@justmpm/firebase-audit 0.5.4 → 0.5.6

package/README.md

@@ -163,20 +163,22 @@ Limites assumidos: Emulator não prova índice (produção exige, ele deixa pass
 - `UNKNOWN` — impossível resolver estaticamente (ex: `where(fieldVar, ...)`)
 - `CONFLICTING` — interno, duas evidências se contradizem (ex: typo `order.delete` vs `orders.delete`)
 
-### 10 checks do V1
+### 9 checks implementados (+ avisos de infra e Storage/AppCheck)
 
 | # | Check | Sev | Conf |
 |---|-------|-----|------|
-| FBA001 | `allow write/create/update/delete: if true` | ERROR | CONFIRMED |
-| FBA002 | `allow read: if true` (pode ser público proposital) | WARNING | CONFIRMED |
-| FBA003 | Admin SDK dentro de boundary Client | ERROR | PROBABLE |
+| FBA001 | `allow write/create/update/delete` público | ERROR | CONFIRMED/PROBABLE |
+| FBA002 | `allow read/get/list` público (pode ser proposital) | WARNING | CONFIRMED/PROBABLE |
+| FBA003 | Admin SDK em arquivo de cliente (+ origem indefinida como INFO) | ERROR/INFO | PROBABLE/UNKNOWN |
 | FBA004 | Permission usada e não declarada | ERROR | CONFIRMED |
-| FBA005 | Claim nas Rules não declarada no contrato (pega typo `admn`) | WARNING | PROBABLE |
-| FBA006 | Query provavelmente exige composto não encontrado | WARNING | PROBABLE |
-| FBA007 | Índice local sem query observada | INFO | NOT_OBSERVED |
-| FBA008 | Rule sem operação observada | INFO | NOT_OBSERVED |
-| FBA009 | Adapter não resolvido | WARNING | UNKNOWN |
-| FBA010 | Query shape dinâmica | INFO | UNKNOWN |
+| FBA009 | Adapter não observado (com hint de portaria tenant) | WARNING/INFO | UNKNOWN/NOT_OBSERVED |
+| FBA010 | Permissão dinâmica (não resolvida estaticamente) | INFO | UNKNOWN |
+| FBA011 | Role referencia permission não declarada | ERROR | CONFIRMED |
+| FBA012 | Rule ampla vs contrato admin-only | WARNING | PROBABLE |
+| FBA013 | Role sem permissions | WARNING | CONFIRMED |
+| AUTH_ANON_ALLOWED | `auth != null` sozinho (anônimo passa) | INFO | PROBABLE |
+| STORAGE_* | Escrita aberta / curinga total / leitura aberta / anônimo (por bloco do match) | ERROR/WARNING/INFO | CONFIRMED/PROBABLE |
+| APPCHECK_* | Carimbo observado / verificação manual (onRequest por rota) | INFO | CONFIRMED/PROBABLE |
 
 Detalhes que quebram se deixar pra depois: `write` = create+update+delete (guardar origem), `OR` nas Rules (`isAdmin() || public==true`), `resource` vs `request.resource`, `collectionGroup` com escopo próprio, `databaseId` nomeado desde o dia 1.
 
@@ -193,12 +195,13 @@ Detalhes que quebram se deixar pra depois: `write` = create+update+delete (guard
 
 ## 2. Escopo
 
-**V1 — scan estático:** Discovery + 10 checks + `firebase-audit scan [--json|--strict]`. Zero-config, valor imediato.
-**V2 — check com contrato:** YAML + `Code ↔ Contract ↔ Rules` (mismatch muito amplo, role sem permissão, etc.).
-**V3 — verify:** gera cenários → roda no Emulator → tabela ALLOW/DENY + coverage.
-**V4 — drift:** local vs implantado (`LOCAL_ONLY / REMOTE_ONLY / MATCHED`).
+**Scan:** Discovery + checks + `firebase-audit scan [--json|--strict]`. Zero-config, valor imediato.
+**Check com contrato:** YAML + `Code ↔ Contract ↔ Rules` (mismatch muito amplo, role sem permissão, etc.).
+**Verify:** gera matriz papel×operação×path → roda no Emulator → cobertura `ruleCoverage` (não substitui scan).
+**Drift:** local vs implantado (`LOCAL_ONLY / REMOTE_ONLY / MATCHED`).
 
-Fora do V1: Storage, Realtime DB, Hosting, App Check, Functions complexas, IAM, Data Connect.
+**Escopo atual:** Firestore Rules + Storage Rules (vitrine vs cofre, por bloco) + AppCheck (carimbo, não autorização) + contrato + índices.
+**Fora de escopo (declarado em `summary.skipped`):** Realtime DB, Hosting, Functions complexas, IAM, Data Connect, isolamento por tenant, bancos/buckets extras além do default.
 
 ---
 

package/dist/{chunk-AKPQ4OAJ.js → chunk-BB6XXEIK.js}

@@ -51,18 +51,39 @@ function discover(rootDir) {
   if (firebaseJson) {
     try {
       const raw = JSON.parse(readFileSync(firebaseJson, "utf-8"));
-      if (typeof raw.firestore?.rules === "string") {
-        const p = join(rootDir, raw.firestore.rules);
+      const first = (v) => Array.isArray(v) ? v[0] : v;
+      const fs = first(raw.firestore);
+      const st = first(raw.storage);
+      const fsAny = fs;
+      if (fsAny && typeof fsAny.database === "string" && fsAny.database.length > 0 && fsAny.database !== "(default)") {
+        databaseId = fsAny.database;
+      }
+      if (typeof fs?.rules === "string") {
+        const p = join(rootDir, fs.rules);
         if (existsSync(p)) rulesFile = p;
       }
-      if (typeof raw.firestore?.indexes === "string") {
-        const p = join(rootDir, raw.firestore.indexes);
+      if (typeof fs?.indexes === "string") {
+        const p = join(rootDir, fs.indexes);
         if (existsSync(p)) indexesFile = p;
       }
-      if (typeof raw.storage?.rules === "string") {
-        const p = join(rootDir, raw.storage.rules);
+      if (typeof st?.rules === "string") {
+        const p = join(rootDir, st.rules);
         if (existsSync(p)) storageFile = p;
       }
+      const fns = raw.functions;
+      if (typeof fns === "string" && fns.length > 0) {
+        const p = join(rootDir, fns);
+        try {
+          if (statSync(p).isDirectory()) functionsDir = p;
+        } catch {
+        }
+      } else if (fns && typeof fns === "object" && typeof fns.source === "string" && fns.source.length > 0) {
+        const p = join(rootDir, fns.source);
+        try {
+          if (statSync(p).isDirectory()) functionsDir = p;
+        } catch {
+        }
+      }
     } catch {
     }
   }
@@ -105,7 +126,7 @@ function classifyOrigin(file, content) {
   if (content.includes("firebase-admin") || content.includes("firebase-functions")) {
     return "CLIENT";
   }
-  if (rel.includes("src/") || rel.includes("app/") || rel.includes("components/")) {
+  if (hasSeg("src", "app", "components")) {
     return "CLIENT";
   }
   return "UNKNOWN";
@@ -139,7 +160,7 @@ async function enrichWithGraph(rootDir, d) {
     const ai = await import("@justmpm/ai-tool");
     const res = await ai.map({ cwd: rootDir, format: "json" });
     const files = Array.isArray(res.files) ? res.files : [];
-    const code = files.map((f) => String(f.path).replace(/\\/g, "/")).filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p)).filter((p) => !p.includes("node_modules/") && !/(^|\/)dist\//.test(p)).slice(0, 500);
+    const code = files.map((f) => String(f.path).replace(/\\/g, "/")).filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p)).filter((p) => !p.includes("node_modules/") && !/(^|\/)(dist|build|\.next|coverage|lib)\//.test(p)).slice(0, 500);
     const { readFileSync: readSync, existsSync: existsSyncFn, statSync: statSync2 } = await import("fs");
     const { join: joinP } = await import("path");
     for (const rel of code) {
@@ -164,6 +185,10 @@ async function enrichWithGraph(rootDir, d) {
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
 import { join as join2 } from "path";
 import { executeFind } from "@justmpm/supergrep";
+function isBuildOutput(file) {
+  const n = file.replace(/\\/g, "/");
+  return /(^|\/)(node_modules|dist|build|\.next|coverage|out)\//.test(n);
+}
 var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
 function createEvidence() {
   let counter = 0;
@@ -546,6 +571,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
   }
   const seen = /* @__PURE__ */ new Set();
   const pushLiteral = (file, line, permission) => {
+    if (isBuildOutput(file)) return;
     const k = `${file}:${line}:${permission}`;
     if (seen.has(k)) return;
     seen.add(k);
@@ -558,10 +584,12 @@ async function collectPermissionCalls(rootDir, adapterFn) {
         const raw = (m.metaVariables["PERM"] ?? "").trim();
         const line = m.line + 1;
         if (raw.includes("${")) {
-          const k = `${m.file}:${line}:${raw}`;
-          if (!seen.has(k)) {
-            seen.add(k);
-            dynamic.push({ file: m.file, line, text: m.text });
+          if (!isBuildOutput(m.file)) {
+            const k = `${m.file}:${line}:${raw}`;
+            if (!seen.has(k)) {
+              seen.add(k);
+              dynamic.push({ file: m.file, line, text: m.text });
+            }
           }
           continue;
         }
@@ -570,18 +598,22 @@ async function collectPermissionCalls(rootDir, adapterFn) {
           const perm = raw.replace(/^['"`]|['"`]$/g, "").trim();
           if (/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/.test(perm)) pushLiteral(m.file, line, perm);
           else {
-            const k = `${m.file}:${line}:${raw}:invalid`;
+            if (!isBuildOutput(m.file)) {
+              const k = `${m.file}:${line}:${raw}:invalid`;
+              if (!seen.has(k)) {
+                seen.add(k);
+                dynamic.push({ file: m.file, line, text: m.text });
+              }
+            }
+          }
+        } else if (raw.length > 0) {
+          if (!isBuildOutput(m.file)) {
+            const k = `${m.file}:${line}:${raw}`;
             if (!seen.has(k)) {
               seen.add(k);
               dynamic.push({ file: m.file, line, text: m.text });
             }
           }
-        } else if (raw.length > 0) {
-          const k = `${m.file}:${line}:${raw}`;
-          if (!seen.has(k)) {
-            seen.add(k);
-            dynamic.push({ file: m.file, line, text: m.text });
-          }
         }
       }
     } catch {
@@ -598,6 +630,10 @@ async function collectAdminImports(rootDir) {
     "import $DEFAULT from '$MODULE'",
     'import * as $NS from "$MODULE"',
     "import * as $NS from '$MODULE'",
+    'export { $$$ITEMS } from "$MODULE"',
+    "export { $$$ITEMS } from '$MODULE'",
+    'export * from "$MODULE"',
+    "export * from '$MODULE'",
     'import "$MODULE"',
     "import '$MODULE'",
     'const $X = require("$MODULE")',
@@ -614,6 +650,7 @@ async function collectAdminImports(rootDir) {
       for (const m of result.matches) {
         const mod = m.metaVariables["MODULE"] ?? "";
         if (mod.includes("firebase-admin") || mod.includes("firebase-functions")) {
+          if (isBuildOutput(m.file)) continue;
           const k = `${m.file}:${m.line}:${m.text}`;
           if (seen.has(k)) continue;
           seen.add(k);
@@ -796,7 +833,7 @@ var RoleNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*$/);
 var AuditYamlSchema = z.strictObject({
   $schema: z.string().optional(),
   authorization: z.strictObject({
-    adapter: z.strictObject({ function: z.string().min(1) }).optional(),
+    adapter: z.strictObject({ function: z.string().min(1) }).nullish(),
     roles: z.record(RoleNameSchema, z.strictObject({ permissions: z.array(PermissionNameSchema) })),
     permissions: z.record(
       PermissionNameSchema,
@@ -804,9 +841,10 @@ var AuditYamlSchema = z.strictObject({
     ),
     claims: z.strictObject({
       enabled: z.boolean(),
-      roleKey: z.string().min(1),
+      // Reservado para o futuro (nenhum check consome ainda): opcional.
+      roleKey: z.string().min(1).optional(),
       samples: z.record(RoleNameSchema, z.record(z.string().min(1), z.json())).optional()
-    }).optional()
+    }).nullish()
   })
 });
 var RESERVED_CLAIM_KEYS = [
@@ -860,11 +898,40 @@ async function scan(rootDir, opts = {}) {
   try {
     if (d.firebaseJson && existsSync3(d.firebaseJson)) {
       const raw = JSON.parse(readFileSync3(d.firebaseJson, "utf-8"));
-      for (const [kind, rel, label] of [
-        ["rules", raw.firestore?.rules, "firestore.rules"],
-        ["indexes", raw.firestore?.indexes, "firestore.indexes"],
-        ["storage-rules", raw.storage?.rules, "storage.rules"]
-      ]) {
+      const asList = (v) => v === void 0 ? [] : Array.isArray(v) ? v : [v];
+      const entries = [];
+      for (const f of asList(raw.firestore)) {
+        entries.push({ kind: "rules", rel: f.rules, label: "firestore.rules" });
+        entries.push({ kind: "indexes", rel: f.indexes, label: "firestore.indexes" });
+      }
+      for (const s of asList(raw.storage)) {
+        entries.push({ kind: "storage-rules", rel: s.rules, label: "storage.rules" });
+      }
+      if (Array.isArray(raw.firestore) && raw.firestore.length > 1) {
+        findings_pre.push({
+          rule: "FIREBASE_JSON_ARRAY",
+          severity: "INFO",
+          confidence: "CONFIRMED",
+          message: `firebase.json com ${raw.firestore.length} databases \u2014 este scan audita s\xF3 o default. Bancos nomeados (databaseId) fora do escopo.`,
+          fingerprint: "FIREBASE_JSON_ARRAY:firestore",
+          evidence: [
+            { id: "ev-config-array-fs", kind: "config-parse", summary: `${raw.firestore.length} databases`, confidence: "CONFIRMED" }
+          ]
+        });
+      }
+      if (Array.isArray(raw.storage) && raw.storage.length > 1) {
+        findings_pre.push({
+          rule: "FIREBASE_JSON_ARRAY",
+          severity: "INFO",
+          confidence: "CONFIRMED",
+          message: `firebase.json com ${raw.storage.length} buckets \u2014 este scan audita s\xF3 o default. Buckets extras fora do escopo.`,
+          fingerprint: "FIREBASE_JSON_ARRAY:storage",
+          evidence: [
+            { id: "ev-config-array-st", kind: "config-parse", summary: `${raw.storage.length} buckets`, confidence: "CONFIRMED" }
+          ]
+        });
+      }
+      for (const [kind, rel, label] of entries.map((e) => [e.kind, e.rel, e.label])) {
         if (typeof rel === "string" && rel.length > 0) {
           if (!existsSync3(join3(rootDir, rel))) {
             findings_pre.push({
@@ -1122,6 +1189,9 @@ async function scan(rootDir, opts = {}) {
         return `ev-storage-${prefix}-${evCounter}`;
       };
       for (const m of parseStorageAllows(clean)) {
+        if (m.condition !== void 0 && stripOuterParens(m.condition).toLowerCase().replace(/\s+/g, "") === "false") {
+          continue;
+        }
         const ops = expandStorageOps(m.target);
         const key = conditionKeyForFingerprint(m.condition);
         const normCond = (m.condition ?? "").toLowerCase().replace(/\s+/g, "");
@@ -1242,20 +1312,23 @@ async function scan(rootDir, opts = {}) {
         rule: "APPCHECK_ENFORCED",
         severity: "INFO",
         confidence: "CONFIRMED",
-        message: `enforceAppCheck observado (${appcheck.occurrences} ocorr\xEAncia(s) em ${appcheck.files} arquivo(s)). Carimbo do app oficial \u2014 n\xE3o prova quem \xE9 o usu\xE1rio nem o tenant. Autoriza\xE7\xE3o segue nas Rules/guardas.`,
+        message: `enforceAppCheck observado (${appcheck.occurrences} ocorr\xEAncia(s) em ${appcheck.files} arquivo(s), fora de onRequest). Carimbo do app oficial \u2014 n\xE3o prova quem \xE9 o usu\xE1rio nem o tenant. Autoriza\xE7\xE3o segue nas Rules/guardas.`,
         fingerprint: "APPCHECK_ENFORCED",
         evidence: [{ id: "ev-appcheck", kind: "appcheck", summary: `${appcheck.occurrences} ocorr\xEAncias`, confidence: "CONFIRMED" }]
       });
-    } else if (appcheck.manual === 0) {
+    } else if (appcheck.manual === 0 && appcheck.ignoredOnRequest === 0) {
       skipped.push("functions sem enforceAppCheck literal nem verifyToken observado \u2014 AppCheck sem cobertura afirmativa (config via vari\xE1vel conta como n\xE3o observada; onRequest exige verifica\xE7\xE3o manual por rota)");
     }
+    if (appcheck.ignoredOnRequest > 0) {
+      skipped.push(`enforceAppCheck em onRequest ignorado pelo runtime (${appcheck.ignoredOnRequest} ocorr\xEAncia(s)) \u2014 onRequest exige verifyToken por rota`);
+    }
     if (appcheck.limitHit) {
       skipped.push("functions: teto de varredura atingido \u2014 AppCheck parcial neste scan");
     }
   } else {
     skipped.push("functions n\xE3o observadas \u2014 AppCheck fora deste scan");
   }
-  skipped.push("isolamento por tenant (ownerId/tenantId) n\xE3o verificado \u2014 fora dos checks implementados, nunca verde silencioso");
+  skipped.push("isolamento por tenant (ownerId/tenantId) e mismatch de papel n\xE3o-admin fora dos checks \u2014 coberto s\xF3 via verify/Emulator, nunca verde silencioso");
   const modelCheck = ProjectModelSchema.safeParse(model);
   if (!modelCheck.success) {
     findings.push({
@@ -1320,6 +1393,7 @@ async function countAppCheckEnforced(rootDir) {
     let occurrences = 0;
     const files = /* @__PURE__ */ new Set();
     let manual = 0;
+    let ignoredOnRequest = 0;
     let limitHit = false;
     const stack = [...roots];
     let guard = 0;
@@ -1341,18 +1415,22 @@ async function countAppCheckEnforced(rootDir) {
         const name = e.name;
         const abs = joinP(cur, name);
         let isDir = false;
+        let size = 0;
         try {
-          isDir = stat(abs).isDirectory();
+          const st = stat(abs);
+          isDir = st.isDirectory();
+          size = st.size;
         } catch {
           continue;
         }
         if (isDir) {
-          if (name === "node_modules" || name === "dist" || name === "lib") continue;
+          if (name === "node_modules" || name === "dist" || name === "lib" || name === "build" || name === ".next" || name === "coverage" || name === ".git" || name === "out") continue;
           stack.push(abs);
           continue;
         }
         if (!/\.(ts|js|mjs|cjs|py)$/.test(name)) continue;
         if (isTestFile(abs)) continue;
+        if (size > 100 * 1024) continue;
         try {
           let text = strip(readSync(abs, "utf-8"));
           if (name.endsWith(".py")) {
@@ -1361,10 +1439,16 @@ async function countAppCheckEnforced(rootDir) {
               return idx === -1 ? l : l.slice(0, idx);
             }).join("\n");
           }
-          const hits = text.match(/enforceAppCheck\s*:\s*true|enforce_app_check\s*=\s*True/g);
-          if (hits) {
-            occurrences += hits.length;
-            files.add(abs);
+          for (const em of text.matchAll(/enforceAppCheck\s*:\s*true|enforce_app_check\s*=\s*True/g)) {
+            const before = text.slice(Math.max(0, (em.index ?? 0) - 600), em.index ?? 0);
+            const triggers = [...before.matchAll(/on(Request|Call|request|call)\s*[\(.]/g)].map((t) => t[1].toLowerCase());
+            const last = triggers[triggers.length - 1];
+            if (last === "request") {
+              ignoredOnRequest += 1;
+            } else {
+              occurrences += 1;
+              files.add(abs);
+            }
           }
           const manualHits = text.match(/verifyToken\s*\(|verify_token\s*\(|consumeAppCheckToken|getLimitedUseToken|getAppCheck\s*\(/g);
           if (manualHits) manual += manualHits.length;
@@ -1372,9 +1456,9 @@ async function countAppCheckEnforced(rootDir) {
         }
       }
     }
-    return { occurrences, files: files.size, manual, limitHit };
+    return { occurrences, files: files.size, manual, ignoredOnRequest, limitHit };
   } catch {
-    return { occurrences: 0, files: 0, manual: 0, limitHit: false };
+    return { occurrences: 0, files: 0, manual: 0, ignoredOnRequest: 0, limitHit: false };
   }
 }
 function isOpenStorageCondition(condition) {

package/dist/{chunk-Y4VXWSKX.js → chunk-DIO36A3I.js}

@@ -102,8 +102,9 @@ function verify(model, opts = {}) {
       }
     }
   }
+  const uncoveredNote = "uncovered lista os paths do modelo \u2014 atribui\xE7\xE3o contador\u2192path indispon\xEDvel (s\xF3 coverage 100% esvazia)";
   if (coveragePct === 100) {
-    return { cases, uncovered: [], findings, coveragePct };
+    return { cases, uncovered: [], findings, coveragePct, uncoveredNote };
   }
   const seenPaths = /* @__PURE__ */ new Set();
   for (const rule of model.rules) {
@@ -112,7 +113,7 @@ function verify(model, opts = {}) {
     seenPaths.add(rule.path);
     uncovered.push(rule.path);
   }
-  return { cases, uncovered, findings, coveragePct };
+  return { cases, uncovered, findings, coveragePct, uncoveredNote };
 }
 
 export {

package/dist/{chunk-RKQ3ZWWI.js → chunk-SH6HFX5Y.js}

@@ -1,9 +1,9 @@
 import {
   scan
-} from "./chunk-AKPQ4OAJ.js";
+} from "./chunk-BB6XXEIK.js";
 import {
   verify
-} from "./chunk-Y4VXWSKX.js";
+} from "./chunk-DIO36A3I.js";
 import {
   drift
 } from "./chunk-XZ32YQQC.js";
@@ -152,7 +152,7 @@ function createMcpServer() {
       try {
         assertCwd(cwd);
         const { resolve } = await import("path");
-        const { model } = await scan(cwd);
+        const { summary: scanSummary, model } = await scan(cwd);
         const res = verify(model, { coverageFile: coverage ? resolve(cwd, coverage) : void 0 });
         const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
         const truncated = res.cases.length > 50;
@@ -169,8 +169,10 @@ function createMcpServer() {
                   truncated,
                   uncovered: res.uncovered.slice(0, 20),
                   uncoveredTotal: res.uncovered.length,
+                  uncoveredNote: res.uncoveredNote,
                   coveragePct: res.coveragePct,
-                  findings: res.findings
+                  findings: res.findings,
+                  scan: { errors: scanSummary.errors, warnings: scanSummary.warnings, note: "verify n\xE3o substitui scan/check" }
                 },
                 null,
                 2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-AKPQ4OAJ.js";
+} from "./chunk-BB6XXEIK.js";
 import "./chunk-FECVBQUO.js";
 
 // src/cli.ts
@@ -41,13 +41,13 @@ Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
     return void 0;
   };
   const strictArg = getArg("strict");
-  const strict = args.includes("--strict") || strictArg === "true" || cmd === "check";
+  const strict = (args.includes("--strict") || strictArg === "true") && strictArg !== "false" || cmd === "check";
   if (strictArg !== void 0 && strictArg !== "true" && strictArg !== "false") {
     console.error(`Valor inv\xE1lido para --strict: ${strictArg} (use --strict, --strict=true ou --strict=false)`);
     process.exit(1);
   }
   const asJsonArg = getArg("json");
-  const asJson = args.includes("--json") || asJsonArg === "true";
+  const asJson = (args.includes("--json") || asJsonArg === "true") && asJsonArg !== "false";
   if (asJsonArg !== void 0 && asJsonArg !== "true" && asJsonArg !== "false") {
     console.error(`Valor inv\xE1lido para --json: ${asJsonArg} (use --json, --json=true ou --json=false)`);
     process.exit(1);
@@ -81,23 +81,25 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-YUXXYBRU.js");
-    const { verify } = await import("./verify-WBVSESHD.js");
+    const { scan: scanForVerify } = await import("./scan-SDJSDRDQ.js");
+    const { verify } = await import("./verify-DECP4IUW.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");
     const coveragePath = coverageArg ? resolveVerify(rootDir, coverageArg) : void 0;
-    const { model } = await scanForVerify(rootDir, { adapterFn: adapterArg });
+    const { model, summary: scanSummary } = await scanForVerify(rootDir, { adapterFn: adapterArg });
     const res = verify(model, { coverageFile: coveragePath });
     const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
     const rolesReduced = model.authorization.roles.length === 0;
+    const scanRef = { errors: scanSummary.errors, warnings: scanSummary.warnings };
     if (asJson) {
-      console.log(JSON.stringify({ roles, rolesReduced, cases: res.cases.slice(0, 50), casesTotal: res.cases.length, truncated: res.cases.length > 50, uncovered: res.uncovered.slice(0, 20), uncoveredTotal: res.uncovered.length, coveragePct: res.coveragePct, findings: res.findings }, null, 2));
+      console.log(JSON.stringify({ roles, rolesReduced, cases: res.cases.slice(0, 50), casesTotal: res.cases.length, truncated: res.cases.length > 50, uncovered: res.uncovered.slice(0, 20), uncoveredTotal: res.uncovered.length, uncoveredNote: res.uncoveredNote, coveragePct: res.coveragePct, findings: res.findings, scan: scanRef }, null, 2));
       return;
     }
     const covStr = res.coveragePct === null ? "sem cobertura observada" : `${res.coveragePct}% de express\xF5es visitadas`;
     const rolesNote = rolesReduced ? "pap\xE9is reduzidos (sem contrato: anonymous/user/admin)" : `${roles.length} pap\xE9is do contrato (${roles.join(", ")})`;
     console.log(`
 FIREBASE AUDIT verify \u2014 ${res.cases.length} casos planejados (${rolesNote}), ${res.uncovered.length} paths sem cobertura (${covStr}).`);
+    console.log(`Scan est\xE1tico junto: ${scanRef.errors} errors, ${scanRef.warnings} warnings \u2014 verify n\xE3o substitui scan/check.`);
     for (const f of res.findings) {
       const icon = f.severity === "ERROR" ? "\u274C" : f.severity === "WARNING" ? "\u26A0" : "\u2139";
       console.log(`
@@ -156,6 +158,9 @@ FIREBASE AUDIT drift \u2014 MATCHED ${counts("MATCHED")}, LOCAL_ONLY ${counts("L
     return;
   }
   const { findings, summary } = await scan(rootDir, { strict, adapterFn: adapterArg });
+  if (!strict && summary.errors > 0) {
+    console.error(`\u26A0 scan encontrou ${summary.errors} ERROR(s) mas sai 0 \u2014 use 'check' no CI para reprovar.`);
+  }
   if (asJson) {
     console.log(JSON.stringify({ summary, findings }, null, 2));
     if (strict && summary.errors > 0) process.exit(2);

package/dist/index.d.ts

@@ -577,9 +577,9 @@ declare const FindingSchema: z.ZodObject<{
 declare const AuditYamlSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     authorization: z.ZodObject<{
-        adapter: z.ZodOptional<z.ZodObject<{
+        adapter: z.ZodOptional<z.ZodNullable<z.ZodObject<{
             function: z.ZodString;
-        }, z.core.$strict>>;
+        }, z.core.$strict>>>;
         roles: z.ZodRecord<z.ZodString, z.ZodObject<{
             permissions: z.ZodArray<z.ZodString>;
         }, z.core.$strict>>;
@@ -595,11 +595,11 @@ declare const AuditYamlSchema: z.ZodObject<{
                 write: "write";
             }>;
         }, z.core.$strict>>;
-        claims: z.ZodOptional<z.ZodObject<{
+        claims: z.ZodOptional<z.ZodNullable<z.ZodObject<{
             enabled: z.ZodBoolean;
-            roleKey: z.ZodString;
+            roleKey: z.ZodOptional<z.ZodString>;
             samples: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodJSONSchema>>>;
-        }, z.core.$strict>>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 /** Chaves OIDC/Firebase reservadas — nunca em custom claims (1000 bytes, só acesso). */
@@ -639,7 +639,8 @@ interface DiscoveryResult {
 declare function discover(rootDir: string): DiscoveryResult;
 /** Segmentos de servidor (fail-closed: `api` genérico NÃO é server, ver classifyOrigin). */
 declare const SERVER_HINTS_SEGMENTS: string[];
-/** Heurística CLIENT vs SERVER: caminho manda primeiro (grafo ai-tool preenche listas na Fase 3). */
+/** Heurística CLIENT vs SERVER: caminho manda primeiro (grafo ai-tool preenche listas na Fase 3).
+ * Segmentos ancorados — nunca substring solta (`myapp/` não é `app/`). */
 declare function classifyOrigin(file: string, content: string): "CLIENT" | "SERVER" | "UNKNOWN";
 declare function emptyModel(rootDir: string, d: DiscoveryResult): ProjectModel;
 /**
@@ -752,8 +753,9 @@ interface ScanOptions {
     adapterFn?: string;
     strict?: boolean;
     /**
-     * Opt-in: enriquece Discovery com grafo do ai-tool (clientFiles/serverFiles).
-     * Default false (scan estático rápido; nenhum check consome o grafo por padrão).
+     * Prévia opt-in: enriquece Discovery com grafo do ai-tool (clientFiles/serverFiles).
+     * Nenhum check consome o grafo ainda — resultado idêntico com ou sem.
+     * Default false (scan estático rápido).
      */
     graph?: boolean;
 }
@@ -806,6 +808,8 @@ interface VerifyResult {
     findings: Finding[];
     /** 0-100 quando o coverage tem visitCount avaliável; null = não observada. */
     coveragePct: number | null;
+    /** Como ler `uncovered`: atribuição por expressão indisponível (só 100% esvazia). */
+    uncoveredNote: string;
 }
 /** Gera matriz role × operação × path a partir do modelo (sem executar nada).
  * Mapeamento: read≡get+list, write≡create+update+delete (mesma semântica do opsFrom).

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-RKQ3ZWWI.js";
+} from "./chunk-SH6HFX5Y.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -33,7 +33,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-AKPQ4OAJ.js";
+} from "./chunk-BB6XXEIK.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,
@@ -59,7 +59,7 @@ import {
 import {
   planVerify,
   verify
-} from "./chunk-Y4VXWSKX.js";
+} from "./chunk-DIO36A3I.js";
 import {
   drift
 } from "./chunk-XZ32YQQC.js";

package/dist/mcp-cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-RKQ3ZWWI.js";
-import "./chunk-AKPQ4OAJ.js";
+} from "./chunk-SH6HFX5Y.js";
+import "./chunk-BB6XXEIK.js";
 import "./chunk-FECVBQUO.js";
-import "./chunk-Y4VXWSKX.js";
+import "./chunk-DIO36A3I.js";
 import "./chunk-XZ32YQQC.js";
 
 // src/mcp-cli.ts

package/dist/mcp.js

@@ -1,10 +1,10 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-RKQ3ZWWI.js";
-import "./chunk-AKPQ4OAJ.js";
+} from "./chunk-SH6HFX5Y.js";
+import "./chunk-BB6XXEIK.js";
 import "./chunk-FECVBQUO.js";
-import "./chunk-Y4VXWSKX.js";
+import "./chunk-DIO36A3I.js";
 import "./chunk-XZ32YQQC.js";
 export {
   createMcpServer,

package/dist/{scan-YUXXYBRU.js → scan-SDJSDRDQ.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-AKPQ4OAJ.js";
+} from "./chunk-BB6XXEIK.js";
 import "./chunk-FECVBQUO.js";
 export {
   scan

package/dist/{verify-WBVSESHD.js → verify-DECP4IUW.js}

@@ -1,7 +1,7 @@
 import {
   planVerify,
   verify
-} from "./chunk-Y4VXWSKX.js";
+} from "./chunk-DIO36A3I.js";
 export {
   planVerify,
   verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -35,4 +35,5 @@ Use `drift` para comparar índices locais vs implantados (MATCHED/LOCAL_ONLY/REM
 ## Limites honestos
 
 - AppCheck: varredura TS/Python por texto (`enforceAppCheck`, `verifyToken` e afins). Config via variável conta como não observada; `onRequest` exige revisão rota a rota.
-- Isolamento por tenant (ownerId/tenantId): fora dos checks — revise manualmente ou no Emulator.
+- Isolamento por tenant (ownerId/tenantId) e mismatch de papel não-admin: fora dos checks — revise manualmente ou no Emulator.
+- `graph: true` é prévia opt-in da biblioteca (nenhum check consome ainda).