@oondemand/oon-core-back 0.3.18 → 0.3.19

package/bin/bootstrap-root.js

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+"use strict";
+
+const {
+  validateInfraFromCluster,
+} = require("../src/deploy/contracts/infra-contract");
+const {
+  dnsLabel,
+  provisionRuntime,
+  deployRuntime,
+  waitHttp,
+} = require("../src/delivery/runtime");
+const {
+  copyProtectedConfig,
+  attachProtectedConfig,
+} = require("../src/delivery/controlPlaneBootstrap");
+
+function flag(name, fallback) {
+  const index = process.argv.indexOf(name);
+  return index < 0 ? fallback : process.argv[index + 1];
+}
+function required(value, name) {
+  if (!value) throw new Error(`${name} obrigatório.`);
+  return value;
+}
+
+async function main() {
+  const appCode = dnsLabel(flag("--app-code", "central-ativacao"));
+  const imageDigest = required(flag("--image-digest"), "--image-digest");
+  const infra = validateInfraFromCluster().config;
+  const hostname = flag("--hostname", `${appCode}.${infra.DNS}`);
+  const publicUrl = `${infra.DEFAULT_PROTOCOL || "https"}://${hostname}`;
+  const apiUrl = `${publicUrl}/api`;
+  const namespace = `${infra.RUNTIME_NAMESPACE_PREFIX || "oon"}-${appCode}-dev`
+    .slice(0, 63)
+    .replace(/-+$/, "");
+  const imageRepository = flag(
+    "--image-repository",
+    `${infra.REGISTRY_HOST || "ghcr.io"}/oondemand/${appCode}`,
+  );
+  const context = {
+    releaseId: `bootstrap-${appCode}`,
+    appCode,
+    environment: "desenvolvimento",
+    namespace,
+    hostname,
+    publicUrl,
+    activationApiUrl: apiUrl,
+    imageRepository,
+  };
+  const extraSecrets = {
+    GITHUB_OIDC_AUDIENCE: apiUrl,
+    PLATFORM_DNS: infra.DNS,
+    PLATFORM_DEFAULT_PROTOCOL: infra.DEFAULT_PROTOCOL || "https",
+    PLATFORM_REGISTRY_HOST: infra.REGISTRY_HOST || "ghcr.io",
+    PLATFORM_REGISTRY_OWNER: "oondemand",
+    PLATFORM_RUNTIME_NAMESPACE_PREFIX:
+      infra.RUNTIME_NAMESPACE_PREFIX || "oon",
+    PLATFORM_DELIVERY_REPOSITORY: "oondemand/oon-platform",
+    PLATFORM_DELIVERY_WORKFLOW: "publish-dev.yml",
+    PLATFORM_DELIVERY_REF: "main",
+    PLATFORM_API_URL: apiUrl,
+    PLATFORM_ADMINISTRATIVE_EMAIL: "plataforma@oondemand.com.br",
+  };
+
+  const provisioned = await provisionRuntime({ context, extraSecrets });
+  deployRuntime({ context, infra: provisioned.infra, imageDigest });
+
+  const protectedName = "oon-control-plane";
+  copyProtectedConfig({
+    sourceNamespace: infra.PLATFORM_NAMESPACE || "oon-system",
+    sourceName: flag("--bootstrap-secret", "oon-control-plane-bootstrap"),
+    targetNamespace: namespace,
+    targetName: protectedName,
+  });
+  attachProtectedConfig({
+    namespace,
+    deployment: appCode,
+    secretName: protectedName,
+  });
+
+  await waitHttp(`${publicUrl}/health/live`);
+  await waitHttp(`${apiUrl}/ativacao/status`);
+  console.log(
+    JSON.stringify(
+      {
+        appCode,
+        namespace,
+        publicUrl,
+        apiUrl,
+        activationUrl: `${publicUrl}/ativacao`,
+        imageDigest,
+      },
+      null,
+      2,
+    ),
+  );
+}
+
+main().catch((error) => {
+  console.error(error.message);
+  process.exit(1);
+});

package/bin/build-delivery-image.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+"use strict";
+
+const path = require("node:path");
+const { buildImage } = require("../src/delivery/buildImage");
+function flag(name) { const index = process.argv.indexOf(name); return index < 0 ? undefined : process.argv[index + 1]; }
+const workspace = path.resolve(flag("--workspace") || process.cwd());
+const tag = flag("--tag");
+const output = flag("--output");
+if (!tag || !output) { console.error("--tag e --output são obrigatórios"); process.exit(2); }
+buildImage({ workspace, tag, output: path.resolve(output) });

package/bin/cli.js

@@ -3,93 +3,135 @@
 
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
+const { ContractError, EXIT_CODES, sanitizeMessage } = require("../src/deploy/contracts/errors");
 
 const cmd = process.argv[2];
 const cwd = process.cwd();
 
-function loadManifest() {
-  return require("../src/deploy/render").loadManifest(cwd);
-}
-
+function loadManifest() { return require("../src/deploy/render").loadManifest(cwd); }
 function run(bin, args) {
-  const r = spawnSync(bin, args, { stdio: "inherit", cwd });
-  if (r.error) {
-    console.error(`Falha ao executar ${bin}:`, r.error.message);
-    process.exit(1);
+  const result = spawnSync(bin, args, { stdio: "inherit", cwd });
+  if (result.error) { console.error(`Falha ao executar ${bin}:`, sanitizeMessage(result.error.message)); process.exit(1); }
+  process.exit(result.status || 0);
+}
+function getFlagValue(args, flag) {
+  const index = args.indexOf(flag);
+  if (index === -1) return undefined;
+  const value = args[index + 1];
+  if (!value || value.startsWith("--")) throw new ContractError("USAGE_ERROR", `Valor obrigatório ausente para ${flag}.`);
+  return value;
+}
+function hasFlag(args, flag) { return args.includes(flag); }
+function printJson(result) {
+  const safe = { ok: result.ok, contract: result.contract, version: result.version };
+  if (result.errors) safe.errors = result.errors;
+  console.log(JSON.stringify(safe, null, 2));
+}
+function errorPayload(err) {
+  const errors = err.details?.length ? err.details : [{ path: err.path || "$", message: sanitizeMessage(err.message) }];
+  return { ok: false, errors: errors.map((item) => ({ path: item.path || "$", message: sanitizeMessage(item.message) })), category: err.category || "ERROR" };
+}
+function handleExpectedError(err, { json, contract }) {
+  const payload = { ...errorPayload(err), contract };
+  if (json) printJson(payload);
+  else {
+    console.error(`${payload.category}: ${sanitizeMessage(err.message)}`);
+    for (const issue of payload.errors) console.error(` - ${issue.path}: ${issue.message}`);
+  }
+  process.exit(err.exitCode || 1);
+}
+function ensureNoUnknownFlags(args, allowed) {
+  for (let index = 0; index < args.length; index += 1) {
+    const value = args[index];
+    if (!value.startsWith("--")) continue;
+    if (!allowed.includes(value)) throw new ContractError("USAGE_ERROR", `Flag não suportada: ${value}`);
+    if (["--manifest", "--file", "--api"].includes(value)) index += 1;
   }
-  process.exit(r.status || 0);
 }
 
 async function main() {
   switch (cmd) {
-    case "start": {
-      const { start } = require("../src");
-      await start({ cwd });
-      break;
-    }
-
+    case "start": { const { start } = require("../src"); await start({ cwd }); break; }
     case "dev": {
-      // Watch + restart usando o próprio Node (>=18.11 tem --watch).
       process.env.NODE_ENV = process.env.NODE_ENV || "development";
-      const bootstrap = path.join(__dirname, "dev-runner.js");
-      run(process.execPath, ["--watch", bootstrap]);
+      run(process.execPath, ["--watch", path.join(__dirname, "dev-runner.js")]);
       break;
     }
-
-    case "activate": {
-      const { activate } = require("../src");
-      await activate({ cwd });
+    case "activate": { const { activate } = require("../src"); await activate({ cwd }); process.exit(0); break; }
+    case "deploy:validate": {
+      const args = process.argv.slice(3);
+      try {
+        ensureNoUnknownFlags(args, ["--manifest", "--json"]);
+        const json = hasFlag(args, "--json");
+        const manifest = getFlagValue(args, "--manifest") || path.join(cwd, "oon.deploy.json");
+        const result = require("../src/deploy/contracts/deploy-contract").validateDeployFile(path.resolve(cwd, manifest));
+        if (json) printJson(result); else console.log(`OK: ${result.contract} ${result.version} válido.`);
+        process.exit(0);
+      } catch (err) {
+        if (err instanceof ContractError) handleExpectedError(err, { json: hasFlag(args, "--json"), contract: "oon.deploy" });
+        throw err;
+      }
+      break;
+    }
+    case "infra:validate": {
+      const args = process.argv.slice(3);
+      try {
+        ensureNoUnknownFlags(args, ["--file", "--json"]);
+        const json = hasFlag(args, "--json");
+        const file = getFlagValue(args, "--file");
+        const infra = require("../src/deploy/contracts/infra-contract");
+        const result = file ? infra.validateInfraFile(path.resolve(cwd, file)) : infra.validateInfraFromCluster();
+        if (json) printJson(result); else console.log(`OK: ${result.contract} ${result.version} válido.`);
+        process.exit(0);
+      } catch (err) {
+        if (err instanceof ContractError) handleExpectedError(err, { json: hasFlag(args, "--json"), contract: "oon-platform-config" });
+        throw err;
+      }
+      break;
+    }
+    case "publish:request": {
+      const args = process.argv.slice(3);
+      ensureNoUnknownFlags(args, ["--api"]);
+      const result = await require("../src/delivery/publicationRequest").requestDevPublication({ cwd, apiUrl: getFlagValue(args, "--api") });
+      console.log(JSON.stringify(result, null, 2));
       process.exit(0);
       break;
     }
-
     case "build:image": {
-      const m = loadManifest();
+      const manifest = loadManifest();
       require("../src/deploy/render").renderDockerfile({ cwd });
-      const tag = `${m.IMAGE}:${m.IMAGE_TAG}`;
-      console.log(`Construindo imagem ${tag}...`);
-      run("docker", [
-        "build",
-        "--build-arg",
-        `SERVICE_VERSION=${m.IMAGE_TAG}`,
-        "-t",
-        tag,
-        ".",
-      ]);
+      run("docker", ["build", "--build-arg", `SERVICE_VERSION=${manifest.IMAGE_TAG}`, "-t", `${manifest.IMAGE}:${manifest.IMAGE_TAG}`, "."]);
       break;
     }
-
     case "k8s:render": {
       const files = require("../src/deploy/render").renderK8s({ cwd });
-      console.log("Manifests gerados:");
-      files.forEach((f) => console.log(" -", path.relative(cwd, f)));
+      files.forEach((file) => console.log(" -", path.relative(cwd, file)));
       process.exit(0);
       break;
     }
-
     case "deploy": {
       const files = require("../src/deploy/render").renderK8s({ cwd });
-      console.log("Aplicando manifests no cluster...");
-      run("kubectl", ["apply", ...files.flatMap((f) => ["-f", f])]);
+      run("kubectl", ["apply", ...files.flatMap((file) => ["-f", file])]);
       break;
     }
-
     default:
       console.log(`oonCore-back <comando>
 
 Comandos:
-  start         Sobe a Central (produção).
-  dev           Sobe com watch/reload.
-  activate      Executa seed/ativação (singleton Sistema + hook).
-  build:image   Renderiza o Dockerfile e roda 'docker build'.
-  k8s:render    Renderiza os manifests k8s a partir de central.manifest.json.
-  deploy        Renderiza e aplica os manifests com 'kubectl apply'.
+  start              Sobe a Central.
+  dev                Sobe com watch/reload.
+  activate           Executa seed/ativação.
+  deploy:validate    Valida o contrato neutro oon.deploy.json.
+  infra:validate     Valida o contrato oon-platform-config.
+  publish:request    Solicita publicação dev usando GitHub OIDC.
+  build:image        Legado: constrói imagem por central.manifest.json.
+  k8s:render         Legado: renderiza manifests.
+  deploy             Legado: executa kubectl apply.
+
+Códigos de saída: ${Object.entries(EXIT_CODES).map(([key, value]) => `${value}=${key}`).join(", ")}.
 `);
       process.exit(cmd ? 1 : 0);
   }
 }
 
-main().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});
+main().catch((err) => { console.error(sanitizeMessage(err?.message || err)); process.exit(1); });

package/bin/delivery.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { getContextWithPhase, setState, addEvidence } = require("../src/delivery/api");
+const { provisionRuntime, deployRuntime, waitHttp, activateMember } = require("../src/delivery/runtime");
+
+function flag(name, fallback) {
+  const args = process.argv.slice(3);
+  const index = args.indexOf(name);
+  if (index < 0) return fallback;
+  const value = args[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`Valor ausente para ${name}.`);
+  return value;
+}
+function required(value, name) { if (!value) throw new Error(`${name} obrigatório.`); return value; }
+function secret() { return required(process.env.OON_DELIVERY_SHARED_SECRET, "OON_DELIVERY_SHARED_SECRET"); }
+
+async function main() {
+  const command = process.argv[2];
+  const releaseId = flag("--release", process.env.RELEASE_ID);
+  const apiUrl = flag("--api", process.env.ACTIVATION_API_URL);
+
+  if (command === "context") {
+    const phase = flag("--phase", "build");
+    const output = required(flag("--output"), "--output");
+    const context = await getContextWithPhase({ apiUrl: required(apiUrl, "--api"), releaseId: required(releaseId, "--release"), token: secret(), phase });
+    fs.writeFileSync(path.resolve(output), JSON.stringify(context, null, 2), { mode: 0o600 });
+    return;
+  }
+  if (command === "state") {
+    await setState({
+      apiUrl: required(apiUrl, "--api"), releaseId: required(releaseId, "--release"), token: secret(),
+      etapa: required(flag("--state"), "--state"), imageDigest: flag("--image-digest"),
+      erroCodigo: flag("--error-code"), erroMensagem: flag("--error-message"),
+    });
+    return;
+  }
+  if (command === "deploy") {
+    const contextFile = required(flag("--context"), "--context");
+    const imageDigest = required(flag("--image-digest"), "--image-digest");
+    const context = JSON.parse(fs.readFileSync(path.resolve(contextFile), "utf8"));
+    let failureState = "falha_infra";
+    try {
+      await setState({ apiUrl, releaseId, token: secret(), etapa: "provisionando", imageDigest });
+      const provisioned = await provisionRuntime({ context });
+      failureState = "falha_deploy";
+      await setState({ apiUrl, releaseId, token: secret(), etapa: "implantando", imageDigest });
+      const deployed = deployRuntime({ context, infra: provisioned.infra, imageDigest, resourceProfile: context.resourceProfile });
+      await waitHttp(`${context.publicUrl}/health/live`);
+      failureState = "falha_ativacao";
+      await setState({ apiUrl, releaseId, token: secret(), etapa: "ativando", imageDigest });
+      const activation = await activateMember(context);
+      failureState = "falha_saude";
+      await setState({ apiUrl, releaseId, token: secret(), etapa: "validando_saude", imageDigest, instanciaId: activation.instanceId });
+      await waitHttp(`${context.publicUrl}/api/ativacao/status`);
+      await addEvidence({ apiUrl, releaseId, token: secret(), evidence: { kind: "deployment", imageDigest, infraVersion: deployed.infraVersion, namespace: context.namespace, publicUrl: context.publicUrl, health: "ok" } });
+      await setState({ apiUrl, releaseId, token: secret(), etapa: "publicada", imageDigest, instanciaId: activation.instanceId, urlPublica: context.publicUrl });
+      console.log(`Publicação concluída: ${context.publicUrl}`);
+    } catch (error) {
+      try { await setState({ apiUrl, releaseId, token: secret(), etapa: failureState, erroCodigo: failureState.toUpperCase(), erroMensagem: error.message, imageDigest }); }
+      catch (reportError) { console.error(`Falha ao reportar erro: ${reportError.message}`); }
+      throw error;
+    } finally {
+      delete context.activationCode;
+      fs.writeFileSync(path.resolve(contextFile), JSON.stringify(context, null, 2), { mode: 0o600 });
+    }
+    return;
+  }
+  throw new Error(`Comando desconhecido: ${command}`);
+}
+
+main().catch((error) => { console.error(error.message); process.exit(1); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.3.18",
+  "version": "0.3.19",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/delivery/api.js

@@ -0,0 +1,42 @@
+"use strict";
+
+function endpoint(apiUrl, releaseId, suffix) {
+  return `${String(apiUrl).replace(/\/$/, "")}/integracao/publicacoes/${encodeURIComponent(releaseId)}${suffix}`;
+}
+
+async function request(url, { token, method = "GET", body } = {}) {
+  const response = await fetch(url, {
+    method,
+    headers: {
+      "x-oon-delivery-token": token,
+      "Content-Type": "application/json",
+    },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const error = new Error(data?.error?.message || data?.message || `HTTP ${response.status}`);
+    error.statusCode = response.status;
+    error.code = data?.error?.code;
+    throw error;
+  }
+  return data;
+}
+
+async function getContextWithPhase({ apiUrl, releaseId, token, phase }) {
+  const response = await fetch(endpoint(apiUrl, releaseId, "/contexto"), {
+    headers: { "x-oon-delivery-token": token, "x-oon-delivery-phase": phase },
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(data?.error?.message || data?.message || `HTTP ${response.status}`);
+  return data;
+}
+
+function setState({ apiUrl, releaseId, token, etapa, ...details }) {
+  return request(endpoint(apiUrl, releaseId, "/estado"), { token, method: "POST", body: { etapa, ...details } });
+}
+function addEvidence({ apiUrl, releaseId, token, evidence }) {
+  return request(endpoint(apiUrl, releaseId, "/evidencias"), { token, method: "POST", body: evidence });
+}
+
+module.exports = { endpoint, request, getContextWithPhase, setState, addEvidence };

package/src/delivery/buildImage.js

@@ -0,0 +1,87 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { run } = require("./command");
+
+const DOCKERFILE = `# syntax=docker/dockerfile:1.7
+FROM node:20-alpine AS frontend
+WORKDIR /src/frontend
+COPY frontend/package*.json ./
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
+COPY frontend/ ./
+ARG VITE_API_URL=/api
+ENV VITE_API_URL=$VITE_API_URL
+RUN npm run build
+
+FROM node:20-alpine AS backend
+WORKDIR /app/backend
+COPY backend/package*.json ./
+RUN if [ -f package-lock.json ]; then npm ci --omit=dev; else npm install --omit=dev; fi
+COPY backend/ ./
+
+FROM node:20-alpine
+RUN apk add --no-cache nginx curl
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=backend /app/backend /app/backend
+COPY --from=frontend /src/frontend/dist /usr/share/nginx/html
+COPY .oon-delivery/nginx.conf /etc/nginx/http.d/default.conf
+COPY .oon-delivery/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh && mkdir -p /app/backend/uploads /run/nginx
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD curl -fsS http://127.0.0.1:8080/health/live || exit 1
+ENTRYPOINT ["/entrypoint.sh"]
+`;
+
+const NGINX = `server {
+  listen 8080;
+  server_name _;
+  root /usr/share/nginx/html;
+  location = /health/live { access_log off; return 200 'ok'; add_header Content-Type text/plain; }
+  location /api/ {
+    proxy_pass http://127.0.0.1:4000/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+  location / { try_files $uri $uri/ /index.html; }
+}
+`;
+
+const ENTRYPOINT = `#!/bin/sh
+set -eu
+cd /app/backend
+export PORT=4000
+./node_modules/.bin/oonCore-back start &
+backend_pid=$!
+trap 'kill $backend_pid 2>/dev/null || true' TERM INT EXIT
+exec nginx -g 'daemon off;'
+`;
+
+function prepareDeliveryFiles(workspace) {
+  const target = path.join(workspace, ".oon-delivery");
+  fs.mkdirSync(target, { recursive: true });
+  fs.writeFileSync(path.join(target, "Dockerfile"), DOCKERFILE);
+  fs.writeFileSync(path.join(target, "nginx.conf"), NGINX);
+  fs.writeFileSync(path.join(target, "entrypoint.sh"), ENTRYPOINT, {
+    mode: 0o755,
+  });
+  return path.join(target, "Dockerfile");
+}
+
+function buildImage({ workspace, tag, output }) {
+  const dockerfile = prepareDeliveryFiles(workspace);
+  run("docker", ["build", "-f", dockerfile, "-t", tag, workspace]);
+  run("docker", ["save", "-o", output, tag]);
+  return { dockerfile, output, tag };
+}
+
+module.exports = {
+  DOCKERFILE,
+  NGINX,
+  ENTRYPOINT,
+  prepareDeliveryFiles,
+  buildImage,
+};

package/src/delivery/command.js

@@ -0,0 +1,22 @@
+"use strict";
+
+const { spawnSync } = require("node:child_process");
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd || process.cwd(),
+    encoding: "utf8",
+    stdio: options.capture ? ["ignore", "pipe", "pipe"] : "inherit",
+    env: { ...process.env, ...(options.env || {}) },
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const message = options.capture ? String(result.stderr || result.stdout || "").slice(0, 2000) : `${command} falhou`;
+    throw new Error(message);
+  }
+  return options.capture ? String(result.stdout || "").trim() : result;
+}
+
+function kubectl(args, options = {}) { return run("kubectl", args, options); }
+
+module.exports = { run, kubectl };

package/src/delivery/controlPlaneBootstrap.js

@@ -0,0 +1,81 @@
+"use strict";
+
+const { spawnSync } = require("node:child_process");
+const { kubectl } = require("./command");
+
+function applyJson(document) {
+  const result = spawnSync("kubectl", ["apply", "-f", "-"], {
+    input: JSON.stringify(document),
+    encoding: "utf8",
+    stdio: ["pipe", "inherit", "inherit"],
+  });
+  if (result.status !== 0) {
+    throw new Error("Falha ao copiar configuração protegida.");
+  }
+}
+
+function copyProtectedConfig({
+  sourceNamespace,
+  sourceName,
+  targetNamespace,
+  targetName,
+}) {
+  const source = JSON.parse(
+    kubectl(
+      ["-n", sourceNamespace, "get", "secret", sourceName, "-o", "json"],
+      { capture: true },
+    ),
+  );
+  for (const key of [
+    "namespace",
+    "resourceVersion",
+    "uid",
+    "creationTimestamp",
+    "managedFields",
+  ]) {
+    delete source.metadata[key];
+  }
+  source.metadata.namespace = targetNamespace;
+  source.metadata.name = targetName;
+  applyJson(source);
+}
+
+function attachProtectedConfig({ namespace, deployment, secretName }) {
+  const patch = {
+    spec: {
+      template: {
+        spec: {
+          containers: [
+            {
+              name: "central",
+              envFrom: [
+                { secretRef: { name: "oon-runtime" } },
+                { secretRef: { name: secretName } },
+              ],
+            },
+          ],
+        },
+      },
+    },
+  };
+  kubectl([
+    "-n",
+    namespace,
+    "patch",
+    "deployment",
+    deployment,
+    "--type=strategic",
+    "-p",
+    JSON.stringify(patch),
+  ]);
+  kubectl([
+    "-n",
+    namespace,
+    "rollout",
+    "status",
+    `deployment/${deployment}`,
+    "--timeout=10m",
+  ]);
+}
+
+module.exports = { copyProtectedConfig, attachProtectedConfig };

package/src/delivery/publicationRequest.js

@@ -0,0 +1,49 @@
+"use strict";
+
+const path = require("node:path");
+const { validateDeployFile } = require("../deploy/contracts/deploy-contract");
+
+const DEFAULT_ACTIVATION_API = "https://central-ativacao.central.oondemand.online/api";
+
+async function githubOidcToken(audience) {
+  const base = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+  const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  if (!base || !requestToken) {
+    const error = new Error("GitHub Actions OIDC indisponível. O workflow precisa de permissions.id-token=write.");
+    error.code = "GITHUB_OIDC_UNAVAILABLE";
+    throw error;
+  }
+  const separator = base.includes("?") ? "&" : "?";
+  const response = await fetch(`${base}${separator}audience=${encodeURIComponent(audience)}`, {
+    headers: { Authorization: `Bearer ${requestToken}` },
+  });
+  if (!response.ok) throw new Error(`Falha ao obter OIDC do GitHub: HTTP ${response.status}.`);
+  const data = await response.json();
+  if (!data.value) throw new Error("Resposta OIDC do GitHub não contém token.");
+  return data.value;
+}
+
+async function requestDevPublication({ cwd = process.cwd(), apiUrl } = {}) {
+  const result = validateDeployFile(path.join(cwd, "oon.deploy.json"));
+  const activationApi = String(apiUrl || process.env.CENTRAL_ATIVACAO_API_URL || DEFAULT_ACTIVATION_API).replace(/\/$/, "");
+  const token = await githubOidcToken(activationApi);
+  const response = await fetch(`${activationApi}/integracao/publicacoes/solicitar`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      "Idempotency-Key": `${process.env.GITHUB_REPOSITORY || "local"}:${process.env.GITHUB_SHA || "unknown"}:dev`,
+    },
+    body: JSON.stringify({ appCode: result.manifest.appCode }),
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const error = new Error(`Publicação dev não autorizada: ${data?.error?.message || data?.message || `HTTP ${response.status}`}`);
+    error.code = data?.error?.code || "PUBLICATION_REQUEST_FAILED";
+    error.statusCode = response.status;
+    throw error;
+  }
+  return { activationApi, ...data };
+}
+
+module.exports = { DEFAULT_ACTIVATION_API, githubOidcToken, requestDevPublication };

package/src/delivery/runtime.js

@@ -0,0 +1,252 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const { mongo } = require("mongoose");
+const { spawnSync } = require("node:child_process");
+const { kubectl } = require("./command");
+const { validateInfraFromCluster } = require("../deploy/contracts/infra-contract");
+
+const RESOURCE_PROFILES = {
+  nano: { cpuRequest: "50m", cpuLimit: "250m", memoryRequest: "96Mi", memoryLimit: "256Mi" },
+  small: { cpuRequest: "100m", cpuLimit: "500m", memoryRequest: "128Mi", memoryLimit: "512Mi" },
+  medium: { cpuRequest: "250m", cpuLimit: "1", memoryRequest: "256Mi", memoryLimit: "1Gi" },
+  large: { cpuRequest: "500m", cpuLimit: "2", memoryRequest: "512Mi", memoryLimit: "2Gi" },
+};
+
+function randomSecret(bytes = 32) { return crypto.randomBytes(bytes).toString("base64url"); }
+function dnsLabel(value, max = 63) {
+  return String(value || "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, max).replace(/-+$/, "");
+}
+function applyYaml(yaml) {
+  const result = spawnSync("kubectl", ["apply", "-f", "-"], { input: yaml, encoding: "utf8", stdio: ["pipe", "inherit", "inherit"] });
+  if (result.status !== 0) throw new Error("kubectl apply falhou.");
+}
+function readSecret(namespace, name, key) {
+  try {
+    const value = kubectl(["-n", namespace, "get", "secret", name, "-o", `jsonpath={.data.${key}}`], { capture: true });
+    return value ? Buffer.from(value, "base64").toString("utf8") : null;
+  } catch { return null; }
+}
+
+async function provisionMongo({ adminUri, appCode, environment }) {
+  const dbName = dnsLabel(`${appCode}_${environment}`, 48).replace(/-/g, "_");
+  const username = dnsLabel(`${appCode}-${environment}`, 48);
+  const password = randomSecret(30);
+  const client = new mongo.MongoClient(adminUri, { serverSelectionTimeoutMS: 15000 });
+  await client.connect();
+  try {
+    const db = client.db(dbName);
+    try { await db.command({ createUser: username, pwd: password, roles: [{ role: "readWrite", db: dbName }] }); }
+    catch (error) {
+      if (error.codeName !== "DuplicateKey" && error.code !== 51003 && !/already exists/i.test(error.message)) throw error;
+      await db.command({ updateUser: username, pwd: password, roles: [{ role: "readWrite", db: dbName }] });
+    }
+  } finally { await client.close(); }
+  const uri = new URL(adminUri);
+  uri.username = username;
+  uri.password = password;
+  uri.pathname = `/${dbName}`;
+  uri.searchParams.set("authSource", dbName);
+  return { dbName, mongoUri: uri.toString() };
+}
+
+function baselineManifest({ context }) {
+  return `apiVersion: v1
+kind: Namespace
+metadata:
+  name: ${context.namespace}
+  labels:
+    oon.dev/app-code: ${context.appCode}
+    oon.dev/environment: ${context.environment}
+    app.kubernetes.io/managed-by: oon-platform
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata: { name: oon-runtime, namespace: ${context.namespace} }
+automountServiceAccountToken: false
+---
+apiVersion: v1
+kind: LimitRange
+metadata: { name: oon-runtime-defaults, namespace: ${context.namespace} }
+spec:
+  limits:
+    - type: Container
+      defaultRequest: { cpu: 100m, memory: 128Mi }
+      default: { cpu: 500m, memory: 512Mi }
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata: { name: oon-runtime-quota, namespace: ${context.namespace} }
+spec:
+  hard: { requests.cpu: "2", requests.memory: 2Gi, limits.cpu: "4", limits.memory: 4Gi, pods: "20", services: "10" }
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata: { name: oon-runtime-baseline, namespace: ${context.namespace} }
+spec:
+  podSelector: {}
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels: { kubernetes.io/metadata.name: ingress-nginx }
+  egress:
+    - {}
+`;
+}
+
+function runtimeManifest({ context, infra, imageRef, profile = "small" }) {
+  const resources = RESOURCE_PROFILES[profile] || RESOURCE_PROFILES.small;
+  return `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${context.appCode}
+  namespace: ${context.namespace}
+spec:
+  replicas: 1
+  selector:
+    matchLabels: { app.kubernetes.io/name: ${context.appCode} }
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: ${context.appCode}
+        app.kubernetes.io/part-of: oon-central
+        oon.dev/release-id: ${context.releaseId}
+    spec:
+      serviceAccountName: oon-runtime
+      imagePullSecrets: [{ name: ${infra.REGISTRY_PULL_SECRET_NAME || "ghcr-oon"} }]
+      containers:
+        - name: central
+          image: ${imageRef}
+          imagePullPolicy: IfNotPresent
+          ports: [{ name: http, containerPort: 8080 }]
+          envFrom: [{ secretRef: { name: oon-runtime } }]
+          resources:
+            requests: { cpu: ${resources.cpuRequest}, memory: ${resources.memoryRequest} }
+            limits: { cpu: ${resources.cpuLimit}, memory: ${resources.memoryLimit} }
+          livenessProbe:
+            httpGet: { path: /health/live, port: http }
+            initialDelaySeconds: 20
+          readinessProbe:
+            httpGet: { path: /api/ativacao/status, port: http }
+            initialDelaySeconds: 10
+---
+apiVersion: v1
+kind: Service
+metadata: { name: ${context.appCode}, namespace: ${context.namespace} }
+spec:
+  selector: { app.kubernetes.io/name: ${context.appCode} }
+  ports: [{ name: http, port: 80, targetPort: http }]
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ${context.appCode}
+  namespace: ${context.namespace}
+  annotations: { cert-manager.io/cluster-issuer: ${infra.CLUSTER_ISSUER} }
+spec:
+  ingressClassName: ${infra.INGRESS_CLASS}
+  tls: [{ hosts: [${context.hostname}], secretName: ${context.appCode}-tls }]
+  rules:
+    - host: ${context.hostname}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service: { name: ${context.appCode}, port: { name: http } }
+`;
+}
+
+function copyPullSecret(namespace, infra) {
+  const source = infra.REGISTRY_PULL_SECRET_NAME || "ghcr-oon";
+  try {
+    const secret = JSON.parse(kubectl(["-n", infra.PLATFORM_NAMESPACE || "oon-system", "get", "secret", source, "-o", "json"], { capture: true }));
+    for (const key of ["namespace", "resourceVersion", "uid", "creationTimestamp", "managedFields"]) delete secret.metadata[key];
+    secret.metadata.namespace = namespace;
+    applyYaml(JSON.stringify(secret));
+  } catch (error) { if (!/not found/i.test(error.message)) throw error; }
+}
+
+function applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets = {} }) {
+  const literals = {
+    MONGO_URI: mongoUri,
+    NODE_ENV: "production",
+    APP_ENVIRONMENT: context.environment,
+    APP_CODE: context.appCode,
+    PUBLIC_APP_URL: context.publicUrl,
+    CENTRAL_ATIVACAO_URL: context.activationApiUrl,
+    CENTRAL_ATIVACAO_API_URL: context.activationApiUrl,
+    INSTANCE_CREDENTIAL_ENCRYPTION_KEY: encryptionKey,
+    ...extraSecrets,
+  };
+  const args = ["-n", context.namespace, "create", "secret", "generic", "oon-runtime"];
+  for (const [key, value] of Object.entries(literals)) args.push(`--from-literal=${key}=${value}`);
+  args.push("--dry-run=client", "-o", "yaml");
+  applyYaml(kubectl(args, { capture: true }));
+}
+
+async function provisionRuntime({ context, extraSecrets = {} }) {
+  const infra = validateInfraFromCluster().config;
+  applyYaml(baselineManifest({ context, infra }));
+  let mongoUri = readSecret(context.namespace, "oon-runtime", "MONGO_URI");
+  let databaseName = "";
+  if (!mongoUri) {
+    const adminUri = readSecret(infra.PLATFORM_NAMESPACE || "oon-system", infra.MONGO_ADMIN_SECRET_NAME || "oon-mongo-admin", "MONGO_ADMIN_URI");
+    if (!adminUri) throw new Error("MongoDB administrativo não configurado na plataforma.");
+    const provisioned = await provisionMongo({ adminUri, appCode: context.appCode, environment: context.environment });
+    mongoUri = provisioned.mongoUri;
+    databaseName = provisioned.dbName;
+  }
+  const encryptionKey = readSecret(context.namespace, "oon-runtime", "INSTANCE_CREDENTIAL_ENCRYPTION_KEY") || randomSecret(48);
+  applyRuntimeSecret({ context, mongoUri, encryptionKey, extraSecrets });
+  return { infra, databaseName };
+}
+
+function deployRuntime({ context, infra, imageDigest, resourceProfile = "small" }) {
+  copyPullSecret(context.namespace, infra);
+  const imageRef = `${context.imageRepository}@${imageDigest}`;
+  applyYaml(runtimeManifest({ context, infra, imageRef, profile: resourceProfile }));
+  kubectl(["-n", context.namespace, "rollout", "status", `deployment/${context.appCode}`, "--timeout=10m"]);
+  return { infraVersion: infra.INFRA_SCHEMA_VERSION, imageRef };
+}
+
+async function waitHttp(url, { timeoutMs = 300000, expectedStatus = 200 } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  let last;
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(url, { redirect: "manual" });
+      last = `HTTP ${response.status}`;
+      if (response.status === expectedStatus) return response;
+    } catch (error) { last = error.message; }
+    await new Promise((resolve) => setTimeout(resolve, 5000));
+  }
+  throw new Error(`Timeout aguardando ${url}: ${last || "sem resposta"}`);
+}
+
+async function activateMember(context) {
+  const statusResponse = await waitHttp(`${context.publicUrl}/api/ativacao/status`);
+  const status = await statusResponse.json();
+  if (status.status === "ativa") return { alreadyActive: true, instanceId: status.instanceId };
+  if (!context.activationCode) throw new Error("Instância não está ativa e não há código de ativação autorizado.");
+  const response = await fetch(`${context.publicUrl}/api/ativacao/concluir`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "Idempotency-Key": context.releaseId },
+    body: JSON.stringify({
+      codigoAtivacao: context.activationCode,
+      nomeInstancia: `${context.appCode} dev`,
+      parametrosGlobais: {
+        nomeInstancia: `${context.appCode} dev`, ambiente: context.environment,
+        urlPublica: context.publicUrl, emailAdministrativo: context.administrativeEmail,
+        idioma: "pt-BR", timezone: "America/Sao_Paulo", moeda: "BRL", pais: "BR", formatoData: "DD/MM/YYYY",
+      },
+      parametrosAplicacao: {},
+    }),
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(data?.error?.message || data?.message || `Ativação falhou: HTTP ${response.status}`);
+  return data;
+}
+
+module.exports = { RESOURCE_PROFILES, randomSecret, dnsLabel, provisionMongo, baselineManifest, runtimeManifest, provisionRuntime, deployRuntime, waitHttp, activateMember };

package/src/deploy/contracts/deploy-contract.js

@@ -0,0 +1,96 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { ContractError, toIssue, isSensitiveKey } = require("./errors");
+
+const CONTRACT = "oon.deploy";
+const SUPPORTED_MAJOR = 1;
+const RUNTIMES = ["ooncore-node-react"];
+const RESOURCE_PROFILES = ["nano", "small", "medium", "large"];
+const REQUIRED = ["schemaVersion", "appCode", "runtime", "components", "resourceProfile", "health"];
+const COMPONENTS = ["backend", "frontend"];
+const HEALTH = ["livePath", "readyPath", "versionPath"];
+
+function readJsonFile(file) {
+  let raw;
+  try { raw = fs.readFileSync(file, "utf8"); }
+  catch (err) {
+    if (err.code === "ENOENT") throw new ContractError("FILE_NOT_FOUND", `Arquivo não encontrado: ${file}`);
+    throw new ContractError("FILE_NOT_FOUND", `Não foi possível ler o arquivo: ${file}`);
+  }
+  try { return JSON.parse(raw); }
+  catch { throw new ContractError("INVALID_JSON", `JSON inválido em ${file}`); }
+}
+
+function majorOf(version) {
+  const match = String(version || "").match(/^(\d+)\.\d+\.\d+$/);
+  return match ? Number(match[1]) : null;
+}
+
+function validRelativePath(value) {
+  if (typeof value !== "string" || !value.trim() || path.isAbsolute(value)) return false;
+  const normalized = path.posix.normalize(value.replace(/\\/g, "/"));
+  return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
+}
+
+function walkSecrets(value, currentPath, issues) {
+  if (!value || typeof value !== "object") return;
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = `${currentPath}.${key}`;
+    if (isSensitiveKey(key)) issues.push(toIssue(childPath, "Campo com semântica de segredo/credencial não é permitido."));
+    walkSecrets(child, childPath, issues);
+  }
+}
+
+function noExtra(object, allowed, base, issues) {
+  for (const key of Object.keys(object || {})) {
+    if (!allowed.includes(key)) issues.push(toIssue(`${base}.${key}`, "Propriedade não permitida neste contrato."));
+  }
+}
+
+function validateDeployContract(manifest) {
+  const issues = [];
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    issues.push(toIssue("$", "O manifesto deve ser um objeto JSON."));
+  } else {
+    const major = majorOf(manifest.schemaVersion);
+    if (major === null) issues.push(toIssue("$.schemaVersion", "schemaVersion deve seguir semver."));
+    else if (major !== SUPPORTED_MAJOR) throw new ContractError("UNSUPPORTED_CONTRACT_VERSION", `Major não suportado: ${manifest.schemaVersion}. Migre para 1.x.`, { path: "$.schemaVersion" });
+
+    REQUIRED.forEach((key) => { if (manifest[key] === undefined) issues.push(toIssue(`$.${key}`, "Campo obrigatório ausente.")); });
+    noExtra(manifest, REQUIRED, "$", issues);
+    walkSecrets(manifest, "$", issues);
+
+    if (manifest.appCode !== undefined && !/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(manifest.appCode)) issues.push(toIssue("$.appCode", "appCode deve ser compatível com DNS/Kubernetes."));
+    if (manifest.runtime !== undefined && !RUNTIMES.includes(manifest.runtime)) issues.push(toIssue("$.runtime", "Runtime não suportado."));
+    if (manifest.resourceProfile !== undefined && !RESOURCE_PROFILES.includes(manifest.resourceProfile)) issues.push(toIssue("$.resourceProfile", "Perfil de recursos não suportado."));
+
+    if (manifest.components && typeof manifest.components === "object" && !Array.isArray(manifest.components)) {
+      noExtra(manifest.components, COMPONENTS, "$.components", issues);
+      COMPONENTS.forEach((name) => {
+        const component = manifest.components[name];
+        if (!component || typeof component !== "object" || Array.isArray(component)) issues.push(toIssue(`$.components.${name}`, "Componente obrigatório ausente ou inválido."));
+        else {
+          noExtra(component, ["path"], `$.components.${name}`, issues);
+          if (!validRelativePath(component.path)) issues.push(toIssue(`$.components.${name}.path`, "path deve ser relativo e não pode escapar do workspace."));
+        }
+      });
+    } else if (manifest.components !== undefined) issues.push(toIssue("$.components", "components deve ser um objeto."));
+
+    if (manifest.health && typeof manifest.health === "object" && !Array.isArray(manifest.health)) {
+      noExtra(manifest.health, HEALTH, "$.health", issues);
+      HEALTH.forEach((key) => {
+        if (typeof manifest.health[key] !== "string" || !manifest.health[key].startsWith("/")) issues.push(toIssue(`$.health.${key}`, "Health path deve iniciar por /."));
+      });
+    } else if (manifest.health !== undefined) issues.push(toIssue("$.health", "health deve ser um objeto."));
+  }
+  if (issues.length) throw new ContractError("SCHEMA_VALIDATION_ERROR", "oon.deploy.json inválido.", { details: issues });
+  return { ok: true, contract: CONTRACT, version: manifest.schemaVersion, manifest };
+}
+
+function validateDeployFile(file = path.join(process.cwd(), "oon.deploy.json")) {
+  return validateDeployContract(readJsonFile(file));
+}
+
+module.exports = { validateDeployContract, validateDeployFile, readJsonFile, RUNTIMES, RESOURCE_PROFILES };

package/src/deploy/contracts/errors.js

@@ -0,0 +1,44 @@
+"use strict";
+
+const EXIT_CODES = {
+  USAGE_ERROR: 2,
+  FILE_NOT_FOUND: 3,
+  INVALID_JSON: 4,
+  SCHEMA_VALIDATION_ERROR: 5,
+  UNSUPPORTED_CONTRACT_VERSION: 6,
+  KUBECTL_UNAVAILABLE: 7,
+  KUBERNETES_ACCESS_ERROR: 8,
+  CONFIGMAP_NOT_FOUND: 9,
+};
+
+class ContractError extends Error {
+  constructor(category, message, { path = "$", details = [] } = {}) {
+    super(message);
+    this.name = "ContractError";
+    this.category = category;
+    this.path = path;
+    this.details = details;
+    this.exitCode = EXIT_CODES[category] || 1;
+  }
+}
+
+const SENSITIVE_RE = /(secret|token|password|passwd|pwd|kubeconfig|credential|connection\s*string|connectionstring|db[_-]?uri|database[_-]?uri|mongo[_-]?uri|mongodb|private[_-]?key|access[_-]?key)/i;
+
+function sanitizeMessage(message) {
+  return String(message || "")
+    .replace(/(mongodb(?:\+srv)?:\/\/)[^\s"']+/gi, "$1[REDACTED]")
+    .replace(/(postgres(?:ql)?:\/\/)[^\s"']+/gi, "$1[REDACTED]")
+    .replace(/(mysql:\/\/)[^\s"']+/gi, "$1[REDACTED]")
+    .replace(/(Bearer\s+)[A-Za-z0-9._~+\-/]+=*/gi, "$1[REDACTED]")
+    .replace(/([A-Za-z0-9_ -]*(?:secret|token|password|kubeconfig|credential|connectionstring|connection string)[A-Za-z0-9_ -]*\s*[=:]\s*)[^\s,;]+/gi, "$1[REDACTED]");
+}
+
+function toIssue(path, message) {
+  return { path, message: sanitizeMessage(message) };
+}
+
+function isSensitiveKey(key) {
+  return SENSITIVE_RE.test(String(key));
+}
+
+module.exports = { ContractError, EXIT_CODES, sanitizeMessage, toIssue, isSensitiveKey };

package/src/deploy/contracts/infra-contract.js

@@ -0,0 +1,65 @@
+"use strict";
+
+const { spawnSync } = require("node:child_process");
+const { ContractError, toIssue } = require("./errors");
+const { readJsonFile } = require("./deploy-contract");
+
+const CONTRACT = "oon-platform-config";
+const SUPPORTED_MAJORS = new Set([1, 2]);
+const REQUIRED_COMMON = ["DNS", "DEFAULT_PROTOCOL", "INGRESS_CLASS", "CLUSTER_ISSUER", "INFRA_SCHEMA_VERSION"];
+const REQUIRED_V2 = ["REGISTRY_HOST", "PLATFORM_NAMESPACE", "DELIVERY_NAMESPACE", "RUNTIME_NAMESPACE_PREFIX", "REGISTRY_PULL_SECRET_NAME", "MONGO_ADMIN_SECRET_NAME"];
+const DEFAULTS = {
+  REGISTRY_HOST: "ghcr.io",
+  PLATFORM_NAMESPACE: "oon-system",
+  DELIVERY_NAMESPACE: "oon-delivery",
+  RUNTIME_NAMESPACE_PREFIX: "oon",
+  REGISTRY_PULL_SECRET_NAME: "ghcr-oon",
+  MONGO_ADMIN_SECRET_NAME: "oon-mongo-admin",
+  OBSERVABILITY_MODE: "contract-only",
+  NETWORK_POLICY_MODE: "baseline",
+};
+
+function majorOf(value) {
+  const match = String(value || "").match(/^(\d+)(?:\.|$)/);
+  return match ? Number(match[1]) : null;
+}
+function extractData(input) {
+  if (input && input.kind === "ConfigMap" && input.data && typeof input.data === "object") return input.data;
+  return input;
+}
+
+function validateInfraConfig(input) {
+  const data = extractData(input);
+  const issues = [];
+  if (!data || typeof data !== "object" || Array.isArray(data)) issues.push(toIssue("$", "Contrato de infraestrutura deve ser um objeto."));
+  else {
+    const major = majorOf(data.INFRA_SCHEMA_VERSION);
+    if (major !== null && !SUPPORTED_MAJORS.has(major)) throw new ContractError("UNSUPPORTED_CONTRACT_VERSION", `Major de INFRA_SCHEMA_VERSION não suportado: ${data.INFRA_SCHEMA_VERSION}.`, { path: "$.INFRA_SCHEMA_VERSION" });
+    REQUIRED_COMMON.forEach((key) => { if (data[key] === undefined || data[key] === "") issues.push(toIssue(`$.${key}`, "Chave obrigatória ausente.")); });
+    if (major === 2) {
+      REQUIRED_V2.forEach((key) => { if (data[key] === undefined || data[key] === "") issues.push(toIssue(`$.${key}`, "Chave obrigatória ausente.")); });
+      if (Object.prototype.hasOwnProperty.call(data, "OON_ENVIRONMENT")) issues.push(toIssue("$.OON_ENVIRONMENT", "A infraestrutura 2.x é neutra e não aceita ambiente."));
+    }
+  }
+  if (issues.length) throw new ContractError("SCHEMA_VALIDATION_ERROR", "oon-platform-config inválido.", { details: issues });
+  const normalized = { ...DEFAULTS, ...data };
+  delete normalized.OON_ENVIRONMENT;
+  return { ok: true, contract: CONTRACT, version: normalized.INFRA_SCHEMA_VERSION, config: normalized };
+}
+
+function validateInfraFile(file) { return validateInfraConfig(readJsonFile(file)); }
+function readConfigMapWithKubectl() {
+  const result = spawnSync("kubectl", ["-n", "oon-system", "get", "configmap", "oon-platform-config", "-o", "json"], { encoding: "utf8" });
+  if (result.error?.code === "ENOENT") throw new ContractError("KUBECTL_UNAVAILABLE", "kubectl não encontrado no PATH.");
+  if (result.error) throw new ContractError("KUBERNETES_ACCESS_ERROR", "Falha ao executar kubectl.");
+  if (result.status !== 0) {
+    const stderr = String(result.stderr || "");
+    if (/notfound|not found/i.test(stderr)) throw new ContractError("CONFIGMAP_NOT_FOUND", "ConfigMap oon-system/oon-platform-config não encontrado.");
+    throw new ContractError("KUBERNETES_ACCESS_ERROR", "Não foi possível ler o ConfigMap oon-system/oon-platform-config.");
+  }
+  try { return JSON.parse(result.stdout); }
+  catch { throw new ContractError("INVALID_JSON", "kubectl retornou JSON inválido para o ConfigMap."); }
+}
+function validateInfraFromCluster() { return validateInfraConfig(readConfigMapWithKubectl()); }
+
+module.exports = { validateInfraConfig, validateInfraFile, validateInfraFromCluster, DEFAULTS, REQUIRED_COMMON, REQUIRED_V2 };