@fabrika/provider-zerops 0.0.22 → 0.0.24

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.0.22",
+	"version": "0.0.24",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -32,9 +32,9 @@
 		"gen:schema": "bun scripts/generate-zerops-types.ts"
 	},
 	"dependencies": {
-		"@fabrika/auth": "^0.0.22",
-		"@fabrika/auth-core": "^0.0.22",
-		"@fabrika/provider-contract": "^0.0.22",
-		"@fabrika/proxy-contract": "^0.0.22"
+		"@fabrika/auth": "^0.0.24",
+		"@fabrika/auth-core": "^0.0.24",
+		"@fabrika/provider-contract": "^0.0.24",
+		"@fabrika/proxy-contract": "^0.0.24"
 	}
 }

package/src/api.ts

@@ -784,6 +784,9 @@ export class ZeropsApiError extends Error {
 /** The platform's code for "this service stack already has a variable under that key". */
 const USER_DATA_DUPLICATE_KEY = 'userDataDuplicateKey'
 
+/** The platform's code for a service stack it cannot find — sent with a 400, not a 404. */
+const ZEROPS_SERVICE_STACK_NOT_FOUND = 'serviceStackNotFound'
+
 /**
  * The platform's code for "this service publishes no HTTP port", the answer `enableSubdomainAccess` gives
  * before a service's first deploy. Exported so a caller can say what is missing instead of relaying prose.
@@ -1124,8 +1127,9 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 			try {
 				return readService(await request('find service', 'GET', `/service-stack-by-name/${projectId}/${encodeURIComponent(hostname)}`, { signal }))
 			} catch (error) {
-				// A missing service is an answer, not a failure; anything else propagates.
-				if (error instanceof Error && error.message.includes('(404)')) {
+				// A missing service is an answer, not a failure; anything else propagates. The live platform
+				// says it as 400 `serviceStackNotFound` (docs/reference/zerops-platform.md), not as a 404.
+				if (error instanceof ZeropsApiError && (error.status === 404 || error.code === ZEROPS_SERVICE_STACK_NOT_FOUND)) {
 					return null
 				}
 				throw error

package/src/control.ts

@@ -418,18 +418,15 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 			signal: input.signal,
 		}
 		let result: ZeropsSourceResolveResult
-		if (binding?.transportKind === 'keyed-v2') {
+		if (binding === undefined) {
+			result = await options.source.resolve(base)
+		} else {
 			const resolveV2 = options.source.resolveV2
 			if (resolveV2 === undefined) throw new Error('Zerops keyed source transport is unavailable')
 			result = await resolveV2.call(options.source, {
 				...base,
 				privateBinding: { connectionId: binding.connectionId, installationId: binding.installationId },
 			})
-		} else {
-			result = await options.source.resolve({
-				...base,
-				...(binding === undefined ? {} : { githubInstallationId: binding.installationId }),
-			})
 		}
 		if (
 			result.runId !== input.runId

package/src/index.ts

@@ -99,21 +99,14 @@ export type * from './schema.generated'
 export {
 	buildZeropsSourceCancelRequest,
 	buildZeropsSourceCancelResponse,
-	buildZeropsSourceCredentialActivateRequest,
 	buildZeropsSourceCredentialActivateRequestV2,
-	buildZeropsSourceCredentialActivateResponse,
 	buildZeropsSourceCredentialActivateResponseV2,
-	buildZeropsSourceCredentialBundle,
 	buildZeropsSourceCredentialBundleV2,
-	buildZeropsSourceCredentialStatusRequest,
 	buildZeropsSourceCredentialStatusRequestV2,
-	buildZeropsSourceCredentialStatusResponse,
 	buildZeropsSourceCredentialStatusResponseV2,
 	buildZeropsSourceErrorEnvelope,
 	buildZeropsSourceInstallationsVerifyRequest,
 	buildZeropsSourceInstallationsVerifyResponse,
-	buildZeropsSourceResolveInstallationRequest,
-	buildZeropsSourceResolveInstallationResponse,
 	buildZeropsSourceResolveRequest,
 	buildZeropsSourceResolveRequestV2,
 	buildZeropsSourceResolveResponse,
@@ -126,21 +119,14 @@ export {
 	buildZeropsSourceWebhookConfigureResponse,
 	decodeZeropsSourceCancelRequest,
 	decodeZeropsSourceCancelResponse,
-	decodeZeropsSourceCredentialActivateRequest,
 	decodeZeropsSourceCredentialActivateRequestV2,
-	decodeZeropsSourceCredentialActivateResponse,
 	decodeZeropsSourceCredentialActivateResponseV2,
-	decodeZeropsSourceCredentialBundle,
 	decodeZeropsSourceCredentialBundleV2,
-	decodeZeropsSourceCredentialStatusRequest,
 	decodeZeropsSourceCredentialStatusRequestV2,
-	decodeZeropsSourceCredentialStatusResponse,
 	decodeZeropsSourceCredentialStatusResponseV2,
 	decodeZeropsSourceErrorEnvelope,
 	decodeZeropsSourceInstallationsVerifyRequest,
 	decodeZeropsSourceInstallationsVerifyResponse,
-	decodeZeropsSourceResolveInstallationRequest,
-	decodeZeropsSourceResolveInstallationResponse,
 	decodeZeropsSourceResolveRequest,
 	decodeZeropsSourceResolveRequestV2,
 	decodeZeropsSourceResolveResponse,
@@ -152,24 +138,18 @@ export {
 	decodeZeropsSourceWebhookConfigureRequest,
 	decodeZeropsSourceWebhookConfigureResponse,
 	normalizeZeropsSourceRepository,
-	serializeZeropsSourceCredentialBundle,
 	serializeZeropsSourceCredentialBundleV2,
-	sha256ZeropsSourceCredentialBundle,
 	sha256ZeropsSourceCredentialBundleV2,
 	ZEROPS_SOURCE_CANCEL_PATH,
-	ZEROPS_SOURCE_CREDENTIAL_ACTIVATE_PATH,
 	ZEROPS_SOURCE_CREDENTIAL_ACTIVATE_PATH_V2,
-	ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION,
 	ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION_V2,
 	ZEROPS_SOURCE_CREDENTIAL_ENV_V2_PREFIX,
-	ZEROPS_SOURCE_CREDENTIAL_STATUS_PATH,
 	ZEROPS_SOURCE_CREDENTIAL_STATUS_PATH_V2,
 	ZEROPS_SOURCE_ERROR_CODES,
 	ZEROPS_SOURCE_ERROR_STAGES,
 	ZEROPS_SOURCE_INSTALLATIONS_VERIFY_PATH,
 	ZEROPS_SOURCE_PROTOCOL_VERSION,
 	ZEROPS_SOURCE_PROTOCOL_VERSION_V2,
-	ZEROPS_SOURCE_RESOLVE_INSTALLATION_PATH,
 	ZEROPS_SOURCE_RESOLVE_PATH,
 	ZEROPS_SOURCE_RESOLVE_PATH_V2,
 	ZEROPS_SOURCE_UPLOAD_PATH,
@@ -185,22 +165,15 @@ export type {
 	ZeropsSourceClient,
 	ZeropsSourceClientV2,
 	ZeropsSourceCredentialActivateInput,
-	ZeropsSourceCredentialActivateRequestV1,
 	ZeropsSourceCredentialActivateRequestV2,
-	ZeropsSourceCredentialActivateResponseV1,
 	ZeropsSourceCredentialActivateResponseV2,
-	ZeropsSourceCredentialActiveStatusResponseV1,
 	ZeropsSourceCredentialActiveStatusResponseV2,
-	ZeropsSourceCredentialAnonymousStatusResponseV1,
 	ZeropsSourceCredentialAnonymousStatusResponseV2,
-	ZeropsSourceCredentialBundleV1,
 	ZeropsSourceCredentialBundleV2,
 	ZeropsSourceCredentialManager,
 	ZeropsSourceCredentialManagerV2,
 	ZeropsSourceCredentialStatusInput,
-	ZeropsSourceCredentialStatusRequestV1,
 	ZeropsSourceCredentialStatusRequestV2,
-	ZeropsSourceCredentialStatusResponseV1,
 	ZeropsSourceCredentialStatusResponseV2,
 	ZeropsSourceDescriptor,
 	ZeropsSourceErrorCode,
@@ -216,8 +189,6 @@ export type {
 	ZeropsSourceRepository,
 	ZeropsSourceResolveInput,
 	ZeropsSourceResolveInputV2,
-	ZeropsSourceResolveInstallationRequestV1,
-	ZeropsSourceResolveInstallationResponseV1,
 	ZeropsSourceResolveRequestV1,
 	ZeropsSourceResolveRequestV2,
 	ZeropsSourceResolveResponseV1,
@@ -234,18 +205,11 @@ export type {
 	ZeropsSourceWebhookConfigureRequestV1,
 	ZeropsSourceWebhookConfigureResponseV1,
 } from './source'
-export {
-	createZeropsSourceConnectionAdmin,
-	SourceConnectionAdminError,
-	ZEROPS_SOURCE_CREDENTIAL_ENV,
-	ZEROPS_SOURCE_LEGACY_APP_ID_ENV,
-	ZEROPS_SOURCE_LEGACY_PRIVATE_KEY_ENV,
-} from './source-connection'
+export { createZeropsSourceConnectionAdmin, SourceConnectionAdminError } from './source-connection'
 export type {
 	SourceConnectionActivateInput,
 	SourceConnectionAdmin,
 	SourceConnectionAdminErrorCode,
-	SourceConnectionAdoptExistingInput,
 	SourceConnectionInspection,
 	SourceConnectionStatus,
 	SourceConnectionStatusInput,

package/src/namespace.ts

@@ -1,15 +1,17 @@
-import type {
-	JsonValue,
-	ProviderCodec,
-	ProviderDeploymentNamespace,
-	ProviderEnvelope,
-	ProviderNamespaceCapabilities,
-	ProviderNamespaceMutationInput,
-	ProviderNamespaceOperator,
-	ProviderNamespacePlanInput,
-	ProviderNamespacePresentation,
-	ProviderNamespacePreset,
-	ProviderRegistration,
+import {
+	type JsonValue,
+	type ProviderCodec,
+	type ProviderDeploymentNamespace,
+	type ProviderEnvelope,
+	type ProviderNamespaceCapabilities,
+	ProviderNamespaceError,
+	type ProviderNamespaceFact,
+	type ProviderNamespaceMutationInput,
+	type ProviderNamespaceOperator,
+	type ProviderNamespacePlanInput,
+	type ProviderNamespacePresentation,
+	type ProviderNamespacePreset,
+	type ProviderRegistration,
 } from '@fabrika/provider-contract'
 import { encodeProxyManifestJson, FABRIKA_PROXY_MANIFEST_JSON } from '@fabrika/proxy-contract'
 import {
@@ -343,25 +345,36 @@ const registrationResourceClaims = (registration: ProviderRegistration): string[
 }
 
 /**
- * The namespace-owned PostgreSQL service, sized rather than defaulted.
+ * The namespace-owned PostgreSQL service: the cheapest shape that runs, on EVERY environment.
+ *
+ * A profile sets the FLOOR and the tuning preset, never the cap — `oltp-hobby` and `oltp-production`
+ * share the same 8-core / 48 GB / 250 GB ceiling and the same vertical autoscaler, so the production
+ * preset does not buy headroom, it buys an idle bill. `oltp-hobby` starts at one SHARED core and
+ * 0.25 GB and grows under load; the shape is proven by a live app with dozens of tables.
  *
- * Omitting `profile` is not neutral: an HA service silently gets `oltp-production` (two DEDICATED cores
- * and 4 GB per container, three containers) and a single one gets `oltp-staging`. Both verified by
- * reading the profile back off a live service. Production takes the production preset deliberately;
- * everything else takes the cheapest one its type offers, because a namespace database for a staging
- * app should cost what staging is worth.
+ * Keying this off `env === 'prod'` is what this default used to do, and it was wrong: most apps are
+ * small on every environment they have, and a name is not a size. HA and a bigger floor stay
+ * available and become a DELIBERATE act — `--postgres-type` and `--postgres-profile` on the namespace
+ * command — because the failure mode of over-provisioning is silent and monthly, while the failure
+ * mode of under-provisioning is visible and fixable at any time.
+ *
+ * Omitting `profile` would not be neutral: an HA service silently gets `oltp-production` (two
+ * DEDICATED cores and 4 GB per container, three containers) and a single one `oltp-staging`. Both
+ * read back off a live service.
  */
-const defaultPostgres = (env: string): ZeropsNamespacePostgres =>
-	env === 'prod' ? { type: 'postgresql:ha@18', profile: 'oltp-production' } : { type: 'postgresql:single@18', profile: 'oltp-hobby' }
+const defaultPostgres = (): ZeropsNamespacePostgres => ({ type: 'postgresql:single@18', profile: 'oltp-hobby' })
 
 export const zeropsNamespacePreset = (input: ZeropsNamespacePresetInput): ZeropsNamespaceTarget => ({
 	projectName: input.projectName,
-	corePackage: input.corePackage ?? (input.env === 'prod' ? 'SERIOUS' : 'LIGHT'),
+	// `LIGHT` on every environment. An APP namespace is not the platform project — the argument for
+	// `SERIOUS` in `installation-zerops` is that the platform repairs the apps project, which no app
+	// namespace does. `corePackage` is upgrade-only, so this stays the caller's explicit choice.
+	corePackage: input.corePackage ?? 'LIGHT',
 	publicAccess: input.publicAccess ?? 'custom-domain',
 	proxyBuildFromGit: input.proxyBuildFromGit,
 	managed: true,
 	ready: false,
-	...(input.preset === 'cheap' ? { postgres: input.postgres ?? defaultPostgres(input.env) } : {}),
+	...(input.preset === 'cheap' ? { postgres: input.postgres ?? defaultPostgres() } : {}),
 })
 
 const projectMarker = (namespace: ProviderDeploymentNamespace): string => `Managed by Fabrika namespace ${namespace.id} (${namespace.env}).`
@@ -380,7 +393,11 @@ const proxyService = (publicAccess: ZeropsNamespacePublicAccess): ZeropsServiceS
 	type: PROXY_TYPE,
 	priority: 10,
 	enableSubdomainAccess: publicAccess === 'zerops-subdomain',
-	minContainers: 2,
+	// One container is a real availability trade — the proxy is the only enforcement point (ADR-0022),
+	// so a restart is a short outage rather than a rolling one — taken because it is a whole core of
+	// idle floor on every namespace, and most namespaces hold one small app. `maxContainers` is
+	// unchanged, so load still scales out.
+	minContainers: 1,
 	maxContainers: 6,
 })
 
@@ -481,7 +498,7 @@ const namespacePresentation = (
 ): ProviderNamespacePresentation => {
 	const preset = target.postgres !== undefined ? 'cheap' : namespace.exclusiveAppId === undefined ? 'mid' : 'full'
 	const projectName = target.projectName ?? namespace.id
-	const corePackage = target.corePackage ?? (namespace.env === 'prod' ? 'SERIOUS' : 'LIGHT')
+	const corePackage = target.corePackage ?? 'LIGHT'
 	const publicAccess = target.publicAccess ?? 'custom-domain'
 	const postgres = target.postgres === undefined
 		? 'App-owned database services'
@@ -494,11 +511,16 @@ const namespacePresentation = (
 			? []
 			: ['Every app consuming the shared PostgreSQL binding shares its physical service and provider-issued credential.']),
 	]
+	// The project is the one fact that names a LIVE resource: it exists at the provider, it outlives the
+	// namespace row, and removal does not delete it (ADR-0034). Marked only once it actually exists.
+	const project: ProviderNamespaceFact = target.projectId === undefined
+		? { label: 'Project', value: projectName }
+		: { label: 'Project', value: `${projectName} (${target.projectId})`, resource: true }
 	return {
 		preset,
 		title: `${ZEROPS_NAMESPACE_PRESETS.find((candidate) => candidate.id === preset)?.label ?? preset} namespace`,
 		facts: [
-			{ label: 'Project', value: projectName },
+			project,
 			{ label: 'Environment', value: namespace.env },
 			{ label: 'Core package', value: corePackage },
 			{ label: 'Placement', value: namespace.exclusiveAppId === undefined ? 'Shared' : `Exclusive to ${namespace.exclusiveAppId}` },
@@ -574,7 +596,7 @@ const normalizeTarget = (
 	return {
 		...decoded,
 		projectName: decoded.projectName ?? namespace.id,
-		corePackage: decoded.corePackage ?? (namespace.env === 'prod' ? 'SERIOUS' : 'LIGHT'),
+		corePackage: decoded.corePackage ?? 'LIGHT',
 		publicAccess: decoded.publicAccess ?? 'custom-domain',
 		proxyBuildFromGit,
 		managed: decoded.managed ?? decoded.projectId === undefined,
@@ -827,8 +849,8 @@ const latestAfterBaseline = async (
 	return latest
 }
 
-const terminalFailure = (version: ZeropsAppVersion): Error =>
-	new Error(`Zerops namespace proxy deploy ${version.id} finished as ${version.status ?? 'unknown'}`)
+const terminalFailure = (version: ZeropsAppVersion): ProviderNamespaceError =>
+	namespaceError(ZEROPS_PROXY_DEPLOY_FAILED, `Zerops namespace proxy deploy ${version.id} finished as ${version.status ?? 'unknown'}`, false)
 
 const waitForProxy = async (
 	appVersionId: string,
@@ -838,14 +860,14 @@ const waitForProxy = async (
 	const deadline = Date.now() + POLL_TIMEOUT_MS
 	for (;;) {
 		if (signal.aborted) {
-			throw new Error('Zerops namespace provisioning was cancelled')
+			throw namespaceError(ZEROPS_NAMESPACE_CANCELLED, 'Zerops namespace provisioning was cancelled', true)
 		}
 		const version = await options.api.getAppVersion({ appVersionId, signal })
 		if (version.status !== undefined && ZEROPS_TERMINAL.has(version.status)) {
 			return version
 		}
 		if (Date.now() > deadline) {
-			throw new Error(`Zerops namespace proxy deploy ${appVersionId} timed out`)
+			throw namespaceError(ZEROPS_PROXY_DEPLOY_TIMEOUT, `Zerops namespace proxy deploy ${appVersionId} timed out`, true)
 		}
 		await (options.sleep ?? defaultSleep)(POLL_INTERVAL_MS, signal)
 	}
@@ -912,6 +934,60 @@ const deployProxy = async (
 	return { namespace: currentNamespace, target: currentTarget }
 }
 
+/**
+ * Lifecycle codes this provider defines where the platform has none of its own. They are an
+ * operator-facing vocabulary, so they are stable identifiers rather than prose (backlog 72): a
+ * platform code such as `insufficientPermissions` and one of these read the same way downstream.
+ */
+export const ZEROPS_NAMESPACE_CANCELLED = 'namespaceCancelled'
+export const ZEROPS_NAMESPACE_LIFECYCLE = 'namespaceLifecycle'
+export const ZEROPS_PROXY_DEPLOY_TIMEOUT = 'proxyDeployTimeout'
+export const ZEROPS_PROXY_DEPLOY_FAILED = 'proxyDeployFailed'
+export const ZEROPS_SUBDOMAIN_NOT_PUBLISHED = 'subdomainNotPublished'
+
+const namespaceError = (code: string, message: string, retryable: boolean, detail?: string): ProviderNamespaceError =>
+	new ProviderNamespaceError(message, code, retryable, detail)
+
+/**
+ * `apiError` composes `zerops: <label> failed (<status>) — <code>: <server message>`. The half before the
+ * first separator is OURS (a literal label and the status); the half after is the platform's, and it
+ * REPEATS the code, which travels separately. Splitting them keeps the summary safe to show while the
+ * upstream words survive in `detail`, where the control plane redacts them before they are stored or
+ * logged — discarding them is what left three different live failures indistinguishable (backlog 72).
+ *
+ * A `redactDetail: true` call carries the code and nothing else, so it yields no detail at all.
+ */
+const splitApiMessage = (message: string, code: string): { summary: string; detail?: string } => {
+	const at = message.indexOf(' — ')
+	if (at === -1) return { summary: message }
+	const summary = message.slice(0, at)
+	const rest = message.slice(at + 3)
+	if (code === '' || rest === code) return rest === code ? { summary } : { summary, detail: rest }
+	const detail = rest.startsWith(`${code}: `) ? rest.slice(code.length + 2) : rest
+	return detail === '' ? { summary } : { summary, detail }
+}
+
+/** Every namespace lifecycle failure leaves this provider as one typed, coded error. */
+const asNamespaceError = (cause: unknown, mode: 'provision' | 'reconcile'): ProviderNamespaceError => {
+	if (cause instanceof ProviderNamespaceError) return cause
+	if (cause instanceof ZeropsApiError) {
+		const { summary, detail } = splitApiMessage(cause.message, cause.code)
+		return namespaceError(
+			cause.code === '' ? `zeropsHttp${cause.status}` : cause.code,
+			summary,
+			cause.status === 429 || cause.status >= 500,
+			detail,
+		)
+	}
+	if (cause instanceof Error && cause.name === 'AbortError') {
+		return namespaceError(ZEROPS_NAMESPACE_CANCELLED, `Zerops namespace ${mode} was cancelled`, true)
+	}
+	if (cause instanceof Error) {
+		return namespaceError(ZEROPS_NAMESPACE_LIFECYCLE, cause.message, false)
+	}
+	return namespaceError(ZEROPS_NAMESPACE_LIFECYCLE, `Zerops namespace ${mode} failed`, false)
+}
+
 /**
  * Publish the proxy on its `*.zerops.app` subdomain — the ONE thing the import document cannot do.
  *
@@ -945,32 +1021,49 @@ const ensureSubdomainAccess = async (
 		await options.api.enableSubdomainAccess({ serviceId: proxyServiceId, signal })
 	} catch (error) {
 		if (error instanceof ZeropsApiError && error.code === ZEROPS_SERVICE_NOT_HTTP) {
-			throw new Error(
+			throw namespaceError(
+				ZEROPS_SERVICE_NOT_HTTP,
 				`Zerops namespace proxy ${proxyServiceId} cannot be published on a zerops.app subdomain: it exposes no deployed HTTP port (${ZEROPS_SERVICE_NOT_HTTP})`,
+				false,
 			)
 		}
 		throw error
 	}
 	for (let attempt = 0;; attempt += 1) {
 		if (signal.aborted) {
-			throw new Error('Zerops namespace provisioning was cancelled')
+			throw namespaceError(ZEROPS_NAMESPACE_CANCELLED, 'Zerops namespace provisioning was cancelled', true)
 		}
 		if (await published()) {
 			return
 		}
 		if (attempt >= SUBDOMAIN_READBACK_ATTEMPTS) {
-			throw new Error(
+			throw namespaceError(
+				ZEROPS_SUBDOMAIN_NOT_PUBLISHED,
 				`Zerops namespace proxy ${proxyServiceId} accepted enable-subdomain-access but still reads subdomainAccess: false — the namespace has no public entry point`,
+				true,
 			)
 		}
 		await (options.sleep ?? defaultSleep)(POLL_INTERVAL_MS, signal)
 	}
 }
 
+/** Every exit from the lifecycle below is a `ProviderNamespaceError`, so a caller never has to guess. */
 const mutateNamespace = async (
 	input: ProviderNamespaceMutationInput,
 	options: ZeropsNamespaceOptions,
 	mode: 'provision' | 'reconcile',
+): Promise<ProviderDeploymentNamespace> => {
+	try {
+		return await runNamespaceMutation(input, options, mode)
+	} catch (cause) {
+		throw asNamespaceError(cause, mode)
+	}
+}
+
+const runNamespaceMutation = async (
+	input: ProviderNamespaceMutationInput,
+	options: ZeropsNamespaceOptions,
+	mode: 'provision' | 'reconcile',
 ): Promise<ProviderDeploymentNamespace> => {
 	const suppliedTarget = decodeEnvelope(input.namespace.target)
 	let namespace = normalizedNamespace(input.namespace, options)

package/src/provider.ts

@@ -41,7 +41,7 @@ type ZeropsRun = TypedProviderRun<ZeropsRuntimeTarget, FabrikaManifest>
 export interface ZeropsSourceTransportBinding {
 	readonly connectionId: string
 	readonly installationId: number
-	readonly transportKind: 'legacy-v1' | 'keyed-v2'
+	readonly transportKind: 'keyed-v2'
 }
 
 export interface ZeropsSourceTransportRouting {
@@ -334,14 +334,14 @@ const runStep = async (spec: ZeropsJobSpec, env: StepEnv): Promise<void> => {
 					throw new Error('zerops: source transport binding has different installation coordinates')
 				}
 				let uploaded: ZeropsSourceUploadResult
-				if (binding?.transportKind === 'keyed-v2') {
+				if (binding === undefined) {
+					uploaded = await source.client.upload(uploadInput)
+				} else {
 					if (sourceTransport === undefined) throw new Error('zerops: keyed source transport is unavailable')
 					uploaded = await sourceTransport.uploadV2({
 						...uploadInput,
 						privateBinding: { connectionId: binding.connectionId, installationId: binding.installationId },
 					})
-				} else {
-					uploaded = await source.client.upload(uploadInput)
 				}
 				if (
 					uploaded.runId !== source.runtime.runId

package/src/source-connection.ts

@@ -1,19 +1,13 @@
 import type { ZeropsApi, ZeropsService, ZeropsServiceEnv } from './api'
 import {
-	buildZeropsSourceCredentialBundle,
-	decodeZeropsSourceCredentialBundle,
 	decodeZeropsSourceCredentialBundleV2,
-	serializeZeropsSourceCredentialBundle,
-	sha256ZeropsSourceCredentialBundle,
 	sha256ZeropsSourceCredentialBundleV2,
 	ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION_V2,
 	ZEROPS_SOURCE_PROTOCOL_VERSION_V2,
-	type ZeropsSourceCredentialActivateResponseV1,
 	type ZeropsSourceCredentialActivateResponseV2,
 	zeropsSourceCredentialEnvV2,
 	type ZeropsSourceCredentialManager,
 	type ZeropsSourceCredentialManagerV2,
-	type ZeropsSourceCredentialStatusResponseV1,
 	type ZeropsSourceCredentialStatusResponseV2,
 	type ZeropsSourceGitHubAppIdentityV1,
 	type ZeropsSourceInstallationsVerifyInput,
@@ -22,22 +16,14 @@ import {
 	type ZeropsSourceWebhookConfigureResponseV1,
 } from './source'
 
-export const ZEROPS_SOURCE_CREDENTIAL_ENV = 'GITHUB_APP_CREDENTIALS'
-export const ZEROPS_SOURCE_LEGACY_APP_ID_ENV = 'GITHUB_APP_ID'
-export const ZEROPS_SOURCE_LEGACY_PRIVATE_KEY_ENV = 'GITHUB_APP_PRIVATE_KEY'
-
 const SOURCE_HOSTNAME = 'source'
 const PROJECT_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/
 const DEFAULT_REREAD_ATTEMPTS = 5
 const DEFAULT_REREAD_DELAY_MS = 250
-const ADOPTION_CONNECTION_DOMAIN = 'fabrika:zerops-source-connection:v1'
 
 export type SourceConnectionInspection =
 	| { readonly state: 'unavailable' }
 	| { readonly state: 'anonymous' }
-	| { readonly state: 'legacy-complete' }
-	| { readonly state: 'legacy-partial' }
-	| { readonly state: 'durable'; readonly credentialSha256: string }
 
 export type SourceConnectionStatus =
 	| SourceConnectionInspection
@@ -60,32 +46,20 @@ export interface SourceConnectionStatusInput {
 	readonly signal: AbortSignal
 }
 
-export interface SourceConnectionAdoptExistingInput {
-	readonly signal: AbortSignal
-}
-
-/** Provider-neutral lifecycle consumed by the future authenticated control connection flow. */
+/** Provider-neutral lifecycle consumed by the authenticated control connection flow. */
 export interface SourceConnectionAdmin {
 	inspect(signal: AbortSignal): Promise<SourceConnectionInspection>
-	adoptExisting(input: SourceConnectionAdoptExistingInput): Promise<ZeropsSourceCredentialActivateResponseV1>
-	activate(input: SourceConnectionActivateInput): Promise<ZeropsSourceCredentialActivateResponseV1>
-	activateV2?(input: SourceConnectionActivateInput): Promise<ZeropsSourceCredentialActivateResponseV2>
-	status(input: SourceConnectionStatusInput): Promise<SourceConnectionStatus>
-	statusV2?(input: SourceConnectionStatusInput): Promise<SourceConnectionStatus>
-	configureWebhook(input: ZeropsSourceWebhookConfigureInput): Promise<ZeropsSourceWebhookConfigureResponseV1>
-	verifyInstallations(input: ZeropsSourceInstallationsVerifyInput): Promise<ZeropsSourceInstallationsVerifyResponseV1>
-}
-
-interface CompleteSourceConnectionAdmin extends SourceConnectionAdmin {
 	activateV2(input: SourceConnectionActivateInput): Promise<ZeropsSourceCredentialActivateResponseV2>
 	statusV2(input: SourceConnectionStatusInput): Promise<SourceConnectionStatus>
+	configureWebhook(input: ZeropsSourceWebhookConfigureInput): Promise<ZeropsSourceWebhookConfigureResponseV1>
+	verifyInstallations(input: ZeropsSourceInstallationsVerifyInput): Promise<ZeropsSourceInstallationsVerifyResponseV1>
 }
 
 export type SourceConnectionZeropsApi = Pick<ZeropsApi, 'findService' | 'listServiceEnv' | 'createServiceEnv'>
 
 export interface ZeropsSourceConnectionAdminOptions {
 	readonly api: SourceConnectionZeropsApi
-	readonly source: ZeropsSourceCredentialManager & Partial<ZeropsSourceCredentialManagerV2>
+	readonly source: ZeropsSourceCredentialManager & ZeropsSourceCredentialManagerV2
 	readonly projectId: string
 	readonly reread?: {
 		readonly attempts?: number
@@ -110,12 +84,6 @@ export class SourceConnectionAdminError extends Error {
 	}
 }
 
-interface DurableInspection {
-	readonly public: SourceConnectionInspection
-	readonly service: ZeropsService
-	readonly bundle?: string
-}
-
 interface DurableInspectionV2 {
 	readonly public:
 		| { readonly state: 'anonymous' }
@@ -125,7 +93,7 @@ interface DurableInspectionV2 {
 	readonly bundle?: string
 }
 
-export function createZeropsSourceConnectionAdmin(options: ZeropsSourceConnectionAdminOptions): CompleteSourceConnectionAdmin {
+export function createZeropsSourceConnectionAdmin(options: ZeropsSourceConnectionAdminOptions): SourceConnectionAdmin {
 	if (!PROJECT_ID_PATTERN.test(options.projectId)) throw new SourceConnectionAdminError('invalid_configuration')
 	const attempts = options.reread?.attempts ?? DEFAULT_REREAD_ATTEMPTS
 	const delayMs = options.reread?.delayMs ?? DEFAULT_REREAD_DELAY_MS
@@ -148,11 +116,6 @@ export function createZeropsSourceConnectionAdmin(options: ZeropsSourceConnectio
 		return { service, environment }
 	}
 
-	const inspectInternal = async (signal: AbortSignal): Promise<DurableInspection> => {
-		const current = await readEnvironment(signal)
-		return await withDigest(classify(current.service, current.environment))
-	}
-
 	const inspectV2Internal = async (connectionId: string, signal: AbortSignal): Promise<DurableInspectionV2> => {
 		let environmentKey: string
 		try {
@@ -164,99 +127,15 @@ export function createZeropsSourceConnectionAdmin(options: ZeropsSourceConnectio
 		return await classifyV2(current.service, current.environment, environmentKey, connectionId)
 	}
 
-	const admin: CompleteSourceConnectionAdmin = {
-		inspect: async (signal) => (await inspectInternal(signal)).public,
-
-		adoptExisting: async (input) => {
-			const existing = await inspectInternal(input.signal)
-			if (
-				(existing.public.state !== 'legacy-complete' && existing.public.state !== 'durable')
-				|| existing.bundle === undefined
-			) throw new SourceConnectionAdminError('credential_conflict')
-			let credentialSha256: string
-			try {
-				credentialSha256 = existing.public.state === 'durable'
-					? existing.public.credentialSha256
-					: await sha256ZeropsSourceCredentialBundle(existing.bundle)
-			} catch {
-				throw new SourceConnectionAdminError('credential_conflict')
-			}
-			return await admin.activate({
-				connectionId: await adoptionConnectionId(options.projectId, credentialSha256),
-				credentialBundle: existing.bundle,
-				credentialSha256,
-				signal: input.signal,
-			})
-		},
-
-		activate: async (input) => {
-			let digest: string
-			try {
-				decodeZeropsSourceCredentialBundle(input.credentialBundle)
-				digest = await sha256ZeropsSourceCredentialBundle(input.credentialBundle)
-			} catch {
-				throw new SourceConnectionAdminError('credential_conflict')
-			}
-			if (digest !== input.credentialSha256) throw new SourceConnectionAdminError('credential_conflict')
-			const initial = await inspectInternal(input.signal)
-			if (initial.public.state === 'legacy-partial' || initial.public.state === 'unavailable') {
-				throw new SourceConnectionAdminError('credential_conflict')
-			}
-			if (initial.public.state === 'durable') {
-				if (initial.bundle !== input.credentialBundle || initial.public.credentialSha256 !== digest) {
-					throw new SourceConnectionAdminError('credential_conflict')
-				}
-			} else {
-				if (initial.public.state === 'legacy-complete' && initial.bundle !== input.credentialBundle) {
-					throw new SourceConnectionAdminError('credential_conflict')
-				}
-				try {
-					await options.api.createServiceEnv({
-						serviceId: initial.service.id,
-						key: ZEROPS_SOURCE_CREDENTIAL_ENV,
-						value: input.credentialBundle,
-						signal: input.signal,
-					})
-				} catch (error) {
-					if (isAbort(error, input.signal)) throw error
-				}
-				await proveDurable(input.credentialBundle, digest, input.signal, attempts, delayMs, sleep, inspectInternal)
-			}
-			let activated: ZeropsSourceCredentialActivateResponseV1
-			try {
-				activated = await options.source.activate(input)
-			} catch (error) {
-				if (isAbort(error, input.signal)) throw error
-				let status: ZeropsSourceCredentialStatusResponseV1
-				try {
-					status = await options.source.status({ connectionId: input.connectionId, signal: input.signal })
-				} catch (statusError) {
-					if (isAbort(statusError, input.signal)) throw statusError
-					throw new SourceConnectionAdminError('credential_activation')
-				}
-				if (
-					status.state !== 'active' || status.connectionId !== input.connectionId || status.credentialSha256 !== digest
-				) throw new SourceConnectionAdminError('credential_activation')
-				activated = {
-					protocolVersion: 1,
-					connectionId: input.connectionId,
-					credentialVersion: status.credentialVersion,
-					credentialSha256: status.credentialSha256,
-					githubApp: status.githubApp,
-				}
-			}
-			if (activated.connectionId !== input.connectionId || activated.credentialSha256 !== digest) {
-				throw new SourceConnectionAdminError('credential_activation')
-			}
-			return activated
+	const admin: SourceConnectionAdmin = {
+		// Proves the exact `source` service AND that this token can read its environment. A setup that
+		// cannot do both fails later anyway; the console shows this probe before it starts one.
+		inspect: async (signal) => {
+			await readEnvironment(signal)
+			return { state: 'anonymous' }
 		},
 
 		activateV2: async (input) => {
-			if (options.source.activateV2 === undefined || options.source.statusV2 === undefined) {
-				throw new SourceConnectionAdminError('credential_activation')
-			}
-			const activateV2 = options.source.activateV2.bind(options.source)
-			const statusV2 = options.source.statusV2.bind(options.source)
 			let digest: string
 			try {
 				const bundle = decodeZeropsSourceCredentialBundleV2(input.credentialBundle)
@@ -286,12 +165,12 @@ export function createZeropsSourceConnectionAdmin(options: ZeropsSourceConnectio
 			}
 			let activated: ZeropsSourceCredentialActivateResponseV2
 			try {
-				activated = await activateV2(input)
+				activated = await options.source.activateV2(input)
 			} catch (error) {
 				if (isAbort(error, input.signal)) throw error
 				let status: ZeropsSourceCredentialStatusResponseV2
 				try {
-					status = await statusV2({ connectionId: input.connectionId, signal: input.signal })
+					status = await options.source.statusV2({ connectionId: input.connectionId, signal: input.signal })
 				} catch (statusError) {
 					if (isAbort(statusError, input.signal)) throw statusError
 					throw new SourceConnectionAdminError('credential_activation')
@@ -313,34 +192,12 @@ export function createZeropsSourceConnectionAdmin(options: ZeropsSourceConnectio
 			return activated
 		},
 
-		status: async (input) => {
-			const durable = await inspectInternal(input.signal)
-			if (durable.public.state !== 'durable') return durable.public
-			let runtime: ZeropsSourceCredentialStatusResponseV1
-			try {
-				runtime = await options.source.status(input)
-			} catch (error) {
-				if (isAbort(error, input.signal)) throw error
-				throw new SourceConnectionAdminError('credential_activation')
-			}
-			if (runtime.connectionId !== input.connectionId || runtime.state === 'anonymous') {
-				return { state: 'activation-required', credentialSha256: durable.public.credentialSha256 }
-			}
-			if (runtime.credentialSha256 !== durable.public.credentialSha256) {
-				throw new SourceConnectionAdminError('credential_conflict')
-			}
-			return { state: 'active', credentialSha256: runtime.credentialSha256, githubApp: runtime.githubApp }
-		},
-
 		statusV2: async (input) => {
 			const durable = await inspectV2Internal(input.connectionId, input.signal)
 			if (durable.public.state !== 'durable') return durable.public
-			const statusV2 = options.source.statusV2
-			if (statusV2 === undefined) throw new SourceConnectionAdminError('credential_activation')
-			const readStatusV2 = statusV2.bind(options.source)
 			let runtime: ZeropsSourceCredentialStatusResponseV2
 			try {
-				runtime = await readStatusV2(input)
+				runtime = await options.source.statusV2(input)
 			} catch (error) {
 				if (isAbort(error, input.signal)) throw error
 				throw new SourceConnectionAdminError('credential_activation')
@@ -355,7 +212,7 @@ export function createZeropsSourceConnectionAdmin(options: ZeropsSourceConnectio
 		},
 
 		configureWebhook: async (input) => {
-			await requireDurableDigest(input.connectionId, input.credentialSha256, input.signal, inspectInternal, inspectV2Internal)
+			await requireDurableDigest(input.connectionId, input.credentialSha256, input.signal, inspectV2Internal)
 			try {
 				const response = await options.source.configureWebhook(input)
 				if (
@@ -371,7 +228,7 @@ export function createZeropsSourceConnectionAdmin(options: ZeropsSourceConnectio
 		},
 
 		verifyInstallations: async (input) => {
-			await requireDurableDigest(input.connectionId, input.credentialSha256, input.signal, inspectInternal, inspectV2Internal)
+			await requireDurableDigest(input.connectionId, input.credentialSha256, input.signal, inspectV2Internal)
 			try {
 				const response = await options.source.verifyInstallations(input)
 				if (response.connectionId !== input.connectionId || response.credentialSha256 !== input.credentialSha256) {
@@ -388,26 +245,14 @@ export function createZeropsSourceConnectionAdmin(options: ZeropsSourceConnectio
 	return admin
 }
 
-async function adoptionConnectionId(projectId: string, credentialSha256: string): Promise<string> {
-	const material = `${ADOPTION_CONNECTION_DOMAIN}\0${projectId}\0${credentialSha256}`
-	const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(material)))
-	return `zsrc-${[...digest].map((byte) => byte.toString(16).padStart(2, '0')).join('')}`
-}
-
 async function requireDurableDigest(
 	connectionId: string,
 	digest: string,
 	signal: AbortSignal,
-	inspect: (signal: AbortSignal) => Promise<DurableInspection>,
 	inspectV2: (connectionId: string, signal: AbortSignal) => Promise<DurableInspectionV2>,
 ): Promise<void> {
 	const keyed = await inspectV2(connectionId, signal)
-	if (keyed.public.state === 'durable') {
-		if (keyed.public.credentialSha256 === digest) return
-		throw new SourceConnectionAdminError('credential_conflict')
-	}
-	const durable = await inspect(signal)
-	if (durable.public.state !== 'durable' || durable.public.credentialSha256 !== digest) {
+	if (keyed.public.state !== 'durable' || keyed.public.credentialSha256 !== digest) {
 		throw new SourceConnectionAdminError('credential_conflict')
 	}
 }
@@ -427,45 +272,6 @@ async function exactSourceService(api: SourceConnectionZeropsApi, projectId: str
 	return service
 }
 
-function classify(service: ZeropsService, environment: readonly ZeropsServiceEnv[]): DurableInspection {
-	const bundleEntries = environment.filter((entry) => entry.key === ZEROPS_SOURCE_CREDENTIAL_ENV)
-	const legacyIdEntries = environment.filter((entry) => entry.key === ZEROPS_SOURCE_LEGACY_APP_ID_ENV)
-	const legacyKeyEntries = environment.filter((entry) => entry.key === ZEROPS_SOURCE_LEGACY_PRIVATE_KEY_ENV)
-	if (bundleEntries.length > 1 || legacyIdEntries.length > 1 || legacyKeyEntries.length > 1) {
-		throw new SourceConnectionAdminError('credential_conflict')
-	}
-	const legacyCount = legacyIdEntries.length + legacyKeyEntries.length
-	let legacyBundle: string | undefined
-	if (legacyIdEntries.length === 1 && legacyKeyEntries.length === 1) {
-		const legacyAppId = legacyIdEntries[0]?.content
-		const legacyPrivateKeyPem = legacyKeyEntries[0]?.content
-		if (legacyAppId === undefined || legacyPrivateKeyPem === undefined) throw new SourceConnectionAdminError('credential_conflict')
-		try {
-			legacyBundle = serializeZeropsSourceCredentialBundle(buildZeropsSourceCredentialBundle({
-				githubAppId: legacyAppId,
-				privateKeyPem: legacyPrivateKeyPem,
-			}))
-		} catch {
-			throw new SourceConnectionAdminError('credential_conflict')
-		}
-	}
-	if (bundleEntries.length === 1) {
-		if (legacyCount !== 0 && legacyBundle === undefined) throw new SourceConnectionAdminError('credential_conflict')
-		const bundle = bundleEntries[0]?.content
-		if (bundle === undefined) throw new SourceConnectionAdminError('credential_conflict')
-		try {
-			decodeZeropsSourceCredentialBundle(bundle)
-		} catch {
-			throw new SourceConnectionAdminError('credential_conflict')
-		}
-		if (legacyBundle !== undefined && legacyBundle !== bundle) throw new SourceConnectionAdminError('credential_conflict')
-		return { public: { state: 'durable', credentialSha256: '' }, service, bundle }
-	}
-	if (legacyCount === 0) return { public: { state: 'anonymous' }, service }
-	if (legacyBundle !== undefined) return { public: { state: 'legacy-complete' }, service, bundle: legacyBundle }
-	return { public: { state: 'legacy-partial' }, service }
-}
-
 async function classifyV2(
 	service: ZeropsService,
 	environment: readonly ZeropsServiceEnv[],
@@ -491,35 +297,6 @@ async function classifyV2(
 	}
 }
 
-async function withDigest(inspection: DurableInspection): Promise<DurableInspection> {
-	if (inspection.public.state !== 'durable' || inspection.bundle === undefined) return inspection
-	return {
-		...inspection,
-		public: { state: 'durable', credentialSha256: await sha256ZeropsSourceCredentialBundle(inspection.bundle) },
-	}
-}
-
-async function proveDurable(
-	bundle: string,
-	digest: string,
-	signal: AbortSignal,
-	attempts: number,
-	delayMs: number,
-	sleep: (delayMs: number, signal: AbortSignal) => Promise<void>,
-	inspect: (signal: AbortSignal) => Promise<DurableInspection>,
-): Promise<void> {
-	for (let attempt = 0; attempt < attempts; attempt++) {
-		const durable = await withDigest(await inspect(signal))
-		if (durable.public.state === 'durable') {
-			if (durable.bundle === bundle && durable.public.credentialSha256 === digest) return
-			throw new SourceConnectionAdminError('credential_conflict')
-		}
-		if (durable.public.state !== 'anonymous') throw new SourceConnectionAdminError('credential_conflict')
-		if (attempt + 1 < attempts) await sleep(delayMs, signal)
-	}
-	throw new SourceConnectionAdminError('credential_persistence')
-}
-
 async function proveDurableV2(
 	input: SourceConnectionActivateInput,
 	digest: string,

package/src/source.ts

@@ -1,13 +1,9 @@
 export const ZEROPS_SOURCE_PROTOCOL_VERSION = 1
-export const ZEROPS_SOURCE_RESOLVE_INSTALLATION_PATH = '/v1/installations/resolve'
 export const ZEROPS_SOURCE_RESOLVE_PATH = '/v1/source/resolve'
 export const ZEROPS_SOURCE_UPLOAD_PATH = '/v1/source/upload'
 export const ZEROPS_SOURCE_CANCEL_PATH = '/v1/source/cancel'
-export const ZEROPS_SOURCE_CREDENTIAL_ACTIVATE_PATH = '/v1/source/credentials/activate'
-export const ZEROPS_SOURCE_CREDENTIAL_STATUS_PATH = '/v1/source/credentials/status'
 export const ZEROPS_SOURCE_WEBHOOK_CONFIGURE_PATH = '/v1/source/github/webhook/configure'
 export const ZEROPS_SOURCE_INSTALLATIONS_VERIFY_PATH = '/v1/source/github/installations/verify'
-export const ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION = 1
 export const ZEROPS_SOURCE_PROTOCOL_VERSION_V2 = 2
 export const ZEROPS_SOURCE_RESOLVE_PATH_V2 = '/v2/source/resolve'
 export const ZEROPS_SOURCE_UPLOAD_PATH_V2 = '/v2/source/upload'
@@ -33,12 +29,6 @@ const GITHUB_APP_ID_PATTERN = /^[1-9][0-9]{0,31}$/
 const GITHUB_APP_SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,98}[a-z0-9])?$/
 const GITHUB_LOGIN_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,98}[A-Za-z0-9])?$/
 
-export interface ZeropsSourceCredentialBundleV1 {
-	readonly version: typeof ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION
-	readonly githubAppId: string
-	readonly privateKeyPem: string
-}
-
 export interface ZeropsSourceCredentialBundleV2 {
 	readonly version: typeof ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION_V2
 	readonly connectionId: string
@@ -61,41 +51,6 @@ export interface ZeropsSourceGitHubAppIdentityV1 {
 	readonly events: readonly ['push']
 }
 
-export interface ZeropsSourceCredentialActivateRequestV1 {
-	readonly protocolVersion: typeof ZEROPS_SOURCE_PROTOCOL_VERSION
-	readonly connectionId: string
-	/** Canonical JSON that is byte-identical to the durable source environment value. */
-	readonly credentialBundle: string
-	readonly credentialSha256: string
-}
-
-export interface ZeropsSourceCredentialActivateResponseV1 {
-	readonly protocolVersion: typeof ZEROPS_SOURCE_PROTOCOL_VERSION
-	readonly connectionId: string
-	readonly credentialVersion: typeof ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION
-	readonly credentialSha256: string
-	readonly githubApp: ZeropsSourceGitHubAppIdentityV1
-}
-
-export interface ZeropsSourceCredentialStatusRequestV1 {
-	readonly protocolVersion: typeof ZEROPS_SOURCE_PROTOCOL_VERSION
-	readonly connectionId: string
-}
-
-export interface ZeropsSourceCredentialAnonymousStatusResponseV1 {
-	readonly protocolVersion: typeof ZEROPS_SOURCE_PROTOCOL_VERSION
-	readonly connectionId: string
-	readonly state: 'anonymous'
-}
-
-export interface ZeropsSourceCredentialActiveStatusResponseV1 extends ZeropsSourceCredentialActivateResponseV1 {
-	readonly state: 'active'
-}
-
-export type ZeropsSourceCredentialStatusResponseV1 =
-	| ZeropsSourceCredentialAnonymousStatusResponseV1
-	| ZeropsSourceCredentialActiveStatusResponseV1
-
 export interface ZeropsSourceCredentialActivateRequestV2 {
 	readonly protocolVersion: typeof ZEROPS_SOURCE_PROTOCOL_VERSION_V2
 	readonly connectionId: string
@@ -198,16 +153,6 @@ export interface ZeropsSourceDescriptor {
 	sha256: string
 }
 
-export interface ZeropsSourceResolveInstallationRequestV1 {
-	protocolVersion: typeof ZEROPS_SOURCE_PROTOCOL_VERSION
-	repository: ZeropsSourceRepository
-}
-
-export interface ZeropsSourceResolveInstallationResponseV1 {
-	protocolVersion: typeof ZEROPS_SOURCE_PROTOCOL_VERSION
-	githubInstallationId: number | null
-}
-
 export interface ZeropsSourceResolveRequestV1 {
 	protocolVersion: typeof ZEROPS_SOURCE_PROTOCOL_VERSION
 	runId: string
@@ -340,7 +285,6 @@ export const ZEROPS_SOURCE_ERROR_CODES: readonly ZeropsSourceErrorCode[] = [
 export type ZeropsSourceErrorStage =
 	| 'authenticate'
 	| 'validate'
-	| 'resolve-installation'
 	| 'resolve'
 	| 'archive'
 	| 'upload'
@@ -350,7 +294,6 @@ export type ZeropsSourceErrorStage =
 export const ZEROPS_SOURCE_ERROR_STAGES: readonly ZeropsSourceErrorStage[] = [
 	'authenticate',
 	'validate',
-	'resolve-installation',
 	'resolve',
 	'archive',
 	'upload',
@@ -428,13 +371,12 @@ export interface ZeropsSourceCancelInput {
 }
 
 export interface ZeropsSourceClient {
-	resolveInstallationId(repoUrl: string, signal: AbortSignal): Promise<number | null>
 	resolve(input: ZeropsSourceResolveInput): Promise<ZeropsSourceResolveResult>
 	upload(input: ZeropsSourceUploadInput): Promise<ZeropsSourceUploadResult>
 	cancel(input: ZeropsSourceCancelInput): Promise<void>
 }
 
-/** Keyed source operations are additive so legacy client implementations remain valid. */
+/** Keyed source operations; the unkeyed v1 wire remains the anonymous public-repository path. */
 export interface ZeropsSourceClientV2 {
 	resolveV2(input: ZeropsSourceResolveInputV2): Promise<ZeropsSourceResolveResult>
 	uploadV2(input: ZeropsSourceUploadInputV2): Promise<ZeropsSourceUploadResult>
@@ -454,13 +396,11 @@ export interface ZeropsSourceCredentialStatusInput {
 
 /** Credential management is separate from the deploy source client and is composed only in the authenticated admin flow. */
 export interface ZeropsSourceCredentialManager {
-	activate(input: ZeropsSourceCredentialActivateInput): Promise<ZeropsSourceCredentialActivateResponseV1>
-	status(input: ZeropsSourceCredentialStatusInput): Promise<ZeropsSourceCredentialStatusResponseV1>
 	configureWebhook(input: ZeropsSourceWebhookConfigureInput): Promise<ZeropsSourceWebhookConfigureResponseV1>
 	verifyInstallations(input: ZeropsSourceInstallationsVerifyInput): Promise<ZeropsSourceInstallationsVerifyResponseV1>
 }
 
-/** Keyed credential operations are additive so legacy credential managers remain valid. */
+/** Keyed credential operations — the only way a private credential reaches `source`. */
 export interface ZeropsSourceCredentialManagerV2 {
 	activateV2(input: ZeropsSourceCredentialActivateInput): Promise<ZeropsSourceCredentialActivateResponseV2>
 	statusV2(input: ZeropsSourceCredentialStatusInput): Promise<ZeropsSourceCredentialStatusResponseV2>
@@ -539,23 +479,6 @@ const sha256 = (value: unknown, label: string): string => {
 	return value
 }
 
-const sourceCredentialBundleValue = (value: unknown): ZeropsSourceCredentialBundleV1 => {
-	const parsed = record(value, 'source credential bundle')
-	exactKeys(parsed, ['version', 'githubAppId', 'privateKeyPem'], 'source credential bundle')
-	if (parsed['version'] !== ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION) {
-		throw new Error('source credential bundle has an unsupported version')
-	}
-	const githubAppId = boundedString(parsed['githubAppId'], 'source credential bundle.githubAppId', 32)
-	if (!GITHUB_APP_ID_PATTERN.test(githubAppId)) throw new Error('source credential bundle.githubAppId is invalid')
-	const privateKeyPem = boundedString(
-		parsed['privateKeyPem'],
-		'source credential bundle.privateKeyPem',
-		MAX_GITHUB_APP_PRIVATE_KEY_LENGTH,
-	)
-	if (!isCanonicalPrivateKeyPem(privateKeyPem)) throw new Error('source credential bundle.privateKeyPem is invalid')
-	return { version: ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION, githubAppId, privateKeyPem }
-}
-
 const sourceCredentialBundleValueV2 = (value: unknown): ZeropsSourceCredentialBundleV2 => {
 	const parsed = record(value, 'source credential bundle v2')
 	exactKeys(parsed, ['version', 'connectionId', 'githubAppId', 'privateKeyPem'], 'source credential bundle v2')
@@ -592,38 +515,6 @@ const isCanonicalPrivateKeyPem = (value: string): boolean => {
 	}
 }
 
-export function buildZeropsSourceCredentialBundle(
-	input: Omit<ZeropsSourceCredentialBundleV1, 'version'>,
-): ZeropsSourceCredentialBundleV1 {
-	return sourceCredentialBundleValue({ version: ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION, ...input })
-}
-
-export function serializeZeropsSourceCredentialBundle(bundle: ZeropsSourceCredentialBundleV1): string {
-	const parsed = sourceCredentialBundleValue(bundle)
-	return JSON.stringify({ version: parsed.version, githubAppId: parsed.githubAppId, privateKeyPem: parsed.privateKeyPem })
-}
-
-export function decodeZeropsSourceCredentialBundle(value: unknown): ZeropsSourceCredentialBundleV1 {
-	if (typeof value !== 'string' || new TextEncoder().encode(value).byteLength > MAX_SOURCE_CREDENTIAL_BUNDLE_BYTES) {
-		throw new Error('source credential bundle must be bounded canonical JSON')
-	}
-	let decoded: unknown
-	try {
-		decoded = JSON.parse(value)
-	} catch {
-		throw new Error('source credential bundle must be bounded canonical JSON')
-	}
-	const bundle = sourceCredentialBundleValue(decoded)
-	if (serializeZeropsSourceCredentialBundle(bundle) !== value) throw new Error('source credential bundle must be bounded canonical JSON')
-	return bundle
-}
-
-export async function sha256ZeropsSourceCredentialBundle(value: string): Promise<string> {
-	decodeZeropsSourceCredentialBundle(value)
-	const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value)))
-	return [...digest].map((byte) => byte.toString(16).padStart(2, '0')).join('')
-}
-
 export function buildZeropsSourceCredentialBundleV2(
 	input: Omit<ZeropsSourceCredentialBundleV2, 'version'>,
 ): ZeropsSourceCredentialBundleV2 {
@@ -810,115 +701,6 @@ export function normalizeZeropsSourceRepository(repoUrl: string): ZeropsSourceRe
 	return repository({ owner: owner.toLowerCase(), name: name.toLowerCase() }, 'source repository')
 }
 
-export function decodeZeropsSourceCredentialActivateRequest(value: unknown): ZeropsSourceCredentialActivateRequestV1 {
-	const parsed = record(value, 'source credential activate request')
-	exactKeys(
-		parsed,
-		['protocolVersion', 'connectionId', 'credentialBundle', 'credentialSha256'],
-		'source credential activate request',
-	)
-	const credentialBundle = boundedString(
-		parsed['credentialBundle'],
-		'source credential activate request.credentialBundle',
-		MAX_SOURCE_CREDENTIAL_BUNDLE_BYTES,
-	)
-	decodeZeropsSourceCredentialBundle(credentialBundle)
-	return {
-		protocolVersion: protocolVersion(parsed, 'source credential activate request'),
-		connectionId: identifier(parsed['connectionId'], 'source credential activate request.connectionId'),
-		credentialBundle,
-		credentialSha256: sha256(parsed['credentialSha256'], 'source credential activate request.credentialSha256'),
-	}
-}
-
-export function buildZeropsSourceCredentialActivateRequest(
-	input: ZeropsSourceCredentialActivateInput,
-): ZeropsSourceCredentialActivateRequestV1 {
-	return decodeZeropsSourceCredentialActivateRequest({
-		protocolVersion: ZEROPS_SOURCE_PROTOCOL_VERSION,
-		connectionId: input.connectionId,
-		credentialBundle: input.credentialBundle,
-		credentialSha256: input.credentialSha256,
-	})
-}
-
-export function decodeZeropsSourceCredentialActivateResponse(value: unknown): ZeropsSourceCredentialActivateResponseV1 {
-	const parsed = record(value, 'source credential activate response')
-	exactKeys(
-		parsed,
-		['protocolVersion', 'connectionId', 'credentialVersion', 'credentialSha256', 'githubApp'],
-		'source credential activate response',
-	)
-	if (parsed['credentialVersion'] !== ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION) {
-		throw new Error('source credential activate response has an unsupported credentialVersion')
-	}
-	return {
-		protocolVersion: protocolVersion(parsed, 'source credential activate response'),
-		connectionId: identifier(parsed['connectionId'], 'source credential activate response.connectionId'),
-		credentialVersion: ZEROPS_SOURCE_CREDENTIAL_BUNDLE_VERSION,
-		credentialSha256: sha256(parsed['credentialSha256'], 'source credential activate response.credentialSha256'),
-		githubApp: githubAppIdentity(parsed['githubApp'], 'source credential activate response.githubApp'),
-	}
-}
-
-export function buildZeropsSourceCredentialActivateResponse(
-	input: Omit<ZeropsSourceCredentialActivateResponseV1, 'protocolVersion'>,
-): ZeropsSourceCredentialActivateResponseV1 {
-	return decodeZeropsSourceCredentialActivateResponse({ protocolVersion: ZEROPS_SOURCE_PROTOCOL_VERSION, ...input })
-}
-
-export function decodeZeropsSourceCredentialStatusRequest(value: unknown): ZeropsSourceCredentialStatusRequestV1 {
-	const parsed = record(value, 'source credential status request')
-	exactKeys(parsed, ['protocolVersion', 'connectionId'], 'source credential status request')
-	return {
-		protocolVersion: protocolVersion(parsed, 'source credential status request'),
-		connectionId: identifier(parsed['connectionId'], 'source credential status request.connectionId'),
-	}
-}
-
-export function buildZeropsSourceCredentialStatusRequest(
-	input: ZeropsSourceCredentialStatusInput,
-): ZeropsSourceCredentialStatusRequestV1 {
-	return decodeZeropsSourceCredentialStatusRequest({
-		protocolVersion: ZEROPS_SOURCE_PROTOCOL_VERSION,
-		connectionId: input.connectionId,
-	})
-}
-
-export function decodeZeropsSourceCredentialStatusResponse(value: unknown): ZeropsSourceCredentialStatusResponseV1 {
-	const parsed = record(value, 'source credential status response')
-	if (parsed['state'] === 'anonymous') {
-		exactKeys(parsed, ['protocolVersion', 'connectionId', 'state'], 'source credential status response')
-		return {
-			protocolVersion: protocolVersion(parsed, 'source credential status response'),
-			connectionId: identifier(parsed['connectionId'], 'source credential status response.connectionId'),
-			state: 'anonymous',
-		}
-	}
-	if (parsed['state'] !== 'active') throw new Error('source credential status response.state is invalid')
-	exactKeys(
-		parsed,
-		['protocolVersion', 'connectionId', 'state', 'credentialVersion', 'credentialSha256', 'githubApp'],
-		'source credential status response',
-	)
-	const active = decodeZeropsSourceCredentialActivateResponse({
-		protocolVersion: parsed['protocolVersion'],
-		connectionId: parsed['connectionId'],
-		credentialVersion: parsed['credentialVersion'],
-		credentialSha256: parsed['credentialSha256'],
-		githubApp: parsed['githubApp'],
-	})
-	return { ...active, state: 'active' }
-}
-
-export function buildZeropsSourceCredentialStatusResponse(
-	input:
-		| { readonly connectionId: string; readonly state: 'anonymous' }
-		| Omit<ZeropsSourceCredentialActiveStatusResponseV1, 'protocolVersion'>,
-): ZeropsSourceCredentialStatusResponseV1 {
-	return decodeZeropsSourceCredentialStatusResponse({ protocolVersion: ZEROPS_SOURCE_PROTOCOL_VERSION, ...input })
-}
-
 export function decodeZeropsSourceCredentialActivateRequestV2(value: unknown): ZeropsSourceCredentialActivateRequestV2 {
 	const parsed = record(value, 'source credential activate request v2')
 	exactKeys(
@@ -1033,12 +815,11 @@ export function buildZeropsSourceCredentialStatusResponseV2(
 const WEBHOOK_PATH = '/webhooks/github'
 
 /**
- * `/webhooks/github` is the legacy single-connection route; every keyed connection appends its own id
- * so one App's deliveries cannot be replayed against another. Requiring the bare path rejected every
- * multi-connection setup at `configureWebhook`.
+ * Only the Zerops `source` configure wire reaches this, and every Zerops connection appends its own id
+ * so one App's deliveries cannot be replayed against another. The bare path is a Cloudflare URL and is
+ * refused here (ADR-0039).
  */
 const isWebhookPath = (pathname: string): boolean => {
-	if (pathname === WEBHOOK_PATH) return true
 	if (!pathname.startsWith(`${WEBHOOK_PATH}/`)) return false
 	const connectionId = pathname.slice(WEBHOOK_PATH.length + 1)
 	// `ID_PATTERN` has no `%`, so a percent-escape in the path fails here rather than round-tripping.
@@ -1188,37 +969,6 @@ export function buildZeropsSourceInstallationsVerifyResponse(
 	return decodeZeropsSourceInstallationsVerifyResponse({ protocolVersion: ZEROPS_SOURCE_PROTOCOL_VERSION, ...input })
 }
 
-export function decodeZeropsSourceResolveInstallationRequest(value: unknown): ZeropsSourceResolveInstallationRequestV1 {
-	const parsed = record(value, 'source resolve-installation request')
-	exactKeys(parsed, ['protocolVersion', 'repository'], 'source resolve-installation request')
-	return {
-		protocolVersion: protocolVersion(parsed, 'source resolve-installation request'),
-		repository: repository(parsed['repository'], 'source resolve-installation request.repository'),
-	}
-}
-
-export function buildZeropsSourceResolveInstallationRequest(repoUrl: string): ZeropsSourceResolveInstallationRequestV1 {
-	return decodeZeropsSourceResolveInstallationRequest({
-		protocolVersion: ZEROPS_SOURCE_PROTOCOL_VERSION,
-		repository: normalizeZeropsSourceRepository(repoUrl),
-	})
-}
-
-export function decodeZeropsSourceResolveInstallationResponse(value: unknown): ZeropsSourceResolveInstallationResponseV1 {
-	const parsed = record(value, 'source resolve-installation response')
-	exactKeys(parsed, ['protocolVersion', 'githubInstallationId'], 'source resolve-installation response')
-	return {
-		protocolVersion: protocolVersion(parsed, 'source resolve-installation response'),
-		githubInstallationId: parsed['githubInstallationId'] === null
-			? null
-			: installationId(parsed['githubInstallationId'], 'source resolve-installation response.githubInstallationId'),
-	}
-}
-
-export function buildZeropsSourceResolveInstallationResponse(githubInstallationId: number | null): ZeropsSourceResolveInstallationResponseV1 {
-	return decodeZeropsSourceResolveInstallationResponse({ protocolVersion: ZEROPS_SOURCE_PROTOCOL_VERSION, githubInstallationId })
-}
-
 export function decodeZeropsSourceResolveRequest(value: unknown): ZeropsSourceResolveRequestV1 {
 	const parsed = record(value, 'source resolve request')
 	optionalFields(