@justmpm/firebase-audit 0.5.6 → 0.5.8

package/dist/{chunk-FECVBQUO.js → chunk-7J3ADEBW.js}

@@ -42,11 +42,12 @@ function stripRuleComments(content) {
 }
 function opsFrom(target) {
   const t = target.trim().toLowerCase();
-  if (t === "read") return { ops: ["read", "get", "list"], known: true };
-  if (t === "write") return { ops: ["write", "create", "update", "delete"], known: true };
+  if (t === "read") return { ops: ["read", "get", "list"], known: true, unknown: [] };
+  if (t === "write") return { ops: ["write", "create", "update", "delete"], known: true, unknown: [] };
   const parts = t.split(",").map((s) => s.trim()).filter(Boolean);
   const valid = ["read", "get", "list", "create", "update", "delete", "write"];
   const out = [];
+  const unknown = [];
   let known = false;
   for (const p of parts) {
     if (valid.includes(p)) {
@@ -62,9 +63,11 @@ function opsFrom(target) {
           if (!out.includes(extra)) out.push(extra);
         }
       }
+    } else {
+      unknown.push(p);
     }
   }
-  return { ops: out, known: out.length > 0 && known };
+  return { ops: out, known: out.length > 0 && known, unknown };
 }
 function findBlockEnd(content, openBraceIndex) {
   let depth = 0;
@@ -247,13 +250,14 @@ function extractRulesContent(rawContent, relFile) {
     const requestResourceReferences = [
       ...big.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
     ].map((x) => x[1]);
-    const { ops, known } = opsFrom(target);
+    const { ops, known, unknown } = opsFrom(target);
     const isHelperCall = !unconditional && rawCondition !== resolved;
     const hasAuth = authSource.includes("request.auth");
     rules.push({
       id: `rule-${idx++}`,
       path: fullPath,
       operations: ops,
+      unknownOperations: unknown.length > 0 ? unknown : void 0,
       conditionPresent: !unconditional && condition.length > 0,
       condition: unconditional ? void 0 : condition,
       authReferences,

package/dist/{chunk-DIO36A3I.js → chunk-CSMT4PIP.js}

@@ -1,9 +1,9 @@
 // src/verify.ts
-import { readFileSync, existsSync } from "fs";
-function collectVisitCounts(node, out) {
-  if (typeof node !== "object" || node === null) return;
+import { readFileSync, existsSync, statSync } from "fs";
+function collectVisitCounts(node, out, depth = 0) {
+  if (typeof node !== "object" || node === null || depth > 100) return;
   if (Array.isArray(node)) {
-    for (const v of node) collectVisitCounts(v, out);
+    for (const v of node) collectVisitCounts(v, out, depth + 1);
     return;
   }
   const rec = node;
@@ -14,7 +14,7 @@ function collectVisitCounts(node, out) {
       break;
     }
   }
-  for (const v of Object.values(rec)) collectVisitCounts(v, out);
+  for (const v of Object.values(rec)) collectVisitCounts(v, out, depth + 1);
 }
 function planVerify(model) {
   const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
@@ -63,6 +63,13 @@ function verify(model, opts = {}) {
       });
     } else {
       try {
+        let tooBig = false;
+        try {
+          tooBig = statSync(opts.coverageFile).size > 5 * 1024 * 1024;
+        } catch {
+          tooBig = false;
+        }
+        if (tooBig) throw new Error("coverage acima de 5 MB");
         const raw = JSON.parse(readFileSync(opts.coverageFile, "utf-8"));
         const counts = [];
         collectVisitCounts(raw, counts);
@@ -95,7 +102,7 @@ function verify(model, opts = {}) {
           rule: "COVERAGE_INVALID",
           severity: "WARNING",
           confidence: "CONFIRMED",
-          message: "Arquivo de cobertura inv\xE1lido \u2014 Verifier sem cobertura neste run.",
+          message: "Arquivo de cobertura inv\xE1lido ou acima de 5 MB \u2014 Verifier sem cobertura neste run.",
           fingerprint: "COVERAGE_INVALID",
           evidence: [{ id: "ev-coverage", kind: "coverage-parse", summary: "JSON inv\xE1lido", confidence: "CONFIRMED" }]
         });

package/dist/{chunk-SH6HFX5Y.js → chunk-D75SRJ7P.js}

@@ -1,12 +1,12 @@
 import {
   scan
-} from "./chunk-BB6XXEIK.js";
+} from "./chunk-NZT4NIVA.js";
 import {
   verify
-} from "./chunk-DIO36A3I.js";
+} from "./chunk-CSMT4PIP.js";
 import {
   drift
-} from "./chunk-XZ32YQQC.js";
+} from "./chunk-LD3F73XI.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -142,17 +142,18 @@ function createMcpServer() {
     "verify",
     {
       title: "Firebase Audit Verify (Emulator)",
-      description: "Gera matriz papel\xD7opera\xE7\xE3o\xD7path e avalia cobertura do ruleCoverage. Requer Emulator. Sem contrato usa pap\xE9is reduzidos (anonymous/user/admin). Nunca afirma cobertura sem teste real.",
+      description: "Gera matriz papel\xD7opera\xE7\xE3o\xD7path e avalia cobertura do ruleCoverage. Requer Emulator. Sem contrato usa pap\xE9is reduzidos (anonymous/user/admin). Nunca afirma cobertura sem teste real. N\xE3o substitui scan/check.",
       inputSchema: {
         cwd: z.string().min(1).describe("Diret\xF3rio raiz do projeto"),
-        coverage: z.string().optional().describe("Path do coverage.json do ruleCoverage (relativo ao cwd)")
+        coverage: z.string().optional().describe("Path do coverage.json do ruleCoverage (relativo ao cwd)"),
+        adapter: z.string().optional().describe("Fun\xE7\xE3o de permiss\xE3o no c\xF3digo que recebe o nome como texto (ex: rbac.can). Default: do contrato.")
       }
     },
-    async ({ cwd, coverage }) => {
+    async ({ cwd, coverage, adapter }) => {
       try {
         assertCwd(cwd);
         const { resolve } = await import("path");
-        const { summary: scanSummary, model } = await scan(cwd);
+        const { summary: scanSummary, model } = await scan(cwd, { adapterFn: adapter });
         const res = verify(model, { coverageFile: coverage ? resolve(cwd, coverage) : void 0 });
         const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
         const truncated = res.cases.length > 50;

package/dist/{chunk-XZ32YQQC.js → chunk-LD3F73XI.js}

@@ -1,5 +1,5 @@
 // src/drift.ts
-import { readFileSync, existsSync } from "fs";
+import { readFileSync, existsSync, statSync } from "fs";
 function normalizeMode(f) {
   if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0) return null;
   if (f.vectorConfig !== void 0 && f.vectorConfig !== null) return { fieldPath: f.fieldPath, mode: "VECTOR" };
@@ -59,10 +59,19 @@ function drift(localFile, remoteFile) {
     });
     return { entries: [], findings };
   }
+  const tooLarge = (f) => {
+    if (!f || !existsSync(f)) return false;
+    try {
+      return statSync(f).size > 5 * 1024 * 1024;
+    } catch {
+      return false;
+    }
+  };
   let local = [];
   let remote = [];
   if (localFile && existsSync(localFile)) {
     try {
+      if (tooLarge(localFile)) throw new Error("local acima de 5 MB");
       const raw = JSON.parse(readFileSync(localFile, "utf-8"));
       const rawIndexes = normalizeList(raw);
       const parsed = [];
@@ -88,7 +97,7 @@ function drift(localFile, remoteFile) {
         rule: "DRIFT_LOCAL_INVALID",
         severity: "WARNING",
         confidence: "CONFIRMED",
-        message: "\xCDndices locais inv\xE1lidos \u2014 drift sem base local.",
+        message: "\xCDndices locais inv\xE1lidos ou acima de 5 MB \u2014 drift sem base local.",
         fingerprint: "DRIFT_LOCAL_INVALID",
         evidence: [{ id: "ev-drift-local", kind: "drift-parse", summary: "local inv\xE1lido", confidence: "CONFIRMED" }]
       });
@@ -96,6 +105,7 @@ function drift(localFile, remoteFile) {
   }
   if (remoteFile && existsSync(remoteFile)) {
     try {
+      if (tooLarge(remoteFile)) throw new Error("remoto acima de 5 MB");
       const list = normalizeList(JSON.parse(readFileSync(remoteFile, "utf-8")));
       const parsed = [];
       let skipped = 0;
@@ -120,7 +130,7 @@ function drift(localFile, remoteFile) {
         rule: "DRIFT_REMOTE_INVALID",
         severity: "WARNING",
         confidence: "CONFIRMED",
-        message: "\xCDndices remotos inv\xE1lidos \u2014 drift sem base remota.",
+        message: "\xCDndices remotos inv\xE1lidos ou acima de 5 MB \u2014 drift sem base remota.",
         fingerprint: "DRIFT_REMOTE_INVALID",
         evidence: [{ id: "ev-drift-remote", kind: "drift-parse", summary: "remoto inv\xE1lido", confidence: "CONFIRMED" }]
       });

package/dist/{chunk-BB6XXEIK.js → chunk-NZT4NIVA.js}

@@ -9,10 +9,10 @@ import {
   resolveHelperConditionDetailed,
   stripOuterParens,
   stripRuleComments
-} from "./chunk-FECVBQUO.js";
+} from "./chunk-7J3ADEBW.js";
 
 // src/scan.ts
-import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
+import { readFileSync as readFileSync3, existsSync as existsSync3, statSync as statSync2 } from "fs";
 import { join as join3 } from "path";
 import { parse as parseYaml } from "yaml";
 
@@ -107,6 +107,10 @@ var SERVER_HINTS_SEGMENTS = [
   "backend",
   "scripts"
 ];
+function isTestPath(file) {
+  const n = file.replace(/\\/g, "/");
+  return /\.test\.[tj]sx?$/.test(n) || /\.spec\.[tj]sx?$/.test(n) || /(^|\/)__tests__\//.test(n) || /(^|\/)(test|tests|testing)\//.test(n);
+}
 function classifyOrigin(file, content) {
   const rel = file.replace(/\\/g, "/");
   const segs = rel.split("/");
@@ -123,6 +127,8 @@ function classifyOrigin(file, content) {
   if (rel.includes("src/app/api/")) return "SERVER";
   if (rel.includes("server/api/")) return "SERVER";
   if (hasSeg(...SERVER_HINTS_SEGMENTS)) return "SERVER";
+  const base = segs[segs.length - 1] ?? "";
+  if (/^(server|middleware)[.\-]/i.test(base)) return "SERVER";
   if (content.includes("firebase-admin") || content.includes("firebase-functions")) {
     return "CLIENT";
   }
@@ -161,14 +167,14 @@ async function enrichWithGraph(rootDir, d) {
     const res = await ai.map({ cwd: rootDir, format: "json" });
     const files = Array.isArray(res.files) ? res.files : [];
     const code = files.map((f) => String(f.path).replace(/\\/g, "/")).filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p)).filter((p) => !p.includes("node_modules/") && !/(^|\/)(dist|build|\.next|coverage|lib)\//.test(p)).slice(0, 500);
-    const { readFileSync: readSync, existsSync: existsSyncFn, statSync: statSync2 } = await import("fs");
+    const { readFileSync: readSync, existsSync: existsSyncFn, statSync: statSync3 } = await import("fs");
     const { join: joinP } = await import("path");
     for (const rel of code) {
       let content = "";
       try {
         const abs = joinP(rootDir, rel);
         if (!existsSyncFn(abs)) continue;
-        if (statSync2(abs).size > 100 * 1024) continue;
+        if (statSync3(abs).size > 100 * 1024) continue;
         content = readSync(abs, "utf-8");
       } catch {
         content = "";
@@ -187,7 +193,7 @@ import { join as join2 } from "path";
 import { executeFind } from "@justmpm/supergrep";
 function isBuildOutput(file) {
   const n = file.replace(/\\/g, "/");
-  return /(^|\/)(node_modules|dist|build|\.next|coverage|out)\//.test(n);
+  return /(^|\/)(node_modules|dist|build|\.next|coverage|out)\//.test(n) || /\/functions\/lib\//.test(n);
 }
 var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
 function createEvidence() {
@@ -273,6 +279,28 @@ async function runChecks(model, rootDir, opts = {}) {
       }
     }
   }
+  for (const rule of model.rules) {
+    const unknown2 = rule.unknownOperations ?? [];
+    if (rule.operations.length === 0 || unknown2.length > 0) {
+      const detail = unknown2.length > 0 ? ` (trecho desconhecido: ${unknown2.join(", ")})` : "";
+      findings.push(
+        make(
+          "RULES_UNKNOWN_OP",
+          "WARNING",
+          "CONFIRMED",
+          `Opera\xE7\xE3o desconhecida em ${rule.path}${detail} (${rule.location.file}:${rule.location.start.line}). Typo em allow? Deploy rejeita.`,
+          `RULES_UNKNOWN_OP:${rule.path}:${rule.location.start.line}:${[...rule.operations].sort().join(",")}`,
+          {
+            file: rule.location.file,
+            line: rule.location.start.line,
+            resource: rule.path,
+            evidence: [ev("unknown-op", rule.condition ?? "allow sem opera\xE7\xE3o v\xE1lida", "CONFIRMED", rule.location.file, rule.location.start.line)],
+            fix: "Corrija para read/get/list/write/create/update/delete."
+          }
+        )
+      );
+    }
+  }
   const adapterFn = opts.adapterFn ?? "rbac.can";
   const permissionCalls = await collectPermissionCalls(rootDir, adapterFn);
   const declared = new Set(model.authorization.permissions.map((p) => p.name));
@@ -508,10 +536,6 @@ async function runChecks(model, rootDir, opts = {}) {
     }
   }
   const adminHits = await collectAdminImports(rootDir);
-  const isTestPath = (f) => {
-    const n = f.replace(/\\/g, "/");
-    return /\.test\.[tj]sx?$/.test(n) || /\.spec\.[tj]sx?$/.test(n) || /(^|\/)__tests__\//.test(n) || /(^|\/)(test|tests|testing)\//.test(n);
-  };
   for (const hit of adminHits) {
     let origin = "UNKNOWN";
     try {
@@ -571,7 +595,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
   }
   const seen = /* @__PURE__ */ new Set();
   const pushLiteral = (file, line, permission) => {
-    if (isBuildOutput(file)) return;
+    if (isBuildOutput(file) || isTestPath(file)) return;
     const k = `${file}:${line}:${permission}`;
     if (seen.has(k)) return;
     seen.add(k);
@@ -584,7 +608,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
         const raw = (m.metaVariables["PERM"] ?? "").trim();
         const line = m.line + 1;
         if (raw.includes("${")) {
-          if (!isBuildOutput(m.file)) {
+          if (!isBuildOutput(m.file) && !isTestPath(m.file)) {
             const k = `${m.file}:${line}:${raw}`;
             if (!seen.has(k)) {
               seen.add(k);
@@ -598,7 +622,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
           const perm = raw.replace(/^['"`]|['"`]$/g, "").trim();
           if (/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/.test(perm)) pushLiteral(m.file, line, perm);
           else {
-            if (!isBuildOutput(m.file)) {
+            if (!isBuildOutput(m.file) && !isTestPath(m.file)) {
               const k = `${m.file}:${line}:${raw}:invalid`;
               if (!seen.has(k)) {
                 seen.add(k);
@@ -607,7 +631,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
             }
           }
         } else if (raw.length > 0) {
-          if (!isBuildOutput(m.file)) {
+          if (!isBuildOutput(m.file) && !isTestPath(m.file)) {
             const k = `${m.file}:${line}:${raw}`;
             if (!seen.has(k)) {
               seen.add(k);
@@ -750,6 +774,8 @@ var RuleSchema = z.strictObject({
   id: z.string().min(1),
   path: z.string().min(1),
   operations: z.array(OperationSchema),
+  /** Partes de `allow` não reconhecidas (typo parcial: `get, gett`). */
+  unknownOperations: z.array(z.string()).optional(),
   conditionPresent: z.boolean(),
   condition: z.string().optional(),
   authReferences: z.array(z.string()),
@@ -886,6 +912,14 @@ function validateClaimSamples(samples) {
 
 // src/scan.ts
 async function scan(rootDir, opts = {}) {
+  const { statSync: statRoot } = await import("fs");
+  let rootOk = false;
+  try {
+    rootOk = statRoot(rootDir).isDirectory();
+  } catch {
+    rootOk = false;
+  }
+  if (!rootOk) throw new Error(`Diret\xF3rio n\xE3o existe: ${rootDir}`);
   const d = discover(rootDir);
   if (opts.graph === true) {
     try {
@@ -976,13 +1010,14 @@ async function scan(rootDir, opts = {}) {
   if (d.firestoreRulesFile && existsSync3(d.firestoreRulesFile)) {
     const rel = model.firebase.firestore.rulesFile ?? "firestore.rules";
     try {
+      if (tooLarge(d.firestoreRulesFile, 1024 * 1024)) throw new Error("rules acima de 1 MB");
       model.rules = extractRules(d.firestoreRulesFile, rel);
     } catch {
       findings_pre.push({
         rule: "RULES_UNREADABLE",
         severity: "WARNING",
         confidence: "CONFIRMED",
-        message: "firestore.rules existe mas n\xE3o p\xF4de ser lido \u2014 FBA001/FBA002 sem cobertura.",
+        message: "firestore.rules existe mas n\xE3o p\xF4de ser lido (ileg\xEDvel ou acima de 1 MB) \u2014 FBA001/FBA002 sem cobertura.",
         fingerprint: "RULES_UNREADABLE",
         evidence: [
           { id: "ev-rules-unreadable", kind: "rules-read", summary: "leitura falhou", confidence: "CONFIRMED" }
@@ -992,6 +1027,7 @@ async function scan(rootDir, opts = {}) {
   }
   if (d.firestoreIndexesFile && existsSync3(d.firestoreIndexesFile)) {
     try {
+      if (tooLarge(d.firestoreIndexesFile, 1024 * 1024)) throw new Error("indexes acima de 1 MB");
       const raw = JSON.parse(readFileSync3(d.firestoreIndexesFile, "utf-8"));
       if (Array.isArray(raw.fieldOverrides) && raw.fieldOverrides.length > 0) {
         findings_pre.push({
@@ -1062,7 +1098,7 @@ async function scan(rootDir, opts = {}) {
         rule: "INDEXES_INVALID",
         severity: "WARNING",
         confidence: "CONFIRMED",
-        message: "firestore.indexes.json inv\xE1lido \u2014 \xEDndices ignorados neste scan.",
+        message: "firestore.indexes.json inv\xE1lido ou acima de 1 MB \u2014 \xEDndices ignorados neste scan.",
         fingerprint: "INDEXES_INVALID",
         evidence: [
           { id: "ev-indexes-invalid", kind: "indexes-parse", summary: "JSON inv\xE1lido", confidence: "CONFIRMED" }
@@ -1072,6 +1108,7 @@ async function scan(rootDir, opts = {}) {
   }
   if (d.auditYamlFile && existsSync3(d.auditYamlFile)) {
     try {
+      if (tooLarge(d.auditYamlFile, 256 * 1024)) throw new Error("yaml acima de 256 KB");
       const text = readFileSync3(d.auditYamlFile, "utf-8");
       const parsed = parseYaml(text);
       const validated = AuditYamlSchema.safeParse(parsed);
@@ -1180,6 +1217,7 @@ async function scan(rootDir, opts = {}) {
   if (d.storageRulesFile && existsSync3(d.storageRulesFile)) {
     checked.push("storage.rules");
     try {
+      if (tooLarge(d.storageRulesFile, 1024 * 1024)) throw new Error("storage acima de 1 MB");
       const raw = readFileSync3(d.storageRulesFile, "utf-8");
       const relStorage = model.firebase.storage?.rulesFile ?? "storage.rules";
       const clean = stripRuleComments(raw);
@@ -1288,13 +1326,13 @@ async function scan(rootDir, opts = {}) {
         }
       }
     } catch {
-      skipped.push("storage.rules ileg\xEDvel \u2014 Storage sem cobertura neste scan");
+      skipped.push("storage.rules ileg\xEDvel ou acima de 1 MB \u2014 Storage sem cobertura neste scan");
     }
   } else {
     skipped.push("storage.rules n\xE3o observado \u2014 Storage fora deste scan");
   }
   if (d.functionsDir) {
-    const appcheck = await countAppCheckEnforced(rootDir);
+    const appcheck = await countAppCheckEnforced(rootDir, d.functionsDir);
     model.functions = { dir: model.functions?.dir, appCheckEnforced: appcheck.occurrences };
     checked.push("functions-appcheck");
     if (appcheck.manual > 0) {
@@ -1384,12 +1422,19 @@ async function scan(rootDir, opts = {}) {
     }
   };
 }
-async function countAppCheckEnforced(rootDir) {
+function tooLarge(abs, maxBytes) {
+  try {
+    return statSync2(abs).size > maxBytes;
+  } catch {
+    return false;
+  }
+}
+async function countAppCheckEnforced(rootDir, functionsDir) {
   try {
     const { readdirSync, readFileSync: readSync, statSync: stat } = await import("fs");
     const { join: joinP } = await import("path");
-    const { stripRuleComments: strip } = await import("./rules-W4VUUQM4.js");
-    const roots = [joinP(rootDir, "functions")];
+    const { stripRuleComments: strip } = await import("./rules-HCXATUST.js");
+    const roots = [functionsDir ?? joinP(rootDir, "functions")];
     let occurrences = 0;
     const files = /* @__PURE__ */ new Set();
     let manual = 0;
@@ -1397,13 +1442,9 @@ async function countAppCheckEnforced(rootDir) {
     let limitHit = false;
     const stack = [...roots];
     let guard = 0;
-    const isTestFile = (p) => {
-      const n = p.replace(/\\/g, "/");
-      return /\.test\.[tj]sx?$/.test(n) || /\.spec\.[tj]sx?$/.test(n) || /(^|\/)__tests__\//.test(n) || /(^|\/)(test|tests|testing)\//.test(n);
-    };
+    const isTestFile = isTestPath;
     while (stack.length > 0 && guard < 200) {
       guard += 1;
-      if (guard >= 200 && stack.length > 0) limitHit = true;
       const cur = stack.pop();
       let entries = [];
       try {
@@ -1450,12 +1491,13 @@ async function countAppCheckEnforced(rootDir) {
               files.add(abs);
             }
           }
-          const manualHits = text.match(/verifyToken\s*\(|verify_token\s*\(|consumeAppCheckToken|getLimitedUseToken|getAppCheck\s*\(/g);
+          const manualHits = text.match(/verifyToken\s*\(|verify_token\s*\(|consumeAppCheckToken|getLimitedUseToken/g);
           if (manualHits) manual += manualHits.length;
         } catch {
         }
       }
     }
+    if (stack.length > 0) limitHit = true;
     return { occurrences, files: files.size, manual, ignoredOnRequest, limitHit };
   } catch {
     return { occurrences: 0, files: 0, manual: 0, ignoredOnRequest: 0, limitHit: false };
@@ -1522,9 +1564,14 @@ function parseStorageAllows(clean) {
   const re = /allow\s+([^;:]+?)(?::\s*if\s+([^;]+))?;/gi;
   let m;
   while ((m = re.exec(clean)) !== null) {
-    const containing = matches.filter((b) => b.start <= m.index && m.index < b.end).sort((a, b) => b.start - a.start);
+    const containing = matches.filter((b) => b.start <= m.index && m.index < b.end).sort((a, b) => a.start - b.start);
+    const parts = [];
+    for (const b of containing) {
+      const p = b.path.trim().replace(/^\/+|\/+$/g, "");
+      if (p.length > 0) parts.push(p);
+    }
     const line = clean.slice(0, m.index).split("\n").length;
-    out.push({ target: m[1].trim(), condition: m[2]?.trim(), matchPath: containing[0]?.path ?? "/(unknown)", line });
+    out.push({ target: m[1].trim(), condition: m[2]?.trim(), matchPath: parts.length > 0 ? `/${parts.join("/")}` : "/(unknown)", line });
   }
   return out;
 }
@@ -1550,6 +1597,7 @@ function expandStorageOps(target) {
 export {
   discover,
   SERVER_HINTS_SEGMENTS,
+  isTestPath,
   classifyOrigin,
   emptyModel,
   enrichWithGraph,

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-BB6XXEIK.js";
-import "./chunk-FECVBQUO.js";
+} from "./chunk-NZT4NIVA.js";
+import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -46,6 +46,9 @@ Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
     console.error(`Valor inv\xE1lido para --strict: ${strictArg} (use --strict, --strict=true ou --strict=false)`);
     process.exit(1);
   }
+  if (cmd === "check" && strictArg === "false") {
+    console.error("Aviso: 'check' \xE9 sempre strict por defini\xE7\xE3o \u2014 --strict=false ignorado.");
+  }
   const asJsonArg = getArg("json");
   const asJson = (args.includes("--json") || asJsonArg === "true") && asJsonArg !== "false";
   if (asJsonArg !== void 0 && asJsonArg !== "true" && asJsonArg !== "false") {
@@ -81,8 +84,8 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-SDJSDRDQ.js");
-    const { verify } = await import("./verify-DECP4IUW.js");
+    const { scan: scanForVerify } = await import("./scan-RTIMO3I2.js");
+    const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");
     const coveragePath = coverageArg ? resolveVerify(rootDir, coverageArg) : void 0;
@@ -116,7 +119,7 @@ ${icon} ${f.rule} [${f.confidence}]
     return;
   }
   if (cmd === "drift") {
-    const { drift } = await import("./drift-QXALNO2V.js");
+    const { drift } = await import("./drift-C3JZI5ZA.js");
     const { resolve: resolveDrift } = await import("path");
     const { existsSync: existsDrift } = await import("fs");
     const localArg = getArg("local");
@@ -130,7 +133,7 @@ ${icon} ${f.rule} [${f.confidence}]
     for (const [label, p] of [["--local", localPath], ["--remote", remotePath]]) {
       if (p && !existsDrift(p)) {
         if (asJson) {
-          const { drift: driftMissing } = await import("./drift-QXALNO2V.js");
+          const { drift: driftMissing } = await import("./drift-C3JZI5ZA.js");
           const res2 = driftMissing(
             localPath && existsDrift(localPath) ? localPath : null,
             remotePath && existsDrift(remotePath) ? remotePath : null

package/dist/{drift-QXALNO2V.js → drift-C3JZI5ZA.js}

@@ -1,6 +1,6 @@
 import {
   drift
-} from "./chunk-XZ32YQQC.js";
+} from "./chunk-LD3F73XI.js";
 export {
   drift
 };

package/dist/index.d.ts

@@ -217,6 +217,7 @@ declare const RuleSchema: z.ZodObject<{
         delete: "delete";
         write: "write";
     }>>;
+    unknownOperations: z.ZodOptional<z.ZodArray<z.ZodString>>;
     conditionPresent: z.ZodBoolean;
     condition: z.ZodOptional<z.ZodString>;
     authReferences: z.ZodArray<z.ZodString>;
@@ -419,6 +420,7 @@ declare const ProjectModelSchema: z.ZodObject<{
             delete: "delete";
             write: "write";
         }>>;
+        unknownOperations: z.ZodOptional<z.ZodArray<z.ZodString>>;
         conditionPresent: z.ZodBoolean;
         condition: z.ZodOptional<z.ZodString>;
         authReferences: z.ZodArray<z.ZodString>;
@@ -639,6 +641,8 @@ interface DiscoveryResult {
 declare function discover(rootDir: string): DiscoveryResult;
 /** Segmentos de servidor (fail-closed: `api` genérico NÃO é server, ver classifyOrigin). */
 declare const SERVER_HINTS_SEGMENTS: string[];
+/** Arquivo de teste/setup de Emulator (com Admin legitimamente): nunca reprova CI. */
+declare function isTestPath(file: string): boolean;
 /** Heurística CLIENT vs SERVER: caminho manda primeiro (grafo ai-tool preenche listas na Fase 3).
  * Segmentos ancorados — nunca substring solta (`myapp/` não é `app/`). */
 declare function classifyOrigin(file: string, content: string): "CLIENT" | "SERVER" | "UNKNOWN";
@@ -665,6 +669,7 @@ declare function stripRuleComments(content: string): string;
 declare function opsFrom(target: string): {
     ops: Rule["operations"];
     known: boolean;
+    unknown: string[];
 };
 /** Normaliza target de allow para fingerprint estável (case/espaço/ordem). */
 declare function normalizeTarget(target: string): string;
@@ -763,7 +768,9 @@ interface ScanSummary {
     errors: number;
     warnings: number;
     infos: number;
+    /** Checks FBA que passaram (só FBA; infra nomeada vai em `infra`). */
     passedChecks: number;
+    /** Total de checks FBA implementados. */
     totalChecks: number;
     /** Infra nomeada (fora dos checks FBA): cada item diz qual e por quê. */
     infra: {
@@ -845,4 +852,4 @@ declare function drift(localFile: string | null, remoteFile: string | null): Dri
 
 declare const VERSION: string;
 
-export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, type DriftEntry, type DriftResult, type DriftStatus, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IMPLEMENTED_CHECKS, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RESERVED_CLAIM_KEYS, RoleSchema, RuleSchema, SERVER_HINTS_SEGMENTS, type ScanOptions, type ScanResult, type ScanSummary, SeveritySchema, VERSION, type VerifyCase, type VerifyOptions, type VerifyResult, buildFullPath, classifyOrigin, conditionKeyForFingerprint, discover, drift, emptyModel, enrichWithGraph, extractRules, extractRulesContent, findPublicAllows, findPublicAllowsContent, hashShort, helperBodyToCondition, inlineHelperArgs, inlineHelpersInCondition, isPublicCondition, normalizeTarget, opsFrom, parseMatchBlocks, parseRuleFunctions, parseRuleFunctionsDetailed, planVerify, resolveHelperCondition, resolveHelperConditionDetailed, runChecks, scan, stripOuterParens, stripRuleComments, validateClaimSamples, verify };
+export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, type DriftEntry, type DriftResult, type DriftStatus, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IMPLEMENTED_CHECKS, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RESERVED_CLAIM_KEYS, RoleSchema, RuleSchema, SERVER_HINTS_SEGMENTS, type ScanOptions, type ScanResult, type ScanSummary, SeveritySchema, VERSION, type VerifyCase, type VerifyOptions, type VerifyResult, buildFullPath, classifyOrigin, conditionKeyForFingerprint, discover, drift, emptyModel, enrichWithGraph, extractRules, extractRulesContent, findPublicAllows, findPublicAllowsContent, hashShort, helperBodyToCondition, inlineHelperArgs, inlineHelpersInCondition, isPublicCondition, isTestPath, normalizeTarget, opsFrom, parseMatchBlocks, parseRuleFunctions, parseRuleFunctionsDetailed, planVerify, resolveHelperCondition, resolveHelperConditionDetailed, runChecks, scan, stripOuterParens, stripRuleComments, validateClaimSamples, verify };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-SH6HFX5Y.js";
+} from "./chunk-D75SRJ7P.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -30,10 +30,11 @@ import {
   discover,
   emptyModel,
   enrichWithGraph,
+  isTestPath,
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-BB6XXEIK.js";
+} from "./chunk-NZT4NIVA.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,
@@ -55,14 +56,14 @@ import {
   resolveHelperConditionDetailed,
   stripOuterParens,
   stripRuleComments
-} from "./chunk-FECVBQUO.js";
+} from "./chunk-7J3ADEBW.js";
 import {
   planVerify,
   verify
-} from "./chunk-DIO36A3I.js";
+} from "./chunk-CSMT4PIP.js";
 import {
   drift
-} from "./chunk-XZ32YQQC.js";
+} from "./chunk-LD3F73XI.js";
 
 // src/index.ts
 import { createRequire } from "module";
@@ -111,6 +112,7 @@ export {
   inlineHelperArgs,
   inlineHelpersInCondition,
   isPublicCondition,
+  isTestPath,
   normalizeTarget,
   opsFrom,
   parseMatchBlocks,

package/dist/mcp-cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-SH6HFX5Y.js";
-import "./chunk-BB6XXEIK.js";
-import "./chunk-FECVBQUO.js";
-import "./chunk-DIO36A3I.js";
-import "./chunk-XZ32YQQC.js";
+} from "./chunk-D75SRJ7P.js";
+import "./chunk-NZT4NIVA.js";
+import "./chunk-7J3ADEBW.js";
+import "./chunk-CSMT4PIP.js";
+import "./chunk-LD3F73XI.js";
 
 // src/mcp-cli.ts
 startMcpServer().catch((err) => {

package/dist/mcp.js

@@ -1,11 +1,11 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-SH6HFX5Y.js";
-import "./chunk-BB6XXEIK.js";
-import "./chunk-FECVBQUO.js";
-import "./chunk-DIO36A3I.js";
-import "./chunk-XZ32YQQC.js";
+} from "./chunk-D75SRJ7P.js";
+import "./chunk-NZT4NIVA.js";
+import "./chunk-7J3ADEBW.js";
+import "./chunk-CSMT4PIP.js";
+import "./chunk-LD3F73XI.js";
 export {
   createMcpServer,
   startMcpServer

package/dist/{rules-W4VUUQM4.js → rules-HCXATUST.js}

@@ -19,7 +19,7 @@ import {
   resolveHelperConditionDetailed,
   stripOuterParens,
   stripRuleComments
-} from "./chunk-FECVBQUO.js";
+} from "./chunk-7J3ADEBW.js";
 export {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/scan-RTIMO3I2.js

@@ -0,0 +1,7 @@
+import {
+  scan
+} from "./chunk-NZT4NIVA.js";
+import "./chunk-7J3ADEBW.js";
+export {
+  scan
+};

package/dist/{verify-DECP4IUW.js → verify-GQSR4FQL.js}

@@ -1,7 +1,7 @@
 import {
   planVerify,
   verify
-} from "./chunk-DIO36A3I.js";
+} from "./chunk-CSMT4PIP.js";
 export {
   planVerify,
   verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -34,6 +34,6 @@ Use `drift` para comparar índices locais vs implantados (MATCHED/LOCAL_ONLY/REM
 
 ## Limites honestos
 
-- AppCheck: varredura TS/Python por texto (`enforceAppCheck`, `verifyToken` e afins). Config via variável conta como não observada; `onRequest` exige revisão rota a rota.
+- AppCheck: varredura TS/Python por texto (`enforceAppCheck`, `verifyToken` e afins). Config via variável ou objeto compartilhado conta como não observada; janela de trigger pode errar em arquivo multi-função — `onRequest` exige revisão rota a rota.
 - Isolamento por tenant (ownerId/tenantId) e mismatch de papel não-admin: fora dos checks — revise manualmente ou no Emulator.
 - `graph: true` é prévia opt-in da biblioteca (nenhum check consome ainda).

package/dist/scan-SDJSDRDQ.js

@@ -1,7 +0,0 @@
-import {
-  scan
-} from "./chunk-BB6XXEIK.js";
-import "./chunk-FECVBQUO.js";
-export {
-  scan
-};