@justmpm/firebase-audit 0.3.1 → 0.4.1

package/dist/chunk-GOLWQBD5.js

@@ -0,0 +1,165 @@
+import {
+  scan
+} from "./chunk-3SEVYYCX.js";
+import {
+  verify
+} from "./chunk-PSSMYRRU.js";
+import {
+  drift
+} from "./chunk-NJBCSW7E.js";
+
+// src/mcp.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+function createMcpServer() {
+  const server = new McpServer({
+    name: "firebase-audit-mcp-server",
+    version: pkg.version
+  });
+  server.registerTool(
+    "firebase_audit_scan",
+    {
+      title: "Firebase Audit Scan",
+      description: "Audita projeto Firebase (c\xF3digo + firestore.rules + \xEDndices + contrato). Static-first, nunca inventa certeza (CONFIRMED/PROBABLE/NOT_OBSERVED/UNKNOWN). Use para descobrir regras p\xFAblicas, Admin em cliente, permiss\xF5es sem contrato.",
+      inputSchema: {
+        cwd: z.string().min(1).describe("Diret\xF3rio raiz do projeto Firebase a auditar"),
+        adapter: z.string().optional().describe("Fun\xE7\xE3o de autoriza\xE7\xE3o (ex: rbac.can). Default: do contrato."),
+        strict: z.boolean().optional().describe("Exige contrato (firebase-audit.yaml). CI usa strict.")
+      }
+    },
+    async ({ cwd, adapter, strict }) => {
+      try {
+        const res = await scan(cwd, { adapterFn: adapter, strict });
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({ version: pkg.version, summary: res.summary, findings: res.findings }, null, 2)
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `scan falhou: ${err instanceof Error ? err.message : err}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "firebase_audit_check",
+    {
+      title: "Firebase Audit Check (strict)",
+      description: "Alias de scan --strict: exige contrato e falha (exit 2 no CLI) se houver ERROR. Use no CI.",
+      inputSchema: {
+        cwd: z.string().min(1).describe("Diret\xF3rio raiz do projeto Firebase"),
+        adapter: z.string().optional().describe("Fun\xE7\xE3o de autoriza\xE7\xE3o (ex: rbac.can)")
+      }
+    },
+    async ({ cwd, adapter }) => {
+      try {
+        const res = await scan(cwd, { adapterFn: adapter, strict: true });
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({ version: pkg.version, summary: res.summary, findings: res.findings }, null, 2)
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `check falhou: ${err instanceof Error ? err.message : err}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "firebase_audit_verify",
+    {
+      title: "Firebase Audit Verify (Emulator)",
+      description: "Gera matriz role\xD7opera\xE7\xE3o\xD7path e avalia coverage do :ruleCoverage. Requer Emulator (firebase emulators:exec). Nunca afirma cobertura sem teste real.",
+      inputSchema: {
+        cwd: z.string().min(1).describe("Diret\xF3rio raiz do projeto"),
+        coverage: z.string().optional().describe("Path do coverage.json do :ruleCoverage (relativo ao cwd)")
+      }
+    },
+    async ({ cwd, coverage }) => {
+      try {
+        const { resolve } = await import("path");
+        const { model } = await scan(cwd);
+        const res = verify(model, { coverageFile: coverage ? resolve(cwd, coverage) : void 0 });
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                { version: pkg.version, cases: res.cases.length, uncovered: res.uncovered, coveragePct: res.coveragePct, findings: res.findings },
+                null,
+                2
+              )
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `verify falhou: ${err instanceof Error ? err.message : err}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "firebase_audit_drift",
+    {
+      title: "Firebase Audit Drift (\xEDndices)",
+      description: "Compara \xEDndices locais vs implantados. Retorna MATCHED/LOCAL_ONLY/REMOTE_ONLY. Nunca diz 'unused', apenas NOT_OBSERVED.",
+      inputSchema: {
+        local: z.string().nullable().optional().describe("Path do firestore.indexes.json local (ou null). Relativo resolve contra cwd."),
+        remote: z.string().nullable().optional().describe("Path do JSON remoto (gcloud/REST) (ou null). Relativo resolve contra cwd."),
+        cwd: z.string().optional().describe("Diret\xF3rio base para paths relativos (default: cwd do servidor).")
+      }
+    },
+    async ({ local, remote, cwd }) => {
+      try {
+        const { resolve: resolveP, isAbsolute } = await import("path");
+        const base = cwd && cwd.length > 0 ? cwd : process.cwd();
+        const resPath = (p) => {
+          if (p === null || p === void 0) return null;
+          return isAbsolute(p) ? p : resolveP(base, p);
+        };
+        const res = drift(resPath(local), resPath(remote));
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({ version: pkg.version, entries: res.entries, findings: res.findings }, null, 2)
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `drift falhou: ${err instanceof Error ? err.message : err}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  return server;
+}
+async function startMcpServer() {
+  const server = createMcpServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error(`[firebase-audit] MCP server v${pkg.version} running via stdio`);
+}
+
+export {
+  createMcpServer,
+  startMcpServer
+};

package/dist/{chunk-GUSNXUAT.js → chunk-NJBCSW7E.js}

@@ -1,7 +1,7 @@
 // src/drift.ts
 import { readFileSync, existsSync } from "fs";
 function normalizeMode(f) {
-  if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0 || f.fieldPath === "__name__") return null;
+  if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0) return null;
   if (f.vectorConfig !== void 0 && f.vectorConfig !== null) return { fieldPath: f.fieldPath, mode: "VECTOR" };
   if (f.arrayConfig === "CONTAINS") return { fieldPath: f.fieldPath, mode: "ARRAY_CONTAINS" };
   if (typeof f.mode === "string" && (f.mode === "ASCENDING" || f.mode === "DESCENDING" || f.mode === "ARRAY_CONTAINS" || f.mode === "VECTOR")) {
@@ -19,6 +19,9 @@ function normalizeEntry(raw) {
     if (m) cg = m[1];
   }
   if (!cg) return null;
+  if (raw.queryScope !== void 0 && raw.queryScope !== "COLLECTION" && raw.queryScope !== "COLLECTION_GROUP") {
+    return null;
+  }
   const scope = raw.queryScope === "COLLECTION_GROUP" ? "COLLECTION_GROUP" : "COLLECTION";
   const fields = [];
   if (Array.isArray(raw.fields)) {
@@ -27,6 +30,7 @@ function normalizeEntry(raw) {
       if (n) fields.push(n);
     }
   }
+  if (fields.length === 0) return null;
   return { collectionGroup: cg, queryScope: scope, fields };
 }
 function keyOf(i) {
@@ -42,6 +46,19 @@ function normalizeList(raw) {
 }
 function drift(localFile, remoteFile) {
   const findings = [];
+  const localMissing = !localFile || !existsSync(localFile);
+  const remoteMissing = !remoteFile || !existsSync(remoteFile);
+  if (localMissing && remoteMissing) {
+    findings.push({
+      rule: "DRIFT_NO_INPUT",
+      severity: "INFO",
+      confidence: "NOT_OBSERVED",
+      message: "Drift sem base local nem remota \u2014 nada a comparar.",
+      fingerprint: "DRIFT_NO_INPUT",
+      evidence: [{ id: "ev-drift-noinput", kind: "drift-parse", summary: "sem base", confidence: "NOT_OBSERVED" }]
+    });
+    return { entries: [], findings };
+  }
   let local = [];
   let remote = [];
   if (localFile && existsSync(localFile)) {

package/dist/{chunk-CPEIPRCF.js → chunk-PSSMYRRU.js}

@@ -1,5 +1,21 @@
 // src/verify.ts
 import { readFileSync, existsSync } from "fs";
+function collectVisitCounts(node, out) {
+  if (typeof node !== "object" || node === null) return;
+  if (Array.isArray(node)) {
+    for (const v of node) collectVisitCounts(v, out);
+    return;
+  }
+  const rec = node;
+  for (const k of ["visitCount", "visit_count"]) {
+    const v = rec[k];
+    if (typeof v === "number" && Number.isFinite(v)) {
+      out.push(v);
+      break;
+    }
+  }
+  for (const v of Object.values(rec)) collectVisitCounts(v, out);
+}
 function planVerify(model) {
   const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
   const expand = (op) => {
@@ -10,6 +26,7 @@ function planVerify(model) {
   };
   const cases = [];
   for (const rule of model.rules) {
+    if (rule.path === "/(unknown)") continue;
     for (const role of roles) {
       for (const op of rule.operations) {
         for (const mapped of expand(op)) {
@@ -32,6 +49,7 @@ function verify(model, opts = {}) {
   const cases = planVerify(model);
   const findings = [];
   const uncovered = [];
+  let coveragePct = null;
   if (opts.coverageFile) {
     if (!existsSync(opts.coverageFile)) {
       findings.push({
@@ -46,15 +64,32 @@ function verify(model, opts = {}) {
     } else {
       try {
         const raw = JSON.parse(readFileSync(opts.coverageFile, "utf-8"));
-        void raw;
-        findings.push({
-          rule: "COVERAGE_NOT_EVALUATED",
-          severity: "WARNING",
-          confidence: "NOT_OBSERVED",
-          message: "Coverage recebido mas ainda n\xE3o avaliado nesta vers\xE3o (formato :ruleCoverage inst\xE1vel) \u2014 uncovered lista tudo por honestidade.",
-          fingerprint: "COVERAGE_NOT_EVALUATED",
-          evidence: [{ id: "ev-coverage-ne", kind: "coverage-parse", summary: "n\xE3o avaliado", confidence: "NOT_OBSERVED" }]
-        });
+        const counts = [];
+        collectVisitCounts(raw, counts);
+        if (counts.length === 0) {
+          findings.push({
+            rule: "COVERAGE_NOT_EVALUATED",
+            severity: "WARNING",
+            confidence: "NOT_OBSERVED",
+            message: "Coverage sem visitCount reconhec\xEDvel nesta vers\xE3o \u2014 uncovered lista tudo por honestidade.",
+            fingerprint: "COVERAGE_NOT_EVALUATED",
+            evidence: [{ id: "ev-coverage-ne", kind: "coverage-parse", summary: "n\xE3o avaliado", confidence: "NOT_OBSERVED" }]
+          });
+        } else {
+          const covered = counts.filter((c) => c > 0).length;
+          coveragePct = Math.round(covered / counts.length * 100);
+          if (coveragePct < 100) {
+            findings.push({
+              rule: "COVERAGE_LOW",
+              severity: "WARNING",
+              confidence: "CONFIRMED",
+              message: `Cobertura de Rules em ${coveragePct}% (${covered}/${counts.length} express\xF5es visitadas) \u2014 ramos com visitCount 0 sem teste.`,
+              fingerprint: "COVERAGE_LOW",
+              evidence: [{ id: "ev-coverage-low", kind: "coverage-parse", summary: `${coveragePct}%`, confidence: "CONFIRMED" }],
+              fix: "Adicione casos anon/user/admin x get/list/create/update/delete at\xE9 100%."
+            });
+          }
+        }
       } catch {
         findings.push({
           rule: "COVERAGE_INVALID",
@@ -67,10 +102,14 @@ function verify(model, opts = {}) {
       }
     }
   }
+  if (coveragePct === 100) {
+    return { cases, uncovered: [], findings, coveragePct };
+  }
   for (const rule of model.rules) {
+    if (rule.path === "/(unknown)") continue;
     uncovered.push(rule.path);
   }
-  return { cases, uncovered, findings };
+  return { cases, uncovered, findings, coveragePct };
 }
 
 export {

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-UMQH7UDI.js";
+} from "./chunk-3SEVYYCX.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -64,19 +64,20 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-TLHI777J.js");
-    const { verify } = await import("./verify-Y7BWAFPL.js");
+    const { scan: scanForVerify } = await import("./scan-VREY2FGO.js");
+    const { verify } = await import("./verify-O722ZZBV.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");
     const coveragePath = coverageArg ? resolveVerify(rootDir, coverageArg) : void 0;
     const { model } = await scanForVerify(rootDir, { adapterFn: adapterArg });
     const res = verify(model, { coverageFile: coveragePath });
     if (asJson) {
-      console.log(JSON.stringify({ version: pkg.version, cases: res.cases.length, uncovered: res.uncovered, findings: res.findings }, null, 2));
+      console.log(JSON.stringify({ version: pkg.version, cases: res.cases.length, uncovered: res.uncovered, coveragePct: res.coveragePct, findings: res.findings }, null, 2));
       return;
     }
+    const covStr = res.coveragePct === null ? "sem cobertura observada" : `${res.coveragePct}% de express\xF5es visitadas`;
     console.log(`
-FIREBASE AUDIT verify \u2014 ${res.cases.length} casos planejados, ${res.uncovered.length} paths sem cobertura observada.`);
+FIREBASE AUDIT verify \u2014 ${res.cases.length} casos planejados, ${res.uncovered.length} paths sem mapeamento n\xF3\u2192path (${covStr}).`);
     for (const f of res.findings) {
       const icon = f.severity === "ERROR" ? "\u274C" : f.severity === "WARNING" ? "\u26A0" : "\u2139";
       console.log(`
@@ -93,7 +94,7 @@ ${icon} ${f.rule} [${f.confidence}]
     return;
   }
   if (cmd === "drift") {
-    const { drift } = await import("./drift-BEXSL2IX.js");
+    const { drift } = await import("./drift-KU7HWL7M.js");
     const { resolve: resolveDrift } = await import("path");
     const { existsSync: existsDrift } = await import("fs");
     const localArg = getArg("local");
@@ -106,6 +107,15 @@ ${icon} ${f.rule} [${f.confidence}]
     const remotePath = remoteArg ? resolveDrift(rootDir, remoteArg) : null;
     for (const [label, p] of [["--local", localPath], ["--remote", remotePath]]) {
       if (p && !existsDrift(p)) {
+        if (asJson) {
+          const { drift: driftMissing } = await import("./drift-KU7HWL7M.js");
+          const res2 = driftMissing(
+            localPath && existsDrift(localPath) ? localPath : null,
+            remotePath && existsDrift(remotePath) ? remotePath : null
+          );
+          console.log(JSON.stringify({ version: pkg.version, entries: res2.entries, findings: res2.findings }, null, 2));
+          process.exit(1);
+        }
         console.error(`Arquivo ${label} n\xE3o encontrado: ${p}`);
         process.exit(1);
       }

package/dist/{drift-BEXSL2IX.js → drift-KU7HWL7M.js}

@@ -1,6 +1,6 @@
 import {
   drift
-} from "./chunk-GUSNXUAT.js";
+} from "./chunk-NJBCSW7E.js";
 export {
   drift
 };

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 import * as z from 'zod';
 import { z as z$1 } from 'zod';
+export { createMcpServer, startMcpServer } from './mcp.js';
+import '@modelcontextprotocol/sdk/server/mcp.js';
 
 /**
  * firebase-audit — schemas centrais (Zod v4).
@@ -566,6 +568,7 @@ declare const FindingSchema: z.ZodObject<{
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strict>;
 declare const AuditYamlSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
     authorization: z.ZodObject<{
         adapter: z.ZodOptional<z.ZodObject<{
             function: z.ZodString;
@@ -592,6 +595,13 @@ declare const AuditYamlSchema: z.ZodObject<{
         }, z.core.$strict>>;
     }, z.core.$strict>;
 }, z.core.$strict>;
+/** Chaves OIDC/Firebase reservadas — nunca em custom claims (1000 bytes, só acesso). */
+declare const RESERVED_CLAIM_KEYS: readonly string[];
+/** Valida samples de claims: tamanho 1000 bytes + chaves reservadas. */
+declare function validateClaimSamples(samples: Record<string, Record<string, unknown>> | undefined): {
+    ok: boolean;
+    errors: string[];
+};
 type ProjectModel = z.infer<typeof ProjectModelSchema>;
 type Finding = z.infer<typeof FindingSchema>;
 type AuditYaml = z.infer<typeof AuditYamlSchema>;
@@ -618,15 +628,25 @@ interface DiscoveryResult {
     serverFiles: string[];
 }
 declare function discover(rootDir: string): DiscoveryResult;
-/** Segmentos de servidor usados por classifyOrigin (documentados; ai-tool graph na V3). */
+/** Segmentos de servidor (fail-closed: `api` genérico NÃO é server, ver classifyOrigin). */
 declare const SERVER_HINTS_SEGMENTS: string[];
-/** Heurística CLIENT vs SERVER: caminho manda primeiro (grafo/voz do ai-tool na V2). */
+/** Heurística CLIENT vs SERVER: caminho manda primeiro (grafo ai-tool preenche listas na Fase 3). */
 declare function classifyOrigin(file: string, content: string): "CLIENT" | "SERVER" | "UNKNOWN";
 declare function emptyModel(rootDir: string, d: DiscoveryResult): ProjectModel;
+/**
+ * Fase 3 — enriquece Discovery com grafo do ai-tool (como lib, sem spawn/MCP).
+ * Preenche clientFiles/serverFiles a partir do mapa do projeto.
+ * Nunca joga: falha do ai-tool mantém listas vazias (honesto).
+ */
+declare function enrichWithGraph(rootDir: string, d: DiscoveryResult): Promise<void>;
 
 /**
  * Rules extractor — estrutura + referências + locations (sem avaliar).
  * Parser leve e intencionalmente incompleto: avaliação real é do Emulator (V3).
+ *
+ * Limitação conhecida: `ALLOW_RE` corta a condição no primeiro `;` mesmo dentro
+ * de string literal (ex: `x != "a;b"`). Raríssimo em Rules reais; documentado aqui
+ * em vez de silêncio — Emulator acusa a regra de verdade.
  */
 
 type Rule = z$1.infer<typeof RuleSchema>;
@@ -636,23 +656,77 @@ declare function opsFrom(target: string): {
     ops: Rule["operations"];
     known: boolean;
 };
+/** Normaliza target de allow para fingerprint estável (case/espaço/ordem). */
+declare function normalizeTarget(target: string): string;
+/** Bloco match com posição para concatenação de pais (subcoleções). */
+interface MatchBlock {
+    path: string;
+    line: number;
+    blockStart: number;
+    blockEnd: number;
+}
+/** Núcleo comum: blocos match com fim por profundidade (fora de strings). */
+declare function parseMatchBlocks(content: string): MatchBlock[];
+/** Concatena paths ancestrais: /users/{u} + /orders/{o} = /users/{u}/orders/{o}. */
+declare function buildFullPath(containingAsc: MatchBlock[]): string;
+/** Mapa function NAME -> corpo para helpers (isAdmin, isSignedIn — padrão oficial). */
+declare function parseRuleFunctions(content: string): Map<string, string>;
+/** Versão com assinatura (params) para inline de helpers com argumentos. */
+declare function parseRuleFunctionsDetailed(content: string): Map<string, {
+    params: string[];
+    body: string;
+}>;
+/** Inline textual de args nos params (1 nível, sem aninhamento complexo). */
+declare function inlineHelperArgs(body: string, params: string[], args: string[]): string;
+/** Inline de helpers dentro de expressões: `isAdmin() && x==1` vira `(corpo) && x==1`. */
+declare function inlineHelpersInCondition(condition: string, detailed: Map<string, {
+    params: string[];
+    body: string;
+}>): string;
+/** Se condição é chamada única `nome(...)`, resolve corpo do helper (1 nível, com args). */
+declare function resolveHelperCondition(condition: string, functions: Map<string, string>): string;
+/** Resolução com substituição de args (para helpers parametrizados oficiais). */
+declare function resolveHelperConditionDetailed(condition: string, detailed: Map<string, {
+    params: string[];
+    body: string;
+}>): string;
 declare function extractRules(rulesFile: string, relFile: string): Rule[];
+/** Extrai de conteúdo (evita triple-read + permite teste sem arquivo). */
+declare function extractRulesContent(rawContent: string, relFile: string): Rule[];
+/** Remove apenas parênteses externos balanceados que embrulham tudo. */
+declare function stripOuterParens(s: string): string;
 /** Normaliza condição para detectar público: sem if, `true`, `(true)`, `|| true`, `auth == null`. */
 declare function isPublicCondition(condition: string | undefined): {
     isPublic: boolean;
     confidence: "CONFIRMED" | "PROBABLE";
 };
+/** Hash curto e estável (8 hex) para fingerprint v2: imune a formatação/espaço/case. */
+declare function hashShort(text: string): string;
+/** Chave de condição para fingerprint: "uncond" ou hash da condição normalizada. */
+declare function conditionKeyForFingerprint(condition: string | undefined): string;
 /** Detecta allows públicos preservando linha, path e confiança para FBA001/FBA002. */
 declare function findPublicAllows(rulesFile: string): {
     line: number;
     target: string;
     path: string;
     confidence: "CONFIRMED" | "PROBABLE";
+    conditionKey: string;
+}[];
+/** Extrai expressão de `return` do corpo do helper para avaliação pública. */
+declare function helperBodyToCondition(body: string): string;
+/** Núcleo com conteúdo (reuso em checks sem triple-read). */
+declare function findPublicAllowsContent(rawContent: string): {
+    line: number;
+    target: string;
+    path: string;
+    confidence: "CONFIRMED" | "PROBABLE";
+    conditionKey: string;
 }[];
 
 /**
  * Checks V1+V2 (FBA001–FBA004, FBA009–FBA013, subconjunto intencional).
- * Fingerprints: FBA001/FBA002 por regra-lógica (sem linha, estáveis a formatação);
+ * Fingerprints v2: FBA001/FBA002 por regra-lógica + hash da condição
+ * (estáveis a formatação, únicos por regra duplicada);
  * FBA003/FBA004/FBA010/FBA012 com linha (únicos por ocorrência).
  */
 
@@ -668,17 +742,32 @@ declare function runChecks(model: ProjectModel, rootDir: string, opts?: {
 interface ScanOptions {
     adapterFn?: string;
     strict?: boolean;
+    /**
+     * Opt-in: enriquece Discovery com grafo do ai-tool (clientFiles/serverFiles).
+     * Default false (scan static-first rápido; nenhum check consome o grafo na 0.4.0).
+     */
+    graph?: boolean;
+}
+interface ScanSummary {
+    errors: number;
+    warnings: number;
+    infos: number;
+    /** Compat: mesmo que passedChecks. */
+    passed: number;
+    /** Compat: mesmo que totalChecks. */
+    total: number;
+    passedChecks: number;
+    totalChecks: number;
+    /** Findings de infra (fora dos checks FBA): rules/contrato/índices/model. */
+    infraSkipped: number;
+    /** Cobertura de Rules (0-100) quando verify com coverage avalia; null = não observada.
+     * Sempre null no scan() por desenho (cobertura só via verify coveragePct). */
+    coveragePct: number | null;
 }
 interface ScanResult {
     model: ProjectModel;
     findings: Finding[];
-    summary: {
-        errors: number;
-        warnings: number;
-        infos: number;
-        passed: number;
-        total: number;
-    };
+    summary: ScanSummary;
 }
 declare function scan(rootDir: string, opts?: ScanOptions): Promise<ScanResult>;
 
@@ -704,6 +793,8 @@ interface VerifyResult {
     cases: VerifyCase[];
     uncovered: string[];
     findings: Finding[];
+    /** 0-100 quando o coverage tem visitCount avaliável; null = não observada. */
+    coveragePct: number | null;
 }
 /** Gera matriz role × operação × path a partir do modelo (sem executar nada).
  * Mapeamento: read≡get+list, write≡create+update+delete (mesma semântica do opsFrom).
@@ -740,4 +831,4 @@ declare function drift(localFile: string | null, remoteFile: string | null): Dri
 
 declare const VERSION: string;
 
-export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, type DriftEntry, type DriftResult, type DriftStatus, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IMPLEMENTED_CHECKS, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RoleSchema, RuleSchema, SERVER_HINTS_SEGMENTS, type ScanOptions, type ScanResult, SeveritySchema, VERSION, type VerifyCase, type VerifyOptions, type VerifyResult, classifyOrigin, discover, drift, emptyModel, extractRules, findPublicAllows, isPublicCondition, opsFrom, planVerify, runChecks, scan, stripRuleComments, verify };
+export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, type DriftEntry, type DriftResult, type DriftStatus, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IMPLEMENTED_CHECKS, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RESERVED_CLAIM_KEYS, RoleSchema, RuleSchema, SERVER_HINTS_SEGMENTS, type ScanOptions, type ScanResult, type ScanSummary, SeveritySchema, VERSION, type VerifyCase, type VerifyOptions, type VerifyResult, buildFullPath, classifyOrigin, conditionKeyForFingerprint, discover, drift, emptyModel, enrichWithGraph, extractRules, extractRulesContent, findPublicAllows, findPublicAllowsContent, hashShort, helperBodyToCondition, inlineHelperArgs, inlineHelpersInCondition, isPublicCondition, normalizeTarget, opsFrom, parseMatchBlocks, parseRuleFunctions, parseRuleFunctionsDetailed, planVerify, resolveHelperCondition, resolveHelperConditionDetailed, runChecks, scan, stripOuterParens, stripRuleComments, validateClaimSamples, verify };

package/dist/index.js

@@ -1,3 +1,7 @@
+import {
+  createMcpServer,
+  startMcpServer
+} from "./chunk-GOLWQBD5.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -17,28 +21,46 @@ import {
   QueryFilterSchema,
   QueryOrderSchema,
   QueryShapeSchema,
+  RESERVED_CLAIM_KEYS,
   RoleSchema,
   RuleSchema,
   SERVER_HINTS_SEGMENTS,
   SeveritySchema,
+  buildFullPath,
   classifyOrigin,
+  conditionKeyForFingerprint,
   discover,
   emptyModel,
+  enrichWithGraph,
   extractRules,
+  extractRulesContent,
   findPublicAllows,
+  findPublicAllowsContent,
+  hashShort,
+  helperBodyToCondition,
+  inlineHelperArgs,
+  inlineHelpersInCondition,
   isPublicCondition,
+  normalizeTarget,
   opsFrom,
+  parseMatchBlocks,
+  parseRuleFunctions,
+  parseRuleFunctionsDetailed,
+  resolveHelperCondition,
+  resolveHelperConditionDetailed,
   runChecks,
   scan,
-  stripRuleComments
-} from "./chunk-UMQH7UDI.js";
+  stripOuterParens,
+  stripRuleComments,
+  validateClaimSamples
+} from "./chunk-3SEVYYCX.js";
 import {
   planVerify,
   verify
-} from "./chunk-CPEIPRCF.js";
+} from "./chunk-PSSMYRRU.js";
 import {
   drift
-} from "./chunk-GUSNXUAT.js";
+} from "./chunk-NJBCSW7E.js";
 
 // src/index.ts
 import { createRequire } from "module";
@@ -64,22 +86,42 @@ export {
   QueryFilterSchema,
   QueryOrderSchema,
   QueryShapeSchema,
+  RESERVED_CLAIM_KEYS,
   RoleSchema,
   RuleSchema,
   SERVER_HINTS_SEGMENTS,
   SeveritySchema,
   VERSION,
+  buildFullPath,
   classifyOrigin,
+  conditionKeyForFingerprint,
+  createMcpServer,
   discover,
   drift,
   emptyModel,
+  enrichWithGraph,
   extractRules,
+  extractRulesContent,
   findPublicAllows,
+  findPublicAllowsContent,
+  hashShort,
+  helperBodyToCondition,
+  inlineHelperArgs,
+  inlineHelpersInCondition,
   isPublicCondition,
+  normalizeTarget,
   opsFrom,
+  parseMatchBlocks,
+  parseRuleFunctions,
+  parseRuleFunctionsDetailed,
   planVerify,
+  resolveHelperCondition,
+  resolveHelperConditionDetailed,
   runChecks,
   scan,
+  startMcpServer,
+  stripOuterParens,
   stripRuleComments,
+  validateClaimSamples,
   verify
 };

package/dist/mcp-cli.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node