@podosoft/podokit 0.16.3 → 0.17.0

package/dist/deploy-profile.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.profileDirectory = profileDirectory;
-exports.profilePath = profilePath;
+exports.profilePath = exports.profileDirectory = void 0;
 exports.loadDeploymentProfile = loadDeploymentProfile;
 exports.listDeploymentProfiles = listDeploymentProfiles;
 exports.initializeDeploymentProfile = initializeDeploymentProfile;
@@ -11,134 +10,24 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const lockfile_1 = require("./lockfile");
-const PROFILE_NAME = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
-const DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-const IMAGE_NAME = /^(?:[a-z0-9]+(?:[._-][a-z0-9]+)*(?::[1-9][0-9]{0,4})?\/)?(?:[a-z0-9]+(?:[._-][a-z0-9]+)*\/)*[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
-const IMAGE_TAG = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+const deploy_schema_1 = require("./deploy-schema");
+var deploy_schema_2 = require("./deploy-schema");
+Object.defineProperty(exports, "profileDirectory", { enumerable: true, get: function () { return deploy_schema_2.profileDirectory; } });
+Object.defineProperty(exports, "profilePath", { enumerable: true, get: function () { return deploy_schema_2.profilePath; } });
 const RESOURCE_VALUE = /^[1-9][0-9]*(?:m|Mi|Gi)?$/;
 const STORAGE_VALUE = /^[1-9][0-9]*(?:Mi|Gi|Ti)$/;
-const SENSITIVE_KEY = /(password|passphrase|secret|token|private.?key|credential|access.?key|api.?keys?|signing.?key|encryption.?key)/i;
-const STABLE_SEMVER_TAG_PATTERN = "^v(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$";
-function containsUrlCredentials(value) {
-    if (!value.includes("://"))
-        return false;
-    try {
-        const parsed = new URL(value);
-        return parsed.username !== "" || parsed.password !== "";
-    }
-    catch {
-        return false;
-    }
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function assertOnlyKeys(value, allowed, field) {
-    const unexpected = Object.keys(value).filter((key) => !allowed.includes(key));
-    if (unexpected.length) {
-        throw new Error(`Deployment profile field "${field}" contains unknown key(s): ${unexpected.join(", ")}.`);
-    }
-}
-function requiredRecord(parent, key) {
-    const value = parent[key];
-    if (!isRecord(value))
-        throw new Error(`Deployment profile field "${key}" must be an object.`);
-    return value;
-}
-function requiredString(parent, key) {
-    const value = parent[key];
-    if (typeof value !== "string" || value.trim() === "") {
-        throw new Error(`Deployment profile field "${key}" must be a non-empty string.`);
-    }
-    return value;
-}
-function optionalString(parent, key) {
-    const value = parent[key];
-    if (value === null || value === undefined)
-        return null;
-    if (typeof value !== "string" || value.trim() === "") {
-        throw new Error(`Deployment profile field "${key}" must be a string or null.`);
-    }
-    return value;
-}
-function requiredNumber(parent, key) {
-    const value = parent[key];
-    if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
-        throw new Error(`Deployment profile field "${key}" must be a positive integer.`);
-    }
-    return value;
-}
-function parseRequiredKeys(value, field) {
-    if (!Array.isArray(value)) {
-        throw new Error(`Deployment profile field "${field}" must be a string array.`);
-    }
-    const keys = value.map((entry) => {
-        if (typeof entry !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(entry)) {
-            throw new Error(`Deployment profile field "${field}" contains an invalid environment key.`);
-        }
-        return entry;
-    });
-    if (new Set(keys).size !== keys.length) {
-        throw new Error(`Deployment profile field "${field}" contains duplicate keys.`);
-    }
-    return keys.sort();
-}
 function parseNamedSecret(value, field) {
-    if (!isRecord(value)) {
+    if (!(0, deploy_schema_1.isRecord)(value)) {
         throw new Error(`Deployment profile field "${field}" must be an object.`);
     }
-    assertOnlyKeys(value, ["name", "requiredKeys"], field);
+    (0, deploy_schema_1.assertOnlyKeys)(value, ["name", "requiredKeys"], field);
     const parsed = {
-        name: requiredString(value, "name"),
-        requiredKeys: parseRequiredKeys(value.requiredKeys, `${field}.requiredKeys`),
+        name: (0, deploy_schema_1.requiredString)(value, "name"),
+        requiredKeys: (0, deploy_schema_1.parseRequiredKeys)(value.requiredKeys, `${field}.requiredKeys`),
     };
-    validateDnsLabel(parsed.name, `${field}.name`);
+    (0, deploy_schema_1.validateDnsLabel)(parsed.name, `${field}.name`);
     return parsed;
 }
-function validateDnsLabel(value, field) {
-    if (!DNS_LABEL.test(value)) {
-        throw new Error(`Deployment profile field "${field}" must be a Kubernetes DNS label.`);
-    }
-}
-function validateDnsSubdomain(value, field) {
-    if (value.length > 253 ||
-        !value.split(".").every((label) => DNS_LABEL.test(label))) {
-        throw new Error(`Deployment profile field "${field}" must be a Kubernetes DNS subdomain.`);
-    }
-}
-function parseImageReference(value) {
-    if (value.length > 512 || value.includes("://") || /[\s\u0000-\u001f\u007f]/.test(value)) {
-        return null;
-    }
-    const at = value.indexOf("@");
-    if (at !== -1 && at !== value.lastIndexOf("@"))
-        return null;
-    const digest = at === -1 ? null : value.slice(at + 1);
-    const tagged = at === -1 ? value : value.slice(0, at);
-    const lastSlash = tagged.lastIndexOf("/");
-    const lastColon = tagged.lastIndexOf(":");
-    const hasTag = lastColon > lastSlash;
-    const name = hasTag ? tagged.slice(0, lastColon) : tagged;
-    const tag = hasTag ? tagged.slice(lastColon + 1) : null;
-    if (!IMAGE_NAME.test(name) ||
-        (tag !== null && !IMAGE_TAG.test(tag)) ||
-        (digest !== null && !/^sha256:[a-f0-9]{64}$/.test(digest))) {
-        return null;
-    }
-    return { name, tag, digest };
-}
-function validateImage(value, field) {
-    const parsed = parseImageReference(value);
-    if (!parsed || parsed.tag === "latest" || (!parsed.tag && !parsed.digest)) {
-        throw new Error(`Deployment profile field "${field}" must use an explicit non-latest image tag or digest.`);
-    }
-}
-function validateImageRepository(value, field) {
-    const parsed = parseImageReference(value);
-    if (!parsed || parsed.tag || parsed.digest) {
-        throw new Error(`Deployment profile field "${field}" must be an image repository without a tag or digest.`);
-    }
-}
 function validateResource(value, field) {
     if (!RESOURCE_VALUE.test(value)) {
         throw new Error(`Deployment profile field "${field}" is not a supported resource quantity.`);
@@ -150,22 +39,22 @@ function validateStorage(value, field) {
     }
 }
 function parseResources(value, field) {
-    assertOnlyKeys(value, ["cpuRequest", "cpuLimit", "memoryRequest", "memoryLimit"], field);
+    (0, deploy_schema_1.assertOnlyKeys)(value, ["cpuRequest", "cpuLimit", "memoryRequest", "memoryLimit"], field);
     const parsed = {
-        cpuRequest: requiredString(value, "cpuRequest"),
-        cpuLimit: requiredString(value, "cpuLimit"),
-        memoryRequest: requiredString(value, "memoryRequest"),
-        memoryLimit: requiredString(value, "memoryLimit"),
+        cpuRequest: (0, deploy_schema_1.requiredString)(value, "cpuRequest"),
+        cpuLimit: (0, deploy_schema_1.requiredString)(value, "cpuLimit"),
+        memoryRequest: (0, deploy_schema_1.requiredString)(value, "memoryRequest"),
+        memoryLimit: (0, deploy_schema_1.requiredString)(value, "memoryLimit"),
     };
     for (const [key, quantity] of Object.entries(parsed))
         validateResource(quantity, `${field}.${key}`);
     return parsed;
 }
 function parseWorkload(value, field) {
-    assertOnlyKeys(value, ["replicas", "resources"], field);
+    (0, deploy_schema_1.assertOnlyKeys)(value, ["replicas", "resources"], field);
     return {
-        replicas: requiredNumber(value, "replicas"),
-        resources: parseResources(requiredRecord(value, "resources"), `${field}.resources`),
+        replicas: (0, deploy_schema_1.requiredNumber)(value, "replicas"),
+        resources: parseResources((0, deploy_schema_1.requiredRecord)(value, "resources"), `${field}.resources`),
     };
 }
 function parseMode(value, field) {
@@ -175,16 +64,16 @@ function parseMode(value, field) {
     return value;
 }
 function parseStatefulDependency(value, field, extraKeys = []) {
-    assertOnlyKeys(value, ["mode", "image", "secretName", "storageClassName", "storageSize", ...extraKeys], field);
+    (0, deploy_schema_1.assertOnlyKeys)(value, ["mode", "image", "secretName", "storageClassName", "storageSize", ...extraKeys], field);
     const parsed = {
         mode: parseMode(value.mode, `${field}.mode`),
-        image: requiredString(value, "image"),
-        secretName: requiredString(value, "secretName"),
+        image: (0, deploy_schema_1.requiredString)(value, "image"),
+        secretName: (0, deploy_schema_1.requiredString)(value, "secretName"),
         storageClassName: typeof value.storageClassName === "string" ? value.storageClassName : "",
-        storageSize: requiredString(value, "storageSize"),
+        storageSize: (0, deploy_schema_1.requiredString)(value, "storageSize"),
     };
-    validateImage(parsed.image, `${field}.image`);
-    validateDnsLabel(parsed.secretName, `${field}.secretName`);
+    (0, deploy_schema_1.validateImage)(parsed.image, `${field}.image`);
+    (0, deploy_schema_1.validateDnsLabel)(parsed.secretName, `${field}.secretName`);
     validateStorage(parsed.storageSize, `${field}.storageSize`);
     if (parsed.storageClassName && parsed.storageClassName.length > 253) {
         throw new Error(`Deployment profile field "${field}.storageClassName" is too long.`);
@@ -194,25 +83,10 @@ function parseStatefulDependency(value, field, extraKeys = []) {
 function parseRedisDependency(value, field) {
     return parseStatefulDependency(value, field);
 }
-function validateHttpsOrigin(value) {
-    let parsed;
-    try {
-        parsed = new URL(value);
-    }
-    catch {
-        throw new Error(`Deployment verification baseUrl "${value}" is invalid.`);
-    }
-    if (parsed.username || parsed.password) {
-        throw new Error("Deployment verification baseUrl must not contain URL credentials; use a credential-free HTTPS origin.");
-    }
-    if (parsed.protocol !== "https:" || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-        throw new Error("Deployment verification baseUrl must be an HTTPS origin without a path.");
-    }
-}
 function parseProfile(value) {
-    if (!isRecord(value))
+    if (!(0, deploy_schema_1.isRecord)(value))
         throw new Error("Deployment profile must be a JSON object.");
-    assertOnlyKeys(value, [
+    (0, deploy_schema_1.assertOnlyKeys)(value, [
         "schemaVersion",
         "driver",
         "target",
@@ -221,6 +95,7 @@ function parseProfile(value) {
         "workloads",
         "dependencies",
         "secrets",
+        "migration",
         "runtimeConfig",
         "verification",
     ], "root");
@@ -230,64 +105,67 @@ function parseProfile(value) {
     if (value.driver !== "kubernetes-helm") {
         throw new Error(`Unsupported deployment driver: ${String(value.driver)}`);
     }
-    const target = requiredRecord(value, "target");
-    const release = requiredRecord(value, "release");
-    const exposure = requiredRecord(value, "exposure");
-    const workloads = requiredRecord(value, "workloads");
-    const dependencies = requiredRecord(value, "dependencies");
-    const secrets = requiredRecord(value, "secrets");
-    const verification = requiredRecord(value, "verification");
-    const runtimeConfig = requiredRecord(value, "runtimeConfig");
-    assertOnlyKeys(target, ["context", "clusterFingerprint", "namespace", "release", "createNamespace"], "target");
-    assertOnlyKeys(release, ["strategy", "tagPattern", "apiRepository", "webRepository"], "release");
-    assertOnlyKeys(exposure, ["mode", "host", "ingressClassName", "tlsSecretName"], "exposure");
-    assertOnlyKeys(workloads, ["api", "web", "worker"], "workloads");
-    assertOnlyKeys(dependencies, ["postgres", "redis", "objectStorage"], "dependencies");
-    assertOnlyKeys(secrets, ["api", "web", "imagePull"], "secrets");
-    assertOnlyKeys(verification, ["baseUrl", "checks"], "verification");
-    const context = requiredString(target, "context");
-    const clusterFingerprint = requiredString(target, "clusterFingerprint");
+    const target = (0, deploy_schema_1.requiredRecord)(value, "target");
+    const release = (0, deploy_schema_1.requiredRecord)(value, "release");
+    const exposure = (0, deploy_schema_1.requiredRecord)(value, "exposure");
+    const workloads = (0, deploy_schema_1.requiredRecord)(value, "workloads");
+    const dependencies = (0, deploy_schema_1.requiredRecord)(value, "dependencies");
+    const secrets = (0, deploy_schema_1.requiredRecord)(value, "secrets");
+    const migration = value.migration === undefined ? undefined : (0, deploy_schema_1.requiredRecord)(value, "migration");
+    const verification = (0, deploy_schema_1.requiredRecord)(value, "verification");
+    const runtimeConfig = (0, deploy_schema_1.requiredRecord)(value, "runtimeConfig");
+    (0, deploy_schema_1.assertOnlyKeys)(target, ["context", "clusterFingerprint", "namespace", "release", "createNamespace"], "target");
+    (0, deploy_schema_1.assertOnlyKeys)(release, ["strategy", "tagPattern", "apiRepository", "webRepository"], "release");
+    (0, deploy_schema_1.assertOnlyKeys)(exposure, ["mode", "host", "ingressClassName", "tlsSecretName"], "exposure");
+    (0, deploy_schema_1.assertOnlyKeys)(workloads, ["api", "web", "worker"], "workloads");
+    (0, deploy_schema_1.assertOnlyKeys)(dependencies, ["postgres", "redis", "objectStorage"], "dependencies");
+    (0, deploy_schema_1.assertOnlyKeys)(secrets, ["api", "web", "imagePull"], "secrets");
+    if (migration)
+        (0, deploy_schema_1.assertOnlyKeys)(migration, ["command"], "migration");
+    (0, deploy_schema_1.assertOnlyKeys)(verification, ["baseUrl", "checks"], "verification");
+    const context = (0, deploy_schema_1.requiredString)(target, "context");
+    const clusterFingerprint = (0, deploy_schema_1.requiredString)(target, "clusterFingerprint");
     if (!/^sha256:[a-f0-9]{64}$/.test(clusterFingerprint)) {
         throw new Error("Deployment target.clusterFingerprint must be a sha256 fingerprint.");
     }
-    const namespace = requiredString(target, "namespace");
-    const releaseName = requiredString(target, "release");
-    validateDnsLabel(namespace, "target.namespace");
-    validateDnsLabel(releaseName, "target.release");
+    const namespace = (0, deploy_schema_1.requiredString)(target, "namespace");
+    const releaseName = (0, deploy_schema_1.requiredString)(target, "release");
+    (0, deploy_schema_1.validateDnsLabel)(namespace, "target.namespace");
+    (0, deploy_schema_1.validateDnsLabel)(releaseName, "target.release");
     if (releaseName.length > 40) {
         throw new Error("Deployment target.release must be at most 40 characters.");
     }
     if (target.createNamespace !== false) {
         throw new Error("Deployment target.createNamespace must be false in schema version 1.");
     }
-    const tagPattern = requiredString(release, "tagPattern");
-    if (tagPattern !== STABLE_SEMVER_TAG_PATTERN) {
+    const tagPattern = (0, deploy_schema_1.requiredString)(release, "tagPattern");
+    if (tagPattern !== deploy_schema_1.STABLE_SEMVER_TAG_PATTERN) {
         throw new Error("Deployment release.tagPattern must require stable vMAJOR.MINOR.PATCH tags.");
     }
     if (release.strategy !== "shared-tag") {
         throw new Error("Deployment release.strategy must be shared-tag.");
     }
-    const apiRepository = requiredString(release, "apiRepository");
-    const webRepository = requiredString(release, "webRepository");
-    validateImageRepository(apiRepository, "release.apiRepository");
-    validateImageRepository(webRepository, "release.webRepository");
+    const apiRepository = (0, deploy_schema_1.requiredString)(release, "apiRepository");
+    const webRepository = (0, deploy_schema_1.requiredString)(release, "webRepository");
+    (0, deploy_schema_1.validateImageRepository)(apiRepository, "release.apiRepository");
+    (0, deploy_schema_1.validateImageRepository)(webRepository, "release.webRepository");
     const exposureMode = exposure.mode;
     if (exposureMode !== "ingress" && exposureMode !== "nodePort") {
         throw new Error("Deployment exposure.mode must be ingress or nodePort.");
     }
-    const host = requiredString(exposure, "host");
+    const host = (0, deploy_schema_1.requiredString)(exposure, "host");
     if (exposureMode === "ingress") {
-        validateDnsSubdomain(host, "exposure.host");
+        (0, deploy_schema_1.validateDnsSubdomain)(host, "exposure.host");
     }
-    const ingressClassName = requiredString(exposure, "ingressClassName");
-    validateDnsSubdomain(ingressClassName, "exposure.ingressClassName");
-    const tlsSecretName = optionalString(exposure, "tlsSecretName");
+    const ingressClassName = (0, deploy_schema_1.requiredString)(exposure, "ingressClassName");
+    (0, deploy_schema_1.validateDnsSubdomain)(ingressClassName, "exposure.ingressClassName");
+    const tlsSecretName = (0, deploy_schema_1.optionalString)(exposure, "tlsSecretName");
     if (tlsSecretName)
-        validateDnsSubdomain(tlsSecretName, "exposure.tlsSecretName");
-    const postgres = parseStatefulDependency(requiredRecord(dependencies, "postgres"), "dependencies.postgres");
-    const redis = parseRedisDependency(requiredRecord(dependencies, "redis"), "dependencies.redis");
-    const objectStorageRecord = requiredRecord(dependencies, "objectStorage");
-    assertOnlyKeys(objectStorageRecord, [
+        (0, deploy_schema_1.validateDnsSubdomain)(tlsSecretName, "exposure.tlsSecretName");
+    const postgres = parseStatefulDependency((0, deploy_schema_1.requiredRecord)(dependencies, "postgres"), "dependencies.postgres");
+    const redis = parseRedisDependency((0, deploy_schema_1.requiredRecord)(dependencies, "redis"), "dependencies.redis");
+    const objectStorageRecord = (0, deploy_schema_1.requiredRecord)(dependencies, "objectStorage");
+    (0, deploy_schema_1.assertOnlyKeys)(objectStorageRecord, [
         "mode",
         "image",
         "secretName",
@@ -298,73 +176,13 @@ function parseProfile(value) {
     ], "dependencies.objectStorage");
     const objectStorage = {
         ...parseStatefulDependency(objectStorageRecord, "dependencies.objectStorage", ["bucket", "clientImage"]),
-        bucket: requiredString(objectStorageRecord, "bucket"),
-        clientImage: requiredString(objectStorageRecord, "clientImage"),
+        bucket: (0, deploy_schema_1.requiredString)(objectStorageRecord, "bucket"),
+        clientImage: (0, deploy_schema_1.requiredString)(objectStorageRecord, "clientImage"),
     };
-    validateDnsLabel(objectStorage.bucket, "dependencies.objectStorage.bucket");
-    validateImage(objectStorage.clientImage, "dependencies.objectStorage.clientImage");
-    const parsedConfig = {};
-    for (const [key, entry] of Object.entries(runtimeConfig)) {
-        if (!/^[A-Z][A-Z0-9_]*$/.test(key)) {
-            throw new Error(`Deployment runtimeConfig key "${key}" must be an uppercase environment name.`);
-        }
-        if (SENSITIVE_KEY.test(key)) {
-            throw new Error(`Deployment runtimeConfig key "${key}" may contain a secret; use a Kubernetes Secret.`);
-        }
-        if (["PORT", "BACKEND_INTERNAL_URL"].includes(key)) {
-            throw new Error(`Deployment runtimeConfig key "${key}" is managed by PodoKit.`);
-        }
-        if (typeof entry !== "string") {
-            throw new Error(`Deployment runtimeConfig value "${key}" must be a string.`);
-        }
-        if (containsUrlCredentials(entry)) {
-            throw new Error(`Deployment runtimeConfig value "${key}" contains URL credentials; use a Kubernetes Secret.`);
-        }
-        parsedConfig[key] = entry;
-    }
-    const baseUrl = requiredString(verification, "baseUrl");
-    validateHttpsOrigin(baseUrl);
-    const baseOrigin = new URL(baseUrl).origin;
-    const checksValue = verification.checks;
-    if (!Array.isArray(checksValue) || checksValue.length === 0) {
-        throw new Error("Deployment verification.checks must be a non-empty array.");
-    }
-    const checks = checksValue.map((entry, index) => {
-        if (!isRecord(entry)) {
-            throw new Error(`Deployment verification.checks[${index}] must be an object.`);
-        }
-        assertOnlyKeys(entry, ["path", "expectedStatus", "expectedJson"], `verification.checks[${index}]`);
-        const path = requiredString(entry, "path");
-        if (!path.startsWith("/") ||
-            path.startsWith("//") ||
-            path.includes("\\") ||
-            /[\u0000-\u001f\u007f]/.test(path) ||
-            new URL(path, baseUrl).origin !== baseOrigin) {
-            throw new Error("Every deployment verification path must be an absolute URL path.");
-        }
-        const expectedStatus = requiredNumber(entry, "expectedStatus");
-        if (expectedStatus < 100 || expectedStatus > 599) {
-            throw new Error("Deployment verification expectedStatus must be an HTTP status.");
-        }
-        const expectedJsonValue = entry.expectedJson;
-        let expectedJson;
-        if (expectedJsonValue !== undefined) {
-            if (!isRecord(expectedJsonValue)) {
-                throw new Error("Deployment verification expectedJson must be an object.");
-            }
-            expectedJson = {};
-            for (const [key, value] of Object.entries(expectedJsonValue)) {
-                if (value !== null &&
-                    typeof value !== "string" &&
-                    typeof value !== "number" &&
-                    typeof value !== "boolean") {
-                    throw new Error("Deployment verification expectedJson values must be scalar.");
-                }
-                expectedJson[key] = value;
-            }
-        }
-        return { path, expectedStatus, ...(expectedJson ? { expectedJson } : {}) };
-    });
+    (0, deploy_schema_1.validateDnsLabel)(objectStorage.bucket, "dependencies.objectStorage.bucket");
+    (0, deploy_schema_1.validateImage)(objectStorage.clientImage, "dependencies.objectStorage.clientImage");
+    const parsedConfig = (0, deploy_schema_1.parseRuntimeConfig)(runtimeConfig);
+    const { baseUrl, checks } = (0, deploy_schema_1.parseVerification)(verification);
     const profile = {
         schemaVersion: 1,
         driver: "kubernetes-helm",
@@ -388,11 +206,11 @@ function parseProfile(value) {
             tlsSecretName,
         },
         workloads: {
-            api: parseWorkload(requiredRecord(workloads, "api"), "workloads.api"),
-            web: parseWorkload(requiredRecord(workloads, "web"), "workloads.web"),
+            api: parseWorkload((0, deploy_schema_1.requiredRecord)(workloads, "api"), "workloads.api"),
+            web: parseWorkload((0, deploy_schema_1.requiredRecord)(workloads, "web"), "workloads.web"),
             worker: workloads.worker === null
                 ? null
-                : parseWorkload(requiredRecord(workloads, "worker"), "workloads.worker"),
+                : parseWorkload((0, deploy_schema_1.requiredRecord)(workloads, "worker"), "workloads.worker"),
         },
         dependencies: { postgres, redis, objectStorage },
         secrets: {
@@ -400,25 +218,19 @@ function parseProfile(value) {
             web: secrets.web === null
                 ? null
                 : parseNamedSecret(secrets.web, "secrets.web"),
-            imagePull: requiredString(secrets, "imagePull"),
+            imagePull: (0, deploy_schema_1.requiredString)(secrets, "imagePull"),
         },
+        ...(migration
+            ? { migration: { command: (0, deploy_schema_1.parseCommand)(migration.command, "migration.command") } }
+            : {}),
         runtimeConfig: parsedConfig,
         verification: { baseUrl, checks },
     };
-    validateDnsLabel(profile.secrets.imagePull, "secrets.imagePull");
+    (0, deploy_schema_1.validateDnsLabel)(profile.secrets.imagePull, "secrets.imagePull");
     return profile;
 }
-function profileDirectory(projectRoot) {
-    return (0, node_path_1.join)((0, node_path_1.resolve)(projectRoot), ".podokit", "deploy");
-}
-function profilePath(projectRoot, name) {
-    if (!PROFILE_NAME.test(name)) {
-        throw new Error(`Invalid deployment profile name "${name}".`);
-    }
-    return (0, node_path_1.join)(profileDirectory(projectRoot), `${name}.json`);
-}
 function loadDeploymentProfile(projectRoot, name) {
-    const path = profilePath(projectRoot, name);
+    const path = (0, deploy_schema_1.profilePath)(projectRoot, name);
     if (!(0, node_fs_1.existsSync)(path))
         throw new Error(`Deployment profile "${name}" does not exist at ${path}.`);
     let parsed;
@@ -431,7 +243,7 @@ function loadDeploymentProfile(projectRoot, name) {
     return parseProfile(parsed);
 }
 function listDeploymentProfiles(projectRoot) {
-    const directory = profileDirectory(projectRoot);
+    const directory = (0, deploy_schema_1.profileDirectory)(projectRoot);
     if (!(0, node_fs_1.existsSync)(directory))
         return [];
     return (0, node_fs_1.readdirSync)(directory)
@@ -449,7 +261,7 @@ function initializeDeploymentProfile(projectRoot, name, options) {
     const projectName = manifest.answers.projectName;
     if (!projectName)
         throw new Error("PodoKit manifest is missing answers.projectName.");
-    const path = profilePath(projectRoot, name);
+    const path = (0, deploy_schema_1.profilePath)(projectRoot, name);
     if ((0, node_fs_1.existsSync)(path))
         throw new Error(`Deployment profile "${name}" already exists.`);
     const releaseName = projectName
@@ -480,7 +292,7 @@ function initializeDeploymentProfile(projectRoot, name, options) {
         },
         release: {
             strategy: "shared-tag",
-            tagPattern: STABLE_SEMVER_TAG_PATTERN,
+            tagPattern: deploy_schema_1.STABLE_SEMVER_TAG_PATTERN,
             apiRepository: `ghcr.io/example/${releaseName}-api`,
             webRepository: `ghcr.io/example/${releaseName}-web`,
         },
@@ -589,7 +401,7 @@ function initializeDeploymentProfile(projectRoot, name, options) {
         },
     };
     const validated = parseProfile(defaultProfile);
-    (0, node_fs_1.mkdirSync)(profileDirectory(projectRoot), { recursive: true });
+    (0, node_fs_1.mkdirSync)((0, deploy_schema_1.profileDirectory)(projectRoot), { recursive: true });
     (0, node_fs_1.writeFileSync)(path, `${JSON.stringify(validated, null, 2)}\n`, { flag: "wx" });
     return { name, path, profile: validated };
 }

package/dist/deploy-render.js

@@ -8,6 +8,14 @@ const deploy_profile_1 = require("./deploy-profile");
 function quote(value) {
     return JSON.stringify(value);
 }
+function yamlScalar(value) {
+    return /^(?!null$|true$|false$|~$)[A-Za-z_][A-Za-z0-9_./:-]*$/i.test(value)
+        ? value
+        : quote(value);
+}
+function yamlStringSequence(values) {
+    return `[${values.map((value) => yamlScalar(value)).join(", ")}]`;
+}
 function digest(parts) {
     const hash = (0, node_crypto_1.createHash)("sha256");
     for (const part of parts)
@@ -571,6 +579,7 @@ function migrationRuntimeEnv(profile) {
 }
 function migrationManifest(profile, release, images) {
     const releaseSlug = release.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+    const command = profile.migration?.command ?? ["npm", "run", "migrate:all"];
     return `apiVersion: batch/v1
 kind: Job
 metadata:
@@ -596,7 +605,7 @@ ${labels(`${profile.target.release}-migration`, 8)}    spec:
         - name: migrate
           image: ${quote(images.api)}
           imagePullPolicy: IfNotPresent
-          command: [npm, run, migrate:all]
+          command: ${yamlStringSequence(command)}
           env:
 ${migrationRuntimeEnv(profile)}
           envFrom:

package/dist/deploy-schema.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Validation primitives shared by every deployment driver.
+ *
+ * A driver profile decides its own target, exposure, and dependency shape, but the
+ * pieces that describe *what is being released* — image repositories, the stable tag
+ * pattern, the migration command, non-secret runtime configuration, and the public
+ * verification contract — mean the same thing everywhere and are parsed here once.
+ */
+export interface VerificationCheckProfile {
+    path: string;
+    expectedStatus: number;
+    expectedJson?: Record<string, string | number | boolean | null>;
+}
+export interface VerificationProfile {
+    baseUrl: string;
+    checks: VerificationCheckProfile[];
+}
+export interface MigrationProfile {
+    command: string[];
+}
+export interface ReleaseProfile {
+    strategy: "shared-tag";
+    tagPattern: string;
+    apiRepository: string;
+    webRepository: string;
+}
+export declare const PROFILE_NAME: RegExp;
+export declare const DNS_LABEL: RegExp;
+export declare const SENSITIVE_KEY: RegExp;
+export declare const STABLE_SEMVER_TAG_PATTERN = "^v(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$";
+/** Keys PodoKit derives itself, so a profile may not set them. */
+export declare const MANAGED_RUNTIME_CONFIG_KEYS: string[];
+export declare function containsUrlCredentials(value: string): boolean;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function assertOnlyKeys(value: Record<string, unknown>, allowed: string[], field: string): void;
+export declare function requiredRecord(parent: Record<string, unknown>, key: string): Record<string, unknown>;
+export declare function requiredString(parent: Record<string, unknown>, key: string): string;
+export declare function optionalString(parent: Record<string, unknown>, key: string): string | null;
+export declare function requiredNumber(parent: Record<string, unknown>, key: string): number;
+export declare function parseRequiredKeys(value: unknown, field: string): string[];
+export declare function parseCommand(value: unknown, field: string): string[];
+export declare function validateDnsLabel(value: string, field: string): void;
+export declare function validateDnsSubdomain(value: string, field: string): void;
+export declare function parseImageReference(value: string): {
+    name: string;
+    tag: string | null;
+    digest: string | null;
+} | null;
+export declare function validateImage(value: string, field: string): void;
+export declare function validateImageRepository(value: string, field: string): void;
+export declare function parseReleaseProfile(release: Record<string, unknown>): ReleaseProfile;
+export declare function parseRuntimeConfig(runtimeConfig: Record<string, unknown>): Record<string, string>;
+export declare function validateHttpsOrigin(value: string): void;
+export declare function parseVerification(verification: Record<string, unknown>): VerificationProfile;
+export declare function profileDirectory(projectRoot: string): string;
+export declare function profilePath(projectRoot: string, name: string): string;