@oondemand/create-central-oon 0.7.4 → 0.7.8

package/examples/first-journey/backend/central.domain.json

@@ -0,0 +1,141 @@
+{
+  "schemaVersion": 1,
+  "name": "Primeira jornada",
+  "models": [
+    {
+      "name": "Ticket",
+      "singular": "ticket",
+      "basePath": "/tickets",
+      "crud": {
+        "enabled": true,
+        "permissions": {
+          "read": "tickets.read",
+          "write": "tickets.write"
+        }
+      },
+      "fields": {
+        "titulo": {
+          "kind": "string",
+          "required": true
+        },
+        "etapa": {
+          "kind": "enum",
+          "values": [
+            "Aberto",
+            "Concluido"
+          ],
+          "default": "Aberto"
+        }
+      }
+    },
+    {
+      "name": "Contrato",
+      "basePath": "/contratos",
+      "crud": {
+        "enabled": true,
+        "permissions": {
+          "read": "contratos.read",
+          "write": "contratos.write"
+        }
+      },
+      "fields": {
+        "titulo": {
+          "kind": "string",
+          "required": true,
+          "maxLength": 80
+        },
+        "quantidade": {
+          "kind": "number",
+          "required": true,
+          "min": 1
+        },
+        "valorUnitario": {
+          "kind": "currency",
+          "required": true,
+          "min": 0
+        },
+        "total": {
+          "kind": "currency",
+          "computed": {
+            "precision": 2,
+            "expression": {
+              "op": "multiply",
+              "args": [
+                {
+                  "field": "quantidade"
+                },
+                {
+                  "field": "valorUnitario"
+                }
+              ]
+            }
+          }
+        },
+        "pago": {
+          "kind": "currency",
+          "readonly": true,
+          "default": 0
+        },
+        "saldo": {
+          "kind": "currency",
+          "readonly": true,
+          "default": 0
+        },
+        "etapa": {
+          "kind": "enum",
+          "values": [
+            "Aberto",
+            "Fechado"
+          ],
+          "default": "Aberto"
+        }
+      },
+      "validations": [
+        {
+          "name": "limite-local",
+          "code": "TOTAL_EXCEDE_LIMITE",
+          "message": "O total da demonstração deve ser no máximo 1000.",
+          "field": "quantidade",
+          "assert": {
+            "op": "lte",
+            "args": [
+              {
+                "field": "total"
+              },
+              {
+                "value": 1000
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "name": "Parcela",
+      "basePath": "/parcelas",
+      "crud": {
+        "enabled": true,
+        "permissions": {
+          "read": "parcelas.read",
+          "write": "parcelas.write"
+        }
+      },
+      "fields": {
+        "contratoId": {
+          "kind": "ref",
+          "ref": "Contrato",
+          "required": true
+        },
+        "valor": {
+          "kind": "currency",
+          "required": true,
+          "min": 0.01
+        },
+        "tituloContrato": {
+          "kind": "string",
+          "readonly": true
+        }
+      }
+    }
+  ]
+}

package/examples/first-journey/backend/central.process.json

@@ -0,0 +1,105 @@
+{
+  "schemaVersion": 1,
+  "models": {
+    "Ticket": {
+      "workflow": {
+        "stageField": "etapa",
+        "initialStages": [
+          "Aberto"
+        ],
+        "defaultStage": "Aberto",
+        "transitions": [
+          {
+            "from": "Aberto",
+            "to": "Concluido"
+          }
+        ]
+      }
+    },
+    "Contrato": {
+      "workflow": {
+        "stageField": "etapa",
+        "initialStages": [
+          "Aberto"
+        ],
+        "defaultStage": "Aberto",
+        "transitions": [
+          {
+            "from": "Aberto",
+            "to": "Fechado"
+          }
+        ],
+        "lockedFieldsByStage": {
+          "Fechado": [
+            "titulo",
+            "quantidade",
+            "valorUnitario"
+          ]
+        }
+      },
+      "bindings": [
+        {
+          "field": "pago",
+          "kind": "aggregate",
+          "sourceModel": "Parcela",
+          "foreignField": "contratoId",
+          "operator": "sum",
+          "sourceField": "valor",
+          "default": 0
+        },
+        {
+          "field": "saldo",
+          "kind": "expression",
+          "precision": 2,
+          "expression": {
+            "op": "subtract",
+            "args": [
+              {
+                "field": "total"
+              },
+              {
+                "field": "pago"
+              }
+            ]
+          }
+        }
+      ],
+      "deleteProtection": [
+        {
+          "sourceModel": "Parcela",
+          "foreignField": "contratoId",
+          "message": "Existem parcelas vinculadas."
+        }
+      ]
+    },
+    "Parcela": {
+      "bindings": [
+        {
+          "field": "tituloContrato",
+          "kind": "lookup",
+          "sourceModel": "Contrato",
+          "localField": "contratoId",
+          "sourceField": "titulo",
+          "watchFields": [
+            "titulo"
+          ],
+          "recalculate": "async",
+          "default": ""
+        }
+      ],
+      "atomicInvariants": [
+        {
+          "name": "limite-parcelas",
+          "kind": "relatedSumLteParentField",
+          "parentModel": "Contrato",
+          "parentLocalField": "contratoId",
+          "sourceField": "valor",
+          "parentField": "total",
+          "tolerance": 0,
+          "code": "PARCELAS_ACIMA_TOTAL",
+          "message": "A soma das parcelas excede o total do contrato."
+        }
+      ]
+    }
+  }
+}

package/examples/first-journey/backend/emails/confirmacao.json

@@ -0,0 +1,12 @@
+{
+  "code": "confirmacao", "name": "Confirmação",
+  "subject": "Confirmação para {{nome}}",
+  "htmlContent": "<p>Olá, {{nome}}. Sua operação foi recebida.</p>",
+  "textContent": "Olá, {{nome}}. Sua operação foi recebida.",
+  "variablesSchema": {
+    "type": "object", "additionalProperties": false, "required": ["nome"],
+    "properties": { "nome": { "type": "string" } }
+  },
+  "locale": "pt-BR", "initialStatus": "active",
+  "attachmentsPolicy": { "allowed": false }
+}

package/examples/first-journey/backend/src/models/Documento.js

@@ -0,0 +1,9 @@
+const { defineModel, fields } = require("@oondemand/oon-core-back");
+defineModel({
+  name: "Documento", singular: "documento", basePath: "/documentos", scope: "tenant",
+  schema: {
+    titulo: fields.string({ required: true, label: "Título" }),
+    conteudo: fields.string({ required: true, label: "Conteúdo" }),
+  },
+  crud: { enabled: true, permissions: { read: "documentos.read", write: "documentos.write" } },
+});

package/examples/first-journey/backend/src/models/Pessoa.js

@@ -0,0 +1,6 @@
+const { defineModel, fields } = require("@oondemand/oon-core-back");
+module.exports = defineModel({
+  name: "Pessoa", singular: "pessoa", basePath: "/pessoas", scope: "tenant",
+  schema: { nome: fields.string({ required: true, label: "Nome" }) },
+  crud: { enabled: true, permissions: { read: "pessoas.read", write: "pessoas.write" } },
+});

package/examples/first-journey/backend/src/routes/integracao.js

@@ -0,0 +1,23 @@
+const { defineRoutes, GenericError } = require("@oondemand/oon-core-back");
+// The secret stays in the backend environment; no secret is accepted from the UI.
+defineRoutes("/integracao", (router) => {
+  router.private.post("/testar", { permission: "integracao.test", sensitiveBody: true }, async (req, res) => {
+    const url = process.env.INTEGRACAO_URL;
+    const token = process.env.INTEGRACAO_TOKEN;
+    if (!url || !token) throw new GenericError("Configure a integração no backend.", { statusCode: 409, code: "INTEGRATION_NOT_CONFIGURED" });
+    let target;
+    try { target = new URL(url); } catch { /* safe error below */ }
+    if (!target || target.protocol !== "https:" || target.username || target.password) {
+      throw new GenericError("Configure um endpoint HTTPS sem credenciais na URL.", { statusCode: 422, code: "INTEGRATION_URL_INVALID" });
+    }
+    let response;
+    try {
+      response = await fetch(target, { headers: { Authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(10000), redirect: "error" });
+    } catch {
+      throw new GenericError("Serviço externo indisponível.", { statusCode: 502, code: "INTEGRATION_TRANSPORT_ERROR" });
+    }
+    await response.body?.cancel();
+    if (!response.ok) throw new GenericError("Consulta recusada pelo serviço externo.", { statusCode: 502, code: "INTEGRATION_REMOTE_REJECTED", details: { remoteStatus: response.status } });
+    res.json({ message: "Consulta externa concluída." });
+  });
+});

package/examples/first-journey/backend/src/routes/jornada.js

@@ -0,0 +1,10 @@
+const { defineRoutes, GenericError } = require("@oondemand/oon-core-back");
+defineRoutes("/jornada", (router) => {
+  router.private.post("/saudar", { permission: "jornada.write" }, async (req, res) => {
+    const nome = req.body?.nome;
+    if (typeof nome !== "string" || !nome.trim() || nome.length > 80) {
+      throw new GenericError("Informe um nome com até 80 caracteres.", { statusCode: 422, code: "NAME_INVALID" });
+    }
+    res.json({ message: `Olá, ${nome.trim()}!` });
+  });
+});

package/examples/first-journey/backend/src/routes/recursos.js

@@ -0,0 +1,26 @@
+const { defineRoutes, mergeScopedFilter, capabilities } = require("@oondemand/oon-core-back");
+const pessoa = require("../models/Pessoa");
+
+defineRoutes("/recursos", router => {
+  router.private.get("/pessoas/contagem", { permission: "pessoas.read" }, async (req, res) => {
+    // Não propague filtros arbitrários, tenantId ou operadores recebidos do cliente.
+    const filter = mergeScopedFilter(pessoa, {}, req.accessContext);
+    res.json({ total: await pessoa.mongooseModel.countDocuments(filter) });
+  });
+  router.private.post("/pdf", { permission: "pdf.render", sensitiveBody: true }, async (req, res) => {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    req.once("aborted", abort);
+    res.once("close", abort);
+    try {
+      // HTML fixo: nenhum dado secreto ou conteúdo remoto nesta demonstração.
+      const pdf = await capabilities.pdf.render({ html: "<h1>Recursos nativos</h1>", format: "A4" }, {
+        ...req.accessContext, correlationId: req.correlationId, signal: controller.signal,
+      });
+      res.type("application/pdf").send(pdf);
+    } finally {
+      req.off("aborted", abort);
+      res.off("close", abort);
+    }
+  });
+});

package/examples/first-journey/backend/src/routes/segredos.js

@@ -0,0 +1,27 @@
+const { defineRoutes, capabilities, GenericError } = require("@oondemand/oon-core-back");
+const { randomUUID } = require("node:crypto");
+function options(req) {
+  if (!["omie", "secondary"].includes(req.params.name)) throw new GenericError("Nome inválido.", { statusCode: 422 });
+  return { name: req.params.name, context: req.accessContext, correlationId: randomUUID() };
+}
+defineRoutes("/segredos", router => {
+  router.private.get("/:name", { permission: "segredos.manage", sensitiveBody: true }, async (req, res) => res.json(await capabilities.secrets.status(options(req))));
+  router.private.put("/:name", { permission: "segredos.manage", sensitiveBody: true }, async (req, res) => {
+    const { appKey, appSecret, replace } = req.body || {};
+    if (typeof appKey !== "string" || typeof appSecret !== "string" || !appKey || !appSecret || appKey.length > 4096 || appSecret.length > 4096) throw new GenericError("Informe as duas credenciais.", { statusCode: 422 });
+    res.json(await capabilities.secrets.put({ ...options(req), value: { appKey, appSecret }, replace: replace === true }));
+  });
+  router.private.delete("/:name", { permission: "segredos.manage", sensitiveBody: true }, async (req, res) => res.json(await capabilities.secrets.remove(options(req))));
+  router.private.post("/:name/testar", { permission: "segredos.manage", sensitiveBody: true }, async (req, res) => {
+    // Endpoint controlled by backend configuration, never by request body.
+    let target;
+    try { target = new URL(process.env.INTEGRACAO_URL); } catch { /* sanitized below */ }
+    if (!target || target.protocol !== "https:" || target.username || target.password) throw new GenericError("Configure INTEGRACAO_URL HTTPS no backend.", { statusCode: 409 });
+    await capabilities.secrets.use(options(req), async credential => {
+      const response = await fetch(target, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(credential), redirect: "error", signal: AbortSignal.timeout(10000) });
+      await response.body?.cancel();
+      if (!response.ok) throw Error("remote rejected");
+    });
+    res.json({ message: "Credencial utilizada no backend." });
+  });
+});

package/examples/first-journey/backend/src/services/confirmacao.js

@@ -0,0 +1,11 @@
+const { capabilities } = require("@oondemand/oon-core-back");
+
+// Chame somente após autorizar a operação e resolver o destinatário no domínio.
+// Use uma chave estável do evento de negócio; accepted não significa entregue.
+async function enviarConfirmacao({ email, nome, eventId }, req) {
+  return capabilities.transactionalEmail.send({
+    templateCode: "confirmacao", to: email, variables: { nome },
+    idempotencyKey: eventId, correlationId: req.correlationId, maxAttempts: 5,
+  }, { ...req.accessContext });
+}
+module.exports = { enviarConfirmacao };

package/examples/first-journey/frontend/src/pages/JourneyPage.tsx

@@ -0,0 +1,32 @@
+import { useState } from "react";
+import { CoreCollection, CorePipeline, useOonApi } from "@oondemand/oon-core-front";
+
+export function JourneyPage() {
+  const { http } = useOonApi();
+  const [nome, setNome] = useState("");
+  const [message, setMessage] = useState("");
+  const [busy, setBusy] = useState(false);
+  async function send(path: string, body: object) {
+    setBusy(true);
+    setMessage("");
+    try { const response = await http.post(path, body); setMessage(response.data.message); }
+    catch (error: any) { setMessage(error?.response?.data?.message || "Não foi possível executar a ação."); }
+    finally { setBusy(false); }
+  }
+  return <main>
+    <h1>Primeira jornada</h1>
+    <p>Selecione o perfil admin no runtime local para executar. Viewer não possui as permissões destas operações.</p>
+    <section aria-label="Formulário privado">
+      <form onSubmit={(event) => { event.preventDefault(); void send("/jornada/saudar", { nome }); }}>
+        <label>Nome <input value={nome} maxLength={80} required onChange={event => setNome(event.target.value)} /></label>
+        <button disabled={busy} type="submit">Saudar</button>
+      </form>
+      <button disabled={busy} onClick={() => void send("/integracao/testar", {})}>Testar integração externa</button>
+      <p role="status">{message}</p>
+    </section>
+    <CoreCollection model="Pessoa" label="Pessoas" endpoint="/pessoas" />
+    <CorePipeline model="Ticket" label="Tickets" endpoint="/tickets" titleField="titulo" stageField="etapa"
+      create={{ enabled: true, defaultStage: "Aberto" }} defaultActions={{ workStatus: false }}
+      stages={[{ id: "Aberto", label: "Aberto" }, { id: "Concluido", label: "Concluído" }]} />
+  </main>;
+}

package/examples/first-journey/frontend/src/pages/NativeResourcesPage.tsx

@@ -0,0 +1,50 @@
+import { useState } from "react";
+import { CoreCollection, CoreDocument, CoreDashboard, useOonApi } from "@oondemand/oon-core-front";
+
+export function NativeResourcesPage() {
+  const { http } = useOonApi();
+  const [tab, setTab] = useState("contratos");
+  const [message, setMessage] = useState("");
+  const [busy, setBusy] = useState(false);
+  async function download() {
+    setBusy(true);
+    setMessage("");
+    try {
+      const response = await http.post("/recursos/pdf", {}, { responseType: "blob" });
+      const url = URL.createObjectURL(response.data);
+      const link = document.createElement("a");
+      link.href = url;
+      link.download = "recursos.pdf";
+      link.click();
+      setTimeout(() => URL.revokeObjectURL(url), 1000);
+      setMessage("PDF gerado.");
+    } catch (error: any) {
+      const data = error?.response?.data;
+      let detail = data;
+      if (data instanceof Blob) { try { detail = JSON.parse(await data.text()); } catch { detail = undefined; } }
+      setMessage(detail?.error?.message || detail?.message || "PDF indisponível neste ambiente.");
+    } finally { setBusy(false); }
+  }
+  return <main>
+    <h1>Recursos nativos</h1>
+    <p>Demonstração opcional em banco dedicado. Fórmulas, transições e limites são aplicados no backend.</p>
+    <label>Visualização <select value={tab} onChange={event => setTab(event.target.value)}>
+      <option value="contratos">Contratos</option><option value="parcelas">Parcelas</option>
+      <option value="documentos">Documentos</option><option value="indicadores">Indicadores</option>
+      <option value="pdf">PDF</option>
+    </select></label>
+    {tab === "contratos" && <CoreCollection model="Contrato" label="Contratos" endpoint="/contratos" />}
+    {tab === "parcelas" && <CoreCollection model="Parcela" label="Parcelas" endpoint="/parcelas" />}
+    {tab === "documentos" && <CoreDocument model="Documento" label="Documentos de texto" endpoint="/documentos" />}
+    {tab === "indicadores" && <CoreDashboard label="Contratos e parcelas" widgets={[
+      { id: "contratos", model: "Contrato", kind: "count", label: "Contratos" },
+      { id: "total", model: "Contrato", kind: "sum", field: "total", label: "Valor total" },
+      { id: "etapas", model: "Contrato", kind: "groupCount", groupBy: "etapa", label: "Por etapa" },
+    ]} />}
+    {tab === "pdf" && <section>
+      <p>Requer a capability de PDF resolvida. Sem ela, a operação apresenta indisponibilidade.</p>
+      <button disabled={busy} onClick={() => void download()}>Gerar PDF de demonstração</button>
+      <p role="status">{message}</p>
+    </section>}
+  </main>;
+}

package/examples/first-journey/frontend/src/pages/SecretsPage.tsx

@@ -0,0 +1,31 @@
+import { useState } from "react";
+import { useOonApi } from "@oondemand/oon-core-front";
+export function SecretsPage() {
+  const { http } = useOonApi();
+  const [name, setName] = useState("omie");
+  const [appKey, setKey] = useState("");
+  const [appSecret, setSecret] = useState("");
+  const [replace, setReplace] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [message, setMessage] = useState("");
+  async function act(action: string) {
+    setBusy(true); setMessage("");
+    try {
+      const url = `/segredos/${name}`;
+      const result = action === "save" ? await http.put(url, { appKey, appSecret, replace }) : action === "remove" ? await http.delete(url) : action === "use" ? await http.post(`${url}/testar`, {}) : await http.get(url);
+      setMessage(result.data.message || ({ absent: "Não cadastrado", available: "Disponível", reentry_required: "Recadastro necessário; confira o provisionamento antes de substituir." } as Record<string, string>)[result.data.state]);
+    } catch { setMessage("Operação recusada. Confira acesso, configuração e estado da credencial."); }
+    finally { setKey(""); setSecret(""); setReplace(false); setBusy(false); }
+  }
+  return <main><h1>Segredos</h1><p>Valores são utilizados apenas no backend e nunca são exibidos após o cadastro.</p>
+    <fieldset disabled={busy}><legend>Credencial</legend>
+      <label>Nome <select value={name} onChange={e => { setName(e.target.value); setKey(""); setSecret(""); setMessage(""); }}><option>omie</option><option>secondary</option></select></label>
+      <form onSubmit={e => { e.preventDefault(); void act("save"); }}>
+        <label>App Key <input type="password" autoComplete="off" value={appKey} required maxLength={4096} onChange={e => setKey(e.target.value)} /></label>
+        <label>App Secret <input type="password" autoComplete="new-password" value={appSecret} required maxLength={4096} onChange={e => setSecret(e.target.value)} /></label>
+        <label><input type="checkbox" checked={replace} onChange={e => setReplace(e.target.checked)} />Substituir explicitamente valor incompatível</label>
+        <button>Salvar</button>
+      </form>
+      <button onClick={() => void act("status")}>Consultar estado</button><button onClick={() => void act("use")}>Testar chamada externa</button><button onClick={() => void act("remove")}>Remover</button>
+    </fieldset><p role="status">{message}</p></main>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/create-central-oon",
-  "version": "0.7.4",
+  "version": "0.7.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",
@@ -23,7 +23,8 @@
     "templates",
     "schemas",
     "docs",
-    "README.md"
+    "README.md",
+    "examples"
   ],
   "scripts": {
     "test": "node --test"

package/schemas/central.app.schema.json

@@ -282,6 +282,18 @@
               }
             }
           }
+        },
+        "core.secrets": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "enabled"
+          ],
+          "properties": {
+            "enabled": {
+              "const": true
+            }
+          }
         }
       }
     }

package/src/doctor.js

@@ -0,0 +1,90 @@
+"use strict";
+const fs = require("node:fs");
+const path = require("node:path");
+const vm = require("node:vm");
+const { createRequire } = require("node:module");
+const { checkDocs, resolveCentralRoot } = require("./index");
+const { checkConformance, listFiles } = require("./conformance");
+
+// Read package metadata without importing/running consumer code.
+function installedPackage(root, name) {
+  const resolver = createRequire(path.join(root, "package.json"));
+  // The frontend exports only the import condition; require.resolve(name)
+  // would reject a correctly installed ESM-only package.
+  for (const directory of resolver.resolve.paths(name) || []) {
+    const file = path.join(directory, name, "package.json");
+    if (!fs.existsSync(file)) continue;
+    const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (pkg.name === name) return pkg;
+  }
+  throw new Error(`Pacote ${name} não encontrado.`);
+}
+function doctor({ cwd = process.cwd() } = {}) {
+  const root = resolveCentralRoot(cwd);
+  const issues = [];
+  const add = (code, file, message) => issues.push({ code, path: file, message });
+  const versions = {};
+  let backendType;
+  let workspaceLock;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+    if (pkg.workspaces) workspaceLock = JSON.parse(fs.readFileSync(path.join(root, "package-lock.json"), "utf8"));
+  } catch { /* diagnosed below */ }
+  for (const [directory, name] of [["", "@oondemand/create-central-oon"], ["backend", "@oondemand/oon-core-back"], ["frontend", "@oondemand/oon-core-front"]]) {
+    const file = path.join(directory, "package.json");
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(root, file), "utf8"));
+      if (directory === "backend") backendType = pkg.type;
+      const spec = pkg.dependencies?.[name] || pkg.devDependencies?.[name];
+      if (!spec) add("CORE_DEPENDENCY_MISSING", file, `Declare ${name}.`);
+      try { versions[name] = installedPackage(path.join(root, directory), name).version; }
+      catch { add("CORE_NOT_INSTALLED", file, `Instale ${name} com npm ci no diretório ${directory || "."}.`); }
+      const isWorkspace = Boolean(workspaceLock && (!directory || workspaceLock.packages?.[directory]));
+      const lockPath = isWorkspace ? "package-lock.json" : path.join(directory, "package-lock.json");
+      try {
+        const lock = isWorkspace ? workspaceLock : JSON.parse(fs.readFileSync(path.join(root, lockPath), "utf8"));
+        const lockedRoot = lock.packages?.[isWorkspace ? directory : ""];
+        if ((lockedRoot?.dependencies?.[name] || lockedRoot?.devDependencies?.[name]) !== spec) {
+          add("LOCK_SPEC_MISMATCH", lockPath, `Lockfile diverge de ${file}; atualize com npm install e versione ambos.`);
+        }
+        const locked = (isWorkspace && directory && lock.packages?.[`${directory}/node_modules/${name}`]) || lock.packages?.[`node_modules/${name}`];
+        if (!locked?.version || locked.version !== versions[name]) {
+          add("LOCK_VERSION_MISMATCH", lockPath, `Versão instalada de ${name} diverge do lockfile; execute npm ci.`);
+        }
+      } catch { add("LOCKFILE_REQUIRED", lockPath, "Gere um lockfile npm v2/v3 com npm install neste diretório."); }
+    } catch (error) { add("PACKAGE_INVALID", file, error.message); }
+  }
+  if (new Set(Object.values(versions)).size > 1) add("CORE_VERSION_MISMATCH", "package.json", "Alinhe backend, frontend e gerador na mesma release; consulte CORE_UPGRADE.md.");
+  const generatorVersion = require("../package.json").version;
+  if (versions["@oondemand/create-central-oon"] && versions["@oondemand/create-central-oon"] !== generatorVersion) {
+    add("DOCTOR_VERSION_MISMATCH", "package.json", "Execute o create-central-oon instalado no App, usando npm run check.");
+  }
+  try { checkDocs({ cwd: root, quiet: true }); } catch (error) { add("DOCS_OUTDATED", ".ooncore/manifest.json", error.message); }
+  try { issues.push(...checkConformance({ cwd: root }).issues); } catch (error) { add("COMPOSITION_INVALID", ".", error.message); }
+  try {
+    const core = createRequire(path.join(root, "backend/package.json"))("@oondemand/oon-core-back");
+    for (const [file, validate] of [["central.domain.json", core.validateDomainManifest], ["central.process.json", core.validateProcessManifest]]) {
+      const full = path.join(root, "backend", file);
+      if (!fs.existsSync(full)) continue;
+      try { validate(JSON.parse(fs.readFileSync(full, "utf8"))); }
+      catch (error) { add("DOMAIN_MANIFEST_INVALID", `backend/${file}`, error.message); }
+    }
+  } catch { /* missing Core is already reported */ }
+  const files = listFiles(root);
+  for (const file of files.filter(f => /^backend\/src\/(models|validations|triggers|routes|pipelines|documents|hooks)\//.test(f))) {
+    if (backendType === "module" && /\.js$/.test(file)) add("MODULE_NOT_DISCOVERED", file, "Backend type=module exige arquivos .cjs no autoload CommonJS.");
+    if (/\.(ts|mjs)$/.test(file)) add("MODULE_NOT_DISCOVERED", file, "O autoload aceita .js/.cjs. Compile para a estrutura backend/src antes de executar/publicar.");
+    if (/\.(js|cjs)$/.test(file)) {
+      const source = fs.readFileSync(path.join(root, file), "utf8");
+      for (const match of source.matchAll(/require\(\s*["'](\.[^"']*)["']\s*\)/g)) {
+        const target = path.resolve(root, path.dirname(file), match[1]);
+        const relative = path.relative(path.join(root, "backend"), target);
+        if (relative.startsWith("../") && target !== path.join(root, "central.app.json")) add("RUNTIME_ASSET_OUTSIDE_BACKEND", file, "Import relativo depende de arquivo fora de backend/, ausente na imagem. Consulte APP_PACKAGING.md.");
+      }
+      try { new vm.Script(`(function(require,module,exports,__filename,__dirname){\n${fs.readFileSync(path.join(root, file), "utf8")}\n})`, { filename: file }); }
+      catch { add("MODULE_SYNTAX_INVALID", file, "Módulo de autoload precisa ser CommonJS válido (.js/.cjs)."); }
+    }
+  }
+  return { ok: issues.length === 0, root, versions, issues, routes: { backendCwd: path.join(root, "backend"), publicPrefix: "/api", internalExample: "/integracao/testar", publicExample: "/api/integracao/testar", note: "O proxy existente remove /api. Não acrescente /api ao defineRoutes. Doctor é estático: prove a rota por HTTP autenticado." } };
+}
+module.exports = { doctor };