
   options: StorageOptions,
   caller: string,
 ): Promise<StorageService> {
-  const existing = SERVICES.get(sandbox);
+  const existing = OPEN_SERVICES.get(sandbox);
   if (existing) {
-    const openedWith = SERVICE_RULES_SOURCE.get(sandbox) ?? null;
-    if (options.rules !== undefined && options.rules !== openedWith) {
-      throw new Error(
-        `pyric/storage: ${caller} received a rules source, but this sandbox's storage ` +
-          `service is already open ${openedWith === null ? 'without rules' : 'with a different rules source'} ` +
-          '— rules are honored only on the FIRST storage call per Sandbox, so these rules ' +
-          'would be silently discarded. Configure rules on the first storage call for this sandbox.',
-      );
-    }
-    return existing;
+    rejectDifferingLateConfig(
+      'rules',
+      'rules source',
+      options.rules,
+      existing.rulesSource,
+      caller,
+    );
+    rejectDifferingLateConfig(
+      'crossServiceIam',
+      'crossServiceIam mode',
+      options.crossServiceIam,
+      existing.crossServiceIam,
+      caller,
+    );
+    return existing.service;
   }
   let rules: StorageRules | null = null;
   let resolution: StorageRulesResolution | null = null;
@@ -221,14 +282,18 @@ function ensureService(
   }
   // Explicit dbName wins; otherwise scope the default by project identity so
   // two projects on one origin never share a storage database (issue #359).
+  const crossServiceIam = options.crossServiceIam ?? 'granted';
   const servicePromise = openStorageBackend(
     options.dbName ?? storageDbName(options.projectId),
   ).then(
-    (backend) => new StorageService(backend, rules),
+    (backend) => new StorageService(backend, rules, crossServiceIam),
   );
-  SERVICES.set(sandbox, servicePromise);
-  SERVICE_RULES_SOURCE.set(sandbox, options.rules ?? null);
-  SERVICE_RULES_RESOLUTION.set(sandbox, resolution);
+  OPEN_SERVICES.set(sandbox, {
+    service: servicePromise,
+    rulesSource: options.rules ?? null,
+    rulesResolution: resolution,
+    crossServiceIam,
+  });
   // Join the sandbox's persistable-service REGISTRY so `sandbox.resetAll()`
   // reaches storage (issue #359: Studio's reset cleared Firestore + auth but
   // never storage — storage was invisible to the sandbox). Storage does NOT
@@ -293,6 +358,7 @@ export function getStorageSandbox(
     kind: 'sandbox',
     sandbox,
     context: ctx,
+    currentAuth: fromBareSandbox ? () => sandbox.currentUser : undefined,
     bucket,
     servicePromise,
   };
@@ -427,5 +493,5 @@ export function getStorageService(storage: FirebaseStorage): Promise<StorageServ
 export function getStorageRulesResolution(
   storage: FirebaseStorage,
 ): StorageRulesResolution | null {
-  return SERVICE_RULES_RESOLUTION.get(targetOf(storage).sandbox) ?? null;
+  return OPEN_SERVICES.get(targetOf(storage).sandbox)?.rulesResolution ?? null;
 }