@justmpm/firebase-audit 0.5.0 → 0.5.1

package/dist/chunk-7EWTBIKJ.js

@@ -0,0 +1,356 @@
+// src/rules.ts
+import { readFileSync } from "fs";
+import { createHash } from "crypto";
+var MATCH_RE = /match\s+(\/[^{\s]*(?:\{[^}]*\}[^{\s]*)*)\s*\{/g;
+var ALLOW_RE = /allow\s+([^;:]+)(?::\s*if\s+([^;]+))?;/g;
+function stripRuleComments(content) {
+  let out = "";
+  let i = 0;
+  let quote = null;
+  while (i < content.length) {
+    const c = content[i];
+    const next = content[i + 1] ?? "";
+    if (quote) {
+      out += c;
+      if (c === quote && content[i - 1] !== "\\") quote = null;
+      i += 1;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      out += c;
+      i += 1;
+      continue;
+    }
+    if (c === "/" && next === "/") {
+      while (i < content.length && content[i] !== "\n") i += 1;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      i += 2;
+      while (i < content.length && !(content[i] === "*" && content[i + 1] === "/")) {
+        if (content[i] === "\n") out += "\n";
+        i += 1;
+      }
+      i += 2;
+      continue;
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+function opsFrom(target) {
+  const t = target.trim().toLowerCase();
+  if (t === "read") return { ops: ["read", "get", "list"], known: true };
+  if (t === "write") return { ops: ["write", "create", "update", "delete"], known: true };
+  const parts = t.split(",").map((s) => s.trim()).filter(Boolean);
+  const valid = ["read", "get", "list", "create", "update", "delete", "write"];
+  const out = [];
+  let known = false;
+  for (const p of parts) {
+    if (valid.includes(p)) {
+      known = true;
+      out.push(p);
+      if (p === "write") {
+        for (const extra of ["create", "update", "delete"]) {
+          if (!out.includes(extra)) out.push(extra);
+        }
+      }
+      if (p === "read") {
+        for (const extra of ["get", "list"]) {
+          if (!out.includes(extra)) out.push(extra);
+        }
+      }
+    }
+  }
+  return { ops: out, known: out.length > 0 && known };
+}
+function findBlockEnd(content, openBraceIndex) {
+  let depth = 0;
+  let quote = null;
+  for (let i = openBraceIndex; i < content.length; i++) {
+    const c = content[i];
+    if (quote) {
+      if (c === quote && content[i - 1] !== "\\") quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      continue;
+    }
+    if (c === "{") depth += 1;
+    else if (c === "}") {
+      depth -= 1;
+      if (depth === 0) return i + 1;
+    }
+  }
+  return content.length;
+}
+function normalizeTarget(target) {
+  return target.toLowerCase().split(",").map((s) => s.trim()).filter(Boolean).sort().join(",");
+}
+function parseMatchBlocks(content) {
+  const blocks = [];
+  const matchRe = new RegExp(MATCH_RE.source, "g");
+  let m;
+  while ((m = matchRe.exec(content)) !== null) {
+    const before = content.slice(0, m.index);
+    const line = before.split("\n").length;
+    const openBrace = m.index + m[0].length - 1;
+    blocks.push({ path: m[1], line, blockStart: m.index, blockEnd: findBlockEnd(content, openBrace) });
+  }
+  return blocks;
+}
+function buildFullPath(containingAsc) {
+  const parts = [];
+  for (const b of containingAsc) {
+    const p = b.path.trim();
+    if (/^\/databases\/\{[^}]+\}\/documents\/?$/.test(p)) continue;
+    const stripped = p.replace(/^\/+|\/+$/g, "");
+    if (stripped.length === 0) continue;
+    const docIdx = stripped.indexOf("/documents/");
+    if (stripped.startsWith("databases/") && docIdx !== -1) {
+      const rest = stripped.slice(docIdx + "/documents/".length);
+      if (rest.length > 0) parts.push(rest);
+      continue;
+    }
+    parts.push(stripped);
+  }
+  if (parts.length === 0) return "/(unknown)";
+  return "/" + parts.join("/");
+}
+function parseRuleFunctions(content) {
+  const out = /* @__PURE__ */ new Map();
+  for (const [name, fn] of parseRuleFunctionsDetailed(content)) {
+    out.set(name, fn.body);
+  }
+  return out;
+}
+function parseRuleFunctionsDetailed(content) {
+  const out = /* @__PURE__ */ new Map();
+  const re = /function\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(([^)]*)\)\s*\{/g;
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    const openBrace = m.index + m[0].length - 1;
+    const end = findBlockEnd(content, openBrace);
+    const body = content.slice(openBrace + 1, end - 1);
+    const params = m[2].trim() === "" ? [] : m[2].split(",").map((s) => s.trim()).filter((s) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(s));
+    out.set(m[1], { params, body });
+  }
+  return out;
+}
+function inlineHelperArgs(body, params, args) {
+  let out = body;
+  for (let i = 0; i < params.length; i++) {
+    const p = params[i];
+    const a = (args[i] ?? "").trim();
+    if (!p || !a) continue;
+    out = out.replace(new RegExp(`\\b${p}\\b`, "g"), () => a);
+  }
+  return out;
+}
+function inlineHelpersInCondition(condition, detailed) {
+  let out = condition;
+  for (const [name, fn] of detailed) {
+    const re = new RegExp(`\\b${name}\\s*\\(([^()]*)\\)`, "g");
+    out = out.replace(re, (_m, argsStr) => {
+      const args = argsStr.length === 0 ? [] : String(argsStr).split(",").map((s) => s.trim());
+      const inlined = inlineHelperArgs(fn.body, fn.params, args);
+      return `(${inlined})`;
+    });
+  }
+  return out;
+}
+function resolveHelperCondition(condition, functions) {
+  const t = condition.trim().replace(/;$/, "").trim();
+  const call = /^([A-Za-z_][A-Za-z0-9_]*)\s*\((.*)\)$/.exec(t);
+  if (!call) return condition;
+  const body = functions.get(call[1]);
+  if (body === void 0) return condition;
+  return body;
+}
+function resolveHelperConditionDetailed(condition, detailed) {
+  const t = condition.trim().replace(/;$/, "").trim();
+  const call = /^([A-Za-z_][A-Za-z0-9_]*)\s*\((.*)\)$/.exec(t);
+  if (!call) return condition;
+  const fn = detailed.get(call[1]);
+  if (!fn) return condition;
+  const args = call[2].length === 0 ? [] : call[2].split(",").map((s) => s.trim());
+  return inlineHelperArgs(fn.body, fn.params, args);
+}
+function extractRules(rulesFile, relFile) {
+  const rawContent = readFileSync(rulesFile, "utf-8");
+  return extractRulesContent(rawContent, relFile);
+}
+function extractRulesContent(rawContent, relFile) {
+  const content = stripRuleComments(rawContent);
+  const rules = [];
+  const functions = parseRuleFunctions(content);
+  const detailed = parseRuleFunctionsDetailed(content);
+  const matchBlocks = parseMatchBlocks(content);
+  const allowRe = new RegExp(ALLOW_RE.source, "g");
+  let a;
+  let idx = 0;
+  while ((a = allowRe.exec(content)) !== null) {
+    const before = content.slice(0, a.index);
+    const line = before.split("\n").length;
+    const target = a[1];
+    const rawCondition = (a[2] ?? "").trim();
+    const unconditional = a[2] === void 0;
+    const containing = matchBlocks.filter((b) => b.blockStart <= a.index && a.index < b.blockEnd).sort((x, y) => x.blockStart - y.blockStart);
+    const fullPath = containing.length > 0 ? buildFullPath(containing) : "/(unknown)";
+    const resolved = unconditional ? "" : resolveHelperCondition(rawCondition, functions);
+    const resolvedDetailed = unconditional ? "" : resolveHelperConditionDetailed(rawCondition, detailed);
+    const inlinedBody = unconditional ? "" : inlineHelpersInCondition(rawCondition, detailed);
+    const effectiveBody = resolvedDetailed !== rawCondition ? resolvedDetailed : resolved !== rawCondition ? resolved : inlinedBody;
+    const condition = rawCondition;
+    const authReferences = [];
+    const authSource = `${rawCondition} ${resolved} ${effectiveBody} ${inlinedBody}`;
+    if (authSource.includes("request.auth")) authReferences.push("request.auth");
+    if (authSource.includes("request.auth.uid")) authReferences.push("request.auth.uid");
+    const big = `${rawCondition} ${resolved} ${effectiveBody} ${inlinedBody}`;
+    const claimReferences = [
+      ...big.matchAll(/request\.auth\.token\.([A-Za-z0-9_]+)/g),
+      ...big.matchAll(/request\.auth\.token\.get\(\s*['"]([A-Za-z0-9_]+)['"]/g),
+      ...big.matchAll(/request\.auth\.token\[\s*['"]([A-Za-z0-9_]+)['"]\s*\]/g)
+    ].map((x) => x[1]);
+    const resourceReferences = [...big.matchAll(/resource\.data\.([A-Za-z0-9_]+)/g)].map(
+      (x) => x[1]
+    );
+    const requestResourceReferences = [
+      ...big.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
+    ].map((x) => x[1]);
+    const { ops, known } = opsFrom(target);
+    const isHelperCall = !unconditional && rawCondition !== resolved;
+    const hasAuth = authSource.includes("request.auth");
+    rules.push({
+      id: `rule-${idx++}`,
+      path: fullPath,
+      operations: ops,
+      conditionPresent: !unconditional && condition.length > 0,
+      condition: unconditional ? void 0 : condition,
+      authReferences,
+      claimReferences,
+      resourceReferences,
+      requestResourceReferences,
+      confidence: !known || isHelperCall && !hasAuth ? "UNKNOWN" : "CONFIRMED",
+      location: { file: relFile, start: { line, column: 0 } }
+    });
+  }
+  return rules;
+}
+function stripOuterParens(s) {
+  let norm = s.trim();
+  for (; ; ) {
+    if (!(norm.startsWith("(") && norm.endsWith(")"))) return norm;
+    let depth = 0;
+    let wrapsAll = true;
+    for (let i = 0; i < norm.length; i++) {
+      if (norm[i] === "(") depth += 1;
+      else if (norm[i] === ")") {
+        depth -= 1;
+        if (depth === 0 && i !== norm.length - 1) {
+          wrapsAll = false;
+          break;
+        }
+      }
+    }
+    if (!wrapsAll || depth !== 0) return norm;
+    norm = norm.slice(1, -1).trim();
+  }
+}
+function isPublicCondition(condition) {
+  if (condition === void 0) return { isPublic: true, confidence: "CONFIRMED" };
+  const norm = stripOuterParens(condition);
+  const low = norm.toLowerCase().replace(/\s+/g, "");
+  if (low === "false") return { isPublic: false, confidence: "CONFIRMED" };
+  if (/^!\(.*request\.auth(===|==)null/.test(low)) {
+    return { isPublic: false, confidence: "CONFIRMED" };
+  }
+  if (/^!\(.*request\.auth(!==|!=)null/.test(low)) {
+    return { isPublic: true, confidence: "CONFIRMED" };
+  }
+  if (low.includes("!(request.auth==null)") || low.includes("!(request.auth===null)") || low === "!request.auth==null" || low === "!request.auth===null") {
+    return { isPublic: false, confidence: "CONFIRMED" };
+  }
+  if (low === "true") return { isPublic: true, confidence: "CONFIRMED" };
+  if (/(^|\|\|)true($|\|\|)/.test(low)) return { isPublic: true, confidence: "PROBABLE" };
+  if (low.includes("request.auth==null") || low.includes("request.auth===null")) {
+    return { isPublic: true, confidence: "CONFIRMED" };
+  }
+  if (!low.includes("request.auth")) {
+    return { isPublic: true, confidence: "PROBABLE" };
+  }
+  return { isPublic: false, confidence: "CONFIRMED" };
+}
+function hashShort(text) {
+  return createHash("sha256").update(text, "utf-8").digest("hex").slice(0, 8);
+}
+function conditionKeyForFingerprint(condition) {
+  if (condition === void 0) return "uncond";
+  const norm = stripOuterParens(condition).toLowerCase().replace(/\s+/g, "");
+  if (norm === "") return "uncond";
+  return hashShort(norm);
+}
+function findPublicAllows(rulesFile) {
+  const rawContent = readFileSync(rulesFile, "utf-8");
+  return findPublicAllowsContent(rawContent);
+}
+function helperBodyToCondition(body) {
+  const m = /\breturn\b\s*([^;]+);?/.exec(body);
+  if (m) return m[1].trim();
+  return body;
+}
+function findPublicAllowsContent(rawContent) {
+  const content = stripRuleComments(rawContent);
+  const functions = parseRuleFunctions(content);
+  const detailed = parseRuleFunctionsDetailed(content);
+  const out = [];
+  const parsed = parseMatchBlocks(content);
+  const re = new RegExp(ALLOW_RE.source, "g");
+  let mm;
+  while ((mm = re.exec(content)) !== null) {
+    const line = content.slice(0, mm.index).split("\n").length;
+    const target = mm[1].trim();
+    const single = mm[2] === void 0 ? void 0 : resolveHelperCondition(mm[2], functions);
+    const singleD = mm[2] === void 0 ? void 0 : resolveHelperConditionDetailed(mm[2], detailed);
+    const inlined = mm[2] === void 0 ? void 0 : inlineHelpersInCondition(mm[2], detailed);
+    const effective = singleD !== void 0 && singleD !== mm[2] ? singleD : single !== void 0 && single !== mm[2] ? single : inlined !== void 0 && inlined !== mm[2] ? inlined : mm[2];
+    if (mm[2] !== void 0 && effective !== mm[2] && !String(effective).includes("request.auth")) {
+      const bodyCheck = isPublicCondition(helperBodyToCondition(String(effective)));
+      if (!bodyCheck.isPublic) {
+        continue;
+      }
+    }
+    const check = isPublicCondition(effective);
+    if (!check.isPublic) continue;
+    const ascBlocks = parsed.filter((b) => b.blockStart <= mm.index && mm.index < b.blockEnd).sort((x, y) => x.blockStart - y.blockStart);
+    const path = ascBlocks.length > 0 ? buildFullPath(ascBlocks) : "/(unknown)";
+    out.push({ line, target, path, confidence: check.confidence, conditionKey: conditionKeyForFingerprint(mm[2]) });
+  }
+  return out;
+}
+
+export {
+  stripRuleComments,
+  opsFrom,
+  normalizeTarget,
+  parseMatchBlocks,
+  buildFullPath,
+  parseRuleFunctions,
+  parseRuleFunctionsDetailed,
+  inlineHelperArgs,
+  inlineHelpersInCondition,
+  resolveHelperCondition,
+  resolveHelperConditionDetailed,
+  extractRules,
+  extractRulesContent,
+  stripOuterParens,
+  isPublicCondition,
+  hashShort,
+  conditionKeyForFingerprint,
+  findPublicAllows,
+  helperBodyToCondition,
+  findPublicAllowsContent
+};

package/dist/{chunk-TQZTE2NR.js → chunk-GDO2DLNQ.js}

@@ -1,5 +1,18 @@
+import {
+  conditionKeyForFingerprint,
+  extractRules,
+  findPublicAllowsContent,
+  inlineHelpersInCondition,
+  normalizeTarget,
+  opsFrom,
+  parseRuleFunctionsDetailed,
+  resolveHelperConditionDetailed,
+  stripOuterParens,
+  stripRuleComments
+} from "./chunk-7EWTBIKJ.js";
+
 // src/scan.ts
-import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
+import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
 import { join as join3 } from "path";
 import { parse as parseYaml } from "yaml";
 
@@ -147,342 +160,8 @@ async function enrichWithGraph(rootDir, d) {
   }
 }
 
-// src/rules.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { createHash } from "crypto";
-var MATCH_RE = /match\s+(\/[^{\s]*(?:\{[^}]*\}[^{\s]*)*)\s*\{/g;
-var ALLOW_RE = /allow\s+([^;:]+)(?::\s*if\s+([^;]+))?;/g;
-function stripRuleComments(content) {
-  let out = "";
-  let i = 0;
-  let quote = null;
-  while (i < content.length) {
-    const c = content[i];
-    const next = content[i + 1] ?? "";
-    if (quote) {
-      out += c;
-      if (c === quote && content[i - 1] !== "\\") quote = null;
-      i += 1;
-      continue;
-    }
-    if (c === '"' || c === "'" || c === "`") {
-      quote = c;
-      out += c;
-      i += 1;
-      continue;
-    }
-    if (c === "/" && next === "/") {
-      while (i < content.length && content[i] !== "\n") i += 1;
-      continue;
-    }
-    if (c === "/" && next === "*") {
-      i += 2;
-      while (i < content.length && !(content[i] === "*" && content[i + 1] === "/")) {
-        if (content[i] === "\n") out += "\n";
-        i += 1;
-      }
-      i += 2;
-      continue;
-    }
-    out += c;
-    i += 1;
-  }
-  return out;
-}
-function opsFrom(target) {
-  const t = target.trim().toLowerCase();
-  if (t === "read") return { ops: ["read", "get", "list"], known: true };
-  if (t === "write") return { ops: ["write", "create", "update", "delete"], known: true };
-  const parts = t.split(",").map((s) => s.trim()).filter(Boolean);
-  const valid = ["read", "get", "list", "create", "update", "delete", "write"];
-  const out = [];
-  let known = false;
-  for (const p of parts) {
-    if (valid.includes(p)) {
-      known = true;
-      out.push(p);
-      if (p === "write") {
-        for (const extra of ["create", "update", "delete"]) {
-          if (!out.includes(extra)) out.push(extra);
-        }
-      }
-      if (p === "read") {
-        for (const extra of ["get", "list"]) {
-          if (!out.includes(extra)) out.push(extra);
-        }
-      }
-    }
-  }
-  return { ops: out, known: out.length > 0 && known };
-}
-function findBlockEnd(content, openBraceIndex) {
-  let depth = 0;
-  let quote = null;
-  for (let i = openBraceIndex; i < content.length; i++) {
-    const c = content[i];
-    if (quote) {
-      if (c === quote && content[i - 1] !== "\\") quote = null;
-      continue;
-    }
-    if (c === '"' || c === "'" || c === "`") {
-      quote = c;
-      continue;
-    }
-    if (c === "{") depth += 1;
-    else if (c === "}") {
-      depth -= 1;
-      if (depth === 0) return i + 1;
-    }
-  }
-  return content.length;
-}
-function normalizeTarget(target) {
-  return target.toLowerCase().split(",").map((s) => s.trim()).filter(Boolean).sort().join(",");
-}
-function parseMatchBlocks(content) {
-  const blocks = [];
-  const matchRe = new RegExp(MATCH_RE.source, "g");
-  let m;
-  while ((m = matchRe.exec(content)) !== null) {
-    const before = content.slice(0, m.index);
-    const line = before.split("\n").length;
-    const openBrace = m.index + m[0].length - 1;
-    blocks.push({ path: m[1], line, blockStart: m.index, blockEnd: findBlockEnd(content, openBrace) });
-  }
-  return blocks;
-}
-function buildFullPath(containingAsc) {
-  const parts = [];
-  for (const b of containingAsc) {
-    const p = b.path.trim();
-    if (/^\/databases\/\{[^}]+\}\/documents\/?$/.test(p)) continue;
-    const stripped = p.replace(/^\/+|\/+$/g, "");
-    if (stripped.length === 0) continue;
-    const docIdx = stripped.indexOf("/documents/");
-    if (stripped.startsWith("databases/") && docIdx !== -1) {
-      const rest = stripped.slice(docIdx + "/documents/".length);
-      if (rest.length > 0) parts.push(rest);
-      continue;
-    }
-    parts.push(stripped);
-  }
-  if (parts.length === 0) return "/(unknown)";
-  return "/" + parts.join("/");
-}
-function parseRuleFunctions(content) {
-  const out = /* @__PURE__ */ new Map();
-  for (const [name, fn] of parseRuleFunctionsDetailed(content)) {
-    out.set(name, fn.body);
-  }
-  return out;
-}
-function parseRuleFunctionsDetailed(content) {
-  const out = /* @__PURE__ */ new Map();
-  const re = /function\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(([^)]*)\)\s*\{/g;
-  let m;
-  while ((m = re.exec(content)) !== null) {
-    const openBrace = m.index + m[0].length - 1;
-    const end = findBlockEnd(content, openBrace);
-    const body = content.slice(openBrace + 1, end - 1);
-    const params = m[2].trim() === "" ? [] : m[2].split(",").map((s) => s.trim()).filter((s) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(s));
-    out.set(m[1], { params, body });
-  }
-  return out;
-}
-function inlineHelperArgs(body, params, args) {
-  let out = body;
-  for (let i = 0; i < params.length; i++) {
-    const p = params[i];
-    const a = (args[i] ?? "").trim();
-    if (!p || !a) continue;
-    out = out.replace(new RegExp(`\\b${p}\\b`, "g"), () => a);
-  }
-  return out;
-}
-function inlineHelpersInCondition(condition, detailed) {
-  let out = condition;
-  for (const [name, fn] of detailed) {
-    const re = new RegExp(`\\b${name}\\s*\\(([^()]*)\\)`, "g");
-    out = out.replace(re, (_m, argsStr) => {
-      const args = argsStr.length === 0 ? [] : String(argsStr).split(",").map((s) => s.trim());
-      const inlined = inlineHelperArgs(fn.body, fn.params, args);
-      return `(${inlined})`;
-    });
-  }
-  return out;
-}
-function resolveHelperCondition(condition, functions) {
-  const t = condition.trim().replace(/;$/, "").trim();
-  const call = /^([A-Za-z_][A-Za-z0-9_]*)\s*\((.*)\)$/.exec(t);
-  if (!call) return condition;
-  const body = functions.get(call[1]);
-  if (body === void 0) return condition;
-  return body;
-}
-function resolveHelperConditionDetailed(condition, detailed) {
-  const t = condition.trim().replace(/;$/, "").trim();
-  const call = /^([A-Za-z_][A-Za-z0-9_]*)\s*\((.*)\)$/.exec(t);
-  if (!call) return condition;
-  const fn = detailed.get(call[1]);
-  if (!fn) return condition;
-  const args = call[2].length === 0 ? [] : call[2].split(",").map((s) => s.trim());
-  return inlineHelperArgs(fn.body, fn.params, args);
-}
-function extractRules(rulesFile, relFile) {
-  const rawContent = readFileSync2(rulesFile, "utf-8");
-  return extractRulesContent(rawContent, relFile);
-}
-function extractRulesContent(rawContent, relFile) {
-  const content = stripRuleComments(rawContent);
-  const rules = [];
-  const functions = parseRuleFunctions(content);
-  const detailed = parseRuleFunctionsDetailed(content);
-  const matchBlocks = parseMatchBlocks(content);
-  const allowRe = new RegExp(ALLOW_RE.source, "g");
-  let a;
-  let idx = 0;
-  while ((a = allowRe.exec(content)) !== null) {
-    const before = content.slice(0, a.index);
-    const line = before.split("\n").length;
-    const target = a[1];
-    const rawCondition = (a[2] ?? "").trim();
-    const unconditional = a[2] === void 0;
-    const containing = matchBlocks.filter((b) => b.blockStart <= a.index && a.index < b.blockEnd).sort((x, y) => x.blockStart - y.blockStart);
-    const fullPath = containing.length > 0 ? buildFullPath(containing) : "/(unknown)";
-    const resolved = unconditional ? "" : resolveHelperCondition(rawCondition, functions);
-    const resolvedDetailed = unconditional ? "" : resolveHelperConditionDetailed(rawCondition, detailed);
-    const inlinedBody = unconditional ? "" : inlineHelpersInCondition(rawCondition, detailed);
-    const effectiveBody = resolvedDetailed !== rawCondition ? resolvedDetailed : resolved !== rawCondition ? resolved : inlinedBody;
-    const condition = rawCondition;
-    const authReferences = [];
-    const authSource = `${rawCondition} ${resolved} ${effectiveBody} ${inlinedBody}`;
-    if (authSource.includes("request.auth")) authReferences.push("request.auth");
-    if (authSource.includes("request.auth.uid")) authReferences.push("request.auth.uid");
-    const big = `${rawCondition} ${resolved} ${effectiveBody} ${inlinedBody}`;
-    const claimReferences = [
-      ...big.matchAll(/request\.auth\.token\.([A-Za-z0-9_]+)/g),
-      ...big.matchAll(/request\.auth\.token\.get\(\s*['"]([A-Za-z0-9_]+)['"]/g),
-      ...big.matchAll(/request\.auth\.token\[\s*['"]([A-Za-z0-9_]+)['"]\s*\]/g)
-    ].map((x) => x[1]);
-    const resourceReferences = [...big.matchAll(/resource\.data\.([A-Za-z0-9_]+)/g)].map(
-      (x) => x[1]
-    );
-    const requestResourceReferences = [
-      ...big.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
-    ].map((x) => x[1]);
-    const { ops, known } = opsFrom(target);
-    const isHelperCall = !unconditional && rawCondition !== resolved;
-    const hasAuth = authSource.includes("request.auth");
-    rules.push({
-      id: `rule-${idx++}`,
-      path: fullPath,
-      operations: ops,
-      conditionPresent: !unconditional && condition.length > 0,
-      condition: unconditional ? void 0 : condition,
-      authReferences,
-      claimReferences,
-      resourceReferences,
-      requestResourceReferences,
-      confidence: !known || isHelperCall && !hasAuth ? "UNKNOWN" : "CONFIRMED",
-      location: { file: relFile, start: { line, column: 0 } }
-    });
-  }
-  return rules;
-}
-function stripOuterParens(s) {
-  let norm = s.trim();
-  for (; ; ) {
-    if (!(norm.startsWith("(") && norm.endsWith(")"))) return norm;
-    let depth = 0;
-    let wrapsAll = true;
-    for (let i = 0; i < norm.length; i++) {
-      if (norm[i] === "(") depth += 1;
-      else if (norm[i] === ")") {
-        depth -= 1;
-        if (depth === 0 && i !== norm.length - 1) {
-          wrapsAll = false;
-          break;
-        }
-      }
-    }
-    if (!wrapsAll || depth !== 0) return norm;
-    norm = norm.slice(1, -1).trim();
-  }
-}
-function isPublicCondition(condition) {
-  if (condition === void 0) return { isPublic: true, confidence: "CONFIRMED" };
-  const norm = stripOuterParens(condition);
-  const low = norm.toLowerCase().replace(/\s+/g, "");
-  if (low === "false") return { isPublic: false, confidence: "CONFIRMED" };
-  if (/^!\(.*request\.auth(===|==)null/.test(low)) {
-    return { isPublic: false, confidence: "CONFIRMED" };
-  }
-  if (/^!\(.*request\.auth(!==|!=)null/.test(low)) {
-    return { isPublic: true, confidence: "CONFIRMED" };
-  }
-  if (low.includes("!(request.auth==null)") || low.includes("!(request.auth===null)") || low === "!request.auth==null" || low === "!request.auth===null") {
-    return { isPublic: false, confidence: "CONFIRMED" };
-  }
-  if (low === "true") return { isPublic: true, confidence: "CONFIRMED" };
-  if (/(^|\|\|)true($|\|\|)/.test(low)) return { isPublic: true, confidence: "PROBABLE" };
-  if (low.includes("request.auth==null") || low.includes("request.auth===null")) {
-    return { isPublic: true, confidence: "CONFIRMED" };
-  }
-  if (!low.includes("request.auth")) {
-    return { isPublic: true, confidence: "PROBABLE" };
-  }
-  return { isPublic: false, confidence: "CONFIRMED" };
-}
-function hashShort(text) {
-  return createHash("sha256").update(text, "utf-8").digest("hex").slice(0, 8);
-}
-function conditionKeyForFingerprint(condition) {
-  if (condition === void 0) return "uncond";
-  const norm = stripOuterParens(condition).toLowerCase().replace(/\s+/g, "");
-  if (norm === "") return "uncond";
-  return hashShort(norm);
-}
-function findPublicAllows(rulesFile) {
-  const rawContent = readFileSync2(rulesFile, "utf-8");
-  return findPublicAllowsContent(rawContent);
-}
-function helperBodyToCondition(body) {
-  const m = /\breturn\b\s*([^;]+);?/.exec(body);
-  if (m) return m[1].trim();
-  return body;
-}
-function findPublicAllowsContent(rawContent) {
-  const content = stripRuleComments(rawContent);
-  const functions = parseRuleFunctions(content);
-  const detailed = parseRuleFunctionsDetailed(content);
-  const out = [];
-  const parsed = parseMatchBlocks(content);
-  const re = new RegExp(ALLOW_RE.source, "g");
-  let mm;
-  while ((mm = re.exec(content)) !== null) {
-    const line = content.slice(0, mm.index).split("\n").length;
-    const target = mm[1].trim();
-    const single = mm[2] === void 0 ? void 0 : resolveHelperCondition(mm[2], functions);
-    const singleD = mm[2] === void 0 ? void 0 : resolveHelperConditionDetailed(mm[2], detailed);
-    const inlined = mm[2] === void 0 ? void 0 : inlineHelpersInCondition(mm[2], detailed);
-    const effective = singleD !== void 0 && singleD !== mm[2] ? singleD : single !== void 0 && single !== mm[2] ? single : inlined !== void 0 && inlined !== mm[2] ? inlined : mm[2];
-    if (mm[2] !== void 0 && effective !== mm[2] && !String(effective).includes("request.auth")) {
-      const bodyCheck = isPublicCondition(helperBodyToCondition(String(effective)));
-      if (!bodyCheck.isPublic) {
-        continue;
-      }
-    }
-    const check = isPublicCondition(effective);
-    if (!check.isPublic) continue;
-    const ascBlocks = parsed.filter((b) => b.blockStart <= mm.index && mm.index < b.blockEnd).sort((x, y) => x.blockStart - y.blockStart);
-    const path = ascBlocks.length > 0 ? buildFullPath(ascBlocks) : "/(unknown)";
-    out.push({ line, target, path, confidence: check.confidence, conditionKey: conditionKeyForFingerprint(mm[2]) });
-  }
-  return out;
-}
-
 // src/checks.ts
-import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
 import { join as join2 } from "path";
 import { executeFind } from "@justmpm/supergrep";
 var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
@@ -521,7 +200,7 @@ async function runChecks(model, rootDir, opts = {}) {
   let helperDetailed = /* @__PURE__ */ new Map();
   if (absRules && existsSync2(absRules)) {
     try {
-      const rawAll = readFileSync3(absRules, "utf-8");
+      const rawAll = readFileSync2(absRules, "utf-8");
       pubs = findPublicAllowsContent(rawAll);
       helperDetailed = parseRuleFunctionsDetailed(rawAll);
     } catch {
@@ -574,7 +253,7 @@ async function runChecks(model, rootDir, opts = {}) {
   const declared = new Set(model.authorization.permissions.map((p) => p.name));
   if (permissionCalls.literals.length === 0 && permissionCalls.dynamic.length === 0) {
     const tenantHint = [...helperDetailed.keys()].find(
-      (n) => /tenant|member|signedin/i.test(n)
+      (n) => /tenant|isMember|isSignedIn|_member/i.test(n)
     );
     findings.push(
       make(
@@ -811,7 +490,7 @@ async function runChecks(model, rootDir, opts = {}) {
   for (const hit of adminHits) {
     let origin = "UNKNOWN";
     try {
-      const content = readFileSync3(join2(rootDir, hit.file), "utf-8");
+      const content = readFileSync2(join2(rootDir, hit.file), "utf-8");
       origin = classifyOrigin(hit.file, content);
     } catch {
       origin = "UNKNOWN";
@@ -1164,7 +843,7 @@ async function scan(rootDir, opts = {}) {
   const findings_pre = [];
   try {
     if (d.firebaseJson && existsSync3(d.firebaseJson)) {
-      const raw = JSON.parse(readFileSync4(d.firebaseJson, "utf-8"));
+      const raw = JSON.parse(readFileSync3(d.firebaseJson, "utf-8"));
       for (const [kind, rel] of [
         ["rules", raw.firestore?.rules],
         ["indexes", raw.firestore?.indexes]
@@ -1219,7 +898,7 @@ async function scan(rootDir, opts = {}) {
   }
   if (d.firestoreIndexesFile && existsSync3(d.firestoreIndexesFile)) {
     try {
-      const raw = JSON.parse(readFileSync4(d.firestoreIndexesFile, "utf-8"));
+      const raw = JSON.parse(readFileSync3(d.firestoreIndexesFile, "utf-8"));
       if (Array.isArray(raw.fieldOverrides) && raw.fieldOverrides.length > 0) {
         findings_pre.push({
           rule: "FIELD_OVERRIDES_PRESENT",
@@ -1299,7 +978,7 @@ async function scan(rootDir, opts = {}) {
   }
   if (d.auditYamlFile && existsSync3(d.auditYamlFile)) {
     try {
-      const text = readFileSync4(d.auditYamlFile, "utf-8");
+      const text = readFileSync3(d.auditYamlFile, "utf-8");
       const parsed = parseYaml(text);
       const validated = AuditYamlSchema.safeParse(parsed);
       if (validated.success) {
@@ -1394,44 +1073,51 @@ async function scan(rootDir, opts = {}) {
   if (d.storageRulesFile && existsSync3(d.storageRulesFile)) {
     checked.push("storage.rules");
     try {
-      const raw = readFileSync4(d.storageRulesFile, "utf-8");
+      const raw = readFileSync3(d.storageRulesFile, "utf-8");
       const relStorage = model.firebase.storage?.rulesFile ?? "storage.rules";
-      const low = raw.toLowerCase().replace(/\s+/g, "");
-      const hasAllPaths = raw.includes("allPaths=**") || raw.includes("allPaths = **");
-      const writeOpen = /allowwrite:[^;]*iftrue/.test(low);
-      const getOpen = /allowget:[^;]*iftrue/.test(low);
-      if (writeOpen) {
-        findings.push({
-          rule: "STORAGE_PUBLIC_WRITE",
-          severity: "ERROR",
-          confidence: "CONFIRMED",
-          message: `Storage com escrita aberta (${relStorage}). Qualquer cliente pode escrever \u2014 cofre aberto, n\xE3o vitrine.`,
-          fingerprint: "STORAGE_PUBLIC_WRITE",
-          file: relStorage,
-          evidence: [{ id: "ev-storage-write", kind: "storage-public", summary: "write if true", confidence: "CONFIRMED" }],
-          fix: "Exigir request.auth (e dono/tenant) no write. Deixe get aberto s\xF3 em pasta de vitrine como logos/."
-        });
-      } else if (hasAllPaths && getOpen) {
-        findings.push({
-          rule: "STORAGE_ALL_PATHS_OPEN",
-          severity: "WARNING",
-          confidence: "PROBABLE",
-          message: `Storage com get aberto em /{allPaths=**} (${relStorage}). Vale para tudo \u2014 se a inten\xE7\xE3o era s\xF3 logo, restrinja a /logos/{id}.`,
-          fingerprint: "STORAGE_ALL_PATHS_OPEN",
-          file: relStorage,
-          evidence: [{ id: "ev-storage-all", kind: "storage-public", summary: "allPaths get true", confidence: "PROBABLE" }],
-          fix: "Troque /{allPaths=**} por pastas expl\xEDcitas (ex: /logos/{logoId}) com get: if true e write restrito."
-        });
-      } else if (getOpen) {
-        findings.push({
-          rule: "STORAGE_PUBLIC_READ",
-          severity: "INFO",
-          confidence: "PROBABLE",
-          message: `Storage com leitura aberta (${relStorage}). Pode ser vitrine proposital (logos) \u2014 confirme que o write segue restrito.`,
-          fingerprint: "STORAGE_PUBLIC_READ",
-          file: relStorage,
-          evidence: [{ id: "ev-storage-read", kind: "storage-public", summary: "get if true", confidence: "PROBABLE" }]
-        });
+      const clean = stripRuleComments(raw);
+      const low = clean.toLowerCase().replace(/\s+/g, "");
+      const hasAllPaths = low.includes("allpaths=**") || /\{[^}]*=\*\*\}/.test(low);
+      for (const m of parseStorageAllows(clean)) {
+        const open = m.condition === void 0 || m.condition.trim().toLowerCase().replace(/\s+/g, "") === "true";
+        if (!open) continue;
+        const ops = expandStorageOps(m.target);
+        const key = conditionKeyForFingerprint(m.condition);
+        if (ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete")) {
+          findings.push({
+            rule: "STORAGE_PUBLIC_WRITE",
+            severity: "ERROR",
+            confidence: "CONFIRMED",
+            message: `Storage com escrita aberta (${relStorage}, allow ${m.target}). Qualquer cliente pode escrever \u2014 cofre aberto, n\xE3o vitrine.`,
+            fingerprint: `STORAGE_PUBLIC_WRITE:${m.target}:${key}`,
+            file: relStorage,
+            evidence: [{ id: `ev-storage-write-${findings.length}`, kind: "storage-public", summary: `${m.target} if true`, confidence: "CONFIRMED" }],
+            fix: "Exigir request.auth (e dono/tenant) no write. Deixe get aberto s\xF3 em pasta de vitrine como logos/."
+          });
+        } else if (ops.has("read") || ops.has("get") || ops.has("list")) {
+          if (hasAllPaths) {
+            findings.push({
+              rule: "STORAGE_ALL_PATHS_OPEN",
+              severity: "WARNING",
+              confidence: "PROBABLE",
+              message: `Storage com leitura aberta em curinga total (${relStorage}, allow ${m.target}). Vale para tudo \u2014 se a inten\xE7\xE3o era s\xF3 logo, restrinja a /logos/{id}.`,
+              fingerprint: `STORAGE_ALL_PATHS_OPEN:${m.target}:${key}`,
+              file: relStorage,
+              evidence: [{ id: `ev-storage-all-${findings.length}`, kind: "storage-public", summary: `${m.target} if true`, confidence: "PROBABLE" }],
+              fix: "Troque o curinga total por pastas expl\xEDcitas (ex: /logos/{logoId}) com get: if true e write restrito."
+            });
+          } else {
+            findings.push({
+              rule: "STORAGE_PUBLIC_READ",
+              severity: "INFO",
+              confidence: "PROBABLE",
+              message: `Storage com leitura aberta (${relStorage}, allow ${m.target}). Pode ser vitrine proposital (logos) \u2014 confirme que o write segue restrito.`,
+              fingerprint: `STORAGE_PUBLIC_READ:${m.target}:${key}`,
+              file: relStorage,
+              evidence: [{ id: `ev-storage-read-${findings.length}`, kind: "storage-public", summary: `${m.target} if true`, confidence: "PROBABLE" }]
+            });
+          }
+        }
       }
     } catch {
       skipped.push("storage.rules ileg\xEDvel \u2014 Storage sem cobertura neste scan");
@@ -1517,10 +1203,15 @@ async function countAppCheckEnforced(rootDir) {
   try {
     const { readdirSync, readFileSync: readSync, statSync: stat } = await import("fs");
     const { join: joinP } = await import("path");
+    const { stripRuleComments: strip } = await import("./rules-GTGZWN5U.js");
     const roots = [joinP(rootDir, "functions")];
     let count = 0;
     const stack = [...roots];
     let guard = 0;
+    const isTestFile = (p) => {
+      const n = p.replace(/\\/g, "/");
+      return /\.test\.[tj]sx?$/.test(n) || /\.spec\.[tj]sx?$/.test(n) || /(^|\/)__tests__\//.test(n);
+    };
     while (stack.length > 0 && guard < 200) {
       guard += 1;
       const cur = stack.pop();
@@ -1545,9 +1236,11 @@ async function countAppCheckEnforced(rootDir) {
           continue;
         }
         if (!/\.(ts|js|mjs|cjs)$/.test(name)) continue;
+        if (isTestFile(abs)) continue;
         try {
-          const text = readSync(abs, "utf-8");
-          if (/enforceAppCheck\s*:\s*true/.test(text)) count += 1;
+          const text = strip(readSync(abs, "utf-8"));
+          const hits = text.match(/enforceAppCheck\s*:\s*true/g);
+          if (hits) count += hits.length;
         } catch {
         }
       }
@@ -1557,6 +1250,33 @@ async function countAppCheckEnforced(rootDir) {
     return 0;
   }
 }
+function parseStorageAllows(clean) {
+  const out = [];
+  const re = /allow\s+([^;:]+?)(?::\s*if\s+([^;]+))?;/gi;
+  let m;
+  while ((m = re.exec(clean)) !== null) {
+    out.push({ target: m[1].trim(), condition: m[2]?.trim() });
+  }
+  return out;
+}
+function expandStorageOps(target) {
+  const out = /* @__PURE__ */ new Set();
+  for (const part of target.toLowerCase().split(",").map((s) => s.trim()).filter(Boolean)) {
+    if (part === "read") {
+      out.add("read");
+      out.add("get");
+      out.add("list");
+    } else if (part === "write") {
+      out.add("write");
+      out.add("create");
+      out.add("update");
+      out.add("delete");
+    } else {
+      out.add(part);
+    }
+  }
+  return out;
+}
 
 export {
   discover,
@@ -1564,26 +1284,6 @@ export {
   classifyOrigin,
   emptyModel,
   enrichWithGraph,
-  stripRuleComments,
-  opsFrom,
-  normalizeTarget,
-  parseMatchBlocks,
-  buildFullPath,
-  parseRuleFunctions,
-  parseRuleFunctionsDetailed,
-  inlineHelperArgs,
-  inlineHelpersInCondition,
-  resolveHelperCondition,
-  resolveHelperConditionDetailed,
-  extractRules,
-  extractRulesContent,
-  stripOuterParens,
-  isPublicCondition,
-  hashShort,
-  conditionKeyForFingerprint,
-  findPublicAllows,
-  helperBodyToCondition,
-  findPublicAllowsContent,
   IMPLEMENTED_CHECKS,
   runChecks,
   SeveritySchema,

package/dist/{chunk-EHGW2EX6.js → chunk-QACXCMYB.js}

@@ -1,12 +1,12 @@
 import {
   scan
-} from "./chunk-TQZTE2NR.js";
+} from "./chunk-GDO2DLNQ.js";
 import {
   verify
-} from "./chunk-2X3BTSGP.js";
+} from "./chunk-Y4VXWSKX.js";
 import {
   drift
-} from "./chunk-NJBCSW7E.js";
+} from "./chunk-XZ32YQQC.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/dist/{chunk-NJBCSW7E.js → chunk-XZ32YQQC.js}

@@ -128,6 +128,16 @@ function drift(localFile, remoteFile) {
   }
   const remoteByKey = new Map(remote.map((r) => [keyOf(r), r]));
   const localByKey = new Map(local.map((l) => [keyOf(l), l]));
+  if (local.length !== localByKey.size || remote.length !== remoteByKey.size) {
+    findings.push({
+      rule: "DRIFT_DUPLICATE_KEY",
+      severity: "INFO",
+      confidence: "CONFIRMED",
+      message: "\xCDndices duplicados colapsados por chave \u2014 revise o arquivo de origem.",
+      fingerprint: "DRIFT_DUPLICATE_KEY",
+      evidence: [{ id: "ev-drift-dup", kind: "drift-parse", summary: "chave duplicada", confidence: "CONFIRMED" }]
+    });
+  }
   const entries = [];
   for (const [key, l] of localByKey) {
     if (remoteByKey.has(key)) entries.push({ key, status: "MATCHED", local: l, remote: remoteByKey.get(key) });

package/dist/{chunk-2X3BTSGP.js → chunk-Y4VXWSKX.js}

@@ -39,7 +39,7 @@ function planVerify(model) {
   }
   const seen = /* @__PURE__ */ new Set();
   return cases.filter((c) => {
-    const k = `${c.role}:${c.operation}:${c.path}`;
+    const k = `${c.role}:${c.operation}:${c.pathTemplate}:${c.path}`;
     if (seen.has(k)) return false;
     seen.add(k);
     return true;
@@ -105,8 +105,11 @@ function verify(model, opts = {}) {
   if (coveragePct === 100) {
     return { cases, uncovered: [], findings, coveragePct };
   }
+  const seenPaths = /* @__PURE__ */ new Set();
   for (const rule of model.rules) {
     if (rule.path === "/(unknown)") continue;
+    if (seenPaths.has(rule.path)) continue;
+    seenPaths.add(rule.path);
     uncovered.push(rule.path);
   }
   return { cases, uncovered, findings, coveragePct };

package/dist/cli.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-TQZTE2NR.js";
+} from "./chunk-GDO2DLNQ.js";
+import "./chunk-7EWTBIKJ.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -64,19 +65,21 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-FYAWNRIE.js");
-    const { verify } = await import("./verify-GWRLO344.js");
+    const { scan: scanForVerify } = await import("./scan-4Q4XVLJU.js");
+    const { verify } = await import("./verify-WBVSESHD.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");
     const coveragePath = coverageArg ? resolveVerify(rootDir, coverageArg) : void 0;
     const { model } = await scanForVerify(rootDir, { adapterFn: adapterArg });
     const res = verify(model, { coverageFile: coveragePath });
+    const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
+    const rolesReduced = model.authorization.roles.length === 0;
     if (asJson) {
-      console.log(JSON.stringify({ cases: res.cases.slice(0, 50), casesTotal: res.cases.length, truncated: res.cases.length > 50, uncovered: res.uncovered.slice(0, 20), uncoveredTotal: res.uncovered.length, coveragePct: res.coveragePct, findings: res.findings }, null, 2));
+      console.log(JSON.stringify({ roles, rolesReduced, cases: res.cases.slice(0, 50), casesTotal: res.cases.length, truncated: res.cases.length > 50, uncovered: res.uncovered.slice(0, 20), uncoveredTotal: res.uncovered.length, coveragePct: res.coveragePct, findings: res.findings }, null, 2));
       return;
     }
     const covStr = res.coveragePct === null ? "sem cobertura observada" : `${res.coveragePct}% de express\xF5es visitadas`;
-    const rolesNote = "pap\xE9is reduzidos (sem contrato: anonymous/user/admin)";
+    const rolesNote = rolesReduced ? "pap\xE9is reduzidos (sem contrato: anonymous/user/admin)" : `${roles.length} pap\xE9is do contrato (${roles.join(", ")})`;
     console.log(`
 FIREBASE AUDIT verify \u2014 ${res.cases.length} casos planejados (${rolesNote}), ${res.uncovered.length} paths sem cobertura (${covStr}).`);
     for (const f of res.findings) {
@@ -95,7 +98,7 @@ ${icon} ${f.rule} [${f.confidence}]
     return;
   }
   if (cmd === "drift") {
-    const { drift } = await import("./drift-KU7HWL7M.js");
+    const { drift } = await import("./drift-QXALNO2V.js");
     const { resolve: resolveDrift } = await import("path");
     const { existsSync: existsDrift } = await import("fs");
     const localArg = getArg("local");
@@ -109,7 +112,7 @@ ${icon} ${f.rule} [${f.confidence}]
     for (const [label, p] of [["--local", localPath], ["--remote", remotePath]]) {
       if (p && !existsDrift(p)) {
         if (asJson) {
-          const { drift: driftMissing } = await import("./drift-KU7HWL7M.js");
+          const { drift: driftMissing } = await import("./drift-QXALNO2V.js");
           const res2 = driftMissing(
             localPath && existsDrift(localPath) ? localPath : null,
             remotePath && existsDrift(remotePath) ? remotePath : null

package/dist/{drift-KU7HWL7M.js → drift-QXALNO2V.js}

@@ -1,6 +1,6 @@
 import {
   drift
-} from "./chunk-NJBCSW7E.js";
+} from "./chunk-XZ32YQQC.js";
 export {
   drift
 };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-EHGW2EX6.js";
+} from "./chunk-QACXCMYB.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -26,12 +26,17 @@ import {
   RuleSchema,
   SERVER_HINTS_SEGMENTS,
   SeveritySchema,
-  buildFullPath,
   classifyOrigin,
-  conditionKeyForFingerprint,
   discover,
   emptyModel,
   enrichWithGraph,
+  runChecks,
+  scan,
+  validateClaimSamples
+} from "./chunk-GDO2DLNQ.js";
+import {
+  buildFullPath,
+  conditionKeyForFingerprint,
   extractRules,
   extractRulesContent,
   findPublicAllows,
@@ -48,19 +53,16 @@ import {
   parseRuleFunctionsDetailed,
   resolveHelperCondition,
   resolveHelperConditionDetailed,
-  runChecks,
-  scan,
   stripOuterParens,
-  stripRuleComments,
-  validateClaimSamples
-} from "./chunk-TQZTE2NR.js";
+  stripRuleComments
+} from "./chunk-7EWTBIKJ.js";
 import {
   planVerify,
   verify
-} from "./chunk-2X3BTSGP.js";
+} from "./chunk-Y4VXWSKX.js";
 import {
   drift
-} from "./chunk-NJBCSW7E.js";
+} from "./chunk-XZ32YQQC.js";
 
 // src/index.ts
 import { createRequire } from "module";

package/dist/mcp-cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-EHGW2EX6.js";
-import "./chunk-TQZTE2NR.js";
-import "./chunk-2X3BTSGP.js";
-import "./chunk-NJBCSW7E.js";
+} from "./chunk-QACXCMYB.js";
+import "./chunk-GDO2DLNQ.js";
+import "./chunk-7EWTBIKJ.js";
+import "./chunk-Y4VXWSKX.js";
+import "./chunk-XZ32YQQC.js";
 
 // src/mcp-cli.ts
 startMcpServer().catch((err) => {

package/dist/mcp.js

@@ -1,10 +1,11 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-EHGW2EX6.js";
-import "./chunk-TQZTE2NR.js";
-import "./chunk-2X3BTSGP.js";
-import "./chunk-NJBCSW7E.js";
+} from "./chunk-QACXCMYB.js";
+import "./chunk-GDO2DLNQ.js";
+import "./chunk-7EWTBIKJ.js";
+import "./chunk-Y4VXWSKX.js";
+import "./chunk-XZ32YQQC.js";
 export {
   createMcpServer,
   startMcpServer

package/dist/rules-GTGZWN5U.js

@@ -0,0 +1,44 @@
+import {
+  buildFullPath,
+  conditionKeyForFingerprint,
+  extractRules,
+  extractRulesContent,
+  findPublicAllows,
+  findPublicAllowsContent,
+  hashShort,
+  helperBodyToCondition,
+  inlineHelperArgs,
+  inlineHelpersInCondition,
+  isPublicCondition,
+  normalizeTarget,
+  opsFrom,
+  parseMatchBlocks,
+  parseRuleFunctions,
+  parseRuleFunctionsDetailed,
+  resolveHelperCondition,
+  resolveHelperConditionDetailed,
+  stripOuterParens,
+  stripRuleComments
+} from "./chunk-7EWTBIKJ.js";
+export {
+  buildFullPath,
+  conditionKeyForFingerprint,
+  extractRules,
+  extractRulesContent,
+  findPublicAllows,
+  findPublicAllowsContent,
+  hashShort,
+  helperBodyToCondition,
+  inlineHelperArgs,
+  inlineHelpersInCondition,
+  isPublicCondition,
+  normalizeTarget,
+  opsFrom,
+  parseMatchBlocks,
+  parseRuleFunctions,
+  parseRuleFunctionsDetailed,
+  resolveHelperCondition,
+  resolveHelperConditionDetailed,
+  stripOuterParens,
+  stripRuleComments
+};

package/dist/scan-4Q4XVLJU.js

@@ -0,0 +1,7 @@
+import {
+  scan
+} from "./chunk-GDO2DLNQ.js";
+import "./chunk-7EWTBIKJ.js";
+export {
+  scan
+};

package/dist/{verify-GWRLO344.js → verify-WBVSESHD.js}

@@ -1,7 +1,7 @@
 import {
   planVerify,
   verify
-} from "./chunk-2X3BTSGP.js";
+} from "./chunk-Y4VXWSKX.js";
 export {
   planVerify,
   verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -19,7 +19,8 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 - Nunca dizer "unused" — apenas NOT_OBSERVED
 - Claims: 1000 bytes max, sem chaves OIDC reservadas, só controle de acesso
 - AppCheck é carimbo do app oficial — não prova usuário nem tenant
-- Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou `/{allPaths=**}` aberto
+- Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou curinga total aberto
+- Seeds/fixtures com Admin SDK moram em `scripts/` ou `server/`, nunca em `src/` (senão o scan acusa FBA003 de propósito)
 
 ## Emulador
 

package/dist/scan-FYAWNRIE.js

@@ -1,6 +0,0 @@
-import {
-  scan
-} from "./chunk-TQZTE2NR.js";
-export {
-  scan
-};