API reference: @pyric/cli/verify

Classes

VerifyInputError

Extends

Error

Constructors

Constructor

new VerifyInputError(message: string): VerifyInputError;

Parameters

Parameter	Type
`message`	`string`

Returns

VerifyInputError

Overrides

Error.constructor

Interfaces

BuildVerifyFixtureInput

Properties

Property	Type	Description
`authState?`	{ `currentUser?`: `unknown`; `users?`: `unknown`[]; }	-
`authState.currentUser?`	`unknown`	-
`authState.users?`	`unknown`[]	-
`capturedBy?`	`string`	Stamped into the fixture as `capturedBy` (identity for boot-time event hydration). Omit for `pyric verify` builds — they have no instance.
`createdAt?`	`string`	-
`description?`	`string`	-
`firestoreRules?`	`string`	-
`rtdbDatabaseUrl?`	`string`	-
`rtdbRules?`	{ `rules`: `Record`<`string`, `unknown`>; }	-
`rtdbRules.rules`	`Record`<`string`, `unknown`>	-
`rtdbState?`	`unknown`	-
`sandbox`	`Pick`<`Sandbox`, `"history"` \| `"snapshot"`> & { `currentUser?`: `unknown`; }	-
`storageRules?`	`string`	Currently-deployed storage rules text. RULES ONLY — there is no `storageState` input; captured storage OBJECTS are a separate, larger redesign left untouched by this fixture.

DerivedRulesTestCase

Properties

Property	Type
`eventId`	`string`
`testCase`	{ `auth?`: { `token?`: `Record`<`string`, `unknown`>; `uid`: `string`; }; `data?`: `Record`<`string`, `unknown`>; `description`: `string`; `expectation`: `"ALLOW"` \| `"DENY"`; `functionMocks?`: { `function`: `"get"` \| `"exists"`; `path`: `string`; `result`: `boolean` \| `Record`<`string`, `unknown`>; }[]; `method`: `"delete"` \| `"get"` \| `"list"` \| `"create"` \| `"update"`; `path`: `string`; `query?`: { `limit?`: `number`; `offset?`: `number`; `orderBy?`: `string`; }; `requestTime?`: `string`; `resource?`: `Record`<`string`, `unknown`>; `writeMode?`: \| { `kind`: `"create"`; } \| { `kind`: `"set"`; `merge`: `boolean`; } \| { `kind`: `"update"`; } \| { `kind`: `"delete"`; }; }
`testCase.auth?`	{ `token?`: `Record`<`string`, `unknown`>; `uid`: `string`; }
`testCase.auth.token?`	`Record`<`string`, `unknown`>
`testCase.auth.uid`	`string`
`testCase.data?`	`Record`<`string`, `unknown`>
`testCase.description`	`string`
`testCase.expectation`	`"ALLOW"` \| `"DENY"`
`testCase.functionMocks?`	{ `function`: `"get"` \| `"exists"`; `path`: `string`; `result`: `boolean` \| `Record`<`string`, `unknown`>; }[]
`testCase.method`	`"delete"` \| `"get"` \| `"list"` \| `"create"` \| `"update"`
`testCase.path`	`string`
`testCase.query?`	{ `limit?`: `number`; `offset?`: `number`; `orderBy?`: `string`; }
`testCase.query.limit?`	`number`
`testCase.query.offset?`	`number`
`testCase.query.orderBy?`	`string`
`testCase.requestTime?`	`string`
`testCase.resource?`	`Record`<`string`, `unknown`>
`testCase.writeMode?`	\| { `kind`: `"create"`; } \| { `kind`: `"set"`; `merge`: `boolean`; } \| { `kind`: `"update"`; } \| { `kind`: `"delete"`; }

DeriveRulesTestCasesOptions

Properties

Property	Type
`includeAllowed?`	`boolean`
`includeDenied?`	`boolean`
`mockReads?`	`"strict"` \| `"omit"`
`service?`	`"firestore"`

DeriveRulesTestCasesResult

Properties

Property	Type
`derived`	`DerivedRulesTestCase`[]
`ok`	`boolean`
`service`	`"firestore"`
`testCases`	{ `auth?`: { `token?`: `Record`<`string`, `unknown`>; `uid`: `string`; }; `data?`: `Record`<`string`, `unknown`>; `description`: `string`; `expectation`: `"ALLOW"` \| `"DENY"`; `functionMocks?`: { `function`: `"get"` \| `"exists"`; `path`: `string`; `result`: `boolean` \| `Record`<`string`, `unknown`>; }[]; `method`: `"delete"` \| `"get"` \| `"list"` \| `"create"` \| `"update"`; `path`: `string`; `query?`: { `limit?`: `number`; `offset?`: `number`; `orderBy?`: `string`; }; `requestTime?`: `string`; `resource?`: `Record`<`string`, `unknown`>; `writeMode?`: \| { `kind`: `"create"`; } \| { `kind`: `"set"`; `merge`: `boolean`; } \| { `kind`: `"update"`; } \| { `kind`: `"delete"`; }; }[]
`unsupportedEvents`	`VerifyUnsupportedEvent`[]
`warnings`	`VerifyFixtureWarning`[]

PyricVerifyFixture

Properties

Property	Type	Description
`capturedBy?`	`string`	Opaque id of the sandbox instance that produced this capture (the served SharedWorker’s `instanceId`). Purely additive: `pyric verify` ignores it. Present only on captures written by the worker’s capture flush; used by boot-time event hydration to SKIP priming a capture that belongs to a DIFFERENT instance (e.g. another browser profile sharing one `pyric dev`), so someone else’s session never shows up as yours. Absent on older / standalone captures → hydration primes best-effort.
`createdAt?`	`string`	-
`description?`	`string`	-
`events`	`SandboxEvent`[]	-
`schema`	`"pyric.verify.fixture.v1"`	-
`services`	{ [`service`: `string`]: `unknown`; `auth?`: { `state`: { `currentUser?`: `unknown`; `users?`: `unknown`[]; }; }; `firestore?`: { `rules`: `VerifyFirestoreRulesBlock`; `state`: { `documents`: `Record`<`string`, `Record`<`string`, `unknown`>>; }; }; `rtdb?`: { `databaseUrl?`: `string`; `rules`: `VerifyRtdbRulesBlock`; `state`: { `tree`: `unknown`; }; }; `storage?`: { `rules`: `VerifyStorageRulesBlock`; `state`: `unknown`; }; }	-
`services.auth?`	{ `state`: { `currentUser?`: `unknown`; `users?`: `unknown`[]; }; }	-
`services.auth.state`	{ `currentUser?`: `unknown`; `users?`: `unknown`[]; }	-
`services.auth.state.currentUser?`	`unknown`	-
`services.auth.state.users?`	`unknown`[]	-
`services.firestore?`	{ `rules`: `VerifyFirestoreRulesBlock`; `state`: { `documents`: `Record`<`string`, `Record`<`string`, `unknown`>>; }; }	-
`services.firestore.rules`	`VerifyFirestoreRulesBlock`	-
`services.firestore.state`	{ `documents`: `Record`<`string`, `Record`<`string`, `unknown`>>; }	-
`services.firestore.state.documents`	`Record`<`string`, `Record`<`string`, `unknown`>>	-
`services.rtdb?`	{ `databaseUrl?`: `string`; `rules`: `VerifyRtdbRulesBlock`; `state`: { `tree`: `unknown`; }; }	-
`services.rtdb.databaseUrl?`	`string`	-
`services.rtdb.rules`	`VerifyRtdbRulesBlock`	-
`services.rtdb.state`	{ `tree`: `unknown`; }	-
`services.rtdb.state.tree`	`unknown`	-
`services.storage?`	{ `rules`: `VerifyStorageRulesBlock`; `state`: `unknown`; }	-
`services.storage.rules`	`VerifyStorageRulesBlock`	RULES TEXT ONLY — captured object state is a separate, larger redesign (persistence.ts’s IDB blob store) and is deliberately left untouched here. `state` stays `null` until that lands.
`services.storage.state`	`unknown`	-

VerifyEngineResult

Properties

Property	Type
`checkedEvents`	`number`
`derivation?`	`DeriveRulesTestCasesResult`
`divergences`	`VerifyDivergence`[]
`engine`	`VerifyEngine`
`failed?`	`number`
`ok`	`boolean`
`passed?`	`number`
`results?`	`TestResult`[]
`testCases?`	`number`
`unsupported?`	`number`

VerifyFirestoreRulesBlock

Properties

Property	Type
`format`	`"firestore.rules"`
`source`	`string`

VerifyFixtureOptions

Properties

Property	Type
`caseDerivation?`	`Omit`<`DeriveRulesTestCasesOptions`, `"service"`>
`engines?`	`VerifyEngine`[]
`rules`	`VerifyRulesInput`
`rulesTestApi?`	{ `expressionReportLevel?`: `ExpressionReportLevel`; `scope`: `ProjectScope`; }
`rulesTestApi.expressionReportLevel?`	`ExpressionReportLevel`
`rulesTestApi.scope`	`ProjectScope`
`services?`	`VerifiableService`[]

VerifyResult

Properties

Property	Type
`ok`	`boolean`
`services`	`Partial`<`Record`<`VerifiableService`, `VerifyServiceResult`>>

VerifyRtdbRulesBlock

Properties

Property	Type
`format`	`"rtdb.rules.json"`
`json`	{ `rules`: `Record`<`string`, `unknown`>; }
`json.rules`	`Record`<`string`, `unknown`>

VerifyServiceResult

Properties

Property	Type
`checkedEvents`	`number`
`divergences`	`VerifyDivergence`[]
`engines?`	`Partial`<`Record`<`VerifyEngine`, `VerifyEngineResult`>>
`ok`	`boolean`
`service`	`VerifiableService`

VerifyStorageRulesBlock

Properties

Property	Type
`format`	`"storage.rules"`
`source`	`string`

VerifyToolDeps

Properties

Property	Type
`scope?`	`ProjectScope`

Type Aliases

VerifiableService

type VerifiableService = "firestore" | "rtdb";

VerifyDivergence

type VerifyDivergence =
  | {
  kind: "now-denied";
  method?: string;
  path?: string;
  reason?: string;
  service: EventService | string;
}
  | {
  kind: "now-allowed";
  method?: string;
  path?: string;
  reason?: string;
  service: EventService | string;
}
  | {
  after: unknown;
  before: unknown;
  field?: string;
  kind: "state-drift";
  path?: string;
  service: EventService | string;
}
  | {
  kind: "unsupported";
  method?: string;
  path?: string;
  reason: string;
  service: EventService | string;
}
  | {
  after?: unknown;
  before?: unknown;
  drift: string;
  field?: string;
  kind: "expected-drift";
  path?: string;
  service: EventService | string;
}
  | {
  kind: "engine-drift";
  method?: string;
  path?: string;
  reason?: string;
  rulesTestApi: string;
  sandbox: string;
  service: EventService | string;
};

VerifyEngine

type VerifyEngine = "sandbox" | "rulesTestApi";

VerifyFixtureWarning

type VerifyFixtureWarning = {
  code: string;
  eventId?: string;
  message: string;
  method?: string;
  path?: string;
  service: "firestore";
};

Properties

Property	Type
`code`	`string`
`eventId?`	`string`
`message`	`string`
`method?`	`string`
`path?`	`string`
`service`	`"firestore"`

VerifyRulesInput

type VerifyRulesInput = {
  firestore?:   | string
     | {
     source: string;
   };
  rtdb?:   | {
     rules: Record<string, unknown>;
   }
     | RtdbRulesDocument;
  storage?:   | string
     | {
     source: string;
   };
};

Properties

Property	Type
`firestore?`	\| `string` \| { `source`: `string`; }
`rtdb?`	\| { `rules`: `Record`<`string`, `unknown`>; } \| `RtdbRulesDocument`
`storage?`	\| `string` \| { `source`: `string`; }

VerifyUnsupportedEvent

type VerifyUnsupportedEvent = {
  eventId?: string;
  method?: string;
  path?: string;
  reason: string;
  service: "firestore";
};

Properties

Property	Type
`eventId?`	`string`
`method?`	`string`
`path?`	`string`
`reason`	`string`
`service`	`"firestore"`

Variables

VERIFY_FIXTURE_SCHEMA

const VERIFY_FIXTURE_SCHEMA: "pyric.verify.fixture.v1";

Functions

buildVerifyFixture()

function buildVerifyFixture(input: BuildVerifyFixtureInput): PyricVerifyFixture;

Parameters

Parameter	Type
`input`	`BuildVerifyFixtureInput`

Returns

PyricVerifyFixture

createVerifyTools()

function createVerifyTools(deps?: VerifyToolDeps): ToolHandler<unknown, unknown>[];

Parameters

Parameter	Type
`deps?`	`VerifyToolDeps`

Returns

ToolHandler<unknown, unknown>[]

deriveRulesTestCases()

function deriveRulesTestCases(fixtureInput: unknown, opts?: DeriveRulesTestCasesOptions): DeriveRulesTestCasesResult;

Parameters

Parameter	Type
`fixtureInput`	`unknown`
`opts?`	`DeriveRulesTestCasesOptions`

Returns

DeriveRulesTestCasesResult

fixtureVerifiableServices()

function fixtureVerifiableServices(fixture: PyricVerifyFixture): ("firestore" | "rtdb")[];

Parameters

Parameter	Type
`fixture`	`PyricVerifyFixture`

Returns

("firestore" | "rtdb")[]

parseVerifyFixture()

function parseVerifyFixture(value: unknown): PyricVerifyFixture;

Parameters

Parameter	Type
`value`	`unknown`

Returns

PyricVerifyFixture

restoreStorageRulesFromFixture()

function restoreStorageRulesFromFixture(fixture: PyricVerifyFixture, sandbox: Sandbox): void;

Re-deploy a fixture’s captured storage rules into a sandbox’s storage evaluator. RULES TEXT ONLY, mirroring the capture-side scope note: this never touches storage OBJECTS (persistence.ts’s IDB blob store) — only fixture.services.storage.rules.source is applied.

Storage rules are honored only on the FIRST getStorageSandbox call per Sandbox (see storage/service.ts), so this must run before any other code opens the storage service on sandbox — exactly the same ordering constraint firestore/rtdb rules already have at restore time. A no-op when the fixture carries no storage block.

Parameters

Parameter	Type
`fixture`	`PyricVerifyFixture`
`sandbox`	`Sandbox`

Returns

void

verifyFixture()

function verifyFixture(fixtureInput: unknown, opts: VerifyFixtureOptions): Promise<VerifyResult>;

Parameters

Parameter	Type
`fixtureInput`	`unknown`
`opts`	`VerifyFixtureOptions`

Returns

Promise<VerifyResult>