pyric 0.1.0-alpha.21 → 0.1.0-alpha.24

package/dist/database/sandbox/query.d.ts

@@ -46,65 +46,7 @@
  * enforcement is a deferred follow-up (would naturally hang off
  * `RulesEvaluator` not here).
  */
-import type { JsonValue } from './data-tree.js';
-/** Ordering selector. Stored as a discriminated union so the executor
- *  can switch on the kind without re-parsing. */
-export type OrderBy = {
-    kind: 'child';
-    path: string;
-} | {
-    kind: 'key';
-} | {
-    kind: 'priority';
-} | {
-    kind: 'value';
-};
-export type Priority = string | number | null;
-/** Cursor or filter bound. `startAt`/`endAt` are inclusive; the
- *  `*Exclusive` variants drop the boundary value. `equalTo` collapses
- *  start + end onto the same value (and is sugar for `startAt(v) +
- *  endAt(v)` per the SDK docs). */
-export type Bound = {
-    kind: 'startAt';
-    value: JsonValue;
-    key?: string;
-} | {
-    kind: 'startAfter';
-    value: JsonValue;
-    key?: string;
-} | {
-    kind: 'endAt';
-    value: JsonValue;
-    key?: string;
-} | {
-    kind: 'endBefore';
-    value: JsonValue;
-    key?: string;
-} | {
-    kind: 'equalTo';
-    value: JsonValue;
-    key?: string;
-};
-/** Window-size constraint. Mutually exclusive with each other (prod
- *  rejects setting both — we don't reject here but the executor
- *  prioritises the last one set, matching `firebase/database`). */
-export type LimitKind = 'limitToFirst' | 'limitToLast';
-/**
- * A {@link Query} is a ref + a chain of constraints. The chain is
- * order-independent in terms of declared shape — the executor groups
- * constraints into {order, bounds, limit} during apply.
- */
-export interface QuerySpec {
-    /** Active ordering. `null` means Firebase's default priority index. */
-    orderBy: OrderBy | null;
-    /** Range/equality filters. Multiple bounds compose. */
-    bounds: Bound[];
-    /** Optional limit. Last-wins if set more than once. */
-    limit: {
-        kind: LimitKind;
-        n: number;
-    } | null;
-}
+import type { Bound, LimitKind, OrderBy, QuerySpec } from '../internal/query-projection.js';
 /** Empty spec — equivalent to "no constraints" (a plain ref query). */
 export declare function emptySpec(): QuerySpec;
 /**
@@ -134,46 +76,5 @@ export type Constraint = {
     limitKind: LimitKind;
     n: number;
 };
-/**
- * Compare two `JsonValue`s under RTDB's documented type-order rules.
- * Locked by the upstream contract (Firebase docs: null < false < true
- * < number < string < object). The sandbox's ordering only needs to
- * match against same-type-or-null/undefined.
- *
- * Returns -1 / 0 / 1.
- */
-export declare function compareValues(a: JsonValue, b: JsonValue): number;
-/**
- * Compare two Firebase key names under RTDB's `nameCompare` ordering:
- * integer-looking keys sort FIRST (numerically; ties broken by string
- * length so `"01"` follows `"1"`), then non-integer keys sort
- * lexicographically. Mirrors `nameCompare` (`core/util/util.ts:253-276`).
- *
- * This is RTDB's universal key order — it drives `orderByKey()`, the
- * tie-break for `orderByChild`/`orderByValue`, and the `key` argument of
- * `startAt(value, key)` / `endAt(value, key)` cursors. Plain
- * lexicographic compare (DB-B4) put `"10"` before `"2"`.
- */
-export declare function nameCompare(a: string, b: string): number;
-/**
- * Extract the value the ordering uses to compare a child. For
- * `orderByKey()` it's the key string; for `orderByValue()` the child's
- * raw value; for `orderByChild(path)` the nested field at `path`
- * (which may itself be missing → `null`).
- */
-export declare function extractOrderValue(spec: OrderBy | null, key: string, value: JsonValue, priority?: Priority): JsonValue;
-/** Result row — kept minimal so the snap-builder can render it cheaply. */
-export interface QueryRow {
-    key: string;
-    value: JsonValue;
-    priority: Priority;
-}
-/**
- * Run a {@link QuerySpec} against the data at a path. The caller passes
- * the raw value at the path (a `Record<string, JsonValue>` if it's a
- * collection, anything else → empty result).
- *
- * Returns an ordered, filtered, limited list of rows.
- */
-export declare function executeQuery(pathData: JsonValue, spec: QuerySpec, priorityForKey?: (key: string) => Priority): QueryRow[];
+export { compareValues, nameCompare, extractOrderValue, executeQuery, type QueryRow, type OrderBy, type Priority, type Bound, type LimitKind, type QuerySpec, } from '../internal/query-projection.js';
 //# sourceMappingURL=query.d.ts.map

package/dist/database/sandbox/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/database/sandbox/query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;iDACiD;AACjD,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAE9C;;;mCAGmC;AACnC,MAAM,MAAM,KAAK,GACb;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;mEAEmE;AACnE,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,aAAa,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,uDAAuD;IACvD,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,uDAAuD;IACvD,KAAK,EAAE;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9C;AAED,uEAAuE;AACvE,wBAAgB,SAAS,IAAI,SAAS,CAErC;AAkBD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,EACf,CAAC,EAAE,UAAU,GACZ,SAAS,CAgCX;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAkBhE;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAcxD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,OAAO,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,EAChB,QAAQ,GAAE,QAAe,GACxB,SAAS,CAuBX;AAED,2EAA2E;AAC3E,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,SAAS,EACnB,IAAI,EAAE,SAAS,EACf,cAAc,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,QAAqB,GACrD,QAAQ,EAAE,CA+CZ"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/database/sandbox/query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAE5F,uEAAuE;AACvE,wBAAgB,SAAS,IAAI,SAAS,CAErC;AAkBD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,EACf,CAAC,EAAE,UAAU,GACZ,SAAS,CAgCX;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,SAAS,GACf,MAAM,iCAAiC,CAAC"}

package/dist/database/sandbox/query.js

@@ -47,229 +47,5 @@ export function applyConstraint(spec, c) {
             return { ...spec, limit: { kind: c.limitKind, n: c.n } };
     }
 }
-/**
- * Compare two `JsonValue`s under RTDB's documented type-order rules.
- * Locked by the upstream contract (Firebase docs: null < false < true
- * < number < string < object). The sandbox's ordering only needs to
- * match against same-type-or-null/undefined.
- *
- * Returns -1 / 0 / 1.
- */
-export function compareValues(a, b) {
-    if (a === b)
-        return 0;
-    // null sorts first.
-    if (a === null)
-        return -1;
-    if (b === null)
-        return 1;
-    const ta = typeofRank(a);
-    const tb = typeofRank(b);
-    if (ta !== tb)
-        return ta - tb;
-    // Same type — value comparison.
-    if (typeof a === 'number' && typeof b === 'number')
-        return a < b ? -1 : a > b ? 1 : 0;
-    if (typeof a === 'boolean' && typeof b === 'boolean')
-        return a === b ? 0 : a ? 1 : -1;
-    if (typeof a === 'string' && typeof b === 'string')
-        return a < b ? -1 : a > b ? 1 : 0;
-    // Objects/arrays are "greater" than primitives, but two object-valued
-    // children are ORDER-EQUAL under RTDB's model — the tie is broken by
-    // key, NOT by an invented JSON-string ordering (DB-B11; mirrors
-    // `ChildrenNode.ts:386-400` where ChildrenNodes compare equal). Return
-    // 0 so the caller's key tie-break takes over.
-    return 0;
-}
-function typeofRank(v) {
-    // null = 0; boolean = 1; number = 2; string = 3; object/array = 4.
-    if (v === null)
-        return 0;
-    if (typeof v === 'boolean')
-        return 1;
-    if (typeof v === 'number')
-        return 2;
-    if (typeof v === 'string')
-        return 3;
-    return 4;
-}
-/** Used to test for integer-looking strings. Mirrors `INTEGER_REGEXP_`
- *  (`core/util/util.ts:496`). */
-const INTEGER_REGEXP = /^-?(0*)\d{1,10}$/;
-const INTEGER_32_MIN = -2147483648;
-const INTEGER_32_MAX = 2147483647;
-/** If the string is a 32-bit integer, return it; else `null`. Mirrors
- *  `tryParseInt` (`core/util/util.ts:511-520`). */
-function tryParseInt(str) {
-    if (INTEGER_REGEXP.test(str)) {
-        const intVal = Number(str);
-        if (intVal >= INTEGER_32_MIN && intVal <= INTEGER_32_MAX) {
-            return intVal;
-        }
-    }
-    return null;
-}
-/**
- * Compare two Firebase key names under RTDB's `nameCompare` ordering:
- * integer-looking keys sort FIRST (numerically; ties broken by string
- * length so `"01"` follows `"1"`), then non-integer keys sort
- * lexicographically. Mirrors `nameCompare` (`core/util/util.ts:253-276`).
- *
- * This is RTDB's universal key order — it drives `orderByKey()`, the
- * tie-break for `orderByChild`/`orderByValue`, and the `key` argument of
- * `startAt(value, key)` / `endAt(value, key)` cursors. Plain
- * lexicographic compare (DB-B4) put `"10"` before `"2"`.
- */
-export function nameCompare(a, b) {
-    if (a === b)
-        return 0;
-    const aAsInt = tryParseInt(a);
-    const bAsInt = tryParseInt(b);
-    if (aAsInt !== null) {
-        if (bAsInt !== null) {
-            return aAsInt - bAsInt === 0 ? a.length - b.length : aAsInt - bAsInt;
-        }
-        // Integer keys sort before non-integer keys.
-        return -1;
-    }
-    else if (bAsInt !== null) {
-        return 1;
-    }
-    return a < b ? -1 : 1;
-}
-/**
- * Extract the value the ordering uses to compare a child. For
- * `orderByKey()` it's the key string; for `orderByValue()` the child's
- * raw value; for `orderByChild(path)` the nested field at `path`
- * (which may itself be missing → `null`).
- */
-export function extractOrderValue(spec, key, value, priority = null) {
-    const o = spec ?? { kind: 'priority' };
-    switch (o.kind) {
-        case 'key':
-            return key;
-        case 'value':
-            return value;
-        case 'priority':
-            return priority;
-        case 'child': {
-            if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-                return null;
-            }
-            // Path may be a slash-separated dotted path (`'profile/name'`).
-            const segs = o.path.split('/').filter((s) => s.length > 0);
-            let cur = value;
-            for (const s of segs) {
-                if (cur === null || typeof cur !== 'object' || Array.isArray(cur))
-                    return null;
-                cur = cur[s] ?? null;
-            }
-            return cur;
-        }
-    }
-}
-/**
- * Run a {@link QuerySpec} against the data at a path. The caller passes
- * the raw value at the path (a `Record<string, JsonValue>` if it's a
- * collection, anything else → empty result).
- *
- * Returns an ordered, filtered, limited list of rows.
- */
-export function executeQuery(pathData, spec, priorityForKey = () => null) {
-    // Non-collection input → no rows. RTDB's `query()` on a primitive
-    // path returns an empty snapshot.
-    if (pathData === null || typeof pathData !== 'object' || Array.isArray(pathData)) {
-        return [];
-    }
-    const obj = pathData;
-    // Enumerate immediate children only — RTDB's query model is one-level.
-    let rows = Object.entries(obj).map(([key, value]) => ({
-        key,
-        value,
-        priority: priorityForKey(key),
-    }));
-    // ─── 1. Order ─────────────────────────────────────────────────────
-    const orderingByKey = spec.orderBy?.kind === 'key';
-    rows.sort((a, b) => {
-        if (orderingByKey) {
-            // `orderByKey` compares keys under RTDB's nameCompare directly
-            // (numeric-keys-first) — there's no separate tie-break.
-            return nameCompare(a.key, b.key);
-        }
-        const va = extractOrderValue(spec.orderBy, a.key, a.value, a.priority);
-        const vb = extractOrderValue(spec.orderBy, b.key, b.value, b.priority);
-        const cmp = compareValues(va, vb);
-        if (cmp !== 0)
-            return cmp;
-        // Tie-break by key under nameCompare (RTDB's documented behavior —
-        // orderByChild / orderByValue ties break by key, numeric-first).
-        return nameCompare(a.key, b.key);
-    });
-    // ─── 2. Bounds ────────────────────────────────────────────────────
-    for (const b of spec.bounds) {
-        rows = rows.filter((row) => boundMatches(b, row, spec.orderBy));
-    }
-    // ─── 3. Limit ─────────────────────────────────────────────────────
-    if (spec.limit) {
-        const n = spec.limit.n;
-        if (spec.limit.kind === 'limitToFirst') {
-            rows = rows.slice(0, n);
-        }
-        else {
-            rows = n >= rows.length ? rows : rows.slice(rows.length - n);
-        }
-    }
-    return rows;
-}
-/**
- * Does `row` pass the bound `b` under the active ordering?
- *
- * The bound's `value` is compared against the row's `extractOrderValue`.
- * The optional `key` arg (for `startAt(value, key)`) is a tie-breaker
- * for matching rows whose ordered-value equals `value` — the row passes
- * only if its key is also at-or-past the supplied key.
- */
-function boundMatches(b, row, orderBy) {
-    const orderingByKey = orderBy?.kind === 'key';
-    // Under `orderByKey`, the bound's `value` IS the comparison key and is
-    // compared with nameCompare (numeric-first), NOT the value type-order.
-    // Under value/child ordering, compare the ordered value, then break
-    // ties on the key with nameCompare.
-    const cmp = orderingByKey
-        ? nameCompare(row.key, String(b.value))
-        : compareValues(extractOrderValue(orderBy, row.key, row.value, row.priority), b.value);
-    const keyCmp = (other) => nameCompare(row.key, other);
-    switch (b.kind) {
-        case 'startAt':
-            if (cmp > 0)
-                return true;
-            if (cmp < 0)
-                return false;
-            // Equal: defer to optional key tie-breaker.
-            return b.key === undefined || keyCmp(b.key) >= 0;
-        case 'startAfter':
-            if (cmp > 0)
-                return true;
-            if (cmp < 0)
-                return false;
-            // Equal: row passes only if key strictly past the tie-breaker.
-            return b.key === undefined ? false : keyCmp(b.key) > 0;
-        case 'endAt':
-            if (cmp < 0)
-                return true;
-            if (cmp > 0)
-                return false;
-            return b.key === undefined || keyCmp(b.key) <= 0;
-        case 'endBefore':
-            if (cmp < 0)
-                return true;
-            if (cmp > 0)
-                return false;
-            return b.key === undefined ? false : keyCmp(b.key) < 0;
-        case 'equalTo':
-            if (cmp !== 0)
-                return false;
-            return b.key === undefined || keyCmp(b.key) === 0;
-    }
-}
+export { compareValues, nameCompare, extractOrderValue, executeQuery, } from '../internal/query-projection.js';
 //# sourceMappingURL=query.js.map

package/dist/database/sandbox/query.js.map

@@ -1 +1 @@
-{"version":3,"file":"query.js","sourceRoot":"","sources":["../../../src/database/sandbox/query.ts"],"names":[],"mappings":"AA0FA,uEAAuE;AACvE,MAAM,UAAU,SAAS;IACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;0DAC0D;AAC1D,SAAS,YAAY,CAAC,IAAe;IACnC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC;AAED;qDACqD;AACrD,SAAS,UAAU,CAAC,IAAe;IACjC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAe,EACf,CAAa;IAEb,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,SAAS,GACb,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;YAC5F,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;YACzF,IAAI,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,wFAAwF,CACxG,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,mFAAmF,CACnG,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,CAAC;QACD,KAAK,OAAO;YACV,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,CAAC,SAAS,2EAA2E,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7D,CAAC;AACH,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,CAAY,EAAE,CAAY;IACtD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,oBAAoB;IACpB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC9B,gCAAgC;IAChC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,sEAAsE;IACtE,qEAAqE;IACrE,gEAAgE;IAChE,uEAAuE;IACvE,8CAA8C;IAC9C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,CAAY;IAC9B,mEAAmE;IACnE,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;iCACiC;AACjC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,cAAc,GAAG,CAAC,UAAU,CAAC;AACnC,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC;mDACmD;AACnD,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,MAAM,IAAI,cAAc,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QACvE,CAAC;QACD,6CAA6C;QAC7C,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;SAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAoB,EACpB,GAAW,EACX,KAAgB,EAChB,WAAqB,IAAI;IAEzB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,IAAI,EAAE,UAAmB,EAAE,CAAC;IAChD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,KAAK;YACR,OAAO,GAAG,CAAC;QACb,KAAK,OAAO;YACV,OAAO,KAAK,CAAC;QACf,KAAK,UAAU;YACb,OAAO,QAAQ,CAAC;QAClB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,gEAAgE;YAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3D,IAAI,GAAG,GAAc,KAAK,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC/E,GAAG,GAAI,GAAiC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YACtD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;AACH,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAmB,EACnB,IAAe,EACf,iBAA4C,GAAG,EAAE,CAAC,IAAI;IAEtD,kEAAkE;IAClE,kCAAkC;IAClC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,QAAqC,CAAC;IAClD,uEAAuE;IACvE,IAAI,IAAI,GAAe,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,GAAG;QACH,KAAK;QACL,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC;KAC9B,CAAC,CAAC,CAAC;IAEJ,qEAAqE;IACrE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjB,IAAI,aAAa,EAAE,CAAC;YAClB,+DAA+D;YAC/D,wDAAwD;YACxD,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1B,mEAAmE;QACnE,iEAAiE;QACjE,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACvC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,CAAQ,EAAE,GAAa,EAAE,OAAuB;IACpE,MAAM,aAAa,GAAG,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC;IAC9C,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,oCAAoC;IACpC,MAAM,GAAG,GAAG,aAAa;QACvB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1B,4CAA4C;YAC5C,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,KAAK,YAAY;YACf,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1B,+DAA+D;YAC/D,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,KAAK,OAAO;YACV,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1B,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,KAAK,WAAW;YACd,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1B,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,KAAK,SAAS;YACZ,IAAI,GAAG,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5B,OAAO,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../../src/database/sandbox/query.ts"],"names":[],"mappings":"AAkDA,uEAAuE;AACvE,MAAM,UAAU,SAAS;IACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;0DAC0D;AAC1D,SAAS,YAAY,CAAC,IAAe;IACnC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC;AAED;qDACqD;AACrD,SAAS,UAAU,CAAC,IAAe;IACjC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAe,EACf,CAAa;IAEb,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,SAAS,GACb,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;YAC5F,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;YACzF,IAAI,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,wFAAwF,CACxG,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,mFAAmF,CACnG,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,CAAC;QACD,KAAK,OAAO;YACV,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,CAAC,SAAS,2EAA2E,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7D,CAAC;AACH,CAAC;AAYD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,GAOb,MAAM,iCAAiC,CAAC"}

package/dist/database/sandbox/rules-eval.d.ts

@@ -1,4 +1,12 @@
+import type { SimulationInput } from '../../rules/rtdb/simulation/spec.js';
 import type { AuthState } from 'pyric/sandbox';
+import { SandboxClock } from 'pyric/sandbox';
+import type { QuerySpec } from './query.js';
+/**
+ * Convert a sandbox `QuerySpec` to the `SimulationInput['query']` shape
+ * consumed by the RTDB rules simulator.
+ */
+export declare function querySpecToSimulationQuery(spec: QuerySpec): SimulationInput['query'];
 /**
  * Plain-Error denial constructor. Matches the oracle observation: the
  * thrown value's `.name === 'Error'`, `.constructor.name === 'Error'`,
@@ -61,11 +69,23 @@ export interface EvalContext {
         path: string;
         value: unknown;
     }[];
+    /** Optional query constraints for read rule evaluation. */
+    query?: SimulationInput['query'];
+    /** Optional query spec from sandbox query execution; automatically converts to `query` and validates `.indexOn`. */
+    querySpec?: QuerySpec;
+    indexMethod?: 'get' | 'listen';
 }
 export type RtdbDefaultPolicy = 'allow' | 'deny';
 export declare class RulesEvaluator {
+    private readonly clock;
+    private readonly missingIndex?;
     private compiled;
     private defaultPolicy;
+    /**
+     * @param clock The sandbox's clock, read for the rules engine's `now`. A
+     * standalone evaluator keeps its own wall clock.
+     */
+    constructor(clock?: SandboxClock, missingIndex?: ((path: string, spec: QuerySpec, ctx: EvalContext) => void) | undefined);
     /** Set default access policy when no rules are loaded ('allow' or 'deny'). */
     setDefaultPolicy(policy: RtdbDefaultPolicy): void;
     /** Replace the deployed rules. `null` clears (sandbox returns to
@@ -75,6 +95,14 @@ export declare class RulesEvaluator {
     } | null): void;
     /** True when rules have been deployed via `setRules`. */
     hasRules(): boolean;
+    /**
+     * Enforce `.indexOn` rules for queries when security rules are active.
+     *
+     * Built-in orderings (`orderByKey`, `orderByPriority`, or default priority)
+     * and queries when no security rules are loaded (`this.compiled === null`)
+     * are exempt.
+     */
+    assertQueryIndex(path: string, spec: QuerySpec): void;
     /**
      * Evaluate one op. Default-deny when no rules are loaded.
      *

package/dist/database/sandbox/rules-eval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules-eval.d.ts","sourceRoot":"","sources":["../../../src/database/sandbox/rules-eval.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,KAAK,CAIxC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,IAAI,EAAE,SAAS,CAAC;IAChB;;2CAEuC;IACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC9C;AAED,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEjD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,aAAa,CAA6B;IAElD,8EAA8E;IAC9E,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAIjD;sCACkC;IAClC,QAAQ,CAAC,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,GAAG,IAAI;IAQpE,yDAAyD;IACzD,QAAQ,IAAI,OAAO;IAInB;;;;;;;;;OASG;IACH,KAAK,CACH,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,EACxC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,WAAW,GACf,SAAS;IAIZ,QAAQ,CACN,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,EACxC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,WAAW,GACf,qBAAqB;CAgGzB"}
+{"version":3,"file":"rules-eval.d.ts","sourceRoot":"","sources":["../../../src/database/sandbox/rules-eval.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAkB5C;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CA2BpF;AAsBD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,KAAK,CAIxC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,IAAI,EAAE,SAAS,CAAC;IAChB;;2CAEuC;IACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC7C,2DAA2D;IAC3D,KAAK,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;IACjC,oHAAoH;IACpH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,WAAW,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAChC;AAED,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEjD,qBAAa,cAAc;IASvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAThC,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,aAAa,CAA6B;IAElD;;;OAGG;gBAEgB,KAAK,GAAE,YAAiC,EACxC,YAAY,CAAC,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,KAAK,IAAI,aAAA;IAG3F,8EAA8E;IAC9E,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAIjD;sCACkC;IAClC,QAAQ,CAAC,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,GAAG,IAAI;IAQpE,yDAAyD;IACzD,QAAQ,IAAI,OAAO;IAInB;;;;;;OAMG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IAwBrD;;;;;;;;;OASG;IACH,KAAK,CACH,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,EACxC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,WAAW,GACf,SAAS;IAIZ,QAAQ,CACN,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,EACxC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,WAAW,GACf,qBAAqB;CAiHzB"}

package/dist/database/sandbox/rules-eval.js

@@ -21,6 +21,77 @@
  * unconfigured DB allows everything until rules deploy).
  */
 import { compileRtdbRules, simulateRtdbRules, } from '../../rules/rtdb/compiled-rules.js';
+import { SandboxClock } from 'pyric/sandbox';
+function toPrimitiveBoundValue(value) {
+    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
+        return value;
+    }
+    return null;
+}
+function resolveRequiredIndexKey(orderBy) {
+    if (orderBy.kind === 'value') {
+        return '.value';
+    }
+    return orderBy.path.split('/').filter(Boolean).join('/');
+}
+/**
+ * Convert a sandbox `QuerySpec` to the `SimulationInput['query']` shape
+ * consumed by the RTDB rules simulator.
+ */
+export function querySpecToSimulationQuery(spec) {
+    const q = {};
+    if (spec.orderBy?.kind === 'child') {
+        q.orderByChild = spec.orderBy.path;
+    }
+    else if (spec.orderBy?.kind === 'key') {
+        q.orderByKey = true;
+    }
+    else if (spec.orderBy?.kind === 'value') {
+        q.orderByValue = true;
+    }
+    for (const bound of spec.bounds) {
+        const val = toPrimitiveBoundValue(bound.value);
+        if (bound.kind === 'equalTo') {
+            q.equalTo = val;
+            q.startAt = val;
+            q.endAt = val;
+        }
+        else if (bound.kind === 'startAt' || bound.kind === 'startAfter') {
+            q.startAt = val;
+        }
+        else if (bound.kind === 'endAt' || bound.kind === 'endBefore') {
+            q.endAt = val;
+        }
+    }
+    if (spec.limit?.kind === 'limitToFirst') {
+        q.limitToFirst = spec.limit.n;
+    }
+    else if (spec.limit?.kind === 'limitToLast') {
+        q.limitToLast = spec.limit.n;
+    }
+    return q;
+}
+function findMatchingNodesAtPath(root, segments) {
+    let currentNodes = [root];
+    for (const seg of segments) {
+        const nextNodes = [];
+        for (const node of currentNodes) {
+            for (const child of node.children) {
+                const childSegs = child.path.split('/').filter(Boolean);
+                const lastSeg = childSegs[childSegs.length - 1];
+                if (!lastSeg)
+                    continue;
+                if (lastSeg === seg || lastSeg.startsWith('$')) {
+                    nextNodes.push(child);
+                }
+            }
+        }
+        currentNodes = nextNodes;
+        if (currentNodes.length === 0)
+            break;
+    }
+    return currentNodes;
+}
 /**
  * Plain-Error denial constructor. Matches the oracle observation: the
  * thrown value's `.name === 'Error'`, `.constructor.name === 'Error'`,
@@ -37,8 +108,18 @@ export function permissionDenied() {
     return err;
 }
 export class RulesEvaluator {
+    clock;
+    missingIndex;
     compiled = null;
     defaultPolicy = 'deny';
+    /**
+     * @param clock The sandbox's clock, read for the rules engine's `now`. A
+     * standalone evaluator keeps its own wall clock.
+     */
+    constructor(clock = new SandboxClock(), missingIndex) {
+        this.clock = clock;
+        this.missingIndex = missingIndex;
+    }
     /** Set default access policy when no rules are loaded ('allow' or 'deny'). */
     setDefaultPolicy(policy) {
         this.defaultPolicy = policy;
@@ -56,6 +137,29 @@ export class RulesEvaluator {
     hasRules() {
         return this.compiled !== null;
     }
+    /**
+     * Enforce `.indexOn` rules for queries when security rules are active.
+     *
+     * Built-in orderings (`orderByKey`, `orderByPriority`, or default priority)
+     * and queries when no security rules are loaded (`this.compiled === null`)
+     * are exempt.
+     */
+    assertQueryIndex(path, spec) {
+        if (this.compiled === null)
+            return;
+        if (spec.orderBy === null)
+            return;
+        if (spec.orderBy.kind === 'key' || spec.orderBy.kind === 'priority')
+            return;
+        const requiredIndex = resolveRequiredIndexKey(spec.orderBy);
+        const segments = path.split('/').filter(Boolean);
+        const normalizedPath = '/' + segments.join('/');
+        const matchingNodes = findMatchingNodesAtPath(this.compiled, segments);
+        const hasIndex = matchingNodes.some((node) => node.indexOn?.some((idx) => idx === requiredIndex || idx.split('/').filter(Boolean).join('/') === requiredIndex));
+        if (!hasIndex) {
+            throw new Error(`Index not defined, add ".indexOn": "${requiredIndex}", for path "${normalizedPath}", to the rules`);
+        }
+    }
     /**
      * Evaluate one op. Default-deny when no rules are loaded.
      *
@@ -108,15 +212,24 @@ export class RulesEvaluator {
                 reasons: ['No RTDB rules loaded; default allow.'],
             };
         }
-        // The simulator's SimulationInputSchema requires `auth` to be
-        // either `null` or `{ uid: string, token: Record<string, unknown> }` —
-        // `token` is mandatory, not optional. `AuthState` from
-        // `pyric/sandbox` makes `token` optional. Normalise here so an
-        // auth identity without custom claims (`{ uid: 'alice' }`) still
-        // satisfies the schema and the rule sees `auth.token = {}`.
-        const normalisedAuth = ctx.auth === null
-            ? null
-            : { uid: ctx.auth.uid, token: ctx.auth.token ?? {} };
+        // The simulator's SimulationInputSchema accepts `auth` as
+        // either `null` or `{ uid: string, tenant?: string, token?: Record<string, unknown> }`.
+        // Preserve tenant and optional token from AuthState so tenant claim
+        // normalization and custom claims reach the simulator.
+        let normalisedAuth = null;
+        if (ctx.auth !== null) {
+            normalisedAuth = {
+                uid: ctx.auth.uid,
+                token: ctx.auth.token ?? {},
+            };
+            if (ctx.auth.tenant !== undefined) {
+                normalisedAuth.tenant = ctx.auth.tenant;
+            }
+        }
+        let simulatedQuery = ctx.query;
+        if (simulatedQuery === undefined && ctx.querySpec !== undefined) {
+            simulatedQuery = querySpecToSimulationQuery(ctx.querySpec);
+        }
         const result = simulateRtdbRules(this.compiled, {
             operation,
             path: path === '/' ? '/' : path,
@@ -124,6 +237,8 @@ export class RulesEvaluator {
             mockData: ctx.mockData,
             newData: ctx.newData,
             updates: ctx.updates,
+            query: simulatedQuery,
+            now: this.clock.now(),
         });
         if (!result.success) {
             if (result.error.code === 'NO_MATCHING_RULE') {
@@ -153,6 +268,18 @@ export class RulesEvaluator {
                 pathVariableBindings: result.data.pathVariableBindings,
             };
         }
+        if (result.data.allowed && isReadOperation && ctx.querySpec) {
+            try {
+                this.assertQueryIndex(path, ctx.querySpec);
+            }
+            catch (error) {
+                try {
+                    this.missingIndex?.(path, ctx.querySpec, ctx);
+                }
+                catch { /* diagnostics do not change the SDK failure */ }
+                throw error;
+            }
+        }
         return {
             check: result.data.allowed ? 'allow' : 'deny',
             reasons: [

package/dist/database/sandbox/rules-eval.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules-eval.js","sourceRoot":"","sources":["../../../src/database/sandbox/rules-eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,oCAAoC,CAAC;AAG5C;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,sCAAsC,CAA6B,CAAC;IAC1F,GAAG,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC;AAwDD,MAAM,OAAO,cAAc;IACjB,QAAQ,GAA6B,IAAI,CAAC;IAC1C,aAAa,GAAsB,MAAM,CAAC;IAElD,8EAA8E;IAC9E,gBAAgB,CAAC,MAAyB;QACxC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;IAC9B,CAAC;IAED;sCACkC;IAClC,QAAQ,CAAC,SAAoD;QAC3D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,yDAAyD;IACzD,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CACH,SAAwC,EACxC,IAAY,EACZ,GAAgB;QAEhB,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC;IAED,QAAQ,CACN,SAAwC,EACxC,IAAY,EACZ,GAAgB;QAEhB,MAAM,eAAe,GAAG,SAAS,KAAK,MAAM,CAAC;QAC7C,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,cAAc,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC;YAC7D,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO;oBACL,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,CAAC,iFAAiF,CAAC;iBAC7F,CAAC;YACJ,CAAC;YACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,mBAAmB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,CAAC,iFAAiF,CAAC;iBAC7F,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO;oBACL,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,CAAC,iFAAiF,CAAC;iBAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,CAAC,qCAAqC,CAAC;oBAChD,SAAS,EAAE,kBAAkB;oBAC7B,YAAY,EAAE,qCAAqC;iBACpD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,CAAC,sCAAsC,CAAC;aAClD,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,uEAAuE;QACvE,uDAAuD;QACvD,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,cAAc,GAClB,GAAG,CAAC,IAAI,KAAK,IAAI;YACf,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC9C,SAAS;YACT,IAAI,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAC/B,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC7C,OAAO;oBACL,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;oBAC/B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;oBAC5B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;iBACnC,CAAC;YACJ,CAAC;YACD,8CAA8C;YAC9C,4CAA4C;YAC5C,OAAO;gBACL,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC/B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBAC5B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;aACnC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS,iBAAiB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvF,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB;aACvD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC7C,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;aAC3G;YACD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACpC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACpC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB;SACvD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"rules-eval.js","sourceRoot":"","sources":["../../../src/database/sandbox/rules-eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAA4D;IAE5D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAe;IACxD,MAAM,CAAC,GAA0C,EAAE,CAAC;IACpD,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,CAAC;SAAM,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;QACxC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;IACtB,CAAC;SAAM,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1C,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC;YAChB,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC;YAChB,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC;QAChB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACnE,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC;QAClB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChE,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;QACxC,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;QAC9C,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAuB,EAAE,QAAkB;IAC1E,IAAI,YAAY,GAAwB,CAAC,IAAI,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAwB,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxD,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAChD,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/C,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QACD,YAAY,GAAG,SAAS,CAAC;QACzB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;IACvC,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,sCAAsC,CAA6B,CAAC;IAC1F,GAAG,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC;AA6DD,MAAM,OAAO,cAAc;IASN;IACA;IATX,QAAQ,GAA6B,IAAI,CAAC;IAC1C,aAAa,GAAsB,MAAM,CAAC;IAElD;;;OAGG;IACH,YACmB,QAAsB,IAAI,YAAY,EAAE,EACxC,YAAwE;QADxE,UAAK,GAAL,KAAK,CAAmC;QACxC,iBAAY,GAAZ,YAAY,CAA4D;IACxF,CAAC;IAEJ,8EAA8E;IAC9E,gBAAgB,CAAC,MAAyB;QACxC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;IAC9B,CAAC;IAED;sCACkC;IAClC,QAAQ,CAAC,SAAoD;QAC3D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,yDAAyD;IACzD,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,IAAY,EAAE,IAAe;QAC5C,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO;QACnC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QAClC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO;QAE5E,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhD,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,IAAI,CAAC,OAAO,EAAE,IAAI,CAChB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,aAAa,CAC7F,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,uCAAuC,aAAa,gBAAgB,cAAc,iBAAiB,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CACH,SAAwC,EACxC,IAAY,EACZ,GAAgB;QAEhB,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC;IAED,QAAQ,CACN,SAAwC,EACxC,IAAY,EACZ,GAAgB;QAEhB,MAAM,eAAe,GAAG,SAAS,KAAK,MAAM,CAAC;QAC7C,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,cAAc,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC;YAC7D,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO;oBACL,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,CAAC,iFAAiF,CAAC;iBAC7F,CAAC;YACJ,CAAC;YACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,mBAAmB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,CAAC,iFAAiF,CAAC;iBAC7F,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO;oBACL,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,CAAC,iFAAiF,CAAC;iBAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,CAAC,qCAAqC,CAAC;oBAChD,SAAS,EAAE,kBAAkB;oBAC7B,YAAY,EAAE,qCAAqC;iBACpD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,CAAC,sCAAsC,CAAC;aAClD,CAAC;QACJ,CAAC;QACD,0DAA0D;QAC1D,wFAAwF;QACxF,oEAAoE;QACpE,uDAAuD;QACvD,IAAI,cAAc,GAA4B,IAAI,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,cAAc,GAAG;gBACf,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG;gBACjB,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;aAC5B,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,cAAc,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,IAAI,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC;QAC/B,IAAI,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChE,cAAc,GAAG,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC9C,SAAS;YACT,IAAI,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAC/B,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC7C,OAAO;oBACL,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;oBAC/B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;oBAC5B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;iBACnC,CAAC;YACJ,CAAC;YACD,8CAA8C;YAC9C,4CAA4C;YAC5C,OAAO;gBACL,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC/B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBAC5B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;aACnC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS,iBAAiB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvF,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB;aACvD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC5D,IAAI,CAAC;gBAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YACnD,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC;oBAAC,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;gBAChH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC7C,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;aAC3G;YACD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACpC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACpC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB;SACvD,CAAC;IACJ,CAAC;CACF"}