wu-framework 1.1.16 → 1.1.18

package/src/core/wu-plugin.js

@@ -11,7 +11,7 @@ import { logger } from './wu-logger.js';
 
 
 export class WuPluginSystem {
-  constructor(core) {
+  constructor(core, options = {}) {
     this._core = core; // Privado - no expuesto a plugins
     this.plugins = new Map();
     this.hooks = new Map();
@@ -35,7 +35,7 @@ export class WuPluginSystem {
     ];
 
     // 🔐 Timeout para hooks (evita que plugins bloqueen)
-    this.hookTimeout = 5000; // 5 segundos
+    this.hookTimeout = options.hookTimeout || 5000; // Default: 5 segundos
 
     this.availableHooks.forEach(hook => {
       this.hooks.set(hook, []);
@@ -106,8 +106,61 @@ export class WuPluginSystem {
       logger.warn('[WuPlugin] ⚠️ Plugin has unsafe access to core!');
     }
 
-    // Congelar API para evitar modificaciones
-    return Object.freeze(api);
+    // Congelar API recursivamente para evitar modificaciones en cualquier nivel
+    return WuPluginSystem._deepFreeze(api);
+  }
+
+  /**
+   * Deep-freeze an object and all its nested plain objects and arrays.
+   * Functions, DOM nodes, and other non-plain types are left untouched
+   * so they remain callable / functional. A WeakSet guards against
+   * circular references.
+   *
+   * @param {*} obj - The value to deep-freeze
+   * @param {WeakSet} [seen] - Internal tracker for circular references
+   * @returns {*} The same object, now deeply frozen
+   */
+  static _deepFreeze(obj, seen) {
+    if (obj === null || obj === undefined) {
+      return obj;
+    }
+
+    // Only freeze plain objects and arrays.
+    // Functions must stay invocable; DOM nodes, class instances, etc.
+    // should not be tampered with.
+    const dominated = typeof obj === 'object';
+    if (!dominated) {
+      return obj;
+    }
+
+    const isPlainObject =
+      Object.getPrototypeOf(obj) === Object.prototype ||
+      Object.getPrototypeOf(obj) === null;
+    const isArray = Array.isArray(obj);
+
+    if (!isPlainObject && !isArray) {
+      return obj;
+    }
+
+    // Circular-reference guard
+    if (!seen) {
+      seen = new WeakSet();
+    }
+    if (seen.has(obj)) {
+      return obj;
+    }
+    seen.add(obj);
+
+    // Recurse into own enumerable properties
+    const keys = Object.keys(obj);
+    for (let i = 0; i < keys.length; i++) {
+      const value = obj[keys[i]];
+      if (value !== null && value !== undefined && typeof value === 'object') {
+        WuPluginSystem._deepFreeze(value, seen);
+      }
+    }
+
+    return Object.freeze(obj);
   }
 
   /**

package/src/core/wu-proxy-sandbox.js

@@ -13,8 +13,9 @@
 import { logger } from './wu-logger.js';
 
 export class WuProxySandbox {
-  constructor(appName) {
+  constructor(appName, options = {}) {
     this.appName = appName;
+    this.options = options;
     this.proxy = null;
     this.fakeWindow = Object.create(null);
     this.active = false;

package/src/core/wu-script-executor.js

@@ -15,6 +15,52 @@ import { logger } from './wu-logger.js';
 
 export class WuScriptExecutor {
 
+  /**
+   * Dangerous patterns that indicate prototype pollution, sandbox escape,
+   * or direct access to sensitive APIs. Each entry is a regex paired with
+   * a human-readable label used in error messages.
+   *
+   * This is a tripwire, not a full parser. It catches the most common
+   * attack vectors without the overhead of AST analysis.
+   */
+  static DANGEROUS_PATTERNS = [
+    // Prototype pollution vectors
+    { pattern: /constructor\s*\[\s*['"`]constructor['"`]\s*\]/, label: 'constructor chain access (sandbox escape)' },
+    { pattern: /__proto__/, label: '__proto__ access (prototype pollution)' },
+
+    // Sandbox escape via proxy introspection
+    { pattern: /Object\s*\.\s*getPrototypeOf\s*\(\s*proxy\s*\)/, label: 'Object.getPrototypeOf(proxy) (sandbox escape)' },
+
+    // Dynamic code generation that bypasses the sandbox
+    { pattern: /Function\s*\(\s*['"`]/, label: 'Function() constructor (dynamic code generation)' },
+    { pattern: /\beval\s*\(/, label: 'eval() (dynamic code execution)' },
+
+    // Dynamic import escapes the sandbox entirely (runs in global scope)
+    { pattern: /\bimport\s*\(/, label: 'import() (dynamic import escapes sandbox)' },
+
+    // Direct cookie access (should go through proxy traps, not raw document)
+    { pattern: /document\s*\.\s*cookie/, label: 'document.cookie (direct cookie access)' },
+  ];
+
+  /**
+   * Validate script text against known dangerous patterns before execution.
+   * Throws if any pattern matches. This is intentionally lightweight --
+   * pattern detection only, not a full parse.
+   *
+   * @param {string} scriptText - The raw script to validate
+   * @param {string} appName - App identifier (for error context)
+   * @throws {Error} If a dangerous pattern is detected
+   */
+  _validateScript(scriptText, appName) {
+    for (const { pattern, label } of WuScriptExecutor.DANGEROUS_PATTERNS) {
+      if (pattern.test(scriptText)) {
+        const msg = `[ScriptExecutor] Blocked dangerous pattern in "${appName}": ${label}`;
+        logger.wuError(msg);
+        throw new Error(msg);
+      }
+    }
+  }
+
   /**
    * Execute a script string inside the proxy sandbox.
    *
@@ -31,6 +77,8 @@ export class WuScriptExecutor {
 
     if (!scriptText || !scriptText.trim()) return;
 
+    this._validateScript(scriptText, appName);
+
     const sourceComment = sourceUrl ? `\n//# sourceURL=wu-sandbox:///${appName}/${sourceUrl}\n` : '';
 
     let wrappedCode;

package/src/core/wu-store.js

@@ -8,6 +8,15 @@
  * - API minimalista: get(), set(), on()
  */
 
+/**
+ * @typedef {Object} WuStoreMetrics
+ * @property {number} reads - Total read operations
+ * @property {number} writes - Total write operations
+ * @property {number} notifications - Total notifications sent
+ * @property {number} bufferUtilization - Ring buffer utilization (0-1)
+ * @property {number} listenerCount - Active listener count
+ */
+
 export class WuStore {
   constructor(bufferSize = 256) {
     // Ring Buffer configuration
@@ -63,8 +72,9 @@ export class WuStore {
   set(path, value) {
     this.metrics.writes++;
 
-    // Write to ring buffer (lock-free)
-    const sequence = this.cursor++;
+    // Write to ring buffer (lock-free, wraps at buffer boundary)
+    const sequence = this.cursor;
+    this.cursor = (this.cursor + 1) % (this.bufferSize * this.bufferSize);
     const index = sequence & this.mask;
 
     // Reuse buffer slot (zero allocation)
@@ -151,7 +161,7 @@ export class WuStore {
   getMetrics() {
     return {
       ...this.metrics,
-      bufferUtilization: (this.cursor % this.bufferSize) / this.bufferSize,
+      bufferUtilization: Math.min(1, this.cursor / this.bufferSize),
       listenerCount: this.listeners.size + this.patternListeners.size
     };
   }

package/src/index.d.ts

@@ -0,0 +1,317 @@
+// Wu Framework - Type Declarations
+
+// --- Core Types ---
+
+export interface WuEvent {
+  name: string;
+  data: any;
+  timestamp: number;
+  appName: string;
+  meta: Record<string, any>;
+  verified: boolean;
+}
+
+export interface WuAppConfig {
+  name: string;
+  url: string;
+  container?: string;
+  keepAlive?: boolean;
+  sandbox?: 'module' | 'strict' | 'eval';
+  styleMode?: 'shared' | 'isolated' | 'fully-isolated';
+}
+
+export interface WuLifecycle {
+  mount: (container: HTMLElement) => void | Promise<void>;
+  unmount?: (container: HTMLElement) => void | Promise<void>;
+}
+
+export interface WuPlugin {
+  name: string;
+  permissions?: Array<'mount' | 'events' | 'store' | 'apps' | 'config' | 'unsafe'>;
+  install?: (api: WuSandboxedApi, options?: any) => void;
+  uninstall?: (api: WuSandboxedApi) => void;
+  beforeInit?: (context: any) => void | Promise<void>;
+  afterInit?: (context: any) => void | Promise<void>;
+  beforeMount?: (context: any) => void | boolean | Promise<void | boolean>;
+  afterMount?: (context: any) => void | Promise<void>;
+  beforeUnmount?: (context: any) => void | Promise<void>;
+  afterUnmount?: (context: any) => void | Promise<void>;
+  onError?: (context: any) => void | Promise<void>;
+  onDestroy?: (context: any) => void | Promise<void>;
+}
+
+export interface WuSandboxedApi {
+  version: string;
+  info: { name: string; description: string; features: string[] };
+  getAppInfo(appName: string): { name: string; state: string; timestamp: number } | null;
+  getMountedApps(): string[];
+  getStats(): Record<string, any>;
+  emit?(event: string, data: any): boolean;
+  on?(event: string, cb: (event: WuEvent) => void): () => void;
+  off?(event: string, cb: (event: WuEvent) => void): void;
+  getState?(path: string): any;
+  setState?(path: string, value: any): number;
+  mount?(appName: string, container: string): Promise<void>;
+  unmount?(appName: string): Promise<void>;
+}
+
+// --- Core Classes ---
+
+export class WuCore {
+  apps: Map<string, any>;
+  mounted: Map<string, any>;
+  eventBus: WuEventBus;
+  store: WuStore;
+  pluginSystem: WuPluginSystem;
+  hooks: WuLifecycleHooks;
+  performance: WuPerformance;
+
+  init(config: { apps: WuAppConfig[]; sandbox?: string; overrides?: any }): Promise<void>;
+  mount(appName: string, containerSelector: string): Promise<void>;
+  unmount(appName: string, options?: { force?: boolean; defer?: boolean }): Promise<void>;
+  define(appName: string, lifecycle: WuLifecycle): void;
+  app(name: string, config: Partial<WuAppConfig>): WuApp;
+  hide(appName: string): Promise<void>;
+  show(appName: string): Promise<void>;
+  isHidden(appName: string): boolean;
+  destroy(): void;
+  getStats(): Record<string, any>;
+}
+
+export class WuEventBus {
+  constructor();
+  emit(eventName: string, data?: any, options?: { appName?: string; token?: string; meta?: any }): boolean;
+  on(eventName: string, callback: (event: WuEvent) => void): () => void;
+  once(eventName: string, callback: (event: WuEvent) => void): () => void;
+  off(eventName: string, callback: (event: WuEvent) => void): void;
+  registerApp(appName: string, options?: { permissions?: string[]; token?: string }): string;
+  unregisterApp(appName: string): void;
+  replay(eventNameOrPattern: string, callback: (event: WuEvent) => void): void;
+  enableStrictMode(): void;
+  disableStrictMode(): void;
+  removeAll(): void;
+  getStats(): Record<string, any>;
+  configure(config: Partial<Record<string, any>>): void;
+}
+
+export class WuStore {
+  constructor(bufferSize?: number);
+  get(path?: string): any;
+  set(path: string, value: any): number;
+  on(pattern: string, callback: (value: any, path?: string) => void): () => void;
+  batch(updates: Record<string, any>): number[];
+  clear(): void;
+  getMetrics(): { reads: number; writes: number; notifications: number; bufferUtilization: number; listenerCount: number };
+  getRecentEvents(count?: number): Array<{ path: string; value: any; timestamp: number }>;
+}
+
+export class WuLoader {
+  constructor(options?: { maxCacheSize?: number; cacheTTL?: number });
+  loadApp(appUrl: string, manifest?: any): Promise<string>;
+  loadComponent(appUrl: string, componentPath: string): Promise<any>;
+  preload(appConfigs: WuAppConfig[]): Promise<void>;
+  isAvailable(url: string): Promise<boolean>;
+  clearCache(pattern?: string): void;
+  getStats(): Record<string, any>;
+}
+
+export class WuSandbox {
+  create(appName: string, container: HTMLElement, options?: any): any;
+}
+
+export class WuManifest {
+  load(appUrl: string): Promise<any>;
+  validate(manifest: any): any;
+  create(name: string, config?: any): any;
+  clearCache(pattern?: string): void;
+}
+
+export class WuApp {
+  mount(): Promise<void>;
+  unmount(): Promise<void>;
+}
+
+export class WuCache {
+  constructor(options?: { maxSize?: number; maxItems?: number; defaultTTL?: number; persistent?: boolean; storage?: string });
+  get(key: string): any;
+  set(key: string, value: any, ttl?: number): boolean;
+  delete(key: string): void;
+  clear(): void;
+  getStats(): Record<string, any>;
+}
+
+export class WuPerformance {
+  startMeasure(name: string, appName?: string): void;
+  endMeasure(name: string, appName?: string): number;
+  generateReport(): Record<string, any>;
+}
+
+export class WuProxySandbox {
+  constructor(appName: string, options?: Record<string, any>);
+  activate(): any;
+  deactivate(): void;
+  patchWindow(): void;
+  unpatchWindow(): void;
+  setContainer(container: HTMLElement, shadowRoot: ShadowRoot): void;
+  getProxy(): any;
+  isActive(): boolean;
+  getStats(): Record<string, any>;
+}
+
+export class WuSnapshotSandbox {
+  constructor(appName: string);
+  activate(): void;
+  deactivate(): void;
+}
+
+export class WuHtmlParser {
+  parse(html: string, appName: string, baseUrl: string): { dom: string; scripts: { inline: string[]; external: string[] }; styles: { inline: string[]; external: string[] } };
+  fetchHtml(url: string, appName: string): Promise<string>;
+  fetchAndParse(url: string, appName: string): Promise<any>;
+  clearCache(): void;
+}
+
+export class WuScriptExecutor {
+  execute(scriptText: string, appName: string, proxy: any, options?: { strictGlobal?: boolean; sourceUrl?: string }): any;
+  fetchScript(url: string): Promise<string>;
+  executeAll(scripts: Array<{ content?: string; src?: string }>, appName: string, proxy: any, options?: any): Promise<void>;
+}
+
+export class WuIframeSandbox {
+  constructor();
+}
+
+export class WuPluginSystem {
+  constructor(core: WuCore, options?: { hookTimeout?: number });
+  use(plugin: WuPlugin | ((options?: any) => WuPlugin), options?: any): void;
+  uninstall(pluginName: string): void;
+  getPlugin(pluginName: string): WuPlugin | undefined;
+  getStats(): Record<string, any>;
+  cleanup(): void;
+}
+
+export class WuLoadingStrategy {
+  constructor(core: WuCore);
+}
+
+export class WuPrefetch {
+  constructor(core: WuCore);
+  prefetch(appNames: string | string[], options?: any): Promise<void>;
+  prefetchAll(options?: any): Promise<void>;
+}
+
+export class WuOverrides {
+  constructor();
+  set(name: string, url: string, options?: any): void;
+  remove(name: string): void;
+  getAll(): Record<string, string>;
+  clearAll(): void;
+}
+
+export class WuErrorBoundary {
+  constructor(core: WuCore);
+  handle(error: Error, context?: any): Promise<{ recovered: boolean; action: string; message?: string }>;
+  register(handler: { name: string; canHandle: (error: Error) => boolean; handle: (error: Error, context: any) => Promise<any> }): void;
+  getErrorLog(limit?: number): any[];
+  getStats(): Record<string, any>;
+}
+
+export class WuLifecycleHooks {
+  constructor(core: WuCore);
+  use(phase: string, middleware: Function, options?: any): void;
+  execute(phase: string, context?: any): Promise<{ cancelled: boolean }>;
+}
+
+export class WuStyleBridge {}
+
+// --- Hook Factories ---
+
+export function createSimpleHook(fn: Function): any;
+export function createConditionalHook(condition: Function, fn: Function): any;
+export function createGuardHook(fn: Function): any;
+export function createTransformHook(fn: Function): any;
+export function createTimedHook(fn: Function, timeout: number): any;
+export function createPlugin(config: WuPlugin): WuPlugin;
+
+// --- Convenience API ---
+
+export const wu: WuCore;
+export default wu;
+
+export function init(apps: WuAppConfig[]): Promise<void>;
+export function mount(name: string, container: string): Promise<void>;
+export function unmount(name: string, opts?: any): Promise<void>;
+export function define(name: string, lifecycle: WuLifecycle): void;
+export function app(name: string, config: Partial<WuAppConfig>): WuApp;
+export function destroy(): void;
+export function hide(name: string): Promise<void>;
+export function show(name: string): Promise<void>;
+export function isHidden(name: string): boolean;
+
+export function emit(event: string, data?: any, opts?: any): boolean;
+export function on(event: string, cb: (event: WuEvent) => void): () => void;
+export function once(event: string, cb: (event: WuEvent) => void): () => void;
+export function off(event: string, cb: (event: WuEvent) => void): void;
+
+export function getState(path?: string): any;
+export function setState(path: string, value: any): number;
+export function onStateChange(pattern: string, cb: (value: any) => void): () => void;
+
+export function startMeasure(name: string, app?: string): void;
+export function endMeasure(name: string, app?: string): number;
+export function generatePerformanceReport(): Record<string, any>;
+
+export function prefetch(appNames: string | string[], opts?: any): Promise<void>;
+export function prefetchAll(opts?: any): Promise<void>;
+
+export function override(name: string, url: string, opts?: any): void;
+export function removeOverride(name: string): void;
+export function getOverrides(): Record<string, string>;
+export function clearOverrides(): void;
+
+export function usePlugin(plugin: WuPlugin | Function, opts?: any): void;
+export function useHook(phase: string, middleware: Function, opts?: any): void;
+
+export function silenceAllLogs(): void;
+export function enableAllLogs(): void;
+
+// --- AI Classes ---
+
+export class WuAI {
+  provider(name: string, config: any): void;
+  send(message: string, options?: any): Promise<any>;
+  stream(message: string, options?: any): AsyncGenerator<any>;
+  json(message: string, options?: any): Promise<any>;
+  action(name: string, config: any): void;
+  agent(goal: string, options?: any): Promise<any>;
+}
+
+export class WuAIProvider {}
+export class WuAIPermissions {}
+export class WuAIContext {}
+export class WuAIActions {}
+export class WuAIConversation {}
+export class WuAITriggers {}
+export class WuAIAgent {}
+export class WuAIOrchestrate {}
+
+export function sanitizeForPrompt(text: string): string;
+export function redactSensitive(text: string): string;
+export function interpolate(template: string, vars: Record<string, any>): string;
+export function buildToolSchemas(actions: any): any;
+export function normalizeParameters(params: any): any;
+export function validateParams(params: any, schema: any): boolean;
+export function estimateTokens(text: string): number;
+export function truncateToTokenBudget(text: string, budget: number): string;
+
+// --- MCP & Browser ---
+
+export function createMcpBridge(core: WuCore): any;
+export function registerBrowserActions(ai: WuAI): void;
+export function ensureInterceptors(): void;
+export function captureScreenshot(): Promise<string>;
+export function buildA11yTree(): any;
+export function clickElement(selector: string): Promise<void>;
+export function typeIntoElement(selector: string, text: string): Promise<void>;
+export function getFilteredNetwork(): any[];
+export function getFilteredConsole(): any[];

package/src/index.js

@@ -25,14 +25,24 @@ if (typeof window !== 'undefined' && window.wu && window.wu._isWuFramework) {
 } else {
   wu = new WuCore();
   wu._isWuFramework = true;
+
+  // Also store on a Symbol key for collision-safe access
+  if (typeof window !== 'undefined') {
+    const WU_KEY = Symbol.for('wu-framework');
+    window[WU_KEY] = wu;
+  }
 }
 
 // Expose globally for microfrontends
 if (typeof window !== 'undefined') {
+  // Warn if window.wu exists but is not a Wu Framework instance
+  if (window.wu && !window.wu._isWuFramework) {
+    console.warn('[Wu Framework] window.wu already exists and is not a Wu Framework instance. Overwriting. Use Symbol.for("wu-framework") for collision-safe access.');
+  }
   window.wu = wu;
 
   if (!wu.version) {
-    wu.version = '1.1.8';
+    wu.version = '1.1.17';
     wu.info = {
       name: 'Wu Framework',
       description: 'Universal Microfrontends',