@fabrika/provider-zerops 0.0.14 → 0.0.16

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.0.14",
+	"version": "0.0.16",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -32,9 +32,9 @@
 		"gen:schema": "bun scripts/generate-zerops-types.ts"
 	},
 	"dependencies": {
-		"@fabrika/auth": "^0.0.14",
-		"@fabrika/auth-core": "^0.0.14",
-		"@fabrika/provider-contract": "^0.0.14",
-		"@fabrika/proxy-contract": "^0.0.14"
+		"@fabrika/auth": "^0.0.16",
+		"@fabrika/auth-core": "^0.0.16",
+		"@fabrika/provider-contract": "^0.0.16",
+		"@fabrika/proxy-contract": "^0.0.16"
 	}
 }

package/src/control.ts

@@ -440,6 +440,19 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 	const controlProvider: ZeropsControlProvider = {
 		id: 'zerops',
 		normalizeRegistration,
+		/**
+		 * A Zerops artifact IS the compiled manifest, so the declaration is right here and core can refuse
+		 * a variable this app would never read. An artifact that will not decode answers `undefined`
+		 * rather than an empty set: a broken envelope is a registration problem, and reporting it as an
+		 * undeclared variable would point the operator at the wrong thing.
+		 */
+		declaredVariables: ({ artifact }) => {
+			try {
+				return parseFabrikaManifest(decodeEnvelope('artifact', artifact, zeropsArtifactCodec)).app.pipeline.vars
+			} catch {
+				return undefined
+			}
+		},
 		resolveSource: (input) => resolveSource(input),
 		resolveSourceWithBinding: (input) => resolveSource(input, input.sourceBinding),
 		deploy: async (input: ProviderDeployInput): Promise<ProviderTerminalOutcome> => {

package/src/index.ts

@@ -69,8 +69,9 @@ export {
 	compileZeropsNamespaceTopology,
 	createZeropsNamespaceCapabilities,
 	createZeropsNamespaceOperator,
+	ensureNamespaceProxyIam,
+	ZEROPS_NAMESPACE_IAM_ISSUER_VARIABLE,
 	ZEROPS_NAMESPACE_IAM_KEY_VARIABLE,
-	ZEROPS_NAMESPACE_IAM_URL_VARIABLE,
 	ZEROPS_NAMESPACE_POSTGRES_HOSTNAME,
 	ZEROPS_NAMESPACE_PROXY_HOSTNAME,
 	ZEROPS_SHARED_POSTGRES_CONNECTION_STRING,
@@ -78,6 +79,7 @@ export {
 	zeropsNamespaceTargetCodec,
 } from './namespace'
 export type {
+	NamespaceProxyIamInput,
 	ZeropsNamespaceOperatorOptions,
 	ZeropsNamespaceOptions,
 	ZeropsNamespacePlanOptions,

package/src/namespace.ts

@@ -31,7 +31,7 @@ import type { ZeropsServiceSpec, ZeropsSourceTarget } from './types'
 
 export const ZEROPS_NAMESPACE_PROXY_HOSTNAME = 'proxy'
 export const ZEROPS_NAMESPACE_POSTGRES_HOSTNAME = 'postgres'
-export const ZEROPS_NAMESPACE_IAM_URL_VARIABLE = 'FABRIKA_IAM_URL'
+export const ZEROPS_NAMESPACE_IAM_ISSUER_VARIABLE = 'FABRIKA_IAM_ISSUER'
 export const ZEROPS_NAMESPACE_IAM_KEY_VARIABLE = 'FABRIKA_IAM_KEY'
 /**
  * How an app reaches the namespace-owned PostgreSQL service — port, database and TLS mode NAMED, not
@@ -737,6 +737,47 @@ const resolveServices = async (
 	return postgres === null ? { proxy } : { proxy, postgres }
 }
 
+export interface NamespaceProxyIamInput {
+	readonly api: Pick<ZeropsApi, 'listServiceEnv' | 'putServiceEnv'>
+	readonly proxyServiceId: string
+	/** The public IAM origin the proxy compares a token's `iss` against. */
+	readonly iamUrl: string
+	readonly iamKey: string
+	readonly signal: AbortSignal
+}
+
+/**
+ * Converge the two variables the namespace proxy's own CODE reads, and call this from everywhere that
+ * code is replaced — not only where the namespace is created.
+ *
+ * `syncZeropsProxy` rebuilds the proxy from git on every app deploy, so a proxy can take new code
+ * whose configuration nobody rewrote. That is not hypothetical: the `FABRIKA_IAM_URL` →
+ * `FABRIKA_IAM_ISSUER` rename ([ADR-0035](../../../docs/decisions/0035-the-platform-owns-the-application-iam-issuer.md))
+ * left a live namespace proxy crash-looping on `FABRIKA_IAM_ISSUER is required`, because provisioning
+ * had written the old name months earlier and the deploy path only ever wrote the manifest. Writing
+ * these BEFORE the pipeline is triggered is what makes a rename a flag day rather than an outage
+ * ([ADR-0024](../../../docs/decisions/0024-retire-the-legacy-environment-name-fallback.md)).
+ */
+export const ensureNamespaceProxyIam = async (input: NamespaceProxyIamInput): Promise<void> => {
+	const variables = await input.api.listServiceEnv({ serviceId: input.proxyServiceId, signal: input.signal })
+	const issuer = variables.find((variable) => variable.key === ZEROPS_NAMESPACE_IAM_ISSUER_VARIABLE)
+	if (issuer?.content !== input.iamUrl) {
+		await input.api.putServiceEnv({
+			serviceId: input.proxyServiceId,
+			key: ZEROPS_NAMESPACE_IAM_ISSUER_VARIABLE,
+			value: input.iamUrl,
+			signal: input.signal,
+		})
+	}
+	// Secret read-back is not trustworthy, so overwrite it idempotently without inspecting its value.
+	await input.api.putServiceEnv({
+		serviceId: input.proxyServiceId,
+		key: ZEROPS_NAMESPACE_IAM_KEY_VARIABLE,
+		value: input.iamKey,
+		signal: input.signal,
+	})
+}
+
 const ensureProxyConfiguration = async (
 	target: NormalizedZeropsNamespaceTarget,
 	options: ZeropsNamespaceOptions,
@@ -759,20 +800,11 @@ const ensureProxyConfiguration = async (
 		})
 		deployRequired = true
 	}
-	const iamUrl = byKey.get(ZEROPS_NAMESPACE_IAM_URL_VARIABLE)
-	if (iamUrl?.content !== options.iamUrl) {
-		await options.api.putServiceEnv({
-			serviceId: proxyServiceId,
-			key: ZEROPS_NAMESPACE_IAM_URL_VARIABLE,
-			value: options.iamUrl,
-			signal,
-		})
-	}
-	// Secret read-back is not trustworthy, so overwrite it idempotently without inspecting its value.
-	await options.api.putServiceEnv({
-		serviceId: proxyServiceId,
-		key: ZEROPS_NAMESPACE_IAM_KEY_VARIABLE,
-		value: options.iamKey,
+	await ensureNamespaceProxyIam({
+		api: options.api,
+		proxyServiceId,
+		iamUrl: options.iamUrl,
+		iamKey: options.iamKey,
 		signal,
 	})
 	return deployRequired

package/src/provider.ts

@@ -152,9 +152,21 @@ const cancelSourceBestEffort = async (env: StepEnv, source: ZeropsRuntimeSource,
 	sourceController.abort()
 }
 
+/**
+ * Drop a version that was created and never handed to the platform.
+ *
+ * BEST EFFORT ON PURPOSE. Every caller runs this while already failing, so a cleanup that throws would
+ * replace the reason the deploy failed with the reason the cleanup did — which is what happened live,
+ * where a real `trigger-deploy` failure surfaced as `delete app-version failed (400)` and the cause was
+ * gone. The leftover version is visible on the platform; the lost diagnosis was not.
+ */
 const cleanupPreTriggerVersion = async (env: StepEnv, source: ZeropsRuntimeSource, appVersionId: string): Promise<void> => {
 	await cancelSourceBestEffort(env, source, appVersionId)
-	await env.zerops.api.deleteAppVersion({ appVersionId, signal: AbortSignal.timeout(5000) })
+	try {
+		await env.zerops.api.deleteAppVersion({ appVersionId, signal: AbortSignal.timeout(5000) })
+	} catch (error) {
+		env.log(`  [warn] app-version ${appVersionId} was left behind: ${error instanceof Error ? error.message : 'unknown error'}`)
+	}
 }
 
 /**