rl-core-api 0.1.0

package/README.md

@@ -0,0 +1,99 @@
+# rl-core-api
+
+Base NestJS para não recomeçar todo projeto pelo login.
+
+Instala e o sistema já sobe com autenticação (2FA obrigatório por TOTP), RBAC,
+trilha de auditoria, notificações em WebSocket e listagens paginadas com filtro
+dinâmico. Você escreve só o domínio.
+
+```bash
+npm install rl-core-api
+```
+
+## Uso
+
+```ts
+// src/app.module.ts
+import { Module } from "@nestjs/common";
+import { RlCoreModule } from "rl-core-api";
+
+import { ContasModule } from "@/features/contas/contas.module";
+import { Conta } from "@/features/contas/infra/schema/conta.schema";
+
+@Module({
+  imports: [RlCoreModule.forRoot({ entities: [Conta] }), ContasModule],
+})
+export class AppModule {}
+```
+
+```ts
+// src/main.ts
+import { bootstrapCore } from "rl-core-api";
+
+import { AppModule } from "@/app.module";
+
+void bootstrapCore(AppModule, { title: "Controle Pessoal" });
+```
+
+```ts
+// src/data-source.ts — a CLI do TypeORM usa este arquivo
+import "dotenv/config";
+import { coreEntities, coreMigrations, createCoreDataSource } from "rl-core-api";
+
+import { CreateContas1790000000000 } from "@/migrations/1790000000000-CreateContas";
+import { Conta } from "@/features/contas/infra/schema/conta.schema";
+
+export const AppDataSource = createCoreDataSource({
+  entities: [...coreEntities, Conta],
+  migrations: [...coreMigrations, CreateContas1790000000000],
+});
+```
+
+`npm run migration:run` cria as tabelas do core e as suas, na ordem certa. As
+migrations do core vêm no pacote — você nunca copia nem reescreve nenhuma.
+
+## O que vem pronto
+
+| | |
+|---|---|
+| **Auth** | login, refresh por cookie httpOnly, 2FA obrigatório (TOTP + fallback por e-mail + códigos de backup), primeiro acesso, reset de senha, bloqueio por tentativas, expiração de senha |
+| **RBAC** | resources, actions, scopes, permissions, roles e groups, com guard por `resource:action:scope` |
+| **Auditoria** | trilha de alterações de dados, log de requisições e log de erros, com retenção configurável |
+| **Notificações** | WebSocket com handshake por cookie ou Bearer, escopo resolvido na leitura |
+| **Listagens** | paginação, ordenação e filtro dinâmico com catálogo por listagem (`$AND`/`$OR` aninhados, 17 operadores) |
+| **Infra** | config validada com Zod, mailer, agendador, rate-limit, CSRF, filtro global de exceções, logger Winston |
+
+## Configuração
+
+O pacote **não traz `.env`** — ele declara o que precisa e quebra no boot se
+faltar. Cada projeto tem os valores dele (banco próprio, segredo JWT próprio).
+Comece pelo `.env.example` do repositório.
+
+Para acrescentar variáveis suas, estenda o schema:
+
+```ts
+import { envSchema } from "rl-core-api";
+
+export const appEnvSchema = envSchema.extend({
+  FUNKO_API_KEY: z.string().min(1),
+});
+```
+
+## Peer dependencies
+
+`@nestjs/common`, `@nestjs/core`, `@nestjs/platform-express`, `@nestjs/swagger`,
+`@nestjs/typeorm`, `class-transformer`, `class-validator`, `reflect-metadata`,
+`rxjs`, `typeorm` e `zod` são peers: precisam ser uma instância só, ou a
+injeção de dependência e os decorators param de se enxergar. O npm 7+ instala
+sozinho.
+
+## Pacotes irmãos
+
+| | |
+|---|---|
+| [`rl-core-front`](https://www.npmjs.com/package/rl-core-front) | as telas em Next.js |
+| `rl_core_app` | o app Flutter, consumido por tag do git |
+
+## Licença
+
+MIT © Rodrigo Liberti

package/dist/app.module.d.ts

@@ -0,0 +1,2 @@
+export declare class AppModule {
+}

package/dist/app.module.js

@@ -0,0 +1,19 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppModule = void 0;
+const common_1 = require("@nestjs/common");
+const rlCore_module_1 = require("./rlCore.module");
+let AppModule = class AppModule {
+};
+exports.AppModule = AppModule;
+exports.AppModule = AppModule = __decorate([
+    (0, common_1.Module)({
+        imports: [rlCore_module_1.RlCoreModule.forRoot()],
+    })
+], AppModule);

package/dist/core/auth/authenticatedUser.interface.d.ts

@@ -0,0 +1,16 @@
+import { Request } from "express";
+export interface AuthenticatedUser {
+    id: string;
+    email: string;
+    name: string;
+    lastName?: string | null;
+    avatar?: string | null;
+    roles: string[];
+    permissions: string[];
+    twoFactorEnabled: boolean;
+    passwordExpired: boolean;
+    mustChangePassword: boolean;
+}
+export interface RequestWithUser extends Request {
+    user?: AuthenticatedUser;
+}

package/dist/core/auth/authenticatedUser.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/core/auth/cookie.util.d.ts

@@ -0,0 +1,9 @@
+import { Response } from "express";
+import { EnvService } from "../config/env.service";
+export declare const ACCESS_COOKIE = "access_token";
+export declare const REFRESH_COOKIE = "refresh_token";
+export declare function setAuthCookies(res: Response, env: EnvService, tokens: {
+    accessToken: string;
+    refreshToken: string;
+}): void;
+export declare function clearAuthCookies(res: Response, env: EnvService): void;

package/dist/core/auth/cookie.util.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFRESH_COOKIE = exports.ACCESS_COOKIE = void 0;
+exports.setAuthCookies = setAuthCookies;
+exports.clearAuthCookies = clearAuthCookies;
+exports.ACCESS_COOKIE = "access_token";
+exports.REFRESH_COOKIE = "refresh_token";
+function setAuthCookies(res, env, tokens) {
+    const secure = env.get("COOKIE_SECURE");
+    const domain = env.get("COOKIE_DOMAIN");
+    const common = {
+        httpOnly: true,
+        secure,
+        sameSite: "lax",
+        domain,
+        path: "/",
+    };
+    res.cookie(exports.ACCESS_COOKIE, tokens.accessToken, common);
+    res.cookie(exports.REFRESH_COOKIE, tokens.refreshToken, {
+        ...common,
+        maxAge: env.get("JWT_REFRESH_EXPIRES_MINUTES") * 60_000,
+    });
+}
+function clearAuthCookies(res, env) {
+    const domain = env.get("COOKIE_DOMAIN");
+    res.clearCookie(exports.ACCESS_COOKIE, { domain, path: "/" });
+    res.clearCookie(exports.REFRESH_COOKIE, { domain, path: "/" });
+}

package/dist/core/auth/decorators/currentUser.decorator.d.ts

@@ -0,0 +1,2 @@
+import { AuthenticatedUser } from "../authenticatedUser.interface";
+export declare const CurrentUser: (...dataOrPipes: (keyof AuthenticatedUser | import("@nestjs/common").PipeTransform<any, any> | import("@nestjs/common").Type<import("@nestjs/common").PipeTransform<any, any>> | undefined)[]) => ParameterDecorator;

package/dist/core/auth/decorators/currentUser.decorator.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentUser = void 0;
+const common_1 = require("@nestjs/common");
+exports.CurrentUser = (0, common_1.createParamDecorator)((data, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    const user = request.user;
+    return data ? user?.[data] : user;
+});

package/dist/core/auth/decorators/public.decorator.d.ts

@@ -0,0 +1,3 @@
+import { CustomDecorator } from "@nestjs/common";
+export declare const IS_PUBLIC_KEY = "isPublic";
+export declare const Public: () => CustomDecorator<string>;

package/dist/core/auth/decorators/public.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.IS_PUBLIC_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.IS_PUBLIC_KEY = "isPublic";
+const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_KEY, true);
+exports.Public = Public;

package/dist/core/auth/decorators/requirePermission.decorator.d.ts

@@ -0,0 +1,5 @@
+import { CustomDecorator } from "@nestjs/common";
+export declare const PERMISSIONS_KEY = "requiredPermissions";
+export declare const ANY_PERMISSIONS_KEY = "requiredAnyPermissions";
+export declare const RequirePermission: (...codes: string[]) => CustomDecorator<string>;
+export declare const RequireAnyPermission: (...codes: string[]) => CustomDecorator<string>;

package/dist/core/auth/decorators/requirePermission.decorator.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequireAnyPermission = exports.RequirePermission = exports.ANY_PERMISSIONS_KEY = exports.PERMISSIONS_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.PERMISSIONS_KEY = "requiredPermissions";
+exports.ANY_PERMISSIONS_KEY = "requiredAnyPermissions";
+const RequirePermission = (...codes) => (0, common_1.SetMetadata)(exports.PERMISSIONS_KEY, codes);
+exports.RequirePermission = RequirePermission;
+const RequireAnyPermission = (...codes) => (0, common_1.SetMetadata)(exports.ANY_PERMISSIONS_KEY, codes);
+exports.RequireAnyPermission = RequireAnyPermission;

package/dist/core/auth/guards/appThrottler.guard.d.ts

@@ -0,0 +1,5 @@
+import { ExecutionContext } from "@nestjs/common";
+import { ThrottlerGuard, ThrottlerLimitDetail } from "@nestjs/throttler";
+export declare class AppThrottlerGuard extends ThrottlerGuard {
+    protected throwThrottlingException(_context: ExecutionContext, _throttlerLimitDetail: ThrottlerLimitDetail): Promise<void>;
+}

package/dist/core/auth/guards/appThrottler.guard.js

@@ -0,0 +1,23 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppThrottlerGuard = void 0;
+const common_1 = require("@nestjs/common");
+const throttler_1 = require("@nestjs/throttler");
+const appErrorCode_enum_1 = require("../../filters/appErrorCode.enum");
+const codedError_util_1 = require("../../utils/codedError.util");
+const THROTTLE_MESSAGE = "Muitas tentativas em pouco tempo. Aguarde um instante e tente de novo";
+let AppThrottlerGuard = class AppThrottlerGuard extends throttler_1.ThrottlerGuard {
+    throwThrottlingException(_context, _throttlerLimitDetail) {
+        throw (0, codedError_util_1.codedTooManyRequests)(THROTTLE_MESSAGE, appErrorCode_enum_1.AppErrorCode.TOO_MANY_REQUESTS);
+    }
+};
+exports.AppThrottlerGuard = AppThrottlerGuard;
+exports.AppThrottlerGuard = AppThrottlerGuard = __decorate([
+    (0, common_1.Injectable)()
+], AppThrottlerGuard);

package/dist/core/auth/guards/csrf.guard.d.ts

@@ -0,0 +1,8 @@
+import { CanActivate, ExecutionContext } from "@nestjs/common";
+import { EnvService } from "../../config/env.service";
+export declare class CsrfGuard implements CanActivate {
+    private readonly env;
+    private readonly logger;
+    constructor(env: EnvService);
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/core/auth/guards/csrf.guard.js

@@ -0,0 +1,55 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var CsrfGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CsrfGuard = void 0;
+const common_1 = require("@nestjs/common");
+const env_service_1 = require("../../config/env.service");
+const MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+let CsrfGuard = CsrfGuard_1 = class CsrfGuard {
+    constructor(env) {
+        this.env = env;
+        this.logger = new common_1.Logger(CsrfGuard_1.name);
+    }
+    canActivate(context) {
+        const req = context.switchToHttp().getRequest();
+        if (!MUTATING.has(req.method)) {
+            return true;
+        }
+        const hasSessionCookie = !!req.cookies?.access_token || !!req.cookies?.refresh_token;
+        if (!hasSessionCookie) {
+            return true;
+        }
+        const allowed = this.env
+            .get("CORS_ORIGIN")
+            .split(",")
+            .map((o) => o.trim());
+        let origin = req.headers.origin ?? null;
+        if (!origin && req.headers.referer) {
+            try {
+                origin = new URL(req.headers.referer).origin;
+            }
+            catch (err) {
+                this.logger.warn(`Referer inválido: ${req.headers.referer} (${err.message})`);
+                origin = null;
+            }
+        }
+        if (origin && allowed.includes(origin)) {
+            return true;
+        }
+        throw new common_1.ForbiddenException("Origem não permitida (proteção CSRF)");
+    }
+};
+exports.CsrfGuard = CsrfGuard;
+exports.CsrfGuard = CsrfGuard = CsrfGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [env_service_1.EnvService])
+], CsrfGuard);

package/dist/core/auth/guards/jwtAuth.guard.d.ts

@@ -0,0 +1,10 @@
+import { ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { Observable } from "rxjs";
+declare const JwtAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+export declare class JwtAuthGuard extends JwtAuthGuard_base {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): boolean | Promise<boolean> | Observable<boolean>;
+}
+export {};

package/dist/core/auth/guards/jwtAuth.guard.js

@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const passport_1 = require("@nestjs/passport");
+const public_decorator_1 = require("../decorators/public.decorator");
+let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
+    constructor(reflector) {
+        super();
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic) {
+            return true;
+        }
+        return super.canActivate(context);
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], JwtAuthGuard);

package/dist/core/auth/guards/permissions.guard.d.ts

@@ -0,0 +1,7 @@
+import { CanActivate, ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+export declare class PermissionsGuard implements CanActivate {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/core/auth/guards/permissions.guard.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionsGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const requirePermission_decorator_1 = require("../decorators/requirePermission.decorator");
+let PermissionsGuard = class PermissionsGuard {
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        const targets = [context.getHandler(), context.getClass()];
+        const required = this.reflector.getAllAndOverride(requirePermission_decorator_1.PERMISSIONS_KEY, targets);
+        const requiredAny = this.reflector.getAllAndOverride(requirePermission_decorator_1.ANY_PERMISSIONS_KEY, targets);
+        if ((!required || required.length === 0) &&
+            (!requiredAny || requiredAny.length === 0)) {
+            return true;
+        }
+        const user = context.switchToHttp().getRequest().user;
+        const granted = new Set(user?.permissions ?? []);
+        const allOk = !required?.length || required.every((code) => granted.has(code));
+        const anyOk = !requiredAny?.length || requiredAny.some((code) => granted.has(code));
+        if (!allOk || !anyOk) {
+            throw new common_1.ForbiddenException("Permissão insuficiente para esta ação");
+        }
+        return true;
+    }
+};
+exports.PermissionsGuard = PermissionsGuard;
+exports.PermissionsGuard = PermissionsGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], PermissionsGuard);

package/dist/core/bootstrap/bootstrapCore.util.d.ts

@@ -0,0 +1,9 @@
+import { IEntryNestModule } from "@nestjs/core";
+import { NestExpressApplication } from "@nestjs/platform-express";
+export interface BootstrapOptions {
+    title?: string;
+    description?: string;
+    version?: string;
+    uploadsDir?: string;
+}
+export declare const bootstrapCore: (appModule: IEntryNestModule, options?: BootstrapOptions) => Promise<NestExpressApplication>;

package/dist/core/bootstrap/bootstrapCore.util.js

@@ -0,0 +1,67 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bootstrapCore = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const swagger_1 = require("@nestjs/swagger");
+const cookie_parser_1 = __importDefault(require("cookie-parser"));
+const helmet_1 = __importDefault(require("helmet"));
+const path_1 = require("path");
+const env_service_1 = require("../config/env.service");
+const winston_config_1 = require("../logger/winston.config");
+const bootstrapCore = async (appModule, options = {}) => {
+    const app = await core_1.NestFactory.create(appModule, {
+        logger: (0, winston_config_1.createAppLogger)(),
+    });
+    const env = app.get(env_service_1.EnvService);
+    const logger = new common_1.Logger("Bootstrap");
+    app.set("trust proxy", env.get("TRUST_PROXY_HOPS"));
+    const prefix = env.get("API_PREFIX");
+    app.setGlobalPrefix(prefix);
+    app.enableVersioning({ type: common_1.VersioningType.URI, defaultVersion: "1" });
+    app.use((0, helmet_1.default)({ contentSecurityPolicy: false }));
+    app.use((0, cookie_parser_1.default)());
+    app.useStaticAssets((0, path_1.join)(process.cwd(), options.uploadsDir ?? "uploads"), {
+        prefix: "/uploads/",
+        setHeaders: (res) => {
+            res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+            res.setHeader("Cache-Control", "no-cache");
+        },
+    });
+    app.enableCors({
+        origin: env
+            .get("CORS_ORIGIN")
+            .split(",")
+            .map((o) => o.trim()),
+        credentials: true,
+    });
+    app.useGlobalPipes(new common_1.ValidationPipe({
+        whitelist: true,
+        forbidNonWhitelisted: true,
+        transform: true,
+        transformOptions: { enableImplicitConversion: true },
+    }));
+    app.useGlobalInterceptors(new common_1.ClassSerializerInterceptor(app.get(core_1.Reflector)));
+    if (env.get("NODE_ENV") !== "production") {
+        const config = new swagger_1.DocumentBuilder()
+            .setTitle(options.title ?? "Core API")
+            .setDescription(options.description ?? "Auth + 2FA obrigatório (TOTP) + RBAC + auditoria")
+            .setVersion(options.version ?? "1.0")
+            .addBearerAuth()
+            .addCookieAuth("access_token")
+            .build();
+        const document = swagger_1.SwaggerModule.createDocument(app, config);
+        swagger_1.SwaggerModule.setup(`${prefix}/docs`, app, document);
+    }
+    const port = env.get("PORT");
+    await app.listen(port);
+    logger.log(`${options.title ?? "Core API"} rodando em http://localhost:${port}/${prefix}`);
+    if (env.get("NODE_ENV") !== "production") {
+        logger.log(`Swagger em http://localhost:${port}/${prefix}/docs`);
+    }
+    return app;
+};
+exports.bootstrapCore = bootstrapCore;

package/dist/core/config/config.module.d.ts

@@ -0,0 +1,8 @@
+import { DynamicModule } from "@nestjs/common";
+export type EnvValidator = (config: Record<string, unknown>) => Record<string, unknown>;
+export interface ConfigModuleOptions {
+    validateEnv?: EnvValidator;
+}
+export declare class ConfigModule {
+    static forRoot(options?: ConfigModuleOptions): DynamicModule;
+}

package/dist/core/config/config.module.js

@@ -0,0 +1,34 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var ConfigModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigModule = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const env_schema_1 = require("./env.schema");
+const env_service_1 = require("./env.service");
+let ConfigModule = ConfigModule_1 = class ConfigModule {
+    static forRoot(options = {}) {
+        return {
+            module: ConfigModule_1,
+            global: true,
+            imports: [
+                config_1.ConfigModule.forRoot({
+                    isGlobal: true,
+                    validate: options.validateEnv ?? env_schema_1.validateEnv,
+                }),
+            ],
+            providers: [env_service_1.EnvService],
+            exports: [env_service_1.EnvService],
+        };
+    }
+};
+exports.ConfigModule = ConfigModule;
+exports.ConfigModule = ConfigModule = ConfigModule_1 = __decorate([
+    (0, common_1.Module)({})
+], ConfigModule);

package/dist/core/config/env.schema.d.ts

@@ -0,0 +1,65 @@
+import { z } from "zod";
+export declare const envSchema: z.ZodObject<{
+    NODE_ENV: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        test: "test";
+        production: "production";
+    }>>;
+    PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    API_PREFIX: z.ZodDefault<z.ZodString>;
+    APP_URL: z.ZodDefault<z.ZodString>;
+    DB_HOST: z.ZodString;
+    DB_PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    DB_NAME: z.ZodString;
+    DB_USER: z.ZodString;
+    DB_PASSWORD: z.ZodString;
+    DB_LOGGING: z.ZodDefault<z.ZodPipe<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "true" | "false">>>;
+    DB_SSL: z.ZodDefault<z.ZodPipe<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "true" | "false">>>;
+    TRUST_PROXY_HOPS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    JWT_ACCESS_SECRET: z.ZodString;
+    JWT_PENDING_SECRET: z.ZodString;
+    JWT_ACCESS_EXPIRES: z.ZodDefault<z.ZodString>;
+    JWT_REFRESH_EXPIRES_MINUTES: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    TOTP_ENC_KEY: z.ZodString;
+    COOKIE_SECURE: z.ZodDefault<z.ZodPipe<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "true" | "false">>>;
+    COOKIE_DOMAIN: z.ZodDefault<z.ZodString>;
+    TOTP_ISSUER: z.ZodDefault<z.ZodString>;
+    TWO_FACTOR_EMAIL_CODE_EXPIRY: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    BACKUP_CODES_COUNT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    LOGIN_MAX_ATTEMPTS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    THROTTLE_TTL_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    THROTTLE_LIMIT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    CORS_ORIGIN: z.ZodDefault<z.ZodString>;
+    LOG_LEVEL: z.ZodDefault<z.ZodString>;
+    EMAIL_HOST: z.ZodString;
+    EMAIL_PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    EMAIL_SECURE: z.ZodDefault<z.ZodPipe<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "true" | "false">>>;
+    EMAIL_USER: z.ZodString;
+    EMAIL_PASSWORD: z.ZodString;
+    EMAIL_FROM: z.ZodString;
+    EMAIL_FROM_NAME: z.ZodDefault<z.ZodString>;
+    PASSWORD_RESET_TOKEN_EXPIRY: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    FIRST_ACCESS_TOKEN_EXPIRY: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    PASSWORD_MAX_AGE_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    TOKEN_CLEANUP_CRON: z.ZodDefault<z.ZodString>;
+    AUDIT_LOG_CLEANUP_CRON: z.ZodDefault<z.ZodString>;
+    AUDIT_LOG_RETENTION_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    NOTIFICATION_RETENTION_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    SEED_ADMIN_NAME: z.ZodDefault<z.ZodString>;
+    SEED_ADMIN_EMAIL: z.ZodDefault<z.ZodString>;
+    SEED_ADMIN_PASSWORD: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type Env = z.infer<typeof envSchema>;
+export declare function validateEnv(config: Record<string, unknown>): Env;