@justmpm/firebase-audit 0.5.6 → 0.5.7

package/dist/{chunk-SH6HFX5Y.js → chunk-BHRZOZYA.js}

@@ -1,12 +1,12 @@
 import {
   scan
-} from "./chunk-BB6XXEIK.js";
+} from "./chunk-LJW7QXIJ.js";
 import {
   verify
-} from "./chunk-DIO36A3I.js";
+} from "./chunk-CSMT4PIP.js";
 import {
   drift
-} from "./chunk-XZ32YQQC.js";
+} from "./chunk-LD3F73XI.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/dist/{chunk-DIO36A3I.js → chunk-CSMT4PIP.js}

@@ -1,9 +1,9 @@
 // src/verify.ts
-import { readFileSync, existsSync } from "fs";
-function collectVisitCounts(node, out) {
-  if (typeof node !== "object" || node === null) return;
+import { readFileSync, existsSync, statSync } from "fs";
+function collectVisitCounts(node, out, depth = 0) {
+  if (typeof node !== "object" || node === null || depth > 100) return;
   if (Array.isArray(node)) {
-    for (const v of node) collectVisitCounts(v, out);
+    for (const v of node) collectVisitCounts(v, out, depth + 1);
     return;
   }
   const rec = node;
@@ -14,7 +14,7 @@ function collectVisitCounts(node, out) {
       break;
     }
   }
-  for (const v of Object.values(rec)) collectVisitCounts(v, out);
+  for (const v of Object.values(rec)) collectVisitCounts(v, out, depth + 1);
 }
 function planVerify(model) {
   const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
@@ -63,6 +63,13 @@ function verify(model, opts = {}) {
       });
     } else {
       try {
+        let tooBig = false;
+        try {
+          tooBig = statSync(opts.coverageFile).size > 5 * 1024 * 1024;
+        } catch {
+          tooBig = false;
+        }
+        if (tooBig) throw new Error("coverage acima de 5 MB");
         const raw = JSON.parse(readFileSync(opts.coverageFile, "utf-8"));
         const counts = [];
         collectVisitCounts(raw, counts);
@@ -95,7 +102,7 @@ function verify(model, opts = {}) {
           rule: "COVERAGE_INVALID",
           severity: "WARNING",
           confidence: "CONFIRMED",
-          message: "Arquivo de cobertura inv\xE1lido \u2014 Verifier sem cobertura neste run.",
+          message: "Arquivo de cobertura inv\xE1lido ou acima de 5 MB \u2014 Verifier sem cobertura neste run.",
           fingerprint: "COVERAGE_INVALID",
           evidence: [{ id: "ev-coverage", kind: "coverage-parse", summary: "JSON inv\xE1lido", confidence: "CONFIRMED" }]
         });

package/dist/{chunk-XZ32YQQC.js → chunk-LD3F73XI.js}

@@ -1,5 +1,5 @@
 // src/drift.ts
-import { readFileSync, existsSync } from "fs";
+import { readFileSync, existsSync, statSync } from "fs";
 function normalizeMode(f) {
   if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0) return null;
   if (f.vectorConfig !== void 0 && f.vectorConfig !== null) return { fieldPath: f.fieldPath, mode: "VECTOR" };
@@ -59,10 +59,19 @@ function drift(localFile, remoteFile) {
     });
     return { entries: [], findings };
   }
+  const tooLarge = (f) => {
+    if (!f || !existsSync(f)) return false;
+    try {
+      return statSync(f).size > 5 * 1024 * 1024;
+    } catch {
+      return false;
+    }
+  };
   let local = [];
   let remote = [];
   if (localFile && existsSync(localFile)) {
     try {
+      if (tooLarge(localFile)) throw new Error("local acima de 5 MB");
       const raw = JSON.parse(readFileSync(localFile, "utf-8"));
       const rawIndexes = normalizeList(raw);
       const parsed = [];
@@ -88,7 +97,7 @@ function drift(localFile, remoteFile) {
         rule: "DRIFT_LOCAL_INVALID",
         severity: "WARNING",
         confidence: "CONFIRMED",
-        message: "\xCDndices locais inv\xE1lidos \u2014 drift sem base local.",
+        message: "\xCDndices locais inv\xE1lidos ou acima de 5 MB \u2014 drift sem base local.",
         fingerprint: "DRIFT_LOCAL_INVALID",
         evidence: [{ id: "ev-drift-local", kind: "drift-parse", summary: "local inv\xE1lido", confidence: "CONFIRMED" }]
       });
@@ -96,6 +105,7 @@ function drift(localFile, remoteFile) {
   }
   if (remoteFile && existsSync(remoteFile)) {
     try {
+      if (tooLarge(remoteFile)) throw new Error("remoto acima de 5 MB");
       const list = normalizeList(JSON.parse(readFileSync(remoteFile, "utf-8")));
       const parsed = [];
       let skipped = 0;
@@ -120,7 +130,7 @@ function drift(localFile, remoteFile) {
         rule: "DRIFT_REMOTE_INVALID",
         severity: "WARNING",
         confidence: "CONFIRMED",
-        message: "\xCDndices remotos inv\xE1lidos \u2014 drift sem base remota.",
+        message: "\xCDndices remotos inv\xE1lidos ou acima de 5 MB \u2014 drift sem base remota.",
         fingerprint: "DRIFT_REMOTE_INVALID",
         evidence: [{ id: "ev-drift-remote", kind: "drift-parse", summary: "remoto inv\xE1lido", confidence: "CONFIRMED" }]
       });

package/dist/{chunk-BB6XXEIK.js → chunk-LJW7QXIJ.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-FECVBQUO.js";
 
 // src/scan.ts
-import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
+import { readFileSync as readFileSync3, existsSync as existsSync3, statSync as statSync2 } from "fs";
 import { join as join3 } from "path";
 import { parse as parseYaml } from "yaml";
 
@@ -123,6 +123,8 @@ function classifyOrigin(file, content) {
   if (rel.includes("src/app/api/")) return "SERVER";
   if (rel.includes("server/api/")) return "SERVER";
   if (hasSeg(...SERVER_HINTS_SEGMENTS)) return "SERVER";
+  const base = segs[segs.length - 1] ?? "";
+  if (/^(server|middleware)[.\-]/i.test(base)) return "SERVER";
   if (content.includes("firebase-admin") || content.includes("firebase-functions")) {
     return "CLIENT";
   }
@@ -161,14 +163,14 @@ async function enrichWithGraph(rootDir, d) {
     const res = await ai.map({ cwd: rootDir, format: "json" });
     const files = Array.isArray(res.files) ? res.files : [];
     const code = files.map((f) => String(f.path).replace(/\\/g, "/")).filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p)).filter((p) => !p.includes("node_modules/") && !/(^|\/)(dist|build|\.next|coverage|lib)\//.test(p)).slice(0, 500);
-    const { readFileSync: readSync, existsSync: existsSyncFn, statSync: statSync2 } = await import("fs");
+    const { readFileSync: readSync, existsSync: existsSyncFn, statSync: statSync3 } = await import("fs");
     const { join: joinP } = await import("path");
     for (const rel of code) {
       let content = "";
       try {
         const abs = joinP(rootDir, rel);
         if (!existsSyncFn(abs)) continue;
-        if (statSync2(abs).size > 100 * 1024) continue;
+        if (statSync3(abs).size > 100 * 1024) continue;
         content = readSync(abs, "utf-8");
       } catch {
         content = "";
@@ -273,6 +275,26 @@ async function runChecks(model, rootDir, opts = {}) {
       }
     }
   }
+  for (const rule of model.rules) {
+    if (rule.operations.length === 0) {
+      findings.push(
+        make(
+          "RULES_UNKNOWN_OP",
+          "WARNING",
+          "CONFIRMED",
+          `Opera\xE7\xE3o desconhecida em ${rule.path} (${rule.location.file}:${rule.location.start.line}). Typo em allow? Deploy rejeita.`,
+          `RULES_UNKNOWN_OP:${rule.path}:${rule.location.start.line}`,
+          {
+            file: rule.location.file,
+            line: rule.location.start.line,
+            resource: rule.path,
+            evidence: [ev("unknown-op", rule.condition ?? "allow sem opera\xE7\xE3o v\xE1lida", "CONFIRMED", rule.location.file, rule.location.start.line)],
+            fix: "Corrija para read/get/list/write/create/update/delete."
+          }
+        )
+      );
+    }
+  }
   const adapterFn = opts.adapterFn ?? "rbac.can";
   const permissionCalls = await collectPermissionCalls(rootDir, adapterFn);
   const declared = new Set(model.authorization.permissions.map((p) => p.name));
@@ -976,13 +998,14 @@ async function scan(rootDir, opts = {}) {
   if (d.firestoreRulesFile && existsSync3(d.firestoreRulesFile)) {
     const rel = model.firebase.firestore.rulesFile ?? "firestore.rules";
     try {
+      if (tooLarge(d.firestoreRulesFile, 1024 * 1024)) throw new Error("rules acima de 1 MB");
       model.rules = extractRules(d.firestoreRulesFile, rel);
     } catch {
       findings_pre.push({
         rule: "RULES_UNREADABLE",
         severity: "WARNING",
         confidence: "CONFIRMED",
-        message: "firestore.rules existe mas n\xE3o p\xF4de ser lido \u2014 FBA001/FBA002 sem cobertura.",
+        message: "firestore.rules existe mas n\xE3o p\xF4de ser lido (ileg\xEDvel ou acima de 1 MB) \u2014 FBA001/FBA002 sem cobertura.",
         fingerprint: "RULES_UNREADABLE",
         evidence: [
           { id: "ev-rules-unreadable", kind: "rules-read", summary: "leitura falhou", confidence: "CONFIRMED" }
@@ -992,6 +1015,7 @@ async function scan(rootDir, opts = {}) {
   }
   if (d.firestoreIndexesFile && existsSync3(d.firestoreIndexesFile)) {
     try {
+      if (tooLarge(d.firestoreIndexesFile, 1024 * 1024)) throw new Error("indexes acima de 1 MB");
       const raw = JSON.parse(readFileSync3(d.firestoreIndexesFile, "utf-8"));
       if (Array.isArray(raw.fieldOverrides) && raw.fieldOverrides.length > 0) {
         findings_pre.push({
@@ -1062,7 +1086,7 @@ async function scan(rootDir, opts = {}) {
         rule: "INDEXES_INVALID",
         severity: "WARNING",
         confidence: "CONFIRMED",
-        message: "firestore.indexes.json inv\xE1lido \u2014 \xEDndices ignorados neste scan.",
+        message: "firestore.indexes.json inv\xE1lido ou acima de 1 MB \u2014 \xEDndices ignorados neste scan.",
         fingerprint: "INDEXES_INVALID",
         evidence: [
           { id: "ev-indexes-invalid", kind: "indexes-parse", summary: "JSON inv\xE1lido", confidence: "CONFIRMED" }
@@ -1072,6 +1096,7 @@ async function scan(rootDir, opts = {}) {
   }
   if (d.auditYamlFile && existsSync3(d.auditYamlFile)) {
     try {
+      if (tooLarge(d.auditYamlFile, 256 * 1024)) throw new Error("yaml acima de 256 KB");
       const text = readFileSync3(d.auditYamlFile, "utf-8");
       const parsed = parseYaml(text);
       const validated = AuditYamlSchema.safeParse(parsed);
@@ -1180,6 +1205,7 @@ async function scan(rootDir, opts = {}) {
   if (d.storageRulesFile && existsSync3(d.storageRulesFile)) {
     checked.push("storage.rules");
     try {
+      if (tooLarge(d.storageRulesFile, 1024 * 1024)) throw new Error("storage acima de 1 MB");
       const raw = readFileSync3(d.storageRulesFile, "utf-8");
       const relStorage = model.firebase.storage?.rulesFile ?? "storage.rules";
       const clean = stripRuleComments(raw);
@@ -1288,13 +1314,13 @@ async function scan(rootDir, opts = {}) {
         }
       }
     } catch {
-      skipped.push("storage.rules ileg\xEDvel \u2014 Storage sem cobertura neste scan");
+      skipped.push("storage.rules ileg\xEDvel ou acima de 1 MB \u2014 Storage sem cobertura neste scan");
     }
   } else {
     skipped.push("storage.rules n\xE3o observado \u2014 Storage fora deste scan");
   }
   if (d.functionsDir) {
-    const appcheck = await countAppCheckEnforced(rootDir);
+    const appcheck = await countAppCheckEnforced(rootDir, d.functionsDir);
     model.functions = { dir: model.functions?.dir, appCheckEnforced: appcheck.occurrences };
     checked.push("functions-appcheck");
     if (appcheck.manual > 0) {
@@ -1384,12 +1410,19 @@ async function scan(rootDir, opts = {}) {
     }
   };
 }
-async function countAppCheckEnforced(rootDir) {
+function tooLarge(abs, maxBytes) {
+  try {
+    return statSync2(abs).size > maxBytes;
+  } catch {
+    return false;
+  }
+}
+async function countAppCheckEnforced(rootDir, functionsDir) {
   try {
     const { readdirSync, readFileSync: readSync, statSync: stat } = await import("fs");
     const { join: joinP } = await import("path");
     const { stripRuleComments: strip } = await import("./rules-W4VUUQM4.js");
-    const roots = [joinP(rootDir, "functions")];
+    const roots = [functionsDir ?? joinP(rootDir, "functions")];
     let occurrences = 0;
     const files = /* @__PURE__ */ new Set();
     let manual = 0;
@@ -1403,7 +1436,6 @@ async function countAppCheckEnforced(rootDir) {
     };
     while (stack.length > 0 && guard < 200) {
       guard += 1;
-      if (guard >= 200 && stack.length > 0) limitHit = true;
       const cur = stack.pop();
       let entries = [];
       try {
@@ -1456,6 +1488,7 @@ async function countAppCheckEnforced(rootDir) {
         }
       }
     }
+    if (stack.length > 0) limitHit = true;
     return { occurrences, files: files.size, manual, ignoredOnRequest, limitHit };
   } catch {
     return { occurrences: 0, files: 0, manual: 0, ignoredOnRequest: 0, limitHit: false };
@@ -1522,9 +1555,14 @@ function parseStorageAllows(clean) {
   const re = /allow\s+([^;:]+?)(?::\s*if\s+([^;]+))?;/gi;
   let m;
   while ((m = re.exec(clean)) !== null) {
-    const containing = matches.filter((b) => b.start <= m.index && m.index < b.end).sort((a, b) => b.start - a.start);
+    const containing = matches.filter((b) => b.start <= m.index && m.index < b.end).sort((a, b) => a.start - b.start);
+    const parts = [];
+    for (const b of containing) {
+      const p = b.path.trim().replace(/^\/+|\/+$/g, "");
+      if (p.length > 0) parts.push(p);
+    }
     const line = clean.slice(0, m.index).split("\n").length;
-    out.push({ target: m[1].trim(), condition: m[2]?.trim(), matchPath: containing[0]?.path ?? "/(unknown)", line });
+    out.push({ target: m[1].trim(), condition: m[2]?.trim(), matchPath: parts.length > 0 ? `/${parts.join("/")}` : "/(unknown)", line });
   }
   return out;
 }

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-BB6XXEIK.js";
+} from "./chunk-LJW7QXIJ.js";
 import "./chunk-FECVBQUO.js";
 
 // src/cli.ts
@@ -81,8 +81,8 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-SDJSDRDQ.js");
-    const { verify } = await import("./verify-DECP4IUW.js");
+    const { scan: scanForVerify } = await import("./scan-A34FDN66.js");
+    const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");
     const coveragePath = coverageArg ? resolveVerify(rootDir, coverageArg) : void 0;
@@ -116,7 +116,7 @@ ${icon} ${f.rule} [${f.confidence}]
     return;
   }
   if (cmd === "drift") {
-    const { drift } = await import("./drift-QXALNO2V.js");
+    const { drift } = await import("./drift-C3JZI5ZA.js");
     const { resolve: resolveDrift } = await import("path");
     const { existsSync: existsDrift } = await import("fs");
     const localArg = getArg("local");
@@ -130,7 +130,7 @@ ${icon} ${f.rule} [${f.confidence}]
     for (const [label, p] of [["--local", localPath], ["--remote", remotePath]]) {
       if (p && !existsDrift(p)) {
         if (asJson) {
-          const { drift: driftMissing } = await import("./drift-QXALNO2V.js");
+          const { drift: driftMissing } = await import("./drift-C3JZI5ZA.js");
           const res2 = driftMissing(
             localPath && existsDrift(localPath) ? localPath : null,
             remotePath && existsDrift(remotePath) ? remotePath : null

package/dist/{drift-QXALNO2V.js → drift-C3JZI5ZA.js}

@@ -1,6 +1,6 @@
 import {
   drift
-} from "./chunk-XZ32YQQC.js";
+} from "./chunk-LD3F73XI.js";
 export {
   drift
 };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-SH6HFX5Y.js";
+} from "./chunk-BHRZOZYA.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -33,7 +33,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-BB6XXEIK.js";
+} from "./chunk-LJW7QXIJ.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,
@@ -59,10 +59,10 @@ import {
 import {
   planVerify,
   verify
-} from "./chunk-DIO36A3I.js";
+} from "./chunk-CSMT4PIP.js";
 import {
   drift
-} from "./chunk-XZ32YQQC.js";
+} from "./chunk-LD3F73XI.js";
 
 // src/index.ts
 import { createRequire } from "module";

package/dist/mcp-cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-SH6HFX5Y.js";
-import "./chunk-BB6XXEIK.js";
+} from "./chunk-BHRZOZYA.js";
+import "./chunk-LJW7QXIJ.js";
 import "./chunk-FECVBQUO.js";
-import "./chunk-DIO36A3I.js";
-import "./chunk-XZ32YQQC.js";
+import "./chunk-CSMT4PIP.js";
+import "./chunk-LD3F73XI.js";
 
 // src/mcp-cli.ts
 startMcpServer().catch((err) => {

package/dist/mcp.js

@@ -1,11 +1,11 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-SH6HFX5Y.js";
-import "./chunk-BB6XXEIK.js";
+} from "./chunk-BHRZOZYA.js";
+import "./chunk-LJW7QXIJ.js";
 import "./chunk-FECVBQUO.js";
-import "./chunk-DIO36A3I.js";
-import "./chunk-XZ32YQQC.js";
+import "./chunk-CSMT4PIP.js";
+import "./chunk-LD3F73XI.js";
 export {
   createMcpServer,
   startMcpServer

package/dist/{scan-SDJSDRDQ.js → scan-A34FDN66.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-BB6XXEIK.js";
+} from "./chunk-LJW7QXIJ.js";
 import "./chunk-FECVBQUO.js";
 export {
   scan

package/dist/{verify-DECP4IUW.js → verify-GQSR4FQL.js}

@@ -1,7 +1,7 @@
 import {
   planVerify,
   verify
-} from "./chunk-DIO36A3I.js";
+} from "./chunk-CSMT4PIP.js";
 export {
   planVerify,
   verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",