@ihelpee/prumo-plugin-node-nest 0.0.0-stage → 0.8.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alex Gotardi and Prumo contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,44 @@
-# Temporary Holding Version
+# @ihelpee/prumo-plugin-node-nest 📐
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> Official NestJS architectural invariant plugin for [Prumo](https://www.npmjs.com/package/@ihelpee/prumo).
+
+Provides static AST analysis rules and guardrails for NestJS codebases:
+- **`mutation-routes-guarded`**: Enforces authentication / authorization guards on mutation routes (`@Post`, `@Put`, `@Patch`, `@Delete`).
+- **`dto-has-validation`**: Verifies that DTO properties have class-validator decorators.
+- **`providers-exported-when-cross-module`**: Validates dependency injection exports across module boundaries.
+- **`no-cross-feature-import`**: Prevents architectural leakages between decoupled domain modules.
+- **`monetary-is-integer`**: Prevents floating-point rounding errors for financial/monetary entities.
+
+## Installation
+
+```bash
+pnpm add -D @ihelpee/prumo-plugin-node-nest @ihelpee/prumo
+# or
+npm install --save-dev @ihelpee/prumo-plugin-node-nest @ihelpee/prumo
+```
+
+## Usage
+
+In your `prumo.config.ts`:
+
+```typescript
+import { defineConfig } from '@ihelpee/prumo';
+import nestRules from '@ihelpee/prumo-plugin-node-nest';
+
+export default defineConfig({
+  invariants: [
+    ...nestRules,
+  ],
+});
+```
+
+## Author & Maintainer
+
+**Alex Gotardi**  
+- 📧 Email: [alexgotardi@gmail.com](mailto:alexgotardi@gmail.com)  
+- 🐙 GitHub: [@alexgotardi](https://github.com/alexgotardi)  
+- 💼 LinkedIn: [linkedin.com/in/alexgotardi](https://linkedin.com/in/alexgotardi)  
+
+## License
+
+MIT © Alex Gotardi and Prumo contributors.

package/dist/ast.d.ts

@@ -0,0 +1,45 @@
+import { type SourceFile } from 'ts-morph';
+export interface RouteInfo {
+    /** `POST /orders/:id/refund` */
+    id: string;
+    method: string;
+    path: string;
+    controller: string;
+    handler: string;
+    file: string;
+    line: number;
+    /** Guards declarados no handler. */
+    handlerGuards: string[];
+    /** Guards declarados na classe. */
+    classGuards: string[];
+    /** Guards globais registrados via APP_GUARD. */
+    globalGuards: string[];
+    isPublic: boolean;
+}
+export declare function extractRoutes(root: string, files: SourceFile[]): RouteInfo[];
+export declare function extractGlobalGuards(files: SourceFile[]): string[];
+export interface DtoProperty {
+    name: string;
+    type: string;
+    hasValidationDecorator: boolean;
+    decorators: string[];
+}
+export interface DtoInfo {
+    name: string;
+    file: string;
+    line: number;
+    properties: DtoProperty[];
+    usedInRoute: boolean;
+}
+export declare function extractDtos(root: string, files: SourceFile[]): DtoInfo[];
+export interface ModuleInfo {
+    file: string;
+    dir: string;
+    providers: string[];
+    exports: string[];
+    controllers: string[];
+    imports: string[];
+}
+export declare function extractModules(root: string, files: SourceFile[]): ModuleInfo[];
+export declare function extractInjectables(files: SourceFile[]): Set<string>;
+//# sourceMappingURL=ast.d.ts.map

package/dist/ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../src/ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAcvD,MAAM,WAAW,SAAS;IACxB,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,mCAAmC;IACnC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gDAAgD;IAChD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,SAAS,EAAE,CA6C5E;AAgBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAgBjE;AAeD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,WAAW,EAAE,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;CACtB;AAcD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAqCxE;AAyBD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAqB9E;AAYD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAUnE"}

package/dist/ast.js

@@ -0,0 +1,219 @@
+import { SyntaxKind } from 'ts-morph';
+import { relPath, decoratorsOf, hasDecorator } from '@ihelpee/prumo/invariants';
+const HTTP_METHODS = {
+    Get: 'GET',
+    Post: 'POST',
+    Put: 'PUT',
+    Patch: 'PATCH',
+    Delete: 'DELETE',
+    Head: 'HEAD',
+    Options: 'OPTIONS',
+    All: 'ALL',
+};
+export function extractRoutes(root, files) {
+    const globalGuards = extractGlobalGuards(files);
+    const routes = [];
+    for (const file of files) {
+        for (const cls of file.getClasses()) {
+            if (!hasDecorator(cls, 'Controller'))
+                continue;
+            const controllerDecorator = decoratorsOf(cls).find((d) => d.name === 'Controller');
+            const basePath = stripQuotes(controllerDecorator?.args[0] ?? '');
+            const classGuards = collectGuards(decoratorsOf(cls));
+            const classPublic = decoratorsOf(cls).some((d) => d.name === 'Public');
+            for (const method of cls.getMethods()) {
+                const decorators = decoratorsOf(method);
+                const http = decorators.find((d) => d.name in HTTP_METHODS);
+                if (!http)
+                    continue;
+                const verb = HTTP_METHODS[http.name];
+                const subPath = stripQuotes(http.args[0] ?? '');
+                const path = joinPath(basePath, subPath);
+                const handlerGuards = collectGuards(decorators);
+                routes.push({
+                    id: `${verb} ${path || '/'}`,
+                    method: verb,
+                    path: path || '/',
+                    controller: cls.getName() ?? '(anon)',
+                    handler: method.getName(),
+                    file: relPath(root, file),
+                    line: method.getStartLineNumber(),
+                    handlerGuards,
+                    classGuards,
+                    globalGuards,
+                    isPublic: decorators.some((d) => d.name === 'Public') ||
+                        classPublic ||
+                        handlerGuards.length === 0 && classGuards.length === 0 && globalGuards.length === 0
+                        ? decorators.some((d) => d.name === 'Public') || classPublic
+                        : false,
+                });
+            }
+        }
+    }
+    return routes;
+}
+function collectGuards(decorators) {
+    const guards = [];
+    for (const d of decorators) {
+        if (d.name !== 'UseGuards')
+            continue;
+        for (const arg of d.args) {
+            for (const g of arg.split(',')) {
+                const name = g.trim().replace(/\(.*$/, '').trim();
+                if (name)
+                    guards.push(name);
+            }
+        }
+    }
+    return guards;
+}
+export function extractGlobalGuards(files) {
+    const guards = [];
+    for (const file of files) {
+        const text = file.getFullText();
+        if (!text.includes('APP_GUARD'))
+            continue;
+        const re = /provide:\s*APP_GUARD\s*,?\s*useClass:\s*([A-Za-z0-9_]+)/g;
+        let m;
+        while ((m = re.exec(text)) !== null) {
+            if (m[1])
+                guards.push(m[1]);
+        }
+        const re2 = /useClass:\s*([A-Za-z0-9_]+)\s*,?\s*provide:\s*APP_GUARD/g;
+        while ((m = re2.exec(text)) !== null) {
+            if (m[1])
+                guards.push(m[1]);
+        }
+    }
+    return [...new Set(guards)];
+}
+function stripQuotes(s) {
+    return s.replace(/^['"`]/, '').replace(/['"`]$/, '');
+}
+function joinPath(base, sub) {
+    const b = base.replace(/^\/|\/$/g, '');
+    const s = sub.replace(/^\/|\/$/g, '');
+    if (!b && !s)
+        return '';
+    if (!b)
+        return s;
+    if (!s)
+        return b;
+    return `${b}/${s}`;
+}
+const VALIDATION_DECORATORS = new Set([
+    'IsString', 'IsNumber', 'IsInt', 'IsFloat', 'IsBoolean', 'IsOptional',
+    'IsEmail', 'IsUrl', 'IsUuid', 'IsEnum', 'IsArray', 'IsObject', 'IsDate',
+    'IsPositive', 'IsMinLength', 'IsMaxLength', 'Min', 'Max', 'Length',
+    'IsNotEmpty', 'IsIn', 'IsMongoId', 'IsPhoneNumber', 'IsBase64',
+    'IsString', 'IsBooleanString', 'IsNumberString', 'IsPositiveInt',
+    'IsNegative', 'IsGreaterThan', 'IsLessThan', 'ArrayNotEmpty',
+    'ArrayMinSize', 'ArrayMaxSize', 'ValidateBy', 'Validate', 'ValidateIf',
+    'IsDefined', 'IsNotEmptyObject', 'IsInstance', 'MinDate', 'MaxDate',
+    'IsAlpha', 'IsAlphanumeric', 'IsCreditCard', 'IsCurrency', 'IsJson',
+]);
+export function extractDtos(root, files) {
+    const bodyTypes = collectBodyTypes(files);
+    const dtos = [];
+    for (const file of files) {
+        for (const cls of file.getClasses()) {
+            const name = cls.getName();
+            if (!name)
+                continue;
+            if (!bodyTypes.has(name))
+                continue;
+            const properties = cls
+                .getProperties()
+                .filter((p) => !p.hasModifier(SyntaxKind.PrivateKeyword) &&
+                !p.hasModifier(SyntaxKind.ProtectedKeyword))
+                .map((p) => {
+                const decorators = p.getDecorators().map((d) => d.getName());
+                return {
+                    name: p.getName(),
+                    type: p.getType().getText(),
+                    hasValidationDecorator: decorators.some((d) => VALIDATION_DECORATORS.has(d)),
+                    decorators,
+                };
+            });
+            dtos.push({
+                name,
+                file: relPath(root, file),
+                line: cls.getStartLineNumber(),
+                properties,
+                usedInRoute: true,
+            });
+        }
+    }
+    return dtos;
+}
+function collectBodyTypes(files) {
+    const types = new Set();
+    for (const file of files) {
+        for (const cls of file.getClasses()) {
+            if (!hasDecorator(cls, 'Controller'))
+                continue;
+            for (const method of cls.getMethods()) {
+                for (const param of method.getParameters()) {
+                    const decorators = param.getDecorators().map((d) => d.getName());
+                    if (!decorators.includes('Body'))
+                        continue;
+                    const typeNode = param.getTypeNode()?.getText();
+                    if (!typeNode)
+                        continue;
+                    for (const t of typeNode.split(/[|&]/)) {
+                        const n = t.trim().replace(/<.*>$/, '').replace(/\[\]$/, '');
+                        if (n && /^[A-Z]/.test(n))
+                            types.add(n);
+                    }
+                }
+            }
+        }
+    }
+    return types;
+}
+export function extractModules(root, files) {
+    const out = [];
+    for (const file of files) {
+        for (const cls of file.getClasses()) {
+            const deco = cls.getDecorators().find((d) => d.getName() === 'Module');
+            if (!deco)
+                continue;
+            const arg = deco.getArguments()[0]?.getText();
+            if (!arg)
+                continue;
+            const file_ = relPath(root, file);
+            out.push({
+                file: file_,
+                dir: file_.split('/').slice(0, -1).join('/'),
+                providers: arrayProp(arg, 'providers'),
+                exports: arrayProp(arg, 'exports'),
+                controllers: arrayProp(arg, 'controllers'),
+                imports: arrayProp(arg, 'imports'),
+            });
+        }
+    }
+    return out;
+}
+function arrayProp(objText, key) {
+    const re = new RegExp(`${key}\\s*:\\s*\\[([\\s\\S]*?)\\]`, 'm');
+    const m = objText.match(re);
+    if (!m?.[1])
+        return [];
+    return m[1]
+        .split(',')
+        .map((s) => s.trim().replace(/\/\/.*$/, '').trim())
+        .filter((s) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(s));
+}
+export function extractInjectables(files) {
+    const out = new Set();
+    for (const file of files) {
+        for (const cls of file.getClasses()) {
+            const n = cls.getName();
+            if (!n)
+                continue;
+            if (cls.getDecorators().some((d) => d.getName() === 'Injectable'))
+                out.add(n);
+        }
+    }
+    return out;
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './ast.js';
+export * from './rules.js';
+export { nestPlugin as default } from './rules.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export * from './ast.js';
+export * from './rules.js';
+export { nestPlugin as default } from './rules.js';

package/dist/rules.d.ts

@@ -0,0 +1,24 @@
+import { type RuleDef } from '@ihelpee/prumo/invariants';
+/** Rota de mutação sem guard em nenhuma das três camadas. */
+export declare const mutationRoutesGuarded: RuleDef;
+/** DTO usado em @Body() sem decorator de validação do class-validator. */
+export declare const dtoHasValidation: RuleDef;
+/** Imports entre FEATURES (fronteiras de contexto). */
+export declare const noCrossFeatureImport: RuleDef;
+/** Provider usado fora do módulo que o declara, sem exports. */
+export declare const providersExportedWhenCrossModule: RuleDef;
+/** Valor monetário como float. */
+export declare const monetaryIsInteger: RuleDef;
+/** Guard referenciado que não existe como classe declarada. */
+export declare const guardsResolve: RuleDef;
+/** Família driftada: arquivos quase idênticos. */
+export declare const familyDrift: RuleDef;
+/**
+ * O Plugin oficial do NestJS para o Prumo.
+ *
+ * Implementa o contrato PrumoPlugin (estilo Cordis / DeepSeek harness),
+ * registrando extratores de AST NestJS sob demanda e seu preset de invariantes.
+ */
+export declare const nestPlugin: import("@ihelpee/prumo/invariants").PrumoPlugin;
+export declare const nestPreset: RuleDef[];
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,OAAO,EAA0C,MAAM,2BAA2B,CAAC;AAKrH,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,SAmBxB,CAAC;AAEX,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,SAgBnB,CAAC;AAcX,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,SAavB,CAAC;AAWX,gEAAgE;AAChE,eAAO,MAAM,gCAAgC,SAuCnC,CAAC;AAEX,kCAAkC;AAClC,eAAO,MAAM,iBAAiB,SASpB,CAAC;AAEX,+DAA+D;AAC/D,eAAO,MAAM,aAAa,SAgBhB,CAAC;AAEX,kDAAkD;AAClD,eAAO,MAAM,WAAW,SA4Cd,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,UAAU,iDAmBrB,CAAC;AAEH,eAAO,MAAM,UAAU,EAAE,OAAO,EAAqB,CAAC"}

package/dist/rules.js

@@ -0,0 +1,223 @@
+import { rule, definePlugin } from '@ihelpee/prumo/invariants';
+import { extractRoutes, extractDtos, extractModules, extractInjectables } from './ast.js';
+const MUTATING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+/** Rota de mutação sem guard em nenhuma das três camadas. */
+export const mutationRoutesGuarded = rule('mutation-routes-guarded')
+    .needsData('routes')
+    .message('rota de mutação sem guard (handler, classe e APP_GUARD ausentes)')
+    .assert((ctx) => {
+    const routes = (ctx.routes ?? ctx.data?.['routes'] ?? []);
+    return routes
+        .filter((r) => MUTATING.has(r.method))
+        .filter((r) => !r.isPublic)
+        .filter((r) => r.handlerGuards.length === 0 &&
+        r.classGuards.length === 0 &&
+        r.globalGuards.length === 0)
+        .map((r) => ({
+        target: `${r.id} (${r.controller}.${r.handler})`,
+        location: `${r.file}:${r.line}`,
+    }));
+})
+    .build();
+/** DTO usado em @Body() sem decorator de validação do class-validator. */
+export const dtoHasValidation = rule('dto-has-validation')
+    .needsData('dtos')
+    .message('DTO usado em @Body() sem class-validator: ValidationPipe whitelist stripa tudo')
+    .assert((ctx) => {
+    const dtos = (ctx.dtos ?? ctx.data?.['dtos'] ?? []);
+    const out = [];
+    for (const dto of dtos) {
+        const unvalidated = dto.properties.filter((p) => !p.hasValidationDecorator);
+        if (unvalidated.length === 0)
+            continue;
+        out.push({
+            target: `${dto.name}.${unvalidated.map((p) => p.name).join(', ')}`,
+            location: `${dto.file}:${dto.line}`,
+        });
+    }
+    return out;
+})
+    .build();
+const SHARED = new Set(['common', 'shared', 'core', 'config', 'database']);
+function featureOf(p) {
+    const parts = p.split('/');
+    const i = parts.indexOf('modules');
+    const base = i >= 0 ? i + 1 : parts[0] === 'src' ? 1 : -1;
+    if (base < 0 || !parts[base])
+        return null;
+    const name = parts[base];
+    if (SHARED.has(name))
+        return null;
+    return name;
+}
+/** Imports entre FEATURES (fronteiras de contexto). */
+export const noCrossFeatureImport = rule('no-cross-feature-import')
+    .needsData('imports')
+    .message('importação entre features (fronteira de contexto atravessada)')
+    .assert((ctx) => {
+    const out = [];
+    for (const edge of ctx.imports) {
+        const a = featureOf(edge.from);
+        const b = featureOf(edge.resolved);
+        if (!a || !b || a === b)
+            continue;
+        out.push({ target: `${edge.from} -> ${edge.resolved}` });
+    }
+    return out;
+})
+    .build();
+function fileDeclaring(ctx, sym) {
+    return ctx.declared.get(sym) ?? null;
+}
+function moduleOf(p) {
+    const dir = p.split('/').slice(0, -1).join('/');
+    return dir || null;
+}
+/** Provider usado fora do módulo que o declara, sem exports. */
+export const providersExportedWhenCrossModule = rule('providers-exported-when-cross-module')
+    .needsData('imports', 'modules', 'injectables')
+    .message('provider usado por módulo irmão sem estar em `exports` do módulo que o declara')
+    .assert((ctx) => {
+    const modules = (ctx.modules ?? ctx.data?.['modules'] ?? []);
+    const injectables = (ctx.injectables ?? ctx.data?.['injectables'] ?? new Set());
+    const out = [];
+    const declaringModule = new Map();
+    for (const mod of modules) {
+        for (const prov of mod.providers) {
+            const file = fileDeclaring(ctx, prov);
+            if (!file)
+                continue;
+            declaringModule.set(file, { file: mod.file, exports: mod.exports });
+        }
+    }
+    for (const edge of ctx.imports) {
+        const fromMod = moduleOf(edge.from);
+        const toMod = moduleOf(edge.resolved);
+        if (!fromMod || !toMod || fromMod === toMod)
+            continue;
+        for (const sym of edge.symbols) {
+            if (!injectables.has(sym))
+                continue;
+            const declFile = fileDeclaring(ctx, sym);
+            if (!declFile)
+                continue;
+            const owner = declaringModule.get(declFile);
+            if (!owner)
+                continue;
+            if (edge.from === owner.file)
+                continue;
+            if (owner.exports.includes(sym))
+                continue;
+            out.push({
+                target: `${sym} usado em ${edge.from} mas não exportado por ${owner.file}`,
+                location: edge.from,
+            });
+        }
+    }
+    return out;
+})
+    .build();
+/** Valor monetário como float. */
+export const monetaryIsInteger = rule('monetary-is-integer')
+    .severity('warn')
+    .needsData('contractFields')
+    .message('campo monetário tipado como number/float — use inteiro em centavos')
+    .assert((ctx) => ctx.contractFields
+    .filter((f) => /^(number|float|double|decimal)$/.test(f.type.toLowerCase()))
+    .map((f) => ({ target: `${f.parent}.${f.name}: ${f.type}` })))
+    .build();
+/** Guard referenciado que não existe como classe declarada. */
+export const guardsResolve = rule('guards-resolve')
+    .needsData('routes')
+    .message('@UseGuards referencia guard que não existe como classe declarada no projeto')
+    .assert((ctx) => {
+    const routes = (ctx.routes ?? ctx.data?.['routes'] ?? []);
+    const declared = ctx.declared;
+    const out = [];
+    for (const r of routes) {
+        for (const g of [...r.handlerGuards, ...r.classGuards]) {
+            if (g.startsWith('APP_'))
+                continue;
+            if (declared.has(g))
+                continue;
+            out.push({ target: `${r.id} -> @UseGuards(${g})`, location: `${r.file}:${r.line}` });
+        }
+    }
+    return out;
+})
+    .build();
+/** Família driftada: arquivos quase idênticos. */
+export const familyDrift = rule('family-drift')
+    .severity('warn')
+    .needsData('imports')
+    .message('arquivos quase identicos: familia driftada, o regime onde o agente deriva em vez de especificar')
+    .assert(async (ctx) => {
+    const { similarity } = await import('@ihelpee/prumo/core');
+    const { readFile } = await import('node:fs/promises');
+    const { resolve } = await import('node:path');
+    const byFamily = new Map();
+    for (const f of ctx.files) {
+        const m = f.match(/^src\/([^/]+)\//);
+        const fam = m?.[1];
+        if (!fam)
+            continue;
+        const list = byFamily.get(fam) ?? [];
+        list.push(f);
+        byFamily.set(fam, list);
+    }
+    const out = [];
+    for (const [fam, files] of byFamily) {
+        if (files.length < 2)
+            continue;
+        const cache = new Map();
+        const read = async (f) => {
+            if (!cache.has(f))
+                cache.set(f, await readFile(resolve(ctx.root, f), 'utf8'));
+            return cache.get(f);
+        };
+        for (let i = 0; i < files.length; i++) {
+            for (let j = i + 1; j < files.length; j++) {
+                const a = files[i];
+                const b = files[j];
+                if (!a || !b)
+                    continue;
+                const sim = similarity(await read(a), await read(b), 1);
+                if (sim >= 0.6) {
+                    out.push({
+                        target: `${fam}: ${a} ~ ${b} (${(sim * 100).toFixed(0)}% identicos)`,
+                        location: a,
+                    });
+                }
+            }
+        }
+    }
+    return out;
+})
+    .build();
+/**
+ * O Plugin oficial do NestJS para o Prumo.
+ *
+ * Implementa o contrato PrumoPlugin (estilo Cordis / DeepSeek harness),
+ * registrando extratores de AST NestJS sob demanda e seu preset de invariantes.
+ */
+export const nestPlugin = definePlugin({
+    name: 'nest',
+    version: '0.1.3',
+    description: 'NestJS framework invariants: route guards, DTO validation, and module DI exports.',
+    extractors: {
+        routes: (ctx) => extractRoutes(ctx.root, (ctx.sourceFiles ?? [])),
+        dtos: (ctx) => extractDtos(ctx.root, (ctx.sourceFiles ?? [])),
+        modules: (ctx) => extractModules(ctx.root, (ctx.sourceFiles ?? [])),
+        injectables: (ctx) => extractInjectables((ctx.sourceFiles ?? [])),
+    },
+    rules: [
+        mutationRoutesGuarded,
+        dtoHasValidation,
+        noCrossFeatureImport,
+        providersExportedWhenCrossModule,
+        monetaryIsInteger,
+        guardsResolve,
+        familyDrift,
+    ],
+});
+export const nestPreset = nestPlugin.rules;

package/package.json

@@ -1,6 +1,37 @@
 {
   "name": "@ihelpee/prumo-plugin-node-nest",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.8.3",
+  "type": "module",
+  "description": "NestJS plugin for Prumo: mutation route guards, DTO validation, and module DI invariants.",
+  "author": "Alex Gotardi <alexgotardi@gmail.com> (https://github.com/alexgotardi)",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "package.json",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ihelpee/prumo.git"
+  },
+  "engines": {
+    "node": ">=20.11"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@ihelpee/prumo": "0.8.3",
+    "ts-morph": "^24.0.0"
+  }
 }