@oondemand/oon-core-back 0.7.17 → 0.7.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.7.17",
+  "version": "0.7.20",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/api/access.routes.js

@@ -103,6 +103,12 @@ router.get("/role-catalog", (_req, res) => {
   res.json(publicRoleCatalog());
 });
 
+// F5.2: métricas de uso declaradas no central.app.json.
+router.get("/usage-metrics", (_req, res) => {
+  res.set("Cache-Control", "public, max-age=300");
+  res.json(require("../manifest/usageMetrics").publicUsageMetrics(require("../core/context").config));
+});
+
 router.get("/rbac", (_req, res) => {
   res.json(publicPolicy());
 });

package/src/api/activation.routes.js

@@ -25,29 +25,12 @@ const {
   event,
 } = require("../core/utils/instanceActivation");
 const { getAppCode, getBaseUrl } = require("../core/utils/activationProvider");
+const { createActivationRateLimit } = require("./activationRateLimit");
 
 const router = express.Router();
-const attempts = new Map();
 const DEV_LOCAL_PATH = "/integracao/dev-local/ativar-central";
 
-function rateLimit(req, res, next) {
-  const key = req.ip || "local";
-  const now = Date.now();
-  const list = (attempts.get(key) || []).filter((time) => now - time < 60000);
-
-  if (list.length >= 30) {
-    return res.status(429).json({
-      error: {
-        code: "RATE_LIMIT",
-        message: "Muitas tentativas de ativação.",
-      },
-    });
-  }
-
-  list.push(now);
-  attempts.set(key, list);
-  next();
-}
+const rateLimit = createActivationRateLimit();
 
 function assertMember() {
   if (role() === "root") {

package/src/api/activationRateLimit.js

@@ -0,0 +1,84 @@
+"use strict";
+
+const mongoose = require("../core/database/mongoose");
+
+/**
+ * Limite de tentativas nas rotas de ativação: `limit` requisições por IP a
+ * cada janela fixa de `windowMs`.
+ *
+ * O contador fica no MongoDB para valer para o App inteiro: com o contador em
+ * memória, cada réplica tinha o seu e o limite real virava `limit × réplicas`.
+ * Sem conexão com o banco (boot, queda), usa o contador em memória do processo
+ * para não bloquear a ativação.
+ */
+const COLLECTION = "oon_activation_attempts";
+
+function createActivationRateLimit({
+  limit = 30,
+  windowMs = 60000,
+  now = () => Date.now(),
+  connection = () => mongoose.connection,
+} = {}) {
+  const memory = new Map();
+  let indexReady = null;
+
+  function memoryCount(key, windowStart) {
+    const current = memory.get(key);
+    const next = current && current.windowStart === windowStart ? current.count + 1 : 1;
+    memory.set(key, { windowStart, count: next });
+    if (memory.size > 10000) {
+      for (const [entryKey, entry] of memory) if (entry.windowStart !== windowStart) memory.delete(entryKey);
+    }
+    return next;
+  }
+
+  async function sharedCount(db, key, windowStart) {
+    const collection = db.collection(COLLECTION);
+    if (!indexReady) {
+      indexReady = collection.createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 }).catch((error) => {
+        indexReady = null;
+        throw error;
+      });
+    }
+    await indexReady;
+    const result = await collection.findOneAndUpdate(
+      { _id: `${key}:${windowStart}` },
+      { $inc: { count: 1 }, $setOnInsert: { expiresAt: new Date(windowStart + windowMs * 2) } },
+      { upsert: true, returnDocument: "after", maxTimeMS: 2000 },
+    );
+    const doc = result && Object.hasOwn(result, "value") ? result.value : result;
+    return Number(doc?.count || 1);
+  }
+
+  async function count(key) {
+    const windowStart = Math.floor(now() / windowMs) * windowMs;
+    const db = connection();
+    if (db?.readyState === 1) {
+      try {
+        return await sharedCount(db, key, windowStart);
+      } catch (error) {
+        console.warn(`[OonCore] Limite de ativação usando contador local: ${error?.message || error}`);
+      }
+    }
+    return memoryCount(key, windowStart);
+  }
+
+  return async function activationRateLimit(req, res, next) {
+    try {
+      const attempts = await count(req.ip || "local");
+      if (attempts > limit) {
+        return res.status(429).json({
+          error: {
+            code: "RATE_LIMIT",
+            message: "Muitas tentativas de ativação.",
+          },
+        });
+      }
+      return next();
+    } catch (error) {
+      return next(error);
+    }
+  };
+}
+
+module.exports = { createActivationRateLimit, COLLECTION };

package/src/boot/database.js

@@ -1,7 +1,7 @@
 const mongoose = require("../core/database/mongoose");
 const registry = require("../core/registry");
 const ctx = require("../core/context");
-const { DEFAULTS, poolOptions } = require("../core/database/policy");
+const { poolOptions, resolvePolicy } = require("../core/database/policy");
 const { attachPoolMetrics } = require("../core/database/metrics");
 
 function buildMongoUri() {
@@ -23,7 +23,7 @@ function buildMongoUri() {
 }
 
 function connectionOptions() {
-  const pool = poolOptions();
+  const pool = poolOptions(resolvePolicy().policy);
   if (process.env.MONGO_URI) return pool;
 
   const hasUser = Boolean(process.env.DB_USER);
@@ -49,24 +49,55 @@ function databaseLabel(uri) {
   }
 }
 
+/**
+ * Modo da sincronização de índices no boot (`OON_SYNC_INDEXES`):
+ * - `create` (padrão; também `true`): só cria os índices declarados que faltam
+ *   e informa os obsoletos sem removê-los. Seguro com várias réplicas subindo
+ *   juntas e durante o rolling update, quando a versão anterior ainda está no
+ *   ar e pode depender de um índice que a nova versão não declara mais.
+ * - `drop`: comportamento anterior (`syncIndexes`), que também remove os
+ *   obsoletos. Usar apenas de forma explícita, com uma única réplica no ar.
+ * - `false`: não sincroniza.
+ */
+function indexSyncMode() {
+  const value = String(process.env.OON_SYNC_INDEXES ?? "create").trim().toLowerCase();
+  if (value === "false") return "off";
+  if (value === "drop") return "drop";
+  return "create";
+}
+
 function shouldSyncDeclaredIndexes() {
-  return String(process.env.OON_SYNC_INDEXES ?? "true").toLowerCase() !== "false";
+  return indexSyncMode() !== "off";
 }
 
 async function syncDeclaredIndexes(entries = registry.listModels()) {
-  if (!shouldSyncDeclaredIndexes()) return [];
+  const mode = indexSyncMode();
+  if (mode === "off") return [];
 
   const results = [];
   for (const entry of entries) {
     const model = entry?.mongooseModel;
-    if (!model || typeof model.syncIndexes !== "function") continue;
-
-    const dropped = await model.syncIndexes();
-    const normalized = Array.isArray(dropped) ? dropped : [];
-    results.push({ model: entry.name, dropped: normalized });
+    if (!model) continue;
+
+    if (mode === "drop") {
+      if (typeof model.syncIndexes !== "function") continue;
+      const dropped = await model.syncIndexes();
+      const normalized = Array.isArray(dropped) ? dropped : [];
+      results.push({ model: entry.name, dropped: normalized, obsolete: [] });
+      if (normalized.length) {
+        console.log(`[OonCore] Índices obsoletos removidos de ${entry.name}: ${normalized.join(", ")}`);
+      }
+      continue;
+    }
 
-    if (normalized.length) {
-      console.log(`[OonCore] Índices obsoletos removidos de ${entry.name}: ${normalized.join(", ")}`);
+    if (typeof model.createIndexes !== "function") continue;
+    // createIndex é idempotente no MongoDB: réplicas simultâneas não conflitam.
+    await model.createIndexes();
+    const diff = typeof model.diffIndexes === "function" ? await model.diffIndexes() : null;
+    const obsolete = Array.isArray(diff?.toDrop) ? diff.toDrop : [];
+    results.push({ model: entry.name, dropped: [], obsolete });
+    if (obsolete.length) {
+      console.log(`[OonCore] Índices não declarados mantidos em ${entry.name}: ${obsolete.join(", ")} (remova com OON_SYNC_INDEXES=drop em uma janela com uma única réplica).`);
     }
   }
 
@@ -89,7 +120,8 @@ async function connectDB() {
     metrics?.dispose();
     throw error;
   }
-  console.log("[OonCore] database policy", JSON.stringify({ ...DEFAULTS, uncoveredModels: Object.values(mongoose.models).filter(model => !model.schema[Symbol.for("oon.database.policy.schema.v1")]).length }));
+  const { mode, policy } = resolvePolicy();
+  console.log("[OonCore] database policy", JSON.stringify({ performanceMode: mode, ...policy, uncoveredModels: Object.values(mongoose.models).filter(model => !model.schema[Symbol.for("oon.database.policy.schema.v1")]).length }));
   await syncDeclaredIndexes();
   console.log(`Conectado ao MongoDB (${databaseLabel(uri)})`);
   return mongoose.connection;
@@ -100,6 +132,7 @@ module.exports = {
   buildMongoUri,
   connectionOptions,
   databaseLabel,
+  indexSyncMode,
   shouldSyncDeclaredIndexes,
   syncDeclaredIndexes,
 };

package/src/boot/gracefulShutdown.js

@@ -0,0 +1,64 @@
+"use strict";
+
+/**
+ * Desligamento sem perda para o servidor HTTP do runtime.
+ *
+ * Em deploy, escala ou exclusão de slot o Kubernetes envia SIGTERM. Sem este
+ * tratamento o processo morria na hora, cortando requisições em andamento e
+ * tarefas em segundo plano. Aqui o servidor para de aceitar conexões, espera as
+ * requisições em andamento (até `timeoutMs`), executa as etapas de drenagem em
+ * ordem e só então encerra o processo.
+ */
+function installGracefulShutdown(server, {
+  drain = [],
+  timeoutMs = Number(process.env.OON_SHUTDOWN_TIMEOUT_MS) || 15000,
+  signals = ["SIGTERM", "SIGINT"],
+  processRef = process,
+  log = console,
+} = {}) {
+  let shutting = null;
+
+  const closeServer = () => new Promise((resolve) => {
+    if (!server.listening) return resolve();
+    server.close(() => resolve());
+    // Conexões keep-alive ociosas não podem segurar o fechamento.
+    server.closeIdleConnections?.();
+  });
+
+  const shutdown = (signal) => {
+    if (shutting) return shutting;
+    log.log(`[OonCore] ${signal} recebido; encerrando sem aceitar novas requisições.`);
+    let timer;
+    const deadline = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        log.warn(`[OonCore] Encerramento excedeu ${timeoutMs} ms; conexões restantes serão fechadas.`);
+        server.closeAllConnections?.();
+        resolve("timeout");
+      }, timeoutMs);
+      timer.unref?.();
+    });
+    const graceful = (async () => {
+      await closeServer();
+      for (const step of drain) {
+        try {
+          await step();
+        } catch (error) {
+          log.error(`[OonCore] Falha ao drenar durante o encerramento: ${error?.message || error}`);
+        }
+      }
+      return "drained";
+    })();
+    shutting = Promise.race([graceful, deadline]).then((outcome) => {
+      clearTimeout(timer);
+      log.log(`[OonCore] Encerramento concluído (${outcome}).`);
+      processRef.exit(0);
+      return outcome;
+    });
+    return shutting;
+  };
+
+  for (const signal of signals) processRef.once(signal, () => { void shutdown(signal); });
+  return { shutdown };
+}
+
+module.exports = { installGracefulShutdown };

package/src/boot/startServer.js

@@ -3,6 +3,10 @@ const { connectDB } = require("./database");
 const { createApp } = require("./createApp");
 const { loadCentral } = require("./loadCentral");
 const transactionalEmail = require("../capabilities/transactionalEmail");
+const { startTenantDataPurges, stopTenantDataPurges } = require("../core/runtime/tenantDataPurge");
+const mongoose = require("../core/database/mongoose");
+const { startProcessJobs, stopProcessJobs } = require("../manifest/processRuntime");
+const { installGracefulShutdown } = require("./gracefulShutdown");
 const {
   isLocalRuntime,
   validateLocalRuntime,
@@ -14,12 +18,19 @@ const {
  * banco, monta a app e escuta a porta. É o `start` da API pública e o
  * alvo do `oonCore-back start`.
  *
- * @param {{ cwd?: string, listen?: boolean }} opts
+ * Com `handleSignals` (padrão), SIGTERM/SIGINT encerram sem perda: o servidor
+ * para de aceitar conexões, espera as requisições em andamento, para o worker
+ * de e-mail e o da fila de recálculo (as tarefas pendentes ficam no banco
+ * para outra réplica) e fecha o banco antes de sair.
+ *
+ * @param {{ cwd?: string, listen?: boolean, handleSignals?: boolean }} opts
  */
-async function start({ cwd = process.cwd(), listen = true } = {}) {
+async function start({ cwd = process.cwd(), listen = true, handleSignals = true } = {}) {
   loadCentral(cwd);
   await connectDB();
   await transactionalEmail.initialize();
+  startTenantDataPurges();
+  await startProcessJobs();
   const host = isLocalRuntime() ? "127.0.0.1" : undefined;
   validateLocalRuntime({ host: host || process.env.HOST || "127.0.0.1" });
   const localSession = isLocalRuntime() ? await prepareLocalDevelopmentSession() : null;
@@ -39,8 +50,20 @@ async function start({ cwd = process.cwd(), listen = true } = {}) {
       }
       console.log(`${ctx.config.serviceName} rodando na porta ${port} e conectado ao MongoDB`);
       console.log("****************************************************************");
-      const stop = () => transactionalEmail.stopWorker();
+      const stop = () => { transactionalEmail.stopWorker(); void stopTenantDataPurges(); };
       server.once("close", stop);
+      if (handleSignals) {
+        installGracefulShutdown(server, {
+          drain: [
+            () => transactionalEmail.stopWorker(),
+            () => stopProcessJobs(),
+            () => stopTenantDataPurges(),
+            // F5.3: o consumo ainda em memória vira lote na outbox antes de sair.
+            () => require("../core/usage/reporter").stop(),
+            () => mongoose.disconnect(),
+          ],
+        });
+      }
       resolve({ app, server });
     });
   });

package/src/capabilities/transactionalEmail/models.js

@@ -17,6 +17,8 @@ function getModels() {
   DispatchSchema.index({ status: 1, nextRetryAt: 1, leaseExpiresAt: 1 });
   return { Config: model("OonTransactionalEmailConfig", ConfigSchema, "oon_transactional_email_configs"), Template: model("OonEmailTemplate", TemplateSchema, "oon_email_templates"), Dispatch: model("OonEmailDispatch", DispatchSchema, "oon_email_dispatches") };
 }
-async function syncIndexes() { const models = getModels(); return Promise.all(Object.values(models).map((entry) => entry.syncIndexes())); }
+// Só cria índices que faltam: várias réplicas sobem juntas e a versão anterior
+// ainda pode estar no ar durante o rolling update.
+async function syncIndexes() { const models = getModels(); return Promise.all(Object.values(models).map((entry) => entry.createIndexes())); }
 module.exports = { getModels, syncIndexes };
 

package/src/capabilities/transactionalEmail/worker.js

@@ -10,13 +10,19 @@ const { renderTemplate } = require("./templates");
 const state = { running: false, owner: `${process.pid}:${crypto.randomUUID()}`, lastProgressAt: null, timer: null };
 function backoff(attempt) { const base = Math.min(3600000, 1000 * (2 ** Math.max(0, attempt - 1))); return base + Math.floor(Math.random() * Math.max(250, base * 0.2)); }
 async function lease() { const { Dispatch } = getModels(); const now = new Date(); return Dispatch.findOneAndUpdate({ status: { $in: ["accepted", "failed", "processing"] }, nextRetryAt: { $lte: now }, $or: [{ leaseExpiresAt: { $exists: false } }, { leaseExpiresAt: null }, { leaseExpiresAt: { $lte: now } }] }, { $set: { status: "processing", leaseOwner: state.owner, leaseExpiresAt: new Date(Date.now() + 60000) }, $inc: { attempts: 1 } }, { new: true, sort: { nextRetryAt: 1, createdAt: 1 } }); }
+// Com várias réplicas, um envio que passe do prazo do lease pode ser assumido
+// por outra réplica. Antes de enviar e ao gravar o resultado, a réplica
+// confirma que ainda é a dona do lease; se não for, desiste sem sobrescrever.
+async function stillOwned(Dispatch, dispatch) { return Boolean(await Dispatch.exists({ _id: dispatch._id, leaseOwner: state.owner, leaseExpiresAt: { $gt: new Date() } })); }
+async function saveIfOwned(Dispatch, dispatch) { const result = await Dispatch.updateOne({ _id: dispatch._id, leaseOwner: state.owner }, dispatch.getChanges()); return Number(result?.matchedCount ?? result?.n ?? 0) > 0; }
 async function processOne() {
   const dispatch = await lease(); if (!dispatch) return false;
-  const { Template } = getModels();
+  const { Template, Dispatch } = getModels();
   try {
     const config = await configuration({ appCode: dispatch.scopeKey.split(":")[1], tenantId: dispatch.scopeKey.includes(":tenant:") ? dispatch.scopeKey.split(":tenant:")[1] : undefined });
     const template = await Template.findOne({ scopeKey: dispatch.scopeKey, code: dispatch.templateCode, version: dispatch.templateVersion }).lean();
     const payload = secrets.decrypt(dispatch.protectedPayload); const rendered = renderTemplate(template, payload.variables); const apiKey = secrets.decrypt(config.encryptedEnvelope);
+    if (!await stillOwned(Dispatch, dispatch)) { console.warn(JSON.stringify({ event: "transactionalEmail.worker.lease_lost", stage: "before_send" })); return true; }
     const result = await providers.sendgrid.send({ to: payload.to, from: { email: config.senderEmail, name: config.senderName }, replyTo: config.replyTo, ...rendered }, apiKey);
     dispatch.status = "provider_accepted"; dispatch.providerMessageId = result.providerMessageId; dispatch.sentAt = new Date(); dispatch.leaseOwner = undefined; dispatch.leaseExpiresAt = undefined; dispatch.lastError = undefined;
   } catch (error) {
@@ -24,7 +30,8 @@ async function processOne() {
     if (normalized.retryable && dispatch.attempts < dispatch.maxAttempts) { dispatch.status = "failed"; dispatch.nextRetryAt = new Date(Date.now() + backoff(dispatch.attempts)); }
     else { dispatch.status = "dead_letter"; dispatch.failedAt = new Date(); }
   }
-  await dispatch.save(); state.lastProgressAt = new Date(); return true;
+  if (!await saveIfOwned(Dispatch, dispatch)) console.warn(JSON.stringify({ event: "transactionalEmail.worker.lease_lost", stage: "save" }));
+  state.lastProgressAt = new Date(); return true;
 }
 async function scrubExpired() { const { Dispatch } = getModels(); await Dispatch.updateMany({ payloadExpiresAt: { $lte: new Date() }, status: { $in: ["provider_accepted", "dead_letter", "cancelled"] } }, { $unset: { protectedPayload: 1 } }); }
 async function tick() { if (!state.running) return; try { let count = 0; while (state.running && count < 20 && await processOne()) count += 1; if (Math.random() < 0.05) await scrubExpired(); } catch (error) { console.error(JSON.stringify({ event: "transactionalEmail.worker.failed", code: error?.code || "EMAIL_WORKER_FAILED" })); } finally { if (state.running) state.timer = setTimeout(tick, 1000); } }

package/src/core/database/policy.js

@@ -10,6 +10,11 @@ const DEFAULTS = Object.freeze({
   maxTimeMS: 5000,
 });
 
+// F4.2: modo de performance por ambiente, escolhido pela plataforma (contexto
+// de delivery → OON_DB_PERFORMANCE_MODE). Só altera maxPoolSize, entre perfis
+// fixos; maxConnecting fica em 2 para limitar a abertura simultânea de conexões.
+const PERFORMANCE_MODES = Object.freeze({ min: 4, normal: 8, ultra: 16 });
+
 function configurationError() {
   const error = new Error("Política de contenção MongoDB inválida.");
   error.code = "DATABASE_POLICY_INVALID";
@@ -32,10 +37,21 @@ function poolOptions(policy = DEFAULTS) {
   return pool;
 }
 
+function performancePolicy(mode = "min") {
+  if (!Object.hasOwn(PERFORMANCE_MODES, mode)) throw configurationError();
+  return validatePolicy({ maxPoolSize: PERFORMANCE_MODES[mode] });
+}
+
+/** Política do processo: o modo vem do ambiente (padrão `min`, a contenção atual). */
+function resolvePolicy(env = process.env) {
+  const mode = env.OON_DB_PERFORMANCE_MODE === undefined || env.OON_DB_PERFORMANCE_MODE === "" ? "min" : env.OON_DB_PERFORMANCE_MODE;
+  return { mode, policy: performancePolicy(mode) };
+}
+
 function boundedMaxTimeMS(value, ceiling = DEFAULTS.maxTimeMS) {
   if (value === undefined || value === 0) return ceiling;
   if (!Number.isSafeInteger(value) || value < 0) throw configurationError();
   return Math.min(value, ceiling);
 }
 
-module.exports = { DEFAULTS, validatePolicy, poolOptions, boundedMaxTimeMS };
+module.exports = { DEFAULTS, PERFORMANCE_MODES, validatePolicy, poolOptions, performancePolicy, resolvePolicy, boundedMaxTimeMS };

package/src/core/middlewares/auth.js

@@ -137,6 +137,23 @@ async function applyEffectiveAccess(usuario) {
       rbacMode: "app-commercial", commercialAccess: { ...authority,
         roleComplete: !local.includes("*") && local.every(p => permissions.includes(p)) } };
   }
+  if (usuario?.integrationAccess && typeof ctx.config.auth?.verifyToken !== "function") {
+    // F4.4: token de integração validado pela Central. Recebe as permissões do
+    // perfil do RBAC do App, sem perfis administrativos nem permissões de
+    // gestão de tenant, usuários, perfis ou publicação.
+    const source = usuario.integrationAccess;
+    const role = roleByCode(source.roleCode);
+    if (!source.tokenId || source.tenantId !== usuario.tenantId || !role) {
+      throw Object.assign(Error("Token de integração inválido."), { statusCode: 403, code: "INTEGRATION_ACCESS_INVALID" });
+    }
+    const local = rolePermissions(role);
+    if (role.admin === true || local.includes("*")) {
+      throw Object.assign(Error("Perfis administrativos não podem ser usados por tokens de integração."), { statusCode: 403, code: "INTEGRATION_ROLE_NOT_ALLOWED" });
+    }
+    const permissions = local.filter((permission) => !/^(tenant|publications|homologation|production|apps|users|roles)\./.test(permission));
+    return { ...usuario, tipo: "integracao", perfil: role.code, roleCode: role.code, permissions, accessStatus: "active",
+      mustChangePassword: false, firstAccessPending: false, rbacMode: "integration-token" };
+  }
   if (usuario?.canonicalAccess && typeof ctx.config.auth?.verifyToken !== "function") {
     const source = usuario.canonicalAccess;
     const role = roleByCode(source.roleCode);

package/src/core/runtime/tenantDataPurge.js

@@ -0,0 +1,166 @@
+"use strict";
+
+/**
+ * Exclusão dos dados de uma organização cuja licença do App terminou há mais
+ * de 30 dias (F1.5). A Central decide o que é devido; o runtime só executa o
+ * que ela entrega, autenticado pela credencial do deployment.
+ *
+ * Escopos:
+ * - `tenant` (App multi-tenant, runtime compartilhado): apaga os documentos
+ *   com o tenantId da organização nos models com escopo `tenant` ou `user`, e
+ *   os e-mails transacionais desse tenant. Models `system`/`legacy`, que não
+ *   identificam a organização, ficam intactos e saem no relatório.
+ * - `full` (App single-tenant, runtime dedicado): apaga os documentos de todos
+ *   os models do App, exceto os de escopo `system` (configuração do App), além
+ *   dos e-mails transacionais e dos segredos do runtime. O runtime continua no
+ *   ar para o próximo licenciamento.
+ *
+ * Só uma réplica executa por vez (trava no MongoDB).
+ */
+const crypto = require("node:crypto");
+const axios = require("axios");
+const mongoose = require("../database/mongoose");
+const registry = require("../registry");
+const ctx = require("../context");
+const { dataScope, tenantField } = require("../tenancy");
+const { getBaseUrl, getTimeout } = require("../utils/activationProvider");
+const { operationalRequestHeaders } = require("../utils/instanceActivation");
+const { isLocalRuntime } = require("./localDevelopment");
+
+const PURGES_PATH = "/integracao/runtime/data-purges";
+const LOCKS = "oon_runtime_locks";
+const LOCK_ID = "tenant-data-purge";
+const LOCK_MS = 30 * 60 * 1000;
+const DEFAULT_INTERVAL_MS = 6 * 60 * 60 * 1000;
+const EMAIL_DISPATCHES = "oon_email_dispatches";
+const SECRETS = "oon_secrets";
+
+const state = { owner: `${process.pid}:${crypto.randomUUID()}`, timer: null, running: false, inFlight: null };
+
+function hasField(entry, field) {
+  return Boolean(entry?.mongooseModel?.schema?.path?.(field));
+}
+
+async function executePurge({ scope, tenantId }, { entries = registry.listModels(), connection = mongoose.connection } = {}) {
+  if (!["tenant", "full"].includes(scope)) throw new Error(`Escopo de exclusão inválido: ${scope}`);
+  if (scope === "tenant" && !tenantId) throw new Error("Exclusão por organização exige tenantId.");
+  const deleted = {};
+  const skipped = [];
+  for (const entry of entries) {
+    const model = entry?.mongooseModel;
+    if (!model) continue;
+    const kind = dataScope(entry);
+    let filter = null;
+    if (scope === "full") {
+      if (kind !== "system") filter = {};
+    } else if (["tenant", "user"].includes(kind) && hasField(entry, tenantField(entry))) {
+      filter = { [tenantField(entry)]: tenantId };
+    }
+    if (!filter) { skipped.push(entry.name); continue; }
+    // eslint-disable-next-line no-await-in-loop
+    const result = await model.deleteMany(filter);
+    deleted[entry.name] = Number(result?.deletedCount || 0);
+  }
+  const emails = connection.collection(EMAIL_DISPATCHES);
+  const emailFilter = scope === "full" ? {} : { scopeKey: { $regex: `:tenant:${String(tenantId).replace(/[^A-Za-z0-9_-]/g, "")}$` } };
+  deleted.emailDispatches = Number((await emails.deleteMany(emailFilter))?.deletedCount || 0);
+  if (scope === "full") {
+    deleted.secrets = Number((await connection.collection(SECRETS).deleteMany({}))?.deletedCount || 0);
+  }
+  return { deleted, skipped };
+}
+
+async function acquireLock(connection) {
+  const locks = connection.collection(LOCKS);
+  const expiresAt = new Date(Date.now() + LOCK_MS);
+  try {
+    await locks.insertOne({ _id: LOCK_ID, owner: state.owner, expiresAt });
+    return true;
+  } catch (error) {
+    if (error?.code !== 11000) throw error;
+  }
+  const result = await locks.updateOne({ _id: LOCK_ID, expiresAt: { $lte: new Date() } }, { $set: { owner: state.owner, expiresAt } });
+  return Number(result?.modifiedCount || 0) > 0;
+}
+
+async function releaseLock(connection) {
+  await connection.collection(LOCKS).deleteOne({ _id: LOCK_ID, owner: state.owner });
+}
+
+async function runOnce({
+  http = axios,
+  connection = mongoose.connection,
+  headers = () => operationalRequestHeaders({}),
+  baseUrl = () => getBaseUrl(),
+  execute = executePurge,
+  log = console,
+} = {}) {
+  if (connection?.readyState !== 1) return { skipped: "database_unavailable" };
+  if (!await acquireLock(connection)) return { skipped: "locked" };
+  try {
+    const requestHeaders = await headers();
+    const base = baseUrl();
+    const response = await http.get(`${base}${PURGES_PATH}`, { headers: requestHeaders, timeout: getTimeout(), maxRedirects: 0 });
+    const purges = Array.isArray(response?.data?.purges) ? response.data.purges : [];
+    const results = [];
+    for (const purge of purges) {
+      let body;
+      try {
+        // eslint-disable-next-line no-await-in-loop
+        const report = await execute({ scope: purge.scope, tenantId: purge.tenantId }, { connection });
+        body = { ok: true, report };
+        log.log(`[OonCore] Dados da organização ${purge.tenantId} excluídos (${purge.scope}).`);
+      } catch (error) {
+        body = { ok: false, error: String(error?.message || error).slice(0, 500) };
+        log.error(`[OonCore] Falha ao excluir dados da organização ${purge.tenantId}: ${body.error}`);
+      }
+      // eslint-disable-next-line no-await-in-loop
+      await http.post(`${base}${PURGES_PATH}/${encodeURIComponent(purge.id)}/complete`, body, { headers: requestHeaders, timeout: getTimeout(), maxRedirects: 0 });
+      results.push({ id: purge.id, ok: body.ok });
+    }
+    return { processed: results };
+  } finally {
+    await releaseLock(connection);
+  }
+}
+
+function intervalMs() {
+  const value = Number(process.env.OON_DATA_PURGE_INTERVAL_MS);
+  return Number.isSafeInteger(value) && value >= 60000 ? value : DEFAULT_INTERVAL_MS;
+}
+
+function enabled() {
+  if (isLocalRuntime()) return false;
+  if (String(process.env.OON_DATA_PURGE || "true").toLowerCase() === "false") return false;
+  // A própria Central (root) e Apps globais não recebem licenças de organizações.
+  if (ctx.config.ecosystem?.role === "root") return false;
+  const tenancy = ctx.config.tenancyModel || ctx.config.ecosystem?.tenancyModel;
+  return tenancy !== "none";
+}
+
+function schedule(delay) {
+  if (!state.running) return;
+  state.timer = setTimeout(() => {
+    state.inFlight = runOnce()
+      .catch((error) => console.warn(`[OonCore] Verificação de exclusões de dados falhou: ${error?.message || error}`))
+      .finally(() => { state.inFlight = null; schedule(intervalMs()); });
+  }, delay);
+  state.timer.unref?.();
+}
+
+function startTenantDataPurges() {
+  if (state.running || !enabled()) return false;
+  state.running = true;
+  // Primeira verificação alguns minutos após o boot, com variação entre réplicas.
+  schedule(120000 + Math.floor(Math.random() * 60000));
+  return true;
+}
+
+async function stopTenantDataPurges() {
+  state.running = false;
+  clearTimeout(state.timer);
+  state.timer = null;
+  if (state.inFlight) await state.inFlight;
+}
+
+module.exports = { executePurge, runOnce, startTenantDataPurges, stopTenantDataPurges, PURGES_PATH, LOCKS };