API reference: @pyric/cli/assurance

Classes

AssuranceCampaignStore

Constructors

Constructor

new AssuranceCampaignStore(): AssuranceCampaignStore;

Returns

AssuranceCampaignStore

Methods

create()

create(campaign: AuthorizationCampaign): void;

Parameters

Parameter	Type
`campaign`	`AuthorizationCampaign`

Returns

void

get()

get(id: string): AuthorizationCampaign;

Parameters

Parameter	Type
`id`	`string`

Returns

AuthorizationCampaign

publish()

publish(campaign: AuthorizationCampaign): void;

Parameters

Parameter	Type
`campaign`	`AuthorizationCampaign`

Returns

void

subscribe(listener: (campaign: AssuranceVisualizationSnapshot) => void): () => void;

Parameters

Parameter	Type
`listener`	(`campaign`: `AssuranceVisualizationSnapshot`) => `void`

Returns

(): void;

Returns

void

AssuranceInputError

Extends

Error

Constructors

Constructor

new AssuranceInputError(message?: string): AssuranceInputError;

Parameters

Parameter	Type
`message?`	`string`

Returns

AssuranceInputError

Inherited from

Error.constructor

Constructor

new AssuranceInputError(message?: string, options?: ErrorOptions): AssuranceInputError;

Parameters

Parameter	Type
`message?`	`string`
`options?`	`ErrorOptions`

Returns

AssuranceInputError

Inherited from

Error.constructor

Constructor

new AssuranceInputError(message?: string, options?: ErrorOptions): AssuranceInputError;

Parameters

Parameter	Type
`message?`	`string`
`options?`	`ErrorOptions`

Returns

AssuranceInputError

Inherited from

Error.constructor

Properties

Property	Modifier	Type	Default value
`code`	`readonly`	`"ASSURANCE_INVALID_INPUT"`	`"ASSURANCE_INVALID_INPUT"`

AuthorizationCampaign

Constructors

Constructor

new AuthorizationCampaign(options: CreateAuthorizationCampaignOptions): AuthorizationCampaign;

Parameters

Parameter	Type
`options`	`CreateAuthorizationCampaignOptions`

Returns

AuthorizationCampaign

Properties

Property	Modifier	Type
`context`	`readonly`	`AssuranceCampaignContext`
`id`	`readonly`	`string`
`maxRuns`	`readonly`	`number`
`target`	`readonly`	`LocalFirebaseTarget`

Accessors

observations

Get Signature

get observations(): AssuranceObservation[];

Returns

AssuranceObservation[]

report

Get Signature

get report(): AuthorizationCampaignReport;

Returns

AuthorizationCampaignReport

Methods

addActor()

addActor(actor: AssuranceActor): AssuranceActor;

Parameters

Parameter	Type
`actor`	`AssuranceActor`

Returns

AssuranceActor

addInvariant()

addInvariant(invariant: SecurityInvariant): SecurityInvariant;

Parameters

Parameter	Type
`invariant`	`SecurityInvariant`

Returns

SecurityInvariant

addObservation()

addObservation(observation: AssuranceObservation): AssuranceObservation;

Parameters

Parameter	Type
`observation`	`AssuranceObservation`

Returns

AssuranceObservation

addProbe()

addProbe(probe: AssuranceProbe): AssuranceProbe;

Parameters

Parameter	Type
`probe`	`AssuranceProbe`

Returns

AssuranceProbe

export()

export(): CampaignExport;

Returns

CampaignExport

exportSecurityCases()

exportSecurityCases(options?: {
  includeCandidates?: boolean;
}): SecurityCase[];

Parameters

Parameter	Type
`options?`	{ `includeCandidates?`: `boolean`; }
`options.includeCandidates?`	`boolean`

Returns

SecurityCase[]

inspect()

inspect(probeId: string): AssuranceProbeResult;

Parameters

Parameter	Type
`probeId`	`string`

Returns

AssuranceProbeResult

minimize()

minimize(probeId: string): Promise<MinimizationResult>;

Parameters

Parameter	Type
`probeId`	`string`

Returns

Promise<MinimizationResult>

propose()

propose(input: ProposalInput): AssuranceProbe[];

Parameters

Parameter	Type
`input`	`ProposalInput`

Returns

AssuranceProbe[]

run()

run(probeIds?: string[]): Promise<AuthorizationCampaignReport>;

Parameters

Parameter	Type
`probeIds?`	`string`[]

Returns

Promise<AuthorizationCampaignReport>

spec()

spec(probeIds?: string[]): AuthorizationCampaignSpec;

Parameters

Parameter	Type
`probeIds?`	`string`[]

Returns

AuthorizationCampaignSpec

verifyRules()

verifyRules(options: {
  id?: string;
  includeCandidates?: boolean;
  rules: {
     firestore?: string;
     rtdb?: {
        rules: Record<string, unknown>;
     };
     storage?: string;
  };
}): Promise<AuthorizationCampaignReport>;

Parameters

Parameter	Type
`options`	{ `id?`: `string`; `includeCandidates?`: `boolean`; `rules`: { `firestore?`: `string`; `rtdb?`: { `rules`: `Record`<`string`, `unknown`>; }; `storage?`: `string`; }; }
`options.id?`	`string`
`options.includeCandidates?`	`boolean`
`options.rules`	{ `firestore?`: `string`; `rtdb?`: { `rules`: `Record`<`string`, `unknown`>; }; `storage?`: `string`; }
`options.rules.firestore?`	`string`
`options.rules.rtdb?`	{ `rules`: `Record`<`string`, `unknown`>; }
`options.rules.rtdb.rules`	`Record`<`string`, `unknown`>
`options.rules.storage?`	`string`

Returns

Promise<AuthorizationCampaignReport>

visualization()

visualization(): AssuranceVisualizationSnapshot;

Returns

AssuranceVisualizationSnapshot

Interfaces

ActorEvidence

Properties

Property	Type
`acquisition`	\| `"password"` \| `"anonymous-request"` \| `"anonymous-account"` \| `"fixture-user"` \| `"synthetic"`
`actorId`	`string`
`error?`	`string`
`reachability`	`"synthetic"` \| `"reachable"` \| `"unreachable"`
`uid?`	`string`

AssuranceActor

Properties

Property	Type
`acquisition`	`ActorAcquisition`
`id`	`string`

AssuranceAttachment

Properties

Property	Type
`coverageGaps`	`AssuranceCoverageGap`[]
`inventory`	`AssuranceAttachmentInventory`
`source`	`AssuranceAttachmentSource`
`target`	`LocalFirebaseTarget`

AssuranceAttachmentInput

Properties

Property	Type
`url`	`string`

AssuranceAttachmentInventory

Properties

Property	Type
`authUsers`	`number`
`firestoreDocuments`	`number`
`rtdbPresent`	`boolean`
`storageObjects`	`number`

AssuranceAttachmentSource

Properties

Property	Type
`origin`	`string`
`readOnly`	`true`
`requestedUrl`	`string`
`studioUrl`	`string`
`transport`	`"same-origin-shared-worker"`

AssuranceCampaignContext

Properties

Property	Type
`attachment?`	{ `coverageGaps`: `AssuranceCoverageGap`[]; `inventory`: `AssuranceAttachmentInventory`; `source`: `AssuranceAttachmentSource`; }
`attachment.coverageGaps`	`AssuranceCoverageGap`[]
`attachment.inventory`	`AssuranceAttachmentInventory`
`attachment.source`	`AssuranceAttachmentSource`

AssuranceCoverageGap

Properties

Property	Type
`code`	`string`
`reason`	`string`
`service`	`"auth"` \| `AssuranceService` \| `"attachment"`

AssuranceEventEvidence

Properties

Property	Type
`actor?`	`unknown`
`at?`	`number`
`auth?`	`unknown`
`authLens?`	`unknown`
`evaluatedRule?`	`unknown`
`id?`	`string`
`kind?`	`string`
`matchedRule?`	`unknown`
`method?`	`string`
`op?`	`string`
`origin?`	`unknown`
`path?`	`string`
`reasons?`	`string`[]
`request?`	`unknown`
`resourceBefore?`	`unknown`
`result?`	`string`
`rules?`	`unknown`
`service?`	`string`

AssuranceObservation

Properties

Property	Type
`actorId`	`string`
`description?`	`string`
`id`	`string`
`operation`	`FirebaseOperation`
`result`	`"ALLOW"`
`source`	`"captured"` \| `"authored"` \| `"discovered"`

AssuranceProbe

Properties

Property	Type	Description
`actorId`	`string`	-
`control`	`FirebaseOperation`	-
`id`	`string`	-
`invariantId`	`string`	-
`mutation`	`ProbeMutation`	-
`requires?`	`CapabilityDependency`[]	Graph nodes this probe’s verdict depends on. Each is resolved live against the conformance graph statuses: a node the graph derives non-`supported` makes the engine abstain (engine-gap), and a node the graph does not model is a campaign authoring error (invalid-probe).

AssuranceProbeResult

Properties

Property	Type
`actorEvidence`	`ActorEvidence`
`campaignId`	`string`
`classification`	`ProbeClassification`
`control`	`OperationEvidence`
`invariant`	`SecurityInvariant`
`mutation`	`OperationEvidence`
`mutationSpec`	`ProbeMutation`
`probeId`	`string`
`qualification`	`EngineQualification`
`stateDiff?`	`StateDiff`
`targetHash`	`string`

AssuranceReportSummary

Properties

Property	Type
`candidateSignals`	`number`
`controlsPassed`	`number`
`engineGaps`	`number`
`invalidProbes`	`number`
`localCounterexamples`	`number`
`noCounterexamples`	`number`
`probes`	`number`

AssuranceToolDeps

Properties

Property	Type
`attachmentProvider?`	`AssuranceAttachmentProvider`
`onCampaignUpdate?`	(`campaign`: `AssuranceVisualizationSnapshot`) => `void`
`store?`	`AssuranceCampaignStore`

AssuranceVisualizationSnapshot

Credential-free projection safe to hand to Studio visualization code.

Properties

Property	Type
`campaignId`	`string`
`context?`	`AssuranceCampaignContext`
`observations`	`AssuranceObservation`[]
`probes`	`AssuranceProbe`[]
`report?`	`AuthorizationCampaignReport`
`schema`	`"pyric.assurance.visualization.v1"`
`verifications?`	`AuthorizationCampaignReport`[]

AuthFixtureUser

Properties

Property	Type
`customClaims?`	`Record`<`string`, `unknown`>
`disabled?`	`boolean`
`email?`	`string`
`emailVerified?`	`boolean`
`password?`	`string`
`uid`	`string`

AuthorizationCampaignReport

Properties

Property	Type
`campaignId`	`string`
`localOnly`	{ `engine`: `"pyric-local-sandboxes"`; `network`: `"forbid"`; }
`localOnly.engine`	`"pyric-local-sandboxes"`
`localOnly.network`	`"forbid"`
`results`	`AssuranceProbeResult`[]
`schema`	`"pyric.assurance.report.v1"`
`summary`	`AssuranceReportSummary`
`targetHash`	`string`

AuthorizationCampaignSpec

Properties

Property	Type
`actors`	`AssuranceActor`[]
`id`	`string`
`invariants`	`SecurityInvariant`[]
`probes`	`AssuranceProbe`[]
`schema`	`"pyric.assurance.campaign.v1"`
`target`	`LocalFirebaseTarget`

CampaignExport

Properties

Property	Type
`campaign`	`AuthorizationCampaignSpec`
`cases`	`SecurityCase`[]
`context?`	`AssuranceCampaignContext`
`observations`	`AssuranceObservation`[]
`report?`	`AuthorizationCampaignReport`
`schema`	`"pyric.assurance.export.v1"`
`verifications?`	`AuthorizationCampaignReport`[]

CapabilityRequirement

Properties

Property	Type
`id`	`string`
`reason`	`string`
`supported`	`boolean`

CreateAuthorizationCampaignOptions

Properties

Property	Type
`context?`	`AssuranceCampaignContext`
`id`	`string`
`safety?`	{ `maxRuns?`: `number`; `network?`: `"forbid"`; }
`safety.maxRuns?`	`number`
`safety.network?`	`"forbid"`
`target`	`LocalFirebaseTarget`

EngineQualification

Properties

Property	Type	Description
`classification?`	`"engine-gap"` \| `"invalid-probe"`	How an unsupported qualification must be classified. Absent when the qualification is supported. `engine-gap` is the default abstention (a target-specific check failed, or a required graph node is derived non-supported); `invalid-probe` overrides it when the campaign names a graph node the engine does not know.
`engine`	`"pyric-local-sandboxes"`	-
`requirements`	`CapabilityRequirement`[]	-
`supported`	`boolean`	-

FirestoreOperation

Properties

Property	Type
`data?`	`Record`<`string`, `unknown`>
`method`	`"delete"` \| `"get"` \| `"list"` \| `"create"` \| `"update"` \| `"set"` \| `"merge"`
`path`	`string`
`query?`	{ `limit?`: `number`; `orderBy?`: { `direction?`: `"asc"` \| `"desc"`; `field`: `string`; }[]; `where?`: `FirestoreQueryConstraint`[]; }
`query.limit?`	`number`
`query.orderBy?`	{ `direction?`: `"asc"` \| `"desc"`; `field`: `string`; }[]
`query.where?`	`FirestoreQueryConstraint`[]
`service`	`"firestore"`

FirestoreQueryConstraint

Properties

Property	Type
`field`	`string`
`op`	\| `"<"` \| `"<="` \| `"=="` \| `"!="` \| `">="` \| `">"` \| `"in"` \| `"not-in"` \| `"array-contains"` \| `"array-contains-any"`
`value`	`unknown`

LocalFirebaseTarget

Properties

Property	Type
`network`	`"forbid"`
`rules`	{ `firestore?`: `string`; `rtdb?`: { `rules`: `Record`<`string`, `unknown`>; }; `storage?`: `string`; }
`rules.firestore?`	`string`
`rules.rtdb?`	{ `rules`: `Record`<`string`, `unknown`>; }
`rules.rtdb.rules`	`Record`<`string`, `unknown`>
`rules.storage?`	`string`
`schema`	`"pyric.assurance.target.v1"`
`state`	{ `auth?`: { `users`: `AuthFixtureUser`[]; }; `firestore?`: `Record`<`string`, `Record`<`string`, `unknown`>>; `rtdb?`: `unknown`; `storage?`: `StorageObjectFixture`[]; }
`state.auth?`	{ `users`: `AuthFixtureUser`[]; }
`state.auth.users`	`AuthFixtureUser`[]
`state.firestore?`	`Record`<`string`, `Record`<`string`, `unknown`>>
`state.rtdb?`	`unknown`
`state.storage?`	`StorageObjectFixture`[]

MinimizationResult

Properties

Property	Type
`changed`	`boolean`
`probe`	`AssuranceProbe`
`probeId`	`string`
`removedPayloadFields`	`string`[]
`result`	`AssuranceProbeResult`

MutationCandidate

Extends

ProbeMutation

Properties

Property	Type
`description`	`string`
`dimension`	`MutationDimension`
`id?`	`string`
`operation`	`FirebaseOperation`

OperationEvidence

Properties

Property	Type
`decision`	`AssuranceDecision`
`error?`	{ `code?`: `string`; `message`: `string`; }
`error.code?`	`string`
`error.message`	`string`
`events`	`AssuranceEventEvidence`[]
`operation`	`FirebaseOperation`
`output?`	`unknown`

ProbeMutation

Extended by

MutationCandidate

Properties

Property	Type
`description`	`string`
`dimension`	`MutationDimension`
`operation`	`FirebaseOperation`

ProposalInput

Properties

Property	Type
`invariantId`	`string`
`mutations`	`MutationCandidate`[]
`observationId`	`string`

RtdbOperation

Properties

Property	Type
`data?`	`unknown`
`method`	`"get"` \| `"update"` \| `"set"` \| `"remove"`
`path`	`string`
`query?`	{ `endAt?`: { `key?`: `string`; `value`: `unknown`; }; `endBefore?`: { `key?`: `string`; `value`: `unknown`; }; `equalTo?`: { `key?`: `string`; `value`: `unknown`; }; `limitToFirst?`: `number`; `limitToLast?`: `number`; `orderBy?`: \| { `kind`: `"child"`; `path`: `string`; } \| { `kind`: `"key"`; } \| { `kind`: `"value"`; }; `startAfter?`: { `key?`: `string`; `value`: `unknown`; }; `startAt?`: { `key?`: `string`; `value`: `unknown`; }; }
`query.endAt?`	{ `key?`: `string`; `value`: `unknown`; }
`query.endAt.key?`	`string`
`query.endAt.value`	`unknown`
`query.endBefore?`	{ `key?`: `string`; `value`: `unknown`; }
`query.endBefore.key?`	`string`
`query.endBefore.value`	`unknown`
`query.equalTo?`	{ `key?`: `string`; `value`: `unknown`; }
`query.equalTo.key?`	`string`
`query.equalTo.value`	`unknown`
`query.limitToFirst?`	`number`
`query.limitToLast?`	`number`
`query.orderBy?`	\| { `kind`: `"child"`; `path`: `string`; } \| { `kind`: `"key"`; } \| { `kind`: `"value"`; }
`query.startAfter?`	{ `key?`: `string`; `value`: `unknown`; }
`query.startAfter.key?`	`string`
`query.startAfter.value`	`unknown`
`query.startAt?`	{ `key?`: `string`; `value`: `unknown`; }
`query.startAt.key?`	`string`
`query.startAt.value`	`unknown`
`service`	`"rtdb"`

RunSecurityCasesInput

Properties

Property	Type
`actors`	`AssuranceActor`[]
`campaignId`	`string`
`cases`	`SecurityCase`[]
`target`	`LocalFirebaseTarget`

SandboxAttachmentProviderOptions

Properties

Property	Type
`fetchImpl?`	typeof `fetch`
`origin?`	`string`

SecurityCase

Properties

Property	Type
`actorId`	`string`
`campaignId`	`string`
`control`	`FirebaseOperation`
`expect`	`"ALLOW"` \| `"DENY"`
`id`	`string`
`invariant`	`SecurityInvariant`
`mutation`	`ProbeMutation`
`qualification`	`EngineQualification`
`schema`	`"pyric.assurance.case.v1"`

SecurityInvariant

Properties

Property	Type
`confidence`	`"authoritative"` \| `"strong"` \| `"tentative"`
`expected`	`"ALLOW"` \| `"DENY"`
`id`	`string`
`service`	`AssuranceService` \| `"cross-service"`
`source`	`"agent"` \| `"captured"` \| `"declared"` \| `"authored-test"` \| `"derived"`
`statement`	`string`

StateDiff

Properties

Property	Type
`after`	`unknown`
`before`	`unknown`
`changed`	`boolean`

StorageObjectFixture

Properties

Property	Type
`contentType?`	`string`
`customMetadata?`	`Record`<`string`, `string`>
`dataBase64`	`string`
`path`	`string`

StorageOperation

Properties

Property	Type
`contentType?`	`string`
`customMetadata?`	`Record`<`string`, `string`>
`dataBase64?`	`string`
`method`	`"delete"` \| `"get"` \| `"list"` \| `"upload"` \| `"updateMetadata"`
`path`	`string`
`service`	`"storage"`

Type Aliases

ActorAcquisition

type ActorAcquisition =
  | {
  kind: "anonymous-request";
}
  | {
  kind: "anonymous-account";
}
  | {
  email: string;
  kind: "password";
  password: string;
}
  | {
  kind: "fixture-user";
  uid: string;
}
  | {
  kind: "synthetic";
  token?: Record<string, unknown>;
  uid: string;
};

AssuranceAttachmentProvider()

type AssuranceAttachmentProvider = (input: AssuranceAttachmentInput) => Promise<AssuranceAttachment>;

Parameters

Parameter	Type
`input`	`AssuranceAttachmentInput`

Returns

Promise<AssuranceAttachment>

AssuranceDecision

type AssuranceDecision = "ALLOW" | "DENY" | "ERROR" | "UNSUPPORTED";

AssuranceService

type AssuranceService = "firestore" | "rtdb" | "storage";

FirebaseOperation

type FirebaseOperation =
  | FirestoreOperation
  | RtdbOperation
  | StorageOperation;

MutationDimension

type MutationDimension = "path" | "query" | "payload" | "operation";

ProbeClassification

type ProbeClassification =
  | "local-counterexample"
  | "candidate-signal"
  | "no-counterexample"
  | "engine-gap"
  | "invalid-probe";

Variables

ASSURANCE_CAMPAIGN_SCHEMA

const ASSURANCE_CAMPAIGN_SCHEMA: "pyric.assurance.campaign.v1";

ASSURANCE_REPORT_SCHEMA

const ASSURANCE_REPORT_SCHEMA: "pyric.assurance.report.v1";

ASSURANCE_TARGET_SCHEMA

const ASSURANCE_TARGET_SCHEMA: "pyric.assurance.target.v1";

defaultAssuranceCampaignStore

const defaultAssuranceCampaignStore: AssuranceCampaignStore;

Functions

createAssuranceTools()

function createAssuranceTools(deps?: AssuranceToolDeps): ToolHandler<unknown, unknown>[];

Parameters

Parameter	Type
`deps?`	`AssuranceToolDeps`

Returns

ToolHandler<unknown, unknown>[]

createAuthorizationCampaign()

function createAuthorizationCampaign(options: CreateAuthorizationCampaignOptions): AuthorizationCampaign;

Parameters

Parameter	Type
`options`	`CreateAuthorizationCampaignOptions`

Returns

AuthorizationCampaign

createSandboxAttachmentProvider()

function createSandboxAttachmentProvider(sandbox: Sandbox, options?: SandboxAttachmentProviderOptions): AssuranceAttachmentProvider;

Clone the sandbox currently hosting the connected bridge peer. The URL is an origin assertion and source for explicit rules metadata; no arbitrary host is contacted and the returned campaign target itself keeps networking forbidden.

Parameters

Parameter	Type
`sandbox`	`Sandbox`
`options?`	`SandboxAttachmentProviderOptions`

Returns

AssuranceAttachmentProvider

qualifyProbe()

function qualifyProbe(target: LocalFirebaseTarget, probe: AssuranceProbe): EngineQualification;

Parameters

Parameter	Type
`target`	`LocalFirebaseTarget`
`probe`	`AssuranceProbe`

Returns

EngineQualification

runAuthorizationCampaign()

function runAuthorizationCampaign(spec: AuthorizationCampaignSpec): Promise<AuthorizationCampaignReport>;

Parameters

Parameter	Type
`spec`	`AuthorizationCampaignSpec`

Returns

Promise<AuthorizationCampaignReport>

runSecurityCases()

function runSecurityCases(input: RunSecurityCasesInput): Promise<AuthorizationCampaignReport>;

Re-run exported expectations against a candidate local target. Each case keeps its known-good control and explicit negative expectation, so a rules change must preserve the application workflow and reject the boundary case.

Parameters

Parameter	Type
`input`	`RunSecurityCasesInput`

Returns

Promise<AuthorizationCampaignReport>

References

Classes

AssuranceCampaignStore

Constructors

Constructor

Returns

Methods

create()

Parameters

Returns

get()

Parameters

Returns

publish()

Parameters

Returns

subscribe()

Parameters

Returns

Returns

AssuranceInputError

Extends

Constructors

Constructor

Parameters

Returns

Inherited from

Constructor

Parameters

Returns

Inherited from

Constructor

Parameters

Returns

Inherited from

Properties

AuthorizationCampaign

Constructors

Constructor

Parameters

Returns

Properties

Accessors

observations

Get Signature

Returns

report

Get Signature

Returns

Methods

addActor()

Parameters

Returns

addInvariant()

Parameters

Returns

addObservation()

Parameters

Returns

addProbe()

Parameters

Returns

export()

Returns

exportSecurityCases()

Parameters

Returns

inspect()

Parameters

Returns

minimize()

Parameters

Returns

propose()

Parameters

Returns

run()

Parameters

Returns

spec()

Parameters