@justmpm/firebase-audit 0.1.0 → 0.2.0

package/dist/chunk-VKCDUCYE.js

@@ -1,679 +0,0 @@
-// src/discovery.ts
-import { existsSync, readFileSync } from "fs";
-import { join, relative } from "path";
-var SERVER_HINTS = ["functions/", "src/app/api/", "server/", "admin-sdk", "firebase-admin"];
-function discover(rootDir) {
-  const pick = (name) => {
-    const p = join(rootDir, name);
-    return existsSync(p) ? p : null;
-  };
-  const firebaseJson = pick("firebase.json");
-  let projectId = null;
-  let databaseId = null;
-  let rulesFile = pick("firestore.rules");
-  let indexesFile = pick("firestore.indexes.json");
-  if (firebaseJson) {
-    try {
-      const raw = JSON.parse(readFileSync(firebaseJson, "utf-8"));
-      if (typeof raw.firestore?.rules === "string") {
-        const p = join(rootDir, raw.firestore.rules);
-        if (existsSync(p)) rulesFile = p;
-      }
-      if (typeof raw.firestore?.indexes === "string") {
-        const p = join(rootDir, raw.firestore.indexes);
-        if (existsSync(p)) indexesFile = p;
-      }
-    } catch {
-    }
-  }
-  return {
-    rootDir,
-    firebaseJson,
-    firestoreRulesFile: rulesFile,
-    firestoreIndexesFile: indexesFile,
-    auditYamlFile: pick("firebase-audit.yaml"),
-    projectId,
-    databaseId,
-    clientFiles: [],
-    serverFiles: []
-  };
-}
-function classifyOrigin(file, content) {
-  const rel = file.replace(/\\/g, "/");
-  if (content.includes("firebase-admin") || content.includes("firebase-functions")) {
-    return "SERVER";
-  }
-  if (SERVER_HINTS.some((h) => rel.includes(h))) {
-    return "SERVER";
-  }
-  if (rel.includes("src/") || rel.includes("app/") || rel.includes("components/")) {
-    return "CLIENT";
-  }
-  return "UNKNOWN";
-}
-function emptyModel(rootDir, d) {
-  const rel = (abs) => abs ? relative(rootDir, abs).replace(/\\/g, "/") : void 0;
-  return {
-    schemaVersion: 1,
-    rootDir,
-    firebase: {
-      configFile: rel(d.firebaseJson),
-      projectId: d.projectId,
-      databaseId: d.databaseId,
-      firestore: {
-        rulesFile: rel(d.firestoreRulesFile),
-        indexesFile: rel(d.firestoreIndexesFile)
-      }
-    },
-    authorization: { adapter: null, roles: [], permissions: [] },
-    queries: [],
-    rules: [],
-    indexes: [],
-    evidence: [],
-    graph: []
-  };
-}
-
-// src/rules.ts
-import { readFileSync as readFileSync2 } from "fs";
-var MATCH_RE = /match\s+(\/[^\s{]+)\s*\{/g;
-var ALLOW_RE = /allow\s+([^:]+):\s*if\s+([^;]+);/g;
-function opsFrom(target) {
-  const t = target.trim().toLowerCase();
-  if (t === "read") return ["read"];
-  if (t === "write") return ["write", "create", "update", "delete"];
-  const parts = t.split(",").map((s) => s.trim()).filter(Boolean);
-  const valid = ["read", "get", "list", "create", "update", "delete", "write"];
-  const out = [];
-  for (const p of parts) {
-    if (valid.includes(p)) {
-      out.push(p);
-      if (p === "write") {
-        for (const extra of ["create", "update", "delete"]) {
-          if (!out.includes(extra)) out.push(extra);
-        }
-      }
-    }
-  }
-  return out.length > 0 ? out : ["read"];
-}
-function extractRules(rulesFile, relFile) {
-  const content = readFileSync2(rulesFile, "utf-8");
-  const lines = content.split("\n");
-  const rules = [];
-  const matchBlocks = [];
-  let m;
-  MATCH_RE.lastIndex = 0;
-  while ((m = MATCH_RE.exec(content)) !== null) {
-    const before = content.slice(0, m.index);
-    const line = before.split("\n").length;
-    matchBlocks.push({ path: m[1], line, blockStart: m.index });
-  }
-  ALLOW_RE.lastIndex = 0;
-  let a;
-  let idx = 0;
-  while ((a = ALLOW_RE.exec(content)) !== null) {
-    const before = content.slice(0, a.index);
-    const line = before.split("\n").length;
-    const target = a[1];
-    const condition = a[2].trim();
-    const currentMatch = [...matchBlocks].reverse().find((b) => b.blockStart <= a.index);
-    const authReferences = [];
-    if (condition.includes("request.auth")) authReferences.push("request.auth");
-    if (condition.includes("request.auth.uid")) authReferences.push("request.auth.uid");
-    const claimReferences = [...condition.matchAll(/request\.auth\.token\.([A-Za-z0-9_]+)/g)].map(
-      (x) => x[1]
-    );
-    const resourceReferences = [...condition.matchAll(/resource\.data\.([A-Za-z0-9_]+)/g)].map(
-      (x) => x[1]
-    );
-    const requestResourceReferences = [
-      ...condition.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
-    ].map((x) => x[1]);
-    rules.push({
-      id: `rule-${idx++}`,
-      path: currentMatch?.path ?? "/(unknown)",
-      operations: opsFrom(target),
-      conditionPresent: condition.length > 0 && condition !== "true" && condition !== "false",
-      authReferences,
-      claimReferences,
-      resourceReferences,
-      requestResourceReferences,
-      confidence: "CONFIRMED",
-      location: { file: relFile, start: { line, column: 0 } }
-    });
-    void lines;
-  }
-  return rules;
-}
-function findPublicAllows(rulesFile) {
-  const content = readFileSync2(rulesFile, "utf-8");
-  const out = [];
-  const re = /allow\s+([^:]+):\s*if\s+true\s*;/g;
-  let mm;
-  while ((mm = re.exec(content)) !== null) {
-    const line = content.slice(0, mm.index).split("\n").length;
-    out.push({ line, target: mm[1].trim() });
-  }
-  return out;
-}
-
-// src/checks.ts
-import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
-import { executeFind } from "@justmpm/supergrep";
-var evidenceCounter = 0;
-function ev(kind, summary, confidence, file, line) {
-  evidenceCounter += 1;
-  return {
-    id: `ev-${evidenceCounter}`,
-    kind,
-    summary,
-    confidence,
-    location: file && line ? { file, start: { line, column: 0 } } : void 0
-  };
-}
-function make(rule, severity, confidence, message, fingerprint, opts = {}) {
-  return {
-    rule,
-    severity,
-    confidence,
-    message,
-    fingerprint,
-    evidence: [],
-    ...opts
-  };
-}
-async function runChecks(model, rootDir, opts = {}) {
-  const findings = [];
-  const relRules = model.firebase.firestore.rulesFile;
-  const absRules = relRules ? join2(rootDir, relRules) : null;
-  if (absRules && existsSync2(absRules)) {
-    for (const pub of findPublicAllows(absRules)) {
-      const t = pub.target.toLowerCase();
-      const isWrite = t.includes("write") || t.includes("create") || t.includes("update") || t.includes("delete");
-      const isRead = t.includes("read") || t.includes("get") || t.includes("list");
-      if (isWrite) {
-        findings.push(
-          make(
-            "FBA001",
-            "ERROR",
-            "CONFIRMED",
-            `Public write aberto (${pub.target}: if true). Qualquer cliente pode escrever.`,
-            `FBA001:${relRules}:${pub.target}`,
-            {
-              file: relRules,
-              line: pub.line,
-              evidence: [ev("public-allow", `${pub.target}: if true`, "CONFIRMED", relRules, pub.line)],
-              fix: "Troque `if true` por checagem de auth/claim. Se for proposital, documente no contrato."
-            }
-          )
-        );
-      }
-      if (isRead) {
-        findings.push(
-          make(
-            "FBA002",
-            "WARNING",
-            "CONFIRMED",
-            `Leitura p\xFAblica confirmada (${pub.target}: if true). Pode ser proposital.`,
-            `FBA002:${relRules}:${pub.target}`,
-            {
-              file: relRules,
-              line: pub.line,
-              evidence: [ev("public-allow", `${pub.target}: if true`, "CONFIRMED", relRules, pub.line)]
-            }
-          )
-        );
-      }
-    }
-  }
-  const adapterFn = opts.adapterFn ?? "rbac.can";
-  const permissionCalls = await collectPermissionCalls(rootDir, adapterFn);
-  const declared = new Set(model.authorization.permissions.map((p) => p.name));
-  if (permissionCalls.length === 0) {
-    findings.push(
-      make(
-        "FBA009",
-        "WARNING",
-        "UNKNOWN",
-        `Adapter de autoriza\xE7\xE3o "${adapterFn}" n\xE3o observado no c\xF3digo. Sem adapter, permiss\xF5es s\xE3o UNKNOWN.`,
-        `FBA009:${adapterFn}`,
-        { evidence: [ev("adapter-missing", adapterFn, "UNKNOWN")] }
-      )
-    );
-  }
-  for (const call of permissionCalls) {
-    if (!declared.has(call.permission) && declared.size > 0) {
-      findings.push(
-        make(
-          "FBA004",
-          "ERROR",
-          "CONFIRMED",
-          `Permission "${call.permission}" usada mas n\xE3o declarada no contrato.`,
-          `FBA004:${call.file}:${call.permission}`,
-          {
-            file: call.file,
-            line: call.line,
-            resource: call.permission.split(".")[0],
-            evidence: [ev("permission-call", `${adapterFn}("${call.permission}")`, "CONFIRMED", call.file, call.line)],
-            fix: `Declarar "${call.permission}" em firebase-audit.yaml ou corrigir o nome da chamada.`
-          }
-        )
-      );
-    }
-  }
-  const adminHits = await collectAdminImports(rootDir);
-  for (const hit of adminHits) {
-    let origin = "UNKNOWN";
-    try {
-      const content = readFileSync3(join2(rootDir, hit.file), "utf-8");
-      origin = classifyOrigin(hit.file, content);
-    } catch {
-      origin = "UNKNOWN";
-    }
-    if (origin === "CLIENT") {
-      findings.push(
-        make(
-          "FBA003",
-          "ERROR",
-          "PROBABLE",
-          `Admin SDK em arquivo de cliente (${hit.file}). Rules n\xE3o valem aqui \u2014 precisa auth da app.`,
-          `FBA003:${hit.file}`,
-          {
-            file: hit.file,
-            line: hit.line,
-            evidence: [ev("admin-import", hit.text, "PROBABLE", hit.file, hit.line)],
-            fix: "Mover para Functions/API server ou trocar por Client SDK com Rules."
-          }
-        )
-      );
-    }
-  }
-  if (model.indexes.length > 0 && model.queries.length === 0) {
-    findings.push(
-      make(
-        "FBA007",
-        "INFO",
-        "NOT_OBSERVED",
-        "\xCDndices locais sem query observada (query-shape V1 ainda parcial). N\xE3o significa unused.",
-        "FBA007:indexes",
-        { evidence: [ev("index-not-observed", `${model.indexes.length} \xEDndices`, "NOT_OBSERVED")] }
-      )
-    );
-  }
-  return findings;
-}
-async function collectPermissionCalls(rootDir, adapterFn) {
-  const out = [];
-  const short = adapterFn.includes(".") ? adapterFn.split(".").pop() : adapterFn;
-  const patterns = [`${short}($PERM)`, `${adapterFn}($PERM)`];
-  for (const pattern of patterns) {
-    try {
-      const { result } = await executeFind({ pattern, path: ".", cwd: rootDir });
-      for (const m of result.matches) {
-        const perm = (m.metaVariables["PERM"] ?? "").replace(/['"]/g, "").trim();
-        if (perm.length >= 3) {
-          out.push({ file: m.file, line: m.line + 1, permission: perm });
-        }
-      }
-    } catch {
-    }
-  }
-  const seen = /* @__PURE__ */ new Set();
-  return out.filter((o) => {
-    const k = `${o.file}:${o.line}:${o.permission}`;
-    if (seen.has(k)) return false;
-    seen.add(k);
-    return true;
-  });
-}
-async function collectAdminImports(rootDir) {
-  const out = [];
-  try {
-    const { result } = await executeFind({
-      pattern: "import { $$$ITEMS } from '$MODULE'",
-      path: ".",
-      cwd: rootDir
-    });
-    for (const m of result.matches) {
-      const mod = m.metaVariables["MODULE"] ?? "";
-      if (mod.includes("firebase-admin")) {
-        out.push({ file: m.file, line: m.line + 1, text: m.text });
-      }
-    }
-  } catch {
-  }
-  return out;
-}
-
-// src/schemas.ts
-import * as z from "zod";
-var SeveritySchema = z.enum(["ERROR", "WARNING", "INFO"]);
-var ConfidenceSchema = z.enum([
-  "CONFIRMED",
-  "PROBABLE",
-  "NOT_OBSERVED",
-  "UNKNOWN"
-]);
-var OperationSchema = z.enum([
-  "read",
-  "get",
-  "list",
-  "create",
-  "update",
-  "delete",
-  "write"
-]);
-var AccessOriginSchema = z.enum(["CLIENT", "SERVER", "UNKNOWN"]);
-var PositionSchema = z.strictObject({
-  line: z.number().int().positive(),
-  column: z.number().int().nonnegative()
-});
-var LocationSchema = z.strictObject({
-  file: z.string().min(1),
-  start: PositionSchema,
-  end: PositionSchema.optional()
-});
-var EvidenceSchema = z.strictObject({
-  id: z.string().min(1),
-  kind: z.string().min(1),
-  location: LocationSchema.optional(),
-  summary: z.string().min(1),
-  confidence: ConfidenceSchema,
-  value: z.unknown().optional(),
-  fingerprint: z.string().min(1).optional()
-});
-var DynamicValueSchema = z.discriminatedUnion("kind", [
-  z.strictObject({ kind: z.literal("literal"), value: z.unknown() }),
-  z.strictObject({ kind: z.literal("symbolic"), expression: z.string() }),
-  z.strictObject({ kind: z.literal("unknown"), reason: z.string() })
-]);
-var QueryFilterSchema = z.strictObject({
-  fieldPath: z.string().min(1),
-  operator: z.enum([
-    "==",
-    "!=",
-    "<",
-    "<=",
-    ">",
-    ">=",
-    "in",
-    "not-in",
-    "array-contains",
-    "array-contains-any"
-  ]),
-  value: DynamicValueSchema
-});
-var QueryOrderSchema = z.strictObject({
-  fieldPath: z.string().min(1),
-  direction: z.enum(["ASCENDING", "DESCENDING"])
-});
-var QueryShapeSchema = z.strictObject({
-  scope: z.enum(["COLLECTION", "COLLECTION_GROUP"]),
-  collectionId: z.string().min(1),
-  pathTemplate: z.string().min(1),
-  filters: z.array(QueryFilterSchema),
-  orderBy: z.array(QueryOrderSchema),
-  limit: DynamicValueSchema.optional(),
-  dynamic: z.boolean(),
-  confidence: ConfidenceSchema,
-  location: LocationSchema
-});
-var PermissionSchema = z.strictObject({
-  name: z.string().min(3),
-  resource: z.string().min(1),
-  operation: OperationSchema
-});
-var RoleSchema = z.strictObject({
-  name: z.string().min(1),
-  permissions: z.array(z.string().min(1))
-});
-var RuleSchema = z.strictObject({
-  id: z.string().min(1),
-  path: z.string().min(1),
-  operations: z.array(OperationSchema),
-  conditionPresent: z.boolean(),
-  authReferences: z.array(z.string()),
-  claimReferences: z.array(z.string()),
-  resourceReferences: z.array(z.string()),
-  requestResourceReferences: z.array(z.string()),
-  confidence: ConfidenceSchema,
-  location: LocationSchema
-});
-var IndexFieldSchema = z.strictObject({
-  fieldPath: z.string().min(1),
-  mode: z.enum(["ASCENDING", "DESCENDING", "ARRAY_CONTAINS", "VECTOR"])
-});
-var FirestoreIndexSchema = z.strictObject({
-  collectionGroup: z.string().min(1),
-  queryScope: z.enum(["COLLECTION", "COLLECTION_GROUP"]),
-  fields: z.array(IndexFieldSchema),
-  location: LocationSchema.optional()
-});
-var GraphEdgeSchema = z.strictObject({
-  from: z.string().min(1),
-  to: z.string().min(1),
-  kind: z.enum([
-    "CALLS",
-    "USES_PERMISSION",
-    "TARGETS_RESOURCE",
-    "GUARDED_BY_RULE",
-    "REQUIRES_INDEX",
-    "REFERENCES_ROLE",
-    "REFERENCES_CLAIM"
-  ]),
-  confidence: ConfidenceSchema,
-  evidenceIds: z.array(z.string())
-});
-var ProjectModelSchema = z.strictObject({
-  schemaVersion: z.literal(1),
-  rootDir: z.string().min(1),
-  firebase: z.strictObject({
-    configFile: z.string().optional(),
-    projectId: z.string().nullable(),
-    databaseId: z.string().nullable(),
-    firestore: z.strictObject({
-      rulesFile: z.string().optional(),
-      indexesFile: z.string().optional()
-    })
-  }),
-  authorization: z.strictObject({
-    adapter: z.string().nullable(),
-    roles: z.array(RoleSchema),
-    permissions: z.array(PermissionSchema)
-  }),
-  queries: z.array(QueryShapeSchema),
-  rules: z.array(RuleSchema),
-  indexes: z.array(FirestoreIndexSchema),
-  evidence: z.array(EvidenceSchema),
-  graph: z.array(GraphEdgeSchema)
-});
-var FindingSchema = z.strictObject({
-  rule: z.string().min(1),
-  severity: SeveritySchema,
-  confidence: ConfidenceSchema,
-  file: z.string().optional(),
-  line: z.number().int().positive().optional(),
-  message: z.string().min(1),
-  evidence: z.array(EvidenceSchema),
-  fix: z.string().optional(),
-  resource: z.string().optional(),
-  operation: OperationSchema.optional(),
-  fingerprint: z.string().min(1),
-  metadata: z.record(z.string(), z.unknown()).optional()
-});
-var PermissionNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)?$/);
-var RoleNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*$/);
-var AuditYamlSchema = z.strictObject({
-  authorization: z.strictObject({
-    adapter: z.strictObject({ function: z.string().min(1) }).optional(),
-    roles: z.record(RoleNameSchema, z.strictObject({ permissions: z.array(PermissionNameSchema) })),
-    permissions: z.record(
-      PermissionNameSchema,
-      z.strictObject({ resource: z.string().min(1), operation: OperationSchema })
-    ),
-    claims: z.strictObject({
-      enabled: z.boolean(),
-      roleKey: z.string().min(1),
-      samples: z.record(RoleNameSchema, z.record(z.string().min(1), z.json())).optional()
-    }).optional()
-  })
-});
-
-// src/scan.ts
-import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
-async function scan(rootDir, opts = {}) {
-  const d = discover(rootDir);
-  const model = emptyModel(rootDir, d);
-  if (d.firestoreRulesFile && existsSync3(d.firestoreRulesFile)) {
-    const rel = d.firestoreRulesFile.replace(/\\/g, "/").startsWith(rootDir.replace(/\\/g, "/")) ? d.firestoreRulesFile.slice(rootDir.length + 1).replace(/\\/g, "/") : model.firebase.firestore.rulesFile ?? "firestore.rules";
-    model.rules = extractRules(d.firestoreRulesFile, rel);
-  }
-  if (d.firestoreIndexesFile && existsSync3(d.firestoreIndexesFile)) {
-    try {
-      const raw = JSON.parse(readFileSync4(d.firestoreIndexesFile, "utf-8"));
-      model.indexes = raw.indexes?.map((i) => ({
-        collectionGroup: i.collectionGroup ?? "(unknown)",
-        queryScope: i.queryScope === "COLLECTION_GROUP" ? "COLLECTION_GROUP" : "COLLECTION",
-        fields: (i.fields ?? []).map((f) => ({
-          fieldPath: f.fieldPath ?? "(unknown)",
-          mode: f.arrayConfig ? "ARRAY_CONTAINS" : f.order ?? "ASCENDING"
-        }))
-      })) ?? [];
-    } catch {
-    }
-  }
-  if (d.auditYamlFile && existsSync3(d.auditYamlFile)) {
-    try {
-      const text = readFileSync4(d.auditYamlFile, "utf-8");
-      const parsed = parseSimpleYaml(text);
-      const validated = AuditYamlSchema.safeParse(parsed);
-      if (validated.success) {
-        const auth = validated.data.authorization;
-        model.authorization.adapter = auth.adapter?.function ?? null;
-        model.authorization.permissions = Object.entries(auth.permissions).map(([name, p]) => ({
-          name,
-          resource: p.resource,
-          operation: p.operation
-        }));
-        model.authorization.roles = Object.entries(auth.roles).map(([name, r]) => ({
-          name,
-          permissions: r.permissions
-        }));
-      }
-    } catch {
-    }
-  }
-  const findings = await runChecks(model, rootDir, { adapterFn: opts.adapterFn ?? model.authorization.adapter ?? void 0 });
-  if (opts.strict) {
-    const hasContract = model.authorization.permissions.length > 0;
-    if (!hasContract) {
-      findings.push({
-        rule: "CONTRACT_MISSING",
-        severity: "ERROR",
-        confidence: "CONFIRMED",
-        message: "Modo --strict exige firebase-audit.yaml com permissions declaradas.",
-        fingerprint: "CONTRACT_MISSING",
-        evidence: [
-          { id: "ev-strict", kind: "strict-mode", summary: "sem contrato", confidence: "CONFIRMED" }
-        ],
-        fix: "Crie firebase-audit.yaml (agente sugere, humano aprova)."
-      });
-    }
-  }
-  const errors = findings.filter((f) => f.severity === "ERROR").length;
-  const warnings = findings.filter((f) => f.severity === "WARNING").length;
-  const infos = findings.filter((f) => f.severity === "INFO").length;
-  return { model, findings, summary: { errors, warnings, infos, passed: findings.length === 0 ? 10 : 0 } };
-}
-function parseSimpleYaml(text) {
-  const lines = text.split("\n");
-  const root = {};
-  const stack = [
-    { indent: -1, obj: root }
-  ];
-  let pendingListKey = null;
-  const cur = () => stack[stack.length - 1].obj;
-  for (const rawLine of lines) {
-    const line = rawLine.replace(/\t/g, "  ");
-    if (line.trim() === "" || line.trim().startsWith("#")) continue;
-    const indent = line.length - line.trimStart().length;
-    const trimmed = line.trim();
-    if (trimmed.startsWith("- ")) {
-      const val = trimmed.slice(2).trim();
-      if (pendingListKey && indent >= pendingListKey.indent) {
-        pendingListKey.arr.push(val);
-        continue;
-      }
-      continue;
-    }
-    while (stack.length > 1 && indent <= stack[stack.length - 1].indent) {
-      stack.pop();
-    }
-    pendingListKey = null;
-    const colon = trimmed.indexOf(":");
-    if (colon === -1) continue;
-    const key = trimmed.slice(0, colon).trim();
-    const rest = trimmed.slice(colon + 1).trim();
-    if (rest === "") {
-      const child = {};
-      cur()[key] = child;
-      stack.push({ indent, obj: child, key });
-      const arr = [];
-      child.__maybeList = arr;
-      pendingListKey = { indent: indent + 1, arr };
-      stack[stack.length - 1].listProbe = arr;
-      void join3;
-    } else {
-      const parent = cur();
-      delete parent.__maybeList;
-      parent[key] = rest === "true" ? true : rest === "false" ? false : rest;
-    }
-  }
-  const fix = (o) => {
-    if (Array.isArray(o)) return o.map(fix);
-    if (o && typeof o === "object") {
-      const rec = o;
-      if (Array.isArray(rec.__maybeList) && Object.keys(rec).length === 1) {
-        return rec.__maybeList;
-      }
-      delete rec.__maybeList;
-      for (const k of Object.keys(rec)) rec[k] = fix(rec[k]);
-      return rec;
-    }
-    return o;
-  };
-  return fix(root);
-}
-
-export {
-  discover,
-  classifyOrigin,
-  emptyModel,
-  extractRules,
-  findPublicAllows,
-  runChecks,
-  SeveritySchema,
-  ConfidenceSchema,
-  OperationSchema,
-  AccessOriginSchema,
-  PositionSchema,
-  LocationSchema,
-  EvidenceSchema,
-  DynamicValueSchema,
-  QueryFilterSchema,
-  QueryOrderSchema,
-  QueryShapeSchema,
-  PermissionSchema,
-  RoleSchema,
-  RuleSchema,
-  IndexFieldSchema,
-  FirestoreIndexSchema,
-  GraphEdgeSchema,
-  ProjectModelSchema,
-  FindingSchema,
-  AuditYamlSchema,
-  scan
-};