pyric 0.1.0-alpha.21 → 0.1.0-alpha.24

package/src/rules/grammar/parse-error-wording.ts

@@ -0,0 +1,98 @@
+/**
+ * What a parse failure says it wanted.
+ *
+ * The parser reports its rightmost failure as the set of terminals that could
+ * have continued the match, which for a missing semicolon is nineteen of them:
+ * `";", "[", ".", "%", "/", "*", "<", ">", "<=", ">=", "-", "+", "is", "in",
+ * "!=", "==", "&&", "?", or "||"`. That set is the parser's own state, not the
+ * edit the source needs, and a reader who is handed it reads the whole list
+ * before working out that a semicolon is missing.
+ *
+ * So the set is read for the one terminal that decides the edit, and the line
+ * it failed on says which construct the edit belongs to. Where neither is
+ * decidable the wording says `syntax error` and lets the line and column carry
+ * the whole message, which is still more than a list of nineteen alternatives.
+ */
+
+/** One parse failure, as the grammar reports it. */
+export interface ParseFailurePosition {
+  line: number;
+  column: number;
+  expected: string;
+}
+
+/** The keywords a rules source opens a statement with, and what each one is. */
+const CONSTRUCTS: Readonly<Record<string, string>> = {
+  allow: 'after the allow statement',
+  let: 'after the let binding',
+  return: 'after the return expression',
+  rules_version: 'after the version line',
+};
+
+/** How a missing terminator is worded when the line names no construct. */
+const UNNAMED_CONSTRUCT = 'at the end of the statement';
+
+/** How far back an unterminated statement is looked for from the failure point. */
+const STATEMENT_LOOKBACK = 4;
+
+/** What one source line opens with, lower-cased, or the empty string. */
+function openingWord(line: string | undefined): string {
+  if (line === undefined) return '';
+  const word = line.trim().split(/[^A-Za-z_]+/)[0];
+  return (word ?? '').toLowerCase();
+}
+
+/**
+ * Which construct an unterminated statement belongs to.
+ *
+ * A missing terminator is reported at the token that followed it, which is
+ * usually the closing brace on the next line, so the failing line is read
+ * first and then the few lines above it, and the nearest one that opens a
+ * statement is the one that was never terminated.
+ */
+function unterminatedConstruct(source: string, line: number): string {
+  const lines = source.split('\n');
+  const earliest = Math.max(1, line - STATEMENT_LOOKBACK);
+  for (let at = line; at >= earliest; at--) {
+    const named = CONSTRUCTS[openingWord(lines[at - 1])];
+    if (named !== undefined) return named;
+  }
+  return UNNAMED_CONSTRUCT;
+}
+
+/** Whether the parser named one terminal among the alternatives it expected. */
+function expects(expected: string, terminal: string): boolean {
+  return expected.includes(`"${terminal}"`);
+}
+
+/**
+ * How many alternatives a reader can still act on. A set this size is a
+ * vocabulary, such as the allow verbs a match block takes, and reading it is
+ * the fastest way to the edit. Past it the set is the parser's state.
+ */
+const READABLE_ALTERNATIVES = 8;
+
+/** How many alternatives one expectation set names. */
+function alternativeCount(expected: string): number {
+  const quoted = expected.match(/"[^"]*"/g);
+  if (quoted === null) return 0;
+  return quoted.length;
+}
+
+/**
+ * What the source needs, in the reader's terms rather than the parser's.
+ *
+ * A missing terminator is decided from the failing line, so the wording says
+ * which statement is unterminated rather than only which character is absent.
+ * A short set of alternatives is a vocabulary and is kept as it is. A long one
+ * is the parser's state and is dropped for the line and column.
+ */
+export function parseErrorWording(failure: ParseFailurePosition, source: string): string {
+  if (expects(failure.expected, ';')) {
+    return `expected ';' ${unterminatedConstruct(source, failure.line)}`;
+  }
+  if (alternativeCount(failure.expected) <= READABLE_ALTERNATIVES) {
+    return `expected ${failure.expected}`;
+  }
+  return 'syntax error';
+}

package/src/rules/indexes/query-analysis.ts

@@ -0,0 +1,136 @@
+import type { IndexesConfig, IndexesConfigEntry, IndexField } from './types.js';
+
+/** Index diagnostics contain field names and operators, never query operands. */
+export interface IndexQuery {
+  collectionGroup: string;
+  queryScope: 'COLLECTION' | 'COLLECTION_GROUP';
+  filters: Array<{ field: string; op: string }>;
+  orders: Array<{ field: string; direction: 'asc' | 'desc' }>;
+  unsupported?: string;
+}
+export type IndexFinding =
+  | { status: 'covered'; basis: 'automatic' | 'configured' }
+  | { status: 'missing'; index: IndexesConfigEntry }
+  | { status: 'unavailable'; reason: string; index?: IndexesConfigEntry };
+
+function object(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+}
+
+/** Adapters supply captured descriptors; values/cursors are deliberately never read. */
+export function captureIndexQuery(path: string, group: boolean, filters: readonly unknown[], orders: readonly unknown[]): IndexQuery {
+  const query: IndexQuery = { collectionGroup: path.split('/').filter(Boolean).at(-1) ?? '', queryScope: group ? 'COLLECTION_GROUP' : 'COLLECTION', filters: [], orders: [] };
+  const visit = (input: unknown, depth: number): void => {
+    const entry = object(input);
+    if (!entry || depth > 12 || query.filters.length >= 64) { query.unsupported = 'This query exceeds the index checker’s supported limits.'; return; }
+    if (entry.kind === 'and' && Array.isArray(entry.filters)) { entry.filters.forEach(child => visit(child, depth + 1)); return; }
+    if (entry.kind !== 'where' || typeof entry.field !== 'string' || typeof entry.op !== 'string') { query.unsupported = 'This query uses a filter the index checker does not support yet.'; return; }
+    query.filters.push({ field: entry.field, op: entry.op });
+  };
+  filters.forEach(entry => visit(entry, 0));
+  for (const input of orders.slice(0, 64)) {
+    const entry = object(input);
+    if (!entry || typeof entry.field !== 'string' || (entry.direction !== 'asc' && entry.direction !== 'desc')) { query.unsupported = 'This sort order cannot be checked yet.'; continue; }
+    query.orders.push({ field: entry.field, direction: entry.direction });
+  }
+  if (orders.length > 64) query.unsupported = 'This query exceeds the index checker’s supported limits.';
+  return query;
+}
+
+function hasOneIndexMode(field: Record<string, unknown>): boolean {
+  const modes = [field.order, field.arrayConfig, field.vectorConfig].filter(value => value !== undefined);
+  if (modes.length !== 1) return false;
+  return field.order === 'ASCENDING' || field.order === 'DESCENDING' || field.arrayConfig === 'CONTAINS' || object(field.vectorConfig) !== undefined;
+}
+
+function hasUnsupportedFilterCombination(ranges: string[], arrays: IndexQuery['filters']): boolean {
+  if (ranges.length > 1 || arrays.length > 1) return true;
+  return ranges.length > 0 && arrays.length > 0;
+}
+
+/** Validate before claiming coverage or allowing a file edit. Preserve unrelated metadata. */
+export function readIndexConfig(value: unknown): IndexesConfig {
+  const config = object(value);
+  if (!config || !Array.isArray(config.indexes) || (config.fieldOverrides !== undefined && !Array.isArray(config.fieldOverrides))) throw new Error('The index configuration is invalid. Fix the file before adding an index.');
+  for (const item of config.indexes) {
+    const index = object(item);
+    if (!index || typeof index.collectionGroup !== 'string' || !['COLLECTION', 'COLLECTION_GROUP'].includes(String(index.queryScope)) || !Array.isArray(index.fields)) throw new Error('The index configuration contains an invalid index.');
+    for (const value of index.fields) {
+      const field = object(value);
+      if (!field || typeof field.fieldPath !== 'string' || !hasOneIndexMode(field)) throw new Error('The index configuration contains an invalid field.');
+    }
+  }
+  for (const value of config.fieldOverrides ?? []) {
+    const field = object(value);
+    if (!field || typeof field.collectionGroup !== 'string' || typeof field.fieldPath !== 'string' || (field.indexes !== undefined && !Array.isArray(field.indexes))) throw new Error('The index configuration contains an invalid field override.');
+  }
+  return config as unknown as IndexesConfig;
+}
+
+function automaticField(config: IndexesConfig, query: IndexQuery, field: IndexField): boolean {
+  const overrides = (config.fieldOverrides ?? []).map(object).filter(item => item?.collectionGroup === query.collectionGroup && typeof item.fieldPath === 'string');
+  const candidates = overrides.filter(item => item && (item.fieldPath === '*' || item.fieldPath === field.fieldPath || field.fieldPath.startsWith(`${item.fieldPath}.`)))
+    .sort((a, b) => (b?.fieldPath === '*' ? 0 : String(b?.fieldPath).length) - (a?.fieldPath === '*' ? 0 : String(a?.fieldPath).length));
+  const override = candidates.find(item => item?.indexes !== undefined);
+  if (!override) return query.queryScope === 'COLLECTION';
+  return (override.indexes as unknown[]).some(value => {
+    const index = object(value);
+    return index?.queryScope === query.queryScope && (field.arrayConfig ? index.arrayConfig === field.arrayConfig : index?.order === field.order);
+  });
+}
+
+function matches(index: IndexesConfigEntry, query: IndexQuery, equality: string[], ordered: IndexField[]): boolean {
+  if (index.collectionGroup !== query.collectionGroup || index.queryScope !== query.queryScope || index.fields.some(field => field.vectorConfig)) return false;
+  // Firestore appends __name__ automatically. Explicit document-ID queries are not inferred here.
+  const fields = index.fields.filter(field => field.fieldPath !== '__name__');
+  if (fields.length !== equality.length + ordered.length) return false;
+  const prefix = fields.slice(0, equality.length);
+  if (!equality.every(field => prefix.some(item => item.fieldPath === field && !!item.order))) return false;
+  return ordered.every((field, offset) => {
+    const actual = fields[equality.length + offset];
+    return actual.fieldPath === field.fieldPath && actual.order === field.order && actual.arrayConfig === field.arrayConfig;
+  });
+}
+
+/** A bounded, conservative subset. Unsupported shapes never produce a guessed requirement. */
+export function analyzeIndexQuery(query: IndexQuery, config: IndexesConfig | null): IndexFinding {
+  const unavailable = (reason: string): IndexFinding => ({ status: 'unavailable', reason });
+  if (query.unsupported) return unavailable(query.unsupported);
+  if (!query.collectionGroup || [...query.filters, ...query.orders].some(field => field.field === '__name__' || field.field.includes('`'))) return unavailable('Document ID and escaped field-path queries cannot be checked yet.');
+  if (query.filters.some(filter => !['==', '<', '<=', '>', '>=', 'array-contains'].includes(filter.op))) return unavailable('This filter combination cannot be checked yet.');
+  const ranges = [...new Set(query.filters.filter(filter => ['<', '<=', '>', '>='].includes(filter.op)).map(filter => filter.field))];
+  const arrays = query.filters.filter(filter => filter.op === 'array-contains');
+  if (hasUnsupportedFilterCombination(ranges, arrays)) return unavailable('Queries combining these range or array filters cannot be checked yet.');
+  const equality = [...new Set(query.filters.filter(filter => filter.op === '==').map(filter => filter.field))].sort();
+  if (equality.some(field => ranges.includes(field) || arrays.some(array => array.field === field))) return unavailable('Multiple filter types on the same field cannot be checked yet.');
+  const orders = query.orders.filter(order => !equality.includes(order.field));
+  if (ranges.length && orders.length && orders[0].field !== ranges[0]) return unavailable('The first sort field must match the range filter before indexing can be checked.');
+  const ordered: IndexField[] = arrays.map(array => ({ fieldPath: array.field, arrayConfig: 'CONTAINS' }));
+  ordered.push(...orders.map(order => ({ fieldPath: order.field, order: order.direction === 'asc' ? 'ASCENDING' as const : 'DESCENDING' as const })));
+  if (ranges.length && !orders.some(order => order.field === ranges[0])) ordered.push({ fieldPath: ranges[0], order: 'ASCENDING' });
+  const fields: IndexField[] = [...equality.map(fieldPath => ({ fieldPath, order: 'ASCENDING' as const })), ...ordered];
+  if (new Set(fields.map(field => field.fieldPath)).size !== fields.length) return unavailable('Repeated index fields cannot be checked yet.');
+  const index: IndexesConfigEntry = { collectionGroup: query.collectionGroup, queryScope: query.queryScope, fields };
+  if (!config) return { status: 'unavailable', reason: 'No local index configuration is connected.', ...(fields.length > 1 ? { index } : {}) };
+  if (config.indexes.some(entry => matches(entry, query, equality, ordered))) return { status: 'covered', basis: 'configured' };
+  // Equality-only queries can merge single-field indexes. Do not invent a composite requirement.
+  if (ordered.length === 0) {
+    if (fields.every(field => automaticField(config, query, field) || automaticField(config, query, { ...field, order: 'DESCENDING' }))) return { status: 'covered', basis: 'automatic' };
+    return unavailable('A field used by this query has no matching single-field index. Review its field override.');
+  }
+  if (fields.length === 1) {
+    if (automaticField(config, query, fields[0])) return { status: 'covered', basis: 'automatic' };
+    return unavailable('This query needs a single-field index. Review its field override.');
+  }
+  // Array membership plus equality can merge automatic indexes; a composite is an optimization.
+  // https://firebase.google.com/docs/firestore/query-data/index-overview#index_merging
+  if (arrays.length === 1 && orders.length === 0) {
+    if (fields.every(field => automaticField(config, query, field))) return { status: 'covered', basis: 'automatic' };
+    return unavailable('Array index merging with these field overrides cannot be checked yet.');
+  }
+  // Equality + sorting can also be served by merged compound indexes. Be conservative when present.
+  if (equality.length > 1 && ordered.length === 1 && !arrays.length && !ranges.length && equality.every(field => config.indexes.some(entry => matches(entry, query, [field], ordered)))) return { status: 'covered', basis: 'configured' };
+  const hasBroaderIndex = config.indexes.some(entry => entry.collectionGroup === query.collectionGroup && entry.queryScope === query.queryScope && entry.fields.length > fields.length && fields.every(field => entry.fields.some(candidate => candidate.fieldPath === field.fieldPath)));
+  if (hasBroaderIndex) return unavailable('A broader index is configured. Its coverage cannot be checked yet.');
+  return { status: 'missing', index };
+}

package/src/rules/indexes/service-query.ts

@@ -0,0 +1,69 @@
+import { analyzeIndexQuery, type IndexQuery } from './query-analysis.js';
+import type { IndexesConfig, IndexesConfigEntry } from './types.js';
+
+/** RTDB index evidence includes ordering only, never bounds or their values. */
+export interface DatabaseIndexQuery {
+  service: 'rtdb';
+  path: string;
+  orderBy: { kind: 'child'; path: string } | { kind: 'key' | 'value' | 'priority' } | null;
+}
+export interface DatabaseIndexDefinition { path: string; indexOn: string[] }
+export interface DatabaseIndexConfig { rules: Record<string, unknown> }
+export type ServiceIndexQuery = IndexQuery | DatabaseIndexQuery;
+export type ServiceIndexConfig = IndexesConfig | DatabaseIndexConfig;
+export type ServiceIndexDefinition = IndexesConfigEntry | DatabaseIndexDefinition;
+export type ServiceIndexFinding =
+  | { status: 'covered'; basis: 'automatic' | 'configured' }
+  | { status: 'missing'; index: ServiceIndexDefinition; editBlocked?: string }
+  | { status: 'unavailable'; reason: string; index?: ServiceIndexDefinition };
+
+export function isDatabaseIndexQuery(query: ServiceIndexQuery): query is DatabaseIndexQuery {
+  return 'service' in query && query.service === 'rtdb';
+}
+export function indexService(query: ServiceIndexQuery): 'firestore' | 'rtdb' {
+  return isDatabaseIndexQuery(query) ? 'rtdb' : 'firestore';
+}
+export function captureDatabaseIndexQuery(path: string, spec: { orderBy: DatabaseIndexQuery['orderBy'] }): DatabaseIndexQuery {
+  return { service: 'rtdb', path: '/' + path.split('/').filter(Boolean).join('/'), orderBy: spec.orderBy ? { ...spec.orderBy } : null };
+}
+function object(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+/** Find the existing rule locations at the query path. Multiple wildcard/literal
+ * matches are kept: diagnostics can prove coverage without guessing where to edit. */
+export function databaseIndexLocations(config: DatabaseIndexConfig, path: string) {
+  let matches = [{ path: [] as string[], node: config.rules }];
+  for (const segment of path.split('/').filter(Boolean)) {
+    matches = matches.flatMap(match => Object.entries(match.node)
+      .filter(([key, value]) => (key === segment || key.startsWith('$')) && object(value))
+      .map(([key, value]) => ({ path: [...match.path, key], node: value as Record<string, unknown> })));
+  }
+  return matches;
+}
+export function analyzeServiceIndex(query: ServiceIndexQuery, config: ServiceIndexConfig | null): ServiceIndexFinding {
+  if (!isDatabaseIndexQuery(query)) return analyzeIndexQuery(query, config && 'indexes' in config ? config : null);
+  const ordering = query.orderBy;
+  if (!ordering || ordering.kind === 'key' || ordering.kind === 'priority') return { status: 'covered', basis: 'automatic' };
+  const key = ordering.kind === 'child' ? ordering.path.split('/').filter(Boolean).join('/') : '.value';
+  if (!config || !('rules' in config)) return { status: 'unavailable', reason: 'No local database rules are connected.' };
+  const locations = databaseIndexLocations(config, query.path);
+  for (const { node } of locations) {
+    const indexes = node['.indexOn'];
+    let keys: unknown[] = [];
+    if (typeof indexes === 'string') keys = [indexes];
+    else if (Array.isArray(indexes)) keys = indexes;
+    if (keys.some(value => typeof value === 'string' && value.split('/').filter(Boolean).join('/') === key)) return { status: 'covered', basis: 'configured' };
+  }
+  if (locations.length !== 1) {
+    const editBlocked = locations.length ? 'Several rule paths match. Choose where to add .indexOn in your rules file.' : 'No rule exists at this query path. Choose where to add .indexOn in your rules file.';
+    return { status: 'missing', index: { path: query.path, indexOn: [key] }, editBlocked };
+  }
+  const location = locations[0]!;
+  const existing = location.node['.indexOn'];
+  if (existing !== undefined && typeof existing !== 'string' && (!Array.isArray(existing) || !existing.every(value => typeof value === 'string'))) return { status: 'unavailable', reason: 'The existing .indexOn value must be a field name or a list of field names.' };
+  let indexOn: string[] = [];
+  if (typeof existing === 'string') indexOn = [existing];
+  else if (Array.isArray(existing)) indexOn = existing;
+  return { status: 'missing', index: { path: '/' + location.path.join('/'), indexOn: [...indexOn, key] } };
+}

package/src/rules/internal/index.ts

@@ -67,6 +67,9 @@ export type { ResolveResult, ResolveOptions } from '../modules/resolver.js';
 
 // ─── Rules simulator ─────────────────────────────────────────────────
 export { SimulateFirestoreRulesHandler, SERVER_TIMESTAMP } from '../simulator/handler.js';
+export { DOCUMENT_PATH_FORM, documentRelativePath } from '../simulator/request-path.js';
+export { parseErrorWording } from '../grammar/parse-error-wording.js';
+export type { ParseFailurePosition } from '../grammar/parse-error-wording.js';
 export {
   collectMatches,
   renderMatchBlockPath,
@@ -180,6 +183,19 @@ export { resolveModulesBrowser, STDLIB_INLINE, resolveAuthoredSourceLoc, type Au
 // so neither tree-shaking nor lazy-loading keeps it out). See `./extract.ts`.
 // The erasable TYPES stay here (type-only exports compile away, never bundled).
 export type { ExtractIndexesOptions } from '../indexes/extractHandler.js';
+
+// Composite-index detection over a structured query shape, not source text.
+// `needsCompositeIndex` and `shapeToIndexEntry` have no TypeScript-compiler
+// dependency (pure data functions over `QueryShape`), unlike the source-text
+// extractor above, so they stay on this browser-safe entry rather than the
+// compiler-heavy `pyric/rules/extract` subpath. A caller that already has a
+// query's collection path, filters, and orderings (a recorded sandbox query,
+// or one an agent names directly) reaches these without paying for the parser.
+export {
+  needsCompositeIndex,
+  shapeToIndexEntry,
+  indexEntryKey,
+} from '../indexes/extract/composite.js';
 export type {
   ExtractResult,
   ExtractionWarning,

package/src/rules/modules/rules-capabilities.generated.ts

@@ -70,7 +70,7 @@ export const STORAGE_METHOD_RECEIVER_TYPES = {
   "split": ["string"] as const,
 } as const;
 export const STORAGE_NAMESPACE_METHODS = {
-  duration: ["value"] as const,
+  duration: ["abs", "time", "value"] as const,
   firestore: ["exists", "get"] as const,
   timestamp: ["date", "value"] as const,
 } as const;

package/src/rules/rtdb/constraints/atoms.spec.ts

@@ -7,11 +7,11 @@
 
 export const ATOM_SPECS = {
   // --- Authentication ---
-  authenticated: { args: [], output: 'auth !== null' },
+  authenticated: { args: [], output: 'auth != null' },
 
   // --- Ownership ---
-  ownPath: { args: ['$uid'], output: 'auth.uid === $uid' },
-  ownField: { args: ['author'], output: 'auth.uid === data.child("author").val()' },
+  ownPath: { args: ['$uid'], output: 'auth.uid == $uid' },
+  ownField: { args: ['author'], output: 'auth.uid == data.child("author").val()' },
 
   // --- Existence ---
   isNew: { args: [], output: '!data.exists()' },
@@ -24,12 +24,12 @@ export const ATOM_SPECS = {
   fieldIsBoolean: { args: ['active'], output: 'newData.child("active").isBoolean()' },
   fieldEnum: {
     args: ['role', ['user', 'admin']],
-    output: 'newData.child("role").val() === "user" || newData.child("role").val() === "admin"',
+    output: 'newData.child("role").val() == "user" || newData.child("role").val() == "admin"',
   },
 
   // --- Immutability ---
-  immutable: { args: ['createdAt'], output: '!data.exists() || newData.child("createdAt").val() === data.child("createdAt").val()' },
-  immutableSelf: { args: [], output: '!data.exists() || newData.val() === data.val()' },
+  immutable: { args: ['createdAt'], output: '!data.exists() || newData.child("createdAt").val() == data.child("createdAt").val()' },
+  immutableSelf: { args: [], output: '!data.exists() || newData.val() == data.val()' },
 
   // --- Cross-path ---
   rootExistsPathVar: {
@@ -42,6 +42,6 @@ export const ATOM_SPECS = {
   },
   rootEquals: {
     args: [['users', { $: 'auth.uid' }, 'role'], 'admin'],
-    output: 'root.child("users").child(auth.uid).child("role").val() === "admin"',
+    output: 'root.child("users").child(auth.uid).child("role").val() == "admin"',
   },
 } as const;

package/src/rules/rtdb/constraints/atoms.ts

@@ -12,15 +12,15 @@ function buildPath(segments: Segment[]): string {
 
 // --- Authentication ---
 
-export const authenticated = (): Expr => e('auth !== null');
+export const authenticated = (): Expr => e('auth != null');
 
 // --- Ownership ---
 
 /** Path-based ownership: auth.uid matches a URL path variable */
-export const ownPath = (pathVar: string): Expr => e(`auth.uid === ${pathVar}`);
+export const ownPath = (pathVar: string): Expr => e(`auth.uid == ${pathVar}`);
 
 /** Field-based ownership: auth.uid matches a value stored in a data field */
-export const ownField = (field: string): Expr => e(`auth.uid === data.child("${field}").val()`);
+export const ownField = (field: string): Expr => e(`auth.uid == data.child("${field}").val()`);
 
 // --- Existence ---
 
@@ -46,17 +46,17 @@ export const fieldIsBoolean = (field: string): Expr => e(`newData.child("${field
 
 /** Field must be one of the allowed string values */
 export const fieldEnum = (field: string, values: string[]): Expr =>
-  e(values.map(v => `newData.child("${field}").val() === "${v}"`).join(' || '));
+  e(values.map(v => `newData.child("${field}").val() == "${v}"`).join(' || '));
 
 // --- Immutability ---
 
 /** Field can be set on creation but never changed after */
 export const immutable = (field: string): Expr =>
-  e(`!data.exists() || newData.child("${field}").val() === data.child("${field}").val()`);
+  e(`!data.exists() || newData.child("${field}").val() == data.child("${field}").val()`);
 
 /** This node's own value can be set on creation but never changed */
 export const immutableSelf = (): Expr =>
-  e('!data.exists() || newData.val() === data.val()');
+  e('!data.exists() || newData.val() == data.val()');
 
 // --- Cross-path lookups ---
 
@@ -66,4 +66,4 @@ export const rootExists = (segments: Segment[]): Expr =>
 
 /** Check if a path's value equals a specific string (via root) */
 export const rootEquals = (segments: Segment[], value: string): Expr =>
-  e(`root.${buildPath(segments)}.val() === "${value}"`);
+  e(`root.${buildPath(segments)}.val() == "${value}"`);

package/src/rules/rtdb/constraints/data.ts

@@ -57,13 +57,13 @@ export const newDataParentExists = (depth: number, field: string): Expr =>
 
 // ---- Comparisons ----
 
-/** Strict equality: left === right (right is a literal value or runtime ref) */
+/** Equality: left == right (right is a literal value or runtime ref) */
 export const eq = (left: Expr, right: CompareValue): Expr =>
-  e(`${left} === ${formatRight(right)}`);
+  e(`${left} == ${formatRight(right)}`);
 
-/** Strict inequality: left !== right */
+/** Inequality: left != right */
 export const neq = (left: Expr, right: CompareValue): Expr =>
-  e(`${left} !== ${formatRight(right)}`);
+  e(`${left} != ${formatRight(right)}`);
 
 /** Greater than: left > right */
 export const gt = (left: Expr, right: number): Expr =>

package/src/rules/rtdb/constraints/document.ts

@@ -75,13 +75,15 @@ function normalizeAuth(auth: RtdbRulesSimulationAuth | undefined): SimulationInp
 }
 
 function normalizeSimulationInput(input: RtdbRulesSimulationInput): SimulationInput {
-  return {
+  const simulation: SimulationInput = {
     operation: input.operation,
     path: input.path,
     auth: normalizeAuth(input.auth),
     mockData: input.mockData ?? input.data ?? {},
-    ...(input.newData !== undefined ? { newData: input.newData } : {}),
   };
+  if (input.newData !== undefined) simulation.newData = input.newData;
+  if (input.now !== undefined) simulation.now = input.now;
+  return simulation;
 }
 
 function collectExpressionFindings(

package/src/rules/rtdb/constraints/game.spec.ts

@@ -8,19 +8,19 @@
 export const GAME_SPECS = {
   turnGuardWithStatus: {
     args: { turnField: 'currentTurn', players: { X: 'playerX', O: 'playerO' }, statusField: 'status', playingValue: 'playing' },
-    output: '(data.child("status").val() === "playing") && (data.child("currentTurn").val() === "X" && data.child("playerX").val() === auth.uid || data.child("currentTurn").val() === "O" && data.child("playerO").val() === auth.uid)',
+    output: '(data.child("status").val() == "playing") && (data.child("currentTurn").val() == "X" && data.child("playerX").val() == auth.uid || data.child("currentTurn").val() == "O" && data.child("playerO").val() == auth.uid)',
   },
   turnGuardNoStatus: {
     args: { turnField: 'currentTurn', players: { X: 'playerX', O: 'playerO' } },
-    output: 'data.child("currentTurn").val() === "X" && data.child("playerX").val() === auth.uid || data.child("currentTurn").val() === "O" && data.child("playerO").val() === auth.uid',
+    output: 'data.child("currentTurn").val() == "X" && data.child("playerX").val() == auth.uid || data.child("currentTurn").val() == "O" && data.child("playerO").val() == auth.uid',
   },
   flipTwoMarks: {
     args: { marks: ['X', 'O'] },
-    output: '((!(data.exists())) && (newData.val() === "X")) || ((data.val() === "X") && (newData.val() === "O")) || ((data.val() === "O") && (newData.val() === "X"))',
+    output: '((!(data.exists())) && (newData.val() == "X")) || ((data.val() == "X") && (newData.val() == "O")) || ((data.val() == "O") && (newData.val() == "X"))',
   },
   flipThreeMarks: {
     args: { marks: ['A', 'B', 'C'] },
-    output: '((!(data.exists())) && (newData.val() === "A")) || ((data.val() === "A") && (newData.val() === "B")) || ((data.val() === "B") && (newData.val() === "C")) || ((data.val() === "C") && (newData.val() === "A"))',
+    output: '((!(data.exists())) && (newData.val() == "A")) || ((data.val() == "A") && (newData.val() == "B")) || ((data.val() == "B") && (newData.val() == "C")) || ((data.val() == "C") && (newData.val() == "A"))',
   },
   winCheckHelper: {
     args: { mark: 'X', lines: [[0,1,2],[3,4,5]], boardPath: 'board' },

package/src/rules/rtdb/constraints/policies.spec.ts

@@ -5,19 +5,19 @@
 export const POLICY_SPECS = {
   pathOwnerOnly: {
     args: ['$uid'],
-    output: '(auth !== null) && (auth.uid === $uid)',
+    output: '(auth != null) && (auth.uid == $uid)',
   },
   fieldOwnerOnly: {
     args: ['author'],
-    output: '(auth !== null) && (auth.uid === data.child("author").val())',
+    output: '(auth != null) && (auth.uid == data.child("author").val())',
   },
   ownerOrNew: {
     args: ['author'],
-    output: '(auth !== null) && ((!data.exists()) || (auth.uid === data.child("author").val()))',
+    output: '(auth != null) && ((!data.exists()) || (auth.uid == data.child("author").val()))',
   },
   hasRole: {
     args: [['users', { $: 'auth.uid' }, 'role'], 'admin'],
-    output: 'root.child("users").child(auth.uid).child("role").val() === "admin"',
+    output: 'root.child("users").child(auth.uid).child("role").val() == "admin"',
   },
   isMember: {
     args: ['team-members', 'teamId'],
@@ -29,6 +29,6 @@ export const POLICY_SPECS = {
   },
   transition: {
     args: ['status', [['open', 'playing'], ['open', 'cancelled']]],
-    output: '((data.child("status").val() === "open") && (newData.child("status").val() === "playing")) || ((data.child("status").val() === "open") && (newData.child("status").val() === "cancelled"))',
+    output: '((data.child("status").val() == "open") && (newData.child("status").val() == "playing")) || ((data.child("status").val() == "open") && (newData.child("status").val() == "cancelled"))',
   },
 } as const;

package/src/rules/rtdb/constraints/policies.ts

@@ -2,11 +2,11 @@ import type { Expr, Segment } from './types.js';
 import { all, any, expr } from './compose.js';
 import { authenticated, ownPath, ownField, isNew, hasChild, rootExists, rootEquals } from './atoms.js';
 
-/** Only the path owner (auth.uid === $pathVar) can access */
+/** Only the path owner (auth.uid == $pathVar) can access */
 export const pathOwnerOnly = (pathVar: string): Expr =>
   all(authenticated(), ownPath(pathVar));
 
-/** Only the field owner (auth.uid === data.child(field).val()) can access */
+/** Only the field owner (auth.uid == data.child(field).val()) can access */
 export const fieldOwnerOnly = (field: string): Expr =>
   all(authenticated(), ownField(field));
 
@@ -30,7 +30,7 @@ export const required = (...fields: string[]): Expr =>
 export const transition = (field: string, allowed: Array<[string, string]>): Expr =>
   any(...allowed.map(([from, to]) =>
     all(
-      expr(`data.child("${field}").val() === "${from}"`),
-      expr(`newData.child("${field}").val() === "${to}"`),
+      expr(`data.child("${field}").val() == "${from}"`),
+      expr(`newData.child("${field}").val() == "${to}"`),
     )
   ));

package/src/rules/rtdb/constraints/schema.ts

@@ -69,12 +69,12 @@ function zodTypeToExpr(zodType: z.ZodTypeAny, fieldName: string): Expr {
   }
   if (zodType instanceof z.ZodEnum) {
     const values = (zodType as z.ZodEnum<any>).options as string[];
-    return expr(values.map(v => `newData.val() === "${v}"`).join(' || '));
+    return expr(values.map(v => `newData.val() == "${v}"`).join(' || '));
   }
   if (zodType instanceof z.ZodLiteral) {
     const v = (zodType as z.ZodLiteral<any>).value;
-    if (typeof v === 'string') return expr(`newData.val() === "${v}"`);
-    return expr(`newData.val() === ${v}`);
+    if (typeof v === 'string') return expr(`newData.val() == "${v}"`);
+    return expr(`newData.val() == ${v}`);
   }
   if (zodType instanceof z.ZodUnion) {
     const options = (zodType as z.ZodUnion<any>)._def.options as z.ZodTypeAny[];

package/src/rules/rtdb/grammar/RtdbExpr.ohm

@@ -11,9 +11,7 @@ RtdbExpr {
     | Comparison
 
   Comparison
-    = Comparison "===" Additive  -- strictEq
-    | Comparison "!==" Additive  -- strictNeq
-    | Comparison ">=" Additive   -- gte
+    = Comparison ">=" Additive   -- gte
     | Comparison "<=" Additive   -- lte
     | Comparison ">" Additive    -- gt
     | Comparison "<" Additive    -- lt

package/src/rules/rtdb/grammar/RtdbExpr.ohm.generated.ts

@@ -15,9 +15,7 @@ export const RTDB_EXPR_OHM_SOURCE = `RtdbExpr {
     | Comparison
 
   Comparison
-    = Comparison "===" Additive  -- strictEq
-    | Comparison "!==" Additive  -- strictNeq
-    | Comparison ">=" Additive   -- gte
+    = Comparison ">=" Additive   -- gte
     | Comparison "<=" Additive   -- lte
     | Comparison ">" Additive    -- gt
     | Comparison "<" Additive    -- lt