@justmpm/firebase-audit 0.5.0 → 0.5.2

package/dist/{chunk-NJBCSW7E.js → chunk-XZ32YQQC.js}

@@ -128,6 +128,16 @@ function drift(localFile, remoteFile) {
   }
   const remoteByKey = new Map(remote.map((r) => [keyOf(r), r]));
   const localByKey = new Map(local.map((l) => [keyOf(l), l]));
+  if (local.length !== localByKey.size || remote.length !== remoteByKey.size) {
+    findings.push({
+      rule: "DRIFT_DUPLICATE_KEY",
+      severity: "INFO",
+      confidence: "CONFIRMED",
+      message: "\xCDndices duplicados colapsados por chave \u2014 revise o arquivo de origem.",
+      fingerprint: "DRIFT_DUPLICATE_KEY",
+      evidence: [{ id: "ev-drift-dup", kind: "drift-parse", summary: "chave duplicada", confidence: "CONFIRMED" }]
+    });
+  }
   const entries = [];
   for (const [key, l] of localByKey) {
     if (remoteByKey.has(key)) entries.push({ key, status: "MATCHED", local: l, remote: remoteByKey.get(key) });

package/dist/{chunk-2X3BTSGP.js → chunk-Y4VXWSKX.js}

@@ -39,7 +39,7 @@ function planVerify(model) {
   }
   const seen = /* @__PURE__ */ new Set();
   return cases.filter((c) => {
-    const k = `${c.role}:${c.operation}:${c.path}`;
+    const k = `${c.role}:${c.operation}:${c.pathTemplate}:${c.path}`;
     if (seen.has(k)) return false;
     seen.add(k);
     return true;
@@ -105,8 +105,11 @@ function verify(model, opts = {}) {
   if (coveragePct === 100) {
     return { cases, uncovered: [], findings, coveragePct };
   }
+  const seenPaths = /* @__PURE__ */ new Set();
   for (const rule of model.rules) {
     if (rule.path === "/(unknown)") continue;
+    if (seenPaths.has(rule.path)) continue;
+    seenPaths.add(rule.path);
     uncovered.push(rule.path);
   }
   return { cases, uncovered, findings, coveragePct };

package/dist/cli.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-TQZTE2NR.js";
+} from "./chunk-UKEKA2NQ.js";
+import "./chunk-7EWTBIKJ.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -32,7 +33,7 @@ Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
     process.exit(1);
   }
   const strict = args.includes("--strict") || cmd === "check";
-  const asJson = args.includes("--json");
+  const asJson = args.includes("--json") || args.includes("--json=true");
   const getArg = (name) => {
     const pref = `--${name}=`;
     const hit = args.find((a) => a.startsWith(pref));
@@ -64,19 +65,21 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-FYAWNRIE.js");
-    const { verify } = await import("./verify-GWRLO344.js");
+    const { scan: scanForVerify } = await import("./scan-OEN65GHM.js");
+    const { verify } = await import("./verify-WBVSESHD.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");
     const coveragePath = coverageArg ? resolveVerify(rootDir, coverageArg) : void 0;
     const { model } = await scanForVerify(rootDir, { adapterFn: adapterArg });
     const res = verify(model, { coverageFile: coveragePath });
+    const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
+    const rolesReduced = model.authorization.roles.length === 0;
     if (asJson) {
-      console.log(JSON.stringify({ cases: res.cases.slice(0, 50), casesTotal: res.cases.length, truncated: res.cases.length > 50, uncovered: res.uncovered.slice(0, 20), uncoveredTotal: res.uncovered.length, coveragePct: res.coveragePct, findings: res.findings }, null, 2));
+      console.log(JSON.stringify({ roles, rolesReduced, cases: res.cases.slice(0, 50), casesTotal: res.cases.length, truncated: res.cases.length > 50, uncovered: res.uncovered.slice(0, 20), uncoveredTotal: res.uncovered.length, coveragePct: res.coveragePct, findings: res.findings }, null, 2));
       return;
     }
     const covStr = res.coveragePct === null ? "sem cobertura observada" : `${res.coveragePct}% de express\xF5es visitadas`;
-    const rolesNote = "pap\xE9is reduzidos (sem contrato: anonymous/user/admin)";
+    const rolesNote = rolesReduced ? "pap\xE9is reduzidos (sem contrato: anonymous/user/admin)" : `${roles.length} pap\xE9is do contrato (${roles.join(", ")})`;
     console.log(`
 FIREBASE AUDIT verify \u2014 ${res.cases.length} casos planejados (${rolesNote}), ${res.uncovered.length} paths sem cobertura (${covStr}).`);
     for (const f of res.findings) {
@@ -95,7 +98,7 @@ ${icon} ${f.rule} [${f.confidence}]
     return;
   }
   if (cmd === "drift") {
-    const { drift } = await import("./drift-KU7HWL7M.js");
+    const { drift } = await import("./drift-QXALNO2V.js");
     const { resolve: resolveDrift } = await import("path");
     const { existsSync: existsDrift } = await import("fs");
     const localArg = getArg("local");
@@ -109,7 +112,7 @@ ${icon} ${f.rule} [${f.confidence}]
     for (const [label, p] of [["--local", localPath], ["--remote", remotePath]]) {
       if (p && !existsDrift(p)) {
         if (asJson) {
-          const { drift: driftMissing } = await import("./drift-KU7HWL7M.js");
+          const { drift: driftMissing } = await import("./drift-QXALNO2V.js");
           const res2 = driftMissing(
             localPath && existsDrift(localPath) ? localPath : null,
             remotePath && existsDrift(remotePath) ? remotePath : null
@@ -146,7 +149,7 @@ FIREBASE AUDIT drift \u2014 MATCHED ${counts("MATCHED")}, LOCAL_ONLY ${counts("L
   console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   if (findings.length === 0) {
     console.log(`
-\u2713 Nenhum problema nos checks implementados (${summary.passedChecks}/${summary.totalChecks} passaram).
+\u2713 Nenhum problema nos checks FBA implementados (${summary.passedChecks}/${summary.totalChecks} passaram).
 Olhei: ${summary.checked.join(", ")}.
 Pulei: ${summary.skipped.join(" | ") || "nada"}.
 `);
@@ -161,7 +164,7 @@ ${icon} ${f.rule} [${f.confidence}]${where}
     if (f.fix) console.log(`   \u2192 ${f.fix}`);
   }
   console.log(`
-SUMMARY: ${summary.errors} errors, ${summary.warnings} warnings, ${summary.infos} infos (${summary.passedChecks}/${summary.totalChecks} checks passaram)`);
+SUMMARY: ${summary.errors} errors, ${summary.warnings} warnings, ${summary.infos} infos (${summary.passedChecks}/${summary.totalChecks} checks FBA passaram)`);
   console.log(`Olhei: ${summary.checked.join(", ")}`);
   console.log(`Pulei: ${summary.skipped.join(" | ") || "nada"}
 `);

package/dist/{drift-KU7HWL7M.js → drift-QXALNO2V.js}

@@ -1,6 +1,6 @@
 import {
   drift
-} from "./chunk-NJBCSW7E.js";
+} from "./chunk-XZ32YQQC.js";
 export {
   drift
 };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-EHGW2EX6.js";
+} from "./chunk-AXTYJMA7.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -26,12 +26,17 @@ import {
   RuleSchema,
   SERVER_HINTS_SEGMENTS,
   SeveritySchema,
-  buildFullPath,
   classifyOrigin,
-  conditionKeyForFingerprint,
   discover,
   emptyModel,
   enrichWithGraph,
+  runChecks,
+  scan,
+  validateClaimSamples
+} from "./chunk-UKEKA2NQ.js";
+import {
+  buildFullPath,
+  conditionKeyForFingerprint,
   extractRules,
   extractRulesContent,
   findPublicAllows,
@@ -48,19 +53,16 @@ import {
   parseRuleFunctionsDetailed,
   resolveHelperCondition,
   resolveHelperConditionDetailed,
-  runChecks,
-  scan,
   stripOuterParens,
-  stripRuleComments,
-  validateClaimSamples
-} from "./chunk-TQZTE2NR.js";
+  stripRuleComments
+} from "./chunk-7EWTBIKJ.js";
 import {
   planVerify,
   verify
-} from "./chunk-2X3BTSGP.js";
+} from "./chunk-Y4VXWSKX.js";
 import {
   drift
-} from "./chunk-NJBCSW7E.js";
+} from "./chunk-XZ32YQQC.js";
 
 // src/index.ts
 import { createRequire } from "module";

package/dist/mcp-cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-EHGW2EX6.js";
-import "./chunk-TQZTE2NR.js";
-import "./chunk-2X3BTSGP.js";
-import "./chunk-NJBCSW7E.js";
+} from "./chunk-AXTYJMA7.js";
+import "./chunk-UKEKA2NQ.js";
+import "./chunk-7EWTBIKJ.js";
+import "./chunk-Y4VXWSKX.js";
+import "./chunk-XZ32YQQC.js";
 
 // src/mcp-cli.ts
 startMcpServer().catch((err) => {

package/dist/mcp.js

@@ -1,10 +1,11 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-EHGW2EX6.js";
-import "./chunk-TQZTE2NR.js";
-import "./chunk-2X3BTSGP.js";
-import "./chunk-NJBCSW7E.js";
+} from "./chunk-AXTYJMA7.js";
+import "./chunk-UKEKA2NQ.js";
+import "./chunk-7EWTBIKJ.js";
+import "./chunk-Y4VXWSKX.js";
+import "./chunk-XZ32YQQC.js";
 export {
   createMcpServer,
   startMcpServer

package/dist/rules-GTGZWN5U.js

@@ -0,0 +1,44 @@
+import {
+  buildFullPath,
+  conditionKeyForFingerprint,
+  extractRules,
+  extractRulesContent,
+  findPublicAllows,
+  findPublicAllowsContent,
+  hashShort,
+  helperBodyToCondition,
+  inlineHelperArgs,
+  inlineHelpersInCondition,
+  isPublicCondition,
+  normalizeTarget,
+  opsFrom,
+  parseMatchBlocks,
+  parseRuleFunctions,
+  parseRuleFunctionsDetailed,
+  resolveHelperCondition,
+  resolveHelperConditionDetailed,
+  stripOuterParens,
+  stripRuleComments
+} from "./chunk-7EWTBIKJ.js";
+export {
+  buildFullPath,
+  conditionKeyForFingerprint,
+  extractRules,
+  extractRulesContent,
+  findPublicAllows,
+  findPublicAllowsContent,
+  hashShort,
+  helperBodyToCondition,
+  inlineHelperArgs,
+  inlineHelpersInCondition,
+  isPublicCondition,
+  normalizeTarget,
+  opsFrom,
+  parseMatchBlocks,
+  parseRuleFunctions,
+  parseRuleFunctionsDetailed,
+  resolveHelperCondition,
+  resolveHelperConditionDetailed,
+  stripOuterParens,
+  stripRuleComments
+};

package/dist/scan-OEN65GHM.js

@@ -0,0 +1,7 @@
+import {
+  scan
+} from "./chunk-UKEKA2NQ.js";
+import "./chunk-7EWTBIKJ.js";
+export {
+  scan
+};

package/dist/{verify-GWRLO344.js → verify-WBVSESHD.js}

@@ -1,7 +1,7 @@
 import {
   planVerify,
   verify
-} from "./chunk-2X3BTSGP.js";
+} from "./chunk-Y4VXWSKX.js";
 export {
   planVerify,
   verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -19,7 +19,8 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 - Nunca dizer "unused" — apenas NOT_OBSERVED
 - Claims: 1000 bytes max, sem chaves OIDC reservadas, só controle de acesso
 - AppCheck é carimbo do app oficial — não prova usuário nem tenant
-- Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou `/{allPaths=**}` aberto
+- Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou curinga total aberto
+- Seeds/fixtures com Admin SDK moram em `scripts/` ou `server/`, nunca em `src/` (senão o scan acusa FBA003 de propósito)
 
 ## Emulador
 

package/dist/scan-FYAWNRIE.js

@@ -1,6 +0,0 @@
-import {
-  scan
-} from "./chunk-TQZTE2NR.js";
-export {
-  scan
-};