@oktis-works/plugin-runtime 0.5.6 → 0.5.8

package/dist/plugin-api.js

@@ -0,0 +1,174 @@
+// @oktis-works/plugin-runtime - PluginAPI completa (WP7 + WP8)
+//
+// Este módulo expõe uma fábrica `createPluginApi` que o core injeta com os
+// serviços reais (settings, eventBus, db, etc.). O plugin recebe um objeto
+// com métodos tipados; o runtime só conhece a interface (evita ciclo de dep).
+import { randomUUID } from 'node:crypto';
+/**
+ * Cria a PluginAPI real a partir das dependências do core.
+ * Chamado pelo core no bootstrap (não pelo plugin-runtime diretamente).
+ * Retorna { api: PluginAPI, internal: PluginApiInternal } para separar a API pública dos detalhes internos.
+ */
+export function createPluginApi(deps) {
+    const { hooks, manifest, settings, eventBus, db, getTenantId, getUserId, getTenantById, getUserById, allowedPermissions } = deps;
+    // Valida permissão antes de executar query
+    function checkDbPermission() {
+        if (!allowedPermissions.includes('db:query')) {
+            throw new Error('Plugin permission denied: db:query');
+        }
+    }
+    const registeredRoutes = [];
+    const registeredFields = [];
+    // Build the public API object
+    const api = {
+        registerHook(type, handler) {
+            /**
+             * Maps plugin lifecycle hook types to internal action names.
+             * These actions are fired by the core at the corresponding lifecycle events.
+             *
+             * @example
+             * // In plugin's register function:
+             * api.registerHook('onInstall', async (context, payload) => {
+             *   // Runs when plugin is installed
+             *   await context.api.query('CREATE TABLE IF NOT EXISTS my_plugin_data (...)');
+             * });
+             * api.registerHook('onActivate', async (context, payload) => {
+             *   // Runs when plugin is activated for a tenant
+             * });
+             * api.registerHook('beforeContentCreate', async (context, payload) => {
+             *   // Runs before content is created - can modify payload
+             *   payload.data.custom_field = 'value';
+             * });
+             *
+             * Mapping:
+             * - onInstall         -> plugin.install
+             * - onActivate        -> plugin.activate
+             * - onDeactivate      -> plugin.deactivate
+             * - onUninstall       -> plugin.uninstall
+             * - onSettingsPage    -> plugin.settings_page
+             * - onAdminMenu       -> okcms.admin.menu
+             * - beforeContentCreate  -> okcms.content.before-create
+             * - afterContentCreate   -> okcms.content.after-create
+             * - beforeContentUpdate  -> okcms.content.before-update
+             * - afterContentUpdate   -> okcms.content.after-update
+             * - beforeContentDelete  -> okcms.content.before-delete
+             * - afterContentDelete   -> okcms.content.after-delete
+             * - onContentPublish     -> okcms.content.published
+             * - onContentUnpublish   -> okcms.content.unpublished
+             */
+            const hookMap = {
+                'onInstall': 'plugin.install',
+                'onActivate': 'plugin.activate',
+                'onDeactivate': 'plugin.deactivate',
+                'onUninstall': 'plugin.uninstall',
+                'onSettingsPage': 'plugin.settings_page',
+                'onAdminMenu': 'okcms.admin.menu',
+                'beforeContentCreate': 'okcms.content.before-create',
+                'afterContentCreate': 'okcms.content.after-create',
+                'beforeContentUpdate': 'okcms.content.before-update',
+                'afterContentUpdate': 'okcms.content.after-update',
+                'beforeContentDelete': 'okcms.content.before-delete',
+                'afterContentDelete': 'okcms.content.after-delete',
+                'onContentPublish': 'okcms.content.published',
+                'onContentUnpublish': 'okcms.content.unpublished',
+            };
+            const hookName = hookMap[type];
+            if (!hookName) {
+                console.warn(`[PluginAPI] Hook type "${type}" não mapeado — ignorado`);
+                return;
+            }
+            hooks.addAction(hookName, async (...args) => {
+                const [context, payload] = args;
+                await handler(context, payload);
+            }, { sourceId: manifest.name, sourceType: 'plugin' });
+        },
+        addRoute(route) {
+            if (route.requiredPermissions) {
+                for (const perm of route.requiredPermissions) {
+                    if (!allowedPermissions.includes(perm)) {
+                        throw new Error(`Plugin route permission denied: ${perm}`);
+                    }
+                }
+            }
+            registeredRoutes.push(route);
+        },
+        addContentField(field) {
+            registeredFields.push(field);
+        },
+        async getSetting(key, group) {
+            if (!allowedPermissions.includes('settings:read')) {
+                throw new Error('Plugin permission denied: settings:read');
+            }
+            const fullKey = group ? `${group}.${key}` : key;
+            return settings.get(fullKey);
+        },
+        async setSetting(key, value, group) {
+            if (!allowedPermissions.includes('settings:write')) {
+                throw new Error('Plugin permission denied: settings:write');
+            }
+            const fullKey = group ? `${group}.${key}` : key;
+            return settings.set(fullKey, value);
+        },
+        async getTenant() {
+            const tenantId = getTenantId();
+            if (!tenantId)
+                throw new Error('No tenant context');
+            const tenant = await getTenantById(tenantId);
+            if (!tenant)
+                throw new Error('Tenant not found');
+            return tenant;
+        },
+        async getUser() {
+            const userId = getUserId();
+            if (!userId)
+                throw new Error('No user context');
+            const user = await getUserById(userId);
+            if (!user)
+                throw new Error('User not found');
+            return user;
+        },
+        async query(sql, params) {
+            checkDbPermission();
+            return db.query(sql, params);
+        },
+        async emit(eventType, payload) {
+            if (!allowedPermissions.includes('events:emit')) {
+                throw new Error('Plugin permission denied: events:emit');
+            }
+            return eventBus.emit({ type: eventType, payload, id: randomUUID(), aggregateType: 'plugin', aggregateId: '', processed: false, createdAt: new Date() });
+        },
+        // Hooks WordPress-style (delegam para o registry)
+        addAction(action, callback, options) {
+            hooks.addAction(action, callback, { ...options, sourceId: manifest.name, sourceType: 'plugin' });
+        },
+        addFilter(filter, callback, options) {
+            hooks.addFilter(filter, callback, { ...options, sourceId: manifest.name, sourceType: 'plugin' });
+        },
+        removeAction(action, callback, priority) {
+            return hooks.removeAction(action, callback, priority);
+        },
+        removeFilter(filter, callback, priority) {
+            return hooks.removeFilter(filter, callback, priority);
+        },
+        hasAction(action, callback) {
+            return hooks.hasAction(action, callback);
+        },
+        hasFilter(filter, callback) {
+            return hooks.hasFilter(filter, callback);
+        },
+        didAction(action) {
+            return hooks.didAction(action);
+        },
+        currentHook() {
+            return hooks.getCurrentHook();
+        },
+    };
+    return {
+        api,
+        internal: {
+            getRoutes: () => registeredRoutes,
+            getFields: () => registeredFields,
+        },
+    };
+}
+//# sourceMappingURL=plugin-api.js.map

package/dist/plugin-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-api.js","sourceRoot":"","sources":["../src/plugin-api.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAE9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2HzC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAA2B;IACzD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAEjI,2CAA2C;IAC3C,SAAS,iBAAiB;QACxB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,MAAM,gBAAgB,GAAgH,EAAE,CAAC;IAEzI,8BAA8B;IAC9B,MAAM,GAAG,GAAc;QACrB,YAAY,CAAC,IAAY,EAAE,OAA2E;YACpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAiCG;YACH,MAAM,OAAO,GAA2B;gBACtC,WAAW,EAAE,gBAAgB;gBAC7B,YAAY,EAAE,iBAAiB;gBAC/B,cAAc,EAAE,mBAAmB;gBACnC,aAAa,EAAE,kBAAkB;gBACjC,gBAAgB,EAAE,sBAAsB;gBACxC,aAAa,EAAE,kBAAkB;gBACjC,qBAAqB,EAAE,6BAA6B;gBACpD,oBAAoB,EAAE,4BAA4B;gBAClD,qBAAqB,EAAE,6BAA6B;gBACpD,oBAAoB,EAAE,4BAA4B;gBAClD,qBAAqB,EAAE,6BAA6B;gBACpD,oBAAoB,EAAE,4BAA4B;gBAClD,kBAAkB,EAAE,yBAAyB;gBAC7C,oBAAoB,EAAE,2BAA2B;aAClD,CAAC;YACF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,0BAA0B,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;gBACrD,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,IAAgC,CAAC;gBAC5D,MAAM,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,QAAQ,CAAC,KAAsB;YAC7B,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;oBAC7D,CAAC;gBACH,CAAC;YACH,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,eAAe,CAAC,KAA2G;YACzH,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,KAAc;YAC1C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAChD,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,KAAc,EAAE,KAAc;YAC1D,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAChD,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,SAAS;YACb,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACjD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,OAAO;YACX,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,MAAkB;YACzC,iBAAiB,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,OAAgC;YAC5D,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1J,CAAC;QAED,kDAAkD;QAClD,SAAS,CAAC,MAAc,EAAE,QAAyC,EAAE,OAAsD;YACzH,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,SAAS,CAAC,MAAc,EAAE,QAAyD,EAAE,OAAsD;YACzI,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,YAAY,CAAC,MAAc,EAAE,QAAyC,EAAE,QAAiB;YACvF,OAAO,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;QACD,YAAY,CAAC,MAAc,EAAE,QAAyC,EAAE,QAAiB;YACvF,OAAO,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;QACD,SAAS,CAAC,MAAc,EAAE,QAA0C;YAClE,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QACD,SAAS,CAAC,MAAc,EAAE,QAA0C;YAClE,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QACD,SAAS,CAAC,MAAc;YACtB,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,WAAW;YACT,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;IAEF,OAAO;QACL,GAAG;QACH,QAAQ,EAAE;YACR,SAAS,EAAE,GAAG,EAAE,CAAC,gBAAgB;YACjC,SAAS,EAAE,GAAG,EAAE,CAAC,gBAAgB;SAClC;KACF,CAAC;AACJ,CAAC"}

package/dist/sandbox.d.ts

@@ -1,18 +1,38 @@
 import type { PluginManifest, PluginContext, PluginHookHandler, PluginAPI } from '@oktis-works/plugin-sdk';
 export interface SandboxConfig {
+    /** Timeout para callbacks de hook (ms). 0 = sem timeout. */
     timeoutMs: number;
-    maxMemoryMb: number;
+    /**
+     * **Política** de permissões concedidas (allowlist vinda de configuração /
+     * catálogo). Nunca o manifesto: passar as permissões do próprio manifesto
+     * aqui seria uma tautologia (aprovação garantida).
+     */
     allowedPermissions: string[];
 }
 export declare class PluginSandbox {
     private config;
     constructor(config?: Partial<SandboxConfig>);
     loadPlugin(manifest: PluginManifest, api: PluginAPI): LoadedPlugin;
-    /** BUSI plugin-style-isolation: bloqueia CSS global se plugin declarar style inline sem escopo */
+    /** BUSI plugin-style-isolation: CSS global sem escopo é escopado ao servir via scopePluginCss */
     private enforceStyleIsolation;
     executeHook(hookName: string, context: PluginContext, handler: PluginHookHandler, payload: unknown, pluginPermissions?: string[]): Promise<void>;
     callHandler<T>(handler: (...args: unknown[]) => T | Promise<T>, context: PluginContext, ...args: unknown[]): Promise<T>;
-    private withTimeout;
+    /**
+     * Aplica o timeout **no ponto real de execução** (registro do callback).
+     *
+     * - retorno síncrono → devolve o valor como está (semântica síncrona dos
+     *   filtros, DECI-026 — um `applyFilters` não pode virar Promise);
+     * - retorno assíncrono → corre contra o timeout (`timeoutMs`).
+     *
+     * Limite honesto: `Promise.race` não interrompe CPU síncrona; plugins
+     * custosos de bloco continuam travando o processo (isolamento real seria
+     * worker/processo separado).
+     */
+    wrapCallback<TArgs extends unknown[]>(fn: (...args: TArgs) => unknown): (...args: TArgs) => unknown;
+    /** Race Promise × timeout (API pública usada pelo bootstrap). */
+    withTimeout<T>(promise: Promise<T>): Promise<T>;
+    /** Política vigente (para testes/observabilidade). */
+    getPolicy(): SandboxConfig;
     private checkPermissions;
 }
 export interface LoadedPlugin {

package/dist/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE3G,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAQD,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAI/C,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,GAAG,YAAY;IAMlE,kGAAkG;IAClG,OAAO,CAAC,qBAAqB;IASvB,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,OAAO,EAChB,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAC3B,OAAO,CAAC,IAAI,CAAC;IAOV,WAAW,CAAC,CAAC,EACjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC/C,OAAO,EAAE,aAAa,EACtB,GAAG,IAAI,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,CAAC;YAIC,WAAW;IAczB,OAAO,CAAC,gBAAgB;CAOzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE3G,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAOD,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAI/C,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,GAAG,YAAY;IAMlE,iGAAiG;IACjG,OAAO,CAAC,qBAAqB;IAUvB,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,OAAO,EAChB,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAC3B,OAAO,CAAC,IAAI,CAAC;IAOV,WAAW,CAAC,CAAC,EACjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC/C,OAAO,EAAE,aAAa,EACtB,GAAG,IAAI,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,CAAC;IAIb;;;;;;;;;;OAUG;IACH,YAAY,CAAC,KAAK,SAAS,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO;IAWnG,iEAAiE;IAC3D,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAcrD,sDAAsD;IACtD,SAAS,IAAI,aAAa;IAI1B,OAAO,CAAC,gBAAgB;CAOzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/sandbox.js

@@ -1,6 +1,5 @@
 const defaultSandboxConfig = {
     timeoutMs: 5000,
-    maxMemoryMb: 128,
     allowedPermissions: [],
 };
 export class PluginSandbox {
@@ -13,13 +12,12 @@ export class PluginSandbox {
         this.enforceStyleIsolation(manifest);
         return { manifest, api, loaded: true, loadedAt: Date.now() };
     }
-    /** BUSI plugin-style-isolation: bloqueia CSS global se plugin declarar style inline sem escopo */
+    /** BUSI plugin-style-isolation: CSS global sem escopo é escopado ao servir via scopePluginCss */
     enforceStyleIsolation(manifest) {
         const anyManifest = manifest;
         const style = anyManifest['style'] ?? anyManifest['styles'];
         if (typeof style === 'string' && (style.includes(':root') || style.includes('html{') || style.includes('body{')) && !style.includes('data-plugin')) {
-            // apenas warn — escopo será aplicado em runtime via scopePluginCss
-            console.warn(`[sandbox] Plugin ${manifest.name} declara CSS global sem [data-plugin] — será escopado automaticamente`);
+            console.warn(`[sandbox] Plugin ${manifest.name} declara CSS global sem [data-plugin] — será escopado via scopePluginCss ao ser servido em /style.css`);
         }
     }
     async executeHook(hookName, context, handler, payload, pluginPermissions) {
@@ -31,6 +29,29 @@ export class PluginSandbox {
     async callHandler(handler, context, ...args) {
         return this.withTimeout(Promise.resolve(handler(context, ...args)));
     }
+    /**
+     * Aplica o timeout **no ponto real de execução** (registro do callback).
+     *
+     * - retorno síncrono → devolve o valor como está (semântica síncrona dos
+     *   filtros, DECI-026 — um `applyFilters` não pode virar Promise);
+     * - retorno assíncrono → corre contra o timeout (`timeoutMs`).
+     *
+     * Limite honesto: `Promise.race` não interrompe CPU síncrona; plugins
+     * custosos de bloco continuam travando o processo (isolamento real seria
+     * worker/processo separado).
+     */
+    wrapCallback(fn) {
+        if (this.config.timeoutMs <= 0)
+            return fn;
+        return (...args) => {
+            const result = fn(...args);
+            if (result && typeof result.then === 'function') {
+                return this.withTimeout(result);
+            }
+            return result;
+        };
+    }
+    /** Race Promise × timeout (API pública usada pelo bootstrap). */
     async withTimeout(promise) {
         let timer;
         try {
@@ -46,6 +67,10 @@ export class PluginSandbox {
                 clearTimeout(timer);
         }
     }
+    /** Política vigente (para testes/observabilidade). */
+    getPolicy() {
+        return { ...this.config };
+    }
     checkPermissions(permissions) {
         for (const permission of permissions) {
             if (!this.config.allowedPermissions.includes(permission)) {

package/dist/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAQA,MAAM,oBAAoB,GAAkB;IAC1C,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,GAAG;IAChB,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAEF,MAAM,OAAO,aAAa;IAChB,MAAM,CAAgB;IAE9B,YAAY,SAAiC,EAAE;QAC7C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,UAAU,CAAC,QAAwB,EAAE,GAAc;QACjD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC/D,CAAC;IAED,kGAAkG;IAC1F,qBAAqB,CAAC,QAAwB;QACpD,MAAM,WAAW,GAAG,QAA8C,CAAC;QACnE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACnJ,mEAAmE;YACnE,OAAO,CAAC,IAAI,CAAC,oBAAoB,QAAQ,CAAC,IAAI,uEAAuE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,QAAgB,EAChB,OAAsB,EACtB,OAA0B,EAC1B,OAAgB,EAChB,iBAA4B;QAE5B,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAA+C,EAC/C,OAAsB,EACtB,GAAG,IAAe;QAElB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,WAAW,CAAI,OAAmB;QAC9C,IAAI,KAAiC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;gBACxB,OAAO;gBACP,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC3B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnG,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,WAAqB;QAC5C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAaA,MAAM,oBAAoB,GAAkB;IAC1C,SAAS,EAAE,IAAI;IACf,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAEF,MAAM,OAAO,aAAa;IAChB,MAAM,CAAgB;IAE9B,YAAY,SAAiC,EAAE;QAC7C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,UAAU,CAAC,QAAwB,EAAE,GAAc;QACjD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC/D,CAAC;IAED,iGAAiG;IACzF,qBAAqB,CAAC,QAAwB;QACpD,MAAM,WAAW,GAAG,QAA8C,CAAC;QACnE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACnJ,OAAO,CAAC,IAAI,CACV,oBAAoB,QAAQ,CAAC,IAAI,uGAAuG,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,QAAgB,EAChB,OAAsB,EACtB,OAA0B,EAC1B,OAAgB,EAChB,iBAA4B;QAE5B,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAA+C,EAC/C,OAAsB,EACtB,GAAG,IAAe;QAElB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;;;OAUG;IACH,YAAY,CAA0B,EAA+B;QACnE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,IAAW,EAAW,EAAE;YACjC,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3B,IAAI,MAAM,IAAI,OAAQ,MAA+B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC1E,OAAO,IAAI,CAAC,WAAW,CAAC,MAA0B,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,WAAW,CAAI,OAAmB;QACtC,IAAI,KAAiC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;gBACxB,OAAO;gBACP,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC3B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnG,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAEO,gBAAgB,CAAC,WAAqB;QAC5C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oktis-works/plugin-runtime",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -17,8 +17,8 @@
   },
   "dependencies": {
     "@oktis-works/plugin-sdk": "^0.5.6",
-    "@oktis-works/types": "^0.5.5",
-    "@oktis-works/validation": "^0.5.5",
+    "@oktis-works/types": "^0.5.6",
+    "@oktis-works/validation": "^0.6.0",
     "semver": "7"
   },
   "devDependencies": {