@oondemand/oon-core-back 0.7.17 → 0.7.20

package/src/core/storage/files.js

@@ -0,0 +1,131 @@
+"use strict";
+
+/*
+ * F4.8 — Armazenamento compartilhado de arquivos.
+ *
+ * Substitui a pasta local `uploads` (que é de cada pod e some no reinício) por
+ * GridFS no MongoDB do próprio App: um arquivo gravado por uma réplica é lido
+ * por qualquer outra e sobrevive a reinícios e novas publicações. Cada arquivo
+ * pertence a um tenant; leitura, listagem e exclusão exigem o mesmo tenant,
+ * salvo quando o chamador declara `global: true` (Apps sem tenancy).
+ */
+
+const { Readable } = require("node:stream");
+const mongoose = require("../database/mongoose");
+
+const BUCKET = "oon_files";
+const DEFAULT_MAX_BYTES = 25 * 1024 * 1024;
+
+function storageError(message, code, statusCode) {
+  return Object.assign(new Error(message), { code, statusCode });
+}
+
+function bucket(connection = mongoose.connection) {
+  if (!connection?.db) throw storageError("Banco de dados indisponível para arquivos.", "FILE_STORAGE_UNAVAILABLE", 503);
+  return new mongoose.mongo.GridFSBucket(connection.db, { bucketName: BUCKET });
+}
+
+function scope({ tenantId, global = false } = {}) {
+  if (global === true) return { global: true, tenantId: null };
+  const value = tenantId === undefined || tenantId === null ? "" : String(tenantId);
+  if (!value) throw storageError("Tenant obrigatório para arquivos.", "FILE_TENANT_REQUIRED", 400);
+  return { global: false, tenantId: value };
+}
+
+function objectId(id) {
+  try { return new mongoose.Types.ObjectId(String(id)); } catch { throw storageError("Arquivo não encontrado.", "FILE_NOT_FOUND", 404); }
+}
+
+function info(doc) {
+  return { id: String(doc._id), filename: doc.filename, length: doc.length, contentType: doc.metadata?.contentType || "application/octet-stream",
+    tenantId: doc.metadata?.tenantId || null, metadata: doc.metadata?.custom || {}, uploadDate: doc.uploadDate };
+}
+
+/** Grava um arquivo (Buffer, string ou Readable) e devolve os metadados. */
+async function saveFile({ data, filename, contentType = "application/octet-stream", metadata = {}, maxBytes = DEFAULT_MAX_BYTES, ...owner } = {}, options = {}) {
+  const target = scope(owner);
+  const name = String(filename || "").trim();
+  if (!name || name.length > 255 || /[\\/\0]/.test(name)) throw storageError("Nome de arquivo inválido.", "FILE_NAME_INVALID", 422);
+  const source = data instanceof Readable ? data : Readable.from(Buffer.isBuffer(data) ? [data] : [Buffer.from(String(data ?? ""))]);
+  const upload = bucket(options.connection).openUploadStream(name, { metadata: { tenantId: target.tenantId, contentType: String(contentType), custom: metadata } });
+  let size = 0;
+  await new Promise((resolve, reject) => {
+    const fail = (error) => { source.destroy(); upload.abort().catch(() => {}).finally(() => reject(error)); };
+    source.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > maxBytes) return fail(storageError(`Arquivo maior que o limite de ${maxBytes} bytes.`, "FILE_TOO_LARGE", 413));
+      if (!upload.write(chunk)) source.pause();
+    });
+    upload.on("drain", () => source.resume());
+    source.on("error", fail);
+    upload.on("error", reject);
+    upload.on("finish", resolve);
+    source.on("end", () => { if (size <= maxBytes) upload.end(); });
+  });
+  return getFileInfo(upload.id, target, options);
+}
+
+async function findScoped(id, owner, options) {
+  const target = scope(owner);
+  const [doc] = await bucket(options.connection).find({ _id: objectId(id), ...(target.global ? {} : { "metadata.tenantId": target.tenantId }) }).limit(1).toArray();
+  if (!doc) throw storageError("Arquivo não encontrado.", "FILE_NOT_FOUND", 404);
+  return doc;
+}
+
+async function getFileInfo(id, owner = {}, options = {}) {
+  return info(await findScoped(id, owner, options));
+}
+
+/** Abre o conteúdo para leitura em stream, no escopo do tenant. */
+async function openFile(id, owner = {}, options = {}) {
+  const doc = await findScoped(id, owner, options);
+  return { file: info(doc), stream: bucket(options.connection).openDownloadStream(doc._id) };
+}
+
+async function readFile(id, owner = {}, options = {}) {
+  const { file, stream } = await openFile(id, owner, options);
+  const chunks = [];
+  for await (const chunk of stream) chunks.push(chunk);
+  return { file, data: Buffer.concat(chunks) };
+}
+
+async function listFiles(owner = {}, { limit = 100, filename } = {}, options = {}) {
+  const target = scope(owner);
+  const filter = { ...(target.global ? {} : { "metadata.tenantId": target.tenantId }), ...(filename ? { filename: String(filename) } : {}) };
+  const docs = await bucket(options.connection).find(filter).sort({ uploadDate: -1 }).limit(Math.min(Math.max(1, Number(limit) || 100), 500)).toArray();
+  return docs.map(info);
+}
+
+async function deleteFile(id, owner = {}, options = {}) {
+  const doc = await findScoped(id, owner, options);
+  await bucket(options.connection).delete(doc._id);
+  return { deleted: true, id: String(doc._id) };
+}
+
+/** Responde a requisição com o arquivo (download ou exibição). */
+async function sendFile(res, id, owner = {}, { download = false } = {}, options = {}) {
+  const { file, stream } = await openFile(id, owner, options);
+  res.setHeader("Content-Type", file.contentType);
+  res.setHeader("Content-Length", String(file.length));
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("Content-Disposition", `${download ? "attachment" : "inline"}; filename*=UTF-8''${encodeURIComponent(file.filename)}`);
+  await new Promise((resolve, reject) => { stream.on("error", reject); res.on("finish", resolve); stream.pipe(res); });
+  return file;
+}
+
+/** Atalho com o tenant do request autenticado (req.accessContext). */
+function forRequest(req) {
+  const tenantId = req?.accessContext?.tenantId;
+  const owner = tenantId ? { tenantId } : { global: true };
+  return {
+    save: (input) => saveFile({ ...input, ...owner }),
+    info: (id) => getFileInfo(id, owner),
+    open: (id) => openFile(id, owner),
+    read: (id) => readFile(id, owner),
+    list: (query) => listFiles(owner, query),
+    remove: (id) => deleteFile(id, owner),
+    send: (res, id, opts) => sendFile(res, id, owner, opts),
+  };
+}
+
+module.exports = { BUCKET, DEFAULT_MAX_BYTES, saveFile, getFileInfo, openFile, readFile, listFiles, deleteFile, sendFile, forRequest };

package/src/core/usage/reporter.js

@@ -0,0 +1,193 @@
+"use strict";
+
+/*
+ * F5.3/F5.5 — consumo do App para os limites de uso do plano.
+ *
+ * `usage.record(metric, quantidade, { tenantId })` acumula em memória e, a
+ * cada `OON_USAGE_FLUSH_MS` (padrão 15 s), fecha um lote com id único. O lote
+ * é gravado na outbox `oon_usage_outbox` do MongoDB do App antes do envio,
+ * então sobrevive a reinício e qualquer réplica pode reenviá-lo. A Central
+ * conta cada id uma vez só, mesmo se o lote for reenviado.
+ *
+ * `usage.assertAvailable(metric, { tenantId })` recusa a operação (423
+ * USAGE_LIMIT_REACHED) quando o plano bloqueia ao atingir o limite. O estado
+ * vem da Central (resposta do lote ou consulta, cache de 60 s) somado ao que
+ * ainda não foi enviado. Se a Central não responde, a operação segue: o
+ * consumo continua registrado e o limite é aplicado quando ela voltar.
+ */
+
+const crypto = require("node:crypto");
+const axios = require("axios");
+const mongoose = require("../database/mongoose");
+const { operationalRequestHeaders } = require("../utils/instanceActivation");
+const { getBaseUrl, getTimeout } = require("../utils/activationProvider");
+const { isLocalRuntime } = require("../runtime/localDevelopment");
+
+const METRIC = /^[a-z][a-z0-9_.-]{1,62}$/;
+const COLLECTION = "oon_usage_outbox";
+const STATE_TTL_MS = 60 * 1000;
+const LEASE_MS = 30 * 1000;
+const MAX_ATTEMPTS = 20;
+const owner = `${process.pid}:${crypto.randomUUID()}`;
+
+const buffers = new Map(); // tenantId -> Map(metric -> quantity)
+const memoryOutbox = []; // sem banco conectado
+const states = new Map(); // tenantId -> { at, metrics: Map }
+let timer = null;
+let flushing = null;
+
+function flushInterval() {
+  const value = Number(process.env.OON_USAGE_FLUSH_MS);
+  return Number.isSafeInteger(value) && value >= 1000 ? value : 15000;
+}
+function usageError(message, code, statusCode, details) {
+  return Object.assign(new Error(message), { code, statusCode, ...(details ? { details } : {}) });
+}
+function collection() {
+  return mongoose.connection?.readyState === 1 && mongoose.connection.db ? mongoose.connection.db.collection(COLLECTION) : null;
+}
+function key(tenantId) {
+  const value = tenantId === undefined || tenantId === null ? "" : String(tenantId);
+  if (!value) throw usageError("Tenant obrigatório para registrar consumo.", "USAGE_TENANT_REQUIRED", 400);
+  return value;
+}
+function ensureTimer() {
+  if (timer) return;
+  timer = setInterval(() => { flush().catch(() => {}); }, flushInterval());
+  timer.unref?.();
+}
+
+/** Registra consumo (acumulado e enviado em lote). */
+function record(metric, quantity = 1, { tenantId } = {}) {
+  if (!METRIC.test(String(metric || ""))) throw usageError("Métrica de uso inválida.", "USAGE_METRIC_INVALID", 422, { metric });
+  if (!Number.isSafeInteger(quantity) || quantity < 1) throw usageError("Quantidade de uso inválida.", "USAGE_QUANTITY_INVALID", 422);
+  if (isLocalRuntime()) return { recorded: false, reason: "local" };
+  const tenant = key(tenantId);
+  const bucket = buffers.get(tenant) || new Map();
+  bucket.set(metric, (bucket.get(metric) || 0) + quantity);
+  buffers.set(tenant, bucket);
+  ensureTimer();
+  return { recorded: true };
+}
+
+function pendingFor(tenantId, metric) {
+  return buffers.get(String(tenantId))?.get(metric) || 0;
+}
+
+/** Fecha os lotes em memória, grava na outbox e envia os pendentes. */
+async function flush() {
+  if (flushing) return flushing;
+  flushing = (async () => {
+    const at = new Date();
+    for (const [tenantId, bucket] of [...buffers.entries()]) {
+      buffers.delete(tenantId);
+      const items = [...bucket.entries()].map(([metric, quantity]) => ({ metric, quantity }));
+      if (!items.length) continue;
+      const batch = { _id: crypto.randomUUID(), tenantId, items, status: "pending", attempts: 0, nextAttemptAt: at, createdAt: at };
+      const outbox = collection();
+      if (outbox) await outbox.insertOne(batch); else memoryOutbox.push(batch);
+    }
+    return deliverPending();
+  })().finally(() => { flushing = null; });
+  return flushing;
+}
+
+async function send(batch) {
+  const response = await axios.post(`${getBaseUrl()}/integracao/app-usage/batches`,
+    { tenantId: batch.tenantId, batchId: batch._id, items: batch.items },
+    { headers: await operationalRequestHeaders({ tenantId: batch.tenantId, correlationId: `usage:${batch._id}` }), timeout: getTimeout(), maxRedirects: 0 });
+  remember(batch.tenantId, response.data);
+  return response.data;
+}
+
+function retryable(error) {
+  const status = error?.response?.status;
+  return !status || status >= 500 || status === 429 || status === 408;
+}
+
+async function deliverPending({ limit = 20 } = {}) {
+  const outbox = collection();
+  let sent = 0, failed = 0;
+  if (!outbox) {
+    for (const batch of memoryOutbox.splice(0, limit)) {
+      try { await send(batch); sent++; } catch (error) { failed++; if (retryable(error)) memoryOutbox.push(batch); }
+    }
+    return { sent, failed };
+  }
+  for (let i = 0; i < limit; i++) {
+    const now = new Date();
+    const batch = await outbox.findOneAndUpdate(
+      { status: "pending", nextAttemptAt: { $lte: now }, $or: [{ leaseUntil: { $exists: false } }, { leaseUntil: { $lt: now } }] },
+      { $set: { leaseUntil: new Date(+now + LEASE_MS), leaseOwner: owner } }, { sort: { nextAttemptAt: 1 }, returnDocument: "after" });
+    const doc = batch?.value === undefined ? batch : batch.value;
+    if (!doc) break;
+    try {
+      await send(doc);
+      await outbox.deleteOne({ _id: doc._id, leaseOwner: owner });
+      sent++;
+    } catch (error) {
+      failed++;
+      const attempts = (doc.attempts || 0) + 1;
+      const terminal = !retryable(error) || attempts >= MAX_ATTEMPTS;
+      await outbox.updateOne({ _id: doc._id, leaseOwner: owner }, {
+        $set: { attempts, status: terminal ? "rejected" : "pending", nextAttemptAt: new Date(Date.now() + Math.min(3600000, 2 ** attempts * 1000)),
+          lastError: { status: error?.response?.status || null, code: error?.response?.data?.code || error?.code || null, at: new Date() } },
+        $unset: { leaseUntil: 1, leaseOwner: 1 } });
+    }
+  }
+  return { sent, failed };
+}
+
+function remember(tenantId, data) {
+  if (!data || !Array.isArray(data.metrics)) return;
+  states.set(String(tenantId), { at: Date.now(), metrics: new Map(data.metrics.map((m) => [m.metric, m])) });
+}
+
+async function state(tenantId, { refresh = false } = {}) {
+  const tenant = key(tenantId);
+  const cached = states.get(tenant);
+  if (!refresh && cached && Date.now() - cached.at < STATE_TTL_MS) return cached;
+  const response = await axios.get(`${getBaseUrl()}/integracao/app-usage/state`, {
+    params: { tenantId: tenant }, headers: await operationalRequestHeaders({ tenantId: tenant, correlationId: `usage-state:${crypto.randomUUID()}` }),
+    timeout: getTimeout(), maxRedirects: 0 });
+  remember(tenant, response.data);
+  return states.get(tenant) || { at: Date.now(), metrics: new Map() };
+}
+
+/** Recusa a operação quando a métrica bloqueia ao atingir o limite do ciclo. */
+async function assertAvailable(metric, { tenantId, quantity = 1 } = {}) {
+  if (isLocalRuntime()) return { available: true, reason: "local" };
+  let current;
+  try { current = await state(tenantId); } catch { return { available: true, reason: "central_unavailable" }; }
+  const limit = current.metrics.get(metric);
+  if (!limit || limit.onLimit !== "block") return { available: true };
+  const used = (limit.used || 0) + pendingFor(tenantId, metric);
+  if (used + quantity > limit.included) {
+    throw usageError(`O limite de ${limit.label || metric} do plano foi atingido neste ciclo (${limit.included}). O uso volta no próximo ciclo ou com a troca de plano.`,
+      "USAGE_LIMIT_REACHED", 423, { metric, used, included: limit.included, periodEndAt: limit.periodEndAt || null });
+  }
+  return { available: true, remaining: limit.included - used };
+}
+
+/** Middleware: confere o limite antes e registra 1 uso quando a resposta for 2xx. */
+function limit(metric, { quantity = 1 } = {}) {
+  return async (req, res, next) => {
+    const tenantId = req.accessContext?.tenantId;
+    try {
+      await assertAvailable(metric, { tenantId, quantity });
+      res.on("finish", () => { if (res.statusCode >= 200 && res.statusCode < 300) { try { record(metric, quantity, { tenantId }); } catch { /* sem tenant */ } } });
+      return next();
+    } catch (error) {
+      return res.status(error.statusCode || 500).json({ code: error.code, message: error.message, details: error.details });
+    }
+  };
+}
+
+async function stop() {
+  if (timer) { clearInterval(timer); timer = null; }
+  if (buffers.size) await flush().catch(() => {});
+}
+
+function reset() { buffers.clear(); memoryOutbox.length = 0; states.clear(); if (timer) { clearInterval(timer); timer = null; } }
+
+module.exports = { COLLECTION, record, flush, deliverPending, state, assertAvailable, limit, stop, reset };

package/src/core/utils/instanceActivation.js

@@ -284,16 +284,26 @@ async function ensureInstance() {
   );
 
   if (!instance) {
-    instance = await Instancia.create({
-      ecosystemRole: role(),
-      status: "nao_ativada",
-      appCode: getAppCode(),
-      ambiente: ambiente(),
-      ecosystemUrl: process.env.CENTRAL_ATIVACAO_URL,
-      publicUrl: process.env.PUBLIC_APP_URL,
-      coreVersion: version(),
-      appVersion: version(),
-    });
+    try {
+      instance = await Instancia.create({
+        ecosystemRole: role(),
+        status: "nao_ativada",
+        appCode: getAppCode(),
+        ambiente: ambiente(),
+        ecosystemUrl: process.env.CENTRAL_ATIVACAO_URL,
+        publicUrl: process.env.PUBLIC_APP_URL,
+        coreVersion: version(),
+        appVersion: version(),
+      });
+    } catch (error) {
+      // Outra réplica criou a instância entre o findOne e o create; o índice
+      // único de singletonKey impede a duplicidade, então basta reler.
+      if (error?.code !== 11000) throw error;
+      instance = await Instancia.findOne().select(
+        "+credentialEncrypted +credentialIv +credentialAuthTag +activationRequest",
+      );
+      if (!instance) throw error;
+    }
   }
 
   if (instance.ecosystemRole !== role()) {

package/src/delivery/runtime.js

@@ -38,7 +38,40 @@ function readSecret(namespace, name, key) {
   } catch { return null; }
 }
 
+// Piso da cota do namespace (valores anteriores, fixos para todo App).
+const QUOTA_FLOOR = Object.freeze({ requestsCpuMilli: 2000, requestsMemoryMi: 2048, limitsCpuMilli: 4000, limitsMemoryMi: 4096, pods: 20 });
+
+function cpuMilli(value) {
+  const text = String(value);
+  return text.endsWith("m") ? Number(text.slice(0, -1)) : Number(text) * 1000;
+}
+
+function memoryMi(value) {
+  const text = String(value);
+  if (text.endsWith("Gi")) return Number(text.slice(0, -2)) * 1024;
+  if (text.endsWith("Mi")) return Number(text.slice(0, -2));
+  throw new Error(`Unidade de memória não suportada: ${text}`);
+}
+
+/**
+ * Cota do namespace calculada pelas réplicas e pelo perfil de recursos, com
+ * espaço para o pod extra do rolling update (maxSurge 1). Nunca fica abaixo
+ * do piso anterior, então Apps de 1 réplica mantêm a cota de sempre.
+ */
+function namespaceQuota({ replicas = 1, profile = "small" } = {}) {
+  const resources = RESOURCE_PROFILES[profile] || RESOURCE_PROFILES.small;
+  const pods = replicas + 1;
+  return {
+    requestsCpu: `${Math.max(QUOTA_FLOOR.requestsCpuMilli, pods * cpuMilli(resources.cpuRequest))}m`,
+    requestsMemory: `${Math.max(QUOTA_FLOOR.requestsMemoryMi, pods * memoryMi(resources.memoryRequest))}Mi`,
+    limitsCpu: `${Math.max(QUOTA_FLOOR.limitsCpuMilli, pods * cpuMilli(resources.cpuLimit))}m`,
+    limitsMemory: `${Math.max(QUOTA_FLOOR.limitsMemoryMi, pods * memoryMi(resources.memoryLimit))}Mi`,
+    pods: Math.max(QUOTA_FLOOR.pods, pods),
+  };
+}
+
 function baselineManifest({ context }) {
+  const quota = namespaceQuota({ replicas: replicaCount(context), profile: context.resourceProfile });
   return `apiVersion: v1
 kind: Namespace
 metadata:
@@ -66,7 +99,7 @@ apiVersion: v1
 kind: ResourceQuota
 metadata: { name: oon-runtime-quota, namespace: ${context.namespace} }
 spec:
-  hard: { requests.cpu: "2", requests.memory: 2Gi, limits.cpu: "4", limits.memory: 4Gi, pods: "20", services: "10" }
+  hard: { requests.cpu: "${quota.requestsCpu}", requests.memory: ${quota.requestsMemory}, limits.cpu: "${quota.limitsCpu}", limits.memory: ${quota.limitsMemory}, pods: "${quota.pods}", services: "10" }
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -83,8 +116,74 @@ spec:
 `;
 }
 
+// Cada slot contratado é uma réplica. O teto acompanha a cota de pods do
+// namespace (baselineManifest), com folga para o pod extra do rolling update.
+const MAX_REPLICAS = 10;
+// preStop + OON_SHUTDOWN_GRACE_MS do supervisor (25 s) cabem neste prazo.
+const PRE_STOP_SECONDS = 5;
+const TERMINATION_GRACE_SECONDS = 40;
+
+function replicaCount(context = {}) {
+  const value = context.replicas ?? 1;
+  if (!Number.isSafeInteger(value) || value < 1 || value > MAX_REPLICAS) {
+    throw new Error(`Número de réplicas inválido no contexto de delivery: ${JSON.stringify(value)} (esperado 1 a ${MAX_REPLICAS}).`);
+  }
+  return value;
+}
+
+// F4.2: modo de performance do ambiente (pool MongoDB 4, 8 ou 16).
+const PERFORMANCE_MODES = ["min", "normal", "ultra"];
+function performanceMode(context = {}) {
+  const value = context.performanceMode ?? "min";
+  if (!PERFORMANCE_MODES.includes(value)) {
+    throw new Error(`Modo de performance inválido no contexto de delivery: ${JSON.stringify(value)} (esperado ${PERFORMANCE_MODES.join(", ")}).`);
+  }
+  return value;
+}
+
+// F4.6: domínios personalizados do App (raiz e www), já com DNS aprovado na
+// Central. Ficam num Ingress próprio, com certificado HTTP-01 do cert-manager
+// (renovação automática), para que um domínio com problema não afete o host
+// da plataforma.
+const MAX_CUSTOM_DOMAINS = 10;
+const HOSTNAME = /^(?=.{4,253}$)(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/;
+function customDomains(context = {}) {
+  const value = context.customDomains ?? [];
+  if (!Array.isArray(value) || value.length > MAX_CUSTOM_DOMAINS
+    || value.some((host) => typeof host !== "string" || !HOSTNAME.test(host) || host === context.hostname)
+    || new Set(value).size !== value.length) {
+    throw new Error(`Domínios personalizados inválidos no contexto de delivery: ${JSON.stringify(value)}.`);
+  }
+  return value;
+}
+function customDomainIngress({ context, infra }) {
+  const hosts = customDomains(context);
+  if (!hosts.length) return "";
+  return `---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ${context.appCode}-custom
+  namespace: ${context.namespace}
+  annotations: { cert-manager.io/cluster-issuer: ${infra.CUSTOM_DOMAIN_CLUSTER_ISSUER || "letsencrypt-production-http01"} }
+spec:
+  ingressClassName: ${infra.INGRESS_CLASS}
+  tls: [{ hosts: [${hosts.join(", ")}], secretName: ${context.appCode}-custom-tls }]
+  rules:
+${hosts.map((host) => `    - host: ${host}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service: { name: ${context.appCode}, port: { name: http } }`).join("\n")}
+`;
+}
+
 function runtimeManifest({ context, infra, imageRef, profile = "small" }) {
   const resources = RESOURCE_PROFILES[profile] || RESOURCE_PROFILES.small;
+  const replicas = replicaCount(context);
+  const mode = performanceMode(context);
   const releaseLabel = kubernetesLabelValue(context.releaseId);
   const releaseAnnotation = JSON.stringify(String(context.releaseId));
   return `apiVersion: apps/v1
@@ -93,7 +192,10 @@ metadata:
   name: ${context.appCode}
   namespace: ${context.namespace}
 spec:
-  replicas: 1
+  replicas: ${replicas}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate: { maxUnavailable: 0, maxSurge: 1 }
   selector:
     matchLabels: { app.kubernetes.io/name: ${context.appCode} }
   template:
@@ -106,6 +208,13 @@ spec:
         oon.dev/release-id: ${releaseAnnotation}
     spec:
       serviceAccountName: oon-runtime
+      terminationGracePeriodSeconds: ${TERMINATION_GRACE_SECONDS}
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels: { app.kubernetes.io/name: ${context.appCode} }
       imagePullSecrets: [{ name: ${infra.REGISTRY_PULL_SECRET_NAME || "ghcr-oon"} }]
       containers:
         - name: central
@@ -113,8 +222,10 @@ spec:
           imagePullPolicy: IfNotPresent
           ports: [{ name: http, containerPort: 8080 }]
           envFrom: [{ secretRef: { name: oon-runtime } }]
-${context.functionalCapabilities?.["core.secrets"]?.enabled ? `          env:
-            - name: OON_SECRETS_KEY
+          env:
+            - name: OON_DB_PERFORMANCE_MODE
+              value: "${mode}"
+${context.functionalCapabilities?.["core.secrets"]?.enabled ? `            - name: OON_SECRETS_KEY
               valueFrom:
                 secretKeyRef: { name: oon-core-secrets, key: OON_SECRETS_KEY, optional: true }
 ` : ""}
@@ -127,6 +238,20 @@ ${context.functionalCapabilities?.["core.secrets"]?.enabled ? `          env:
           readinessProbe:
             httpGet: { path: /api/health/ready, port: http }
             initialDelaySeconds: 10
+          lifecycle:
+            # Dá tempo para o ingress tirar o pod dos endpoints antes do SIGTERM.
+            preStop:
+              exec: { command: ["sleep", "${PRE_STOP_SECONDS}"] }
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata: { name: ${context.appCode}, namespace: ${context.namespace} }
+spec:
+  # Drains e a autoescala de nós tiram no máximo uma réplica por vez; com uma
+  # réplica só, o PDB não bloqueia a manutenção do nó.
+  maxUnavailable: 1
+  selector:
+    matchLabels: { app.kubernetes.io/name: ${context.appCode} }
 ---
 apiVersion: v1
 kind: Service
@@ -152,7 +277,28 @@ spec:
             pathType: Prefix
             backend:
               service: { name: ${context.appCode}, port: { name: http } }
-`;
+${customDomainIngress({ context, infra })}`;
+}
+
+/**
+ * F4.6: sem domínios ativos, o Ingress dos domínios personalizados sai. O
+ * publisher não tem permissão de delete (contrato do oon-k8s-infra), então
+ * só tenta remover quando o Ingress existe; se o cluster recusar, avisa e
+ * segue, e a remoção fica para quem administra o cluster.
+ */
+function removeStaleCustomDomainIngress(context, run = kubectl) {
+  if (customDomains(context).length) return "domains";
+  const name = `${context.appCode}-custom`;
+  const found = run(["-n", context.namespace, "get", "ingress", name, "--ignore-not-found", "-o", "name"], { capture: true });
+  if (!found) return "absent";
+  try {
+    run(["-n", context.namespace, "delete", "ingress", name], { capture: true });
+    return "deleted";
+  } catch (error) {
+    if (!/forbidden/i.test(error.message)) throw error;
+    console.warn(`[oon-delivery] Ingress ${context.namespace}/${name} sem domínio ativo não pôde ser removido (sem permissão de delete). Remova-o manualmente.`);
+    return "kept";
+  }
 }
 
 function copyPullSecret(namespace, infra) {
@@ -264,6 +410,7 @@ function deployRuntime({ context, infra, imageDigest, resourceProfile = "small"
   copyPullSecret(context.namespace, infra);
   const imageRef = `${context.imageRepository}@${imageDigest}`;
   applyYaml(runtimeManifest({ context, infra, imageRef, profile: resourceProfile }));
+  removeStaleCustomDomainIngress(context);
   kubectl(["-n", context.namespace, "rollout", "status", `deployment/${context.appCode}`, "--timeout=10m"]);
   return { infraVersion: infra.INFRA_SCHEMA_VERSION, imageRef };
 }
@@ -306,4 +453,4 @@ async function activateMember(context) {
   return data;
 }
 
-module.exports = { supportsSecretsV1: true, RESOURCE_PROFILES, randomSecret, dnsLabel, kubernetesLabelValue, provisionMongo, validateMongoUri, baselineManifest, runtimeManifest, provisionRuntime, deployRuntime, waitHttp, activateMember };
+module.exports = { supportsSecretsV1: true, RESOURCE_PROFILES, MAX_REPLICAS, replicaCount, PERFORMANCE_MODES, performanceMode, MAX_CUSTOM_DOMAINS, customDomains, namespaceQuota, randomSecret, dnsLabel, kubernetesLabelValue, provisionMongo, validateMongoUri, baselineManifest, runtimeManifest, provisionRuntime, deployRuntime, removeStaleCustomDomainIngress, waitHttp, activateMember };

package/src/delivery/supervisor.js

@@ -2,9 +2,19 @@
 
 // PID 1 owns both process groups. An unexpected exit (including status 0)
 // terminates the container; a live proxy cannot hide a dead backend.
+// On SIGTERM each child gets its own stop signal (nginx: SIGQUIT = graceful)
+// and `graceMs` to drain in-flight requests before SIGKILL. The Deployment's
+// terminationGracePeriodSeconds must exceed preStop + graceMs.
 const { spawn } = require("node:child_process");
 
-function supervise({ backend, proxy, graceMs = 5000 } = {}) {
+const DEFAULT_GRACE_MS = 25000;
+
+function graceFromEnv(env = process.env) {
+  const value = Number(env.OON_SHUTDOWN_GRACE_MS);
+  return Number.isSafeInteger(value) && value > 0 ? value : DEFAULT_GRACE_MS;
+}
+
+function supervise({ backend, proxy, graceMs = graceFromEnv() } = {}) {
   const children = [];
   let stopping = false;
   let exitCode = 1;
@@ -25,7 +35,7 @@ function supervise({ backend, proxy, graceMs = 5000 } = {}) {
     if (stopping) return;
     stopping = true;
     exitCode = code;
-    for (const child of children) signalGroup(child, "SIGTERM");
+    for (const child of children) signalGroup(child, child.stopSignal);
     timer = setTimeout(() => {
       for (const child of children) signalGroup(child, "SIGKILL");
     }, graceMs);
@@ -36,6 +46,7 @@ function supervise({ backend, proxy, graceMs = 5000 } = {}) {
       cwd: spec.cwd, env: { ...process.env, PORT: "4000" },
       stdio: "inherit", detached: true,
     });
+    child.stopSignal = spec.stopSignal || "SIGTERM";
     children.push(child);
     child.once("error", () => { child.failed = true; stop(1); finish(); });
     child.once("exit", () => { stop(1); finish(); });
@@ -46,7 +57,7 @@ function supervise({ backend, proxy, graceMs = 5000 } = {}) {
 
 if (require.main === module) supervise({
   backend: { command: process.execPath, args: ["/oon-delivery/launchRuntime.js"], cwd: "/app/backend" },
-  proxy: { command: "nginx", args: ["-c", "/etc/nginx/oon.conf", "-g", "daemon off;"] },
+  proxy: { command: "nginx", args: ["-c", "/etc/nginx/oon.conf", "-g", "daemon off;"], stopSignal: "SIGQUIT" },
 });
 
-module.exports = { supervise };
+module.exports = { supervise, graceFromEnv, DEFAULT_GRACE_MS };

package/src/index.js

@@ -83,5 +83,9 @@ module.exports = {
   PdfRenderingError: capabilities.PdfRenderingError,
   TransactionalEmailError: capabilities.TransactionalEmailError,
   GenericError, registry,
+  // F4.8: arquivos compartilhados entre réplicas (GridFS no MongoDB do App).
+  files: require("./core/storage/files"),
+  // F5.3/F5.5: consumo para os limites de uso do plano do App.
+  usage: require("./core/usage/reporter"),
 };