pyric 0.1.0-alpha.21 → 0.1.0-alpha.24

package/dist/firestore/sandbox/rules-evidence.js

@@ -0,0 +1,87 @@
+/** One budget per snapshot, shared across all rule and helper expressions. */
+class EvidenceBudget {
+    truncated = false;
+    remainingChecks = 128;
+    text(value) {
+        if (value.length <= 256)
+            return value;
+        this.truncated = true;
+        return `${value.slice(0, 256)}…`;
+    }
+    take(values, limit) {
+        if (values.length > limit)
+            this.truncated = true;
+        return values.slice(0, limit);
+    }
+}
+function captureCheck(entry, budget) {
+    const location = {
+        expression: budget.text(entry.source), parent: entry.parent,
+        operator: entry.operator, kind: entry.kind,
+        helper: entry.inlinedFrom?.name,
+        binding: entry.letBinding?.name,
+    };
+    if (location.helper !== undefined)
+        location.helper = budget.text(location.helper);
+    if (location.binding !== undefined)
+        location.binding = budget.text(location.binding);
+    if (entry.skipped)
+        return { ...location, state: 'skipped' };
+    if (entry.error !== undefined)
+        return { ...location, state: 'error', error: budget.text(entry.error) };
+    const value = entry.value;
+    if (value === null || typeof value === 'boolean' || typeof value === 'number') {
+        return { ...location, state: 'value', value };
+    }
+    if (typeof value === 'string')
+        return { ...location, state: 'value', value: budget.text(value) };
+    // Never retain document objects, token maps, or arbitrary runtime handles.
+    return { ...location, state: 'unavailable' };
+}
+function captureRule(rule, budget) {
+    const entries = rule.expressionTrace ?? [];
+    const retained = budget.take(entries, budget.remainingChecks);
+    budget.remainingChecks -= retained.length;
+    const expression = rule.conditionText ?? '';
+    const captured = {
+        expression: budget.text(expression), verdict: rule.verdict,
+        checks: retained.map(entry => captureCheck(entry, budget)),
+    };
+    if (rule.line !== undefined)
+        captured.line = rule.line;
+    if (rule.matchPath !== undefined)
+        captured.path = budget.text(rule.matchPath);
+    if (rule.message !== undefined)
+        captured.error = budget.text(rule.message);
+    return captured;
+}
+export function captureRulesEvidence(result, version, scope = 'request') {
+    const budget = new EvidenceBudget();
+    const rules = budget.take(result.trace, 32).map(rule => captureRule(rule, budget));
+    const attempts = result.pathResolution?.attempts ?? [];
+    const paths = budget.take(attempts, 32).map(entry => ({
+        path: budget.text(entry.blockPath), matched: entry.matched, line: entry.line,
+    }));
+    return { version, scope, decision: result.decision, rules, paths, truncated: budget.truncated };
+}
+/** Query proof may reject a request before any residual simulation occurs. */
+export function captureQueryEvidence(proof, version, residual) {
+    const budget = new EvidenceBudget();
+    const failures = budget.take(proof.failures, 32).map(failure => {
+        const captured = {
+            reason: budget.text(failure.reason),
+        };
+        if (failure.rule?.expression !== undefined)
+            captured.expression = budget.text(failure.rule.expression);
+        if (failure.rule?.line !== undefined)
+            captured.line = failure.rule.line;
+        return captured;
+    });
+    let decision = 'DENY';
+    if (proof.kind === 'unsupported-path' || proof.kind === 'unsupported-predicate')
+        decision = 'UNSUPPORTED';
+    const initial = { version, scope: 'query-residual', decision, truncated: false, rules: [], paths: [] };
+    const evidence = residual ?? initial;
+    return { ...evidence, queryProof: { kind: proof.kind, failures }, truncated: evidence.truncated || budget.truncated };
+}
+//# sourceMappingURL=rules-evidence.js.map

package/dist/firestore/sandbox/rules-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-evidence.js","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-evidence.ts"],"names":[],"mappings":"AAOA,8EAA8E;AAC9E,MAAM,cAAc;IAClB,SAAS,GAAG,KAAK,CAAC;IAClB,eAAe,GAAG,GAAG,CAAC;IAEtB,IAAI,CAAC,KAAa;QAChB,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IACnC,CAAC;IAED,IAAI,CAAI,MAAoB,EAAE,KAAa;QACzC,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAsB,EAAE,MAAsB;IAClE,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1C,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI;QAC/B,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI;KAChC,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACvG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9E,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACjG,2EAA2E;IAC3E,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB,EAAE,MAAsB;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAmC;QAC/C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;QAC1D,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;KAC3D,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAkB,EAClB,OAAe,EACf,QAAgC,SAAS;IAEzC,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,EAAE,QAAQ,IAAI,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;KAC7E,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAClG,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAClC,KAA2B,EAC3B,OAAe,EACf,QAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC7D,MAAM,QAAQ,GAAiE;YAC7E,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;YAAE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,GAA8B,MAAM,CAAC;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB;QAAE,QAAQ,GAAG,aAAa,CAAC;IAC1G,MAAM,OAAO,GAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtH,MAAM,QAAQ,GAAG,QAAQ,IAAI,OAAO,CAAC;IACrC,OAAO,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;AACxH,CAAC"}

package/dist/firestore/sandbox/rules-list-authorizer.d.ts

@@ -1,3 +1,4 @@
+import { type QueryExecutionSpec } from './query-execution.js';
 import type { SimulateFirestoreRulesHandler } from 'pyric/rules/internal';
 import { Timestamp } from 'pyric/rules/internal';
 import type { FirestoreEventBus } from './event-bus.js';
@@ -7,6 +8,7 @@ import type { DocStore } from './local-state.js';
 import type { RulesState } from './rules-state.js';
 import type { TriggerInfo } from './trigger-scope.js';
 import type { Operation } from './writes.js';
+import { SandboxClock } from '../../sandbox/clock.js';
 export interface RulesListAuthorizerHost {
     readonly state: DocStore;
 }
@@ -19,6 +21,7 @@ export interface ListAuthorizationRequest {
     origin: 'listener' | 'user';
     bypassRules?: boolean;
     activityQuery?: unknown;
+    execution?: QueryExecutionSpec;
     triggeredBy?: TriggerInfo;
     /** Preserve the established request.time → event.at capture order. */
     timing?: {
@@ -41,8 +44,17 @@ export declare class RulesListAuthorizer {
     private readonly rules;
     private readonly simulator;
     private readonly host;
-    constructor(events: FirestoreEventBus, rules: RulesState, simulator: SimulateFirestoreRulesHandler, host: RulesListAuthorizerHost);
+    /** The sandbox's clock, read for every server-set time this produces.
+     *  Defaults to a private wall clock for a standalone construction. */
+    private readonly clock;
+    constructor(events: FirestoreEventBus, rules: RulesState, simulator: SimulateFirestoreRulesHandler, host: RulesListAuthorizerHost, 
+    /** The sandbox's clock, read for every server-set time this produces.
+     *  Defaults to a private wall clock for a standalone construction. */
+    clock?: SandboxClock);
     authorize(request: ListAuthorizationRequest): ListAuthorizationResult;
+    /** Combine local proof failures with actual residual evaluation, without
+     * ever putting rejected rules back into the authorization AST. */
+    private denyQuery;
     private applyProof;
     private emitRequest;
     private emitUserDenial;

package/dist/firestore/sandbox/rules-list-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules-list-authorizer.d.ts","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-list-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAkE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAOjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEjD;;;GAGG;AACH,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAHJ,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,6BAA6B,EACxC,IAAI,EAAE,uBAAuB;IAGhD,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,uBAAuB;IA4PrE,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,cAAc;CAGvB"}
+{"version":3,"file":"rules-list-authorizer.d.ts","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-list-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAGzF,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAkE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAOjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEjD;;;GAGG;AACH,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;0EACsE;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBANL,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,6BAA6B,EACxC,IAAI,EAAE,uBAAuB;IAC9C;0EACsE;IACrD,KAAK,GAAE,YAAiC;IAG3D,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,uBAAuB;IAyJrE;sEACkE;IAClE,OAAO,CAAC,SAAS;IA4CjB,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,cAAc;CAGvB"}

package/dist/firestore/sandbox/rules-list-authorizer.js

@@ -1,3 +1,4 @@
+import { queryExecutionDiagnostic } from './query-execution.js';
 import { assembleRules, projectEvaluatedRule, renderLegacyDebugMessages, Timestamp } from 'pyric/rules/internal';
 import { proveGlobalCollectionGroupRules } from './collection-group-rule-proof.js';
 import { makeError } from './errors.js';
@@ -6,6 +7,7 @@ import { buildRequestEvent } from './request-events.js';
 import { listQueryFromStructured } from './reads.js';
 import { SimulatorUnsupportedError, unsupportedMessage, } from './rules-evaluation.js';
 import { buildRulesTestCase } from './rules-test-case.js';
+import { SandboxClock } from '../../sandbox/clock.js';
 /**
  * Owns the shared list-rule proof, residual simulation, and request-event
  * policy used by listener and one-shot query reads.
@@ -15,11 +17,16 @@ export class RulesListAuthorizer {
     rules;
     simulator;
     host;
-    constructor(events, rules, simulator, host) {
+    clock;
+    constructor(events, rules, simulator, host, 
+    /** The sandbox's clock, read for every server-set time this produces.
+     *  Defaults to a private wall clock for a standalone construction. */
+    clock = new SandboxClock()) {
         this.events = events;
         this.rules = rules;
         this.simulator = simulator;
         this.host = host;
+        this.clock = clock;
     }
     authorize(request) {
         const { path, auth, constraints, origin, triggeredBy } = request;
@@ -30,8 +37,8 @@ export class RulesListAuthorizer {
             ...(request.activityQuery !== undefined ? { activityQuery: request.activityQuery } : {}),
         };
         const detail = Object.keys(requestDetail).length > 0 ? requestDetail : undefined;
-        const requestTime = request.timing?.requestTime ?? (request.bypassRules ? undefined : Timestamp.fromMillis(Date.now()));
-        const evalAt = request.timing?.at ?? Date.now();
+        const requestTime = request.timing?.requestTime ?? (request.bypassRules ? undefined : Timestamp.fromMillis(this.clock.now()));
+        const evalAt = request.timing?.at ?? this.clock.now();
         if (request.bypassRules) {
             this.emitRequest({
                 at: evalAt,
@@ -80,46 +87,7 @@ export class RulesListAuthorizer {
         const proof = proveListQuery(evaluationAst, placeholderPath, auth, constraints, this.rules.source);
         const isUnprovable = proof.kind === 'unprovable';
         if (isUnprovable) {
-            const message = `list ${path} denied: the query is statically unprovable for every possible ` +
-                `result (rules are not filters), so the whole query is rejected — ${proof.reason}`;
-            const remediation = renderQueryRemediation(proof.residual);
-            const reqEvent = {
-                at: evalAt,
-                evalMs: performance.now() - evalStart,
-                method: 'list',
-                path,
-                auth,
-                result: 'deny',
-                debugMessages: [message],
-                origin,
-            };
-            const hasDetail = detail !== undefined;
-            if (hasDetail) {
-                reqEvent.detail = detail;
-            }
-            const hasTriggeredBy = triggeredBy !== undefined;
-            if (hasTriggeredBy) {
-                reqEvent.triggeredBy = triggeredBy;
-            }
-            this.emitRequest(reqEvent);
-            const errExtras = {
-                request: { method: 'list', path, auth },
-                query: constraints,
-            };
-            const isRemediationDefined = remediation !== undefined;
-            if (isRemediationDefined) {
-                const isRemediationNotEmpty = remediation !== '';
-                if (isRemediationNotEmpty) {
-                    errExtras.remediation = remediation;
-                }
-            }
-            const hasProofRule = proof.rule !== undefined;
-            if (hasProofRule) {
-                errExtras.rule = proof.rule;
-            }
-            const error = makeError('permission-denied', message, errExtras);
-            this.emitUserDenial(origin, error);
-            return { allowed: false, error };
+            return this.denyQuery(request, proof, evalAt, performance.now() - evalStart, detail);
         }
         const evaluationSource = proof.kind === 'provable'
             ? assembleRules(proof.evaluationAst)
@@ -153,6 +121,7 @@ export class RulesListAuthorizer {
             };
         }
         const result = simulation.data.results[0];
+        const rulesEvidence = this.rules.captureEvidence(result, 'query-residual');
         const debugMessages = renderLegacyDebugMessages(result);
         if (result.state === 'UNSUPPORTED') {
             this.emitRequest({
@@ -162,6 +131,7 @@ export class RulesListAuthorizer {
                 path,
                 auth,
                 result: 'unsupported',
+                rulesEvidence,
                 debugMessages,
                 origin,
                 ...(detail ? { detail } : {}),
@@ -171,37 +141,7 @@ export class RulesListAuthorizer {
         }
         const isNotPassed = result.state !== 'PASSED';
         if (isNotPassed) {
-            const evalRule = projectEvaluatedRule(result);
-            const reqEvent = {
-                at: evalAt,
-                evalMs,
-                method: 'list',
-                path,
-                auth,
-                result: 'deny',
-                debugMessages,
-                evaluatedRule: evalRule,
-                origin,
-            };
-            const hasDetail = detail !== undefined;
-            if (hasDetail) {
-                reqEvent.detail = detail;
-            }
-            const hasTriggeredBy = triggeredBy !== undefined;
-            if (hasTriggeredBy) {
-                reqEvent.triggeredBy = triggeredBy;
-            }
-            this.emitRequest(reqEvent);
-            const errExtras = {
-                request: { method: 'list', path, auth },
-            };
-            const hasRule = evalRule !== undefined;
-            if (hasRule) {
-                errExtras.rule = evalRule;
-            }
-            const error = makeError('permission-denied', `list ${path} denied by rules`, errExtras);
-            this.emitUserDenial(origin, error);
-            return { allowed: false, error };
+            return this.denyQuery(request, proof, evalAt, evalMs, detail, { reasons: debugMessages, rule: projectEvaluatedRule(result), evidence: rulesEvidence });
         }
         this.emitRequest({
             at: evalAt,
@@ -212,12 +152,51 @@ export class RulesListAuthorizer {
             result: 'allow',
             debugMessages,
             evaluatedRule: projectEvaluatedRule(result),
+            rulesEvidence,
             origin,
             ...(detail ? { detail } : {}),
             ...(triggeredBy ? { triggeredBy } : {}),
         });
         return { allowed: true };
     }
+    /** Combine local proof failures with actual residual evaluation, without
+     * ever putting rejected rules back into the authorization AST. */
+    denyQuery(request, proof, at, evalMs, detail, residual = { reasons: [] }) {
+        const { reasons: residualReasons, rule: evaluatedRule } = residual;
+        const failures = proof.kind === 'no-rule' ? [] : proof.failures;
+        const primary = failures.find(failure => failure.kind !== 'constraints-not-satisfied') ?? failures[0];
+        const queryProof = {
+            kind: primary?.kind ?? (proof.kind === 'no-rule' ? 'no-rule' : 'residual-denied'),
+            failures,
+            query: request.activityQuery ?? (request.execution ? queryExecutionDiagnostic(request.execution) : undefined),
+        };
+        const message = primary
+            ? `list ${request.path} denied: Pyric found the query statically unprovable — ${primary.reason}`
+            : `list ${request.path} denied by rules`;
+        // The projected AST can have empty match blocks. Its no-allow summary
+        // does not describe the deployed ruleset when proof rejected siblings.
+        const reasons = primary
+            ? [message, ...residualReasons.filter(reason => !reason.startsWith('No allow rules found'))]
+            : residualReasons;
+        const remediation = primary ? renderQueryRemediation(primary.residual) : undefined;
+        const error = makeError('permission-denied', message, {
+            request: { method: 'list', path: request.path, auth: request.auth },
+            query: request.constraints,
+            queryProof,
+            ...(remediation ? { remediation } : {}),
+            ...(primary?.rule || evaluatedRule ? { rule: primary?.rule ?? evaluatedRule } : {}),
+        });
+        this.emitRequest({
+            at, evalMs, method: 'list', path: request.path, auth: request.auth,
+            result: 'deny', debugMessages: reasons, queryProof, rulesEvidence: this.rules.captureQueryEvidence(queryProof, residual.evidence),
+            ...(evaluatedRule ? { evaluatedRule } : {}),
+            origin: request.origin,
+            ...(detail ? { detail } : {}),
+            ...(request.triggeredBy ? { triggeredBy: request.triggeredBy } : {}),
+        });
+        this.emitUserDenial(request.origin, error);
+        return { allowed: false, error };
+    }
     applyProof(testCase, proof, constraints) {
         if (proof.kind === 'provable') {
             testCase.resource = proof.syntheticResource;

package/dist/firestore/sandbox/rules-list-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules-list-authorizer.js","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-list-authorizer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjH,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AAEnF,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAChE,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AA0B1D;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IACA;IAJnB,YACmB,MAAyB,EACzB,KAAiB,EACjB,SAAwC,EACxC,IAA6B;QAH7B,WAAM,GAAN,MAAM,CAAmB;QACzB,UAAK,GAAL,KAAK,CAAY;QACjB,cAAS,GAAT,SAAS,CAA+B;QACxC,SAAI,GAAJ,IAAI,CAAyB;IAC7C,CAAC;IAEJ,SAAS,CAAC,OAAiC;QACzC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QACjE,MAAM,YAAY,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG;YACpB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CACjD,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CACnE,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAEhD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,CAAC;gBACf,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,OAAO;gBACf,aAAa,EAAE,CAAC,MAAM,KAAK,UAAU;wBACnC,CAAC,CAAC,6BAA6B;wBAC/B,CAAC,CAAC,6CAA6C,CAAC;gBAClD,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe;YAC3C,CAAC,CAAC,+BAA+B,CAAC,WAAW,CAAC;YAC9C,CAAC,CAAC,WAAW,CAAC;QAChB,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9C,MAAM,OAAO,GACX,QAAQ,IAAI,6DAA6D;gBACzE,8EAA8E,CAAC;YACjF,IAAI,CAAC,WAAW,CAAC;gBACf,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,CAAC,OAAO,CAAC;gBACxB,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE;gBACpD,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;gBACvC,KAAK,EAAE,WAAW;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,eAAe,GAAG,GAAG,IAAI,sBAAsB,CAAC;QACtD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnG,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QACjD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,OAAO,GACX,QAAQ,IAAI,iEAAiE;gBAC7E,oEAAoE,KAAK,CAAC,MAAM,EAAE,CAAC;YACrF,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAWV;gBACF,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;gBACrC,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,CAAC,OAAO,CAAC;gBACxB,MAAM;aACP,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACvC,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;YAC3B,CAAC;YACD,MAAM,cAAc,GAAG,WAAW,KAAK,SAAS,CAAC;YACjD,IAAI,cAAc,EAAE,CAAC;gBACnB,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,QAAe,CAAC,CAAC;YAElC,MAAM,SAAS,GAKX;gBACF,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;gBACvC,KAAK,EAAE,WAAW;aACnB,CAAC;YACF,MAAM,oBAAoB,GAAG,WAAW,KAAK,SAAS,CAAC;YACvD,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,qBAAqB,GAAG,WAAW,KAAK,EAAE,CAAC;gBACjD,IAAI,qBAAqB,EAAE,CAAC;oBAC1B,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC;gBACtC,CAAC;YACH,CAAC;YACD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;YAC9C,IAAI,YAAY,EAAE,CAAC;gBACjB,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAC9B,CAAC;YACD,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE,SAAgB,CAAC,CAAC;YACxE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU;YAChD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACvB,CAAC,CAAC,aAAa,CAAC,aAAc,CAAC;gBAC/B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAExB,MAAM,QAAQ,GAAG,kBAAkB,CACjC,IAAI,CAAC,IAAI,CAAC,KAAK,EACf,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAC/C,WAAY,CACb,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE;YACvE,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,CAAC;gBACf,EAAE,EAAE,MAAM;gBACV,MAAM;gBACN,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,CAAC,qBAAqB,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChE,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,SAAS,CAAC,mBAAmB,EAAE,QAAQ,IAAI,kBAAkB,EAAE;oBACpE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;iBACxC,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC;gBACf,EAAE,EAAE,MAAM;gBACV,MAAM;gBACN,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,aAAa;gBACrB,aAAa;gBACb,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,EAC/C,MAAM,EACN,IAAI,EACJ,aAAa,CACd,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC9C,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAYV;gBACF,EAAE,EAAE,MAAM;gBACV,MAAM;gBACN,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,aAAa;gBACb,aAAa,EAAE,QAAQ;gBACvB,MAAM;aACP,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACvC,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;YAC3B,CAAC;YACD,MAAM,cAAc,GAAG,WAAW,KAAK,SAAS,CAAC;YACjD,IAAI,cAAc,EAAE,CAAC;gBACnB,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,QAAe,CAAC,CAAC;YAElC,MAAM,SAAS,GAGX;gBACF,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;aACxC,CAAC;YACF,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,IAAI,GAAG,QAAQ,CAAC;YAC5B,CAAC;YACD,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,EAAE,QAAQ,IAAI,kBAAkB,EAAE,SAAgB,CAAC,CAAC;YAC/F,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,WAAW,CAAC;YACf,EAAE,EAAE,MAAM;YACV,MAAM;YACN,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,IAAI;YACJ,MAAM,EAAE,OAAO;YACf,aAAa;YACb,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC;YAC3C,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,UAAU,CAChB,QAAkB,EAClB,KAAwD,EACxD,WAA6B;QAE7B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAC9C,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,IAAI,WAAW,CAAC,MAAM,IAAI,IAAI,IAAI,WAAW,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC3F,QAAQ,CAAC,KAAK,GAAG;gBACf,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,WAAW,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,KAAuB;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAEO,cAAc,CAAC,MAA0C,EAAE,KAAwB;QACzF,IAAI,MAAM,KAAK,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;CACF"}
+{"version":3,"file":"rules-list-authorizer.js","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-list-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAA2B,MAAM,sBAAsB,CAAC;AAOzF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjH,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AAEnF,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAChE,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAyBtD;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IACA;IAGA;IAPnB,YACmB,MAAyB,EACzB,KAAiB,EACjB,SAAwC,EACxC,IAA6B;IAC9C;0EACsE;IACrD,QAAsB,IAAI,YAAY,EAAE;QANxC,WAAM,GAAN,MAAM,CAAmB;QACzB,UAAK,GAAL,KAAK,CAAY;QACjB,cAAS,GAAT,SAAS,CAA+B;QACxC,SAAI,GAAJ,IAAI,CAAyB;QAG7B,UAAK,GAAL,KAAK,CAAmC;IACxD,CAAC;IAEJ,SAAS,CAAC,OAAiC;QACzC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QACjE,MAAM,YAAY,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG;YACpB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CACjD,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CACzE,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAEtD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,CAAC;gBACf,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,OAAO;gBACf,aAAa,EAAE,CAAC,MAAM,KAAK,UAAU;wBACnC,CAAC,CAAC,6BAA6B;wBAC/B,CAAC,CAAC,6CAA6C,CAAC;gBAClD,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe;YAC3C,CAAC,CAAC,+BAA+B,CAAC,WAAW,CAAC;YAC9C,CAAC,CAAC,WAAW,CAAC;QAChB,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9C,MAAM,OAAO,GACX,QAAQ,IAAI,6DAA6D;gBACzE,8EAA8E,CAAC;YACjF,IAAI,CAAC,WAAW,CAAC;gBACf,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,CAAC,OAAO,CAAC;gBACxB,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE;gBACpD,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;gBACvC,KAAK,EAAE,WAAW;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,eAAe,GAAG,GAAG,IAAI,sBAAsB,CAAC;QACtD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnG,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QACjD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU;YAChD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACvB,CAAC,CAAC,aAAa,CAAC,aAAc,CAAC;gBAC/B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAExB,MAAM,QAAQ,GAAG,kBAAkB,CACjC,IAAI,CAAC,IAAI,CAAC,KAAK,EACf,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAC/C,WAAY,CACb,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE;YACvE,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,CAAC;gBACf,EAAE,EAAE,MAAM;gBACV,MAAM;gBACN,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,CAAC,qBAAqB,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChE,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,SAAS,CAAC,mBAAmB,EAAE,QAAQ,IAAI,kBAAkB,EAAE;oBACpE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;iBACxC,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3E,MAAM,aAAa,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC;gBACf,EAAE,EAAE,MAAM;gBACV,MAAM;gBACN,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,aAAa;gBACrB,aAAa;gBACb,aAAa;gBACb,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,EAC/C,MAAM,EACN,IAAI,EACJ,aAAa,CACd,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC9C,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EACzD,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,CAAC,WAAW,CAAC;YACf,EAAE,EAAE,MAAM;YACV,MAAM;YACN,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,IAAI;YACJ,MAAM,EAAE,OAAO;YACf,aAAa;YACb,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC;YAC3C,aAAa;YACb,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;sEACkE;IAC1D,SAAS,CACf,OAAiC,EACjC,KAAuB,EACvB,EAAU,EACV,MAAc,EACd,MAAkC,EAClC,WAA0G,EAAE,OAAO,EAAE,EAAE,EAAE;QAEzH,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC;QACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,2BAA2B,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtG,MAAM,UAAU,GAAyB;YACvC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACjF,QAAQ;YACR,KAAK,EAAE,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAC9G,CAAC;QACF,MAAM,OAAO,GAAG,OAAO;YACrB,CAAC,CAAC,QAAQ,OAAO,CAAC,IAAI,0DAA0D,OAAO,CAAC,MAAM,EAAE;YAChG,CAAC,CAAC,QAAQ,OAAO,CAAC,IAAI,kBAAkB,CAAC;QAC3C,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,OAAO,GAAG,OAAO;YACrB,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC;YAC5F,CAAC,CAAC,eAAe,CAAC;QACpB,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE;YACpD,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YACnE,KAAK,EAAE,OAAO,CAAC,WAAW;YAC1B,UAAU;YACV,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC;YACf,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;YACjI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAEO,UAAU,CAChB,QAAkB,EAClB,KAAwD,EACxD,WAA6B;QAE7B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAC9C,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,IAAI,WAAW,CAAC,MAAM,IAAI,IAAI,IAAI,WAAW,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC3F,QAAQ,CAAC,KAAK,GAAG;gBACf,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,WAAW,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,KAAuB;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAEO,cAAc,CAAC,MAA0C,EAAE,KAAwB;QACzF,IAAI,MAAM,KAAK,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/firestore/sandbox/rules-operation-reader.d.ts

@@ -4,6 +4,7 @@ import type { OperationResult, ReadOperation } from './writes.js';
 import type { FirestoreEventBus } from './event-bus.js';
 import type { RulesState } from './rules-state.js';
 import { EventLog } from './event-log.js';
+import { SandboxClock } from '../../sandbox/clock.js';
 interface RulesOperationReaderHost {
     readonly state: DocStore;
 }
@@ -14,7 +15,13 @@ export declare class RulesOperationReader {
     private readonly simulator;
     private readonly host;
     private readonly eventLog;
-    constructor(events: FirestoreEventBus, rules: RulesState, simulator: SimulateFirestoreRulesHandler, host: RulesOperationReaderHost, eventLog: EventLog);
+    /** The sandbox's clock, read for every server-set time this produces.
+     *  Defaults to a private wall clock for a standalone construction. */
+    private readonly clock;
+    constructor(events: FirestoreEventBus, rules: RulesState, simulator: SimulateFirestoreRulesHandler, host: RulesOperationReaderHost, eventLog: EventLog, 
+    /** The sandbox's clock, read for every server-set time this produces.
+     *  Defaults to a private wall clock for a standalone construction. */
+    clock?: SandboxClock);
     private get state();
     private emitRequest;
     private emitDenial;

package/dist/firestore/sandbox/rules-operation-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules-operation-reader.d.ts","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-operation-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAM1E,OAAO,KAAK,EAAa,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAOnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,UAAU,wBAAwB;IAChC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,6EAA6E;AAC7E,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAJR,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,6BAA6B,EACxC,IAAI,EAAE,wBAAwB,EAC9B,QAAQ,EAAE,QAAQ;IAGrC,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,SAAS,EAAE,aAAa,GAAG,eAAe;CA4KnD"}
+{"version":3,"file":"rules-operation-reader.d.ts","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-operation-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAM1E,OAAO,KAAK,EAAa,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAOnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,UAAU,wBAAwB;IAChC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,6EAA6E;AAC7E,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;0EACsE;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAPL,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,6BAA6B,EACxC,IAAI,EAAE,wBAAwB,EAC9B,QAAQ,EAAE,QAAQ;IACnC;0EACsE;IACrD,KAAK,GAAE,YAAiC;IAG3D,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,SAAS,EAAE,aAAa,GAAG,eAAe;CA+KnD"}

package/dist/firestore/sandbox/rules-operation-reader.js

@@ -4,6 +4,7 @@ import { buildRequestEvent } from './request-events.js';
 import { SimulatorUnsupportedError, unsupportedMessage, } from './rules-evaluation.js';
 import { buildRulesTestCase } from './rules-test-case.js';
 import { simulateRules } from './rules-simulator.js';
+import { SandboxClock } from '../../sandbox/clock.js';
 /** Rules-gated user `get`/`list` execution, including history and events. */
 export class RulesOperationReader {
     events;
@@ -11,12 +12,17 @@ export class RulesOperationReader {
     simulator;
     host;
     eventLog;
-    constructor(events, rules, simulator, host, eventLog) {
+    clock;
+    constructor(events, rules, simulator, host, eventLog, 
+    /** The sandbox's clock, read for every server-set time this produces.
+     *  Defaults to a private wall clock for a standalone construction. */
+    clock = new SandboxClock()) {
         this.events = events;
         this.rules = rules;
         this.simulator = simulator;
         this.host = host;
         this.eventLog = eventLog;
+        this.clock = clock;
     }
     get state() {
         return this.host.state;
@@ -39,10 +45,10 @@ export class RulesOperationReader {
         // No data to resolve on reads, but still pin a serverTime so the
         // handler's `request.time` is deterministic relative to anything
         // observed by debug messages (Item 1).
-        const readServerTime = Timestamp.fromMillis(Date.now());
+        const readServerTime = Timestamp.fromMillis(this.clock.now());
         const testCase = buildRulesTestCase(this.state, operation, readServerTime);
-        // Issue #307 — time the simulate call for RequestEvent.evalMs.
-        const evalAt = Date.now();
+        // Time the simulate call for RequestEvent.evalMs.
+        const evalAt = this.clock.now();
         const evalStart = performance.now();
         const simResult = simulateRules(this.state, this.rules, this.simulator, [testCase], bypassRules);
         const evalMs = performance.now() - evalStart;
@@ -74,13 +80,14 @@ export class RulesOperationReader {
             return { allowed: false, debugMessages: [simResult.error.message], event };
         }
         const result = simResult.data.results[0];
+        const rulesEvidence = this.rules.captureEvidence(result);
         const isUnsupported = result.state === 'UNSUPPORTED';
         if (isUnsupported) {
             // Issue #307 — surface the eval-time event BEFORE throwing so
             // subscribers see the unsupported request alongside everything else.
             const unsupReqEvent = {
                 at: evalAt, evalMs, method, path, auth, result: 'unsupported',
-                debugMessages: renderLegacyDebugMessages(result), origin: 'user',
+                rulesEvidence, debugMessages: renderLegacyDebugMessages(result), origin: 'user',
             };
             const hasDetail = detail !== undefined;
             if (hasDetail) {
@@ -150,6 +157,7 @@ export class RulesOperationReader {
             result: resultStr,
             debugMessages: renderLegacyDebugMessages(result),
             evaluatedRule: evalRule,
+            rulesEvidence,
             origin: 'user',
         };
         const isEventGet = method === 'get';

package/dist/firestore/sandbox/rules-operation-reader.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules-operation-reader.js","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-operation-reader.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAGhE,OAAO,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAMrD,6EAA6E;AAC7E,MAAM,OAAO,oBAAoB;IAEZ;IACA;IACA;IACA;IACA;IALnB,YACmB,MAAyB,EACzB,KAAiB,EACjB,SAAwC,EACxC,IAA8B,EAC9B,QAAkB;QAJlB,WAAM,GAAN,MAAM,CAAmB;QACzB,UAAK,GAAL,KAAK,CAAY;QACjB,cAAS,GAAT,SAAS,CAA+B;QACxC,SAAI,GAAJ,IAAI,CAA0B;QAC9B,aAAQ,GAAR,QAAQ,CAAU;IAClC,CAAC;IAEJ,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IACzB,CAAC;IAEO,WAAW,CAAC,KAAuB;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAEO,UAAU,CAAC,KAAwB;QACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,SAAwB;QAC9B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtD,IAAI,MAAM,GAAgC,SAAS,CAAC;QACpD,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,iEAAiE;QACjE,iEAAiE;QACjE,uCAAuC;QACvC,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC3E,+DAA+D;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,aAAa,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,SAAS,EACd,CAAC,QAAQ,CAAC,EACV,WAAW,CACZ,CAAC;QACF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE7C,IAAI,WAAW,GAA2B,IAAI,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC;QACzC,MAAM,aAAa,GAAG,IAAI,KAAK,IAAI,CAAC;QACpC,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,aAAa,EAAE,CAAC;gBAClB,WAAW,GAAG,EAAE,GAAG,EAAE,IAAK,CAAC,GAAG,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC;QAC7C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACjC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW;gBAC/C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,qBAAqB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;aAChF,CAAC,CAAC;YACH,sEAAsE;YACtE,MAAM,YAAY,GAAQ;gBACxB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM;gBACtD,aAAa,EAAE,CAAC,qBAAqB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC/D,MAAM,EAAE,MAAM;aACf,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACvC,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,KAAK,aAAa,CAAC;QACrD,IAAI,aAAa,EAAE,CAAC;YAClB,8DAA8D;YAC9D,qEAAqE;YACrE,MAAM,aAAa,GAAQ;gBACzB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa;gBAC7D,aAAa,EAAE,yBAAyB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM;aACjE,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACvC,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YAChC,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,EACnE,MAAM,EAAE,IAAI,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC5C,IAAI,QAAQ,GAAoC,SAAS,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC;YAC/B,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAA4B,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACjC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW;YAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,yBAAyB,CAAC,MAAM,CAAC;SACrE,CAAC,CAAC;QAEH,gEAAgE;QAChE,+DAA+D;QAC/D,yDAAyD;QACzD,MAAM,GAAG,GAAoB;YAC3B,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,yBAAyB,CAAC,MAAM,CAAC;YAChD,KAAK;SACN,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,2DAA2D;YAC3D,4DAA4D;YAC5D,2DAA2D;YAC3D,6DAA6D;YAC7D,oDAAoD;YACpD,MAAM,OAAO,GACX,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzB,MAAM,SAAS,GAIX,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,KAAK,KAAK,CAAC;YACrC,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrC,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;gBACnC,SAAS,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC5D,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,IAAI,GAAG,QAAQ,CAAC;YAC5B,CAAC;YACD,GAAG,CAAC,KAAK,GAAG,SAAS,CACnB,mBAAmB,EACnB,GAAG,MAAM,IAAI,IAAI,kBAAkB,EACnC,SAAgB,CACjB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,8BAA8B;QAC9B,IAAI,SAAS,GAAqB,MAAM,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,GAAG,OAAO,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAYV;YACF,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI;YACtC,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,yBAAyB,CAAC,MAAM,CAAC;YAChD,aAAa,EAAE,QAAQ;YACvB,MAAM,EAAE,MAAM;SACf,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,KAAK,KAAK,CAAC;QACpC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;YACnC,QAAQ,CAAC,cAAc,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACjE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,QAAe,CAAC,CAAC;QAClC,OAAO,GAAG,CAAC;IACb,CAAC;CAEF"}
+{"version":3,"file":"rules-operation-reader.js","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-operation-reader.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAGhE,OAAO,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAMtD,6EAA6E;AAC7E,MAAM,OAAO,oBAAoB;IAEZ;IACA;IACA;IACA;IACA;IAGA;IARnB,YACmB,MAAyB,EACzB,KAAiB,EACjB,SAAwC,EACxC,IAA8B,EAC9B,QAAkB;IACnC;0EACsE;IACrD,QAAsB,IAAI,YAAY,EAAE;QAPxC,WAAM,GAAN,MAAM,CAAmB;QACzB,UAAK,GAAL,KAAK,CAAY;QACjB,cAAS,GAAT,SAAS,CAA+B;QACxC,SAAI,GAAJ,IAAI,CAA0B;QAC9B,aAAQ,GAAR,QAAQ,CAAU;QAGlB,UAAK,GAAL,KAAK,CAAmC;IACxD,CAAC;IAEJ,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IACzB,CAAC;IAEO,WAAW,CAAC,KAAuB;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAEO,UAAU,CAAC,KAAwB;QACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,SAAwB;QAC9B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtD,IAAI,MAAM,GAAgC,SAAS,CAAC;QACpD,MAAM,QAAQ,GAAG,WAAW,KAAK,IAAI,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,iEAAiE;QACjE,iEAAiE;QACjE,uCAAuC;QACvC,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC3E,kDAAkD;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,aAAa,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,SAAS,EACd,CAAC,QAAQ,CAAC,EACV,WAAW,CACZ,CAAC;QACF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE7C,IAAI,WAAW,GAA2B,IAAI,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC;QACzC,MAAM,aAAa,GAAG,IAAI,KAAK,IAAI,CAAC;QACpC,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,aAAa,EAAE,CAAC;gBAClB,WAAW,GAAG,EAAE,GAAG,EAAE,IAAK,CAAC,GAAG,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC;QAC7C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACjC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW;gBAC/C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,qBAAqB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;aAChF,CAAC,CAAC;YACH,sEAAsE;YACtE,MAAM,YAAY,GAAQ;gBACxB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM;gBACtD,aAAa,EAAE,CAAC,qBAAqB,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC/D,MAAM,EAAE,MAAM;aACf,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACvC,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,KAAK,aAAa,CAAC;QACrD,IAAI,aAAa,EAAE,CAAC;YAClB,8DAA8D;YAC9D,qEAAqE;YACrE,MAAM,aAAa,GAAQ;gBACzB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa;gBAC7D,aAAa,EAAE,aAAa,EAAE,yBAAyB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM;aAChF,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACvC,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YAChC,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,EACnE,MAAM,EAAE,IAAI,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC5C,IAAI,QAAQ,GAAoC,SAAS,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC;YAC/B,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAA4B,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACjC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW;YAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,yBAAyB,CAAC,MAAM,CAAC;SACrE,CAAC,CAAC;QAEH,gEAAgE;QAChE,+DAA+D;QAC/D,yDAAyD;QACzD,MAAM,GAAG,GAAoB;YAC3B,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,yBAAyB,CAAC,MAAM,CAAC;YAChD,KAAK;SACN,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,2DAA2D;YAC3D,4DAA4D;YAC5D,2DAA2D;YAC3D,6DAA6D;YAC7D,oDAAoD;YACpD,MAAM,OAAO,GACX,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzB,MAAM,SAAS,GAIX,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,KAAK,KAAK,CAAC;YACrC,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrC,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;gBACnC,SAAS,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC5D,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,IAAI,GAAG,QAAQ,CAAC;YAC5B,CAAC;YACD,GAAG,CAAC,KAAK,GAAG,SAAS,CACnB,mBAAmB,EACnB,GAAG,MAAM,IAAI,IAAI,kBAAkB,EACnC,SAAgB,CACjB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,8BAA8B;QAC9B,IAAI,SAAS,GAAqB,MAAM,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,GAAG,OAAO,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAaV;YACF,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI;YACtC,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,yBAAyB,CAAC,MAAM,CAAC;YAChD,aAAa,EAAE,QAAQ;YACvB,aAAa;YACb,MAAM,EAAE,MAAM;SACf,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,KAAK,KAAK,CAAC;QACpC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;YACnC,QAAQ,CAAC,cAAc,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACjE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,QAAe,CAAC,CAAC;QAClC,OAAO,GAAG,CAAC;IACb,CAAC;CAEF"}

package/dist/firestore/sandbox/rules-read-engine.d.ts

@@ -29,6 +29,7 @@ import type { TriggerScope } from './trigger-scope.js';
 import type { RulesState } from './rules-state.js';
 import { EventLog } from './event-log.js';
 import { type RunQueryRequest, type RunQueryResult } from './query-execution.js';
+import { SandboxClock } from '../../sandbox/clock.js';
 /**
  * The engine capability read paths need from the facade. `state` is a live
  * getter because `seed()` swaps the whole keyspace object.
@@ -42,9 +43,15 @@ export declare class RulesReadEngine implements ListenerDispatchHost {
     private readonly rules;
     private readonly simulator;
     private readonly host;
+    /** The sandbox's clock, read for every server-set time this produces.
+     *  Defaults to a private wall clock for a standalone construction. */
+    private readonly clock;
     private readonly operationReader;
     private readonly listAuthorizer;
-    constructor(events: FirestoreEventBus, triggerScope: TriggerScope, rules: RulesState, simulator: SimulateFirestoreRulesHandler, host: RulesReadHost, eventLog: EventLog);
+    constructor(events: FirestoreEventBus, triggerScope: TriggerScope, rules: RulesState, simulator: SimulateFirestoreRulesHandler, host: RulesReadHost, eventLog: EventLog, 
+    /** The sandbox's clock, read for every server-set time this produces.
+     *  Defaults to a private wall clock for a standalone construction. */
+    clock?: SandboxClock);
     private get state();
     /** Same lazy-allocation contract as the facade's emitRequest. */
     private emitRequest;

package/dist/firestore/sandbox/rules-read-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules-read-engine.d.ts","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-read-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EACV,6BAA6B,EAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAE9B;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,qBAAa,eAAgB,YAAW,oBAAoB;IAKxD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IARvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuB;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;gBAGlC,MAAM,EAAE,iBAAiB,EACzB,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,6BAA6B,EACxC,IAAI,EAAE,aAAa,EACpC,QAAQ,EAAE,QAAQ;IAYpB,OAAO,KAAK,KAAK,GAEhB;IAED,iEAAiE;IACjE,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,SAAS,EAAE,aAAa,GAAG,eAAe;IAGlD;;;;;;;;;OASG;IACH,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,EAClB,WAAW,UAAQ,GAClB;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE;IAgH9F;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,oBAAoB,CAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,EAClB,WAAW,CAAC,EAAE,oBAAoB,EAClC,WAAW,UAAQ,GAClB;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,YAAY,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE;IAwDjH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc;CAqBnD"}
+{"version":3,"file":"rules-read-engine.d.ts","sourceRoot":"","sources":["../../../src/firestore/sandbox/rules-read-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EACV,6BAA6B,EAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,qBAAa,eAAgB,YAAW,oBAAoB;IAKxD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB;0EACsE;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;IAZxB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuB;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;gBAGlC,MAAM,EAAE,iBAAiB,EACzB,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,6BAA6B,EACxC,IAAI,EAAE,aAAa,EACpC,QAAQ,EAAE,QAAQ;IAClB;0EACsE;IACrD,KAAK,GAAE,YAAiC;IAa3D,OAAO,KAAK,KAAK,GAEhB;IAED,iEAAiE;IACjE,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,SAAS,EAAE,aAAa,GAAG,eAAe;IAGlD;;;;;;;;;OASG;IACH,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,EAClB,WAAW,UAAQ,GAClB;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE;IAmH9F;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,oBAAoB,CAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,EAClB,WAAW,CAAC,EAAE,oBAAoB,EAClC,WAAW,UAAQ,GAClB;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,YAAY,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE;IA0DjH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc;CAsBnD"}