@devstroupe/devkit-cli 1.1.16 → 1.2.0-beta.1

package/dist/migrations/entity-module-move.d.ts

@@ -0,0 +1,16 @@
+export interface EntityModuleMoveOperation {
+    kind: 'move' | 'update-config' | 'regenerate-module' | 'review-migration';
+    from?: string;
+    to?: string;
+    detail: string;
+}
+export interface EntityModuleMovePlan {
+    entityName: string;
+    sourceModule: string;
+    targetModule: string;
+    backendType: 'monolith' | 'microservices';
+    operations: EntityModuleMoveOperation[];
+    conflicts: string[];
+}
+export declare function planEntityModuleMove(projectRoot: string, config: any, entityName: string, requestedModule: string): EntityModuleMovePlan;
+export declare function updateEntityModuleInConfig(source: string, entityName: string, targetModule: string): string;

package/dist/migrations/entity-module-move.js

@@ -0,0 +1,98 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.planEntityModuleMove = planEntityModuleMove;
+exports.updateEntityModuleInConfig = updateEntityModuleInConfig;
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const node_path_1 = __importDefault(require("node:path"));
+const devkit_core_1 = require("@devstroupe/devkit-core");
+function planEntityModuleMove(projectRoot, config, entityName, requestedModule) {
+    const entity = (config.entities ?? []).find((candidate) => candidate.name === entityName);
+    if (!entity)
+        throw new Error(`Entity "${entityName}" is not configured.`);
+    const targetModule = (0, devkit_core_1.normalizeEntityModule)(requestedModule);
+    const sourceModule = (0, devkit_core_1.resolveEntityModule)(entity);
+    const backendType = config.backendType === 'microservices' ? 'microservices' : 'monolith';
+    const backendRoot = node_path_1.default.resolve(projectRoot, config.backendPath ?? './backend');
+    const operations = [{
+            kind: 'update-config', detail: `Set ${entityName}.module to "${targetModule}".`,
+        }];
+    const conflicts = [];
+    if (sourceModule === targetModule) {
+        return { entityName, sourceModule, targetModule, backendType, operations: [], conflicts: [] };
+    }
+    if (backendType === 'monolith') {
+        const from = node_path_1.default.join(backendRoot, 'src', 'modules', sourceModule, entityName);
+        const to = node_path_1.default.join(backendRoot, 'src', 'modules', targetModule, entityName);
+        operations.push({ kind: 'move', from, to, detail: 'Move the complete entity directory without rewriting custom files.' });
+        operations.push({ kind: 'regenerate-module', detail: `Regenerate ${sourceModule}.module.ts and ${targetModule}.module.ts.` });
+        operations.push({ kind: 'review-migration', detail: `Update owner-module metadata for ${entityName} migrations.` });
+        if (!fs_extra_1.default.existsSync(from))
+            conflicts.push(`Source entity directory does not exist: ${from}`);
+        if (fs_extra_1.default.existsSync(to))
+            conflicts.push(`Target entity directory already exists: ${to}`);
+    }
+    else {
+        const sourceService = node_path_1.default.join(backendRoot, 'apps', `${sourceModule}-service`);
+        const migrations = node_path_1.default.join(sourceService, 'src', 'database', 'migrations');
+        operations.push({
+            kind: 'review-migration',
+            detail: 'Moving between service databases requires an explicit data/schema migration and cannot be applied automatically.',
+        });
+        if (fs_extra_1.default.existsSync(migrations) && fs_extra_1.default.readdirSync(migrations).some((file) => file.endsWith(`-create-${entityName}.ts`))) {
+            conflicts.push('Microservice ownership changes require an approved cross-database migration plan.');
+        }
+        else {
+            conflicts.push('Automatic microservice moves are intentionally disabled; regenerate after reviewing service contracts and data ownership.');
+        }
+    }
+    return { entityName, sourceModule, targetModule, backendType, operations, conflicts };
+}
+function entityObjectRange(source, entityName) {
+    const escaped = entityName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const nameMatch = new RegExp(`['"]?name['"]?\\s*:\\s*['"]${escaped}['"]`).exec(source);
+    if (!nameMatch)
+        throw new Error(`Could not locate entity "${entityName}" in devstroupe.config.ts.`);
+    const start = source.lastIndexOf('{', nameMatch.index);
+    if (start < 0)
+        throw new Error(`Could not locate object start for entity "${entityName}".`);
+    let depth = 0;
+    let quote;
+    let escapedCharacter = false;
+    for (let index = start; index < source.length; index += 1) {
+        const character = source[index];
+        if (quote) {
+            if (escapedCharacter)
+                escapedCharacter = false;
+            else if (character === '\\')
+                escapedCharacter = true;
+            else if (character === quote)
+                quote = undefined;
+            continue;
+        }
+        if (character === "'" || character === '"' || character === '`') {
+            quote = character;
+            continue;
+        }
+        if (character === '{')
+            depth += 1;
+        if (character === '}' && --depth === 0)
+            return { start, end: index + 1 };
+    }
+    throw new Error(`Could not locate object end for entity "${entityName}".`);
+}
+function updateEntityModuleInConfig(source, entityName, targetModule) {
+    const normalized = (0, devkit_core_1.normalizeEntityModule)(targetModule);
+    const range = entityObjectRange(source, entityName);
+    const objectSource = source.slice(range.start, range.end);
+    const modulePattern = /\n(\s*)['"]?module['"]?\s*:\s*['"][^'"]*['"]\s*,?/;
+    const nameLine = /\n(\s*)['"]?name['"]?\s*:\s*['"][^'"]*['"]\s*,?/;
+    const updatedObject = modulePattern.test(objectSource)
+        ? objectSource.replace(modulePattern, (_match, indent) => `\n${indent}module: '${normalized}',`)
+        : objectSource.replace(nameLine, (match, indent) => `${match}\n${indent}module: '${normalized}',`);
+    if (updatedObject === objectSource)
+        throw new Error(`Entity "${entityName}" must use a multiline object literal for safe migration.`);
+    return source.slice(0, range.start) + updatedObject + source.slice(range.end);
+}

package/dist/migrations/entity-module-move.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/migrations/entity-module-move.test.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_test_1 = __importDefault(require("node:test"));
+const entity_module_move_1 = require("./entity-module-move");
+(0, node_test_1.default)('entity module migration defaults to a non-destructive plan', () => {
+    const root = fs_extra_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'devkit-module-move-'));
+    fs_extra_1.default.ensureDirSync(node_path_1.default.join(root, 'backend/src/modules/core/product'));
+    const plan = (0, entity_module_move_1.planEntityModuleMove)(root, {
+        backendType: 'monolith', backendPath: './backend',
+        entities: [{ name: 'product', properties: [] }],
+    }, 'product', 'Sales Catalog');
+    strict_1.default.equal(plan.sourceModule, 'core');
+    strict_1.default.equal(plan.targetModule, 'sales-catalog');
+    strict_1.default.equal(plan.conflicts.length, 0);
+    strict_1.default.ok(fs_extra_1.default.existsSync(node_path_1.default.join(root, 'backend/src/modules/core/product')));
+    strict_1.default.ok(!fs_extra_1.default.existsSync(node_path_1.default.join(root, 'backend/src/modules/sales-catalog/product')));
+});
+(0, node_test_1.default)('config updater changes only the requested entity object', () => {
+    const source = `entities: [\n  {\n    name: 'product',\n    properties: [],\n  },\n  {\n    name: 'stock',\n    module: 'inventory',\n    properties: [],\n  },\n]`;
+    const updated = (0, entity_module_move_1.updateEntityModuleInConfig)(source, 'product', 'Catalog');
+    strict_1.default.match(updated, /name: 'product',\n    module: 'catalog',/);
+    strict_1.default.match(updated, /name: 'stock',\n    module: 'inventory',/);
+});

package/dist/rules/linter-rules.js

@@ -32,10 +32,71 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runLinter = runLinter;
 const fs = __importStar(require("fs-extra"));
 const path = __importStar(require("path"));
+const devkit_core_1 = require("@devstroupe/devkit-core");
+const typescript_1 = __importDefault(require("typescript"));
+function visit(node, inspect) {
+    inspect(node);
+    typescript_1.default.forEachChild(node, (child) => visit(child, inspect));
+}
+function sourceLine(source, node) {
+    return source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
+}
+function calledMethod(node) {
+    if (!typescript_1.default.isCallExpression(node) || !typescript_1.default.isPropertyAccessExpression(node.expression))
+        return undefined;
+    return node.expression.name.text;
+}
+function nodeCallsMethod(source, method) {
+    let found = false;
+    visit(source, (node) => { if (calledMethod(node) === method)
+        found = true; });
+    return found;
+}
+function callsMethod(source, method) {
+    return nodeCallsMethod(source, method);
+}
+function hasTenantScopedBase(source) {
+    let found = false;
+    visit(source, (node) => {
+        if (!typescript_1.default.isCallExpression(node) || node.expression.kind !== typescript_1.default.SyntaxKind.SuperKeyword)
+            return;
+        for (const argument of node.arguments) {
+            if (!typescript_1.default.isObjectLiteralExpression(argument))
+                continue;
+            const scope = argument.properties.find((property) => {
+                if (!('name' in property) || !property.name)
+                    return false;
+                return (typescript_1.default.isIdentifier(property.name) || typescript_1.default.isStringLiteralLike(property.name))
+                    && property.name.text === 'scope';
+            });
+            if (scope && nodeCallsMethod(scope, 'requireTenantId'))
+                found = true;
+        }
+    });
+    return found;
+}
+function usesDecorator(source, decoratorName) {
+    let found = false;
+    visit(source, (node) => {
+        if (!typescript_1.default.canHaveDecorators(node))
+            return;
+        for (const decorator of typescript_1.default.getDecorators(node) ?? []) {
+            const expression = typescript_1.default.isCallExpression(decorator.expression)
+                ? decorator.expression.expression
+                : decorator.expression;
+            if (typescript_1.default.isIdentifier(expression) && expression.text === decoratorName)
+                found = true;
+        }
+    });
+    return found;
+}
 // Helper para ler arquivos recursivamente com filtros de extensão
 function getFilesRecursively(dir, extensions) {
     let results = [];
@@ -79,22 +140,155 @@ function runLinter(projectRoot, config) {
     const severityCleanArch = getRuleSeverity('clean-architecture-imports', 'warn');
     const severitySynchronize = getRuleSeverity('disable-typeorm-synchronize', 'error');
     const severitySpartanRadius = getRuleSeverity('no-custom-spartan-radius', 'error');
+    const severityModuleOwnership = getRuleSeverity('backend-module-ownership', 'error');
+    const severityModuleIsolation = getRuleSeverity('backend-module-isolation', 'error');
+    const severitySoftDelete = getRuleSeverity('require-soft-delete', 'error');
+    const severityTenantScope = getRuleSeverity('require-tenant-scope', 'error');
+    const severityStatelessGateway = getRuleSeverity('backend-gateway-stateless', 'error');
     const backendRoot = path.resolve(projectRoot, config.backendPath || './backend');
     const frontendRoot = path.resolve(projectRoot, config.frontendPath || './frontend');
+    const configuredEntities = config.entities ?? [];
+    const entityModules = new Map();
+    for (const entity of configuredEntities) {
+        try {
+            entityModules.set(entity.name, (0, devkit_core_1.resolveEntityModule)(entity));
+        }
+        catch (error) {
+            if (severityModuleOwnership !== 'off') {
+                violations.push({
+                    file: 'devstroupe.config.ts', line: 1, rule: 'backend-module-ownership',
+                    severity: severityModuleOwnership,
+                    message: error instanceof Error ? error.message : `Módulo inválido para ${entity.name}.`,
+                });
+            }
+        }
+    }
     // --- 1. Auditando o Backend (NestJS) ---
     if (fs.existsSync(backendRoot)) {
         const backendFiles = getFilesRecursively(backendRoot, ['.ts']);
         filesScanned += backendFiles.length;
+        if (severityModuleOwnership !== 'off') {
+            for (const [entityName, expectedModule] of entityModules) {
+                const ownershipPattern = new RegExp(`(?:^|/)src/modules/([^/]+)/${entityName}/`);
+                const misplaced = backendFiles.find((candidate) => {
+                    const match = path.relative(projectRoot, candidate).replace(/\\/g, '/').match(ownershipPattern);
+                    return match && match[1] !== expectedModule;
+                });
+                if (misplaced) {
+                    violations.push({
+                        file: path.relative(projectRoot, misplaced), line: 1, rule: 'backend-module-ownership',
+                        severity: severityModuleOwnership,
+                        message: `A entidade "${entityName}" pertence ao módulo "${expectedModule}" e não pode ser gerada em outro módulo.`,
+                    });
+                }
+            }
+        }
         for (const file of backendFiles) {
             const content = fs.readFileSync(file, 'utf-8');
-            const lines = content.split('\n');
+            const sourceFile = typescript_1.default.createSourceFile(file, content, typescript_1.default.ScriptTarget.Latest, true, typescript_1.default.ScriptKind.TS);
             const relativePath = path.relative(projectRoot, file);
+            const normalizedBackendPath = relativePath.replace(/\\/g, '/');
+            const businessCode = !/\.(?:test|spec)\.ts$/.test(file) && !normalizedBackendPath.includes('/migrations/');
+            if (severityStatelessGateway !== 'off' && config.backendType === 'microservices') {
+                const gatewaySource = normalizedBackendPath.includes('/api-gateway/src/');
+                const entityGatewayController = /\/api-gateway\/src\/modules\/[^/]+\/[^/]+\/.*\.controller\.ts$/.test(normalizedBackendPath);
+                const statefulGatewayCode = /TypeOrmModule|@Entity\b|\bRepository\s*</.test(content);
+                const rpcCrudGatewayCode = /\bClientProxy\b|@MessagePattern\b/.test(content);
+                if (gatewaySource && (normalizedBackendPath.includes('/src/database/') || entityGatewayController || statefulGatewayCode || rpcCrudGatewayCode)) {
+                    violations.push({
+                        file: relativePath, line: 1, rule: 'backend-gateway-stateless',
+                        severity: severityStatelessGateway,
+                        message: 'O API Gateway deve ser stateless e rotear por módulo: sem TypeORM, banco, CRUD por entidade ou tradução RPC por operação.',
+                    });
+                }
+                const serviceMain = /\/apps\/[^/]+-service\/src\/main\.ts$/.test(normalizedBackendPath);
+                if (serviceMain && /createMicroservice|Transport\.TCP/.test(content)) {
+                    violations.push({
+                        file: relativePath, line: 1, rule: 'backend-gateway-stateless',
+                        severity: severityStatelessGateway,
+                        message: 'CRUD síncrono dos módulos deve ser exposto por HTTP; TCP/mensageria permanece para fluxos assíncronos.',
+                    });
+                }
+            }
+            if (severityModuleIsolation !== 'off') {
+                const ownerMatch = normalizedBackendPath.match(/(?:^|\/)src\/modules\/([^/]+)\//);
+                const ownerModule = ownerMatch?.[1];
+                if (ownerModule) {
+                    for (const statement of sourceFile.statements) {
+                        if (!typescript_1.default.isImportDeclaration(statement) && !typescript_1.default.isExportDeclaration(statement))
+                            continue;
+                        const moduleSpecifier = statement.moduleSpecifier;
+                        if (!moduleSpecifier || !typescript_1.default.isStringLiteralLike(moduleSpecifier))
+                            continue;
+                        const specifier = moduleSpecifier.text;
+                        if (!specifier.startsWith('.'))
+                            continue;
+                        const resolved = path.resolve(path.dirname(file), specifier).replace(/\\/g, '/');
+                        const targetMatch = resolved.match(/\/src\/modules\/([^/]+)\//);
+                        const targetModule = targetMatch?.[1];
+                        const isInfrastructure = /\/(?:infra|infrastructure)\/|\.repository$|\.orm-entity$/.test(resolved);
+                        const identityModules = new Set(['auth', 'user', 'role']);
+                        const sameBuiltInIdentityBoundary = identityModules.has(ownerModule) && identityModules.has(targetModule ?? '');
+                        if (targetModule && targetModule !== ownerModule && !sameBuiltInIdentityBoundary && isInfrastructure) {
+                            violations.push({
+                                file: relativePath,
+                                line: sourceLine(sourceFile, statement),
+                                rule: 'backend-module-isolation',
+                                severity: severityModuleIsolation,
+                                message: `O módulo "${ownerModule}" não pode importar infraestrutura do módulo "${targetModule}". Use ID, contrato ou evento.`,
+                            });
+                        }
+                    }
+                }
+            }
+            const persistenceCode = /(?:\.repository|\.repository\.adapter|\.reader)\.ts$/.test(file);
+            if (severitySoftDelete !== 'off' && businessCode && usesDecorator(sourceFile, 'Entity') && !usesDecorator(sourceFile, 'DeleteDateColumn')) {
+                violations.push({
+                    file: relativePath, line: 1, rule: 'require-soft-delete',
+                    severity: severitySoftDelete,
+                    message: 'Toda entity persistente deve declarar @DeleteDateColumn; restore continua somente operacional/manual.',
+                });
+            }
+            if (severitySoftDelete !== 'off' && businessCode && persistenceCode) {
+                visit(sourceFile, (node) => {
+                    const method = calledMethod(node);
+                    if (!method || !['delete', 'remove', 'clear'].includes(method))
+                        return;
+                    const call = node;
+                    const receiver = call.expression.expression;
+                    const delegatesToSafeBase = method === 'delete' && receiver.kind === typescript_1.default.SyntaxKind.SuperKeyword;
+                    if (!delegatesToSafeBase) {
+                        violations.push({
+                            file: relativePath, line: sourceLine(sourceFile, node), rule: 'require-soft-delete',
+                            severity: severitySoftDelete,
+                            message: 'Hard delete não é permitido em código de negócio. Use soft delete; restore permanece operacional/manual.',
+                        });
+                    }
+                });
+            }
+            if (severityTenantScope !== 'off' && file.endsWith('.repository.ts')) {
+                const entityName = path.basename(file, '.repository.ts');
+                const entity = configuredEntities.find((candidate) => candidate.name === entityName);
+                const tenantScoped = Boolean(config.multiTenant?.enabled && entity && entity.tenantScoped !== false);
+                if (tenantScoped && (!callsMethod(sourceFile, 'requireTenantId') || !hasTenantScopedBase(sourceFile))) {
+                    violations.push({
+                        file: relativePath, line: 1, rule: 'require-tenant-scope',
+                        severity: severityTenantScope,
+                        message: `Repository tenant-scoped "${entityName}" deve fornecer scope fail-closed do BaseRepository com executionContext.requireTenantId() para queries, updates e deletes.`,
+                    });
+                }
+            }
             if (severitySynchronize !== 'off') {
-                lines.forEach((line, index) => {
-                    if (/\bsynchronize\s*:\s*true\b/.test(line)) {
+                visit(sourceFile, (node) => {
+                    if (!typescript_1.default.isPropertyAssignment(node))
+                        return;
+                    const name = node.name;
+                    const isSynchronize = (typescript_1.default.isIdentifier(name) || typescript_1.default.isStringLiteralLike(name))
+                        && name.text === 'synchronize';
+                    if (isSynchronize && node.initializer.kind === typescript_1.default.SyntaxKind.TrueKeyword) {
                         violations.push({
                             file: relativePath,
-                            line: index + 1,
+                            line: sourceLine(sourceFile, node),
                             rule: 'disable-typeorm-synchronize',
                             severity: severitySynchronize,
                             message: 'Use migrations TypeORM e mantenha "synchronize: false" para evitar alterações automáticas no schema.'
@@ -105,57 +299,83 @@ function runLinter(projectRoot, config) {
             // Regra: clean-architecture-imports
             // Impede que arquivos sob subdiretórios de domínio importem infra/controllers
             if (severityCleanArch !== 'off' && (file.includes('/domain/') || file.includes('/entities/'))) {
-                lines.forEach((line, index) => {
-                    const trimmed = line.trim();
-                    if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*'))
-                        return;
-                    // Import contendo infra, controller, module ou similar
-                    if (/import\s+.*\s+from\s+['"].*(?:\/infra\/|\/controllers\/|\/modules\/|\.controller|\.module).*['"]/i.test(line)) {
+                for (const statement of sourceFile.statements) {
+                    if (!typescript_1.default.isImportDeclaration(statement) && !typescript_1.default.isExportDeclaration(statement))
+                        continue;
+                    const moduleSpecifier = statement.moduleSpecifier;
+                    if (!moduleSpecifier || !typescript_1.default.isStringLiteralLike(moduleSpecifier))
+                        continue;
+                    if (/(?:\/infra\/|\/infrastructure\/|\/controllers\/|\/modules\/|\.controller|\.module)/i.test(moduleSpecifier.text)) {
                         violations.push({
                             file: relativePath,
-                            line: index + 1,
+                            line: sourceLine(sourceFile, statement),
                             rule: 'clean-architecture-imports',
                             severity: severityCleanArch,
                             message: 'Camada de Domínio/Entidade não deve importar classes da camada de Infraestrutura, Controladores ou Módulos.'
                         });
                     }
-                });
+                }
             }
             // Regra: force-pagination-in-backend
             // Garante que repositórios/controllers evitem .find() brutas ou .getMany() brutas
             if (severityForcePagination !== 'off') {
-                const hasRepositoryOrController = file.endsWith('.repository.ts') || file.endsWith('.controller.ts') || file.endsWith('.service.ts');
+                const hasRepositoryOrController = file.endsWith('.repository.ts') || file.endsWith('.repository.adapter.ts') || file.endsWith('.controller.ts') || file.endsWith('.service.ts') || file.endsWith('.reader.ts');
                 if (hasRepositoryOrController) {
-                    lines.forEach((line, index) => {
-                        const trimmed = line.trim();
-                        if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*'))
+                    const hasPhysicalLimit = callsMethod(sourceFile, 'take') || callsMethod(sourceFile, 'limit');
+                    visit(sourceFile, (node) => {
+                        if (!typescript_1.default.isCallExpression(node))
                             return;
-                        // .find() sem argumentos ou sem filtros limitados, ou getMany() direto no queryBuilder sem skip/take/limit/take
-                        if (/\.find\(\s*(?:\{\s*\})?\s*\)/.test(line)) {
+                        const method = calledMethod(node);
+                        const emptyFindOptions = node.arguments.length === 1
+                            && typescript_1.default.isObjectLiteralExpression(node.arguments[0])
+                            && node.arguments[0].properties.length === 0;
+                        if (method === 'find' && (node.arguments.length === 0 || emptyFindOptions)) {
                             violations.push({
                                 file: relativePath,
-                                line: index + 1,
+                                line: sourceLine(sourceFile, node),
                                 rule: 'force-pagination-in-backend',
                                 severity: severityForcePagination,
                                 message: 'Evite usar consultas brutas de tabela cheia ".find()". Prefira a paginação padrão do repositório ("findMany").'
                             });
                         }
-                        if (/\.getMany\(\)/.test(line) && !content.includes('.take(') && !content.includes('.limit(')) {
+                        if (method === 'getMany' && !hasPhysicalLimit) {
                             violations.push({
                                 file: relativePath,
-                                line: index + 1,
+                                line: sourceLine(sourceFile, node),
                                 rule: 'force-pagination-in-backend',
                                 severity: severityForcePagination,
                                 message: 'Evite chamar ".getMany()" no QueryBuilder sem especificar limites de paginação (".take" ou ".limit").'
                             });
                         }
+                        if (method === 'getRawMany' && !hasPhysicalLimit) {
+                            violations.push({
+                                file: relativePath,
+                                line: sourceLine(sourceFile, node),
+                                rule: 'force-pagination-in-backend',
+                                severity: severityForcePagination,
+                                message: 'Evite chamar ".getRawMany()" sem um limite físico explícito.',
+                            });
+                        }
                     });
                 }
             }
             // Regra: use-standard-devkit-queries (Backend)
             if (severityStandardQueries !== 'off') {
                 // Controllers devem herdar de BaseCrudController
-                if (file.endsWith('.controller.ts') && !file.endsWith('auth.controller.ts') && !file.endsWith('storage.controller.ts') && !file.endsWith('storage-download.controller.ts') && content.includes('@Controller') && !content.includes('extends BaseCrudController')) {
+                const customInputAdapter = normalizedBackendPath.includes('/api/webhooks/')
+                    || file.endsWith('.webhook.controller.ts');
+                const configuredCrudController = configuredEntities.some((entity) => {
+                    const ownerModule = entityModules.get(entity.name);
+                    return (ownerModule && normalizedBackendPath.endsWith(`/modules/${ownerModule}/${entity.name}/api/${entity.name}.controller.ts`))
+                        || normalizedBackendPath.endsWith(`/modules/${entity.name}/infra/http/${entity.name}.controller.ts`);
+                });
+                const conventionalCrudController = /@(Post|Get|Put|Patch|Delete)\b/.test(content)
+                    && /@Delete\b/.test(content)
+                    && /@(Put|Patch)\b/.test(content);
+                const requiresCrudBase = configuredEntities.length === 0
+                    || configuredCrudController
+                    || conventionalCrudController;
+                if (file.endsWith('.controller.ts') && requiresCrudBase && !customInputAdapter && !file.endsWith('auth.controller.ts') && !file.endsWith('storage.controller.ts') && !file.endsWith('storage-download.controller.ts') && content.includes('@Controller') && !content.includes('@MessagePattern') && !content.includes('GatewayController') && !content.includes('extends BaseCrudController')) {
                     violations.push({
                         file: relativePath,
                         line: 1,
@@ -176,6 +396,16 @@ function runLinter(projectRoot, config) {
                 }
             }
         }
+        if (severityStatelessGateway !== 'off' && config.backendType === 'microservices') {
+            const composePath = path.join(projectRoot, 'docker-compose.yml');
+            if (fs.existsSync(composePath) && fs.readFileSync(composePath, 'utf-8').includes('devstroupe_gateway_identity')) {
+                violations.push({
+                    file: 'docker-compose.yml', line: 1, rule: 'backend-gateway-stateless',
+                    severity: severityStatelessGateway,
+                    message: 'O gateway não possui banco de identidade; User, Role e Auth pertencem ao Core.',
+                });
+            }
+        }
     }
     // --- 2. Auditando o Frontend (Angular) ---
     if (fs.existsSync(frontendRoot)) {

package/dist/rules/linter-rules.test.js

@@ -212,3 +212,128 @@ function teardownSandbox() {
     const violations = result.violations.filter(v => v.rule === 'disable-typeorm-synchronize');
     assert.strictEqual(violations.length, 1);
 });
+(0, node_test_1.test)('runLinter enforces module isolation, soft delete and trusted tenant scope', () => {
+    setupSandbox();
+    const productRoot = path.join(sandboxDir, 'backend/src/modules/catalog/product');
+    const stockRoot = path.join(sandboxDir, 'backend/src/modules/inventory/stock');
+    fs.ensureDirSync(path.join(productRoot, 'infrastructure/persistence/typeorm'));
+    fs.ensureDirSync(path.join(stockRoot, 'infrastructure/persistence/typeorm'));
+    fs.ensureDirSync(path.join(sandboxDir, 'backend/src/modules/wrong/product/api'));
+    fs.writeFileSync(path.join(sandboxDir, 'backend/src/modules/wrong/product/api/product.controller.ts'), `@Controller('product') export class ProductController extends BaseCrudController<any> {}`);
+    fs.writeFileSync(path.join(productRoot, 'infrastructure/persistence/typeorm/product.orm-entity.ts'), 'export class ProductOrmEntity {}');
+    fs.writeFileSync(path.join(stockRoot, 'infrastructure/persistence/typeorm/stock.repository.ts'), `import { Injectable } from '@nestjs/common';
+     import { ProductOrmEntity } from '../../../../../catalog/product/infrastructure/persistence/typeorm/product.orm-entity';
+     @Injectable()
+     export class StockRepository extends BaseRepository<any> {
+       removeStock() { return this.repository.delete(1); }
+       unsafeReport() { return this.queryBuilder.getRawMany(); }
+     }`);
+    const result = (0, linter_rules_1.runLinter)(sandboxDir, {
+        backendPath: './backend', frontendPath: './frontend',
+        multiTenant: { enabled: true },
+        entities: [
+            { name: 'product', module: 'catalog', properties: [] },
+            { name: 'stock', module: 'inventory', properties: [] },
+        ],
+    });
+    teardownSandbox();
+    const rules = result.violations.map((violation) => violation.rule);
+    assert.ok(rules.includes('backend-module-isolation'));
+    assert.ok(rules.includes('backend-module-ownership'));
+    assert.ok(rules.includes('require-soft-delete'));
+    assert.ok(rules.includes('require-tenant-scope'));
+    assert.ok(rules.includes('force-pagination-in-backend'));
+});
+(0, node_test_1.test)('runLinter accepts generated module boundaries and scoped soft-delete repositories', () => {
+    setupSandbox();
+    const repositoryDir = path.join(sandboxDir, 'backend/src/modules/catalog/product/infrastructure/persistence/typeorm');
+    fs.ensureDirSync(repositoryDir);
+    fs.writeFileSync(path.join(repositoryDir, 'product.repository.ts'), `import { Injectable } from '@nestjs/common';
+     @Injectable()
+     export class ProductRepository extends BaseRepository<any> {
+       constructor() { super(repository, { scope: () => ({ tenantId: executionContext.requireTenantId() }) }); }
+     }`);
+    const result = (0, linter_rules_1.runLinter)(sandboxDir, {
+        backendPath: './backend', frontendPath: './frontend',
+        multiTenant: { enabled: true },
+        entities: [{ name: 'product', module: 'catalog', properties: [] }],
+    });
+    teardownSandbox();
+    assert.equal(result.violations.filter((violation) => [
+        'backend-module-isolation', 'backend-module-ownership', 'require-soft-delete', 'require-tenant-scope',
+    ].includes(violation.rule)).length, 0);
+});
+(0, node_test_1.test)('runLinter audits repository adapters and accepts delegation to the safe base delete', () => {
+    setupSandbox();
+    const repositoryDir = path.join(sandboxDir, 'backend/src/modules/catalog/product/infrastructure/persistence/typeorm');
+    fs.ensureDirSync(repositoryDir);
+    const repositoryPath = path.join(repositoryDir, 'product.repository.adapter.ts');
+    fs.writeFileSync(repositoryPath, `
+    export class ProductRepositoryAdapter extends BaseRepository<any> {
+      unbounded() { return this.repository.find(); }
+      delete(id: number) { return super.delete(id); }
+    }
+  `);
+    const result = (0, linter_rules_1.runLinter)(sandboxDir, {
+        backendPath: './backend', frontendPath: './frontend',
+        entities: [{ name: 'product', module: 'catalog', properties: [] }],
+    });
+    teardownSandbox();
+    assert.ok(result.violations.some((violation) => violation.rule === 'force-pagination-in-backend' && violation.file.endsWith('product.repository.adapter.ts')));
+    assert.equal(result.violations.filter((violation) => violation.rule === 'require-soft-delete').length, 0);
+});
+(0, node_test_1.test)('runLinter allows a custom webhook input adapter without treating it as CRUD', () => {
+    setupSandbox();
+    const webhookDir = path.join(sandboxDir, 'backend/src/modules/billing/payments/api/webhooks');
+    fs.ensureDirSync(webhookDir);
+    fs.writeFileSync(path.join(webhookDir, 'provider-payment.webhook.controller.ts'), `
+    import { Controller, Post } from '@nestjs/common';
+    @Controller('webhooks/provider-payment')
+    export class ProviderPaymentWebhookController {
+      @Post() receive() { return processor.process(request); }
+    }
+  `);
+    const result = (0, linter_rules_1.runLinter)(sandboxDir, { backendPath: './backend', frontendPath: './frontend' });
+    teardownSandbox();
+    assert.equal(result.violations.filter((violation) => violation.file.endsWith('provider-payment.webhook.controller.ts')
+        && violation.rule === 'use-standard-devkit-queries').length, 0);
+});
+(0, node_test_1.test)('runLinter requires DeleteDateColumn on every persistent entity', () => {
+    setupSandbox();
+    const entityDir = path.join(sandboxDir, 'backend/src/modules/catalog/product/infrastructure/persistence/typeorm');
+    fs.ensureDirSync(entityDir);
+    fs.writeFileSync(path.join(entityDir, 'product.orm-entity.ts'), `
+    import { Entity, PrimaryGeneratedColumn } from 'typeorm';
+    @Entity('products')
+    export class ProductOrmEntity { @PrimaryGeneratedColumn() id!: number; }
+  `);
+    const result = (0, linter_rules_1.runLinter)(sandboxDir, {
+        backendPath: './backend', frontendPath: './frontend',
+        entities: [{ name: 'product', module: 'catalog', properties: [] }],
+    });
+    teardownSandbox();
+    assert.equal(result.violations.filter((violation) => violation.rule === 'require-soft-delete').length, 1);
+    assert.match(result.violations.find((violation) => violation.rule === 'require-soft-delete').message, /DeleteDateColumn/);
+});
+(0, node_test_1.test)('runLinter requires a stateless module-routing gateway in microservice mode', () => {
+    setupSandbox();
+    const gatewayModule = path.join(sandboxDir, 'backend/api-gateway/src');
+    const serviceRoot = path.join(sandboxDir, 'backend/apps/catalog-service/src');
+    fs.ensureDirSync(path.join(gatewayModule, 'modules/catalog/product'));
+    fs.ensureDirSync(serviceRoot);
+    fs.writeFileSync(path.join(gatewayModule, 'app.module.ts'), `
+    import { TypeOrmModule } from '@nestjs/typeorm';
+    export class AppModule {}
+  `);
+    fs.writeFileSync(path.join(gatewayModule, 'modules/catalog/product/product.controller.ts'), `
+    import { ClientProxy } from '@nestjs/microservices';
+    export class ProductGatewayController {}
+  `);
+    fs.writeFileSync(path.join(serviceRoot, 'main.ts'), `NestFactory.createMicroservice(AppModule, { transport: Transport.TCP });`);
+    fs.writeFileSync(path.join(sandboxDir, 'docker-compose.yml'), 'DB_NAME: devstroupe_gateway_identity\n');
+    const result = (0, linter_rules_1.runLinter)(sandboxDir, {
+        backendType: 'microservices', backendPath: './backend', frontendPath: './frontend',
+    });
+    teardownSandbox();
+    assert.ok(result.violations.filter((violation) => violation.rule === 'backend-gateway-stateless').length >= 4);
+});

package/dist/templates/angular/service.template.d.ts

@@ -1 +1 @@
-export declare function angularServiceTemplate(name: string): string;
+export declare function angularServiceTemplate(name: string, moduleName?: string): string;