@justmpm/firebase-audit 0.4.3 → 0.5.0

package/dist/{chunk-PSSMYRRU.js → chunk-2X3BTSGP.js}

@@ -71,7 +71,7 @@ function verify(model, opts = {}) {
             rule: "COVERAGE_NOT_EVALUATED",
             severity: "WARNING",
             confidence: "NOT_OBSERVED",
-            message: "Coverage sem visitCount reconhec\xEDvel nesta vers\xE3o \u2014 uncovered lista tudo por honestidade.",
+            message: "Coverage sem visitCount reconhec\xEDvel \u2014 uncovered lista tudo por honestidade.",
             fingerprint: "COVERAGE_NOT_EVALUATED",
             evidence: [{ id: "ev-coverage-ne", kind: "coverage-parse", summary: "n\xE3o avaliado", confidence: "NOT_OBSERVED" }]
           });

package/dist/{chunk-IXMAWDJH.js → chunk-EHGW2EX6.js}

@@ -1,9 +1,9 @@
 import {
   scan
-} from "./chunk-3SEVYYCX.js";
+} from "./chunk-TQZTE2NR.js";
 import {
   verify
-} from "./chunk-PSSMYRRU.js";
+} from "./chunk-2X3BTSGP.js";
 import {
   drift
 } from "./chunk-NJBCSW7E.js";
@@ -31,10 +31,11 @@ function readPkgText(rel) {
 var FALLBACK_SKILL = [
   "# firebase-audit-skill (fallback)",
   "",
-  "1. Descobrir projeto (firebase.json, firestore.rules, firestore.indexes.json).",
-  "2. Executar scan (strict no CI). Sem adapter resolvido \u2192 UNKNOWN, nunca adivinhar.",
+  "1. Descobrir projeto (firebase.json, firestore.rules, storage.rules, firestore.indexes.json).",
+  "2. Executar scan (check com contrato no CI). Sem fun\xE7\xE3o de permiss\xE3o que receba o nome como texto \u2192 UNKNOWN, nunca adivinhar.",
   "3. CONFIRMED corrige agora; PROBABLE investiga; NOT_OBSERVED/UNKNOWN n\xE3o afirma.",
-  "4. Corrigir c\xF3digo, nunca o contrato para esconder finding."
+  "4. AppCheck \xE9 carimbo do app, n\xE3o autoriza\xE7\xE3o. Logo p\xFAblica pode ser vitrine; cofre \xE9 write aberto.",
+  "5. Corrigir c\xF3digo, nunca o contrato para esconder finding."
 ].join("\n");
 function createMcpServer() {
   const server = new McpServer({
@@ -45,14 +46,14 @@ function createMcpServer() {
     "skill",
     {
       title: "Firebase Audit Skill (guia do agente)",
-      description: "LEIA ANTES de auditar: sequ\xEAncia obrigat\xF3ria, travas (nunca mude o contrato para esconder finding, nunca afirme sem evid\xEAncia, nunca diga 'unused') e Emulador. Retorna o guia oficial da vers\xE3o instalada + modelo de contrato. Sempre sincronizado \u2014 dispensa skill copiada.",
+      description: "LEIA ANTES de auditar: sequ\xEAncia obrigat\xF3ria, travas (nunca mude o contrato para esconder finding, nunca afirme sem evid\xEAncia, nunca diga 'unused') e Emulador. Retorna o guia oficial instalado + modelo de contrato. Sempre sincronizado \u2014 dispensa skill copiada.",
       inputSchema: {}
     },
     async () => {
       const skill = readPkgText(join("skill", "SKILL.md")) ?? FALLBACK_SKILL;
       const template = readPkgText(join("templates", "firebase-audit.yaml")) ?? "";
       const text = [
-        `# firebase-audit v${pkg.version} \u2014 guia do agente`,
+        "# firebase-audit \u2014 guia do agente",
         "",
         skill,
         "",
@@ -69,10 +70,10 @@ function createMcpServer() {
     "scan",
     {
       title: "Firebase Audit Scan",
-      description: "Audita projeto Firebase (c\xF3digo + firestore.rules + \xEDndices + contrato). Static-first, nunca inventa certeza (CONFIRMED/PROBABLE/NOT_OBSERVED/UNKNOWN). Use para descobrir regras p\xFAblicas, Admin em cliente, permiss\xF5es sem contrato.",
+      description: "Audita projeto Firebase (c\xF3digo + firestore.rules + storage.rules + \xEDndices + contrato + AppCheck). Est\xE1tico primeiro, nunca inventa certeza (CONFIRMED/PROBABLE/NOT_OBSERVED/UNKNOWN). Use para descobrir regras p\xFAblicas, Admin em cliente, permiss\xF5es sem contrato.",
       inputSchema: {
         cwd: z.string().min(1).describe("Diret\xF3rio raiz do projeto Firebase a auditar"),
-        adapter: z.string().optional().describe("Fun\xE7\xE3o de autoriza\xE7\xE3o (ex: rbac.can). Default: do contrato."),
+        adapter: z.string().optional().describe("Fun\xE7\xE3o de permiss\xE3o no c\xF3digo que recebe o nome como texto (ex: rbac.can). N\xE3o use guarda de rota nem function do .rules aqui. Default: do contrato."),
         strict: z.boolean().optional().describe("Exige contrato (firebase-audit.yaml). CI usa strict.")
       }
     },
@@ -83,7 +84,7 @@ function createMcpServer() {
           content: [
             {
               type: "text",
-              text: JSON.stringify({ version: pkg.version, summary: res.summary, findings: res.findings }, null, 2)
+              text: JSON.stringify({ summary: res.summary, findings: res.findings }, null, 2)
             }
           ]
         };
@@ -99,10 +100,10 @@ function createMcpServer() {
     "check",
     {
       title: "Firebase Audit Check (strict)",
-      description: "Alias de scan --strict: exige contrato e falha (exit 2 no CLI) se houver ERROR. Use no CI.",
+      description: "Alias de scan strict: exige contrato e reprova CI se houver ERROR. Use no CI.",
       inputSchema: {
         cwd: z.string().min(1).describe("Diret\xF3rio raiz do projeto Firebase"),
-        adapter: z.string().optional().describe("Fun\xE7\xE3o de autoriza\xE7\xE3o (ex: rbac.can)")
+        adapter: z.string().optional().describe("Fun\xE7\xE3o de permiss\xE3o no c\xF3digo que recebe o nome como texto (ex: rbac.can)")
       }
     },
     async ({ cwd, adapter }) => {
@@ -112,7 +113,7 @@ function createMcpServer() {
           content: [
             {
               type: "text",
-              text: JSON.stringify({ version: pkg.version, summary: res.summary, findings: res.findings }, null, 2)
+              text: JSON.stringify({ summary: res.summary, findings: res.findings }, null, 2)
             }
           ]
         };
@@ -128,10 +129,10 @@ function createMcpServer() {
     "verify",
     {
       title: "Firebase Audit Verify (Emulator)",
-      description: "Gera matriz role\xD7opera\xE7\xE3o\xD7path e avalia coverage do :ruleCoverage. Requer Emulator (firebase emulators:exec). Nunca afirma cobertura sem teste real.",
+      description: "Gera matriz papel\xD7opera\xE7\xE3o\xD7path e avalia cobertura do ruleCoverage. Requer Emulator. Sem contrato usa pap\xE9is reduzidos (anonymous/user/admin). Nunca afirma cobertura sem teste real.",
       inputSchema: {
         cwd: z.string().min(1).describe("Diret\xF3rio raiz do projeto"),
-        coverage: z.string().optional().describe("Path do coverage.json do :ruleCoverage (relativo ao cwd)")
+        coverage: z.string().optional().describe("Path do coverage.json do ruleCoverage (relativo ao cwd)")
       }
     },
     async ({ cwd, coverage }) => {
@@ -139,12 +140,24 @@ function createMcpServer() {
         const { resolve } = await import("path");
         const { model } = await scan(cwd);
         const res = verify(model, { coverageFile: coverage ? resolve(cwd, coverage) : void 0 });
+        const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
+        const truncated = res.cases.length > 50;
         return {
           content: [
             {
               type: "text",
               text: JSON.stringify(
-                { version: pkg.version, cases: res.cases.length, uncovered: res.uncovered, coveragePct: res.coveragePct, findings: res.findings },
+                {
+                  roles,
+                  rolesReduced: model.authorization.roles.length === 0,
+                  cases: res.cases.slice(0, 50),
+                  casesTotal: res.cases.length,
+                  truncated,
+                  uncovered: res.uncovered.slice(0, 20),
+                  uncoveredTotal: res.uncovered.length,
+                  coveragePct: res.coveragePct,
+                  findings: res.findings
+                },
                 null,
                 2
               )
@@ -166,7 +179,7 @@ function createMcpServer() {
       description: "Compara \xEDndices locais vs implantados. Retorna MATCHED/LOCAL_ONLY/REMOTE_ONLY. Nunca diz 'unused', apenas NOT_OBSERVED.",
       inputSchema: {
         local: z.string().nullable().optional().describe("Path do firestore.indexes.json local (ou null). Relativo resolve contra cwd."),
-        remote: z.string().nullable().optional().describe("Path do JSON remoto (gcloud/REST) (ou null). Relativo resolve contra cwd."),
+        remote: z.string().nullable().optional().describe("Path do JSON remoto (ou null). Relativo resolve contra cwd."),
         cwd: z.string().optional().describe("Diret\xF3rio base para paths relativos (default: cwd do servidor).")
       }
     },
@@ -183,7 +196,7 @@ function createMcpServer() {
           content: [
             {
               type: "text",
-              text: JSON.stringify({ version: pkg.version, entries: res.entries, findings: res.findings }, null, 2)
+              text: JSON.stringify({ entries: res.entries, findings: res.findings }, null, 2)
             }
           ]
         };
@@ -201,7 +214,7 @@ async function startMcpServer() {
   const server = createMcpServer();
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  console.error(`[firebase-audit] MCP server v${pkg.version} running via stdio`);
+  console.error("[firebase-audit] MCP server running via stdio");
 }
 
 export {

package/dist/{chunk-3SEVYYCX.js → chunk-TQZTE2NR.js}

@@ -4,7 +4,7 @@ import { join as join3 } from "path";
 import { parse as parseYaml } from "yaml";
 
 // src/discovery.ts
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync, statSync } from "fs";
 import { join, relative } from "path";
 function discover(rootDir) {
   const pick = (name) => {
@@ -16,6 +16,16 @@ function discover(rootDir) {
   let databaseId = null;
   let rulesFile = pick("firestore.rules");
   let indexesFile = pick("firestore.indexes.json");
+  let storageFile = pick("storage.rules");
+  let functionsDir = null;
+  const functionsPick = pick("functions");
+  if (functionsPick) {
+    try {
+      functionsDir = statSync(functionsPick).isDirectory() ? functionsPick : null;
+    } catch {
+      functionsDir = null;
+    }
+  }
   const firebaserc = pick(".firebaserc");
   if (firebaserc) {
     try {
@@ -36,6 +46,10 @@ function discover(rootDir) {
         const p = join(rootDir, raw.firestore.indexes);
         if (existsSync(p)) indexesFile = p;
       }
+      if (typeof raw.storage?.rules === "string") {
+        const p = join(rootDir, raw.storage.rules);
+        if (existsSync(p)) storageFile = p;
+      }
     } catch {
     }
   }
@@ -44,6 +58,8 @@ function discover(rootDir) {
     firebaseJson,
     firestoreRulesFile: rulesFile,
     firestoreIndexesFile: indexesFile,
+    storageRulesFile: storageFile,
+    functionsDir,
     auditYamlFile: pick("firebase-audit.yaml"),
     projectId,
     databaseId,
@@ -93,8 +109,10 @@ function emptyModel(rootDir, d) {
       firestore: {
         rulesFile: rel(d.firestoreRulesFile),
         indexesFile: rel(d.firestoreIndexesFile)
-      }
+      },
+      storage: d.storageRulesFile ? { rulesFile: rel(d.storageRulesFile) } : void 0
     },
+    functions: d.functionsDir ? { dir: rel(d.functionsDir) } : void 0,
     authorization: { adapter: null, roles: [], permissions: [] },
     queries: [],
     rules: [],
@@ -109,14 +127,14 @@ async function enrichWithGraph(rootDir, d) {
     const res = await ai.map({ cwd: rootDir, format: "json" });
     const files = Array.isArray(res.files) ? res.files : [];
     const code = files.map((f) => String(f.path).replace(/\\/g, "/")).filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p)).filter((p) => !p.includes("node_modules/") && !/(^|\/)dist\//.test(p)).slice(0, 500);
-    const { readFileSync: readSync, existsSync: existsSyncFn, statSync } = await import("fs");
+    const { readFileSync: readSync, existsSync: existsSyncFn, statSync: statSync2 } = await import("fs");
     const { join: joinP } = await import("path");
     for (const rel of code) {
       let content = "";
       try {
         const abs = joinP(rootDir, rel);
         if (!existsSyncFn(abs)) continue;
-        if (statSync(abs).size > 100 * 1024) continue;
+        if (statSync2(abs).size > 100 * 1024) continue;
         content = readSync(abs, "utf-8");
       } catch {
         content = "";
@@ -555,12 +573,15 @@ async function runChecks(model, rootDir, opts = {}) {
   const permissionCalls = await collectPermissionCalls(rootDir, adapterFn);
   const declared = new Set(model.authorization.permissions.map((p) => p.name));
   if (permissionCalls.literals.length === 0 && permissionCalls.dynamic.length === 0) {
+    const tenantHint = [...helperDetailed.keys()].find(
+      (n) => /tenant|member|signedin/i.test(n)
+    );
     findings.push(
       make(
         "FBA009",
         "WARNING",
         "UNKNOWN",
-        `Adapter de autoriza\xE7\xE3o "${adapterFn}" n\xE3o observado no c\xF3digo. Sem adapter, permiss\xF5es s\xE3o UNKNOWN.`,
+        tenantHint ? `Adapter "${adapterFn}" n\xE3o observado no c\xF3digo. Encontrei portaria tenant (${tenantHint}) nas Rules, mas sem fun\xE7\xE3o de permiss\xE3o que receba o nome como texto n\xE3o d\xE1 para ligar papel\xD7recurso \u2014 permiss\xF5es seguem UNKNOWN.` : `Adapter "${adapterFn}" n\xE3o observado no c\xF3digo. Sem fun\xE7\xE3o de permiss\xE3o que receba o nome como texto, permiss\xF5es s\xE3o UNKNOWN.`,
         `FBA009:${adapterFn}`,
         { evidence: [ev("adapter-missing", adapterFn, "UNKNOWN")] }
       )
@@ -1041,8 +1062,15 @@ var ProjectModelSchema = z.strictObject({
     firestore: z.strictObject({
       rulesFile: z.string().optional(),
       indexesFile: z.string().optional()
-    })
+    }),
+    storage: z.strictObject({
+      rulesFile: z.string().optional()
+    }).optional()
   }),
+  functions: z.strictObject({
+    dir: z.string().optional(),
+    appCheckEnforced: z.number().int().nonnegative().optional()
+  }).optional(),
   authorization: z.strictObject({
     adapter: z.string().nullable(),
     roles: z.array(RoleSchema),
@@ -1206,11 +1234,11 @@ async function scan(rootDir, opts = {}) {
       }
       const validModes = ["ASCENDING", "DESCENDING", "ARRAY_CONTAINS", "VECTOR"];
       const entries = [];
-      let skipped = 0;
+      let skipped2 = 0;
       let scopeSkipped = 0;
       for (const i of raw.indexes ?? []) {
         if (typeof i.collectionGroup !== "string" || i.collectionGroup.length === 0) {
-          skipped += 1;
+          skipped2 += 1;
           continue;
         }
         if (i.queryScope !== void 0 && i.queryScope !== "COLLECTION" && i.queryScope !== "COLLECTION_GROUP") {
@@ -1220,13 +1248,13 @@ async function scan(rootDir, opts = {}) {
         const fields = [];
         for (const f of i.fields ?? []) {
           if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0) {
-            skipped += 1;
+            skipped2 += 1;
             continue;
           }
           const rawMode = f.vectorConfig ? "VECTOR" : f.arrayConfig === "CONTAINS" ? "ARRAY_CONTAINS" : typeof f.mode === "string" ? f.mode : f.order;
           const mode = rawMode;
           if (mode !== "ASCENDING" && mode !== "DESCENDING" && mode !== "ARRAY_CONTAINS" && mode !== "VECTOR") {
-            skipped += 1;
+            skipped2 += 1;
             continue;
           }
           fields.push({ fieldPath: f.fieldPath, mode });
@@ -1239,11 +1267,11 @@ async function scan(rootDir, opts = {}) {
         const last = entries[entries.length - 1];
         if (last.fields.length === 0) {
           entries.pop();
-          skipped += 1;
+          skipped2 += 1;
         }
       }
       model.indexes = entries;
-      const totalSkipped = skipped + scopeSkipped;
+      const totalSkipped = skipped2 + scopeSkipped;
       if (totalSkipped > 0) {
         findings_pre.push({
           rule: "INDEXES_INVALID",
@@ -1361,6 +1389,75 @@ async function scan(rootDir, opts = {}) {
   }
   const checksFindings = await runChecks(model, rootDir, { adapterFn: opts.adapterFn ?? model.authorization.adapter ?? void 0 });
   const findings = [...findings_pre, ...checksFindings];
+  const checked = ["firestore.rules", "indexes", "contract", "client-code"];
+  const skipped = [];
+  if (d.storageRulesFile && existsSync3(d.storageRulesFile)) {
+    checked.push("storage.rules");
+    try {
+      const raw = readFileSync4(d.storageRulesFile, "utf-8");
+      const relStorage = model.firebase.storage?.rulesFile ?? "storage.rules";
+      const low = raw.toLowerCase().replace(/\s+/g, "");
+      const hasAllPaths = raw.includes("allPaths=**") || raw.includes("allPaths = **");
+      const writeOpen = /allowwrite:[^;]*iftrue/.test(low);
+      const getOpen = /allowget:[^;]*iftrue/.test(low);
+      if (writeOpen) {
+        findings.push({
+          rule: "STORAGE_PUBLIC_WRITE",
+          severity: "ERROR",
+          confidence: "CONFIRMED",
+          message: `Storage com escrita aberta (${relStorage}). Qualquer cliente pode escrever \u2014 cofre aberto, n\xE3o vitrine.`,
+          fingerprint: "STORAGE_PUBLIC_WRITE",
+          file: relStorage,
+          evidence: [{ id: "ev-storage-write", kind: "storage-public", summary: "write if true", confidence: "CONFIRMED" }],
+          fix: "Exigir request.auth (e dono/tenant) no write. Deixe get aberto s\xF3 em pasta de vitrine como logos/."
+        });
+      } else if (hasAllPaths && getOpen) {
+        findings.push({
+          rule: "STORAGE_ALL_PATHS_OPEN",
+          severity: "WARNING",
+          confidence: "PROBABLE",
+          message: `Storage com get aberto em /{allPaths=**} (${relStorage}). Vale para tudo \u2014 se a inten\xE7\xE3o era s\xF3 logo, restrinja a /logos/{id}.`,
+          fingerprint: "STORAGE_ALL_PATHS_OPEN",
+          file: relStorage,
+          evidence: [{ id: "ev-storage-all", kind: "storage-public", summary: "allPaths get true", confidence: "PROBABLE" }],
+          fix: "Troque /{allPaths=**} por pastas expl\xEDcitas (ex: /logos/{logoId}) com get: if true e write restrito."
+        });
+      } else if (getOpen) {
+        findings.push({
+          rule: "STORAGE_PUBLIC_READ",
+          severity: "INFO",
+          confidence: "PROBABLE",
+          message: `Storage com leitura aberta (${relStorage}). Pode ser vitrine proposital (logos) \u2014 confirme que o write segue restrito.`,
+          fingerprint: "STORAGE_PUBLIC_READ",
+          file: relStorage,
+          evidence: [{ id: "ev-storage-read", kind: "storage-public", summary: "get if true", confidence: "PROBABLE" }]
+        });
+      }
+    } catch {
+      skipped.push("storage.rules ileg\xEDvel \u2014 Storage sem cobertura neste scan");
+    }
+  } else {
+    skipped.push("storage.rules n\xE3o observado \u2014 Storage fora deste scan");
+  }
+  if (d.functionsDir) {
+    const enforced = await countAppCheckEnforced(rootDir);
+    model.functions = { dir: model.functions?.dir, appCheckEnforced: enforced };
+    checked.push("functions-appcheck");
+    if (enforced > 0) {
+      findings.push({
+        rule: "APPCHECK_ENFORCED",
+        severity: "INFO",
+        confidence: "CONFIRMED",
+        message: `AppCheck ativo em ${enforced} function(s). Carimbo do app oficial \u2014 n\xE3o prova quem \xE9 o usu\xE1rio nem o tenant. Autoriza\xE7\xE3o segue nas Rules/guardas.`,
+        fingerprint: "APPCHECK_ENFORCED",
+        evidence: [{ id: "ev-appcheck", kind: "appcheck", summary: `${enforced} enforced`, confidence: "CONFIRMED" }]
+      });
+    } else {
+      skipped.push("functions sem enforceAppCheck observado \u2014 AppCheck sem cobertura afirmativa");
+    }
+  } else {
+    skipped.push("functions n\xE3o observadas \u2014 AppCheck fora deste scan");
+  }
   const modelCheck = ProjectModelSchema.safeParse(model);
   if (!modelCheck.success) {
     findings.push({
@@ -1399,7 +1496,7 @@ async function scan(rootDir, opts = {}) {
   );
   const totalChecks = IMPLEMENTED_CHECKS.length;
   const passedChecks = IMPLEMENTED_CHECKS.filter((c) => !failedChecks.has(c)).length;
-  const infraSkipped = findings.filter((f) => !implemented.has(f.rule)).length;
+  const infra = findings.filter((f) => !implemented.has(f.rule)).map((f) => ({ rule: f.rule, message: f.message }));
   return {
     model,
     findings,
@@ -1407,15 +1504,59 @@ async function scan(rootDir, opts = {}) {
       errors,
       warnings,
       infos,
-      passed: passedChecks,
-      total: totalChecks,
       passedChecks,
       totalChecks,
-      infraSkipped,
+      infra,
+      checked,
+      skipped,
       coveragePct: null
     }
   };
 }
+async function countAppCheckEnforced(rootDir) {
+  try {
+    const { readdirSync, readFileSync: readSync, statSync: stat } = await import("fs");
+    const { join: joinP } = await import("path");
+    const roots = [joinP(rootDir, "functions")];
+    let count = 0;
+    const stack = [...roots];
+    let guard = 0;
+    while (stack.length > 0 && guard < 200) {
+      guard += 1;
+      const cur = stack.pop();
+      let entries = [];
+      try {
+        entries = readdirSync(cur, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const e of entries) {
+        const name = e.name;
+        const abs = joinP(cur, name);
+        let isDir = false;
+        try {
+          isDir = stat(abs).isDirectory();
+        } catch {
+          continue;
+        }
+        if (isDir) {
+          if (name === "node_modules" || name === "dist" || name === "lib") continue;
+          stack.push(abs);
+          continue;
+        }
+        if (!/\.(ts|js|mjs|cjs)$/.test(name)) continue;
+        try {
+          const text = readSync(abs, "utf-8");
+          if (/enforceAppCheck\s*:\s*true/.test(text)) count += 1;
+        } catch {
+        }
+      }
+    }
+    return count;
+  } catch {
+    return 0;
+  }
+}
 
 export {
   discover,

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-3SEVYYCX.js";
+} from "./chunk-TQZTE2NR.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -15,13 +15,13 @@ async function main() {
     return;
   }
   if (cmd === "--help" || cmd === "-h" || cmd === "help") {
-    console.log(`firebase-audit v${pkg.version}
+    console.log(`firebase-audit
 
 Uso:
   firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]
-  firebase-audit check [--json] [--adapter=fn] [--cwd=path]   (alias de scan --strict)
-  firebase-audit verify [--coverage=path] [--cwd=path]   (V3: matriz + cobertura)
-  firebase-audit drift --local=indexes.json --remote=deployed.json   (V4: LOCAL_ONLY/REMOTE_ONLY/MATCHED)
+  firebase-audit check [--json] [--adapter=fn] [--cwd=path]   (scan strict para CI)
+  firebase-audit verify [--coverage=path] [--cwd=path]   (matriz + cobertura)
+  firebase-audit drift --local=indexes.json --remote=deployed.json   (LOCAL_ONLY/REMOTE_ONLY/MATCHED)
 
 Exit codes: 0 ok informativo; 2 quando --strict/check encontra ERROR. scan sozinho nunca reprova (use check no CI).`);
     return;
@@ -64,20 +64,21 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-VREY2FGO.js");
-    const { verify } = await import("./verify-O722ZZBV.js");
+    const { scan: scanForVerify } = await import("./scan-FYAWNRIE.js");
+    const { verify } = await import("./verify-GWRLO344.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");
     const coveragePath = coverageArg ? resolveVerify(rootDir, coverageArg) : void 0;
     const { model } = await scanForVerify(rootDir, { adapterFn: adapterArg });
     const res = verify(model, { coverageFile: coveragePath });
     if (asJson) {
-      console.log(JSON.stringify({ version: pkg.version, cases: res.cases.length, uncovered: res.uncovered, coveragePct: res.coveragePct, findings: res.findings }, null, 2));
+      console.log(JSON.stringify({ cases: res.cases.slice(0, 50), casesTotal: res.cases.length, truncated: res.cases.length > 50, uncovered: res.uncovered.slice(0, 20), uncoveredTotal: res.uncovered.length, coveragePct: res.coveragePct, findings: res.findings }, null, 2));
       return;
     }
     const covStr = res.coveragePct === null ? "sem cobertura observada" : `${res.coveragePct}% de express\xF5es visitadas`;
+    const rolesNote = "pap\xE9is reduzidos (sem contrato: anonymous/user/admin)";
     console.log(`
-FIREBASE AUDIT verify \u2014 ${res.cases.length} casos planejados, ${res.uncovered.length} paths sem mapeamento n\xF3\u2192path (${covStr}).`);
+FIREBASE AUDIT verify \u2014 ${res.cases.length} casos planejados (${rolesNote}), ${res.uncovered.length} paths sem cobertura (${covStr}).`);
     for (const f of res.findings) {
       const icon = f.severity === "ERROR" ? "\u274C" : f.severity === "WARNING" ? "\u26A0" : "\u2139";
       console.log(`
@@ -113,7 +114,7 @@ ${icon} ${f.rule} [${f.confidence}]
             localPath && existsDrift(localPath) ? localPath : null,
             remotePath && existsDrift(remotePath) ? remotePath : null
           );
-          console.log(JSON.stringify({ version: pkg.version, entries: res2.entries, findings: res2.findings }, null, 2));
+          console.log(JSON.stringify({ entries: res2.entries, findings: res2.findings }, null, 2));
           process.exit(1);
         }
         console.error(`Arquivo ${label} n\xE3o encontrado: ${p}`);
@@ -122,7 +123,7 @@ ${icon} ${f.rule} [${f.confidence}]
     }
     const res = drift(localPath, remotePath);
     if (asJson) {
-      console.log(JSON.stringify({ version: pkg.version, entries: res.entries, findings: res.findings }, null, 2));
+      console.log(JSON.stringify({ entries: res.entries, findings: res.findings }, null, 2));
       return;
     }
     const counts = (s) => res.entries.filter((e) => e.status === s).length;
@@ -137,16 +138,17 @@ FIREBASE AUDIT drift \u2014 MATCHED ${counts("MATCHED")}, LOCAL_ONLY ${counts("L
   }
   const { findings, summary } = await scan(rootDir, { strict, adapterFn: adapterArg });
   if (asJson) {
-    console.log(JSON.stringify({ version: pkg.version, summary, findings }, null, 2));
+    console.log(JSON.stringify({ summary, findings }, null, 2));
     if (strict && summary.errors > 0) process.exit(2);
     return;
   }
-  console.log(`
-FIREBASE AUDIT v${pkg.version}`);
+  console.log("\nFIREBASE AUDIT");
   console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   if (findings.length === 0) {
     console.log(`
-\u2713 Nenhum problema nos checks V1+V2 implementados (parcial: FBA001-FBA004, FBA009-FBA013).
+\u2713 Nenhum problema nos checks implementados (${summary.passedChecks}/${summary.totalChecks} passaram).
+Olhei: ${summary.checked.join(", ")}.
+Pulei: ${summary.skipped.join(" | ") || "nada"}.
 `);
     return;
   }
@@ -159,7 +161,9 @@ ${icon} ${f.rule} [${f.confidence}]${where}
     if (f.fix) console.log(`   \u2192 ${f.fix}`);
   }
   console.log(`
-SUMMARY: ${summary.errors} errors, ${summary.warnings} warnings, ${summary.infos} infos
+SUMMARY: ${summary.errors} errors, ${summary.warnings} warnings, ${summary.infos} infos (${summary.passedChecks}/${summary.totalChecks} checks passaram)`);
+  console.log(`Olhei: ${summary.checked.join(", ")}`);
+  console.log(`Pulei: ${summary.skipped.join(" | ") || "nada"}
 `);
   if (strict && summary.errors > 0) process.exit(2);
 }

package/dist/index.d.ts

@@ -310,7 +310,14 @@ declare const ProjectModelSchema: z.ZodObject<{
             rulesFile: z.ZodOptional<z.ZodString>;
             indexesFile: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>;
+        storage: z.ZodOptional<z.ZodObject<{
+            rulesFile: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
+    functions: z.ZodOptional<z.ZodObject<{
+        dir: z.ZodOptional<z.ZodString>;
+        appCheckEnforced: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
     authorization: z.ZodObject<{
         adapter: z.ZodNullable<z.ZodString>;
         roles: z.ZodArray<z.ZodObject<{
@@ -618,13 +625,15 @@ interface DiscoveryResult {
     firebaseJson: string | null;
     firestoreRulesFile: string | null;
     firestoreIndexesFile: string | null;
+    storageRulesFile: string | null;
+    functionsDir: string | null;
     auditYamlFile: string | null;
     projectId: string | null;
-    /** V2: databaseId nomeado (sempre null na V1). */
+    /** databaseId nomeado (sempre null sem config explícita). */
     databaseId: string | null;
-    /** V2: preenchido via varredura + ai-tool (sempre [] na V1). */
+    /** preenchido via varredura + ai-tool (vazio sem grafo). */
     clientFiles: string[];
-    /** V2: preenchido via varredura + ai-tool (sempre [] na V1). */
+    /** preenchido via varredura + ai-tool (vazio sem grafo). */
     serverFiles: string[];
 }
 declare function discover(rootDir: string): DiscoveryResult;
@@ -634,7 +643,7 @@ declare const SERVER_HINTS_SEGMENTS: string[];
 declare function classifyOrigin(file: string, content: string): "CLIENT" | "SERVER" | "UNKNOWN";
 declare function emptyModel(rootDir: string, d: DiscoveryResult): ProjectModel;
 /**
- * Fase 3 — enriquece Discovery com grafo do ai-tool (como lib, sem spawn/MCP).
+ * Fase opcional — enriquece Discovery com grafo do ai-tool (como lib, sem spawn/MCP).
  * Preenche clientFiles/serverFiles a partir do mapa do projeto.
  * Nunca joga: falha do ai-tool mantém listas vazias (honesto).
  */
@@ -724,8 +733,8 @@ declare function findPublicAllowsContent(rawContent: string): {
 }[];
 
 /**
- * Checks V1+V2 (FBA001–FBA004, FBA009–FBA013, subconjunto intencional).
- * Fingerprints v2: FBA001/FBA002 por regra-lógica + hash da condição
+ * Checks (FBA001–FBA004, FBA009–FBA013, subconjunto intencional).
+ * Fingerprints: FBA001/FBA002 por regra-lógica + hash da condição
  * (estáveis a formatação, únicos por regra duplicada);
  * FBA003/FBA004/FBA010/FBA012 com linha (únicos por ocorrência).
  */
@@ -736,7 +745,7 @@ declare function runChecks(model: ProjectModel, rootDir: string, opts?: {
 }): Promise<Finding[]>;
 
 /**
- * scan — orquestra Discovery → Rules → Checks (V1 static-first).
+ * scan — orquestra Discovery → Rules → Checks (estático primeiro).
  */
 
 interface ScanOptions {
@@ -744,7 +753,7 @@ interface ScanOptions {
     strict?: boolean;
     /**
      * Opt-in: enriquece Discovery com grafo do ai-tool (clientFiles/serverFiles).
-     * Default false (scan static-first rápido; nenhum check consome o grafo na 0.4.0).
+     * Default false (scan estático rápido; nenhum check consome o grafo por padrão).
      */
     graph?: boolean;
 }
@@ -752,14 +761,16 @@ interface ScanSummary {
     errors: number;
     warnings: number;
     infos: number;
-    /** Compat: mesmo que passedChecks. */
-    passed: number;
-    /** Compat: mesmo que totalChecks. */
-    total: number;
     passedChecks: number;
     totalChecks: number;
-    /** Findings de infra (fora dos checks FBA): rules/contrato/índices/model. */
-    infraSkipped: number;
+    /** Infra nomeada (fora dos checks FBA): cada item diz qual e por quê. */
+    infra: {
+        rule: string;
+        message: string;
+    }[];
+    /** O que foi olhado e o que foi pulado — nunca dizer "tudo certo" sem lista. */
+    checked: string[];
+    skipped: string[];
     /** Cobertura de Rules (0-100) quando verify com coverage avalia; null = não observada.
      * Sempre null no scan() por desenho (cobertura só via verify coveragePct). */
     coveragePct: number | null;
@@ -772,11 +783,11 @@ interface ScanResult {
 declare function scan(rootDir: string, opts?: ScanOptions): Promise<ScanResult>;
 
 /**
- * V3 — Verifier (Emulator) como interface honesta.
+ * Verifier (Emulator) como interface honesta.
  *
  * Não executa o Emulator sozinho (precisa de firebase-tools + Java no host).
- * Gera a matriz de casos (TestCase → Scenario) e avalia cobertura quando
- * o JSON do endpoint `:ruleCoverage` é fornecido (--coverage).
+ * Gera a matriz de casos e avalia cobertura quando
+ * o JSON do endpoint `ruleCoverage` é fornecido (--coverage).
  */
 
 interface VerifyCase {
@@ -804,10 +815,9 @@ declare function planVerify(model: ProjectModel): VerifyCase[];
 declare function verify(model: ProjectModel, opts?: VerifyOptions): VerifyResult;
 
 /**
- * V4 — Drift local vs implantado (comparação honesta de índices).
+ * Drift local vs implantado (comparação honesta de índices).
  *
- * Compara `firestore.indexes.json` local contra um JSON remoto
- * (`gcloud firestore indexes composite list --format=json` ou REST).
+ * Compara `firestore.indexes.json` local contra um JSON remoto.
  * Nunca afirma "unused" — apenas LOCAL_ONLY / REMOTE_ONLY / MATCHED.
  */
 

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-IXMAWDJH.js";
+} from "./chunk-EHGW2EX6.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -53,11 +53,11 @@ import {
   stripOuterParens,
   stripRuleComments,
   validateClaimSamples
-} from "./chunk-3SEVYYCX.js";
+} from "./chunk-TQZTE2NR.js";
 import {
   planVerify,
   verify
-} from "./chunk-PSSMYRRU.js";
+} from "./chunk-2X3BTSGP.js";
 import {
   drift
 } from "./chunk-NJBCSW7E.js";

package/dist/mcp-cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-IXMAWDJH.js";
-import "./chunk-3SEVYYCX.js";
-import "./chunk-PSSMYRRU.js";
+} from "./chunk-EHGW2EX6.js";
+import "./chunk-TQZTE2NR.js";
+import "./chunk-2X3BTSGP.js";
 import "./chunk-NJBCSW7E.js";
 
 // src/mcp-cli.ts

package/dist/mcp.js

@@ -1,9 +1,9 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-IXMAWDJH.js";
-import "./chunk-3SEVYYCX.js";
-import "./chunk-PSSMYRRU.js";
+} from "./chunk-EHGW2EX6.js";
+import "./chunk-TQZTE2NR.js";
+import "./chunk-2X3BTSGP.js";
 import "./chunk-NJBCSW7E.js";
 export {
   createMcpServer,

package/dist/{scan-VREY2FGO.js → scan-FYAWNRIE.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-3SEVYYCX.js";
+} from "./chunk-TQZTE2NR.js";
 export {
   scan
 };

package/dist/{verify-O722ZZBV.js → verify-GWRLO344.js}

@@ -1,7 +1,7 @@
 import {
   planVerify,
   verify
-} from "./chunk-PSSMYRRU.js";
+} from "./chunk-2X3BTSGP.js";
 export {
   planVerify,
   verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -4,11 +4,11 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 
 ## Sequência obrigatória
 
-1. Descobrir projeto (`firebase.json`, `firestore.rules`, `firestore.indexes.json`)
-2. Verificar `firebase-audit.yaml` (se não existe, V1 roda zero-config)
-3. Inspecionar adapter de autorização (ex: `rbac.can`). Sem adapter resolvido → UNKNOWN, nunca adivinhar
-4. Executar `firebase-audit scan` (ou `--strict` com contrato)
-5. Ler findings (CONFIRMED corrige agora; PROBABLE investiga; NOT_OBSERVED/UNKNOWN não afirma)
+1. Descobrir projeto (`firebase.json`, `firestore.rules`, `storage.rules`, `firestore.indexes.json`)
+2. Verificar `firebase-audit.yaml` (se não existe, scan roda zero-config)
+3. Inspecionar função de permissão no código que recebe o nome como texto (ex: `rbac.can`). Guarda de rota ou function do `.rules` (ex: `isTenantMember`) não vale como adapter — sem adapter, permissões seguem UNKNOWN, nunca adivinhar
+4. Executar `firebase-audit scan` (ou `check` com contrato no CI)
+5. Ler findings (CONFIRMED corrige agora; PROBABLE investiga; NOT_OBSERVED/UNKNOWN não afirma) + `summary.skipped` (o que foi pulado)
 6. Corrigir código, nunca o contrato para esconder finding
 7. Reexecutar scan antes de declarar pronto
 
@@ -18,12 +18,14 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 - Nunca transformar UNKNOWN em CONFIRMED sem teste no Emulator
 - Nunca dizer "unused" — apenas NOT_OBSERVED
 - Claims: 1000 bytes max, sem chaves OIDC reservadas, só controle de acesso
+- AppCheck é carimbo do app oficial — não prova usuário nem tenant
+- Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou `/{allPaths=**}` aberto
 
-## Emulador (V3)
+## Emulador
 
 ```bash
 firebase emulators:exec --only firestore "npm test"
 ```
 
 Matriz `anon/user/admin x read/create/update/delete` com `@firebase/rules-unit-testing`.
-Cobertura em `:ruleCoverage` (JSON). Emulator não prova índice.
+Cobertura em `ruleCoverage` (JSON). Emulator não prova índice. Sem contrato, papéis reduzidos (anonymous/user/admin).