@justmpm/firebase-audit 0.1.0 → 0.1.1

package/dist/{chunk-VKCDUCYE.js → chunk-N72YT24M.js}

@@ -1,7 +1,6 @@
 // src/discovery.ts
 import { existsSync, readFileSync } from "fs";
 import { join, relative } from "path";
-var SERVER_HINTS = ["functions/", "src/app/api/", "server/", "admin-sdk", "firebase-admin"];
 function discover(rootDir) {
   const pick = (name) => {
     const p = join(rootDir, name);
@@ -12,6 +11,15 @@ function discover(rootDir) {
   let databaseId = null;
   let rulesFile = pick("firestore.rules");
   let indexesFile = pick("firestore.indexes.json");
+  const firebaserc = pick(".firebaserc");
+  if (firebaserc) {
+    try {
+      const raw = JSON.parse(readFileSync(firebaserc, "utf-8"));
+      const preferred = raw.projects?.default ?? (raw.projects ? Object.values(raw.projects)[0] : void 0);
+      if (typeof preferred === "string" && preferred.length > 0) projectId = preferred;
+    } catch {
+    }
+  }
   if (firebaseJson) {
     try {
       const raw = JSON.parse(readFileSync(firebaseJson, "utf-8"));
@@ -38,13 +46,29 @@ function discover(rootDir) {
     serverFiles: []
   };
 }
+var SERVER_HINTS_SEGMENTS = [
+  "functions",
+  "server",
+  "backend",
+  "api",
+  "scripts"
+];
+function hasPathSegment(rel, seg) {
+  return rel.split("/").includes(seg);
+}
 function classifyOrigin(file, content) {
   const rel = file.replace(/\\/g, "/");
-  if (content.includes("firebase-admin") || content.includes("firebase-functions")) {
+  if (rel.includes("app/api/") || rel.includes("/app/") && rel.endsWith("route.ts") || rel.includes("/app/") && rel.endsWith("route.js")) {
     return "SERVER";
   }
-  if (SERVER_HINTS.some((h) => rel.includes(h))) {
-    return "SERVER";
+  if (rel.includes("src/app/api/")) return "SERVER";
+  if (SERVER_HINTS_SEGMENTS.some((s) => hasPathSegment(rel, s))) {
+    if (hasPathSegment(rel, "functions") || hasPathSegment(rel, "server") || hasPathSegment(rel, "backend") || hasPathSegment(rel, "scripts") || rel.includes("src/app/api/") || rel.includes("app/api/")) {
+      return "SERVER";
+    }
+  }
+  if (content.includes("firebase-admin") || content.includes("firebase-functions")) {
+    return "CLIENT";
   }
   if (rel.includes("src/") || rel.includes("app/") || rel.includes("components/")) {
     return "CLIENT";
@@ -76,47 +100,92 @@ function emptyModel(rootDir, d) {
 
 // src/rules.ts
 import { readFileSync as readFileSync2 } from "fs";
-var MATCH_RE = /match\s+(\/[^\s{]+)\s*\{/g;
-var ALLOW_RE = /allow\s+([^:]+):\s*if\s+([^;]+);/g;
+var MATCH_RE = /match\s+(\/[^{\s]*(?:\{[^}]*\}[^{\s]*)*)\s*\{/g;
+var ALLOW_RE = /allow\s+([^;:]+)(?::\s*if\s+([^;]+))?;/g;
+function stripRuleComments(content) {
+  let out = "";
+  let i = 0;
+  let quote = null;
+  while (i < content.length) {
+    const c = content[i];
+    const next = content[i + 1] ?? "";
+    if (quote) {
+      out += c;
+      if (c === quote && content[i - 1] !== "\\") quote = null;
+      i += 1;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      out += c;
+      i += 1;
+      continue;
+    }
+    if (c === "/" && next === "/") {
+      while (i < content.length && content[i] !== "\n") i += 1;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      i += 2;
+      while (i < content.length && !(content[i] === "*" && content[i + 1] === "/")) {
+        if (content[i] === "\n") out += "\n";
+        i += 1;
+      }
+      i += 2;
+      continue;
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
 function opsFrom(target) {
   const t = target.trim().toLowerCase();
-  if (t === "read") return ["read"];
-  if (t === "write") return ["write", "create", "update", "delete"];
+  if (t === "read") return { ops: ["read", "get", "list"], known: true };
+  if (t === "write") return { ops: ["write", "create", "update", "delete"], known: true };
   const parts = t.split(",").map((s) => s.trim()).filter(Boolean);
   const valid = ["read", "get", "list", "create", "update", "delete", "write"];
   const out = [];
+  let known = false;
   for (const p of parts) {
     if (valid.includes(p)) {
+      known = true;
       out.push(p);
       if (p === "write") {
         for (const extra of ["create", "update", "delete"]) {
           if (!out.includes(extra)) out.push(extra);
         }
       }
+      if (p === "read") {
+        for (const extra of ["get", "list"]) {
+          if (!out.includes(extra)) out.push(extra);
+        }
+      }
     }
   }
-  return out.length > 0 ? out : ["read"];
+  return { ops: out, known: out.length > 0 && known };
 }
 function extractRules(rulesFile, relFile) {
-  const content = readFileSync2(rulesFile, "utf-8");
-  const lines = content.split("\n");
+  const rawContent = readFileSync2(rulesFile, "utf-8");
+  const content = stripRuleComments(rawContent);
   const rules = [];
   const matchBlocks = [];
+  const matchRe = new RegExp(MATCH_RE.source, "g");
   let m;
-  MATCH_RE.lastIndex = 0;
-  while ((m = MATCH_RE.exec(content)) !== null) {
+  while ((m = matchRe.exec(content)) !== null) {
     const before = content.slice(0, m.index);
     const line = before.split("\n").length;
     matchBlocks.push({ path: m[1], line, blockStart: m.index });
   }
-  ALLOW_RE.lastIndex = 0;
+  const allowRe = new RegExp(ALLOW_RE.source, "g");
   let a;
   let idx = 0;
-  while ((a = ALLOW_RE.exec(content)) !== null) {
+  while ((a = allowRe.exec(content)) !== null) {
     const before = content.slice(0, a.index);
     const line = before.split("\n").length;
     const target = a[1];
-    const condition = a[2].trim();
+    const condition = (a[2] ?? "").trim();
+    const unconditional = a[2] === void 0;
     const currentMatch = [...matchBlocks].reverse().find((b) => b.blockStart <= a.index);
     const authReferences = [];
     if (condition.includes("request.auth")) authReferences.push("request.auth");
@@ -130,30 +199,70 @@ function extractRules(rulesFile, relFile) {
     const requestResourceReferences = [
       ...condition.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
     ].map((x) => x[1]);
+    const { ops, known } = opsFrom(target);
     rules.push({
       id: `rule-${idx++}`,
       path: currentMatch?.path ?? "/(unknown)",
-      operations: opsFrom(target),
-      conditionPresent: condition.length > 0 && condition !== "true" && condition !== "false",
+      operations: ops,
+      conditionPresent: !unconditional && condition.length > 0,
       authReferences,
       claimReferences,
       resourceReferences,
       requestResourceReferences,
-      confidence: "CONFIRMED",
+      confidence: known ? "CONFIRMED" : "UNKNOWN",
       location: { file: relFile, start: { line, column: 0 } }
     });
-    void lines;
   }
   return rules;
 }
+function stripOuterParens(s) {
+  let norm = s.trim();
+  for (; ; ) {
+    if (!(norm.startsWith("(") && norm.endsWith(")"))) return norm;
+    let depth = 0;
+    let wrapsAll = true;
+    for (let i = 0; i < norm.length; i++) {
+      if (norm[i] === "(") depth += 1;
+      else if (norm[i] === ")") {
+        depth -= 1;
+        if (depth === 0 && i !== norm.length - 1) {
+          wrapsAll = false;
+          break;
+        }
+      }
+    }
+    if (!wrapsAll || depth !== 0) return norm;
+    norm = norm.slice(1, -1).trim();
+  }
+}
+function isPublicCondition(condition) {
+  if (condition === void 0) return { isPublic: true, confidence: "CONFIRMED" };
+  const norm = stripOuterParens(condition);
+  const low = norm.toLowerCase().replace(/\s+/g, "");
+  if (low === "true") return { isPublic: true, confidence: "CONFIRMED" };
+  if (/(^|\|\|)true($|\|\||&&)/.test(low)) return { isPublic: true, confidence: "PROBABLE" };
+  if (low.includes("request.auth==null") || low.includes("request.auth===null")) {
+    return { isPublic: true, confidence: "CONFIRMED" };
+  }
+  return { isPublic: false, confidence: "CONFIRMED" };
+}
 function findPublicAllows(rulesFile) {
-  const content = readFileSync2(rulesFile, "utf-8");
+  const rawContent = readFileSync2(rulesFile, "utf-8");
+  const content = stripRuleComments(rawContent);
   const out = [];
-  const re = /allow\s+([^:]+):\s*if\s+true\s*;/g;
+  const matchRe = new RegExp(MATCH_RE.source, "g");
+  const blocks = [];
+  let mm0;
+  while ((mm0 = matchRe.exec(content)) !== null) blocks.push({ path: mm0[1], index: mm0.index });
+  const re = new RegExp(ALLOW_RE.source, "g");
   let mm;
   while ((mm = re.exec(content)) !== null) {
     const line = content.slice(0, mm.index).split("\n").length;
-    out.push({ line, target: mm[1].trim() });
+    const target = mm[1].trim();
+    const check = isPublicCondition(mm[2]);
+    if (!check.isPublic) continue;
+    const path = [...blocks].reverse().find((b) => b.index <= mm.index)?.path ?? "/(unknown)";
+    out.push({ line, target, path, confidence: check.confidence });
   }
   return out;
 }
@@ -162,15 +271,20 @@ function findPublicAllows(rulesFile) {
 import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
 import { join as join2 } from "path";
 import { executeFind } from "@justmpm/supergrep";
-var evidenceCounter = 0;
-function ev(kind, summary, confidence, file, line) {
-  evidenceCounter += 1;
+var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011"];
+function createEvidence() {
+  let counter = 0;
   return {
-    id: `ev-${evidenceCounter}`,
-    kind,
-    summary,
-    confidence,
-    location: file && line ? { file, start: { line, column: 0 } } : void 0
+    ev: (kind, summary, confidence, file, line) => {
+      counter += 1;
+      return {
+        id: `ev-${counter}`,
+        kind,
+        summary,
+        confidence,
+        location: file && line ? { file, start: { line, column: 0 } } : void 0
+      };
+    }
   };
 }
 function make(rule, severity, confidence, message, fingerprint, opts = {}) {
@@ -185,27 +299,30 @@ function make(rule, severity, confidence, message, fingerprint, opts = {}) {
   };
 }
 async function runChecks(model, rootDir, opts = {}) {
+  const { ev } = createEvidence();
   const findings = [];
   const relRules = model.firebase.firestore.rulesFile;
   const absRules = relRules ? join2(rootDir, relRules) : null;
   if (absRules && existsSync2(absRules)) {
     for (const pub of findPublicAllows(absRules)) {
       const t = pub.target.toLowerCase();
-      const isWrite = t.includes("write") || t.includes("create") || t.includes("update") || t.includes("delete");
-      const isRead = t.includes("read") || t.includes("get") || t.includes("list");
+      const tokens = t.split(",").map((s) => s.trim());
+      const isWrite = tokens.some((x) => ["write", "create", "update", "delete"].includes(x));
+      const isRead = tokens.some((x) => ["read", "get", "list"].includes(x));
       if (isWrite) {
         findings.push(
           make(
             "FBA001",
             "ERROR",
-            "CONFIRMED",
-            `Public write aberto (${pub.target}: if true). Qualquer cliente pode escrever.`,
-            `FBA001:${relRules}:${pub.target}`,
+            pub.confidence,
+            `Escrita p\xFAblica em ${pub.path} (${pub.target}). Qualquer cliente pode escrever.`,
+            `FBA001:${relRules}:${pub.path}:${pub.target}`,
             {
               file: relRules,
               line: pub.line,
-              evidence: [ev("public-allow", `${pub.target}: if true`, "CONFIRMED", relRules, pub.line)],
-              fix: "Troque `if true` por checagem de auth/claim. Se for proposital, documente no contrato."
+              resource: pub.path,
+              evidence: [ev("public-allow", `${pub.target} em ${pub.path}`, pub.confidence, relRules, pub.line)],
+              fix: "Troque por checagem de auth/claim. Se for proposital, documente no contrato."
             }
           )
         );
@@ -215,13 +332,14 @@ async function runChecks(model, rootDir, opts = {}) {
           make(
             "FBA002",
             "WARNING",
-            "CONFIRMED",
-            `Leitura p\xFAblica confirmada (${pub.target}: if true). Pode ser proposital.`,
-            `FBA002:${relRules}:${pub.target}`,
+            pub.confidence,
+            `Leitura p\xFAblica em ${pub.path} (${pub.target}). Pode ser proposital.`,
+            `FBA002:${relRules}:${pub.path}:${pub.target}`,
             {
               file: relRules,
               line: pub.line,
-              evidence: [ev("public-allow", `${pub.target}: if true`, "CONFIRMED", relRules, pub.line)]
+              resource: pub.path,
+              evidence: [ev("public-allow", `${pub.target} em ${pub.path}`, pub.confidence, relRules, pub.line)]
             }
           )
         );
@@ -231,7 +349,7 @@ async function runChecks(model, rootDir, opts = {}) {
   const adapterFn = opts.adapterFn ?? "rbac.can";
   const permissionCalls = await collectPermissionCalls(rootDir, adapterFn);
   const declared = new Set(model.authorization.permissions.map((p) => p.name));
-  if (permissionCalls.length === 0) {
+  if (permissionCalls.literals.length === 0 && permissionCalls.dynamic.length === 0) {
     findings.push(
       make(
         "FBA009",
@@ -242,8 +360,19 @@ async function runChecks(model, rootDir, opts = {}) {
         { evidence: [ev("adapter-missing", adapterFn, "UNKNOWN")] }
       )
     );
+  } else if (declared.size === 0) {
+    findings.push(
+      make(
+        "FBA009",
+        "INFO",
+        "NOT_OBSERVED",
+        `Permiss\xF5es usadas sem contrato (${permissionCalls.literals.length} literais). Crie firebase-audit.yaml para ativar FBA004.`,
+        `FBA009:no-contract`,
+        { evidence: [ev("permissions-without-contract", `${permissionCalls.literals.length} calls`, "NOT_OBSERVED")] }
+      )
+    );
   }
-  for (const call of permissionCalls) {
+  for (const call of permissionCalls.literals) {
     if (!declared.has(call.permission) && declared.size > 0) {
       findings.push(
         make(
@@ -251,11 +380,11 @@ async function runChecks(model, rootDir, opts = {}) {
           "ERROR",
           "CONFIRMED",
           `Permission "${call.permission}" usada mas n\xE3o declarada no contrato.`,
-          `FBA004:${call.file}:${call.permission}`,
+          `FBA004:${call.file}:${call.line}:${call.permission}`,
           {
             file: call.file,
             line: call.line,
-            resource: call.permission.split(".")[0],
+            resource: call.permission.includes(".") ? call.permission.split(".")[0] : call.permission,
             evidence: [ev("permission-call", `${adapterFn}("${call.permission}")`, "CONFIRMED", call.file, call.line)],
             fix: `Declarar "${call.permission}" em firebase-audit.yaml ou corrigir o nome da chamada.`
           }
@@ -263,6 +392,41 @@ async function runChecks(model, rootDir, opts = {}) {
       );
     }
   }
+  for (const role of model.authorization.roles) {
+    for (const perm of role.permissions) {
+      if (!declared.has(perm)) {
+        findings.push(
+          make(
+            "FBA011",
+            "ERROR",
+            "CONFIRMED",
+            `Role "${role.name}" referencia permission "${perm}" n\xE3o declarada em permissions.`,
+            `FBA011:${role.name}:${perm}`,
+            {
+              evidence: [ev("role-permission", `${role.name} \u2192 ${perm}`, "CONFIRMED")],
+              fix: `Declarar "${perm}" em authorization.permissions.`
+            }
+          )
+        );
+      }
+    }
+  }
+  for (const dyn of permissionCalls.dynamic) {
+    findings.push(
+      make(
+        "FBA010",
+        "INFO",
+        "UNKNOWN",
+        `Chamada de permiss\xE3o din\xE2mica em ${dyn.file}:${dyn.line} \u2014 campo n\xE3o resolvido estaticamente.`,
+        `FBA010:${dyn.file}:${dyn.line}`,
+        {
+          file: dyn.file,
+          line: dyn.line,
+          evidence: [ev("dynamic-permission", dyn.text, "UNKNOWN", dyn.file, dyn.line)]
+        }
+      )
+    );
+  }
   const adminHits = await collectAdminImports(rootDir);
   for (const hit of adminHits) {
     let origin = "UNKNOWN";
@@ -279,7 +443,7 @@ async function runChecks(model, rootDir, opts = {}) {
           "ERROR",
           "PROBABLE",
           `Admin SDK em arquivo de cliente (${hit.file}). Rules n\xE3o valem aqui \u2014 precisa auth da app.`,
-          `FBA003:${hit.file}`,
+          `FBA003:${hit.file}:${hit.line}`,
           {
             file: hit.file,
             line: hit.line,
@@ -290,59 +454,73 @@ async function runChecks(model, rootDir, opts = {}) {
       );
     }
   }
-  if (model.indexes.length > 0 && model.queries.length === 0) {
-    findings.push(
-      make(
-        "FBA007",
-        "INFO",
-        "NOT_OBSERVED",
-        "\xCDndices locais sem query observada (query-shape V1 ainda parcial). N\xE3o significa unused.",
-        "FBA007:indexes",
-        { evidence: [ev("index-not-observed", `${model.indexes.length} \xEDndices`, "NOT_OBSERVED")] }
-      )
-    );
-  }
   return findings;
 }
 async function collectPermissionCalls(rootDir, adapterFn) {
-  const out = [];
-  const short = adapterFn.includes(".") ? adapterFn.split(".").pop() : adapterFn;
-  const patterns = [`${short}($PERM)`, `${adapterFn}($PERM)`];
+  const literals = [];
+  const dynamic = [];
+  if (!adapterFn.includes(".")) {
+    return { literals, dynamic };
+  }
+  const bases = [adapterFn];
+  const patterns = [];
+  for (const b of bases) {
+    patterns.push(`${b}($PERM)`, `${b}($PERM, $$$ARGS)`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const pushLiteral = (file, line, permission) => {
+    const k = `${file}:${line}:${permission}`;
+    if (seen.has(k)) return;
+    seen.add(k);
+    literals.push({ file, line, permission });
+  };
   for (const pattern of patterns) {
     try {
       const { result } = await executeFind({ pattern, path: ".", cwd: rootDir });
       for (const m of result.matches) {
-        const perm = (m.metaVariables["PERM"] ?? "").replace(/['"]/g, "").trim();
-        if (perm.length >= 3) {
-          out.push({ file: m.file, line: m.line + 1, permission: perm });
+        const raw = (m.metaVariables["PERM"] ?? "").trim();
+        const line = m.line + 1;
+        const isQuoted = /^['"].*['"]$/.test(raw);
+        if (isQuoted) {
+          const perm = raw.replace(/^['"]|['"]$/g, "").trim();
+          if (perm.length >= 3) pushLiteral(m.file, line, perm);
+        } else if (raw.length > 0) {
+          const k = `${m.file}:${line}:${raw}`;
+          if (!seen.has(k)) {
+            seen.add(k);
+            dynamic.push({ file: m.file, line, text: m.text });
+          }
         }
       }
     } catch {
     }
   }
-  const seen = /* @__PURE__ */ new Set();
-  return out.filter((o) => {
-    const k = `${o.file}:${o.line}:${o.permission}`;
-    if (seen.has(k)) return false;
-    seen.add(k);
-    return true;
-  });
+  return { literals, dynamic };
 }
 async function collectAdminImports(rootDir) {
   const out = [];
-  try {
-    const { result } = await executeFind({
-      pattern: "import { $$$ITEMS } from '$MODULE'",
-      path: ".",
-      cwd: rootDir
-    });
-    for (const m of result.matches) {
-      const mod = m.metaVariables["MODULE"] ?? "";
-      if (mod.includes("firebase-admin")) {
-        out.push({ file: m.file, line: m.line + 1, text: m.text });
+  const patterns = [
+    'import { $$$ITEMS } from "$MODULE"',
+    'import $DEFAULT from "$MODULE"',
+    'import * as $NS from "$MODULE"',
+    'const $X = require("$MODULE")',
+    'require("$MODULE")'
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const pattern of patterns) {
+    try {
+      const { result } = await executeFind({ pattern, path: ".", cwd: rootDir });
+      for (const m of result.matches) {
+        const mod = m.metaVariables["MODULE"] ?? "";
+        if (mod.includes("firebase-admin") || mod.includes("firebase-functions")) {
+          const k = `${m.file}:${m.line}:${m.text}`;
+          if (seen.has(k)) continue;
+          seen.add(k);
+          out.push({ file: m.file, line: m.line + 1, text: m.text });
+        }
       }
+    } catch {
     }
-  } catch {
   }
   return out;
 }
@@ -354,7 +532,8 @@ var ConfidenceSchema = z.enum([
   "CONFIRMED",
   "PROBABLE",
   "NOT_OBSERVED",
-  "UNKNOWN"
+  "UNKNOWN",
+  "CONFLICTING"
 ]);
 var OperationSchema = z.enum([
   "read",
@@ -503,7 +682,7 @@ var FindingSchema = z.strictObject({
   fingerprint: z.string().min(1),
   metadata: z.record(z.string(), z.unknown()).optional()
 });
-var PermissionNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)?$/);
+var PermissionNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/);
 var RoleNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*$/);
 var AuditYamlSchema = z.strictObject({
   authorization: z.strictObject({
@@ -523,10 +702,23 @@ var AuditYamlSchema = z.strictObject({
 
 // src/scan.ts
 import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
+import { parse as parseYaml } from "yaml";
 async function scan(rootDir, opts = {}) {
   const d = discover(rootDir);
   const model = emptyModel(rootDir, d);
+  const findings_pre = [];
+  if (!d.firestoreRulesFile || !existsSync3(d.firestoreRulesFile)) {
+    findings_pre.push({
+      rule: "RULES_NOT_OBSERVED",
+      severity: "INFO",
+      confidence: "NOT_OBSERVED",
+      message: "firestore.rules n\xE3o encontrado \u2014 FBA001/FBA002 sem cobertura neste scan.",
+      fingerprint: "RULES_NOT_OBSERVED",
+      evidence: [
+        { id: "ev-no-rules", kind: "rules-missing", summary: "sem rules", confidence: "NOT_OBSERVED" }
+      ]
+    });
+  }
   if (d.firestoreRulesFile && existsSync3(d.firestoreRulesFile)) {
     const rel = d.firestoreRulesFile.replace(/\\/g, "/").startsWith(rootDir.replace(/\\/g, "/")) ? d.firestoreRulesFile.slice(rootDir.length + 1).replace(/\\/g, "/") : model.firebase.firestore.rulesFile ?? "firestore.rules";
     model.rules = extractRules(d.firestoreRulesFile, rel);
@@ -539,16 +731,26 @@ async function scan(rootDir, opts = {}) {
         queryScope: i.queryScope === "COLLECTION_GROUP" ? "COLLECTION_GROUP" : "COLLECTION",
         fields: (i.fields ?? []).map((f) => ({
           fieldPath: f.fieldPath ?? "(unknown)",
-          mode: f.arrayConfig ? "ARRAY_CONTAINS" : f.order ?? "ASCENDING"
+          mode: f.vectorConfig ? "VECTOR" : f.arrayConfig === "CONTAINS" ? "ARRAY_CONTAINS" : f.order ?? "ASCENDING"
         }))
       })) ?? [];
     } catch {
+      findings_pre.push({
+        rule: "INDEXES_INVALID",
+        severity: "WARNING",
+        confidence: "CONFIRMED",
+        message: "firestore.indexes.json inv\xE1lido \u2014 \xEDndices ignorados neste scan.",
+        fingerprint: "INDEXES_INVALID",
+        evidence: [
+          { id: "ev-indexes-invalid", kind: "indexes-parse", summary: "JSON inv\xE1lido", confidence: "CONFIRMED" }
+        ]
+      });
     }
   }
   if (d.auditYamlFile && existsSync3(d.auditYamlFile)) {
     try {
       const text = readFileSync4(d.auditYamlFile, "utf-8");
-      const parsed = parseSimpleYaml(text);
+      const parsed = parseYaml(text);
       const validated = AuditYamlSchema.safeParse(parsed);
       if (validated.success) {
         const auth = validated.data.authorization;
@@ -562,11 +764,47 @@ async function scan(rootDir, opts = {}) {
           name,
           permissions: r.permissions
         }));
+      } else {
+        findings_pre.push({
+          rule: "CONTRACT_INVALID",
+          severity: "WARNING",
+          confidence: "CONFIRMED",
+          message: `firebase-audit.yaml existe mas \xE9 inv\xE1lido: ${validated.error.issues[0]?.message ?? "schema"} \u2014 contrato ignorado neste scan.`,
+          fingerprint: "CONTRACT_INVALID",
+          evidence: [
+            { id: "ev-contract-invalid", kind: "contract-parse", summary: "YAML inv\xE1lido", confidence: "CONFIRMED" }
+          ],
+          fix: "Valide contra templates/firebase-audit.yaml."
+        });
       }
-    } catch {
+    } catch (err) {
+      findings_pre.push({
+        rule: "CONTRACT_INVALID",
+        severity: "WARNING",
+        confidence: "CONFIRMED",
+        message: `firebase-audit.yaml n\xE3o p\xF4de ser lido: ${err instanceof Error ? err.message : "erro"} \u2014 contrato ignorado.`,
+        fingerprint: "CONTRACT_INVALID",
+        evidence: [
+          { id: "ev-contract-unreadable", kind: "contract-parse", summary: "leitura falhou", confidence: "CONFIRMED" }
+        ]
+      });
     }
   }
-  const findings = await runChecks(model, rootDir, { adapterFn: opts.adapterFn ?? model.authorization.adapter ?? void 0 });
+  const checksFindings = await runChecks(model, rootDir, { adapterFn: opts.adapterFn ?? model.authorization.adapter ?? void 0 });
+  const findings = [...findings_pre, ...checksFindings];
+  const modelCheck = ProjectModelSchema.safeParse(model);
+  if (!modelCheck.success) {
+    findings.push({
+      rule: "MODEL_INVALID",
+      severity: "WARNING",
+      confidence: "CONFIRMED",
+      message: `ProjectModel inv\xE1lido: ${modelCheck.error.issues[0]?.message ?? "schema"} \u2014 verifique indexes/rules.`,
+      fingerprint: "MODEL_INVALID",
+      evidence: [
+        { id: "ev-model-invalid", kind: "model-validate", summary: "schema", confidence: "CONFIRMED" }
+      ]
+    });
+  }
   if (opts.strict) {
     const hasContract = model.authorization.permissions.length > 0;
     if (!hasContract) {
@@ -586,74 +824,18 @@ async function scan(rootDir, opts = {}) {
   const errors = findings.filter((f) => f.severity === "ERROR").length;
   const warnings = findings.filter((f) => f.severity === "WARNING").length;
   const infos = findings.filter((f) => f.severity === "INFO").length;
-  return { model, findings, summary: { errors, warnings, infos, passed: findings.length === 0 ? 10 : 0 } };
-}
-function parseSimpleYaml(text) {
-  const lines = text.split("\n");
-  const root = {};
-  const stack = [
-    { indent: -1, obj: root }
-  ];
-  let pendingListKey = null;
-  const cur = () => stack[stack.length - 1].obj;
-  for (const rawLine of lines) {
-    const line = rawLine.replace(/\t/g, "  ");
-    if (line.trim() === "" || line.trim().startsWith("#")) continue;
-    const indent = line.length - line.trimStart().length;
-    const trimmed = line.trim();
-    if (trimmed.startsWith("- ")) {
-      const val = trimmed.slice(2).trim();
-      if (pendingListKey && indent >= pendingListKey.indent) {
-        pendingListKey.arr.push(val);
-        continue;
-      }
-      continue;
-    }
-    while (stack.length > 1 && indent <= stack[stack.length - 1].indent) {
-      stack.pop();
-    }
-    pendingListKey = null;
-    const colon = trimmed.indexOf(":");
-    if (colon === -1) continue;
-    const key = trimmed.slice(0, colon).trim();
-    const rest = trimmed.slice(colon + 1).trim();
-    if (rest === "") {
-      const child = {};
-      cur()[key] = child;
-      stack.push({ indent, obj: child, key });
-      const arr = [];
-      child.__maybeList = arr;
-      pendingListKey = { indent: indent + 1, arr };
-      stack[stack.length - 1].listProbe = arr;
-      void join3;
-    } else {
-      const parent = cur();
-      delete parent.__maybeList;
-      parent[key] = rest === "true" ? true : rest === "false" ? false : rest;
-    }
-  }
-  const fix = (o) => {
-    if (Array.isArray(o)) return o.map(fix);
-    if (o && typeof o === "object") {
-      const rec = o;
-      if (Array.isArray(rec.__maybeList) && Object.keys(rec).length === 1) {
-        return rec.__maybeList;
-      }
-      delete rec.__maybeList;
-      for (const k of Object.keys(rec)) rec[k] = fix(rec[k]);
-      return rec;
-    }
-    return o;
-  };
-  return fix(root);
+  return { model, findings, summary: { errors, warnings, infos, passed: IMPLEMENTED_CHECKS.length } };
 }
 
 export {
   discover,
   classifyOrigin,
   emptyModel,
+  stripRuleComments,
   extractRules,
+  isPublicCondition,
   findPublicAllows,
+  IMPLEMENTED_CHECKS,
   runChecks,
   SeveritySchema,
   ConfidenceSchema,

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-VKCDUCYE.js";
+} from "./chunk-N72YT24M.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -34,7 +34,9 @@ Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
 FIREBASE AUDIT v${pkg.version}`);
   console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   if (findings.length === 0) {
-    console.log("\n\u2713 Nenhum problema encontrado (V1 static-first, 10 checks).\n");
+    console.log(`
+\u2713 Nenhum problema nos checks V1 implementados (parcial: FBA001-FBA004, FBA009-FBA011).
+`);
     return;
   }
   for (const f of findings) {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as z from 'zod';
-import z__default from 'zod';
+import { z as z$1 } from 'zod';
 
 /**
  * firebase-audit — schemas centrais (Zod v4).
@@ -19,6 +19,7 @@ declare const ConfidenceSchema: z.ZodEnum<{
     PROBABLE: "PROBABLE";
     NOT_OBSERVED: "NOT_OBSERVED";
     UNKNOWN: "UNKNOWN";
+    CONFLICTING: "CONFLICTING";
 }>;
 declare const OperationSchema: z.ZodEnum<{
     read: "read";
@@ -69,6 +70,7 @@ declare const EvidenceSchema: z.ZodObject<{
         PROBABLE: "PROBABLE";
         NOT_OBSERVED: "NOT_OBSERVED";
         UNKNOWN: "UNKNOWN";
+        CONFLICTING: "CONFLICTING";
     }>;
     value: z.ZodOptional<z.ZodUnknown>;
     fingerprint: z.ZodOptional<z.ZodString>;
@@ -170,6 +172,7 @@ declare const QueryShapeSchema: z.ZodObject<{
         PROBABLE: "PROBABLE";
         NOT_OBSERVED: "NOT_OBSERVED";
         UNKNOWN: "UNKNOWN";
+        CONFLICTING: "CONFLICTING";
     }>;
     location: z.ZodObject<{
         file: z.ZodString;
@@ -222,6 +225,7 @@ declare const RuleSchema: z.ZodObject<{
         PROBABLE: "PROBABLE";
         NOT_OBSERVED: "NOT_OBSERVED";
         UNKNOWN: "UNKNOWN";
+        CONFLICTING: "CONFLICTING";
     }>;
     location: z.ZodObject<{
         file: z.ZodString;
@@ -288,6 +292,7 @@ declare const GraphEdgeSchema: z.ZodObject<{
         PROBABLE: "PROBABLE";
         NOT_OBSERVED: "NOT_OBSERVED";
         UNKNOWN: "UNKNOWN";
+        CONFLICTING: "CONFLICTING";
     }>;
     evidenceIds: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
@@ -378,6 +383,7 @@ declare const ProjectModelSchema: z.ZodObject<{
             PROBABLE: "PROBABLE";
             NOT_OBSERVED: "NOT_OBSERVED";
             UNKNOWN: "UNKNOWN";
+            CONFLICTING: "CONFLICTING";
         }>;
         location: z.ZodObject<{
             file: z.ZodString;
@@ -413,6 +419,7 @@ declare const ProjectModelSchema: z.ZodObject<{
             PROBABLE: "PROBABLE";
             NOT_OBSERVED: "NOT_OBSERVED";
             UNKNOWN: "UNKNOWN";
+            CONFLICTING: "CONFLICTING";
         }>;
         location: z.ZodObject<{
             file: z.ZodString;
@@ -473,6 +480,7 @@ declare const ProjectModelSchema: z.ZodObject<{
             PROBABLE: "PROBABLE";
             NOT_OBSERVED: "NOT_OBSERVED";
             UNKNOWN: "UNKNOWN";
+            CONFLICTING: "CONFLICTING";
         }>;
         value: z.ZodOptional<z.ZodUnknown>;
         fingerprint: z.ZodOptional<z.ZodString>;
@@ -494,6 +502,7 @@ declare const ProjectModelSchema: z.ZodObject<{
             PROBABLE: "PROBABLE";
             NOT_OBSERVED: "NOT_OBSERVED";
             UNKNOWN: "UNKNOWN";
+            CONFLICTING: "CONFLICTING";
         }>;
         evidenceIds: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>;
@@ -510,6 +519,7 @@ declare const FindingSchema: z.ZodObject<{
         PROBABLE: "PROBABLE";
         NOT_OBSERVED: "NOT_OBSERVED";
         UNKNOWN: "UNKNOWN";
+        CONFLICTING: "CONFLICTING";
     }>;
     file: z.ZodOptional<z.ZodString>;
     line: z.ZodOptional<z.ZodNumber>;
@@ -534,6 +544,7 @@ declare const FindingSchema: z.ZodObject<{
             PROBABLE: "PROBABLE";
             NOT_OBSERVED: "NOT_OBSERVED";
             UNKNOWN: "UNKNOWN";
+            CONFLICTING: "CONFLICTING";
         }>;
         value: z.ZodOptional<z.ZodUnknown>;
         fingerprint: z.ZodOptional<z.ZodString>;
@@ -597,12 +608,15 @@ interface DiscoveryResult {
     firestoreIndexesFile: string | null;
     auditYamlFile: string | null;
     projectId: string | null;
+    /** V2: databaseId nomeado (sempre null na V1). */
     databaseId: string | null;
+    /** V2: preenchido via varredura + ai-tool (sempre [] na V1). */
     clientFiles: string[];
+    /** V2: preenchido via varredura + ai-tool (sempre [] na V1). */
     serverFiles: string[];
 }
 declare function discover(rootDir: string): DiscoveryResult;
-/** Heurística simples CLIENT vs SERVER por caminho + import admin. */
+/** Heurística CLIENT vs SERVER: caminho manda primeiro (grafo/voz do ai-tool na V2). */
 declare function classifyOrigin(file: string, content: string): "CLIENT" | "SERVER" | "UNKNOWN";
 declare function emptyModel(rootDir: string, d: DiscoveryResult): ProjectModel;
 
@@ -611,19 +625,32 @@ declare function emptyModel(rootDir: string, d: DiscoveryResult): ProjectModel;
  * Parser leve e intencionalmente incompleto: avaliação real é do Emulator (V3).
  */
 
-type Rule = z__default.infer<typeof RuleSchema>;
+type Rule = z$1.infer<typeof RuleSchema>;
+/** Remove comentários // e block preservando strings simples. */
+declare function stripRuleComments(content: string): string;
 declare function extractRules(rulesFile: string, relFile: string): Rule[];
-/** Detecta allow ... if true preservando linha para FBA001/FBA002. */
+/** Normaliza condição para detectar público: sem if, `true`, `(true)`, `|| true`, `auth == null`. */
+declare function isPublicCondition(condition: string | undefined): {
+    isPublic: boolean;
+    confidence: "CONFIRMED" | "PROBABLE";
+};
+/** Detecta allows públicos preservando linha, path e confiança para FBA001/FBA002. */
 declare function findPublicAllows(rulesFile: string): {
     line: number;
     target: string;
+    path: string;
+    confidence: "CONFIRMED" | "PROBABLE";
 }[];
 
 /**
- * Checks estáticos V1 (FBA001–FBA010, subconjunto intencional).
+ * Checks estáticos V1 (FBA001–FBA004, FBA009–FBA011, subconjunto intencional).
  * Cada check retorna Findings com fingerprint estável para CI.
+ * Nota: FBA001/FBA002 sem linha no fingerprint (estável a formatação);
+ * FBA003/FBA004/FBA010 com linha (únicos por ocorrência — duplicatas no mesmo
+ * arquivo geram findings distintos).
  */
 
+declare const IMPLEMENTED_CHECKS: readonly ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011"];
 declare function runChecks(model: ProjectModel, rootDir: string, opts?: {
     adapterFn?: string;
 }): Promise<Finding[]>;
@@ -654,4 +681,4 @@ declare function scan(rootDir: string, opts?: ScanOptions): Promise<ScanResult>;
 
 declare const VERSION: string;
 
-export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RoleSchema, RuleSchema, SeveritySchema, VERSION, classifyOrigin, discover, emptyModel, extractRules, findPublicAllows, runChecks, scan };
+export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IMPLEMENTED_CHECKS, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RoleSchema, RuleSchema, type ScanOptions, type ScanResult, SeveritySchema, VERSION, classifyOrigin, discover, emptyModel, extractRules, findPublicAllows, isPublicCondition, runChecks, scan, stripRuleComments };

package/dist/index.js

@@ -7,6 +7,7 @@ import {
   FindingSchema,
   FirestoreIndexSchema,
   GraphEdgeSchema,
+  IMPLEMENTED_CHECKS,
   IndexFieldSchema,
   LocationSchema,
   OperationSchema,
@@ -24,9 +25,11 @@ import {
   emptyModel,
   extractRules,
   findPublicAllows,
+  isPublicCondition,
   runChecks,
-  scan
-} from "./chunk-VKCDUCYE.js";
+  scan,
+  stripRuleComments
+} from "./chunk-N72YT24M.js";
 
 // src/index.ts
 import { createRequire } from "module";
@@ -42,6 +45,7 @@ export {
   FindingSchema,
   FirestoreIndexSchema,
   GraphEdgeSchema,
+  IMPLEMENTED_CHECKS,
   IndexFieldSchema,
   LocationSchema,
   OperationSchema,
@@ -60,6 +64,8 @@ export {
   emptyModel,
   extractRules,
   findPublicAllows,
+  isPublicCondition,
   runChecks,
-  scan
+  scan,
+  stripRuleComments
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",
@@ -26,7 +26,9 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "templates",
+    "skill"
   ],
   "scripts": {
     "build": "tsup src/index.ts src/cli.ts --format esm --dts --clean",
@@ -39,6 +41,7 @@
     "@justmpm/ai-tool": "^6.1.1",
     "@justmpm/supergrep": "^0.7.0",
     "@modelcontextprotocol/sdk": "^1.25.3",
+    "yaml": "^2.9.1",
     "zod": "^4.1.0"
   },
   "devDependencies": {

package/skill/SKILL.md

@@ -0,0 +1,29 @@
+# firebase-audit-skill
+
+Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
+
+## Sequência obrigatória
+
+1. Descobrir projeto (`firebase.json`, `firestore.rules`, `firestore.indexes.json`)
+2. Verificar `firebase-audit.yaml` (se não existe, V1 roda zero-config)
+3. Inspecionar adapter de autorização (ex: `rbac.can`). Sem adapter resolvido → UNKNOWN, nunca adivinhar
+4. Executar `firebase-audit scan` (ou `--strict` com contrato)
+5. Ler findings (CONFIRMED corrige agora; PROBABLE investiga; NOT_OBSERVED/UNKNOWN não afirma)
+6. Corrigir código, nunca o contrato para esconder finding
+7. Reexecutar scan antes de declarar pronto
+
+## Travas
+
+- `The contract is an assertion of intent. Do not modify the assertion to make implementation violations disappear.`
+- Nunca transformar UNKNOWN em CONFIRMED sem teste no Emulator
+- Nunca dizer "unused" — apenas NOT_OBSERVED
+- Claims: 1000 bytes max, sem chaves OIDC reservadas, só controle de acesso
+
+## Emulador (V3)
+
+```bash
+firebase emulators:exec --only firestore "npm test"
+```
+
+Matriz `anon/user/admin x read/create/update/delete` com `@firebase/rules-unit-testing`.
+Cobertura em `:ruleCoverage` (JSON). Emulator não prova índice.

package/templates/firebase-audit.yaml

@@ -0,0 +1,39 @@
+authorization:
+  adapter:
+    function: "rbac.can"
+  roles:
+    admin:
+      permissions:
+        - users.read
+        - users.write
+        - orders.read
+        - orders.delete
+    user:
+      permissions:
+        - users.read
+        - orders.read
+        - orders.create
+  permissions:
+    users.read:
+      resource: users
+      operation: read
+    users.write:
+      resource: users
+      operation: write
+    orders.delete:
+      resource: orders
+      operation: delete
+    orders.read:
+      resource: orders
+      operation: read
+    orders.create:
+      resource: orders
+      operation: create
+  claims:
+    enabled: true
+    roleKey: role
+    samples:
+      admin:
+        role: admin
+      user:
+        role: user