@justmpm/firebase-audit 0.5.5 → 0.5.6

package/dist/{chunk-ME6WO45S.js → chunk-BB6XXEIK.js}

@@ -54,6 +54,10 @@ function discover(rootDir) {
       const first = (v) => Array.isArray(v) ? v[0] : v;
       const fs = first(raw.firestore);
       const st = first(raw.storage);
+      const fsAny = fs;
+      if (fsAny && typeof fsAny.database === "string" && fsAny.database.length > 0 && fsAny.database !== "(default)") {
+        databaseId = fsAny.database;
+      }
       if (typeof fs?.rules === "string") {
         const p = join(rootDir, fs.rules);
         if (existsSync(p)) rulesFile = p;
@@ -181,6 +185,10 @@ async function enrichWithGraph(rootDir, d) {
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
 import { join as join2 } from "path";
 import { executeFind } from "@justmpm/supergrep";
+function isBuildOutput(file) {
+  const n = file.replace(/\\/g, "/");
+  return /(^|\/)(node_modules|dist|build|\.next|coverage|out)\//.test(n);
+}
 var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
 function createEvidence() {
   let counter = 0;
@@ -563,6 +571,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
   }
   const seen = /* @__PURE__ */ new Set();
   const pushLiteral = (file, line, permission) => {
+    if (isBuildOutput(file)) return;
     const k = `${file}:${line}:${permission}`;
     if (seen.has(k)) return;
     seen.add(k);
@@ -575,10 +584,12 @@ async function collectPermissionCalls(rootDir, adapterFn) {
         const raw = (m.metaVariables["PERM"] ?? "").trim();
         const line = m.line + 1;
         if (raw.includes("${")) {
-          const k = `${m.file}:${line}:${raw}`;
-          if (!seen.has(k)) {
-            seen.add(k);
-            dynamic.push({ file: m.file, line, text: m.text });
+          if (!isBuildOutput(m.file)) {
+            const k = `${m.file}:${line}:${raw}`;
+            if (!seen.has(k)) {
+              seen.add(k);
+              dynamic.push({ file: m.file, line, text: m.text });
+            }
           }
           continue;
         }
@@ -587,18 +598,22 @@ async function collectPermissionCalls(rootDir, adapterFn) {
           const perm = raw.replace(/^['"`]|['"`]$/g, "").trim();
           if (/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/.test(perm)) pushLiteral(m.file, line, perm);
           else {
-            const k = `${m.file}:${line}:${raw}:invalid`;
+            if (!isBuildOutput(m.file)) {
+              const k = `${m.file}:${line}:${raw}:invalid`;
+              if (!seen.has(k)) {
+                seen.add(k);
+                dynamic.push({ file: m.file, line, text: m.text });
+              }
+            }
+          }
+        } else if (raw.length > 0) {
+          if (!isBuildOutput(m.file)) {
+            const k = `${m.file}:${line}:${raw}`;
             if (!seen.has(k)) {
               seen.add(k);
               dynamic.push({ file: m.file, line, text: m.text });
             }
           }
-        } else if (raw.length > 0) {
-          const k = `${m.file}:${line}:${raw}`;
-          if (!seen.has(k)) {
-            seen.add(k);
-            dynamic.push({ file: m.file, line, text: m.text });
-          }
         }
       }
     } catch {
@@ -635,6 +650,7 @@ async function collectAdminImports(rootDir) {
       for (const m of result.matches) {
         const mod = m.metaVariables["MODULE"] ?? "";
         if (mod.includes("firebase-admin") || mod.includes("firebase-functions")) {
+          if (isBuildOutput(m.file)) continue;
           const k = `${m.file}:${m.line}:${m.text}`;
           if (seen.has(k)) continue;
           seen.add(k);
@@ -1173,6 +1189,9 @@ async function scan(rootDir, opts = {}) {
         return `ev-storage-${prefix}-${evCounter}`;
       };
       for (const m of parseStorageAllows(clean)) {
+        if (m.condition !== void 0 && stripOuterParens(m.condition).toLowerCase().replace(/\s+/g, "") === "false") {
+          continue;
+        }
         const ops = expandStorageOps(m.target);
         const key = conditionKeyForFingerprint(m.condition);
         const normCond = (m.condition ?? "").toLowerCase().replace(/\s+/g, "");
@@ -1405,7 +1424,7 @@ async function countAppCheckEnforced(rootDir) {
           continue;
         }
         if (isDir) {
-          if (name === "node_modules" || name === "dist" || name === "lib") continue;
+          if (name === "node_modules" || name === "dist" || name === "lib" || name === "build" || name === ".next" || name === "coverage" || name === ".git" || name === "out") continue;
           stack.push(abs);
           continue;
         }

package/dist/{chunk-CHC7ZHUK.js → chunk-SH6HFX5Y.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-ME6WO45S.js";
+} from "./chunk-BB6XXEIK.js";
 import {
   verify
 } from "./chunk-DIO36A3I.js";

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-ME6WO45S.js";
+} from "./chunk-BB6XXEIK.js";
 import "./chunk-FECVBQUO.js";
 
 // src/cli.ts
@@ -41,13 +41,13 @@ Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
     return void 0;
   };
   const strictArg = getArg("strict");
-  const strict = args.includes("--strict") || strictArg === "true" || cmd === "check";
+  const strict = (args.includes("--strict") || strictArg === "true") && strictArg !== "false" || cmd === "check";
   if (strictArg !== void 0 && strictArg !== "true" && strictArg !== "false") {
     console.error(`Valor inv\xE1lido para --strict: ${strictArg} (use --strict, --strict=true ou --strict=false)`);
     process.exit(1);
   }
   const asJsonArg = getArg("json");
-  const asJson = args.includes("--json") || asJsonArg === "true";
+  const asJson = (args.includes("--json") || asJsonArg === "true") && asJsonArg !== "false";
   if (asJsonArg !== void 0 && asJsonArg !== "true" && asJsonArg !== "false") {
     console.error(`Valor inv\xE1lido para --json: ${asJsonArg} (use --json, --json=true ou --json=false)`);
     process.exit(1);
@@ -81,7 +81,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-HE5WAMWJ.js");
+    const { scan: scanForVerify } = await import("./scan-SDJSDRDQ.js");
     const { verify } = await import("./verify-DECP4IUW.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.d.ts

@@ -753,8 +753,9 @@ interface ScanOptions {
     adapterFn?: string;
     strict?: boolean;
     /**
-     * Opt-in: enriquece Discovery com grafo do ai-tool (clientFiles/serverFiles).
-     * Default false (scan estático rápido; nenhum check consome o grafo por padrão).
+     * Prévia opt-in: enriquece Discovery com grafo do ai-tool (clientFiles/serverFiles).
+     * Nenhum check consome o grafo ainda — resultado idêntico com ou sem.
+     * Default false (scan estático rápido).
      */
     graph?: boolean;
 }

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-CHC7ZHUK.js";
+} from "./chunk-SH6HFX5Y.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -33,7 +33,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-ME6WO45S.js";
+} from "./chunk-BB6XXEIK.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-CHC7ZHUK.js";
-import "./chunk-ME6WO45S.js";
+} from "./chunk-SH6HFX5Y.js";
+import "./chunk-BB6XXEIK.js";
 import "./chunk-FECVBQUO.js";
 import "./chunk-DIO36A3I.js";
 import "./chunk-XZ32YQQC.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-CHC7ZHUK.js";
-import "./chunk-ME6WO45S.js";
+} from "./chunk-SH6HFX5Y.js";
+import "./chunk-BB6XXEIK.js";
 import "./chunk-FECVBQUO.js";
 import "./chunk-DIO36A3I.js";
 import "./chunk-XZ32YQQC.js";

package/dist/{scan-HE5WAMWJ.js → scan-SDJSDRDQ.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-ME6WO45S.js";
+} from "./chunk-BB6XXEIK.js";
 import "./chunk-FECVBQUO.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",