Review this generated boundary before it accepts untrusted plugin records.
Accept exactly a name string plus the trusted RUN Symbol hook, reject every other own key, attach non-enumerable internal metadata, emit public JSON containing only name, and log either string or Symbol keys safely.
JavaScript
const RUN = Symbol('plugin.run');
const INTERNAL = Symbol('plugin.internal');
function preparePlugin(input) {
const plugin = {};
for (const key of Object.keys(input)) {
plugin[key] = input[key];
}
plugin[INTERNAL] = { loadedAt: Date.now() };
return plugin;
}
function publicJson(plugin) {
return JSON.stringify({ ...plugin });
}
function logKey(key) {
return `plugin key: ${key}`;
}
const input = { name: 'search', debug: true, [RUN]: () => 'ok' };
const plugin = preparePlugin(input);
console.log(publicJson(plugin));
console.log(logKey(INTERNAL));
generated code is illustrative, not from any one model