@justmpm/firebase-audit 0.4.0 → 0.4.2

package/dist/{chunk-5PVQB3ZI.js → chunk-3SEVYYCX.js}

@@ -783,6 +783,10 @@ async function runChecks(model, rootDir, opts = {}) {
     }
   }
   const adminHits = await collectAdminImports(rootDir);
+  const isTestPath = (f) => {
+    const n = f.replace(/\\/g, "/");
+    return /\.test\.[tj]sx?$/.test(n) || /\.spec\.[tj]sx?$/.test(n) || /(^|\/)__tests__\//.test(n) || /(^|\/)(test|tests|testing)\//.test(n);
+  };
   for (const hit of adminHits) {
     let origin = "UNKNOWN";
     try {
@@ -791,7 +795,7 @@ async function runChecks(model, rootDir, opts = {}) {
     } catch {
       origin = "UNKNOWN";
     }
-    if (origin === "CLIENT") {
+    if (origin === "CLIENT" && !isTestPath(hit.file)) {
       findings.push(
         make(
           "FBA003",
@@ -1329,16 +1333,17 @@ async function scan(rootDir, opts = {}) {
           });
         }
       } else {
+        const details = validated.error.issues.slice(0, 5).map((i) => `${String(i.path.join(".")) || "(raiz)"}: ${i.message}`).join("; ");
         findings_pre.push({
           rule: "CONTRACT_INVALID",
           severity: "WARNING",
           confidence: "CONFIRMED",
-          message: `firebase-audit.yaml existe mas \xE9 inv\xE1lido: ${validated.error.issues[0]?.message ?? "schema"} \u2014 contrato ignorado neste scan.`,
+          message: `firebase-audit.yaml inv\xE1lido (${validated.error.issues.length} problema(s): ${details}) \u2014 contrato ignorado neste scan.`,
           fingerprint: "CONTRACT_INVALID",
           evidence: [
-            { id: "ev-contract-invalid", kind: "contract-parse", summary: "YAML inv\xE1lido", confidence: "CONFIRMED" }
+            { id: "ev-contract-invalid", kind: "contract-parse", summary: details.slice(0, 200), confidence: "CONFIRMED" }
           ],
-          fix: "Valide contra templates/firebase-audit.yaml."
+          fix: "Valide contra templates/firebase-audit.yaml (min\xFAsculas, sem chaves extras)."
         });
       }
     } catch (err) {

package/dist/{chunk-TVEZQU7C.js → chunk-PSSMYRRU.js}

@@ -7,7 +7,7 @@ function collectVisitCounts(node, out) {
     return;
   }
   const rec = node;
-  for (const k of ["visitCount", "visit_count", "count", "hits", "visits", "evaluations"]) {
+  for (const k of ["visitCount", "visit_count"]) {
     const v = rec[k];
     if (typeof v === "number" && Number.isFinite(v)) {
       out.push(v);
@@ -26,6 +26,7 @@ function planVerify(model) {
   };
   const cases = [];
   for (const rule of model.rules) {
+    if (rule.path === "/(unknown)") continue;
     for (const role of roles) {
       for (const op of rule.operations) {
         for (const mapped of expand(op)) {
@@ -105,6 +106,7 @@ function verify(model, opts = {}) {
     return { cases, uncovered: [], findings, coveragePct };
   }
   for (const rule of model.rules) {
+    if (rule.path === "/(unknown)") continue;
     uncovered.push(rule.path);
   }
   return { cases, uncovered, findings, coveragePct };

package/dist/{chunk-YVV7YRF3.js → chunk-SKD4TKFU.js}

@@ -1,9 +1,9 @@
 import {
   scan
-} from "./chunk-5PVQB3ZI.js";
+} from "./chunk-3SEVYYCX.js";
 import {
   verify
-} from "./chunk-TVEZQU7C.js";
+} from "./chunk-PSSMYRRU.js";
 import {
   drift
 } from "./chunk-NJBCSW7E.js";
@@ -13,13 +13,58 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { createRequire } from "module";
+import { readFileSync, existsSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
+var pkgDir = join(dirname(fileURLToPath(import.meta.url)), "..");
+function readPkgText(rel) {
+  try {
+    const p = join(pkgDir, rel);
+    if (!existsSync(p)) return null;
+    return readFileSync(p, "utf-8");
+  } catch {
+    return null;
+  }
+}
+var FALLBACK_SKILL = [
+  "# firebase-audit-skill (fallback)",
+  "",
+  "1. Descobrir projeto (firebase.json, firestore.rules, firestore.indexes.json).",
+  "2. Executar scan (strict no CI). Sem adapter resolvido \u2192 UNKNOWN, nunca adivinhar.",
+  "3. CONFIRMED corrige agora; PROBABLE investiga; NOT_OBSERVED/UNKNOWN n\xE3o afirma.",
+  "4. Corrigir c\xF3digo, nunca o contrato para esconder finding."
+].join("\n");
 function createMcpServer() {
   const server = new McpServer({
     name: "firebase-audit-mcp-server",
     version: pkg.version
   });
+  server.registerTool(
+    "firebase_audit_skill",
+    {
+      title: "Firebase Audit Skill (guia do agente)",
+      description: "LEIA ANTES de auditar: sequ\xEAncia obrigat\xF3ria, travas (nunca mude o contrato para esconder finding, nunca afirme sem evid\xEAncia, nunca diga 'unused') e Emulador. Retorna o guia oficial da vers\xE3o instalada + modelo de contrato. Sempre sincronizado \u2014 dispensa skill copiada.",
+      inputSchema: {}
+    },
+    async () => {
+      const skill = readPkgText(join("skill", "SKILL.md")) ?? FALLBACK_SKILL;
+      const template = readPkgText(join("templates", "firebase-audit.yaml")) ?? "";
+      const text = [
+        `# firebase-audit v${pkg.version} \u2014 guia do agente`,
+        "",
+        skill,
+        "",
+        "## Modelo de contrato (templates/firebase-audit.yaml)",
+        "",
+        "```yaml",
+        template,
+        "```"
+      ].join("\n");
+      return { content: [{ type: "text", text }] };
+    }
+  );
   server.registerTool(
     "firebase_audit_scan",
     {
@@ -120,8 +165,8 @@ function createMcpServer() {
       title: "Firebase Audit Drift (\xEDndices)",
       description: "Compara \xEDndices locais vs implantados. Retorna MATCHED/LOCAL_ONLY/REMOTE_ONLY. Nunca diz 'unused', apenas NOT_OBSERVED.",
       inputSchema: {
-        local: z.string().nullable().describe("Path do firestore.indexes.json local (ou null). Relativo resolve contra cwd."),
-        remote: z.string().nullable().describe("Path do JSON remoto (gcloud/REST) (ou null). Relativo resolve contra cwd."),
+        local: z.string().nullable().optional().describe("Path do firestore.indexes.json local (ou null). Relativo resolve contra cwd."),
+        remote: z.string().nullable().optional().describe("Path do JSON remoto (gcloud/REST) (ou null). Relativo resolve contra cwd."),
         cwd: z.string().optional().describe("Diret\xF3rio base para paths relativos (default: cwd do servidor).")
       }
     },
@@ -130,7 +175,7 @@ function createMcpServer() {
         const { resolve: resolveP, isAbsolute } = await import("path");
         const base = cwd && cwd.length > 0 ? cwd : process.cwd();
         const resPath = (p) => {
-          if (p === null) return null;
+          if (p === null || p === void 0) return null;
           return isAbsolute(p) ? p : resolveP(base, p);
         };
         const res = drift(resPath(local), resPath(remote));

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-5PVQB3ZI.js";
+} from "./chunk-3SEVYYCX.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -64,8 +64,8 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-6FRUE5BE.js");
-    const { verify } = await import("./verify-R6LI2KNZ.js");
+    const { scan: scanForVerify } = await import("./scan-VREY2FGO.js");
+    const { verify } = await import("./verify-O722ZZBV.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");
     const coveragePath = coverageArg ? resolveVerify(rootDir, coverageArg) : void 0;
@@ -107,6 +107,15 @@ ${icon} ${f.rule} [${f.confidence}]
     const remotePath = remoteArg ? resolveDrift(rootDir, remoteArg) : null;
     for (const [label, p] of [["--local", localPath], ["--remote", remotePath]]) {
       if (p && !existsDrift(p)) {
+        if (asJson) {
+          const { drift: driftMissing } = await import("./drift-KU7HWL7M.js");
+          const res2 = driftMissing(
+            localPath && existsDrift(localPath) ? localPath : null,
+            remotePath && existsDrift(remotePath) ? remotePath : null
+          );
+          console.log(JSON.stringify({ version: pkg.version, entries: res2.entries, findings: res2.findings }, null, 2));
+          process.exit(1);
+        }
         console.error(`Arquivo ${label} n\xE3o encontrado: ${p}`);
         process.exit(1);
       }

package/dist/index.d.ts

@@ -643,6 +643,10 @@ declare function enrichWithGraph(rootDir: string, d: DiscoveryResult): Promise<v
 /**
  * Rules extractor — estrutura + referências + locations (sem avaliar).
  * Parser leve e intencionalmente incompleto: avaliação real é do Emulator (V3).
+ *
+ * Limitação conhecida: `ALLOW_RE` corta a condição no primeiro `;` mesmo dentro
+ * de string literal (ex: `x != "a;b"`). Raríssimo em Rules reais; documentado aqui
+ * em vez de silêncio — Emulator acusa a regra de verdade.
  */
 
 type Rule = z$1.infer<typeof RuleSchema>;

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-YVV7YRF3.js";
+} from "./chunk-SKD4TKFU.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -53,11 +53,11 @@ import {
   stripOuterParens,
   stripRuleComments,
   validateClaimSamples
-} from "./chunk-5PVQB3ZI.js";
+} from "./chunk-3SEVYYCX.js";
 import {
   planVerify,
   verify
-} from "./chunk-TVEZQU7C.js";
+} from "./chunk-PSSMYRRU.js";
 import {
   drift
 } from "./chunk-NJBCSW7E.js";

package/dist/mcp-cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-YVV7YRF3.js";
-import "./chunk-5PVQB3ZI.js";
-import "./chunk-TVEZQU7C.js";
+} from "./chunk-SKD4TKFU.js";
+import "./chunk-3SEVYYCX.js";
+import "./chunk-PSSMYRRU.js";
 import "./chunk-NJBCSW7E.js";
 
 // src/mcp-cli.ts

package/dist/mcp.d.ts

@@ -3,7 +3,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 /**
  * MCP Server do firebase-audit.
  *
- * Expõe scan/check/verify/drift via protocolo MCP (stdio).
+ * Expõe skill + scan/check/verify/drift via protocolo MCP (stdio).
  * Mesma lógica da biblioteca — sem duplicação (chama scan/verify/drift direto).
  *
  * Uso:

package/dist/mcp.js

@@ -1,9 +1,9 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-YVV7YRF3.js";
-import "./chunk-5PVQB3ZI.js";
-import "./chunk-TVEZQU7C.js";
+} from "./chunk-SKD4TKFU.js";
+import "./chunk-3SEVYYCX.js";
+import "./chunk-PSSMYRRU.js";
 import "./chunk-NJBCSW7E.js";
 export {
   createMcpServer,

package/dist/{scan-6FRUE5BE.js → scan-VREY2FGO.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-5PVQB3ZI.js";
+} from "./chunk-3SEVYYCX.js";
 export {
   scan
 };

package/dist/{verify-R6LI2KNZ.js → verify-O722ZZBV.js}

@@ -1,7 +1,7 @@
 import {
   planVerify,
   verify
-} from "./chunk-TVEZQU7C.js";
+} from "./chunk-PSSMYRRU.js";
 export {
   planVerify,
   verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",