pyric 0.1.0-alpha.20 → 0.1.0-alpha.21

package/dist/deferred/entry.js

@@ -0,0 +1,143 @@
+/**
+ * The shared factory behind pyric's *deferred* Firebase Web SDK subpaths —
+ * `pyric/functions`, `pyric/analytics`, `pyric/app-check`,
+ * `pyric/firestore/lite`, `pyric/performance` and `pyric/remote-config`.
+ *
+ * WHY THESE EXIST AT ALL. pyric is a symbol-for-symbol drop-in for the
+ * Firebase Web SDK: an app swaps the `firebase` specifier for `pyric` and its
+ * module graph must keep loading. A subpath that is simply absent from the
+ * package `exports` map fails at RESOLVE time — Node raises
+ * `ERR_PACKAGE_PATH_NOT_EXPORTED`, bundlers raise their own variants — long
+ * before any pyric code runs. That error names neither pyric nor the reason,
+ * so a developer whose app merely *mentions* `firebase/functions` on a code
+ * path it never takes sees an unattributable build failure.
+ *
+ * THE CONTRACT. Resolution and linking succeed; *use* fails loudly.
+ *   - The subpath resolves, so the module graph loads.
+ *   - Every symbol the real Firebase entry exports is present as a value, so
+ *     named-import linking (which is static in ESM — a missing name is a link
+ *     error, not a runtime one) succeeds and bundlers can tree-shake.
+ *   - Calling, constructing, or reading a member off one of those values
+ *     throws {@link PyricDeferredApiError} with a message that names the
+ *     subpath and points at the conformance matrix.
+ *
+ * An app that imports but never calls therefore runs unchanged. An app that
+ * genuinely depends on a deferred service gets one clear, attributed error at
+ * the exact call site instead of a cryptic resolver failure.
+ *
+ * NOT a mirror. These entries deliberately implement nothing. They are marked
+ * deferred in the conformance surface story and must never be counted as
+ * implemented surface.
+ */
+/**
+ * Compose the single user-facing message every deferred entry raises.
+ *
+ * @param subpath - The Firebase subpath *without* the `firebase/` prefix, e.g.
+ *   `functions` or `firestore/lite`.
+ */
+function deferredApiMessage(subpath) {
+    return (`pyric: 'firebase/${subpath}' is not yet mirrored by the local sandbox. ` +
+        'This API is deferred — see the conformance matrix. Imports resolve so ' +
+        'module graphs load; calls fail with this message.');
+}
+/**
+ * The error thrown by every deferred Firebase entry. Carries the subpath and
+ * the symbol that was touched so tooling can group these without parsing the
+ * message.
+ */
+export class PyricDeferredApiError extends Error {
+    name = 'PyricDeferredApiError';
+    /** The Firebase subpath, without the `firebase/` prefix (e.g. `functions`). */
+    subpath;
+    /** The exported symbol whose use triggered this error (e.g. `getFunctions`). */
+    symbol;
+    constructor(subpath, symbol) {
+        super(deferredApiMessage(subpath));
+        this.subpath = subpath;
+        this.symbol = symbol;
+    }
+}
+/**
+ * Property reads that must NOT throw.
+ *
+ * Bundlers, test runners, `console.log`, promise adoption and React all probe
+ * values with these keys as part of ordinary machinery, never as an intent to
+ * use the API. Throwing on `then` in particular would turn `await`-ing
+ * anything holding a deferred value into this error at the wrong site, and
+ * throwing on `$$typeof` would break React's element check. They read as
+ * `undefined`, exactly as they would on a real function.
+ */
+const INERT_PROPERTIES = new Set([
+    '$$typeof',
+    '__esModule',
+    'constructor',
+    'displayName',
+    'inspect',
+    'length',
+    'name',
+    'nodeType',
+    'prototype',
+    'then',
+    'toJSON',
+    'toString',
+    'valueOf',
+]);
+/**
+ * Build one deferred export: a function that throws when called or
+ * constructed, wrapped in a proxy so member reads (the enum-constant shape)
+ * throw the same error.
+ */
+function deferredSymbol(subpath, symbol) {
+    const throwing = function deferred() {
+        throw new PyricDeferredApiError(subpath, symbol);
+    };
+    Object.defineProperty(throwing, 'name', { value: symbol, configurable: true });
+    return new Proxy(throwing, {
+        get(target, property, receiver) {
+            // Symbol-keyed reads are always machinery (Symbol.toPrimitive,
+            // Symbol.hasInstance, Symbol.toStringTag, the inspect hook, …) — never a
+            // user reaching for an API member.
+            if (typeof property === 'symbol' || INERT_PROPERTIES.has(property)) {
+                return Reflect.get(target, property, receiver);
+            }
+            throw new PyricDeferredApiError(subpath, `${symbol}.${property}`);
+        },
+        construct() {
+            throw new PyricDeferredApiError(subpath, symbol);
+        },
+    });
+}
+/**
+ * The lazily-materialised export bag for one deferred subpath.
+ *
+ * Each entry module destructures the symbols it needs off this object:
+ *
+ * ```ts
+ * export const { getFunctions, httpsCallable } = deferredEntry('functions');
+ * ```
+ *
+ * Destructuring is what makes the names real ESM exports (and what keeps the
+ * generated `.d.ts` honest); the proxy just mints a correctly-attributed stub
+ * for whichever name is read.
+ *
+ * @param subpath - The Firebase subpath, without the `firebase/` prefix.
+ */
+export function deferredEntry(subpath) {
+    const minted = new Map();
+    return new Proxy(Object.create(null), {
+        get(_target, property) {
+            if (typeof property === 'symbol')
+                return undefined;
+            let api = minted.get(property);
+            if (!api) {
+                api = deferredSymbol(subpath, property);
+                minted.set(property, api);
+            }
+            return api;
+        },
+        has() {
+            return true;
+        },
+    });
+}
+//# sourceMappingURL=entry.js.map

package/dist/deferred/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../src/deferred/entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,CACL,oBAAoB,OAAO,8CAA8C;QACzE,wEAAwE;QACxE,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC5B,IAAI,GAAG,uBAAuB,CAAC;IAEjD,+EAA+E;IACtE,OAAO,CAAS;IAEzB,gFAAgF;IACvE,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAiBD;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,UAAU;IACV,YAAY;IACZ,aAAa;IACb,aAAa;IACb,SAAS;IACT,QAAQ;IACR,MAAM;IACN,UAAU;IACV,WAAW;IACX,MAAM;IACN,QAAQ;IACR,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,MAAc;IACrD,MAAM,QAAQ,GAAG,SAAS,QAAQ;QAChC,MAAM,IAAI,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/E,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE;QACzB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC5B,+DAA+D;YAC/D,yEAAyE;YACzE,mCAAmC;YACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,OAAO,EAAE,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,SAAS;YACP,MAAM,IAAI,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;KACF,CAA2B,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgC,EAAE;QACnE,GAAG,CAAC,OAAO,EAAE,QAAQ;YACnB,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,OAAO,SAAmC,CAAC;YAC7E,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/firestore/lite.d.ts

@@ -0,0 +1,72 @@
+/**
+ * `pyric/firestore/lite` — a DEFERRED mirror of `firebase/firestore/lite`.
+ *
+ * The Lite SDK is a separate build of Firestore with no local cache, no
+ * listeners and no offline queue. pyric mirrors the full `firebase/firestore`
+ * surface against the in-process sandbox; the Lite build needs its own
+ * cache-free instance identity, so it is deferred rather than aliased — an
+ * alias would silently give Lite consumers listener-backed semantics the real
+ * Lite SDK does not have.
+ *
+ * Every symbol below resolves and links so an app that swaps `firebase` for
+ * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
+ * subpath. See `../deferred/entry.ts` for the full rationale.
+ *
+ * The value list is the exact public runtime surface of `firebase/firestore/lite`
+ * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
+ * real mirror.
+ */
+import { type DeferredApi } from '../deferred/entry.js';
+export { PyricDeferredApiError } from '../deferred/entry.js';
+export declare const AggregateField: DeferredApi, AggregateQuerySnapshot: DeferredApi, Bytes: DeferredApi, CollectionReference: DeferredApi, DocumentReference: DeferredApi, DocumentSnapshot: DeferredApi, FieldPath: DeferredApi, FieldValue: DeferredApi, Firestore: DeferredApi, FirestoreError: DeferredApi, GeoPoint: DeferredApi, Query: DeferredApi, QueryCompositeFilterConstraint: DeferredApi, QueryConstraint: DeferredApi, QueryDocumentSnapshot: DeferredApi, QueryEndAtConstraint: DeferredApi, QueryFieldFilterConstraint: DeferredApi, QueryLimitConstraint: DeferredApi, QueryOrderByConstraint: DeferredApi, QuerySnapshot: DeferredApi, QueryStartAtConstraint: DeferredApi, Timestamp: DeferredApi, Transaction: DeferredApi, VectorValue: DeferredApi, WriteBatch: DeferredApi, addDoc: DeferredApi, aggregateFieldEqual: DeferredApi, aggregateQuerySnapshotEqual: DeferredApi, and: DeferredApi, arrayRemove: DeferredApi, arrayUnion: DeferredApi, average: DeferredApi, collection: DeferredApi, collectionGroup: DeferredApi, connectFirestoreEmulator: DeferredApi, count: DeferredApi, deleteDoc: DeferredApi, deleteField: DeferredApi, doc: DeferredApi, documentId: DeferredApi, endAt: DeferredApi, endBefore: DeferredApi, getAggregate: DeferredApi, getCount: DeferredApi, getDoc: DeferredApi, getDocs: DeferredApi, getFirestore: DeferredApi, increment: DeferredApi, initializeFirestore: DeferredApi, limit: DeferredApi, limitToLast: DeferredApi, or: DeferredApi, orderBy: DeferredApi, query: DeferredApi, queryEqual: DeferredApi, refEqual: DeferredApi, runTransaction: DeferredApi, serverTimestamp: DeferredApi, setDoc: DeferredApi, setLogLevel: DeferredApi, snapshotEqual: DeferredApi, startAfter: DeferredApi, startAt: DeferredApi, sum: DeferredApi, terminate: DeferredApi, updateDoc: DeferredApi, vector: DeferredApi, where: DeferredApi, writeBatch: DeferredApi;
+export type AddPrefixToKeys = DeferredApi;
+export type AggregateField = DeferredApi;
+export type AggregateFieldType = DeferredApi;
+export type AggregateQuerySnapshot = DeferredApi;
+export type AggregateSpec = DeferredApi;
+export type AggregateSpecData = DeferredApi;
+export type AggregateType = DeferredApi;
+export type Bytes = DeferredApi;
+export type ChildUpdateFields = DeferredApi;
+export type CollectionReference = DeferredApi;
+export type DocumentData = DeferredApi;
+export type DocumentReference = DeferredApi;
+export type DocumentSnapshot = DeferredApi;
+export type EmulatorMockTokenOptions = DeferredApi;
+export type FieldPath = DeferredApi;
+export type FieldValue = DeferredApi;
+export type Firestore = DeferredApi;
+export type FirestoreDataConverter = DeferredApi;
+export type FirestoreError = DeferredApi;
+export type FirestoreErrorCode = DeferredApi;
+export type GeoPoint = DeferredApi;
+export type LogLevel = DeferredApi;
+export type NestedUpdateFields = DeferredApi;
+export type OrderByDirection = DeferredApi;
+export type PartialWithFieldValue = DeferredApi;
+export type Primitive = DeferredApi;
+export type Query = DeferredApi;
+export type QueryCompositeFilterConstraint = DeferredApi;
+export type QueryConstraint = DeferredApi;
+export type QueryConstraintType = DeferredApi;
+export type QueryDocumentSnapshot = DeferredApi;
+export type QueryEndAtConstraint = DeferredApi;
+export type QueryFieldFilterConstraint = DeferredApi;
+export type QueryFilterConstraint = DeferredApi;
+export type QueryLimitConstraint = DeferredApi;
+export type QueryNonFilterConstraint = DeferredApi;
+export type QueryOrderByConstraint = DeferredApi;
+export type QuerySnapshot = DeferredApi;
+export type QueryStartAtConstraint = DeferredApi;
+export type SetOptions = DeferredApi;
+export type Settings = DeferredApi;
+export type Timestamp = DeferredApi;
+export type Transaction = DeferredApi;
+export type TransactionOptions = DeferredApi;
+export type UnionToIntersection = DeferredApi;
+export type UpdateData = DeferredApi;
+export type VectorValue = DeferredApi;
+export type WhereFilterOp = DeferredApi;
+export type WithFieldValue = DeferredApi;
+export type WriteBatch = DeferredApi;
+//# sourceMappingURL=lite.d.ts.map

package/dist/firestore/lite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lite.d.ts","sourceRoot":"","sources":["../../src/firestore/lite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,eAAO,MACL,cAAc,eAAE,sBAAsB,eAAE,KAAK,eAAE,mBAAmB,eAAE,iBAAiB,eACrF,gBAAgB,eAAE,SAAS,eAAE,UAAU,eAAE,SAAS,eAAE,cAAc,eAAE,QAAQ,eAAE,KAAK,eACnF,8BAA8B,eAAE,eAAe,eAAE,qBAAqB,eAAE,oBAAoB,eAC5F,0BAA0B,eAAE,oBAAoB,eAAE,sBAAsB,eAAE,aAAa,eACvF,sBAAsB,eAAE,SAAS,eAAE,WAAW,eAAE,WAAW,eAAE,UAAU,eAAE,MAAM,eAC/E,mBAAmB,eAAE,2BAA2B,eAAE,GAAG,eAAE,WAAW,eAAE,UAAU,eAAE,OAAO,eACvF,UAAU,eAAE,eAAe,eAAE,wBAAwB,eAAE,KAAK,eAAE,SAAS,eAAE,WAAW,eAAE,GAAG,eACzF,UAAU,eAAE,KAAK,eAAE,SAAS,eAAE,YAAY,eAAE,QAAQ,eAAE,MAAM,eAAE,OAAO,eAAE,YAAY,eACnF,SAAS,eAAE,mBAAmB,eAAE,KAAK,eAAE,WAAW,eAAE,EAAE,eAAE,OAAO,eAAE,KAAK,eAAE,UAAU,eAAE,QAAQ,eAC5F,cAAc,eAAE,eAAe,eAAE,MAAM,eAAE,WAAW,eAAE,aAAa,eAAE,UAAU,eAAE,OAAO,eACxF,GAAG,eAAE,SAAS,eAAE,SAAS,eAAE,MAAM,eAAE,KAAK,eAAE,UAAU,aACnB,CAAC;AAOpC,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;AAC1C,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;AACzC,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAC7C,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC;AACjD,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AACxC,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAC5C,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AACxC,MAAM,MAAM,KAAK,GAAG,WAAW,CAAC;AAChC,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAC5C,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC9C,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AACvC,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAC5C,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC3C,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAAC;AACnD,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC;AACpC,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC;AACrC,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC;AACpC,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC;AACjD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;AACzC,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAC7C,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC;AACnC,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC;AACnC,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAC7C,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC3C,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAChD,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC;AACpC,MAAM,MAAM,KAAK,GAAG,WAAW,CAAC;AAChC,MAAM,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACzD,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;AAC1C,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC9C,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAChD,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAC/C,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC;AACrD,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAChD,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAC/C,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAAC;AACnD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC;AACjD,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AACxC,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC;AACjD,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC;AACrC,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC;AACnC,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC;AACtC,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAC7C,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC9C,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC;AACrC,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC;AACtC,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AACxC,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;AACzC,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC"}

package/dist/firestore/lite.js

@@ -0,0 +1,22 @@
+/**
+ * `pyric/firestore/lite` — a DEFERRED mirror of `firebase/firestore/lite`.
+ *
+ * The Lite SDK is a separate build of Firestore with no local cache, no
+ * listeners and no offline queue. pyric mirrors the full `firebase/firestore`
+ * surface against the in-process sandbox; the Lite build needs its own
+ * cache-free instance identity, so it is deferred rather than aliased — an
+ * alias would silently give Lite consumers listener-backed semantics the real
+ * Lite SDK does not have.
+ *
+ * Every symbol below resolves and links so an app that swaps `firebase` for
+ * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
+ * subpath. See `../deferred/entry.ts` for the full rationale.
+ *
+ * The value list is the exact public runtime surface of `firebase/firestore/lite`
+ * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
+ * real mirror.
+ */
+import { deferredEntry } from '../deferred/entry.js';
+export { PyricDeferredApiError } from '../deferred/entry.js';
+export const { AggregateField, AggregateQuerySnapshot, Bytes, CollectionReference, DocumentReference, DocumentSnapshot, FieldPath, FieldValue, Firestore, FirestoreError, GeoPoint, Query, QueryCompositeFilterConstraint, QueryConstraint, QueryDocumentSnapshot, QueryEndAtConstraint, QueryFieldFilterConstraint, QueryLimitConstraint, QueryOrderByConstraint, QuerySnapshot, QueryStartAtConstraint, Timestamp, Transaction, VectorValue, WriteBatch, addDoc, aggregateFieldEqual, aggregateQuerySnapshotEqual, and, arrayRemove, arrayUnion, average, collection, collectionGroup, connectFirestoreEmulator, count, deleteDoc, deleteField, doc, documentId, endAt, endBefore, getAggregate, getCount, getDoc, getDocs, getFirestore, increment, initializeFirestore, limit, limitToLast, or, orderBy, query, queryEqual, refEqual, runTransaction, serverTimestamp, setDoc, setLogLevel, snapshotEqual, startAfter, startAt, sum, terminate, updateDoc, vector, where, writeBatch, } = deferredEntry('firestore/lite');
+//# sourceMappingURL=lite.js.map

package/dist/firestore/lite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lite.js","sourceRoot":"","sources":["../../src/firestore/lite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,EACX,cAAc,EAAE,sBAAsB,EAAE,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EACrF,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EACnF,8BAA8B,EAAE,eAAe,EAAE,qBAAqB,EAAE,oBAAoB,EAC5F,0BAA0B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,aAAa,EACvF,sBAAsB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAC/E,mBAAmB,EAAE,2BAA2B,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EACvF,UAAU,EAAE,eAAe,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EACzF,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EACnF,SAAS,EAAE,mBAAmB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAC5F,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EACxF,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GACrD,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/firestore/persistence.d.ts

@@ -90,7 +90,7 @@ declare const TAB_MANAGER_SYMBOL: unique symbol;
  *  {@link memoryEagerGarbageCollector} / {@link memoryLruGarbageCollector}. */
 declare const GC_SYMBOL: unique symbol;
 /** Opaque tab-manager config token. Inert — persistence is always on,
- *  and the SharedWorker/`pyric dev` path already is the one shared
+ *  and the SharedWorker/`pyric sandbox` path already is the one shared
  *  store every tab talks to, so there is no separate multi-tab mode
  *  to opt into. Carries the requested kind only for debugging. */
 export interface PersistentTabManager {
@@ -235,7 +235,7 @@ export type LogLevel = 'debug' | 'verbose' | 'info' | 'warn' | 'error' | 'silent
 /**
  * Accepted no-op: the sandbox has no modular-SDK-style logger to wire
  * a level into (it uses host-level `console` logging directly, gated
- * by `pyric dev`'s own flags, not this call). Exists purely so app
+ * by `pyric sandbox`'s own flags, not this call). Exists purely so app
  * code that calls this defensively at startup doesn't crash on a
  * missing export.
  */

package/dist/firestore/persistence.js

@@ -263,7 +263,7 @@ export function getDocsFromCache(query) {
 /**
  * Accepted no-op: the sandbox has no modular-SDK-style logger to wire
  * a level into (it uses host-level `console` logging directly, gated
- * by `pyric dev`'s own flags, not this call). Exists purely so app
+ * by `pyric sandbox`'s own flags, not this call). Exists purely so app
  * code that calls this defensively at startup doesn't crash on a
  * missing export.
  */

package/dist/functions/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `pyric/functions` — a DEFERRED mirror of `firebase/functions`.
+ *
+ * Callable Cloud Functions dispatch to deployed server code. Mirroring this
+ * means running the user’s functions, which is the emulator’s job, not the
+ * in-process sandbox’s — deferred pending a decision on the function-host
+ * seam.
+ *
+ * Every symbol below resolves and links so an app that swaps `firebase` for
+ * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
+ * subpath. See `../deferred/entry.ts` for the full rationale.
+ *
+ * The value list is the exact public runtime surface of `firebase/functions`
+ * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
+ * real mirror.
+ */
+import { type DeferredApi } from '../deferred/entry.js';
+export { PyricDeferredApiError } from '../deferred/entry.js';
+export declare const FunctionsError: DeferredApi, connectFunctionsEmulator: DeferredApi, getFunctions: DeferredApi, httpsCallable: DeferredApi, httpsCallableFromURL: DeferredApi;
+export type Functions = DeferredApi;
+export type FunctionsError = DeferredApi;
+export type FunctionsErrorCode = DeferredApi;
+export type FunctionsErrorCodeCore = DeferredApi;
+export type HttpsCallable = DeferredApi;
+export type HttpsCallableOptions = DeferredApi;
+export type HttpsCallableResult = DeferredApi;
+export type HttpsCallableStreamOptions = DeferredApi;
+export type HttpsCallableStreamResult = DeferredApi;
+//# sourceMappingURL=index.d.ts.map

package/dist/functions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/functions/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,eAAO,MACL,cAAc,eAAE,wBAAwB,eAAE,YAAY,eAAE,aAAa,eAAE,oBAAoB,aAC/D,CAAC;AAO/B,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC;AACpC,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;AACzC,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAC7C,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC;AACjD,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AACxC,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAC/C,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC9C,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC;AACrD,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC"}

package/dist/functions/index.js

@@ -0,0 +1,20 @@
+/**
+ * `pyric/functions` — a DEFERRED mirror of `firebase/functions`.
+ *
+ * Callable Cloud Functions dispatch to deployed server code. Mirroring this
+ * means running the user’s functions, which is the emulator’s job, not the
+ * in-process sandbox’s — deferred pending a decision on the function-host
+ * seam.
+ *
+ * Every symbol below resolves and links so an app that swaps `firebase` for
+ * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
+ * subpath. See `../deferred/entry.ts` for the full rationale.
+ *
+ * The value list is the exact public runtime surface of `firebase/functions`
+ * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
+ * real mirror.
+ */
+import { deferredEntry } from '../deferred/entry.js';
+export { PyricDeferredApiError } from '../deferred/entry.js';
+export const { FunctionsError, connectFunctionsEmulator, getFunctions, httpsCallable, httpsCallableFromURL, } = deferredEntry('functions');
+//# sourceMappingURL=index.js.map

package/dist/functions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/functions/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,EACX,cAAc,EAAE,wBAAwB,EAAE,YAAY,EAAE,aAAa,EAAE,oBAAoB,GAC5F,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC"}

package/dist/performance/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `pyric/performance` — a DEFERRED mirror of `firebase/performance`.
+ *
+ * Performance Monitoring instruments real network and render timings and
+ * ships them to Google. Nothing about it is locally observable, so it is
+ * deferred.
+ *
+ * Every symbol below resolves and links so an app that swaps `firebase` for
+ * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
+ * subpath. See `../deferred/entry.ts` for the full rationale.
+ *
+ * The value list is the exact public runtime surface of `firebase/performance`
+ * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
+ * real mirror.
+ */
+import { type DeferredApi } from '../deferred/entry.js';
+export { PyricDeferredApiError } from '../deferred/entry.js';
+export declare const getPerformance: DeferredApi, initializePerformance: DeferredApi, trace: DeferredApi;
+export type FirebasePerformance = DeferredApi;
+export type PerformanceSettings = DeferredApi;
+export type PerformanceTrace = DeferredApi;
+//# sourceMappingURL=index.d.ts.map

package/dist/performance/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/performance/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,eAAO,MACL,cAAc,eAAE,qBAAqB,eAAE,KAAK,aACd,CAAC;AAOjC,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC9C,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC9C,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC"}

package/dist/performance/index.js

@@ -0,0 +1,19 @@
+/**
+ * `pyric/performance` — a DEFERRED mirror of `firebase/performance`.
+ *
+ * Performance Monitoring instruments real network and render timings and
+ * ships them to Google. Nothing about it is locally observable, so it is
+ * deferred.
+ *
+ * Every symbol below resolves and links so an app that swaps `firebase` for
+ * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
+ * subpath. See `../deferred/entry.ts` for the full rationale.
+ *
+ * The value list is the exact public runtime surface of `firebase/performance`
+ * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
+ * real mirror.
+ */
+import { deferredEntry } from '../deferred/entry.js';
+export { PyricDeferredApiError } from '../deferred/entry.js';
+export const { getPerformance, initializePerformance, trace, } = deferredEntry('performance');
+//# sourceMappingURL=index.js.map

package/dist/performance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/performance/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,EACX,cAAc,EAAE,qBAAqB,EAAE,KAAK,GAC7C,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC"}

package/dist/remote-config/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `pyric/remote-config` — a DEFERRED mirror of `firebase/remote-config`.
+ *
+ * Remote Config serves server-side parameter values with fetch/activate
+ * caching semantics. Mirroring it needs a sandbox-side config store and a
+ * model of the fetch throttle — buildable, not yet built.
+ *
+ * Every symbol below resolves and links so an app that swaps `firebase` for
+ * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
+ * subpath. See `../deferred/entry.ts` for the full rationale.
+ *
+ * The value list is the exact public runtime surface of `firebase/remote-config`
+ * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
+ * real mirror.
+ */
+import { type DeferredApi } from '../deferred/entry.js';
+export { PyricDeferredApiError } from '../deferred/entry.js';
+export declare const activate: DeferredApi, ensureInitialized: DeferredApi, fetchAndActivate: DeferredApi, fetchConfig: DeferredApi, getAll: DeferredApi, getBoolean: DeferredApi, getNumber: DeferredApi, getRemoteConfig: DeferredApi, getString: DeferredApi, getValue: DeferredApi, onConfigUpdate: DeferredApi, setCustomSignals: DeferredApi, setLogLevel: DeferredApi;
+/**
+ * The one deferred symbol that answers instead of throwing: the real SDK
+ * resolves a boolean, and a deferred entry IS unsupported, so the standard
+ * `isSupported().then(ok => ok && get…(app))` guard must run — not crash.
+ */
+export declare const isSupported: () => Promise<boolean>;
+export type ConfigUpdate = DeferredApi;
+export type ConfigUpdateObserver = DeferredApi;
+export type CustomSignals = DeferredApi;
+export type FetchResponse = DeferredApi;
+export type FetchStatus = DeferredApi;
+export type FetchType = DeferredApi;
+export type FirebaseExperimentDescription = DeferredApi;
+export type FirebaseRemoteConfigObject = DeferredApi;
+export type LogLevel = DeferredApi;
+export type RemoteConfig = DeferredApi;
+export type RemoteConfigOptions = DeferredApi;
+export type RemoteConfigSettings = DeferredApi;
+export type Unsubscribe = DeferredApi;
+export type Value = DeferredApi;
+export type ValueSource = DeferredApi;
+//# sourceMappingURL=index.d.ts.map

package/dist/remote-config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/remote-config/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,eAAO,MACL,QAAQ,eAAE,iBAAiB,eAAE,gBAAgB,eAAE,WAAW,eAAE,MAAM,eAAE,UAAU,eAAE,SAAS,eACzF,eAAe,eAAE,SAAS,eAAE,QAAQ,eAAE,cAAc,eAAE,gBAAgB,eACtE,WAAW,aACqB,CAAC;AAEnC;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,OAAO,CAAU,CAAC;AAQ/D,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AACvC,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AACxC,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC;AACtC,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC;AACpC,MAAM,MAAM,6BAA6B,GAAG,WAAW,CAAC;AACxD,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC;AACrD,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC;AACnC,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AACvC,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC9C,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAC/C,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC;AACtC,MAAM,MAAM,KAAK,GAAG,WAAW,CAAC;AAChC,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC"}

package/dist/remote-config/index.js

@@ -0,0 +1,25 @@
+/**
+ * `pyric/remote-config` — a DEFERRED mirror of `firebase/remote-config`.
+ *
+ * Remote Config serves server-side parameter values with fetch/activate
+ * caching semantics. Mirroring it needs a sandbox-side config store and a
+ * model of the fetch throttle — buildable, not yet built.
+ *
+ * Every symbol below resolves and links so an app that swaps `firebase` for
+ * `pyric` still loads; touching one throws `PyricDeferredApiError` naming this
+ * subpath. See `../deferred/entry.ts` for the full rationale.
+ *
+ * The value list is the exact public runtime surface of `firebase/remote-config`
+ * (Firebase Web SDK 12.13.0). Keep it in sync when this entry graduates to a
+ * real mirror.
+ */
+import { deferredEntry } from '../deferred/entry.js';
+export { PyricDeferredApiError } from '../deferred/entry.js';
+export const { activate, ensureInitialized, fetchAndActivate, fetchConfig, getAll, getBoolean, getNumber, getRemoteConfig, getString, getValue, onConfigUpdate, setCustomSignals, setLogLevel, } = deferredEntry('remote-config');
+/**
+ * The one deferred symbol that answers instead of throwing: the real SDK
+ * resolves a boolean, and a deferred entry IS unsupported, so the standard
+ * `isSupported().then(ok => ok && get…(app))` guard must run — not crash.
+ */
+export const isSupported = async () => false;
+//# sourceMappingURL=index.js.map

package/dist/remote-config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/remote-config/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,EACX,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EACzF,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EACtE,WAAW,GACZ,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,IAAsB,EAAE,CAAC,KAAK,CAAC"}

package/dist/rules/grammar/FirestoreValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FirestoreValidator.d.ts","sourceRoot":"","sources":["../../../src/rules/grammar/FirestoreValidator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACf,MAAM,mBAAmB,CAAC;AAG3B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,iBAAiB,EAAE,CAwB/E"}
+{"version":3,"file":"FirestoreValidator.d.ts","sourceRoot":"","sources":["../../../src/rules/grammar/FirestoreValidator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACf,MAAM,mBAAmB,CAAC;AAI3B,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,iBAAiB,EAAE,CAyB/E"}

package/dist/rules/grammar/FirestoreValidator.js

@@ -1,4 +1,5 @@
 import { RULES_BUILTIN_FUNCTIONS } from './builtin-functions.js';
+import { countDocumentAccessCalls } from './document-access-count.js';
 const WRITE_OPS = new Set(['write', 'create', 'update', 'delete']);
 const READ_OPS = new Set(['read', 'get', 'list']);
 const DATA_WRITE_OPS = new Set(['create', 'update']);
@@ -10,8 +11,9 @@ export function validateFirestoreRules(ast) {
     const allCalls = collectAllCallsInRules(rootMatch);
     // SEC-4: Check for default deny
     checkDefaultDeny(rootMatch, findings);
-    // QUA-3: Duplicate function names
-    checkDuplicateFunctions(rootMatch, findings);
+    // QUA-3: Duplicate function names in one scope (production compile
+    // rejection, so critical). Nested shadowing is legal and is not flagged.
+    checkDuplicateFunctions(ast, findings);
     // QUA-4: Unused functions
     checkUnusedFunctions(rootMatch, allCalls, findings);
     // STR-3: Overlapping match paths
@@ -88,12 +90,15 @@ function walkMatch(match, findings, allFunctions, scopeFunctions) {
                 message: `Create rule at ${pathStr} references resource.data but document doesn't exist yet on create`,
             });
         }
-        // SEM-3: get()/exists() budget exceeded
-        const docReads = countDocReads(cond, new Map(localScope.map(f => [f.name, f])));
+        // SEM-3: document access budget exceeded. Production allows exactly 10
+        // get/exists/getAfter/existsAfter reads per request evaluation; the
+        // 11th fails, so the finding fires only ABOVE 10 (same boundary as the
+        // linter's GET_COUNT error and the simulator's runtime LookupBudget).
+        const docReads = countDocumentAccessCalls(cond, fnMap);
         if (docReads > 10) {
             findings.push({
                 code: 'SEM-3', severity: 'high', path: pathStr, operation: opStr,
-                message: `Rule at ${pathStr} has ${docReads} document reads (get/exists) — exceeds the 10-call budget`,
+                message: `Rule at ${pathStr} may perform ${docReads} document access calls (get/exists/getAfter/existsAfter), which exceeds the 10-call budget`,
             });
         }
         // SEM-4: Undefined function call
@@ -274,20 +279,6 @@ function referencesResourceData(expr) {
     return exprContains(expr, e => e.type === 'memberAccess' && e.property === 'data' &&
         e.object.type === 'identifier' && e.object.name === 'resource');
 }
-function countDocReads(expr, functions, visited = new Set()) {
-    let count = 0;
-    walkExpr(expr, e => {
-        if (e.type === 'functionCall' && (e.name === 'get' || e.name === 'exists' || e.name === 'getAfter')) {
-            count++;
-        }
-        // Follow user-defined function calls
-        if (e.type === 'functionCall' && functions.has(e.name) && !visited.has(e.name)) {
-            visited.add(e.name);
-            count += countDocReads(functions.get(e.name).body, functions, visited);
-        }
-    });
-    return count;
-}
 function collectFunctionCalls(expr) {
     const calls = [];
     walkExpr(expr, e => {
@@ -308,21 +299,46 @@ function collectAllFunctions(match) {
     return names;
 }
 // ---- QUA-3: Duplicate functions ----
-function checkDuplicateFunctions(match, findings) {
+//
+// Production REJECTS two declarations of one function name in the SAME
+// scope at compile time, so this is severity 'critical': the write gate
+// (`write/handler.ts`) blocks only critical validator findings, and
+// 'medium' folded to a mere warning that deployed anyway.
+//
+// A scope is one declaration list: the global list above `service`, the
+// list directly inside `service`, or one match block's own list. A nested
+// match block that redeclares a name from an enclosing scope SHADOWS it and
+// is legal: the simulator implements shadowing in
+// `simulator/match-resolution.ts`, and the production capture in
+// `conformance/rules-corpus/storage/function-scopes-and-shadowing.ts` pins
+// inner-shadows-outer as accepted. Flagging that would block a ruleset
+// production deploys.
+//
+// The code stays QUA-3 (already registered and asserted by consumers);
+// `DUPLICATE_FUNCTION` was considered and rejected, because the module
+// resolver already uses that name for its own error code
+// (`modules/resolver-core.ts`), and colliding would make mixed issue
+// lists ambiguous.
+function checkDuplicateFunctions(ast, findings) {
+    checkDupsInScope(ast.functions ?? [], 'global scope', findings);
+    checkDupsInScope(ast.service.functions ?? [], `service ${ast.service.name}`, findings);
+    checkDupsInMatchScopes(ast.service.match, findings);
+}
+function checkDupsInMatchScopes(match, findings) {
     checkDupsInScope(match.functions, match.path.raw, findings);
     for (const child of match.children)
-        checkDuplicateFunctions(child, findings);
+        checkDupsInMatchScopes(child, findings);
 }
-function checkDupsInScope(fns, path, findings) {
-    const seen = new Set();
+function checkDupsInScope(fns, scope, findings) {
+    const declared = new Set();
     for (const fn of fns) {
-        if (seen.has(fn.name)) {
+        if (declared.has(fn.name)) {
             findings.push({
-                code: 'QUA-3', severity: 'medium', path,
-                message: `Duplicate function '${fn.name}' in scope at ${path}`,
+                code: 'QUA-3', severity: 'critical', path: scope,
+                message: `Duplicate function '${fn.name}' declared twice in ${scope}. Production rejects duplicate function declarations in one scope at compile time`,
             });
         }
-        seen.add(fn.name);
+        declared.add(fn.name);
     }
 }
 // ---- QUA-4: Unused functions ----