@justmpm/firebase-audit 0.1.0 → 0.2.0

package/dist/chunk-PIRAC3KT.js

@@ -0,0 +1,962 @@
+// src/discovery.ts
+import { existsSync, readFileSync } from "fs";
+import { join, relative } from "path";
+function discover(rootDir) {
+  const pick = (name) => {
+    const p = join(rootDir, name);
+    return existsSync(p) ? p : null;
+  };
+  const firebaseJson = pick("firebase.json");
+  let projectId = null;
+  let databaseId = null;
+  let rulesFile = pick("firestore.rules");
+  let indexesFile = pick("firestore.indexes.json");
+  const firebaserc = pick(".firebaserc");
+  if (firebaserc) {
+    try {
+      const raw = JSON.parse(readFileSync(firebaserc, "utf-8"));
+      const preferred = raw.projects?.default ?? (raw.projects ? Object.values(raw.projects)[0] : void 0);
+      if (typeof preferred === "string" && preferred.length > 0) projectId = preferred;
+    } catch {
+    }
+  }
+  if (firebaseJson) {
+    try {
+      const raw = JSON.parse(readFileSync(firebaseJson, "utf-8"));
+      if (typeof raw.firestore?.rules === "string") {
+        const p = join(rootDir, raw.firestore.rules);
+        if (existsSync(p)) rulesFile = p;
+      }
+      if (typeof raw.firestore?.indexes === "string") {
+        const p = join(rootDir, raw.firestore.indexes);
+        if (existsSync(p)) indexesFile = p;
+      }
+    } catch {
+    }
+  }
+  return {
+    rootDir,
+    firebaseJson,
+    firestoreRulesFile: rulesFile,
+    firestoreIndexesFile: indexesFile,
+    auditYamlFile: pick("firebase-audit.yaml"),
+    projectId,
+    databaseId,
+    clientFiles: [],
+    serverFiles: []
+  };
+}
+var SERVER_HINTS_SEGMENTS = [
+  "functions",
+  "server",
+  "backend",
+  "api",
+  "scripts"
+];
+function hasPathSegment(rel, seg) {
+  return rel.split("/").includes(seg);
+}
+function classifyOrigin(file, content) {
+  const rel = file.replace(/\\/g, "/");
+  if (rel.includes("app/api/") || rel.includes("/app/") && rel.endsWith("route.ts") || rel.includes("/app/") && rel.endsWith("route.js")) {
+    return "SERVER";
+  }
+  if (rel.includes("src/app/api/")) return "SERVER";
+  if (SERVER_HINTS_SEGMENTS.some((s) => hasPathSegment(rel, s))) {
+    if (hasPathSegment(rel, "functions") || hasPathSegment(rel, "server") || hasPathSegment(rel, "backend") || hasPathSegment(rel, "scripts") || rel.includes("src/app/api/") || rel.includes("app/api/")) {
+      return "SERVER";
+    }
+  }
+  if (content.includes("firebase-admin") || content.includes("firebase-functions")) {
+    return "CLIENT";
+  }
+  if (rel.includes("src/") || rel.includes("app/") || rel.includes("components/")) {
+    return "CLIENT";
+  }
+  return "UNKNOWN";
+}
+function emptyModel(rootDir, d) {
+  const rel = (abs) => abs ? relative(rootDir, abs).replace(/\\/g, "/") : void 0;
+  return {
+    schemaVersion: 1,
+    rootDir,
+    firebase: {
+      configFile: rel(d.firebaseJson),
+      projectId: d.projectId,
+      databaseId: d.databaseId,
+      firestore: {
+        rulesFile: rel(d.firestoreRulesFile),
+        indexesFile: rel(d.firestoreIndexesFile)
+      }
+    },
+    authorization: { adapter: null, roles: [], permissions: [] },
+    queries: [],
+    rules: [],
+    indexes: [],
+    evidence: [],
+    graph: []
+  };
+}
+
+// src/rules.ts
+import { readFileSync as readFileSync2 } from "fs";
+var MATCH_RE = /match\s+(\/[^{\s]*(?:\{[^}]*\}[^{\s]*)*)\s*\{/g;
+var ALLOW_RE = /allow\s+([^;:]+)(?::\s*if\s+([^;]+))?;/g;
+function stripRuleComments(content) {
+  let out = "";
+  let i = 0;
+  let quote = null;
+  while (i < content.length) {
+    const c = content[i];
+    const next = content[i + 1] ?? "";
+    if (quote) {
+      out += c;
+      if (c === quote && content[i - 1] !== "\\") quote = null;
+      i += 1;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      out += c;
+      i += 1;
+      continue;
+    }
+    if (c === "/" && next === "/") {
+      while (i < content.length && content[i] !== "\n") i += 1;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      i += 2;
+      while (i < content.length && !(content[i] === "*" && content[i + 1] === "/")) {
+        if (content[i] === "\n") out += "\n";
+        i += 1;
+      }
+      i += 2;
+      continue;
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+function opsFrom(target) {
+  const t = target.trim().toLowerCase();
+  if (t === "read") return { ops: ["read", "get", "list"], known: true };
+  if (t === "write") return { ops: ["write", "create", "update", "delete"], known: true };
+  const parts = t.split(",").map((s) => s.trim()).filter(Boolean);
+  const valid = ["read", "get", "list", "create", "update", "delete", "write"];
+  const out = [];
+  let known = false;
+  for (const p of parts) {
+    if (valid.includes(p)) {
+      known = true;
+      out.push(p);
+      if (p === "write") {
+        for (const extra of ["create", "update", "delete"]) {
+          if (!out.includes(extra)) out.push(extra);
+        }
+      }
+      if (p === "read") {
+        for (const extra of ["get", "list"]) {
+          if (!out.includes(extra)) out.push(extra);
+        }
+      }
+    }
+  }
+  return { ops: out, known: out.length > 0 && known };
+}
+function extractRules(rulesFile, relFile) {
+  const rawContent = readFileSync2(rulesFile, "utf-8");
+  const content = stripRuleComments(rawContent);
+  const rules = [];
+  const matchBlocks = [];
+  const matchRe = new RegExp(MATCH_RE.source, "g");
+  let m;
+  while ((m = matchRe.exec(content)) !== null) {
+    const before = content.slice(0, m.index);
+    const line = before.split("\n").length;
+    matchBlocks.push({ path: m[1], line, blockStart: m.index });
+  }
+  const allowRe = new RegExp(ALLOW_RE.source, "g");
+  let a;
+  let idx = 0;
+  while ((a = allowRe.exec(content)) !== null) {
+    const before = content.slice(0, a.index);
+    const line = before.split("\n").length;
+    const target = a[1];
+    const condition = (a[2] ?? "").trim();
+    const unconditional = a[2] === void 0;
+    const currentMatch = [...matchBlocks].reverse().find((b) => b.blockStart <= a.index);
+    const authReferences = [];
+    if (condition.includes("request.auth")) authReferences.push("request.auth");
+    if (condition.includes("request.auth.uid")) authReferences.push("request.auth.uid");
+    const claimReferences = [...condition.matchAll(/request\.auth\.token\.([A-Za-z0-9_]+)/g)].map(
+      (x) => x[1]
+    );
+    const resourceReferences = [...condition.matchAll(/resource\.data\.([A-Za-z0-9_]+)/g)].map(
+      (x) => x[1]
+    );
+    const requestResourceReferences = [
+      ...condition.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
+    ].map((x) => x[1]);
+    const { ops, known } = opsFrom(target);
+    rules.push({
+      id: `rule-${idx++}`,
+      path: currentMatch?.path ?? "/(unknown)",
+      operations: ops,
+      conditionPresent: !unconditional && condition.length > 0,
+      authReferences,
+      claimReferences,
+      resourceReferences,
+      requestResourceReferences,
+      confidence: known ? "CONFIRMED" : "UNKNOWN",
+      location: { file: relFile, start: { line, column: 0 } }
+    });
+  }
+  return rules;
+}
+function stripOuterParens(s) {
+  let norm = s.trim();
+  for (; ; ) {
+    if (!(norm.startsWith("(") && norm.endsWith(")"))) return norm;
+    let depth = 0;
+    let wrapsAll = true;
+    for (let i = 0; i < norm.length; i++) {
+      if (norm[i] === "(") depth += 1;
+      else if (norm[i] === ")") {
+        depth -= 1;
+        if (depth === 0 && i !== norm.length - 1) {
+          wrapsAll = false;
+          break;
+        }
+      }
+    }
+    if (!wrapsAll || depth !== 0) return norm;
+    norm = norm.slice(1, -1).trim();
+  }
+}
+function isPublicCondition(condition) {
+  if (condition === void 0) return { isPublic: true, confidence: "CONFIRMED" };
+  const norm = stripOuterParens(condition);
+  const low = norm.toLowerCase().replace(/\s+/g, "");
+  if (low.includes("!(request.auth==null)") || low.includes("!(request.auth===null)") || low === "!request.auth==null" || low === "!request.auth===null") {
+    return { isPublic: false, confidence: "CONFIRMED" };
+  }
+  if (low === "true") return { isPublic: true, confidence: "CONFIRMED" };
+  if (/(^|\|\|)true($|\|\||&&)/.test(low)) return { isPublic: true, confidence: "PROBABLE" };
+  if (low.includes("request.auth==null") || low.includes("request.auth===null")) {
+    return { isPublic: true, confidence: "CONFIRMED" };
+  }
+  return { isPublic: false, confidence: "CONFIRMED" };
+}
+function findPublicAllows(rulesFile) {
+  const rawContent = readFileSync2(rulesFile, "utf-8");
+  const content = stripRuleComments(rawContent);
+  const out = [];
+  const matchRe = new RegExp(MATCH_RE.source, "g");
+  const blocks = [];
+  let mm0;
+  while ((mm0 = matchRe.exec(content)) !== null) blocks.push({ path: mm0[1], index: mm0.index });
+  const re = new RegExp(ALLOW_RE.source, "g");
+  let mm;
+  while ((mm = re.exec(content)) !== null) {
+    const line = content.slice(0, mm.index).split("\n").length;
+    const target = mm[1].trim();
+    const check = isPublicCondition(mm[2]);
+    if (!check.isPublic) continue;
+    const path = [...blocks].reverse().find((b) => b.index <= mm.index)?.path ?? "/(unknown)";
+    out.push({ line, target, path, confidence: check.confidence });
+  }
+  return out;
+}
+
+// src/checks.ts
+import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import { executeFind } from "@justmpm/supergrep";
+var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
+function createEvidence() {
+  let counter = 0;
+  return {
+    ev: (kind, summary, confidence, file, line) => {
+      counter += 1;
+      return {
+        id: `ev-${counter}`,
+        kind,
+        summary,
+        confidence,
+        location: file && line ? { file, start: { line, column: 0 } } : void 0
+      };
+    }
+  };
+}
+function make(rule, severity, confidence, message, fingerprint, opts = {}) {
+  return {
+    rule,
+    severity,
+    confidence,
+    message,
+    fingerprint,
+    evidence: [],
+    ...opts
+  };
+}
+async function runChecks(model, rootDir, opts = {}) {
+  const { ev } = createEvidence();
+  const findings = [];
+  const relRules = model.firebase.firestore.rulesFile;
+  const absRules = relRules ? join2(rootDir, relRules) : null;
+  if (absRules && existsSync2(absRules)) {
+    for (const pub of findPublicAllows(absRules)) {
+      const t = pub.target.toLowerCase();
+      const tokens = t.split(",").map((s) => s.trim());
+      const isWrite = tokens.some((x) => ["write", "create", "update", "delete"].includes(x));
+      const isRead = tokens.some((x) => ["read", "get", "list"].includes(x));
+      if (isWrite) {
+        findings.push(
+          make(
+            "FBA001",
+            "ERROR",
+            pub.confidence,
+            `Escrita p\xFAblica em ${pub.path} (${pub.target}). Qualquer cliente pode escrever.`,
+            `FBA001:${relRules}:${pub.path}:${pub.target}`,
+            {
+              file: relRules,
+              line: pub.line,
+              resource: pub.path,
+              evidence: [ev("public-allow", `${pub.target} em ${pub.path}`, pub.confidence, relRules, pub.line)],
+              fix: "Troque por checagem de auth/claim. Se for proposital, documente no contrato."
+            }
+          )
+        );
+      }
+      if (isRead) {
+        findings.push(
+          make(
+            "FBA002",
+            "WARNING",
+            pub.confidence,
+            `Leitura p\xFAblica em ${pub.path} (${pub.target}). Pode ser proposital.`,
+            `FBA002:${relRules}:${pub.path}:${pub.target}`,
+            {
+              file: relRules,
+              line: pub.line,
+              resource: pub.path,
+              evidence: [ev("public-allow", `${pub.target} em ${pub.path}`, pub.confidence, relRules, pub.line)]
+            }
+          )
+        );
+      }
+    }
+  }
+  const adapterFn = opts.adapterFn ?? "rbac.can";
+  const permissionCalls = await collectPermissionCalls(rootDir, adapterFn);
+  const declared = new Set(model.authorization.permissions.map((p) => p.name));
+  if (permissionCalls.literals.length === 0 && permissionCalls.dynamic.length === 0) {
+    findings.push(
+      make(
+        "FBA009",
+        "WARNING",
+        "UNKNOWN",
+        `Adapter de autoriza\xE7\xE3o "${adapterFn}" n\xE3o observado no c\xF3digo. Sem adapter, permiss\xF5es s\xE3o UNKNOWN.`,
+        `FBA009:${adapterFn}`,
+        { evidence: [ev("adapter-missing", adapterFn, "UNKNOWN")] }
+      )
+    );
+  } else if (declared.size === 0) {
+    findings.push(
+      make(
+        "FBA009",
+        "INFO",
+        "NOT_OBSERVED",
+        `Permiss\xF5es usadas sem contrato (${permissionCalls.literals.length} literais). Crie firebase-audit.yaml para ativar FBA004.`,
+        `FBA009:no-contract`,
+        { evidence: [ev("permissions-without-contract", `${permissionCalls.literals.length} calls`, "NOT_OBSERVED")] }
+      )
+    );
+  }
+  for (const call of permissionCalls.literals) {
+    if (!declared.has(call.permission) && declared.size > 0) {
+      findings.push(
+        make(
+          "FBA004",
+          "ERROR",
+          "CONFIRMED",
+          `Permission "${call.permission}" usada mas n\xE3o declarada no contrato.`,
+          `FBA004:${call.file}:${call.line}:${call.permission}`,
+          {
+            file: call.file,
+            line: call.line,
+            resource: call.permission.includes(".") ? call.permission.split(".")[0] : call.permission,
+            evidence: [ev("permission-call", `${adapterFn}("${call.permission}")`, "CONFIRMED", call.file, call.line)],
+            fix: `Declarar "${call.permission}" em firebase-audit.yaml ou corrigir o nome da chamada.`
+          }
+        )
+      );
+    }
+  }
+  for (const role of model.authorization.roles) {
+    for (const perm of role.permissions) {
+      if (!declared.has(perm)) {
+        findings.push(
+          make(
+            "FBA011",
+            "ERROR",
+            "CONFIRMED",
+            `Role "${role.name}" referencia permission "${perm}" n\xE3o declarada em permissions.`,
+            `FBA011:${role.name}:${perm}`,
+            {
+              evidence: [ev("role-permission", `${role.name} \u2192 ${perm}`, "CONFIRMED")],
+              fix: `Declarar "${perm}" em authorization.permissions.`
+            }
+          )
+        );
+      }
+    }
+  }
+  for (const role of model.authorization.roles) {
+    if (role.permissions.length === 0) {
+      findings.push(
+        make(
+          "FBA013",
+          "WARNING",
+          "CONFIRMED",
+          `Role "${role.name}" sem permissions \u2014 nunca autoriza nada.`,
+          `FBA013:${role.name}`,
+          {
+            evidence: [ev("role-empty", role.name, "CONFIRMED")],
+            fix: `Adicionar permissions \xE0 role "${role.name}" ou remov\xEA-la.`
+          }
+        )
+      );
+    }
+  }
+  const publicPaths = new Set(
+    absRules && existsSync2(absRules) ? findPublicAllows(absRules).map((p) => `${p.path}::${p.target}`) : []
+  );
+  const expandOp = (op) => {
+    if (op === "read") return ["read", "get", "list"];
+    if (op === "write") return ["write", "create", "update", "delete"];
+    return [op];
+  };
+  const permsByResource = /* @__PURE__ */ new Map();
+  for (const p of model.authorization.permissions) {
+    const holders = model.authorization.roles.filter((r) => r.permissions.includes(p.name)).map((r) => r.name);
+    const adminOnly = holders.length > 0 && holders.every((h) => h === "admin");
+    const list = permsByResource.get(p.resource) ?? [];
+    list.push({ perm: p.name, operation: p.operation, adminOnly });
+    permsByResource.set(p.resource, list);
+  }
+  for (const rule of model.rules) {
+    const resourceKey = rule.path.replace(/^\/+/, "").split("/")[0] ?? "";
+    if (resourceKey === "databases" || resourceKey === "(unknown)" || resourceKey === "") continue;
+    const entries = permsByResource.get(resourceKey);
+    if (!entries || entries.length === 0) continue;
+    const ruleOps = new Set(rule.operations.flatMap(expandOp));
+    const restricted = entries.filter((e) => e.adminOnly && ruleOps.has(e.operation));
+    if (restricted.length === 0) continue;
+    const isPublicRule = rule.operations.some(
+      (op) => publicPaths.has(`${rule.path}::${op}`)
+    ) || rule.operations.some((op) => publicPaths.has(`${rule.path}::read, ${op}`));
+    if (isPublicRule) continue;
+    const checksAdminClaim = rule.claimReferences.some((c) => c.toLowerCase() === "admin");
+    if (checksAdminClaim) continue;
+    const checksAuth = rule.authReferences.length > 0;
+    if (!checksAuth) continue;
+    findings.push(
+      make(
+        "FBA012",
+        "WARNING",
+        "PROBABLE",
+        `Rule ${rule.path} [${rule.operations.join(", ")}] aceita autenticado sem checar claim de admin, mas contrato restringe ${restricted.map((r) => r.perm).join(", ")} a admin.`,
+        `FBA012:${rule.path}:${[...rule.operations].sort().join(",")}`,
+        {
+          file: rule.location.file,
+          line: rule.location.start.line,
+          resource: rule.path,
+          evidence: [ev("rule-contract-mismatch", `${rule.path} vs ${restricted.map((r) => r.perm).join(", ")}`, "PROBABLE", rule.location.file, rule.location.start.line)],
+          fix: "Adicionar checagem de claim de admin na Rule (ex: request.auth.token.admin == true) ou relaxar o contrato."
+        }
+      )
+    );
+  }
+  for (const dyn of permissionCalls.dynamic) {
+    findings.push(
+      make(
+        "FBA010",
+        "INFO",
+        "UNKNOWN",
+        `Chamada de permiss\xE3o din\xE2mica em ${dyn.file}:${dyn.line} \u2014 campo n\xE3o resolvido estaticamente.`,
+        `FBA010:${dyn.file}:${dyn.line}`,
+        {
+          file: dyn.file,
+          line: dyn.line,
+          evidence: [ev("dynamic-permission", dyn.text, "UNKNOWN", dyn.file, dyn.line)]
+        }
+      )
+    );
+  }
+  const adminHits = await collectAdminImports(rootDir);
+  for (const hit of adminHits) {
+    let origin = "UNKNOWN";
+    try {
+      const content = readFileSync3(join2(rootDir, hit.file), "utf-8");
+      origin = classifyOrigin(hit.file, content);
+    } catch {
+      origin = "UNKNOWN";
+    }
+    if (origin === "CLIENT") {
+      findings.push(
+        make(
+          "FBA003",
+          "ERROR",
+          "PROBABLE",
+          `Admin SDK em arquivo de cliente (${hit.file}). Rules n\xE3o valem aqui \u2014 precisa auth da app.`,
+          `FBA003:${hit.file}:${hit.line}`,
+          {
+            file: hit.file,
+            line: hit.line,
+            evidence: [ev("admin-import", hit.text, "PROBABLE", hit.file, hit.line)],
+            fix: "Mover para Functions/API server ou trocar por Client SDK com Rules."
+          }
+        )
+      );
+    }
+  }
+  return findings;
+}
+async function collectPermissionCalls(rootDir, adapterFn) {
+  const literals = [];
+  const dynamic = [];
+  if (!adapterFn.includes(".")) {
+    return { literals, dynamic };
+  }
+  const bases = [adapterFn];
+  const patterns = [];
+  for (const b of bases) {
+    patterns.push(`${b}($PERM)`, `${b}($PERM, $$$ARGS)`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const pushLiteral = (file, line, permission) => {
+    const k = `${file}:${line}:${permission}`;
+    if (seen.has(k)) return;
+    seen.add(k);
+    literals.push({ file, line, permission });
+  };
+  for (const pattern of patterns) {
+    try {
+      const { result } = await executeFind({ pattern, path: ".", cwd: rootDir });
+      for (const m of result.matches) {
+        const raw = (m.metaVariables["PERM"] ?? "").trim();
+        const line = m.line + 1;
+        const isQuoted = /^['"].*['"]$/.test(raw);
+        if (isQuoted) {
+          const perm = raw.replace(/^['"]|['"]$/g, "").trim();
+          if (perm.length >= 3) pushLiteral(m.file, line, perm);
+        } else if (raw.length > 0) {
+          const k = `${m.file}:${line}:${raw}`;
+          if (!seen.has(k)) {
+            seen.add(k);
+            dynamic.push({ file: m.file, line, text: m.text });
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  return { literals, dynamic };
+}
+async function collectAdminImports(rootDir) {
+  const out = [];
+  const patterns = [
+    'import { $$$ITEMS } from "$MODULE"',
+    'import $DEFAULT from "$MODULE"',
+    'import * as $NS from "$MODULE"',
+    'const $X = require("$MODULE")',
+    'require("$MODULE")'
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const pattern of patterns) {
+    try {
+      const { result } = await executeFind({ pattern, path: ".", cwd: rootDir });
+      for (const m of result.matches) {
+        const mod = m.metaVariables["MODULE"] ?? "";
+        if (mod.includes("firebase-admin") || mod.includes("firebase-functions")) {
+          const k = `${m.file}:${m.line}:${m.text}`;
+          if (seen.has(k)) continue;
+          seen.add(k);
+          out.push({ file: m.file, line: m.line + 1, text: m.text });
+        }
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+
+// src/schemas.ts
+import * as z from "zod";
+var SeveritySchema = z.enum(["ERROR", "WARNING", "INFO"]);
+var ConfidenceSchema = z.enum([
+  "CONFIRMED",
+  "PROBABLE",
+  "NOT_OBSERVED",
+  "UNKNOWN",
+  "CONFLICTING"
+]);
+var OperationSchema = z.enum([
+  "read",
+  "get",
+  "list",
+  "create",
+  "update",
+  "delete",
+  "write"
+]);
+var AccessOriginSchema = z.enum(["CLIENT", "SERVER", "UNKNOWN"]);
+var PositionSchema = z.strictObject({
+  line: z.number().int().positive(),
+  column: z.number().int().nonnegative()
+});
+var LocationSchema = z.strictObject({
+  file: z.string().min(1),
+  start: PositionSchema,
+  end: PositionSchema.optional()
+});
+var EvidenceSchema = z.strictObject({
+  id: z.string().min(1),
+  kind: z.string().min(1),
+  location: LocationSchema.optional(),
+  summary: z.string().min(1),
+  confidence: ConfidenceSchema,
+  value: z.unknown().optional(),
+  fingerprint: z.string().min(1).optional()
+});
+var DynamicValueSchema = z.discriminatedUnion("kind", [
+  z.strictObject({ kind: z.literal("literal"), value: z.unknown() }),
+  z.strictObject({ kind: z.literal("symbolic"), expression: z.string() }),
+  z.strictObject({ kind: z.literal("unknown"), reason: z.string() })
+]);
+var QueryFilterSchema = z.strictObject({
+  fieldPath: z.string().min(1),
+  operator: z.enum([
+    "==",
+    "!=",
+    "<",
+    "<=",
+    ">",
+    ">=",
+    "in",
+    "not-in",
+    "array-contains",
+    "array-contains-any"
+  ]),
+  value: DynamicValueSchema
+});
+var QueryOrderSchema = z.strictObject({
+  fieldPath: z.string().min(1),
+  direction: z.enum(["ASCENDING", "DESCENDING"])
+});
+var QueryShapeSchema = z.strictObject({
+  scope: z.enum(["COLLECTION", "COLLECTION_GROUP"]),
+  collectionId: z.string().min(1),
+  pathTemplate: z.string().min(1),
+  filters: z.array(QueryFilterSchema),
+  orderBy: z.array(QueryOrderSchema),
+  limit: DynamicValueSchema.optional(),
+  dynamic: z.boolean(),
+  confidence: ConfidenceSchema,
+  location: LocationSchema
+});
+var PermissionSchema = z.strictObject({
+  name: z.string().min(1),
+  resource: z.string().min(1),
+  operation: OperationSchema
+});
+var RoleSchema = z.strictObject({
+  name: z.string().min(1),
+  permissions: z.array(z.string().min(1))
+});
+var RuleSchema = z.strictObject({
+  id: z.string().min(1),
+  path: z.string().min(1),
+  operations: z.array(OperationSchema),
+  conditionPresent: z.boolean(),
+  authReferences: z.array(z.string()),
+  claimReferences: z.array(z.string()),
+  resourceReferences: z.array(z.string()),
+  requestResourceReferences: z.array(z.string()),
+  confidence: ConfidenceSchema,
+  location: LocationSchema
+});
+var IndexFieldSchema = z.strictObject({
+  fieldPath: z.string().min(1),
+  mode: z.enum(["ASCENDING", "DESCENDING", "ARRAY_CONTAINS", "VECTOR"])
+});
+var FirestoreIndexSchema = z.strictObject({
+  collectionGroup: z.string().min(1),
+  queryScope: z.enum(["COLLECTION", "COLLECTION_GROUP"]),
+  fields: z.array(IndexFieldSchema),
+  location: LocationSchema.optional()
+});
+var GraphEdgeSchema = z.strictObject({
+  from: z.string().min(1),
+  to: z.string().min(1),
+  kind: z.enum([
+    "CALLS",
+    "USES_PERMISSION",
+    "TARGETS_RESOURCE",
+    "GUARDED_BY_RULE",
+    "REQUIRES_INDEX",
+    "REFERENCES_ROLE",
+    "REFERENCES_CLAIM"
+  ]),
+  confidence: ConfidenceSchema,
+  evidenceIds: z.array(z.string())
+});
+var ProjectModelSchema = z.strictObject({
+  schemaVersion: z.literal(1),
+  rootDir: z.string().min(1),
+  firebase: z.strictObject({
+    configFile: z.string().optional(),
+    projectId: z.string().nullable(),
+    databaseId: z.string().nullable(),
+    firestore: z.strictObject({
+      rulesFile: z.string().optional(),
+      indexesFile: z.string().optional()
+    })
+  }),
+  authorization: z.strictObject({
+    adapter: z.string().nullable(),
+    roles: z.array(RoleSchema),
+    permissions: z.array(PermissionSchema)
+  }),
+  queries: z.array(QueryShapeSchema),
+  rules: z.array(RuleSchema),
+  indexes: z.array(FirestoreIndexSchema),
+  evidence: z.array(EvidenceSchema),
+  graph: z.array(GraphEdgeSchema)
+});
+var FindingSchema = z.strictObject({
+  rule: z.string().min(1),
+  severity: SeveritySchema,
+  confidence: ConfidenceSchema,
+  file: z.string().optional(),
+  line: z.number().int().positive().optional(),
+  message: z.string().min(1),
+  evidence: z.array(EvidenceSchema),
+  fix: z.string().optional(),
+  resource: z.string().optional(),
+  operation: OperationSchema.optional(),
+  fingerprint: z.string().min(1),
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+var PermissionNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/);
+var RoleNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*$/);
+var AuditYamlSchema = z.strictObject({
+  authorization: z.strictObject({
+    adapter: z.strictObject({ function: z.string().min(1) }).optional(),
+    roles: z.record(RoleNameSchema, z.strictObject({ permissions: z.array(PermissionNameSchema) })),
+    permissions: z.record(
+      PermissionNameSchema,
+      z.strictObject({ resource: z.string().min(1), operation: OperationSchema })
+    ),
+    claims: z.strictObject({
+      enabled: z.boolean(),
+      roleKey: z.string().min(1),
+      samples: z.record(RoleNameSchema, z.record(z.string().min(1), z.json())).optional()
+    }).optional()
+  })
+});
+
+// src/scan.ts
+import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
+import { parse as parseYaml } from "yaml";
+async function scan(rootDir, opts = {}) {
+  const d = discover(rootDir);
+  const model = emptyModel(rootDir, d);
+  const findings_pre = [];
+  if (!d.firestoreRulesFile || !existsSync3(d.firestoreRulesFile)) {
+    findings_pre.push({
+      rule: "RULES_NOT_OBSERVED",
+      severity: "INFO",
+      confidence: "NOT_OBSERVED",
+      message: "firestore.rules n\xE3o encontrado \u2014 FBA001/FBA002 sem cobertura neste scan.",
+      fingerprint: "RULES_NOT_OBSERVED",
+      evidence: [
+        { id: "ev-no-rules", kind: "rules-missing", summary: "sem rules", confidence: "NOT_OBSERVED" }
+      ]
+    });
+  }
+  if (d.firestoreRulesFile && existsSync3(d.firestoreRulesFile)) {
+    const rel = d.firestoreRulesFile.replace(/\\/g, "/").startsWith(rootDir.replace(/\\/g, "/")) ? d.firestoreRulesFile.slice(rootDir.length + 1).replace(/\\/g, "/") : model.firebase.firestore.rulesFile ?? "firestore.rules";
+    model.rules = extractRules(d.firestoreRulesFile, rel);
+  }
+  if (d.firestoreIndexesFile && existsSync3(d.firestoreIndexesFile)) {
+    try {
+      const raw = JSON.parse(readFileSync4(d.firestoreIndexesFile, "utf-8"));
+      const validModes = ["ASCENDING", "DESCENDING", "ARRAY_CONTAINS", "VECTOR"];
+      const entries = [];
+      let skipped = 0;
+      for (const i of raw.indexes ?? []) {
+        if (typeof i.collectionGroup !== "string" || i.collectionGroup.length === 0) {
+          skipped += 1;
+          continue;
+        }
+        const fields = [];
+        for (const f of i.fields ?? []) {
+          if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0) {
+            skipped += 1;
+            continue;
+          }
+          const mode = f.vectorConfig ? "VECTOR" : f.arrayConfig === "CONTAINS" ? "ARRAY_CONTAINS" : f.order;
+          if (mode !== "ASCENDING" && mode !== "DESCENDING" && mode !== "ARRAY_CONTAINS" && mode !== "VECTOR") {
+            skipped += 1;
+            continue;
+          }
+          fields.push({ fieldPath: f.fieldPath, mode });
+        }
+        entries.push({
+          collectionGroup: i.collectionGroup,
+          queryScope: i.queryScope === "COLLECTION_GROUP" ? "COLLECTION_GROUP" : "COLLECTION",
+          fields
+        });
+      }
+      model.indexes = entries;
+      if (skipped > 0) {
+        findings_pre.push({
+          rule: "INDEXES_INVALID",
+          severity: "WARNING",
+          confidence: "CONFIRMED",
+          message: `firestore.indexes.json com ${skipped} entrada(s) inv\xE1lidas ignoradas \u2014 verifique campos.`,
+          fingerprint: "INDEXES_INVALID",
+          evidence: [
+            { id: "ev-indexes-skipped", kind: "indexes-parse", summary: `${skipped} inv\xE1lidas`, confidence: "CONFIRMED" }
+          ]
+        });
+      }
+    } catch {
+      findings_pre.push({
+        rule: "INDEXES_INVALID",
+        severity: "WARNING",
+        confidence: "CONFIRMED",
+        message: "firestore.indexes.json inv\xE1lido \u2014 \xEDndices ignorados neste scan.",
+        fingerprint: "INDEXES_INVALID",
+        evidence: [
+          { id: "ev-indexes-invalid", kind: "indexes-parse", summary: "JSON inv\xE1lido", confidence: "CONFIRMED" }
+        ]
+      });
+    }
+  }
+  if (d.auditYamlFile && existsSync3(d.auditYamlFile)) {
+    try {
+      const text = readFileSync4(d.auditYamlFile, "utf-8");
+      const parsed = parseYaml(text);
+      const validated = AuditYamlSchema.safeParse(parsed);
+      if (validated.success) {
+        const auth = validated.data.authorization;
+        model.authorization.adapter = auth.adapter?.function ?? null;
+        model.authorization.permissions = Object.entries(auth.permissions).map(([name, p]) => ({
+          name,
+          resource: p.resource,
+          operation: p.operation
+        }));
+        model.authorization.roles = Object.entries(auth.roles).map(([name, r]) => ({
+          name,
+          permissions: r.permissions
+        }));
+      } else {
+        findings_pre.push({
+          rule: "CONTRACT_INVALID",
+          severity: "WARNING",
+          confidence: "CONFIRMED",
+          message: `firebase-audit.yaml existe mas \xE9 inv\xE1lido: ${validated.error.issues[0]?.message ?? "schema"} \u2014 contrato ignorado neste scan.`,
+          fingerprint: "CONTRACT_INVALID",
+          evidence: [
+            { id: "ev-contract-invalid", kind: "contract-parse", summary: "YAML inv\xE1lido", confidence: "CONFIRMED" }
+          ],
+          fix: "Valide contra templates/firebase-audit.yaml."
+        });
+      }
+    } catch (err) {
+      findings_pre.push({
+        rule: "CONTRACT_INVALID",
+        severity: "WARNING",
+        confidence: "CONFIRMED",
+        message: `firebase-audit.yaml n\xE3o p\xF4de ser lido: ${err instanceof Error ? err.message : "erro"} \u2014 contrato ignorado.`,
+        fingerprint: "CONTRACT_INVALID",
+        evidence: [
+          { id: "ev-contract-unreadable", kind: "contract-parse", summary: "leitura falhou", confidence: "CONFIRMED" }
+        ]
+      });
+    }
+  }
+  const checksFindings = await runChecks(model, rootDir, { adapterFn: opts.adapterFn ?? model.authorization.adapter ?? void 0 });
+  const findings = [...findings_pre, ...checksFindings];
+  const modelCheck = ProjectModelSchema.safeParse(model);
+  if (!modelCheck.success) {
+    findings.push({
+      rule: "MODEL_INVALID",
+      severity: "WARNING",
+      confidence: "CONFIRMED",
+      message: `ProjectModel inv\xE1lido: ${modelCheck.error.issues[0]?.message ?? "schema"} \u2014 verifique indexes/rules.`,
+      fingerprint: "MODEL_INVALID",
+      evidence: [
+        { id: "ev-model-invalid", kind: "model-validate", summary: "schema", confidence: "CONFIRMED" }
+      ]
+    });
+  }
+  if (opts.strict) {
+    const hasContract = model.authorization.permissions.length > 0;
+    if (!hasContract) {
+      findings.push({
+        rule: "CONTRACT_MISSING",
+        severity: "ERROR",
+        confidence: "CONFIRMED",
+        message: "Modo --strict exige firebase-audit.yaml com permissions declaradas.",
+        fingerprint: "CONTRACT_MISSING",
+        evidence: [
+          { id: "ev-strict", kind: "strict-mode", summary: "sem contrato", confidence: "CONFIRMED" }
+        ],
+        fix: "Crie firebase-audit.yaml (agente sugere, humano aprova)."
+      });
+    }
+  }
+  const errors = findings.filter((f) => f.severity === "ERROR").length;
+  const warnings = findings.filter((f) => f.severity === "WARNING").length;
+  const infos = findings.filter((f) => f.severity === "INFO").length;
+  return { model, findings, summary: { errors, warnings, infos, passed: IMPLEMENTED_CHECKS.length } };
+}
+
+export {
+  discover,
+  classifyOrigin,
+  emptyModel,
+  stripRuleComments,
+  extractRules,
+  isPublicCondition,
+  findPublicAllows,
+  IMPLEMENTED_CHECKS,
+  runChecks,
+  SeveritySchema,
+  ConfidenceSchema,
+  OperationSchema,
+  AccessOriginSchema,
+  PositionSchema,
+  LocationSchema,
+  EvidenceSchema,
+  DynamicValueSchema,
+  QueryFilterSchema,
+  QueryOrderSchema,
+  QueryShapeSchema,
+  PermissionSchema,
+  RoleSchema,
+  RuleSchema,
+  IndexFieldSchema,
+  FirestoreIndexSchema,
+  GraphEdgeSchema,
+  ProjectModelSchema,
+  FindingSchema,
+  AuditYamlSchema,
+  scan
+};