tutanus 0.13.0 → 0.13.2

package/dist/app/github/middleware/isolamento.js

@@ -0,0 +1,149 @@
+import crypto from 'node:crypto';
+const PUBLIC_URL = process.env.TUTANUS_PUBLIC_URL || 'http://localhost:3000';
+const API_SECRET = process.env.TUTANUS_API_SECRET || '';
+const IS_PROD = process.env.NODE_ENV === 'production';
+const BLOQUEIO_AVISO = 'Acesso nao autorizado.';
+const ROTAS_PUBLICAS = new Set([
+    '/app-info',
+    '/health',
+    '/webhooks',
+    '/ping',
+]);
+const ORIGENS_PERMITIDAS = new Set([
+    PUBLIC_URL.replace(/\/$/u, ''),
+    'http://localhost:3000',
+    'http://localhost:5173',
+]);
+function isRotaPublica(path) {
+    if (ROTAS_PUBLICAS.has(path))
+        return true;
+    if (path.startsWith('/setup'))
+        return true;
+    return false;
+}
+function originPermitida(origin) {
+    if (!origin)
+        return false;
+    const normalizada = origin.replace(/\/$/u, '');
+    for (const permitida of ORIGENS_PERMITIDAS) {
+        if (normalizada === permitida || normalizada.startsWith(`${permitida}/`)) {
+            return true;
+        }
+    }
+    return false;
+}
+export function bloquearAcessoDireto(req, res, next) {
+    if (isRotaPublica(req.path)) {
+        next();
+        return;
+    }
+    const xRequestedWith = req.headers['x-requested-with'];
+    const secFetchSite = req.headers['sec-fetch-site'];
+    const accept = req.headers.accept;
+    const isXHR = xRequestedWith === 'XMLHttpRequest';
+    const isFetch = accept?.includes('application/json');
+    const isSameOrigin = secFetchSite === 'same-origin' || secFetchSite === 'same-site';
+    if (!isXHR && !isFetch && !isSameOrigin) {
+        if (req.method === 'GET') {
+            res.redirect('/');
+            return;
+        }
+        res.status(403).json({ erro: BLOQUEIO_AVISO });
+        return;
+    }
+    next();
+}
+export function verificarOrigem(req, res, next) {
+    if (isRotaPublica(req.path)) {
+        next();
+        return;
+    }
+    const origin = req.headers.origin;
+    const referer = req.headers.referer;
+    const source = origin || referer;
+    if (source && !originPermitida(source)) {
+        res.status(403).json({ erro: BLOQUEIO_AVISO });
+        return;
+    }
+    next();
+}
+export async function verificarAssinaturaApi(req, res, next) {
+    if (isRotaPublica(req.path)) {
+        next();
+        return;
+    }
+    if (!API_SECRET) {
+        if (IS_PROD) {
+            res.status(401).json({ erro: 'API secret nao configurada (TUTANUS_API_SECRET).' });
+            return;
+        }
+        next();
+        return;
+    }
+    const signature = req.headers['x-api-signature'];
+    if (!signature) {
+        res.status(401).json({ erro: BLOQUEIO_AVISO });
+        return;
+    }
+    const timestamp = req.headers['x-api-timestamp'];
+    if (!timestamp) {
+        res.status(401).json({ erro: BLOQUEIO_AVISO });
+        return;
+    }
+    const now = Date.now();
+    const ts = parseInt(timestamp, 10);
+    if (Number.isNaN(ts) || Math.abs(now - ts) > 30000) {
+        res.status(401).json({ erro: BLOQUEIO_AVISO });
+        return;
+    }
+    const method = req.method;
+    const path = req.path;
+    const body = typeof req.body === 'object' ? JSON.stringify(req.body) : '';
+    const payload = `${method}:${path}:${timestamp}:${body}`;
+    const { verifyRequestSignature: verificarAssinatura } = await import('./crypto.js');
+    const valido = verificarAssinatura(payload, signature, API_SECRET);
+    if (!valido) {
+        res.status(401).json({ erro: BLOQUEIO_AVISO });
+        return;
+    }
+    next();
+}
+export function mascararRotasApi(req, res, next) {
+    if (isRotaPublica(req.path)) {
+        next();
+        return;
+    }
+    if (!req.path.startsWith('/api/github')) {
+        next();
+        return;
+    }
+    const xRequestedWith = req.headers['x-requested-with'];
+    const accept = req.headers.accept;
+    const isXHR = xRequestedWith === 'XMLHttpRequest';
+    const isFetch = accept?.includes('application/json');
+    if (!isXHR && !isFetch) {
+        if (req.method === 'GET') {
+            res.redirect('/');
+            return;
+        }
+        res.status(404).json({ erro: 'Nao encontrado.' });
+        return;
+    }
+    next();
+}
+export function createIsolationMiddleware() {
+    return [
+        bloquearAcessoDireto,
+        verificarOrigem,
+        verificarAssinaturaApi,
+        mascararRotasApi,
+    ];
+}
+export function gerarAssinaturaApi(method, path, body) {
+    const timestamp = String(Date.now());
+    const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
+    const payload = `${method}:${path}:${timestamp}:${bodyStr}`;
+    const signature = crypto.createHmac('sha256', API_SECRET).update(payload).digest('hex');
+    return { signature, timestamp };
+}
+//# sourceMappingURL=isolamento.js.map

package/dist/app/github/middleware/isolamento.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolamento.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/isolamento.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAIjC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,uBAAuB,CAAC;AAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;AACxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAEtD,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAEhD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,WAAW;IACX,SAAS;IACT,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9B,uBAAuB;IACvB,uBAAuB;CACxB,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAClF,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAuB,CAAC;IAC7E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC;IAExD,MAAM,KAAK,GAAG,cAAc,KAAK,gBAAgB,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,YAAY,KAAK,aAAa,IAAI,YAAY,KAAK,WAAW,CAAC;IAEpF,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC7E,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAA6B,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAC;IAEjC,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC1F,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kDAAkD,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAuB,CAAC;IACvE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAuB,CAAC;IACvE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;IACzD,MAAM,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAEnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC9E,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAuB,CAAC;IAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC;IACxD,MAAM,KAAK,GAAG,cAAc,KAAK,gBAAgB,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAErD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,oBAAoB;QACpB,eAAe;QACf,sBAAsB;QACtB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,IAAY,EACZ,IAAsC;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,IAAI,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC","sourcesContent":["import crypto from 'node:crypto';\n\nimport type { NextFunction, Request, Response } from 'express';\n\nconst PUBLIC_URL = process.env.TUTANUS_PUBLIC_URL || 'http://localhost:3000';\nconst API_SECRET = process.env.TUTANUS_API_SECRET || '';\nconst IS_PROD = process.env.NODE_ENV === 'production';\n\nconst BLOQUEIO_AVISO = 'Acesso nao autorizado.';\n\nconst ROTAS_PUBLICAS = new Set([\n  '/app-info',\n  '/health',\n  '/webhooks',\n  '/ping',\n]);\n\nconst ORIGENS_PERMITIDAS = new Set([\n  PUBLIC_URL.replace(/\\/$/u, ''),\n  'http://localhost:3000',\n  'http://localhost:5173',\n]);\n\nfunction isRotaPublica(path: string): boolean {\n  if (ROTAS_PUBLICAS.has(path)) return true;\n  if (path.startsWith('/setup')) return true;\n  return false;\n}\n\nfunction originPermitida(origin: string | undefined): boolean {\n  if (!origin) return false;\n  const normalizada = origin.replace(/\\/$/u, '');\n  for (const permitida of ORIGENS_PERMITIDAS) {\n    if (normalizada === permitida || normalizada.startsWith(`${permitida}/`)) {\n      return true;\n    }\n  }\n  return false;\n}\n\nexport function bloquearAcessoDireto(req: Request, res: Response, next: NextFunction): void {\n  if (isRotaPublica(req.path)) {\n    next();\n    return;\n  }\n\n  const xRequestedWith = req.headers['x-requested-with'] as string | undefined;\n  const secFetchSite = req.headers['sec-fetch-site'] as string | undefined;\n  const accept = req.headers.accept as string | undefined;\n\n  const isXHR = xRequestedWith === 'XMLHttpRequest';\n  const isFetch = accept?.includes('application/json');\n  const isSameOrigin = secFetchSite === 'same-origin' || secFetchSite === 'same-site';\n\n  if (!isXHR && !isFetch && !isSameOrigin) {\n    if (req.method === 'GET') {\n      res.redirect('/');\n      return;\n    }\n    res.status(403).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  next();\n}\n\nexport function verificarOrigem(req: Request, res: Response, next: NextFunction): void {\n  if (isRotaPublica(req.path)) {\n    next();\n    return;\n  }\n\n  const origin = req.headers.origin as string | undefined;\n  const referer = req.headers.referer as string | undefined;\n  const source = origin || referer;\n\n  if (source && !originPermitida(source)) {\n    res.status(403).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  next();\n}\n\nexport async function verificarAssinaturaApi(req: Request, res: Response, next: NextFunction): Promise<void> {\n  if (isRotaPublica(req.path)) {\n    next();\n    return;\n  }\n\n  if (!API_SECRET) {\n    if (IS_PROD) {\n      res.status(401).json({ erro: 'API secret nao configurada (TUTANUS_API_SECRET).' });\n      return;\n    }\n    next();\n    return;\n  }\n\n  const signature = req.headers['x-api-signature'] as string | undefined;\n  if (!signature) {\n    res.status(401).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  const timestamp = req.headers['x-api-timestamp'] as string | undefined;\n  if (!timestamp) {\n    res.status(401).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  const now = Date.now();\n  const ts = parseInt(timestamp, 10);\n  if (Number.isNaN(ts) || Math.abs(now - ts) > 30000) {\n    res.status(401).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  const method = req.method;\n  const path = req.path;\n  const body = typeof req.body === 'object' ? JSON.stringify(req.body) : '';\n  const payload = `${method}:${path}:${timestamp}:${body}`;\n  const { verifyRequestSignature: verificarAssinatura } = await import('./crypto.js');\n  const valido = verificarAssinatura(payload, signature, API_SECRET);\n\n  if (!valido) {\n    res.status(401).json({ erro: BLOQUEIO_AVISO });\n    return;\n  }\n\n  next();\n}\n\nexport function mascararRotasApi(req: Request, res: Response, next: NextFunction): void {\n  if (isRotaPublica(req.path)) {\n    next();\n    return;\n  }\n\n  if (!req.path.startsWith('/api/github')) {\n    next();\n    return;\n  }\n\n  const xRequestedWith = req.headers['x-requested-with'] as string | undefined;\n  const accept = req.headers.accept as string | undefined;\n  const isXHR = xRequestedWith === 'XMLHttpRequest';\n  const isFetch = accept?.includes('application/json');\n\n  if (!isXHR && !isFetch) {\n    if (req.method === 'GET') {\n      res.redirect('/');\n      return;\n    }\n    res.status(404).json({ erro: 'Nao encontrado.' });\n    return;\n  }\n\n  next();\n}\n\nexport function createIsolationMiddleware(): Array<(req: Request, res: Response, next: NextFunction) => void | Promise<void>> {\n  return [\n    bloquearAcessoDireto,\n    verificarOrigem,\n    verificarAssinaturaApi,\n    mascararRotasApi,\n  ];\n}\n\nexport function gerarAssinaturaApi(\n  method: string,\n  path: string,\n  body: Record<string, unknown> | string\n): { signature: string; timestamp: string } {\n  const timestamp = String(Date.now());\n  const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);\n  const payload = `${method}:${path}:${timestamp}:${bodyStr}`;\n  const signature = crypto.createHmac('sha256', API_SECRET).update(payload).digest('hex');\n  return { signature, timestamp };\n}\n"]}

package/dist/app/github/middleware/seguranca.d.ts

@@ -0,0 +1,3 @@
+import type { NextFunction, Request, Response } from 'express';
+export declare function createSecurityMiddleware(): Array<(req: Request, res: Response, next: NextFunction) => void>;
+//# sourceMappingURL=seguranca.d.ts.map

package/dist/app/github/middleware/seguranca.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seguranca.d.ts","sourceRoot":"","sources":["../../../../src/app/github/middleware/seguranca.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAgJ/D,wBAAgB,wBAAwB,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC,CAE3G"}

package/dist/app/github/middleware/seguranca.js

@@ -0,0 +1,114 @@
+import crypto from 'node:crypto';
+const IS_PROD = process.env.NODE_ENV === 'production';
+const PUBLIC_URL = process.env.TUTANUS_PUBLIC_URL || 'http://localhost:3000';
+const WINDOW_MS = 60_000;
+const MAX_REQUESTS = 100;
+const requestCounts = new Map();
+function rateLimit(req, res, next) {
+    const ip = req.ip || req.socket.remoteAddress || 'unknown';
+    const now = Date.now();
+    const entry = requestCounts.get(ip);
+    if (!entry || now > entry.resetAt) {
+        requestCounts.set(ip, { count: 1, resetAt: now + WINDOW_MS });
+        next();
+        return;
+    }
+    entry.count++;
+    if (entry.count > MAX_REQUESTS) {
+        res.status(429).json({ erro: 'Too many requests. Try again later.' });
+        return;
+    }
+    next();
+}
+function securityHeaders(req, res, next) {
+    const nonce = crypto.randomBytes(16).toString('base64url');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('X-Frame-Options', 'DENY');
+    res.setHeader('X-XSS-Protection', '0');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    res.setHeader('X-DNS-Prefetch-Control', 'off');
+    const isApi = req.path.startsWith('/api/');
+    const scriptSrc = isApi
+        ? `'self' 'nonce-${nonce}'`
+        : `'self' 'unsafe-inline'`;
+    const directives = [
+        `default-src 'self'`,
+        `script-src ${scriptSrc}`,
+        `style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com`,
+        `font-src 'self' https://cdnjs.cloudflare.com`,
+        `img-src 'self' data: https:`,
+        `connect-src 'self' https://api.github.com`,
+        `frame-src 'none'`,
+        `object-src 'none'`,
+        `base-uri 'self'`,
+        `form-action 'self'`,
+        `manifest-src 'self'`,
+        `worker-src 'self'`,
+        ...(IS_PROD ? [`upgrade-insecure-requests`] : []),
+    ];
+    res.setHeader('Content-Security-Policy', directives.join('; '));
+    res.setHeader('Permissions-Policy', 'accelerometer=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()');
+    res.setHeader('X-Permitted-Cross-Domain-Policies', 'none');
+    if (IS_PROD && PUBLIC_URL.startsWith('https://')) {
+        res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+    }
+    res.setHeader('Surrogate-Control', 'no-store');
+    res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+    res.setHeader('Pragma', 'no-cache');
+    res.setHeader('Expires', '0');
+    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+    res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+    res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp');
+    req.nonce = nonce;
+    next();
+}
+function corsRestrict(req, res, next) {
+    if (req.path.startsWith('/api/github/webhooks')) {
+        next();
+        return;
+    }
+    res.setHeader('Access-Control-Allow-Origin', PUBLIC_URL);
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token');
+    res.setHeader('Access-Control-Allow-Credentials', 'true');
+    res.setHeader('Access-Control-Max-Age', '86400');
+    res.setHeader('Vary', 'Origin');
+    if (req.method === 'OPTIONS') {
+        res.status(204).end();
+        return;
+    }
+    next();
+}
+const csrfTokens = new Map();
+function generateCsrfToken() {
+    const token = crypto.randomBytes(32).toString('hex');
+    csrfTokens.set(token, { token, expiresAt: Date.now() + 3_600_000 });
+    return token;
+}
+function csrfProtection(req, res, next) {
+    const safeMethods = new Set(['GET', 'HEAD', 'OPTIONS']);
+    if (safeMethods.has(req.method)) {
+        const token = generateCsrfToken();
+        res.setHeader('X-CSRF-Token', token);
+        next();
+        return;
+    }
+    if (req.path.startsWith('/api/github/webhooks')) {
+        next();
+        return;
+    }
+    const headerToken = req.headers['x-csrf-token'];
+    const stored = headerToken ? csrfTokens.get(headerToken) : undefined;
+    if (!stored || stored.expiresAt < Date.now()) {
+        res.status(403).json({ erro: 'CSRF token invalido ou expirado' });
+        return;
+    }
+    if (headerToken) {
+        csrfTokens.delete(headerToken);
+    }
+    next();
+}
+export function createSecurityMiddleware() {
+    return [rateLimit, securityHeaders, corsRestrict, csrfProtection];
+}
+//# sourceMappingURL=seguranca.js.map

package/dist/app/github/middleware/seguranca.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seguranca.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/seguranca.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,aAAa,CAAC;AAIjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,uBAAuB,CAAC;AAE7E,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8C,CAAC;AAE5E,SAAS,SAAS,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAChE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEpC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,KAAK,CAAC,KAAK,GAAG,YAAY,EAAE,CAAC;QAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE3D,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK;QACrB,CAAC,CAAC,iBAAiB,KAAK,GAAG;QAC3B,CAAC,CAAC,wBAAwB,CAAC;IAE7B,MAAM,UAAU,GAAG;QACjB,oBAAoB;QACpB,cAAc,SAAS,EAAE;QACzB,+DAA+D;QAC/D,8CAA8C;QAC9C,6BAA6B;QAC7B,2CAA2C;QAC3C,kBAAkB;QAClB,mBAAmB;QACnB,iBAAiB;QACjB,oBAAoB;QACpB,qBAAqB;QACrB,mBAAmB;QACnB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;IAEF,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,GAAG,CAAC,SAAS,CACX,oBAAoB,EACpB,mHAAmH,CACpH,CAAC;IAEF,GAAG,CAAC,SAAS,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IAE3D,IAAI,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,2BAA2B,EAAE,8CAA8C,CAAC,CAAC;IAC7F,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC/C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;IACxF,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAE9B,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;IAC7D,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IAC3D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAE7D,GAAmC,CAAC,KAAK,GAAG,KAAK,CAAC;IAEnD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACnE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChD,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;IACzD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,mCAAmC,CAAC,CAAC;IACnF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,2CAA2C,CAAC,CAAC;IAC3F,GAAG,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAC1D,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAC;AAE3E,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAExD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChD,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAuB,CAAC;IACtE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AACpE,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport crypto from 'node:crypto';\n\nimport type { NextFunction, Request, Response } from 'express';\n\nconst IS_PROD = process.env.NODE_ENV === 'production';\nconst PUBLIC_URL = process.env.TUTANUS_PUBLIC_URL || 'http://localhost:3000';\n\nconst WINDOW_MS = 60_000;\nconst MAX_REQUESTS = 100;\nconst requestCounts = new Map<string, { count: number; resetAt: number }>();\n\nfunction rateLimit(req: Request, res: Response, next: NextFunction): void {\n  const ip = req.ip || req.socket.remoteAddress || 'unknown';\n  const now = Date.now();\n  const entry = requestCounts.get(ip);\n\n  if (!entry || now > entry.resetAt) {\n    requestCounts.set(ip, { count: 1, resetAt: now + WINDOW_MS });\n    next();\n    return;\n  }\n\n  entry.count++;\n  if (entry.count > MAX_REQUESTS) {\n    res.status(429).json({ erro: 'Too many requests. Try again later.' });\n    return;\n  }\n\n  next();\n}\n\nfunction securityHeaders(req: Request, res: Response, next: NextFunction): void {\n  const nonce = crypto.randomBytes(16).toString('base64url');\n\n  res.setHeader('X-Content-Type-Options', 'nosniff');\n  res.setHeader('X-Frame-Options', 'DENY');\n  res.setHeader('X-XSS-Protection', '0');\n  res.setHeader('Referrer-Policy', 'no-referrer');\n  res.setHeader('X-DNS-Prefetch-Control', 'off');\n\n  const isApi = req.path.startsWith('/api/');\n  const scriptSrc = isApi\n    ? `'self' 'nonce-${nonce}'`\n    : `'self' 'unsafe-inline'`;\n\n  const directives = [\n    `default-src 'self'`,\n    `script-src ${scriptSrc}`,\n    `style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com`,\n    `font-src 'self' https://cdnjs.cloudflare.com`,\n    `img-src 'self' data: https:`,\n    `connect-src 'self' https://api.github.com`,\n    `frame-src 'none'`,\n    `object-src 'none'`,\n    `base-uri 'self'`,\n    `form-action 'self'`,\n    `manifest-src 'self'`,\n    `worker-src 'self'`,\n    ...(IS_PROD ? [`upgrade-insecure-requests`] : []),\n  ];\n\n  res.setHeader('Content-Security-Policy', directives.join('; '));\n\n  res.setHeader(\n    'Permissions-Policy',\n    'accelerometer=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()'\n  );\n\n  res.setHeader('X-Permitted-Cross-Domain-Policies', 'none');\n\n  if (IS_PROD && PUBLIC_URL.startsWith('https://')) {\n    res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');\n  }\n\n  res.setHeader('Surrogate-Control', 'no-store');\n  res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');\n  res.setHeader('Pragma', 'no-cache');\n  res.setHeader('Expires', '0');\n\n  res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');\n  res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');\n  res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp');\n\n  (req as Request & { nonce: string }).nonce = nonce;\n\n  next();\n}\n\nfunction corsRestrict(req: Request, res: Response, next: NextFunction): void {\n  if (req.path.startsWith('/api/github/webhooks')) {\n    next();\n    return;\n  }\n\n  res.setHeader('Access-Control-Allow-Origin', PUBLIC_URL);\n  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS');\n  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token');\n  res.setHeader('Access-Control-Allow-Credentials', 'true');\n  res.setHeader('Access-Control-Max-Age', '86400');\n  res.setHeader('Vary', 'Origin');\n\n  if (req.method === 'OPTIONS') {\n    res.status(204).end();\n    return;\n  }\n\n  next();\n}\n\nconst csrfTokens = new Map<string, { token: string; expiresAt: number }>();\n\nfunction generateCsrfToken(): string {\n  const token = crypto.randomBytes(32).toString('hex');\n  csrfTokens.set(token, { token, expiresAt: Date.now() + 3_600_000 });\n  return token;\n}\n\nfunction csrfProtection(req: Request, res: Response, next: NextFunction): void {\n  const safeMethods = new Set(['GET', 'HEAD', 'OPTIONS']);\n\n  if (safeMethods.has(req.method)) {\n    const token = generateCsrfToken();\n    res.setHeader('X-CSRF-Token', token);\n    next();\n    return;\n  }\n\n  if (req.path.startsWith('/api/github/webhooks')) {\n    next();\n    return;\n  }\n\n  const headerToken = req.headers['x-csrf-token'] as string | undefined;\n  const stored = headerToken ? csrfTokens.get(headerToken) : undefined;\n\n  if (!stored || stored.expiresAt < Date.now()) {\n    res.status(403).json({ erro: 'CSRF token invalido ou expirado' });\n    return;\n  }\n\n  if (headerToken) {\n    csrfTokens.delete(headerToken);\n  }\n  next();\n}\n\nexport function createSecurityMiddleware(): Array<(req: Request, res: Response, next: NextFunction) => void> {\n  return [rateLimit, securityHeaders, corsRestrict, csrfProtection];\n}\n"]}

package/dist/app/github/push-analysis/analysis-core.d.ts

@@ -0,0 +1,7 @@
+import type { App } from '@octokit/app';
+import type { RodarAnaliseParams, RodarAnaliseResult } from '../../../types/github/app.js';
+import type { OctokitInstance } from '../app/webhook-handler.js';
+export type { RodarAnaliseParams, RodarAnaliseResult };
+export declare function listarArquivosAlterados(octokit: OctokitInstance, owner: string, repo: string, beforeSha: string, afterSha: string): Promise<string[]>;
+export declare function rodarAnaliseCodigo(app: App, params: RodarAnaliseParams): Promise<RodarAnaliseResult>;
+//# sourceMappingURL=analysis-core.d.ts.map

package/dist/app/github/push-analysis/analysis-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-core.d.ts","sourceRoot":"","sources":["../../../../src/app/github/push-analysis/analysis-core.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAGV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAQjE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;AAwBvD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAWD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,kBAAkB,CAAC,CAiE7B"}

package/dist/app/github/push-analysis/analysis-core.js

@@ -0,0 +1,84 @@
+import { carregarConfigDeDiretorio } from '../../../core/config/index.js';
+import { obterConfigInstalacao } from '../app/installation-store.js';
+import { downloadRepo } from '../app/repo-downloader.js';
+import { calcularScoreGeral, executarAnaliseInterna, resumirPorSeveridade, resumirPorTipo } from '../jobs/full-analysis-job.js';
+function simplificarOcorrencias(ocorrencias) {
+    return ocorrencias.map(o => ({
+        mensagem: typeof o.mensagem === 'string' ? o.mensagem : String(o.mensagem ?? ''),
+        relPath: typeof o.relPath === 'string' ? o.relPath : String(o.relPath ?? ''),
+        tipo: typeof o.tipo === 'string' ? o.tipo : undefined,
+        nivel: typeof o.nivel === 'string' ? o.nivel : undefined,
+        linha: typeof o.linha === 'number' ? o.linha : undefined,
+        coluna: typeof o.coluna === 'number' ? o.coluna : undefined,
+        sugestao: typeof o.sugestao === 'string' ? o.sugestao : undefined
+    }));
+}
+export async function listarArquivosAlterados(octokit, owner, repo, beforeSha, afterSha) {
+    if (!beforeSha || beforeSha === '0000000000000000000000000000000000000000') {
+        return [];
+    }
+    try {
+        const { data } = await octokit.request('GET /repos/{owner}/{repo}/compare/{basehead}', {
+            owner,
+            repo,
+            basehead: `${beforeSha}...${afterSha}`
+        });
+        return (data.files ?? [])
+            .filter((f) => f.status !== 'removed' && typeof f.filename === 'string')
+            .map(f => f.filename);
+    }
+    catch {
+        return [];
+    }
+}
+function filtrarOcorrenciasPorArquivos(ocorrencias, arquivos) {
+    if (arquivos.length === 0)
+        return ocorrencias;
+    const set = new Set(arquivos);
+    return ocorrencias.filter(o => set.has(o.relPath));
+}
+export async function rodarAnaliseCodigo(app, params) {
+    const config = obterConfigInstalacao(params.installationId);
+    const octokit = await app.getInstallationOctokit(params.installationId);
+    const inicio = Date.now();
+    const { repoDir, cleanup } = await downloadRepo(app, params.installationId, params.owner, params.repo, params.headSha);
+    try {
+        await carregarConfigDeDiretorio(repoDir);
+        const { totalArquivos, arquivosAnalisados, todasOcorrencias } = await executarAnaliseInterna(repoDir, { fast: params.fast ?? config.fast });
+        let ocorrencias = simplificarOcorrencias(todasOcorrencias);
+        let arquivosAlterados = [];
+        const usarIncremental = params.incremental ?? config.incrementalOnPush;
+        if (usarIncremental && params.baseSha) {
+            arquivosAlterados = await listarArquivosAlterados(octokit, params.owner, params.repo, params.baseSha, params.headSha);
+            if (arquivosAlterados.length > 0) {
+                ocorrencias = filtrarOcorrenciasPorArquivos(ocorrencias, arquivosAlterados);
+            }
+        }
+        const resultado = {
+            totalArquivos,
+            totalOcorrencias: ocorrencias.length,
+            duracaoMs: Date.now() - inicio,
+            arquivosAnalisados,
+            ocorrencias,
+            scoreGeral: calcularScoreGeral(totalArquivos, ocorrencias),
+            resumoPorTipo: resumirPorTipo(ocorrencias),
+            resumoPorSeveridade: resumirPorSeveridade(ocorrencias)
+        };
+        const ctx = {
+            branch: params.branch,
+            headSha: params.headSha,
+            commitMessage: params.commitMessage,
+            owner: params.owner,
+            repo: params.repo,
+            arquivosAlterados: arquivosAlterados.length > 0 ? arquivosAlterados : undefined,
+            escopoIncremental: usarIncremental && arquivosAlterados.length > 0,
+            origem: params.baseSha ? 'pull_request' : 'push'
+        };
+        return { resultado, ctx, cleanup };
+    }
+    catch (err) {
+        cleanup();
+        throw err;
+    }
+}
+//# sourceMappingURL=analysis-core.js.map

package/dist/app/github/push-analysis/analysis-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-core.js","sourceRoot":"","sources":["../../../../src/app/github/push-analysis/analysis-core.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AASzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACf,MAAM,8BAA8B,CAAC;AAItC,SAAS,sBAAsB,CAC7B,WAQE;IAEF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QAChF,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QAC5E,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACrD,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACxD,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACxD,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC3D,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAwB,EACxB,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,QAAgB;IAEhB,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,0CAA0C,EAAE,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,8CAA8C,EAAE;YACrF,KAAK;YACL,IAAI;YACJ,QAAQ,EAAE,GAAG,SAAS,MAAM,QAAQ,EAAE;SACvC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;aACtB,MAAM,CAAC,CAAC,CAAC,EAAwC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;aAC7G,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACpC,WAA8C,EAC9C,QAAkB;IAElB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAQ,EACR,MAA0B;IAE1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE1B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAC7C,GAAG,EACH,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,CACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAEzC,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAAG,MAAM,sBAAsB,CAC1F,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CACrC,CAAC;QAEF,IAAI,WAAW,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;QAE3D,IAAI,iBAAiB,GAAa,EAAE,CAAC;QACrC,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,iBAAiB,CAAC;QACvE,IAAI,eAAe,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,iBAAiB,GAAG,MAAM,uBAAuB,CAC/C,OAAO,EACP,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,CACf,CAAC;YACF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,WAAW,GAAG,6BAA6B,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAuB;YACpC,aAAa;YACb,gBAAgB,EAAE,WAAW,CAAC,MAAM;YACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAC9B,kBAAkB;YAClB,WAAW;YACX,UAAU,EAAE,kBAAkB,CAAC,aAAa,EAAE,WAAW,CAAC;YAC1D,aAAa,EAAE,cAAc,CAAC,WAAW,CAAC;YAC1C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW,CAAC;SACvD,CAAC;QAEF,MAAM,GAAG,GAA0B;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAC/E,iBAAiB,EAAE,eAAe,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC;YAClE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM;SACjD,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;QACV,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { carregarConfigDeDiretorio } from '@core/config';\nimport type { App } from '@octokit/app';\n\nimport type {\n  AnalysisReportContext,\n  FullAnalysisResult,\n  RodarAnaliseParams,\n  RodarAnaliseResult\n} from '../../../types/github/app.js';\nimport { obterConfigInstalacao } from '../app/installation-store.js';\nimport { downloadRepo } from '../app/repo-downloader.js';\nimport type { OctokitInstance } from '../app/webhook-handler.js';\nimport {\n  calcularScoreGeral,\n  executarAnaliseInterna,\n  resumirPorSeveridade,\n  resumirPorTipo\n} from '../jobs/full-analysis-job.js';\n\nexport type { RodarAnaliseParams, RodarAnaliseResult };\n\nfunction simplificarOcorrencias(\n  ocorrencias: Array<{\n    mensagem: string;\n    relPath: string;\n    tipo?: string;\n    nivel?: string;\n    linha?: number;\n    coluna?: number;\n    sugestao?: string;\n  }>\n): FullAnalysisResult['ocorrencias'] {\n  return ocorrencias.map(o => ({\n    mensagem: typeof o.mensagem === 'string' ? o.mensagem : String(o.mensagem ?? ''),\n    relPath: typeof o.relPath === 'string' ? o.relPath : String(o.relPath ?? ''),\n    tipo: typeof o.tipo === 'string' ? o.tipo : undefined,\n    nivel: typeof o.nivel === 'string' ? o.nivel : undefined,\n    linha: typeof o.linha === 'number' ? o.linha : undefined,\n    coluna: typeof o.coluna === 'number' ? o.coluna : undefined,\n    sugestao: typeof o.sugestao === 'string' ? o.sugestao : undefined\n  }));\n}\n\nexport async function listarArquivosAlterados(\n  octokit: OctokitInstance,\n  owner: string,\n  repo: string,\n  beforeSha: string,\n  afterSha: string\n): Promise<string[]> {\n  if (!beforeSha || beforeSha === '0000000000000000000000000000000000000000') {\n    return [];\n  }\n  try {\n    const { data } = await octokit.request('GET /repos/{owner}/{repo}/compare/{basehead}', {\n      owner,\n      repo,\n      basehead: `${beforeSha}...${afterSha}`\n    });\n    return (data.files ?? [])\n      .filter((f): f is typeof f & { filename: string } => f.status !== 'removed' && typeof f.filename === 'string')\n      .map(f => f.filename);\n  } catch {\n    return [];\n  }\n}\n\nfunction filtrarOcorrenciasPorArquivos(\n  ocorrencias: FullAnalysisResult['ocorrencias'],\n  arquivos: string[]\n): FullAnalysisResult['ocorrencias'] {\n  if (arquivos.length === 0) return ocorrencias;\n  const set = new Set(arquivos);\n  return ocorrencias.filter(o => set.has(o.relPath));\n}\n\nexport async function rodarAnaliseCodigo(\n  app: App,\n  params: RodarAnaliseParams\n): Promise<RodarAnaliseResult> {\n  const config = obterConfigInstalacao(params.installationId);\n  const octokit = await app.getInstallationOctokit(params.installationId);\n  const inicio = Date.now();\n\n  const { repoDir, cleanup } = await downloadRepo(\n    app,\n    params.installationId,\n    params.owner,\n    params.repo,\n    params.headSha\n  );\n\n  try {\n    await carregarConfigDeDiretorio(repoDir);\n\n    const { totalArquivos, arquivosAnalisados, todasOcorrencias } = await executarAnaliseInterna(\n      repoDir,\n      { fast: params.fast ?? config.fast }\n    );\n\n    let ocorrencias = simplificarOcorrencias(todasOcorrencias);\n\n    let arquivosAlterados: string[] = [];\n    const usarIncremental = params.incremental ?? config.incrementalOnPush;\n    if (usarIncremental && params.baseSha) {\n      arquivosAlterados = await listarArquivosAlterados(\n        octokit,\n        params.owner,\n        params.repo,\n        params.baseSha,\n        params.headSha\n      );\n      if (arquivosAlterados.length > 0) {\n        ocorrencias = filtrarOcorrenciasPorArquivos(ocorrencias, arquivosAlterados);\n      }\n    }\n\n    const resultado: FullAnalysisResult = {\n      totalArquivos,\n      totalOcorrencias: ocorrencias.length,\n      duracaoMs: Date.now() - inicio,\n      arquivosAnalisados,\n      ocorrencias,\n      scoreGeral: calcularScoreGeral(totalArquivos, ocorrencias),\n      resumoPorTipo: resumirPorTipo(ocorrencias),\n      resumoPorSeveridade: resumirPorSeveridade(ocorrencias)\n    };\n\n    const ctx: AnalysisReportContext = {\n      branch: params.branch,\n      headSha: params.headSha,\n      commitMessage: params.commitMessage,\n      owner: params.owner,\n      repo: params.repo,\n      arquivosAlterados: arquivosAlterados.length > 0 ? arquivosAlterados : undefined,\n      escopoIncremental: usarIncremental && arquivosAlterados.length > 0,\n      origem: params.baseSha ? 'pull_request' : 'push'\n    };\n\n    return { resultado, ctx, cleanup };\n  } catch (err) {\n    cleanup();\n    throw err;\n  }\n}\n"]}

package/dist/app/github/push-analysis/pr-analysis-service.d.ts

@@ -0,0 +1,5 @@
+import type { App } from '@octokit/app';
+import type { PullRequestAnalysisParams } from '../../../types/github/app.js';
+export type { PullRequestAnalysisParams };
+export declare function executarAnalisePullRequest(app: App, params: PullRequestAnalysisParams): Promise<void>;
+//# sourceMappingURL=pr-analysis-service.d.ts.map

package/dist/app/github/push-analysis/pr-analysis-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-analysis-service.d.ts","sourceRoot":"","sources":["../../../../src/app/github/push-analysis/pr-analysis-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAsB,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAWlG,YAAY,EAAE,yBAAyB,EAAE,CAAC;AAkD1C,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,IAAI,CAAC,CAyDf"}

package/dist/app/github/push-analysis/pr-analysis-service.js

@@ -0,0 +1,89 @@
+import { obterConfigInstalacao } from '../app/installation-store.js';
+import { statsStore } from '../dashboard/stats-store.js';
+import { rodarAnaliseCodigo } from './analysis-core.js';
+import { gerarComentarioPrAnalise, gerarCorpoPrAnalise, gerarRelatorioMarkdown, gerarResumoReviewPr } from './push-report.js';
+const MAX_REVIEW_COMMENTS = 40;
+const PREFIXO_BRANCH_RELATORIO = 'tutanus/';
+async function publicarReviewComentarios(octokit, owner, repo, prNumber, commitId, ocorrencias) {
+    const comentarios = ocorrencias
+        .filter(o => o.relPath && o.linha && o.linha > 0)
+        .slice(0, MAX_REVIEW_COMMENTS)
+        .map(o => ({
+        path: o.relPath,
+        line: o.linha,
+        body: `**${rotuloSeveridade(o.nivel)}** · ${o.tipo || 'geral'}\n\n${o.mensagem}${o.sugestao ? `\n\n**Sugestão:** ${o.sugestao}` : ''}`
+    }));
+    if (comentarios.length === 0)
+        return;
+    try {
+        await octokit.request('POST /repos/{owner}/{repo}/pulls/{pull_number}/reviews', {
+            owner,
+            repo,
+            pull_number: prNumber,
+            commit_id: commitId,
+            event: 'COMMENT',
+            body: gerarResumoReviewPr(ocorrencias.length, comentarios.length),
+            comments: comentarios
+        });
+    }
+    catch (err) {
+        const { GithubWebhookMensagens } = await import('../../../core/messages/index.js');
+        const { messages: msgs } = await import('../../../core/messages/index.js');
+        msgs.log.aviso(GithubWebhookMensagens.reviewCommentsNoPR(err instanceof Error ? err.message : String(err)));
+    }
+}
+function rotuloSeveridade(nivel) {
+    const nivelNormalizado = (nivel || 'info').toLowerCase();
+    if (nivelNormalizado === 'erro')
+        return 'Erro';
+    if (nivelNormalizado === 'aviso')
+        return 'Aviso';
+    return 'Info';
+}
+export async function executarAnalisePullRequest(app, params) {
+    if (params.headRef.startsWith(PREFIXO_BRANCH_RELATORIO))
+        return;
+    const config = obterConfigInstalacao(params.installationId);
+    if (!config.pullRequestAnalysisEnabled)
+        return;
+    const { resultado, ctx, cleanup } = await rodarAnaliseCodigo(app, {
+        installationId: params.installationId,
+        owner: params.owner,
+        repo: params.repo,
+        headSha: params.headSha,
+        branch: params.headRef,
+        commitMessage: params.prTitle,
+        baseSha: params.baseSha,
+        incremental: config.incrementalOnPush
+    });
+    const octokit = await app.getInstallationOctokit(params.installationId);
+    try {
+        const ctxPr = { ...ctx, baseRef: params.baseRef, prNumber: params.prNumber };
+        const relatorioCompleto = gerarRelatorioMarkdown(resultado, ctxPr);
+        const corpoAnalise = gerarCorpoPrAnalise(resultado, ctxPr);
+        await octokit.request('PATCH /repos/{owner}/{repo}/pulls/{pull_number}', {
+            owner: params.owner,
+            repo: params.repo,
+            pull_number: params.prNumber,
+            body: corpoAnalise
+        });
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner: params.owner,
+            repo: params.repo,
+            issue_number: params.prNumber,
+            body: gerarComentarioPrAnalise(resultado, ctxPr, relatorioCompleto)
+        });
+        await publicarReviewComentarios(octokit, params.owner, params.repo, params.prNumber, params.headSha, resultado.ocorrencias);
+        statsStore.recordAnalysis({
+            repository: `${params.owner}/${params.repo}`,
+            event: 'pull_request',
+            score: resultado.scoreGeral,
+            workflowsCount: 0,
+            occurrencesCount: resultado.totalOcorrencias
+        });
+    }
+    finally {
+        cleanup();
+    }
+}
+//# sourceMappingURL=pr-analysis-service.js.map

package/dist/app/github/push-analysis/pr-analysis-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-analysis-service.js","sourceRoot":"","sources":["../../../../src/app/github/push-analysis/pr-analysis-service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAE5C,KAAK,UAAU,yBAAyB,CACtC,OAA2D,EAC3D,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,QAAgB,EAChB,WAA8C;IAE9C,MAAM,WAAW,GAAG,WAAW;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;SAChD,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACT,IAAI,EAAE,CAAC,CAAC,OAAO;QACf,IAAI,EAAE,CAAC,CAAC,KAAe;QACvB,IAAI,EAAE,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,CAAC,QAAQ,GAC5E,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EACnD,EAAE;KACH,CAAC,CAAC,CAAC;IAEN,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAErC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,CAAC,wDAAwD,EAAE;YAC9E,KAAK;YACL,IAAI;YACJ,WAAW,EAAE,QAAQ;YACrB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,mBAAmB,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;YACjE,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,gBAAgB,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,gBAAgB,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC/C,IAAI,gBAAgB,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAQ,EACR,MAAiC;IAEjC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;QAAE,OAAO;IAEhE,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,0BAA0B;QAAE,OAAO;IAE/C,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE;QAChE,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,OAAO;QACtB,aAAa,EAAE,MAAM,CAAC,OAAO;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,iBAAiB;KACtC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAExE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEnE,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,OAAO,CAAC,iDAAiD,EAAE;YACvE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,QAAQ;YAC5B,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,QAAQ;YAC7B,IAAI,EAAE,wBAAwB,CAAC,SAAS,EAAE,KAAK,EAAE,iBAAiB,CAAC;SACpE,CAAC,CAAC;QAEH,MAAM,yBAAyB,CAC7B,OAAO,EACP,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,OAAO,EACd,SAAS,CAAC,WAAW,CACtB,CAAC;QAEF,UAAU,CAAC,cAAc,CAAC;YACxB,UAAU,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE;YAC5C,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,SAAS,CAAC,UAAU;YAC3B,cAAc,EAAE,CAAC;YACjB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport type { App } from '@octokit/app';\n\nimport type { FullAnalysisResult, PullRequestAnalysisParams } from '../../../types/github/app.js';\nimport { obterConfigInstalacao } from '../app/installation-store.js';\nimport { statsStore } from '../dashboard/stats-store.js';\nimport { rodarAnaliseCodigo } from './analysis-core.js';\nimport {\n  gerarComentarioPrAnalise,\n  gerarCorpoPrAnalise,\n  gerarRelatorioMarkdown,\n  gerarResumoReviewPr\n} from './push-report.js';\n\nexport type { PullRequestAnalysisParams };\n\nconst MAX_REVIEW_COMMENTS = 40;\nconst PREFIXO_BRANCH_RELATORIO = 'tutanus/';\n\nasync function publicarReviewComentarios(\n  octokit: Awaited<ReturnType<App['getInstallationOctokit']>>,\n  owner: string,\n  repo: string,\n  prNumber: number,\n  commitId: string,\n  ocorrencias: FullAnalysisResult['ocorrencias']\n): Promise<void> {\n  const comentarios = ocorrencias\n    .filter(o => o.relPath && o.linha && o.linha > 0)\n    .slice(0, MAX_REVIEW_COMMENTS)\n    .map(o => ({\n      path: o.relPath,\n      line: o.linha as number,\n      body: `**${rotuloSeveridade(o.nivel)}** · ${o.tipo || 'geral'}\\n\\n${o.mensagem}${\n        o.sugestao ? `\\n\\n**Sugestão:** ${o.sugestao}` : ''\n      }`\n    }));\n\n  if (comentarios.length === 0) return;\n\n  try {\n    await octokit.request('POST /repos/{owner}/{repo}/pulls/{pull_number}/reviews', {\n      owner,\n      repo,\n      pull_number: prNumber,\n      commit_id: commitId,\n      event: 'COMMENT',\n      body: gerarResumoReviewPr(ocorrencias.length, comentarios.length),\n      comments: comentarios\n    });\n  } catch (err) {\n    const { GithubWebhookMensagens } = await import('@core/messages');\n    const { messages: msgs } = await import('@core/messages');\n    msgs.log.aviso(GithubWebhookMensagens.reviewCommentsNoPR(err instanceof Error ? err.message : String(err)));\n  }\n}\n\nfunction rotuloSeveridade(nivel?: string): string {\n  const nivelNormalizado = (nivel || 'info').toLowerCase();\n  if (nivelNormalizado === 'erro') return 'Erro';\n  if (nivelNormalizado === 'aviso') return 'Aviso';\n  return 'Info';\n}\n\nexport async function executarAnalisePullRequest(\n  app: App,\n  params: PullRequestAnalysisParams\n): Promise<void> {\n  if (params.headRef.startsWith(PREFIXO_BRANCH_RELATORIO)) return;\n\n  const config = obterConfigInstalacao(params.installationId);\n  if (!config.pullRequestAnalysisEnabled) return;\n\n  const { resultado, ctx, cleanup } = await rodarAnaliseCodigo(app, {\n    installationId: params.installationId,\n    owner: params.owner,\n    repo: params.repo,\n    headSha: params.headSha,\n    branch: params.headRef,\n    commitMessage: params.prTitle,\n    baseSha: params.baseSha,\n    incremental: config.incrementalOnPush\n  });\n\n  const octokit = await app.getInstallationOctokit(params.installationId);\n\n  try {\n    const ctxPr = { ...ctx, baseRef: params.baseRef, prNumber: params.prNumber };\n    const relatorioCompleto = gerarRelatorioMarkdown(resultado, ctxPr);\n\n    const corpoAnalise = gerarCorpoPrAnalise(resultado, ctxPr);\n    await octokit.request('PATCH /repos/{owner}/{repo}/pulls/{pull_number}', {\n      owner: params.owner,\n      repo: params.repo,\n      pull_number: params.prNumber,\n      body: corpoAnalise\n    });\n\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner: params.owner,\n      repo: params.repo,\n      issue_number: params.prNumber,\n      body: gerarComentarioPrAnalise(resultado, ctxPr, relatorioCompleto)\n    });\n\n    await publicarReviewComentarios(\n      octokit,\n      params.owner,\n      params.repo,\n      params.prNumber,\n      params.headSha,\n      resultado.ocorrencias\n    );\n\n    statsStore.recordAnalysis({\n      repository: `${params.owner}/${params.repo}`,\n      event: 'pull_request',\n      score: resultado.scoreGeral,\n      workflowsCount: 0,\n      occurrencesCount: resultado.totalOcorrencias\n    });\n  } finally {\n    cleanup();\n  }\n}\n"]}

package/dist/app/github/push-analysis/push-analysis-service.d.ts

@@ -0,0 +1,5 @@
+import type { App } from '@octokit/app';
+import type { PushAnalysisParams } from '../../../types/github/app.js';
+export type { PushAnalysisParams };
+export declare function executarAnalisePush(app: App, params: PushAnalysisParams): Promise<void>;
+//# sourceMappingURL=push-analysis-service.d.ts.map

package/dist/app/github/push-analysis/push-analysis-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-analysis-service.d.ts","sourceRoot":"","sources":["../../../../src/app/github/push-analysis/push-analysis-service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAsB,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAa3F,YAAY,EAAE,kBAAkB,EAAE,CAAC;AAsGnC,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgI7F"}