@justmpm/firebase-audit 0.2.0 → 0.3.0

package/dist/chunk-CPEIPRCF.js

@@ -0,0 +1,79 @@
+// src/verify.ts
+import { readFileSync, existsSync } from "fs";
+function planVerify(model) {
+  const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
+  const expand = (op) => {
+    if (op === "read") return ["get", "list"];
+    if (op === "get" || op === "list" || op === "create" || op === "update" || op === "delete") return [op];
+    if (op === "write") return ["create", "update", "delete"];
+    return [];
+  };
+  const cases = [];
+  for (const rule of model.rules) {
+    for (const role of roles) {
+      for (const op of rule.operations) {
+        for (const mapped of expand(op)) {
+          const isList = mapped === "list";
+          const path = isList ? rule.path.replace(/\{[^}]+\}/g, "demo-id").replace(/\/demo-id$/, "") : rule.path.replace(/\{[^}]+\}/g, "demo-id");
+          cases.push({ role, operation: mapped, path, pathTemplate: rule.path, expected: "UNKNOWN" });
+        }
+      }
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return cases.filter((c) => {
+    const k = `${c.role}:${c.operation}:${c.path}`;
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+}
+function verify(model, opts = {}) {
+  const cases = planVerify(model);
+  const findings = [];
+  const uncovered = [];
+  if (opts.coverageFile) {
+    if (!existsSync(opts.coverageFile)) {
+      findings.push({
+        rule: "COVERAGE_NOT_OBSERVED",
+        severity: "INFO",
+        confidence: "NOT_OBSERVED",
+        message: "Cobertura n\xE3o encontrada \u2014 rode `firebase emulators:exec` e passe --coverage=coverage.json.",
+        fingerprint: "COVERAGE_NOT_OBSERVED",
+        evidence: [{ id: "ev-no-coverage", kind: "coverage-missing", summary: "sem coverage", confidence: "NOT_OBSERVED" }],
+        fix: 'firebase emulators:exec --only firestore "npm test" + curl :ruleCoverage'
+      });
+    } else {
+      try {
+        const raw = JSON.parse(readFileSync(opts.coverageFile, "utf-8"));
+        void raw;
+        findings.push({
+          rule: "COVERAGE_NOT_EVALUATED",
+          severity: "WARNING",
+          confidence: "NOT_OBSERVED",
+          message: "Coverage recebido mas ainda n\xE3o avaliado nesta vers\xE3o (formato :ruleCoverage inst\xE1vel) \u2014 uncovered lista tudo por honestidade.",
+          fingerprint: "COVERAGE_NOT_EVALUATED",
+          evidence: [{ id: "ev-coverage-ne", kind: "coverage-parse", summary: "n\xE3o avaliado", confidence: "NOT_OBSERVED" }]
+        });
+      } catch {
+        findings.push({
+          rule: "COVERAGE_INVALID",
+          severity: "WARNING",
+          confidence: "CONFIRMED",
+          message: "Arquivo de cobertura inv\xE1lido \u2014 Verifier sem cobertura neste run.",
+          fingerprint: "COVERAGE_INVALID",
+          evidence: [{ id: "ev-coverage", kind: "coverage-parse", summary: "JSON inv\xE1lido", confidence: "CONFIRMED" }]
+        });
+      }
+    }
+  }
+  for (const rule of model.rules) {
+    uncovered.push(rule.path);
+  }
+  return { cases, uncovered, findings };
+}
+
+export {
+  planVerify,
+  verify
+};

package/dist/chunk-GUSNXUAT.js

@@ -0,0 +1,147 @@
+// src/drift.ts
+import { readFileSync, existsSync } from "fs";
+function normalizeMode(f) {
+  if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0 || f.fieldPath === "__name__") return null;
+  if (f.vectorConfig !== void 0 && f.vectorConfig !== null) return { fieldPath: f.fieldPath, mode: "VECTOR" };
+  if (f.arrayConfig === "CONTAINS") return { fieldPath: f.fieldPath, mode: "ARRAY_CONTAINS" };
+  if (typeof f.mode === "string" && (f.mode === "ASCENDING" || f.mode === "DESCENDING" || f.mode === "ARRAY_CONTAINS" || f.mode === "VECTOR")) {
+    return { fieldPath: f.fieldPath, mode: f.mode };
+  }
+  if (typeof f.order === "string" && (f.order === "ASCENDING" || f.order === "DESCENDING")) {
+    return { fieldPath: f.fieldPath, mode: f.order };
+  }
+  return null;
+}
+function normalizeEntry(raw) {
+  let cg = typeof raw.collectionGroup === "string" ? raw.collectionGroup : void 0;
+  if (!cg && typeof raw.name === "string") {
+    const m = raw.name.match(/collectionGroups\/([^/]+)\/indexes\//);
+    if (m) cg = m[1];
+  }
+  if (!cg) return null;
+  const scope = raw.queryScope === "COLLECTION_GROUP" ? "COLLECTION_GROUP" : "COLLECTION";
+  const fields = [];
+  if (Array.isArray(raw.fields)) {
+    for (const f of raw.fields) {
+      const n = normalizeMode(f);
+      if (n) fields.push(n);
+    }
+  }
+  return { collectionGroup: cg, queryScope: scope, fields };
+}
+function keyOf(i) {
+  const fields = i.fields.map((f) => `${f.fieldPath}:${f.mode}`).join(",");
+  return `${i.collectionGroup}|${i.queryScope}|${fields}`;
+}
+function normalizeList(raw) {
+  if (Array.isArray(raw)) return raw;
+  if (raw && typeof raw === "object" && Array.isArray(raw.indexes)) {
+    return raw.indexes;
+  }
+  return [];
+}
+function drift(localFile, remoteFile) {
+  const findings = [];
+  let local = [];
+  let remote = [];
+  if (localFile && existsSync(localFile)) {
+    try {
+      const raw = JSON.parse(readFileSync(localFile, "utf-8"));
+      const rawIndexes = normalizeList(raw);
+      const parsed = [];
+      let skipped = 0;
+      for (const r of rawIndexes) {
+        const n = normalizeEntry(r);
+        if (n) parsed.push(n);
+        else skipped += 1;
+      }
+      local = parsed;
+      if (skipped > 0) {
+        findings.push({
+          rule: "DRIFT_LOCAL_SKIPPED",
+          severity: "INFO",
+          confidence: "NOT_OBSERVED",
+          message: `${skipped} \xEDndice(s) local(is) ignorados por formato inv\xE1lido.`,
+          fingerprint: "DRIFT_LOCAL_SKIPPED",
+          evidence: [{ id: "ev-drift-skip", kind: "drift-parse", summary: `${skipped} ignorados`, confidence: "NOT_OBSERVED" }]
+        });
+      }
+    } catch {
+      findings.push({
+        rule: "DRIFT_LOCAL_INVALID",
+        severity: "WARNING",
+        confidence: "CONFIRMED",
+        message: "\xCDndices locais inv\xE1lidos \u2014 drift sem base local.",
+        fingerprint: "DRIFT_LOCAL_INVALID",
+        evidence: [{ id: "ev-drift-local", kind: "drift-parse", summary: "local inv\xE1lido", confidence: "CONFIRMED" }]
+      });
+    }
+  }
+  if (remoteFile && existsSync(remoteFile)) {
+    try {
+      const list = normalizeList(JSON.parse(readFileSync(remoteFile, "utf-8")));
+      const parsed = [];
+      let skipped = 0;
+      for (const r of list) {
+        const n = normalizeEntry(r);
+        if (n) parsed.push(n);
+        else skipped += 1;
+      }
+      remote = parsed;
+      if (skipped > 0) {
+        findings.push({
+          rule: "DRIFT_REMOTE_SKIPPED",
+          severity: "INFO",
+          confidence: "NOT_OBSERVED",
+          message: `${skipped} \xEDndice(s) remoto(s) ignorados por formato inv\xE1lido.`,
+          fingerprint: "DRIFT_REMOTE_SKIPPED",
+          evidence: [{ id: "ev-drift-rskip", kind: "drift-parse", summary: `${skipped} ignorados`, confidence: "NOT_OBSERVED" }]
+        });
+      }
+    } catch {
+      findings.push({
+        rule: "DRIFT_REMOTE_INVALID",
+        severity: "WARNING",
+        confidence: "CONFIRMED",
+        message: "\xCDndices remotos inv\xE1lidos \u2014 drift sem base remota.",
+        fingerprint: "DRIFT_REMOTE_INVALID",
+        evidence: [{ id: "ev-drift-remote", kind: "drift-parse", summary: "remoto inv\xE1lido", confidence: "CONFIRMED" }]
+      });
+    }
+  }
+  const remoteByKey = new Map(remote.map((r) => [keyOf(r), r]));
+  const localByKey = new Map(local.map((l) => [keyOf(l), l]));
+  const entries = [];
+  for (const [key, l] of localByKey) {
+    if (remoteByKey.has(key)) entries.push({ key, status: "MATCHED", local: l, remote: remoteByKey.get(key) });
+    else {
+      entries.push({ key, status: "LOCAL_ONLY", local: l });
+      findings.push({
+        rule: "DRIFT_LOCAL_ONLY",
+        severity: "INFO",
+        confidence: "NOT_OBSERVED",
+        message: `\xCDndice s\xF3 local: ${key} \u2014 pode faltar deploy, n\xE3o significa unused remoto.`,
+        fingerprint: `DRIFT_LOCAL_ONLY:${key}`,
+        evidence: [{ id: `ev-drift-${entries.length}`, kind: "drift", summary: key, confidence: "NOT_OBSERVED" }]
+      });
+    }
+  }
+  for (const [key, r] of remoteByKey) {
+    if (!localByKey.has(key)) {
+      entries.push({ key, status: "REMOTE_ONLY", remote: r });
+      findings.push({
+        rule: "DRIFT_REMOTE_ONLY",
+        severity: "INFO",
+        confidence: "NOT_OBSERVED",
+        message: `\xCDndice s\xF3 em produ\xE7\xE3o: ${key} \u2014 pode ser de outro consumidor, n\xE3o significa unused.`,
+        fingerprint: `DRIFT_REMOTE_ONLY:${key}`,
+        evidence: [{ id: `ev-drift-r-${entries.length}`, kind: "drift", summary: key, confidence: "NOT_OBSERVED" }]
+      });
+    }
+  }
+  return { entries, findings };
+}
+
+export {
+  drift
+};

package/dist/{chunk-PIRAC3KT.js → chunk-N57MCLTZ.js}

@@ -1,3 +1,7 @@
+// src/scan.ts
+import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
+import { parse as parseYaml } from "yaml";
+
 // src/discovery.ts
 import { existsSync, readFileSync } from "fs";
 import { join, relative } from "path";
@@ -53,20 +57,18 @@ var SERVER_HINTS_SEGMENTS = [
   "api",
   "scripts"
 ];
-function hasPathSegment(rel, seg) {
-  return rel.split("/").includes(seg);
-}
 function classifyOrigin(file, content) {
   const rel = file.replace(/\\/g, "/");
-  if (rel.includes("app/api/") || rel.includes("/app/") && rel.endsWith("route.ts") || rel.includes("/app/") && rel.endsWith("route.js")) {
+  const segs = rel.split("/");
+  const hasSeg = (...names) => names.some((n) => segs.includes(n));
+  if (rel.includes("app/api/") || rel.includes("pages/api/") || hasSeg("api") && segs.includes("pages")) {
     return "SERVER";
   }
-  if (rel.includes("src/app/api/")) return "SERVER";
-  if (SERVER_HINTS_SEGMENTS.some((s) => hasPathSegment(rel, s))) {
-    if (hasPathSegment(rel, "functions") || hasPathSegment(rel, "server") || hasPathSegment(rel, "backend") || hasPathSegment(rel, "scripts") || rel.includes("src/app/api/") || rel.includes("app/api/")) {
-      return "SERVER";
-    }
+  if (segs.includes("app") && rel.endsWith("route.ts") || segs.includes("app") && rel.endsWith("route.js")) {
+    return "SERVER";
   }
+  if (rel.includes("src/app/api/")) return "SERVER";
+  if (hasSeg("functions", "server", "backend", "scripts")) return "SERVER";
   if (content.includes("firebase-admin") || content.includes("firebase-functions")) {
     return "CLIENT";
   }
@@ -165,6 +167,30 @@ function opsFrom(target) {
   }
   return { ops: out, known: out.length > 0 && known };
 }
+function findBlockEnd(content, openBraceIndex) {
+  let depth = 0;
+  let quote = null;
+  for (let i = openBraceIndex; i < content.length; i++) {
+    const c = content[i];
+    if (quote) {
+      if (c === quote && content[i - 1] !== "\\") quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      continue;
+    }
+    if (c === "{") depth += 1;
+    else if (c === "}") {
+      depth -= 1;
+      if (depth === 0) return i + 1;
+    }
+  }
+  return content.length;
+}
+function normalizeTarget(target) {
+  return target.toLowerCase().split(",").map((s) => s.trim()).filter(Boolean).sort().join(",");
+}
 function extractRules(rulesFile, relFile) {
   const rawContent = readFileSync2(rulesFile, "utf-8");
   const content = stripRuleComments(rawContent);
@@ -175,7 +201,8 @@ function extractRules(rulesFile, relFile) {
   while ((m = matchRe.exec(content)) !== null) {
     const before = content.slice(0, m.index);
     const line = before.split("\n").length;
-    matchBlocks.push({ path: m[1], line, blockStart: m.index });
+    const openBrace = m.index + m[0].length - 1;
+    matchBlocks.push({ path: m[1], line, blockStart: m.index, blockEnd: findBlockEnd(content, openBrace) });
   }
   const allowRe = new RegExp(ALLOW_RE.source, "g");
   let a;
@@ -186,7 +213,8 @@ function extractRules(rulesFile, relFile) {
     const target = a[1];
     const condition = (a[2] ?? "").trim();
     const unconditional = a[2] === void 0;
-    const currentMatch = [...matchBlocks].reverse().find((b) => b.blockStart <= a.index);
+    const containing = matchBlocks.filter((b) => b.blockStart <= a.index && a.index < b.blockEnd);
+    const currentMatch = containing.sort((x, y) => y.blockStart - x.blockStart)[0];
     const authReferences = [];
     if (condition.includes("request.auth")) authReferences.push("request.auth");
     if (condition.includes("request.auth.uid")) authReferences.push("request.auth.uid");
@@ -205,6 +233,7 @@ function extractRules(rulesFile, relFile) {
       path: currentMatch?.path ?? "/(unknown)",
       operations: ops,
       conditionPresent: !unconditional && condition.length > 0,
+      condition: unconditional ? void 0 : condition,
       authReferences,
       claimReferences,
       resourceReferences,
@@ -243,7 +272,7 @@ function isPublicCondition(condition) {
     return { isPublic: false, confidence: "CONFIRMED" };
   }
   if (low === "true") return { isPublic: true, confidence: "CONFIRMED" };
-  if (/(^|\|\|)true($|\|\||&&)/.test(low)) return { isPublic: true, confidence: "PROBABLE" };
+  if (/(^|\|\|)true($|\|\|)/.test(low)) return { isPublic: true, confidence: "PROBABLE" };
   if (low.includes("request.auth==null") || low.includes("request.auth===null")) {
     return { isPublic: true, confidence: "CONFIRMED" };
   }
@@ -256,7 +285,10 @@ function findPublicAllows(rulesFile) {
   const matchRe = new RegExp(MATCH_RE.source, "g");
   const blocks = [];
   let mm0;
-  while ((mm0 = matchRe.exec(content)) !== null) blocks.push({ path: mm0[1], index: mm0.index });
+  while ((mm0 = matchRe.exec(content)) !== null) {
+    const openBrace = mm0.index + mm0[0].length - 1;
+    blocks.push({ path: mm0[1], index: mm0.index, end: findBlockEnd(content, openBrace) });
+  }
   const re = new RegExp(ALLOW_RE.source, "g");
   let mm;
   while ((mm = re.exec(content)) !== null) {
@@ -264,7 +296,8 @@ function findPublicAllows(rulesFile) {
     const target = mm[1].trim();
     const check = isPublicCondition(mm[2]);
     if (!check.isPublic) continue;
-    const path = [...blocks].reverse().find((b) => b.index <= mm.index)?.path ?? "/(unknown)";
+    const containing = blocks.filter((b) => b.index <= mm.index && mm.index < b.end);
+    const path = containing.sort((x, y) => y.index - x.index)[0]?.path ?? "/(unknown)";
     out.push({ line, target, path, confidence: check.confidence });
   }
   return out;
@@ -319,7 +352,7 @@ async function runChecks(model, rootDir, opts = {}) {
             "ERROR",
             pub.confidence,
             `Escrita p\xFAblica em ${pub.path} (${pub.target}). Qualquer cliente pode escrever.`,
-            `FBA001:${relRules}:${pub.path}:${pub.target}`,
+            `FBA001:${relRules}:${pub.path}:${normalizeTarget(pub.target)}`,
             {
               file: relRules,
               line: pub.line,
@@ -337,7 +370,7 @@ async function runChecks(model, rootDir, opts = {}) {
             "WARNING",
             pub.confidence,
             `Leitura p\xFAblica em ${pub.path} (${pub.target}). Pode ser proposital.`,
-            `FBA002:${relRules}:${pub.path}:${pub.target}`,
+            `FBA002:${relRules}:${pub.path}:${normalizeTarget(pub.target)}`,
             {
               file: relRules,
               line: pub.line,
@@ -431,14 +464,20 @@ async function runChecks(model, rootDir, opts = {}) {
       );
     }
   }
-  const publicPaths = new Set(
-    absRules && existsSync2(absRules) ? findPublicAllows(absRules).map((p) => `${p.path}::${p.target}`) : []
-  );
   const expandOp = (op) => {
     if (op === "read") return ["read", "get", "list"];
     if (op === "write") return ["write", "create", "update", "delete"];
     return [op];
   };
+  const publicPaths = /* @__PURE__ */ new Set();
+  if (absRules && existsSync2(absRules)) {
+    for (const p of findPublicAllows(absRules)) {
+      const { ops } = opsFrom(p.target);
+      for (const op of /* @__PURE__ */ new Set([...ops, ...ops.flatMap(expandOp)])) {
+        publicPaths.add(`${p.path}::${op.toLowerCase()}`);
+      }
+    }
+  }
   const permsByResource = /* @__PURE__ */ new Map();
   for (const p of model.authorization.permissions) {
     const holders = model.authorization.roles.filter((r) => r.permissions.includes(p.name)).map((r) => r.name);
@@ -447,29 +486,28 @@ async function runChecks(model, rootDir, opts = {}) {
     list.push({ perm: p.name, operation: p.operation, adminOnly });
     permsByResource.set(p.resource, list);
   }
-  for (const rule of model.rules) {
-    const resourceKey = rule.path.replace(/^\/+/, "").split("/")[0] ?? "";
-    if (resourceKey === "databases" || resourceKey === "(unknown)" || resourceKey === "") continue;
-    const entries = permsByResource.get(resourceKey);
-    if (!entries || entries.length === 0) continue;
+  const checkRuleAgainstEntries = (rule, resourceKey, entries) => {
     const ruleOps = new Set(rule.operations.flatMap(expandOp));
-    const restricted = entries.filter((e) => e.adminOnly && ruleOps.has(e.operation));
-    if (restricted.length === 0) continue;
-    const isPublicRule = rule.operations.some(
-      (op) => publicPaths.has(`${rule.path}::${op}`)
-    ) || rule.operations.some((op) => publicPaths.has(`${rule.path}::read, ${op}`));
-    if (isPublicRule) continue;
+    const restricted = entries.filter(
+      (e) => e.adminOnly && expandOp(e.operation).some((o) => ruleOps.has(o))
+    );
+    if (restricted.length === 0) return;
+    const isPublicRule = [...ruleOps].some(
+      (op) => publicPaths.has(`${rule.path}::${op.toLowerCase()}`)
+    );
+    if (isPublicRule) return;
     const checksAdminClaim = rule.claimReferences.some((c) => c.toLowerCase() === "admin");
-    if (checksAdminClaim) continue;
+    const checksAdminRole = /token\.\w+\s*==\s*['"]admin['"]/i.test(rule.condition ?? "");
+    if (checksAdminClaim || checksAdminRole) return;
     const checksAuth = rule.authReferences.length > 0;
-    if (!checksAuth) continue;
+    if (!checksAuth) return;
     findings.push(
       make(
         "FBA012",
         "WARNING",
         "PROBABLE",
         `Rule ${rule.path} [${rule.operations.join(", ")}] aceita autenticado sem checar claim de admin, mas contrato restringe ${restricted.map((r) => r.perm).join(", ")} a admin.`,
-        `FBA012:${rule.path}:${[...rule.operations].sort().join(",")}`,
+        `FBA012:${rule.path}:${[...rule.operations].sort().join(",")}:${rule.location.start.line}:${resourceKey}`,
         {
           file: rule.location.file,
           line: rule.location.start.line,
@@ -479,6 +517,27 @@ async function runChecks(model, rootDir, opts = {}) {
         }
       )
     );
+  };
+  for (const rule of model.rules) {
+    const segments = rule.path.replace(/^\/+/, "").split("/").filter(Boolean);
+    if (segments.length === 0 || segments[0] === "(unknown)") continue;
+    if (segments[0] === "databases") {
+      const docIdx = segments.indexOf("documents");
+      const candidate = docIdx !== -1 ? segments[docIdx + 1] : void 0;
+      if (!candidate || candidate.startsWith("{")) continue;
+      const entriesAbs = permsByResource.get(candidate);
+      if (!entriesAbs) continue;
+      checkRuleAgainstEntries(rule, candidate, entriesAbs);
+      continue;
+    }
+    const tried = /* @__PURE__ */ new Set();
+    for (const seg of segments) {
+      if (seg.startsWith("{") || seg.startsWith("(") || tried.has(seg)) continue;
+      tried.add(seg);
+      const entries = permsByResource.get(seg);
+      if (!entries || entries.length === 0) continue;
+      checkRuleAgainstEntries(rule, seg, entries);
+    }
   }
   for (const dyn of permissionCalls.dynamic) {
     findings.push(
@@ -528,9 +587,6 @@ async function runChecks(model, rootDir, opts = {}) {
 async function collectPermissionCalls(rootDir, adapterFn) {
   const literals = [];
   const dynamic = [];
-  if (!adapterFn.includes(".")) {
-    return { literals, dynamic };
-  }
   const bases = [adapterFn];
   const patterns = [];
   for (const b of bases) {
@@ -549,10 +605,25 @@ async function collectPermissionCalls(rootDir, adapterFn) {
       for (const m of result.matches) {
         const raw = (m.metaVariables["PERM"] ?? "").trim();
         const line = m.line + 1;
-        const isQuoted = /^['"].*['"]$/.test(raw);
+        if (raw.includes("${")) {
+          const k = `${m.file}:${line}:${raw}`;
+          if (!seen.has(k)) {
+            seen.add(k);
+            dynamic.push({ file: m.file, line, text: m.text });
+          }
+          continue;
+        }
+        const isQuoted = /^['"`].*['"`]$/.test(raw);
         if (isQuoted) {
-          const perm = raw.replace(/^['"]|['"]$/g, "").trim();
+          const perm = raw.replace(/^['"`]|['"`]$/g, "").trim();
           if (perm.length >= 3) pushLiteral(m.file, line, perm);
+          else if (perm.length > 0) {
+            const k = `${m.file}:${line}:${raw}:short`;
+            if (!seen.has(k)) {
+              seen.add(k);
+              dynamic.push({ file: m.file, line, text: m.text });
+            }
+          }
         } else if (raw.length > 0) {
           const k = `${m.file}:${line}:${raw}`;
           if (!seen.has(k)) {
@@ -682,6 +753,7 @@ var RuleSchema = z.strictObject({
   path: z.string().min(1),
   operations: z.array(OperationSchema),
   conditionPresent: z.boolean(),
+  condition: z.string().optional(),
   authReferences: z.array(z.string()),
   claimReferences: z.array(z.string()),
   resourceReferences: z.array(z.string()),
@@ -753,7 +825,7 @@ var FindingSchema = z.strictObject({
 });
 var PermissionNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/);
 var RoleNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*$/);
-var AuditYamlSchema = z.strictObject({
+var AuditYamlSchema = z.object({
   authorization: z.strictObject({
     adapter: z.strictObject({ function: z.string().min(1) }).optional(),
     roles: z.record(RoleNameSchema, z.strictObject({ permissions: z.array(PermissionNameSchema) })),
@@ -770,8 +842,6 @@ var AuditYamlSchema = z.strictObject({
 });
 
 // src/scan.ts
-import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
-import { parse as parseYaml } from "yaml";
 async function scan(rootDir, opts = {}) {
   const d = discover(rootDir);
   const model = emptyModel(rootDir, d);
@@ -789,8 +859,21 @@ async function scan(rootDir, opts = {}) {
     });
   }
   if (d.firestoreRulesFile && existsSync3(d.firestoreRulesFile)) {
-    const rel = d.firestoreRulesFile.replace(/\\/g, "/").startsWith(rootDir.replace(/\\/g, "/")) ? d.firestoreRulesFile.slice(rootDir.length + 1).replace(/\\/g, "/") : model.firebase.firestore.rulesFile ?? "firestore.rules";
-    model.rules = extractRules(d.firestoreRulesFile, rel);
+    const rel = model.firebase.firestore.rulesFile ?? "firestore.rules";
+    try {
+      model.rules = extractRules(d.firestoreRulesFile, rel);
+    } catch {
+      findings_pre.push({
+        rule: "RULES_UNREADABLE",
+        severity: "WARNING",
+        confidence: "CONFIRMED",
+        message: "firestore.rules existe mas n\xE3o p\xF4de ser lido \u2014 FBA001/FBA002 sem cobertura.",
+        fingerprint: "RULES_UNREADABLE",
+        evidence: [
+          { id: "ev-rules-unreadable", kind: "rules-read", summary: "leitura falhou", confidence: "CONFIRMED" }
+        ]
+      });
+    }
   }
   if (d.firestoreIndexesFile && existsSync3(d.firestoreIndexesFile)) {
     try {
@@ -925,14 +1008,21 @@ async function scan(rootDir, opts = {}) {
   const errors = findings.filter((f) => f.severity === "ERROR").length;
   const warnings = findings.filter((f) => f.severity === "WARNING").length;
   const infos = findings.filter((f) => f.severity === "INFO").length;
-  return { model, findings, summary: { errors, warnings, infos, passed: IMPLEMENTED_CHECKS.length } };
+  const failedChecks = new Set(
+    findings.filter((f) => f.severity === "ERROR" || f.severity === "WARNING").map((f) => f.rule)
+  );
+  const total = IMPLEMENTED_CHECKS.length;
+  const passed = IMPLEMENTED_CHECKS.filter((c) => !failedChecks.has(c)).length;
+  return { model, findings, summary: { errors, warnings, infos, passed, total } };
 }
 
 export {
   discover,
+  SERVER_HINTS_SEGMENTS,
   classifyOrigin,
   emptyModel,
   stripRuleComments,
+  opsFrom,
   extractRules,
   isPublicCondition,
   findPublicAllows,

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-PIRAC3KT.js";
+} from "./chunk-N57MCLTZ.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -20,11 +20,13 @@ async function main() {
 Uso:
   firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]
   firebase-audit check [--json] [--adapter=fn] [--cwd=path]   (alias de scan --strict)
+  firebase-audit verify [--coverage=path] [--cwd=path]   (V3: matriz + cobertura)
+  firebase-audit drift --local=indexes.json --remote=deployed.json   (V4: LOCAL_ONLY/REMOTE_ONLY/MATCHED)
 
-Exit codes: 0 ok (ou WARNING/INFO fora do strict); 2 quando --strict encontra ERROR.`);
+Exit codes: 0 ok informativo; 2 quando --strict/check encontra ERROR. scan sozinho nunca reprova (use check no CI).`);
     return;
   }
-  if (cmd !== "scan" && cmd !== "check") {
+  if (cmd !== "scan" && cmd !== "check" && cmd !== "verify" && cmd !== "drift") {
     console.error(`Comando desconhecido: ${cmd}
 Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
     process.exit(1);
@@ -39,17 +41,90 @@ Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
     if (idx !== -1 && args[idx + 1] && !args[idx + 1].startsWith("--")) return args[idx + 1];
     return void 0;
   };
-  const knownFlags = /* @__PURE__ */ new Set(["--json", "--strict", "--help", "-h", "help", "--version", "-v"]);
+  const knownFlags = /* @__PURE__ */ new Set(["--json", "--strict", "--help", "-h", "help", "--version", "-v", "--coverage", "--local", "--remote"]);
   for (const a of args.slice(1)) {
-    if (a.startsWith("--") && !a.startsWith("--adapter=") && !a.startsWith("--cwd=") && a !== "--adapter" && a !== "--cwd" && !knownFlags.has(a)) {
+    const base = a.includes("=") ? a.slice(0, a.indexOf("=")) : a;
+    if (a.startsWith("--") && base !== "--adapter" && base !== "--cwd" && base !== "--coverage" && base !== "--local" && base !== "--remote" && !knownFlags.has(a) && !knownFlags.has(base)) {
       console.error(`Flag desconhecida: ${a}
-Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
+Uso: firebase-audit scan|check|verify|drift [--json] ...`);
       process.exit(1);
     }
   }
   const adapterArg = getArg("adapter");
   const cwdArg = getArg("cwd");
-  const rootDir = cwdArg ?? process.cwd();
+  if (cwdArg) {
+    const { existsSync: existsCwd } = await import("fs");
+    const { resolve: resolveCwd } = await import("path");
+    const abs = resolveCwd(process.cwd(), cwdArg);
+    if (!existsCwd(abs)) {
+      console.error(`Diret\xF3rio --cwd n\xE3o existe: ${cwdArg}`);
+      process.exit(1);
+    }
+  }
+  const { resolve: resolveRoot } = await import("path");
+  const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
+  if (cmd === "verify") {
+    const { scan: scanForVerify } = await import("./scan-773ZFQXB.js");
+    const { verify } = await import("./verify-Y7BWAFPL.js");
+    const { resolve: resolveVerify } = await import("path");
+    const coverageArg = getArg("coverage");
+    const coveragePath = coverageArg ? resolveVerify(rootDir, coverageArg) : void 0;
+    const { model } = await scanForVerify(rootDir, { adapterFn: adapterArg });
+    const res = verify(model, { coverageFile: coveragePath });
+    if (asJson) {
+      console.log(JSON.stringify({ version: pkg.version, cases: res.cases.length, uncovered: res.uncovered, findings: res.findings }, null, 2));
+      return;
+    }
+    console.log(`
+FIREBASE AUDIT verify \u2014 ${res.cases.length} casos planejados, ${res.uncovered.length} paths sem cobertura observada.`);
+    for (const f of res.findings) {
+      const icon = f.severity === "ERROR" ? "\u274C" : f.severity === "WARNING" ? "\u26A0" : "\u2139";
+      console.log(`
+${icon} ${f.rule} [${f.confidence}]
+   ${f.message}`);
+      if (f.fix) console.log(`   \u2192 ${f.fix}`);
+    }
+    if (res.uncovered.length > 0) {
+      console.log("\nUncovered paths:");
+      for (const u of res.uncovered.slice(0, 20)) console.log(`   \u2022 ${u}`);
+      if (res.uncovered.length > 20) console.log(`   ... e mais ${res.uncovered.length - 20}`);
+    }
+    console.log('\nEmulator: firebase emulators:exec --only firestore "npm test" + :ruleCoverage.\n');
+    return;
+  }
+  if (cmd === "drift") {
+    const { drift } = await import("./drift-BEXSL2IX.js");
+    const { resolve: resolveDrift } = await import("path");
+    const { existsSync: existsDrift } = await import("fs");
+    const localArg = getArg("local");
+    const remoteArg = getArg("remote");
+    if (!localArg && !remoteArg) {
+      console.error("drift exige --local e/ou --remote.\nUso: firebase-audit drift --local=indexes.json --remote=deployed.json [--cwd=path]");
+      process.exit(1);
+    }
+    const localPath = localArg ? resolveDrift(rootDir, localArg) : null;
+    const remotePath = remoteArg ? resolveDrift(rootDir, remoteArg) : null;
+    for (const [label, p] of [["--local", localPath], ["--remote", remotePath]]) {
+      if (p && !existsDrift(p)) {
+        console.error(`Arquivo ${label} n\xE3o encontrado: ${p}`);
+        process.exit(1);
+      }
+    }
+    const res = drift(localPath, remotePath);
+    if (asJson) {
+      console.log(JSON.stringify({ version: pkg.version, entries: res.entries, findings: res.findings }, null, 2));
+      return;
+    }
+    const counts = (s) => res.entries.filter((e) => e.status === s).length;
+    console.log(`
+FIREBASE AUDIT drift \u2014 MATCHED ${counts("MATCHED")}, LOCAL_ONLY ${counts("LOCAL_ONLY")}, REMOTE_ONLY ${counts("REMOTE_ONLY")}.
+`);
+    for (const f of res.findings.slice(0, 20)) {
+      const icon = f.severity === "ERROR" ? "\u274C" : f.severity === "WARNING" ? "\u26A0" : "\u2139";
+      console.log(`${icon} ${f.rule}: ${f.message}`);
+    }
+    return;
+  }
   const { findings, summary } = await scan(rootDir, { strict, adapterFn: adapterArg });
   if (asJson) {
     console.log(JSON.stringify({ version: pkg.version, summary, findings }, null, 2));

package/dist/drift-BEXSL2IX.js

@@ -0,0 +1,6 @@
+import {
+  drift
+} from "./chunk-GUSNXUAT.js";
+export {
+  drift
+};

package/dist/index.d.ts

@@ -216,6 +216,7 @@ declare const RuleSchema: z.ZodObject<{
         write: "write";
     }>>;
     conditionPresent: z.ZodBoolean;
+    condition: z.ZodOptional<z.ZodString>;
     authReferences: z.ZodArray<z.ZodString>;
     claimReferences: z.ZodArray<z.ZodString>;
     resourceReferences: z.ZodArray<z.ZodString>;
@@ -410,6 +411,7 @@ declare const ProjectModelSchema: z.ZodObject<{
             write: "write";
         }>>;
         conditionPresent: z.ZodBoolean;
+        condition: z.ZodOptional<z.ZodString>;
         authReferences: z.ZodArray<z.ZodString>;
         claimReferences: z.ZodArray<z.ZodString>;
         resourceReferences: z.ZodArray<z.ZodString>;
@@ -589,7 +591,7 @@ declare const AuditYamlSchema: z.ZodObject<{
             samples: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodJSONSchema>>>;
         }, z.core.$strict>>;
     }, z.core.$strict>;
-}, z.core.$strict>;
+}, z.core.$strip>;
 type ProjectModel = z.infer<typeof ProjectModelSchema>;
 type Finding = z.infer<typeof FindingSchema>;
 type AuditYaml = z.infer<typeof AuditYamlSchema>;
@@ -616,6 +618,8 @@ interface DiscoveryResult {
     serverFiles: string[];
 }
 declare function discover(rootDir: string): DiscoveryResult;
+/** Segmentos de servidor usados por classifyOrigin (documentados; ai-tool graph na V3). */
+declare const SERVER_HINTS_SEGMENTS: string[];
 /** Heurística CLIENT vs SERVER: caminho manda primeiro (grafo/voz do ai-tool na V2). */
 declare function classifyOrigin(file: string, content: string): "CLIENT" | "SERVER" | "UNKNOWN";
 declare function emptyModel(rootDir: string, d: DiscoveryResult): ProjectModel;
@@ -628,6 +632,10 @@ declare function emptyModel(rootDir: string, d: DiscoveryResult): ProjectModel;
 type Rule = z$1.infer<typeof RuleSchema>;
 /** Remove comentários // e block preservando strings simples. */
 declare function stripRuleComments(content: string): string;
+declare function opsFrom(target: string): {
+    ops: Rule["operations"];
+    known: boolean;
+};
 declare function extractRules(rulesFile: string, relFile: string): Rule[];
 /** Normaliza condição para detectar público: sem if, `true`, `(true)`, `|| true`, `auth == null`. */
 declare function isPublicCondition(condition: string | undefined): {
@@ -643,11 +651,9 @@ declare function findPublicAllows(rulesFile: string): {
 }[];
 
 /**
- * Checks estáticos V1 (FBA001–FBA004, FBA009–FBA011, subconjunto intencional).
- * Cada check retorna Findings com fingerprint estável para CI.
- * Nota: FBA001/FBA002 sem linha no fingerprint (estável a formatação);
- * FBA003/FBA004/FBA010 com linha (únicos por ocorrência — duplicatas no mesmo
- * arquivo geram findings distintos).
+ * Checks V1+V2 (FBA001–FBA004, FBA009–FBA013, subconjunto intencional).
+ * Fingerprints: FBA001/FBA002 por regra-lógica (sem linha, estáveis a formatação);
+ * FBA003/FBA004/FBA010/FBA012 com linha (únicos por ocorrência).
  */
 
 declare const IMPLEMENTED_CHECKS: readonly ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
@@ -671,14 +677,67 @@ interface ScanResult {
         warnings: number;
         infos: number;
         passed: number;
+        total: number;
     };
 }
 declare function scan(rootDir: string, opts?: ScanOptions): Promise<ScanResult>;
 
+/**
+ * V3 — Verifier (Emulator) como interface honesta.
+ *
+ * Não executa o Emulator sozinho (precisa de firebase-tools + Java no host).
+ * Gera a matriz de casos (TestCase → Scenario) e avalia cobertura quando
+ * o JSON do endpoint `:ruleCoverage` é fornecido (--coverage).
+ */
+
+interface VerifyCase {
+    role: string;
+    operation: "read" | "get" | "list" | "create" | "update" | "delete";
+    path: string;
+    pathTemplate: string;
+    expected: "ALLOW" | "DENY" | "UNKNOWN";
+}
+interface VerifyOptions {
+    coverageFile?: string;
+}
+interface VerifyResult {
+    cases: VerifyCase[];
+    uncovered: string[];
+    findings: Finding[];
+}
+/** Gera matriz role × operação × path a partir do modelo (sem executar nada).
+ * Mapeamento: read≡get+list, write≡create+update+delete (mesma semântica do opsFrom).
+ */
+declare function planVerify(model: ProjectModel): VerifyCase[];
+/** Avalia cobertura a partir do JSON de `:ruleCoverage` (quando fornecido). */
+declare function verify(model: ProjectModel, opts?: VerifyOptions): VerifyResult;
+
+/**
+ * V4 — Drift local vs implantado (comparação honesta de índices).
+ *
+ * Compara `firestore.indexes.json` local contra um JSON remoto
+ * (`gcloud firestore indexes composite list --format=json` ou REST).
+ * Nunca afirma "unused" — apenas LOCAL_ONLY / REMOTE_ONLY / MATCHED.
+ */
+
+type Index = z$1.infer<typeof FirestoreIndexSchema>;
+type DriftStatus = "MATCHED" | "LOCAL_ONLY" | "REMOTE_ONLY";
+interface DriftEntry {
+    key: string;
+    status: DriftStatus;
+    local?: Index;
+    remote?: Index;
+}
+interface DriftResult {
+    entries: DriftEntry[];
+    findings: Finding[];
+}
+declare function drift(localFile: string | null, remoteFile: string | null): DriftResult;
+
 /**
  * firebase-audit — entry point como biblioteca.
  */
 
 declare const VERSION: string;
 
-export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IMPLEMENTED_CHECKS, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RoleSchema, RuleSchema, type ScanOptions, type ScanResult, SeveritySchema, VERSION, classifyOrigin, discover, emptyModel, extractRules, findPublicAllows, isPublicCondition, runChecks, scan, stripRuleComments };
+export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, type DriftEntry, type DriftResult, type DriftStatus, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IMPLEMENTED_CHECKS, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RoleSchema, RuleSchema, SERVER_HINTS_SEGMENTS, type ScanOptions, type ScanResult, SeveritySchema, VERSION, type VerifyCase, type VerifyOptions, type VerifyResult, classifyOrigin, discover, drift, emptyModel, extractRules, findPublicAllows, isPublicCondition, opsFrom, planVerify, runChecks, scan, stripRuleComments, verify };

package/dist/index.js

@@ -19,6 +19,7 @@ import {
   QueryShapeSchema,
   RoleSchema,
   RuleSchema,
+  SERVER_HINTS_SEGMENTS,
   SeveritySchema,
   classifyOrigin,
   discover,
@@ -26,10 +27,18 @@ import {
   extractRules,
   findPublicAllows,
   isPublicCondition,
+  opsFrom,
   runChecks,
   scan,
   stripRuleComments
-} from "./chunk-PIRAC3KT.js";
+} from "./chunk-N57MCLTZ.js";
+import {
+  planVerify,
+  verify
+} from "./chunk-CPEIPRCF.js";
+import {
+  drift
+} from "./chunk-GUSNXUAT.js";
 
 // src/index.ts
 import { createRequire } from "module";
@@ -57,15 +66,20 @@ export {
   QueryShapeSchema,
   RoleSchema,
   RuleSchema,
+  SERVER_HINTS_SEGMENTS,
   SeveritySchema,
   VERSION,
   classifyOrigin,
   discover,
+  drift,
   emptyModel,
   extractRules,
   findPublicAllows,
   isPublicCondition,
+  opsFrom,
+  planVerify,
   runChecks,
   scan,
-  stripRuleComments
+  stripRuleComments,
+  verify
 };

package/dist/scan-773ZFQXB.js

@@ -0,0 +1,6 @@
+import {
+  scan
+} from "./chunk-N57MCLTZ.js";
+export {
+  scan
+};

package/dist/verify-Y7BWAFPL.js

@@ -0,0 +1,8 @@
+import {
+  planVerify,
+  verify
+} from "./chunk-CPEIPRCF.js";
+export {
+  planVerify,
+  verify
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",