@ihelpee/prumo-plugin-node-next 0.0.0-stage → 0.8.3

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,114 @@
-# Temporary Holding Version
+# @ihelpee/prumo-plugin-node-next 🚦
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<p align="center">
+  <a href="https://www.npmjs.com/package/@ihelpee/prumo-plugin-node-next"><img src="https://img.shields.io/npm/v/@ihelpee/prumo-plugin-node-next?logo=npm&color=cb3837&label=npm" alt="npm version" /></a>
+  <a href="https://www.apache.org/licenses/LICENSE-2.0"><img src="https://img.shields.io/badge/license-Apache--2.0-blue?logo=apache&logoColor=white" alt="Apache 2.0 license" /></a>
+  <a href="https://github.com/ihelpee/prumo"><img src="https://img.shields.io/badge/telemetry-zero-brightgreen?logo=ghost&logoColor=white" alt="Zero telemetry" /></a>
+  <a href="https://nodejs.org/"><img src="https://img.shields.io/badge/node-%3E%3D20.11-339933?logo=node.js&logoColor=white" alt="Node >= 20.11" /></a>
+</p>
+
+> Official Next.js **App Router** architectural invariant plugin for [Prumo](https://www.npmjs.com/package/@ihelpee/prumo) — the deterministic gatekeeper and business guardrails for AI-assisted engineering.
+
+No App Router, a **Server Action é um endpoint HTTP público que se disfarça de função interna** e `"use client"` marca um **entry point de bundle**, não um arquivo. Um agente que gera código por IA escreve a action como se fosse uma chamada interna confiável; o compilador transforma cada `export` de `"use server"` num `POST` alcançável por qualquer um. Este plugin fiscaliza essa fronteira com AST estática pura — **sem boot do Next, sem `react`, sem `next build`**.
+
+## Invariantes
+
+| id | sev. | o footgun | fronteira honesta (o que NÃO pega) |
+|---|---|---|---|
+| `server-action-mutation-guarded` | error | Server Action / Route Handler de mutação escreve no banco sem re-verificar auth **no próprio corpo, antes da escrita** | leitura pura (`GET`); guard delegado a um DAL `server-only` que faz o auth dentro |
+| `client-boundary-leak-prevented` | error | o grafo do cliente (alcançável de um `"use client"`) importa ORM/cliente de banco, módulo de segredo ou lê `process.env` não-`NEXT_PUBLIC_` | módulo compartilhado sem ORM/segredo; `await import(nomeVariavel)` (limitação declarada) |
+| `server-action-input-validated` | error | Server Action muta estado sem validar input por schema (Zod/Valibot) **antes** do banco | schema valida **shape, não posse** — IDOR é checagem separada, nunca reportada como "seguro" |
+| `middleware-not-sole-auth` | error | autorização sustentada **só** por `middleware.ts`/`proxy.ts`, sem re-verificação nas actions/handlers | endpoints que re-verificam auth dentro do próprio corpo |
+| `next-public-env-not-secret` | error | `NEXT_PUBLIC_*` com nome de segredo (`KEY`/`SECRET`/`TOKEN`/`DATABASE_URL`/...) é inlined no bundle em build time | `NEXT_PUBLIC_*` genuinamente público (ex.: `NEXT_PUBLIC_SITE_URL`) |
+
+Compatível com **Next 14 / 15 / 16**: o extractor reconhece `middleware.ts` **e** `proxy.ts` (Next 16 renomeou middleware→proxy) como a mesma classe, e aceita `cookies()` e `await cookies()` (Next 15 assíncrono).
+
+## Instalação
+
+```bash
+pnpm add -D @ihelpee/prumo-plugin-node-next @ihelpee/prumo
+# ou
+npm install --save-dev @ihelpee/prumo-plugin-node-next @ihelpee/prumo
+```
+
+## Uso
+
+No `prumo.config.ts` do seu app Next:
+
+```ts
+import { defineConfig } from '@ihelpee/prumo';
+
+export default defineConfig({
+  layout: {
+    src: ['app', 'lib', 'middleware.ts', 'proxy.ts'],
+    oracle: ['test', 'oracle'],
+    invariants: ['.prumo/invariants'],
+    intent: ['.prumo/intent'],
+    waivers: ['.prumo/waivers'],
+  },
+});
+```
+
+Em `.prumo/invariants/rules.ts`, aplique o preset:
+
+```ts
+import { withWaivers } from '@ihelpee/prumo';
+import { nextPreset } from '@ihelpee/prumo-plugin-node-next';
+
+// Waiver estreito é dívida visível; largo é o gate desligado com nome bonito.
+export default withWaivers(nextPreset, '.prumo/waivers/legacy.json', [
+  'server-action-mutation-guarded',
+]);
+```
+
+Ou registre o plugin inteiro (extractor + regras) via contrato:
+
+```ts
+import next from '@ihelpee/prumo-plugin-node-next';
+// prumo plugin node-next  → mostra o catálogo e o snippet de config
+```
+
+Rode o gate:
+
+```bash
+npx prumo gate
+```
+
+## Exemplo — o achado que o teste unitário com mock nunca vê
+
+```ts
+// app/posts/[id]/page.tsx  (Server Component)
+export default async function PostPage({ params }) {
+  const { id } = await params;
+  async function deletePost(formData: FormData) {
+    'use server';                                   // ← vira POST público
+    const postId = String(formData.get('id'));
+    await db.post.delete({ where: { id: postId } }); // ← sem auth(), sem schema
+  }
+  return <form action={deletePost}>…</form>;
+}
+```
+
+O teste feliz ("logado → clica → 200") **confirma a crença do agente**. O gate nega:
+
+```
+server-action-mutation-guarded  app/posts/[id]/page.tsx:6 deletePost
+server-action-input-validated   app/posts/[id]/page.tsx:6 deletePost
+```
+
+## Oráculo: a action é um endpoint, não uma função
+
+Um teste que `import { deletePost } from '@/app/actions'` e a chama como JS **contorna o POST público** — é espelho, não oráculo, e o `oracle-isolation` do core o marca como tal (não conta para o OII). O oráculo canônico é o **teste negativo**: `POST` na action **sem cookie de sessão** deve falhar. Cookies forjados não valem como evidência.
+
+## Autor & Maintainer
+
+**Alex Gotardi**  
+- 📧 Email: [alexgotardi@gmail.com](mailto:alexgotardi@gmail.com)  
+- 🐙 GitHub: [@alexgotardi](https://github.com/alexgotardi)  
+- 💼 LinkedIn: [linkedin.com/in/alexgotardi](https://www.linkedin.com/in/alexgotardi/)
+
+## Corporate Ownership & License
+
+Copyright © 2026 **IHELPEE TECNOLOGIA LTDA** (<https://ihelpee.com>). Created and authored by [Alex Gotardi](https://github.com/alexgotardi).
+
+Licensed under the [Apache License, Version 2.0](https://github.com/ihelpee/prumo/blob/main/LICENSE). Free for commercial and private use; attribution and the [`NOTICE`](https://github.com/ihelpee/prumo/blob/main/NOTICE) file must be preserved. The **"Prumo"** name and logo are trademarks of IHELPEE TECNOLOGIA LTDA and are not licensed under Apache 2.0 — see [Brand Protection](https://github.com/ihelpee/prumo#-corporate-ownership-licensing--brand-protection).

package/dist/ast.d.ts

@@ -0,0 +1,68 @@
+import { Node, type SourceFile } from 'ts-morph';
+import { type ImportEdge } from '@ihelpee/prumo/invariants';
+/**
+ * AST Extractor do App Router — produz o `NextModel` canônico (spec
+ * `docs/especificacao-prumo-node-next.md` §1.5, shape congelado, version 1).
+ *
+ * O modelo é extraído uma única vez pelo motor (`needsData('next')`) e
+ * consumido pelas regras via `ctx.get<NextModel>('next')`. Estático,
+ * determinístico, sem boot de app: o gate nunca roda `next`/`react`.
+ */
+export interface NextModel {
+    version: 1;
+    files: NextFile[];
+    /** Arestas de import (do core) para BFS de fronteira de cliente. */
+    edges: ImportEdge[];
+    /** Existe proxy/middleware com lógica de auth (CA-4/CA-8). */
+    proxyHasAuth: boolean;
+}
+export interface NextFile {
+    path: string;
+    boundary: 'server' | 'client';
+    isRouteHandler: boolean;
+    isProxy: boolean;
+    routeHandlers: RouteHandlerInfo[];
+    serverActions: ServerActionInfo[];
+    serverComponents: string[];
+    envReads: EnvRead[];
+    importsServerOnly: boolean;
+    /** Import dinâmico/require de string literal que casa ORM_PACKAGES (tripwire §7). */
+    dynamicOrmImports: string[];
+}
+export interface RouteHandlerInfo {
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
+    handler: string;
+    line: number;
+    authCallLine: number | null;
+    mutationLine: number | null;
+    inputValidated: boolean;
+    /** Guard delegado: corpo chama módulo `server-only` que contém AUTH_CALLS (§7). */
+    delegatedGuard: boolean;
+}
+export interface ServerActionInfo {
+    name: string;
+    file: string;
+    line: number;
+    inline: boolean;
+    takesFormData: boolean;
+    authCallLine: number | null;
+    mutationLine: number | null;
+    inputValidated: boolean;
+    returnsRawRecord: boolean;
+    delegatedGuard: boolean;
+}
+export interface EnvRead {
+    name: string;
+    isPublic: boolean;
+    line: number;
+}
+export declare const AUTH_CALLS: Set<string>;
+export declare const ORM_PACKAGES: string[];
+export declare function fileDirective(sf: SourceFile): string | null;
+/** `"use server"` inline: directive prologue no corpo da própria função (§1.4). */
+export declare function bodyHasUseServer(fn: Node): boolean;
+export declare function isOrmSpecifier(spec: string): boolean;
+export declare function extractNextFile(root: string, sf: SourceFile, delegatedModuleFiles: Set<string>, resolveSymbolFile: (name: string) => string | null): NextFile;
+export declare function extractNextModel(root: string, sourceFiles: SourceFile[]): NextModel;
+export declare function relOf(root: string, sf: SourceFile): string;
+//# sourceMappingURL=ast.d.ts.map

package/dist/ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../src/ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmC,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAElF,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5E;;;;;;;GAOG;AAEH,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,oEAAoE;IACpE,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,8DAA8D;IAC9D,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,qFAAqF;IACrF,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,mFAAmF;IACnF,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAMD,eAAO,MAAM,UAAU,aAQrB,CAAC;AAmBH,eAAO,MAAM,YAAY,UAexB,CAAC;AAkDF,wBAAgB,aAAa,CAAC,EAAE,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,IAAI,GAAG,OAAO,CASlD;AA0HD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,QAAQ,CA0H7J;AAMD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,SAAS,CAsDnF;AAwBD,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,GAAG,MAAM,CAI1D"}

package/dist/ast.js

@@ -0,0 +1,418 @@
+import { Node, SyntaxKind } from 'ts-morph';
+import { norm } from '@ihelpee/prumo/core';
+import { extractImports } from '@ihelpee/prumo/invariants';
+// ---------------------------------------------------------------------------
+// Vocabulários determinísticos (spec §1.5) — listas nomeadas, não regex solto.
+// ---------------------------------------------------------------------------
+export const AUTH_CALLS = new Set([
+    'auth',
+    'getSession',
+    'verifySession',
+    'requireUser',
+    'currentUser',
+    'getServerSession',
+    'verifyToken',
+]);
+const DB_WRITE_METHODS = new Set([
+    'create',
+    'createMany',
+    'update',
+    'updateMany',
+    'upsert',
+    'delete',
+    'deleteMany',
+    'insert',
+    'save',
+    'remove',
+]);
+const DB_WRITE_PREFIX = /^(create|update|delete|insert|upsert|save|remove|mutate|write)([A-Z]|Many$)/;
+const VALIDATOR_METHODS = new Set(['parse', 'safeParse', 'decode', 'assert']);
+export const ORM_PACKAGES = [
+    '@prisma/client',
+    '@prisma/adapter-',
+    'drizzle-orm',
+    'drizzle-kit',
+    'pg',
+    'mysql2',
+    'mariadb',
+    'sqlite3',
+    'better-sqlite3',
+    'mongoose',
+    'knex',
+    '@neondatabase/serverless',
+    '@planetscale/database',
+    'mongodb',
+];
+const SECRET_MODULE_HINT = /(secret|credential|private[-_]?key|secrets?|vault|kms)(\/|$|\.)/;
+const HTTP_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']);
+const SERVER_COMPONENT_NAMES = new Set([
+    'page',
+    'layout',
+    'template',
+    'error',
+    'global-error',
+    'loading',
+    'not-found',
+    'default',
+    'sitemap',
+    'robots',
+]);
+// ---------------------------------------------------------------------------
+// Directive prologue (spec §1.4, CA-6, TypeScript issue #64033)
+// ---------------------------------------------------------------------------
+/**
+ * Lê o Directive Prologue real do arquivo (spec §1.4, CA-6, TS issue #64033):
+ * sequência inicial CONTÍGUA de `ExpressionStatement` cujo `expression` é
+ * `StringLiteral`/`NoSubstitutionTemplateLiteral`, parando no primeiro
+ * statement que não é directive. Consequências canônicas:
+ *
+ *  - comentários (`//`, `/* *\/`) são trivia: tolerados;
+ *  - `"use strict"` acima da diretiva é directive válida: tolerada;
+ *  - `import type` / `type X = ...` TERMINAM o prologue: um `"use client"`
+ *    depois deles NÃO é diretiva efetiva (caso #64033);
+ *  - zero regex/substring sobre o texto (proibido pela spec).
+ */
+function readPrologue(statements) {
+    for (const st of statements) {
+        if (Node.isExpressionStatement(st)) {
+            const expr = st.getExpression();
+            if (Node.isStringLiteral(expr) || Node.isNoSubstitutionTemplateLiteral(expr)) {
+                const text = expr.getLiteralText();
+                if (text === 'use client' || text === 'use server')
+                    return text;
+                if (text === 'use strict')
+                    continue;
+            }
+        }
+        return null;
+    }
+    return null;
+}
+export function fileDirective(sf) {
+    return readPrologue(sf.getStatements());
+}
+/** `"use server"` inline: directive prologue no corpo da própria função (§1.4). */
+export function bodyHasUseServer(fn) {
+    const body = (Node.isFunctionDeclaration(fn) || Node.isFunctionExpression(fn) || Node.isMethodDeclaration(fn)) && fn.getBody()
+        ? fn.getBody()
+        : Node.isArrowFunction(fn)
+            ? fn.getBody()
+            : null;
+    if (!body || !Node.isBlock(body))
+        return false;
+    return readPrologue(body.getStatements()) === 'use server';
+}
+// ---------------------------------------------------------------------------
+// Heurísticas de corpo (auth / mutação / validação)
+// ---------------------------------------------------------------------------
+function calleeName(call) {
+    const expr = call.getExpression();
+    if (Node.isIdentifier(expr))
+        return expr.getText();
+    if (Node.isPropertyAccessExpression(expr))
+        return expr.getName();
+    return '';
+}
+function isAuthCall(call, fileImportsNextHeaders) {
+    const name = calleeName(call);
+    if (AUTH_CALLS.has(name))
+        return true;
+    if (fileImportsNextHeaders && (name === 'cookies' || name === 'headers'))
+        return true;
+    return false;
+}
+function isMutationCall(call) {
+    const name = calleeName(call);
+    if (!name)
+        return false;
+    if (AUTH_CALLS.has(name))
+        return false;
+    if (DB_WRITE_METHODS.has(name))
+        return true;
+    return DB_WRITE_PREFIX.test(name);
+}
+function isSchemaValidatorCall(call) {
+    const expr = call.getExpression();
+    if (!Node.isPropertyAccessExpression(expr))
+        return false;
+    const method = expr.getName();
+    if (!VALIDATOR_METHODS.has(method))
+        return false;
+    const obj = expr.getExpression();
+    const objText = Node.isIdentifier(obj) ? obj.getText() : obj.getText().slice(0, 40);
+    return /^(z|v)$/.test(objText) || /[Ss]chema/.test(objText);
+}
+function analyzeBody(fn, fileImportsNextHeaders, delegatedModuleFiles, resolveSymbolFile) {
+    const out = {
+        authCallLine: null,
+        mutationLine: null,
+        validatorLine: null,
+        callsDelegatedGuard: false,
+        returnsRawRecord: false,
+    };
+    const calls = fn.getDescendantsOfKind(SyntaxKind.CallExpression);
+    for (const call of calls) {
+        const line = call.getStartLineNumber();
+        if (out.authCallLine === null && isAuthCall(call, fileImportsNextHeaders)) {
+            out.authCallLine = line;
+        }
+        if (out.mutationLine === null && isMutationCall(call)) {
+            out.mutationLine = line;
+        }
+        if (out.validatorLine === null && isSchemaValidatorCall(call)) {
+            out.validatorLine = line;
+        }
+        if (!out.callsDelegatedGuard) {
+            const name = calleeName(call);
+            if (name) {
+                const file = resolveSymbolFile(name);
+                if (file && delegatedModuleFiles.has(file))
+                    out.callsDelegatedGuard = true;
+            }
+        }
+    }
+    // Heurística de retorno cru: `return db.post.delete(...)` sem shape próprio.
+    for (const ret of fn.getDescendantsOfKind(SyntaxKind.ReturnStatement)) {
+        const expr = ret.getExpression();
+        if (expr && Node.isCallExpression(expr) && isMutationCall(expr)) {
+            out.returnsRawRecord = true;
+            break;
+        }
+    }
+    return out;
+}
+function takesFormData(fn) {
+    if (!Node.isFunctionDeclaration(fn) && !Node.isFunctionExpression(fn) && !Node.isArrowFunction(fn)) {
+        return false;
+    }
+    for (const param of fn.getParameters()) {
+        const typeText = param.getTypeNode()?.getText() ?? '';
+        if (/FormData|Promise<FormData>/.test(typeText))
+            return true;
+    }
+    // Parâmetro sem anotação em Server Action = entrada arbitrária não tipada.
+    const params = fn.getParameters();
+    return params.length > 0 && params.every((p) => !p.getTypeNode());
+}
+// ---------------------------------------------------------------------------
+// Extração por arquivo
+// ---------------------------------------------------------------------------
+function baseName(p) {
+    const leaf = norm(p).split('/').pop() ?? '';
+    return leaf.replace(/\.(tsx|ts|mts|cts|jsx|js)$/, '');
+}
+function inAppDir(p) {
+    return /(^|\/)app\//.test(norm(p));
+}
+function isProxyPath(p) {
+    const n = norm(p);
+    const leaf = n.split('/').pop() ?? '';
+    return /^(middleware|proxy)\.(ts|tsx|js)$/.test(leaf);
+}
+export function isOrmSpecifier(spec) {
+    return ORM_PACKAGES.some((pkg) => spec === pkg || spec.startsWith(pkg));
+}
+export function extractNextFile(root, sf, delegatedModuleFiles, resolveSymbolFile) {
+    const path = norm(sf.getFilePath()).startsWith(norm(root))
+        ? norm(sf.getFilePath()).slice(norm(root).replace(/\/+$/, '').length + 1)
+        : norm(sf.getFilePath());
+    const directive = fileDirective(sf);
+    const boundary = directive === 'use client' ? 'client' : 'server';
+    const fileImportsNextHeaders = sf
+        .getImportDeclarations()
+        .some((imp) => imp.getModuleSpecifierValue() === 'next/headers');
+    const importsServerOnly = sf
+        .getImportDeclarations()
+        .some((imp) => /^server-only(-turbo)?$/.test(imp.getModuleSpecifierValue()));
+    const envReads = [];
+    for (const m of sf.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+        const text = m.getText();
+        const match = text.match(/^process\.env\.([A-Za-z0-9_]+)$/);
+        if (match?.[1]) {
+            envReads.push({ name: match[1], isPublic: match[1].startsWith('NEXT_PUBLIC_'), line: m.getStartLineNumber() });
+        }
+    }
+    const dynamicOrmImports = [];
+    const text = sf.getFullText();
+    const dynRe = /(?:require\(|import\()\s*['"]([^'"]+)['"]/g;
+    let dm;
+    while ((dm = dynRe.exec(text)) !== null) {
+        const spec = dm[1];
+        if (isOrmSpecifier(spec))
+            dynamicOrmImports.push(spec);
+    }
+    const serverComponents = [];
+    if (boundary === 'server' && inAppDir(path) && SERVER_COMPONENT_NAMES.has(baseName(path))) {
+        for (const fn of sf.getFunctions()) {
+            const n = fn.getName();
+            if (n && (n === 'default' || SERVER_COMPONENT_NAMES.has(n)))
+                serverComponents.push(n);
+        }
+        if (sf.getDefaultExportSymbol())
+            serverComponents.push('default');
+    }
+    const routeHandlers = [];
+    const isRouteHandler = inAppDir(path) && baseName(path) === 'route';
+    if (isRouteHandler) {
+        for (const fn of sf.getFunctions()) {
+            const name = fn.getName();
+            if (!name || !HTTP_METHODS.has(name))
+                continue;
+            if (!fn.isExported())
+                continue;
+            const signals = analyzeBody(fn, fileImportsNextHeaders, delegatedModuleFiles, resolveSymbolFile);
+            routeHandlers.push({
+                method: name,
+                handler: name,
+                line: fn.getStartLineNumber(),
+                authCallLine: signals.authCallLine,
+                mutationLine: signals.mutationLine,
+                inputValidated: signals.mutationLine === null
+                    ? true
+                    : signals.validatorLine !== null && signals.validatorLine < signals.mutationLine,
+                delegatedGuard: signals.callsDelegatedGuard,
+            });
+        }
+    }
+    const serverActions = [];
+    const fileIsServerModule = directive === 'use server';
+    const pushAction = (fn, name, inline) => {
+        const signals = analyzeBody(fn, fileImportsNextHeaders, delegatedModuleFiles, resolveSymbolFile);
+        serverActions.push({
+            name,
+            file: path,
+            line: fn.getStartLineNumber(),
+            inline,
+            takesFormData: takesFormData(fn),
+            authCallLine: signals.authCallLine,
+            mutationLine: signals.mutationLine,
+            inputValidated: signals.mutationLine === null
+                ? true
+                : signals.validatorLine !== null && signals.validatorLine < signals.mutationLine,
+            returnsRawRecord: signals.returnsRawRecord,
+            delegatedGuard: signals.callsDelegatedGuard,
+        });
+    };
+    // Server Actions de arquivo: `export async function` num módulo `"use server"`.
+    for (const fn of sf.getFunctions()) {
+        if (fileIsServerModule && fn.isExported())
+            pushAction(fn, fn.getName() ?? '(anon)', false);
+    }
+    // Server Actions inline: `"use server"` no topo do CORPO da função (§1.4),
+    // inclusive funções aninhadas em Server Components (padrão `form action={}`).
+    const inlineSeen = new Set();
+    const inlineCandidates = [
+        ...sf.getDescendantsOfKind(SyntaxKind.FunctionDeclaration),
+        ...sf.getDescendantsOfKind(SyntaxKind.FunctionExpression),
+        ...sf.getDescendantsOfKind(SyntaxKind.ArrowFunction),
+    ];
+    for (const fn of inlineCandidates) {
+        if (inlineSeen.has(fn))
+            continue;
+        inlineSeen.add(fn);
+        if (!bodyHasUseServer(fn))
+            continue;
+        const name = Node.isFunctionDeclaration(fn)
+            ? (fn.getName() ?? '(anon)')
+            : Node.isFunctionExpression(fn)
+                ? (fn.getName() ?? '(anon)')
+                : (fn.getParent()?.getParent()?.asKind(SyntaxKind.VariableDeclaration)?.getName() ?? '(anon)');
+        pushAction(fn, name, true);
+    }
+    return {
+        path,
+        boundary,
+        isRouteHandler,
+        isProxy: isProxyPath(path),
+        routeHandlers,
+        serverActions,
+        serverComponents: [...new Set(serverComponents)],
+        envReads,
+        importsServerOnly,
+        dynamicOrmImports,
+    };
+}
+// ---------------------------------------------------------------------------
+// NextModel completo
+// ---------------------------------------------------------------------------
+export function extractNextModel(root, sourceFiles) {
+    // Módulo delegado (DAL): importa `server-only` E contém chamada de auth.
+    const delegatedModuleFiles = new Set();
+    const declaredByFile = new Map();
+    for (const sf of sourceFiles) {
+        const rel = relOf(root, sf);
+        const names = sf
+            .getFunctions()
+            .map((f) => f.getName())
+            .filter((n) => Boolean(n));
+        for (const cls of sf.getClasses()) {
+            const n = cls.getName();
+            if (n)
+                names.push(n);
+        }
+        declaredByFile.set(rel, names);
+    }
+    const fileByPath = new Map();
+    for (const sf of sourceFiles)
+        fileByPath.set(relOf(root, sf), sf);
+    const edges = sourceFiles
+        .flatMap((sf) => extractImports(sf, root))
+        .map((e) => ({ ...e, resolved: resolveToModelPath(e.resolved, fileByPath) }));
+    for (const sf of sourceFiles) {
+        const rel = relOf(root, sf);
+        const importsServerOnly = sf
+            .getImportDeclarations()
+            .some((imp) => /^server-only(-turbo)?$/.test(imp.getModuleSpecifierValue()));
+        if (!importsServerOnly)
+            continue;
+        const text = sf.getFullText();
+        if ([...AUTH_CALLS].some((a) => new RegExp(`\\b${a}\\s*\\(`).test(text))) {
+            delegatedModuleFiles.add(rel);
+        }
+    }
+    // Símbolo -> arquivo que o declara (para o guard delegado).
+    const symbolFile = new Map();
+    for (const [rel, names] of declaredByFile) {
+        for (const n of names)
+            if (!symbolFile.has(n))
+                symbolFile.set(n, rel);
+    }
+    const resolveSymbolFile = (name) => symbolFile.get(name) ?? null;
+    const modelFiles = sourceFiles.map((sf) => extractNextFile(root, sf, delegatedModuleFiles, resolveSymbolFile));
+    const proxyHasAuth = modelFiles.some((f) => {
+        if (!f.isProxy)
+            return false;
+        const sf = fileByPath.get(f.path);
+        if (!sf)
+            return false;
+        const text = sf.getFullText();
+        return [...AUTH_CALLS].some((a) => new RegExp(`\\b${a}\\s*\\(`).test(text)) || /\bcookies\s*\(/.test(text);
+    });
+    return { version: 1, files: modelFiles, edges, proxyHasAuth };
+}
+/**
+ * Normaliza o `resolved` de um ImportEdge para o caminho EXATO de um arquivo
+ * do modelo. O core resolve specifier relativo sem extensão (`../lib/db`);
+ * o BFS da fronteira precisa casar com `lib/db.ts`. Specifier externo
+ * (`@prisma/client`) passa sem mudança.
+ */
+function resolveToModelPath(resolved, fileByPath) {
+    const n = norm(resolved);
+    if (fileByPath.has(n))
+        return n;
+    for (const ext of ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx']) {
+        if (fileByPath.has(n + ext))
+            return n + ext;
+    }
+    for (const ext of ['.ts', '.tsx']) {
+        const idx = `${n}/index${ext}`;
+        if (fileByPath.has(idx))
+            return idx;
+    }
+    return n;
+}
+export function relOf(root, sf) {
+    const nRoot = norm(root).replace(/\/+$/, '');
+    const nAbs = norm(sf.getFilePath());
+    return nAbs.startsWith(nRoot + '/') ? nAbs.slice(nRoot.length + 1) : nAbs;
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './ast.js';
+export * from './rules.js';
+export { nextPlugin as default } from './rules.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export * from './ast.js';
+export * from './rules.js';
+export { nextPlugin as default } from './rules.js';

package/dist/rules.d.ts

@@ -0,0 +1,48 @@
+import { type RuleDef } from '@ihelpee/prumo/invariants';
+/**
+ * CA-1 — Server Action ou Route Handler de mutação que escreve no banco sem
+ * re-verificar sessão/autenticação ANTES da escrita. Auth depois da escrita é
+ * achado (ordem importa). Guard delegado (DAL `server-only` com auth) não é
+ * achado — fronteira honesta da heurística §7.
+ */
+export declare const serverActionMutationGuarded: RuleDef;
+/**
+ * CA-2 — O grafo do cliente (alcançável de um `"use client"`, direta ou
+ * transitivamente) importa ORM/cliente de banco, módulo de segredo, ou lê
+ * `process.env` não-`NEXT_PUBLIC_`. Reporta a TRILHA para ser acionável.
+ *
+ * Não pega: módulo compartilhado sem ORM/segredo importado por client.
+ * Limitação declarada: `await import(nomeVariavel)` não resolve (tripwire só
+ * para string literal de ORM).
+ */
+export declare const clientBoundaryLeakPrevented: RuleDef;
+/**
+ * CA-3 — Server Action que muta estado sem validação estrutural de schema
+ * (Zod/Valibot) ANTES do acesso ao banco. Valida depois de mutar é achado.
+ *
+ * Fronteira crítica (spec §2.3): schema valida SHAPE, não posse. Este
+ * invariante NÃO cobre IDOR e não vende validação como autorização.
+ */
+export declare const serverActionInputValidated: RuleDef;
+/**
+ * CA-4 — Autorização sustentada exclusivamente por middleware/proxy. Se o
+ * proxy tem lógica de auth e alguma action/handler de mutação não tem auth
+ * próprio, o par é achado: proxy roda por matcher, nunca é ponto de
+ * enforcement (Next 16: middleware→proxy, ambos reconhecidos — CA-8).
+ */
+export declare const middlewareNotSoleAuth: RuleDef;
+/**
+ * CA-5 — `NEXT_PUBLIC_*` com nome de segredo. O prefixo inlina o valor
+ * literal no bundle em build time: não é lookup de runtime e não é
+ * rotacionável depois de publicado.
+ */
+export declare const nextPublicEnvNotSecret: RuleDef;
+/**
+ * O Plugin oficial do Next.js App Router para o Prumo.
+ *
+ * Analisa, nunca executa: zero dependência de `next`/`react`. Compat
+ * Next 14/15/16 (middleware.ts e proxy.ts; `cookies()` e `await cookies()`).
+ */
+export declare const nextPlugin: import("@ihelpee/prumo/invariants").PrumoPlugin;
+export declare const nextPreset: RuleDef[];
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,OAAO,EAGb,MAAM,2BAA2B,CAAC;AAsCnC;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,SAuB9B,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,SA6D9B,CAAC;AAKX;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,SAmB7B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,SAsBxB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,SAoBzB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,UAAU,iDAerB,CAAC;AAEH,eAAO,MAAM,UAAU,EAAE,OAAO,EAAqB,CAAC"}

package/dist/rules.js

@@ -0,0 +1,238 @@
+import { rule, definePlugin, } from '@ihelpee/prumo/invariants';
+import { extractNextModel, isOrmSpecifier, } from './ast.js';
+/**
+ * Invariantes do App Router (spec §2). Os cinco ids são canônicos e
+ * congelados: nenhum card filho pode renomeá-los sem voltar à especificação.
+ *
+ * Fronteiras honestas (Art. IV): cada regra declara o que NÃO pega.
+ */
+const MUTATING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+const SECRET_ENV_HINT = /(KEY|SECRET|TOKEN|PASSWORD|PASS|PRIVATE|DATABASE_URL|DB_|API_)/;
+function model(ctx) {
+    return (ctx.get('next') ?? { version: 1, files: [], edges: [], proxyHasAuth: false });
+}
+function endpoints(m) {
+    const out = [];
+    for (const file of m.files) {
+        for (const a of file.serverActions)
+            out.push({ kind: 'action', file, ep: a, method: 'POST' });
+        for (const r of file.routeHandlers)
+            out.push({ kind: 'route', file, ep: r, method: r.method });
+    }
+    return out;
+}
+/**
+ * CA-1 — Server Action ou Route Handler de mutação que escreve no banco sem
+ * re-verificar sessão/autenticação ANTES da escrita. Auth depois da escrita é
+ * achado (ordem importa). Guard delegado (DAL `server-only` com auth) não é
+ * achado — fronteira honesta da heurística §7.
+ */
+export const serverActionMutationGuarded = rule('server-action-mutation-guarded')
+    .needsData('next')
+    .message('Server Action/Route Handler de mutação escreve no banco sem re-verificar auth no próprio corpo antes da escrita (a action é um endpoint HTTP público; gate de página não se propaga)')
+    .assert((ctx) => {
+    const m = model(ctx);
+    const out = [];
+    for (const { kind, file, ep, method } of endpoints(m)) {
+        if (!MUTATING.has(method))
+            continue;
+        if (ep.mutationLine === null)
+            continue; // leitura pura: outro invariante (fora de escopo §8)
+        if (ep.delegatedGuard)
+            continue; // DAL faz o guard dentro (heurística §7)
+        const unguarded = ep.authCallLine === null || ep.authCallLine > ep.mutationLine;
+        if (!unguarded)
+            continue;
+        const label = kind === 'action' ? ep.name : ep.handler;
+        const order = ep.authCallLine !== null ? ' (auth DEPOIS da escrita)' : '';
+        out.push({
+            target: `${file.path}:${ep.line} ${label}${order}`,
+            location: `${file.path}:${ep.line}`,
+        });
+    }
+    return out;
+})
+    .build();
+/**
+ * CA-2 — O grafo do cliente (alcançável de um `"use client"`, direta ou
+ * transitivamente) importa ORM/cliente de banco, módulo de segredo, ou lê
+ * `process.env` não-`NEXT_PUBLIC_`. Reporta a TRILHA para ser acionável.
+ *
+ * Não pega: módulo compartilhado sem ORM/segredo importado por client.
+ * Limitação declarada: `await import(nomeVariavel)` não resolve (tripwire só
+ * para string literal de ORM).
+ */
+export const clientBoundaryLeakPrevented = rule('client-boundary-leak-prevented')
+    .needsData('next')
+    .message('"use client" é entry point de bundle: o grafo do cliente alcança ORM/segredo/env não-público que será enviado ao navegador')
+    .assert((ctx) => {
+    const m = model(ctx);
+    const byPath = new Map(m.files.map((f) => [f.path, f]));
+    const out = [];
+    const reported = new Set();
+    const adjacency = new Map();
+    for (const e of m.edges) {
+        const list = adjacency.get(e.from) ?? [];
+        list.push(e.resolved);
+        adjacency.set(e.from, list);
+    }
+    const leakOf = (f) => {
+        if (f.importsServerOnly)
+            return null; // protegido: o build falha, não o bundle
+        for (const e of m.edges) {
+            if (e.from !== f.path)
+                continue;
+            if (isOrmSpecifier(e.specifier))
+                return `importa ${e.specifier}`;
+        }
+        if (f.dynamicOrmImports.length > 0)
+            return `import dinâmico de ${f.dynamicOrmImports[0]}`;
+        for (const er of f.envReads) {
+            if (!er.isPublic)
+                return `lê process.env.${er.name} (não-NEXT_PUBLIC)`;
+        }
+        if (SECRET_MODULE_HINT_PATH(f.path))
+            return 'módulo de segredo/credencial';
+        return null;
+    };
+    for (const seed of m.files) {
+        if (seed.boundary !== 'client')
+            continue;
+        // BFS com trilha; reporta por par (seed, nó vazado) — cada entry point
+        // de cliente que alcança o segredo é uma violação própria.
+        const queue = [{ path: seed.path, trail: [seed.path] }];
+        const seen = new Set([seed.path]);
+        while (queue.length > 0) {
+            const cur = queue.shift();
+            const node = byPath.get(cur.path);
+            if (node) {
+                const leak = leakOf(node);
+                const key = `${seed.path}=>${node.path}`;
+                if (leak && !reported.has(key)) {
+                    reported.add(key);
+                    out.push({
+                        target: `${cur.trail.join(' → ')} (${leak})`,
+                        location: `${seed.path}`,
+                    });
+                }
+            }
+            for (const next of adjacency.get(cur.path) ?? []) {
+                if (seen.has(next))
+                    continue;
+                seen.add(next);
+                queue.push({ path: next, trail: [...cur.trail, next] });
+            }
+        }
+    }
+    return out;
+})
+    .build();
+const SECRET_MODULE_HINT_PATH = (p) => /(secret|credential|private[-_]?key|secrets?|vault|kms)(\/|\.)/.test(p.split('/').slice(-2).join('/'));
+/**
+ * CA-3 — Server Action que muta estado sem validação estrutural de schema
+ * (Zod/Valibot) ANTES do acesso ao banco. Valida depois de mutar é achado.
+ *
+ * Fronteira crítica (spec §2.3): schema valida SHAPE, não posse. Este
+ * invariante NÃO cobre IDOR e não vende validação como autorização.
+ */
+export const serverActionInputValidated = rule('server-action-input-validated')
+    .needsData('next')
+    .message('Server Action muta estado sem validar input por schema (Zod/Valibot) antes do banco; schema valida shape, não posse (IDOR é checagem separada)')
+    .assert((ctx) => {
+    const m = model(ctx);
+    const out = [];
+    for (const { kind, file, ep } of endpoints(m)) {
+        if (kind !== 'action')
+            continue;
+        if (ep.mutationLine === null)
+            continue;
+        if (ep.inputValidated)
+            continue;
+        out.push({
+            target: `${file.path}:${ep.line} ${ep.name}`,
+            location: `${file.path}:${ep.line}`,
+        });
+    }
+    return out;
+})
+    .build();
+/**
+ * CA-4 — Autorização sustentada exclusivamente por middleware/proxy. Se o
+ * proxy tem lógica de auth e alguma action/handler de mutação não tem auth
+ * próprio, o par é achado: proxy roda por matcher, nunca é ponto de
+ * enforcement (Next 16: middleware→proxy, ambos reconhecidos — CA-8).
+ */
+export const middlewareNotSoleAuth = rule('middleware-not-sole-auth')
+    .needsData('next')
+    .message('autorização apoiada só em middleware.ts/proxy.ts: Server Actions e Route Handlers invocados direto contornam o matcher; re-verifique dentro de cada endpoint')
+    .assert((ctx) => {
+    const m = model(ctx);
+    if (!m.proxyHasAuth)
+        return [];
+    const out = [];
+    for (const { kind, file, ep, method } of endpoints(m)) {
+        if (!MUTATING.has(method))
+            continue;
+        if (ep.mutationLine === null)
+            continue;
+        if (ep.authCallLine !== null && ep.authCallLine <= ep.mutationLine)
+            continue;
+        if (ep.delegatedGuard)
+            continue;
+        const label = kind === 'action' ? ep.name : ep.handler;
+        out.push({
+            target: `${file.path}:${ep.line} ${label} (proxy é o único guard)`,
+            location: `${file.path}:${ep.line}`,
+        });
+    }
+    return out;
+})
+    .build();
+/**
+ * CA-5 — `NEXT_PUBLIC_*` com nome de segredo. O prefixo inlina o valor
+ * literal no bundle em build time: não é lookup de runtime e não é
+ * rotacionável depois de publicado.
+ */
+export const nextPublicEnvNotSecret = rule('next-public-env-not-secret')
+    .needsData('next')
+    .message('NEXT_PUBLIC_* com nome de segredo é inlined no bundle do cliente em build time; use nome sem prefixo para valor não público')
+    .assert((ctx) => {
+    const m = model(ctx);
+    const out = [];
+    for (const file of m.files) {
+        for (const er of file.envReads) {
+            if (!er.isPublic)
+                continue;
+            if (!SECRET_ENV_HINT.test(er.name))
+                continue;
+            out.push({
+                target: `${file.path}:${er.line} process.env.${er.name}`,
+                location: `${file.path}:${er.line}`,
+            });
+        }
+    }
+    return out;
+})
+    .build();
+/**
+ * O Plugin oficial do Next.js App Router para o Prumo.
+ *
+ * Analisa, nunca executa: zero dependência de `next`/`react`. Compat
+ * Next 14/15/16 (middleware.ts e proxy.ts; `cookies()` e `await cookies()`).
+ */
+export const nextPlugin = definePlugin({
+    name: 'node-next',
+    version: '0.1.0',
+    description: 'Next.js App Router invariants: Server Action auth guards, client boundary leaks, input validation, proxy-not-sole-auth, NEXT_PUBLIC secret hygiene.',
+    extractors: {
+        next: (ctx) => extractNextModel(ctx.root, (ctx.sourceFiles ?? [])),
+    },
+    rules: [
+        serverActionMutationGuarded,
+        clientBoundaryLeakPrevented,
+        serverActionInputValidated,
+        middlewareNotSoleAuth,
+        nextPublicEnvNotSecret,
+    ],
+});
+export const nextPreset = nextPlugin.rules;

package/package.json

@@ -1,6 +1,37 @@
 {
   "name": "@ihelpee/prumo-plugin-node-next",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.8.3",
+  "type": "module",
+  "description": "Next.js App Router plugin for Prumo: Server Action guards, client boundary leaks, and input validation invariants.",
+  "author": "Alex Gotardi <alexgotardi@gmail.com> (https://github.com/alexgotardi)",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "package.json",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ihelpee/prumo.git"
+  },
+  "engines": {
+    "node": ">=20.11"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@ihelpee/prumo": "0.8.3",
+    "ts-morph": "^24.0.0"
+  }
 }