pyric 0.1.0-alpha.21 → 0.1.0-alpha.24

package/dist/storage/sandbox/rules-hashing-methods.d.ts

@@ -0,0 +1,16 @@
+import type { EvalCtx } from './rules-evaluator.js';
+import { type MethodCall, type ReceiverMethods } from './rules-method-calls.js';
+/**
+ * `hashing.md5(value)`, `hashing.sha256(value)`, `hashing.crc32(value)`, and
+ * `hashing.crc32c(value)` over a string (hashed as its UTF-8 bytes) or Bytes,
+ * returning Bytes. Another argument type is production's "Unsupported
+ * operation error", captured for `hashing.md5(int)`.
+ */
+export declare function evalHashingNamespace(expr: MethodCall, ctx: EvalCtx): unknown;
+/**
+ * The Bytes encodings, answered by the value itself: `toBase64()` is padded
+ * base64url and `toHexString()` is uppercase hexadecimal. `size()` lives with
+ * the other sized types.
+ */
+export declare const bytesMethods: ReceiverMethods;
+//# sourceMappingURL=rules-hashing-methods.d.ts.map

package/dist/storage/sandbox/rules-hashing-methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-hashing-methods.d.ts","sourceRoot":"","sources":["../../../src/storage/sandbox/rules-hashing-methods.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAMjC;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAkB5E;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,eAG1B,CAAC"}

package/dist/storage/sandbox/rules-hashing-methods.js

@@ -0,0 +1,41 @@
+import { evaluateHashingMethod } from '../../rules/simulator/hashing-builtins.js';
+import { Bytes } from '../../rules/simulator/wrappers/bytes.js';
+import { RuleEvalError, RuleUnsupportedError } from './rules-evaluation-error.js';
+import { evalArguments, evalValueMethod, } from './rules-method-calls.js';
+import { describeRulesType as describeType, isRuleError as isErr } from './rules-values.js';
+/** The digests the `hashing` namespace defines. */
+const HASHING_FUNCTIONS = new Set(['crc32', 'crc32c', 'md5', 'sha256']);
+/**
+ * `hashing.md5(value)`, `hashing.sha256(value)`, `hashing.crc32(value)`, and
+ * `hashing.crc32c(value)` over a string (hashed as its UTF-8 bytes) or Bytes,
+ * returning Bytes. Another argument type is production's "Unsupported
+ * operation error", captured for `hashing.md5(int)`.
+ */
+export function evalHashingNamespace(expr, ctx) {
+    if (!HASHING_FUNCTIONS.has(expr.method)) {
+        // A name outside the namespace is a compile-reject class: never absorbed.
+        throw new RuleUnsupportedError(`unsupported method hashing.${expr.method}()`);
+    }
+    const args = evalArguments(expr, ctx);
+    if (isErr(args))
+        return args;
+    if (args.length !== 1) {
+        throw new RuleEvalError(`hashing.${expr.method}() expects a single string or bytes argument`);
+    }
+    const [input] = args;
+    if (typeof input !== 'string' && !(input instanceof Bytes)) {
+        throw new RuleEvalError(`Unsupported operation error. Received: hashing.${expr.method}(${describeType(input)}). `
+            + `Expected: hashing.${expr.method}(bytes), hashing.${expr.method}(string).`);
+    }
+    return evaluateHashingMethod(expr.method, [input]);
+}
+/**
+ * The Bytes encodings, answered by the value itself: `toBase64()` is padded
+ * base64url and `toHexString()` is uppercase hexadecimal. `size()` lives with
+ * the other sized types.
+ */
+export const bytesMethods = {
+    toBase64: evalValueMethod,
+    toHexString: evalValueMethod,
+};
+//# sourceMappingURL=rules-hashing-methods.js.map

package/dist/storage/sandbox/rules-hashing-methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-hashing-methods.js","sourceRoot":"","sources":["../../../src/storage/sandbox/rules-hashing-methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,KAAK,EAAE,MAAM,yCAAyC,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EACL,aAAa,EACb,eAAe,GAGhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,IAAI,YAAY,EAAE,WAAW,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE5F,mDAAmD;AACnD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAgB,EAAE,GAAY;IACjE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,0EAA0E;QAC1E,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,WAAW,IAAI,CAAC,MAAM,8CAA8C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,aAAa,CACrB,kDAAkD,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK;cACrF,qBAAqB,IAAI,CAAC,MAAM,oBAAoB,IAAI,CAAC,MAAM,WAAW,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,QAAQ,EAAE,eAAe;IACzB,WAAW,EAAE,eAAe;CAC7B,CAAC"}

package/dist/storage/sandbox/rules-method-calls.d.ts

@@ -0,0 +1,40 @@
+import type { Expr } from './rules.js';
+import { type EvalCtx } from './rules-evaluator.js';
+import { RuleEvalError } from './rules-evaluation-error.js';
+import { type RuleError } from './rules-values.js';
+export type MethodCall = Extract<Expr, {
+    kind: 'methodcall';
+}>;
+/**
+ * Evaluates `<receiver>.<method>(args)` for one method name. The dispatcher
+ * evaluates the receiver first and passes its value; an error receiver never
+ * reaches a method.
+ */
+export type ReceiverMethod = (receiver: unknown, expr: MethodCall, ctx: EvalCtx) => unknown;
+/** Method name to evaluator, one record per concern file. */
+export type ReceiverMethods = Readonly<Record<string, ReceiverMethod>>;
+/**
+ * Evaluates `<namespace>.<method>(args)` for a builtin namespace such as
+ * `timestamp` or `hashing`.
+ */
+export type NamespaceMethod = (expr: MethodCall, ctx: EvalCtx) => unknown;
+/**
+ * Production's error for a method its receiver type does not define, such as
+ * `resource.size.hours()`. It is an evaluation error, so a determining
+ * `&&`/`||` operand absorbs it (rules-storage-stdlib-timestamp-duration
+ * captures `resource.size.year() == 1970 || true` allowing).
+ */
+export declare function functionNotFound(method: string): RuleEvalError;
+/** Deny a call that passes arguments to a method that takes none. */
+export declare function expectNoArguments(expr: MethodCall): void;
+/** Evaluate every argument in order; the first error value wins. */
+export declare function evalArguments(expr: MethodCall, ctx: EvalCtx): unknown[] | RuleError;
+/**
+ * A no-argument method a Timestamp, Duration, or Bytes value answers for
+ * itself through `callMethod`: the timestamp accessors, `seconds()` and
+ * `nanos()` on a duration, and the Bytes encodings. Any other receiver, or a
+ * value that does not define the method, is production's function-not-found
+ * error.
+ */
+export declare function evalValueMethod(receiver: unknown, expr: MethodCall): unknown;
+//# sourceMappingURL=rules-method-calls.d.ts.map

package/dist/storage/sandbox/rules-method-calls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-method-calls.d.ts","sourceRoot":"","sources":["../../../src/storage/sandbox/rules-method-calls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAY,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;AAE5F,6DAA6D;AAC7D,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAEvE;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;AAE1E;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAE9D;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAIxD;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,SAAS,CAQnF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAO5E"}

package/dist/storage/sandbox/rules-method-calls.js

@@ -0,0 +1,47 @@
+import { NO_OP, RulesValue } from '../../rules/simulator/wrappers/base.js';
+import { evalExpr } from './rules-evaluator.js';
+import { RuleEvalError } from './rules-evaluation-error.js';
+import { isRuleError as isErr } from './rules-values.js';
+/**
+ * Production's error for a method its receiver type does not define, such as
+ * `resource.size.hours()`. It is an evaluation error, so a determining
+ * `&&`/`||` operand absorbs it (rules-storage-stdlib-timestamp-duration
+ * captures `resource.size.year() == 1970 || true` allowing).
+ */
+export function functionNotFound(method) {
+    return new RuleEvalError(`Function not found error: Name: [${method}].`);
+}
+/** Deny a call that passes arguments to a method that takes none. */
+export function expectNoArguments(expr) {
+    if (expr.args.length !== 0) {
+        throw new RuleEvalError(`${expr.method}() expects no arguments`);
+    }
+}
+/** Evaluate every argument in order; the first error value wins. */
+export function evalArguments(expr, ctx) {
+    const values = [];
+    for (const arg of expr.args) {
+        const value = evalExpr(arg, ctx);
+        if (isErr(value))
+            return value;
+        values.push(value);
+    }
+    return values;
+}
+/**
+ * A no-argument method a Timestamp, Duration, or Bytes value answers for
+ * itself through `callMethod`: the timestamp accessors, `seconds()` and
+ * `nanos()` on a duration, and the Bytes encodings. Any other receiver, or a
+ * value that does not define the method, is production's function-not-found
+ * error.
+ */
+export function evalValueMethod(receiver, expr) {
+    expectNoArguments(expr);
+    if (receiver instanceof RulesValue) {
+        const result = receiver.callMethod(expr.method, []);
+        if (result !== NO_OP)
+            return result;
+    }
+    throw functionNotFound(expr.method);
+}
+//# sourceMappingURL=rules-method-calls.js.map

package/dist/storage/sandbox/rules-method-calls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-method-calls.js","sourceRoot":"","sources":["../../../src/storage/sandbox/rules-method-calls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAE3E,OAAO,EAAE,QAAQ,EAAgB,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,WAAW,IAAI,KAAK,EAAkB,MAAM,mBAAmB,CAAC;AAoBzE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,IAAI,aAAa,CAAC,oCAAoC,MAAM,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,IAAgB;IAChD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,GAAG,IAAI,CAAC,MAAM,yBAAyB,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,GAAY;IAC1D,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,QAAiB,EAAE,IAAgB;IACjE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,QAAQ,YAAY,UAAU,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;IACtC,CAAC;IACD,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/storage/sandbox/rules-methods.d.ts

@@ -1,17 +1,16 @@
-import type { Expr } from './rules.js';
 import { type EvalCtx } from './rules-evaluator.js';
+import type { MethodCall } from './rules-method-calls.js';
 /**
- * Evaluate a `<target>.<method>(args)` call. Two builtin families are
- * supported; everything else denies (throws `RuleEvalError`), so unknown
- * builtins — including deliberately-out-of-scope `firestore.get`/`exists` —
- * deny with a reason rather than ever a false allow.
+ * Evaluate a `<target>.<method>(args)` call.
  *
- *   - `string.matches(re)` — RE2-style whole-string regex match.
- *   - `timestamp.date(y, m, d)` / `timestamp.value(epochMillis)` —
- *     timestamp constructors, returned as epoch millis to compare against
- *     `request.time`.
+ * A bare `timestamp`, `duration`, `hashing`, or `firestore` identifier that
+ * no local or path parameter shadows is a builtin namespace. Otherwise the
+ * target is a receiver: it evaluates first, an error receiver propagates,
+ * and the method's evaluator checks the receiver type. A modeled method on
+ * a receiver that lacks it is production's function-not-found error, which
+ * `&&`/`||` may absorb. An unmodeled method name is either unmodeled here or
+ * rejected by production's compiler; its verdict is unknowable locally, so
+ * it is unabsorbable and fails closed even under a determining operand.
  */
-export declare function evalMethodCall(expr: Extract<Expr, {
-    kind: 'methodcall';
-}>, ctx: EvalCtx): unknown;
+export declare function evalMethodCall(expr: MethodCall, ctx: EvalCtx): unknown;
 //# sourceMappingURL=rules-methods.d.ts.map

package/dist/storage/sandbox/rules-methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules-methods.d.ts","sourceRoot":"","sources":["../../../src/storage/sandbox/rules-methods.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAY,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAmB9D;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAgEjG"}
+{"version":3,"file":"rules-methods.d.ts","sourceRoot":"","sources":["../../../src/storage/sandbox/rules-methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAK9D,OAAO,KAAK,EAAE,UAAU,EAAoD,MAAM,yBAAyB,CAAC;AAqB5G;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CActE"}

package/dist/storage/sandbox/rules-methods.js

@@ -1,370 +1,73 @@
 import { evalExpr } from './rules-evaluator.js';
-import { RuleEvalError, RuleResourceLimitError, RuleUnsupportedError, } from './rules-evaluation-error.js';
-import { RuleError, describeRulesType as describeType, isRuleError as isErr, isRulesMap, rulesEquals, } from './rules-values.js';
-// ═══════════════════════════════════════════════════════════════
-// Builtin method / namespace calls
-// ═══════════════════════════════════════════════════════════════
+import { RuleUnsupportedError } from './rules-evaluation-error.js';
+import { collectionMethods } from './rules-collection-methods.js';
+import { evalFirestoreBuiltin } from './rules-firestore-lookup.js';
+import { bytesMethods, evalHashingNamespace } from './rules-hashing-methods.js';
+import { stringMethods } from './rules-string-methods.js';
+import { evalDurationNamespace, evalTimestampNamespace, timeMethods } from './rules-time-methods.js';
+import { isRuleError as isErr } from './rules-values.js';
+/** The builtin namespaces, keyed by the bare identifier a call names. */
+const NAMESPACES = new Map([
+    ['duration', evalDurationNamespace],
+    ['firestore', evalFirestoreBuiltin],
+    ['hashing', evalHashingNamespace],
+    ['timestamp', evalTimestampNamespace],
+]);
+/** Every receiver method the evaluator models, one record per concern. */
+const RECEIVER_METHODS = mergeReceiverMethods([
+    bytesMethods,
+    collectionMethods,
+    stringMethods,
+    timeMethods,
+]);
 /**
- * Evaluate a `<target>.<method>(args)` call. Two builtin families are
- * supported; everything else denies (throws `RuleEvalError`), so unknown
- * builtins — including deliberately-out-of-scope `firestore.get`/`exists` —
- * deny with a reason rather than ever a false allow.
+ * Evaluate a `<target>.<method>(args)` call.
  *
- *   - `string.matches(re)` — RE2-style whole-string regex match.
- *   - `timestamp.date(y, m, d)` / `timestamp.value(epochMillis)` —
- *     timestamp constructors, returned as epoch millis to compare against
- *     `request.time`.
+ * A bare `timestamp`, `duration`, `hashing`, or `firestore` identifier that
+ * no local or path parameter shadows is a builtin namespace. Otherwise the
+ * target is a receiver: it evaluates first, an error receiver propagates,
+ * and the method's evaluator checks the receiver type. A modeled method on
+ * a receiver that lacks it is production's function-not-found error, which
+ * `&&`/`||` may absorb. An unmodeled method name is either unmodeled here or
+ * rejected by production's compiler; its verdict is unknowable locally, so
+ * it is unabsorbable and fails closed even under a determining operand.
  */
 export function evalMethodCall(expr, ctx) {
-    // Timestamp namespace: `timestamp.date(...)` / `timestamp.value(...)`.
-    // Detected structurally on the bare `timestamp` identifier (not a bound
-    // local/param/global) so a user value named `timestamp` can't hijack it.
-    if (expr.target.kind === 'ident' &&
-        expr.target.name === 'timestamp' &&
-        !(expr.target.name in ctx.locals) &&
-        !(expr.target.name in ctx.params)) {
-        return evalTimestampBuiltin(expr, ctx);
-    }
-    // Duration namespace: `duration.value(n, unit)`. Detected on the bare
-    // `duration` identifier so a user value named `duration` can't hijack it.
-    if (expr.target.kind === 'ident' &&
-        expr.target.name === 'duration' &&
-        !(expr.target.name in ctx.locals) &&
-        !(expr.target.name in ctx.params)) {
-        return evalDurationBuiltin(expr, ctx);
-    }
-    // Firestore namespace: `firestore.get(path)` / `firestore.exists(path)`.
-    // Detected on the bare `firestore` identifier (not a bound local/param) so
-    // a user value named `firestore` can't hijack it.
-    if (expr.target.kind === 'ident' &&
-        expr.target.name === 'firestore' &&
-        !(expr.target.name in ctx.locals) &&
-        !(expr.target.name in ctx.params)) {
-        return evalFirestoreBuiltin(expr, ctx);
-    }
-    if (expr.method === 'matches') {
-        return evalMatches(expr, ctx);
-    }
-    if (expr.method === 'split') {
-        return evalSplit(expr, ctx);
-    }
-    if (expr.method === 'size') {
-        return evalSize(expr, ctx);
-    }
-    if (expr.method === 'keys') {
-        return evalMapKeys(expr, ctx);
-    }
-    if (expr.method === 'hasAll') {
-        return evalHasAll(expr, ctx);
-    }
-    if (expr.method === 'get') {
-        return evalMapGet(expr, ctx);
-    }
-    // An unknown method name is either unmodeled here or rejected by
-    // production's compiler. Its verdict is unknowable locally, so it is
-    // unabsorbable (fails closed even under a determining &&/|| operand).
-    throw new RuleUnsupportedError(`unsupported method .${expr.method}()`);
-}
-/**
- * Evaluate `firestore.get(path)` / `firestore.exists(path)`.
- *
- * Requires an injected {@link FirestoreLookup} (the enforcement layer
- * supplies one from the sandbox's Firestore data). With NO capability —
- * pure/test usage without a sandbox — this denies with an "unsupported"
- * reason rather than ever a false allow, preserving the pre-lookup posture.
- *
- * Semantics (production-honest, deny-on-error):
- *   - `firestore.get(path)` → a resource `{ data: <fields> }`. Member access
- *     `.data.<field>` then reads the doc's fields. On a NONEXISTENT doc,
- *     production `get()` is itself an error, so this denies with a reason.
- *   - `firestore.exists(path)` → boolean.
- *   - Malformed path (missing `/databases/<db>/documents/` prefix, odd
- *     segment count), a non-string interpolation, wrong arg count, or a
- *     non-path argument → deny with a reason.
- */
-function evalFirestoreBuiltin(expr, ctx) {
-    if (expr.method !== 'get' && expr.method !== 'exists') {
-        // Unknown namespace method, compile-reject class, never absorbed.
-        throw new RuleUnsupportedError(`unsupported method firestore.${expr.method}()`);
-    }
-    if (!ctx.firestoreLookup) {
-        // No sandbox-backed capability injected — keep the deny-with-reason
-        // "unsupported" behavior; never a false allow.
-        throw new RuleEvalError(`firestore.${expr.method}() is unsupported here — no Firestore lookup capability is configured`);
-    }
-    if (expr.args.length !== 1) {
-        // Wrong call shape: production rejects at compile; never absorbed.
-        throw new RuleUnsupportedError(`firestore.${expr.method}() expects a single path argument`);
-    }
-    const arg = expr.args[0];
-    if (arg.kind !== 'path') {
-        throw new RuleUnsupportedError(`firestore.${expr.method}() requires a /databases/.../documents/... path literal`);
-    }
-    const docPath = buildFirestoreDocPath(arg, ctx);
-    if (!ctx.firestoreAccesses.has(docPath)) {
-        if (ctx.firestoreAccesses.size >= 2) {
-            // Resource-limit class, the same posture as the Firestore lookup
-            // budget: production fails the whole evaluation closed, so a
-            // determining &&/|| operand must NOT absorb this into an allow.
-            throw new RuleResourceLimitError('firestore access limit exceeded: at most two distinct documents');
-        }
-        ctx.firestoreAccesses.add(docPath);
-    }
-    if (expr.method === 'exists') {
-        return ctx.firestoreLookup.exists(docPath);
-    }
-    const fields = ctx.firestoreLookup.get(docPath);
-    if (fields === null) {
-        // A missing get is a Rules error VALUE: it denies at the allow boundary,
-        // but participates in COMMUTATIVE CEL error absorption in `&&`/`||`
-        // (`error || true` allows, and `error && false` evaluates to false,
-        // see the tri-state operand handling in rules-evaluator.ts).
-        return new RuleError(`firestore.get() targeted a nonexistent document: ${docPath}`);
-    }
-    return { data: fields };
-}
-/**
- * Assemble a {@link PathArgSegment} list into the document path the
- * {@link FirestoreLookup} expects, then validate + strip the required
- * `/databases/<db>/documents/` prefix. Interpolations must resolve to a
- * string or number; anything else (e.g. `request.auth.uid` when auth is
- * null → undefined) throws → deny.
- */
-function buildFirestoreDocPath(pathExpr, ctx) {
-    const parts = pathExpr.segments.map((seg) => {
-        if (seg.kind === 'literal')
-            return seg.value;
-        const v = evalExpr(seg.expr, ctx);
-        if (typeof v === 'string')
-            return v;
-        if (typeof v === 'number')
-            return String(v);
-        throw new RuleEvalError(`Firestore path interpolation resolved to ${describeType(v)} (expected a string)`);
-    });
-    // Required production shape: databases / <db> / documents / <doc path…>.
-    if (parts.length < 4 || parts[0] !== 'databases' || parts[2] !== 'documents') {
-        throw new RuleEvalError(`malformed Firestore path — expected /databases/<db>/documents/... , got /${parts.join('/')}`);
-    }
-    if (parts[1] !== '(default)') {
-        throw new RuleEvalError(`Storage rules may access only the default Firestore database, got ${parts[1]}`);
-    }
-    const docSegments = parts.slice(3);
-    // A document path is collection/doc pairs — an even, non-zero segment count.
-    if (docSegments.length === 0 || docSegments.length % 2 !== 0) {
-        throw new RuleEvalError(`Firestore path does not point at a document (needs an even segment count): ${docSegments.join('/')}`);
-    }
-    return docSegments.join('/');
+    const namespace = builtinNamespace(expr, ctx);
+    if (namespace !== undefined)
+        return namespace(expr, ctx);
+    const method = RECEIVER_METHODS.get(expr.method);
+    if (method === undefined) {
+        throw new RuleUnsupportedError(`unsupported method .${expr.method}()`);
+    }
+    const receiver = evalExpr(expr.target, ctx);
+    // `resource.name.matches(…)` on an object whose `name` is absent: the
+    // receiver is already production's absent-property error. Propagate it
+    // (→ deny) rather than recasting it as a method-specific failure.
+    if (isErr(receiver))
+        return receiver;
+    return method(receiver, expr, ctx);
 }
-/**
- * Milliseconds in each unit `duration.value(n, unit)` accepts.
- * Production's units, per the rules language: weeks, days, hours, minutes,
- * seconds, milliseconds, nanoseconds.
- */
-const DURATION_UNIT_MILLIS = {
-    w: 7 * 24 * 60 * 60 * 1000,
-    d: 24 * 60 * 60 * 1000,
-    h: 60 * 60 * 1000,
-    m: 60 * 1000,
-    s: 1000,
-    ms: 1,
-    ns: 1e-6,
-};
-/**
- * `duration.value(magnitude, unit)` — a duration, returned as milliseconds so
- * it adds to / subtracts from the millis-modeled timestamps
- * (`request.time`, `resource.timeCreated`). This is what makes the freshness
- * idiom production accepts work here too:
- *
- *   request.time < resource.timeCreated + duration.value(1, 'h')
- */
-function evalDurationBuiltin(expr, ctx) {
-    if (expr.method !== 'value') {
-        throw new RuleEvalError(`unsupported duration.${expr.method}()`);
-    }
-    const args = expr.args.map((a) => evalExpr(a, ctx));
-    if (args.length !== 2 || typeof args[0] !== 'number' || typeof args[1] !== 'string') {
-        throw new RuleEvalError(`duration.value() expects (magnitude: number, unit: string)`);
-    }
-    const [magnitude, unit] = args;
-    const millis = DURATION_UNIT_MILLIS[unit];
-    if (millis === undefined) {
-        throw new RuleEvalError(`duration.value() got unknown unit "${unit}" — expected one of ${Object.keys(DURATION_UNIT_MILLIS).join(', ')}`);
-    }
-    return magnitude * millis;
+/** The namespace a call names, when its target is an unshadowed builtin identifier. */
+function builtinNamespace(expr, ctx) {
+    if (expr.target.kind !== 'ident')
+        return undefined;
+    const name = expr.target.name;
+    if (name in ctx.locals || name in ctx.params)
+        return undefined;
+    return NAMESPACES.get(name);
 }
-/** `timestamp.date(year, month, day)` (UTC midnight) and
- *  `timestamp.value(epochMillis)`, both returning epoch milliseconds. */
-function evalTimestampBuiltin(expr, ctx) {
-    const args = expr.args.map((a) => evalExpr(a, ctx));
-    if (expr.method === 'value') {
-        if (args.length !== 1 || typeof args[0] !== 'number') {
-            throw new RuleEvalError(`timestamp.value() expects (epochMillis: number)`);
+/** One table from the concern records; a name two records claim is a wiring error. */
+function mergeReceiverMethods(records) {
+    const merged = new Map();
+    for (const record of records) {
+        for (const [name, method] of Object.entries(record)) {
+            if (merged.has(name)) {
+                throw new Error(`storage rules method .${name}() has two evaluators`);
+            }
+            merged.set(name, method);
         }
-        return args[0];
-    }
-    if (expr.method === 'date') {
-        if (args.length !== 3 || !args.every((a) => typeof a === 'number')) {
-            throw new RuleEvalError(`timestamp.date() expects (year, month, day) numbers`);
-        }
-        const [y, m, d] = args;
-        // Production `timestamp.date(y, m, d)` is UTC midnight; month is 1-based.
-        return Date.UTC(y, m - 1, d);
-    }
-    throw new RuleEvalError(`unsupported timestamp.${expr.method}()`);
-}
-/**
- * `string.matches(re)` — regex match anchored to the WHOLE string, mirroring
- * production Storage (which anchors implicitly, so `'abc'.matches('a')` is
- * FALSE).
- *
- * RE2-vs-JS divergence (honest note): production runs RE2, we compile the
- * pattern with JavaScript's `RegExp`. JS RegExp is a superset of RE2 —
- * backreferences (`\1`) and lookaround (`(?=`, `(?!`, `(?<=`, `(?<!`) work in
- * JS but are UNSUPPORTED in RE2 and would fail in production. To avoid ever
- * false-allowing on a pattern production would reject, those constructs are
- * detected up front and denied. Invalid patterns (that even JS won't compile)
- * also deny. A non-string target (e.g. a missing metadata key → undefined)
- * denies too — production would error, and an error denies.
- */
-function evalMatches(expr, ctx) {
-    const subject = evalExpr(expr.target, ctx);
-    // `resource.name.matches(…)` on an object whose `name` is absent: the target
-    // is already production's absent-property error. Propagate it (→ deny)
-    // rather than recasting it as a matches()-specific failure.
-    if (isErr(subject))
-        return subject;
-    if (typeof subject !== 'string') {
-        throw new RuleEvalError(`matches() requires a string target, got ${describeType(subject)}`);
-    }
-    if (expr.args.length !== 1) {
-        throw new RuleEvalError(`matches() expects a single pattern argument`);
-    }
-    const pattern = evalExpr(expr.args[0], ctx);
-    if (typeof pattern !== 'string') {
-        throw new RuleEvalError(`matches() pattern must be a string`);
-    }
-    // Detect RE2-unsupported constructs JS would happily (mis)compile.
-    const backref = /\\[1-9]/.test(pattern);
-    const lookaround = /\(\?<?[=!]/.test(pattern);
-    if (backref || lookaround) {
-        throw new RuleEvalError(`matches() pattern uses an RE2-unsupported construct (${backref ? 'backreference' : 'lookaround'}) that production would reject`);
-    }
-    let re;
-    try {
-        // Anchor to the whole string. `(?:...)` keeps the caller's alternations
-        // from binding past the anchors.
-        re = new RegExp(`^(?:${pattern})$`);
-    }
-    catch (err) {
-        throw new RuleEvalError(`matches() invalid regex pattern: ${err.message}`);
-    }
-    return re.test(subject);
-}
-/**
- * Evaluate `string.split(re)` — RE2 regex split, the storage-rules idiom for
- * segmenting object names (`fileId.split('-')[0:2]`). Shares matches()'s
- * RE2-vs-JS guard: constructs RE2 rejects (backreferences, lookaround) deny
- * with a reason rather than silently (mis)compiling under JS semantics.
- */
-function evalSplit(expr, ctx) {
-    const subject = evalExpr(expr.target, ctx);
-    if (isErr(subject))
-        return subject;
-    if (typeof subject !== 'string') {
-        throw new RuleEvalError(`split() requires a string target, got ${describeType(subject)}`);
-    }
-    if (expr.args.length !== 1) {
-        throw new RuleEvalError(`split() expects a single pattern argument`);
-    }
-    const pattern = evalExpr(expr.args[0], ctx);
-    if (typeof pattern !== 'string') {
-        throw new RuleEvalError(`split() pattern must be a string`);
-    }
-    const backref = /\\[1-9]/.test(pattern);
-    const lookaround = /\(\?<?[=!]/.test(pattern);
-    if (backref || lookaround) {
-        throw new RuleEvalError(`split() pattern uses an RE2-unsupported construct (${backref ? 'backreference' : 'lookaround'}) that production would reject`);
-    }
-    let re;
-    try {
-        re = new RegExp(pattern);
-    }
-    catch (err) {
-        throw new RuleEvalError(`split() invalid regex pattern: ${err.message}`);
-    }
-    return subject.split(re);
-}
-/**
- * Evaluate `.size()` on the three sized types (string → length, list →
- * element count, map → own-key count). Anything else denies with a reason.
- */
-function evalSize(expr, ctx) {
-    const subject = evalExpr(expr.target, ctx);
-    if (isErr(subject))
-        return subject;
-    if (expr.args.length !== 0) {
-        throw new RuleEvalError(`size() expects no arguments`);
-    }
-    if (typeof subject === 'string' || Array.isArray(subject))
-        return subject.length;
-    if (isRulesMap(subject))
-        return Object.keys(subject).length;
-    throw new RuleEvalError(`size() requires a string, list, or map target, got ${describeType(subject)}`);
-}
-/** `Map.keys()` returns the map's own keys and never exposes JS prototypes. */
-function evalMapKeys(expr, ctx) {
-    const subject = evalExpr(expr.target, ctx);
-    if (isErr(subject))
-        return subject;
-    if (expr.args.length !== 0) {
-        throw new RuleEvalError(`keys() expects no arguments`);
-    }
-    if (!isRulesMap(subject)) {
-        throw new RuleEvalError(`keys() requires a map target, got ${describeType(subject)}`);
-    }
-    return Object.keys(subject);
-}
-/** `List/Set.hasAll(other)` with Rules structural value equality. */
-function evalHasAll(expr, ctx) {
-    const subject = evalExpr(expr.target, ctx);
-    if (isErr(subject))
-        return subject;
-    if (!Array.isArray(subject)) {
-        throw new RuleEvalError(`hasAll() requires a list or set target, got ${describeType(subject)}`);
-    }
-    if (expr.args.length !== 1) {
-        throw new RuleEvalError(`hasAll() expects one list or set argument`);
-    }
-    const required = evalExpr(expr.args[0], ctx);
-    if (isErr(required))
-        return required;
-    if (!Array.isArray(required)) {
-        throw new RuleEvalError(`hasAll() argument must be a list or set`);
-    }
-    return required.every((candidate) => subject.some((value) => rulesEquals(value, candidate)));
-}
-/** `Map.get(key, default)` for the production-probed string-key form. */
-function evalMapGet(expr, ctx) {
-    const subject = evalExpr(expr.target, ctx);
-    if (isErr(subject))
-        return subject;
-    if (!isRulesMap(subject)) {
-        throw new RuleEvalError(`get() requires a map target, got ${describeType(subject)}`);
-    }
-    if (expr.args.length !== 2) {
-        throw new RuleEvalError(`get() expects a key and default value`);
-    }
-    const key = evalExpr(expr.args[0], ctx);
-    if (isErr(key))
-        return key;
-    if (typeof key !== 'string') {
-        throw new RuleEvalError(`get() key must be a string`);
     }
-    const fallback = evalExpr(expr.args[1], ctx);
-    if (isErr(fallback))
-        return fallback;
-    return Object.prototype.hasOwnProperty.call(subject, key)
-        ? subject[key]
-        : fallback;
+    return merged;
 }
 //# sourceMappingURL=rules-methods.js.map