@fabrika/provider-zerops 0.0.26 → 0.3.1

package/src/authoring.ts

@@ -1,6 +1,7 @@
 import { ZEROPS_SHARED_POSTGRES_CONNECTION_STRING } from './namespace'
 export { zeropsSharedServiceHostname, zeropsSharedServicePrefix } from './service-names'
 import { APP_PROVIDER, isProviderAuthoredApp, type ProviderAuthoredApp } from '@fabrika/provider-contract'
+import { z } from 'zod'
 import type { ZeropsAppConfig, ZeropsSharedPostgresBinding } from './types'
 
 /** Declare consumption of the namespace-owned `postgres` service without resolving its credential. */
@@ -20,14 +21,10 @@ export const defineApp = (config: ZeropsAppConfig): ZeropsAuthoredAppConfig => {
 	return { ...config, [APP_PROVIDER]: 'zerops' }
 }
 
-const property = (value: unknown, key: string): unknown => typeof value === 'object' && value !== null ? Reflect.get(value, key) : undefined
+const zeropsAppConfigSchema = z.object({
+	id: z.string().refine((id) => id.trim() !== ''),
+	target: z.object({ platform: z.literal('zerops'), services: z.function() }),
+})
 
-export const isZeropsAppConfig = (value: unknown): value is ZeropsAuthoredAppConfig => {
-	const id = property(value, 'id')
-	const target = property(value, 'target')
-	return isProviderAuthoredApp(value, 'zerops')
-		&& typeof id === 'string'
-		&& id.trim() !== ''
-		&& property(target, 'platform') === 'zerops'
-		&& typeof property(target, 'services') === 'function'
-}
+export const isZeropsAppConfig = (value: unknown): value is ZeropsAuthoredAppConfig =>
+	isProviderAuthoredApp(value, 'zerops') && zeropsAppConfigSchema.safeParse(value).success

package/src/cli-args.ts

@@ -13,7 +13,6 @@ export interface ZeropsCliArgs {
 	publicAccess: string | undefined
 	postgresType: string | undefined
 	postgresProfile: string | undefined
-	proxyBuildFromGit: string | undefined
 	controlUrl: string | undefined
 	help: boolean
 }
@@ -33,7 +32,6 @@ export const parseZeropsCliArgs = (argv: readonly string[]): ZeropsCliArgs => {
 	let publicAccess: string | undefined
 	let postgresType: string | undefined
 	let postgresProfile: string | undefined
-	let proxyBuildFromGit: string | undefined
 	let controlUrl: string | undefined
 	let help = false
 
@@ -64,8 +62,6 @@ export const parseZeropsCliArgs = (argv: readonly string[]): ZeropsCliArgs => {
 			postgresType = arg.slice('--postgres-type='.length)
 		} else if (arg.startsWith('--postgres-profile=')) {
 			postgresProfile = arg.slice('--postgres-profile='.length)
-		} else if (arg.startsWith('--proxy-build-from-git=')) {
-			proxyBuildFromGit = arg.slice('--proxy-build-from-git='.length)
 		} else if (arg.startsWith('--control-url=')) {
 			controlUrl = arg.slice('--control-url='.length)
 		} else if (arg.startsWith('-')) {
@@ -94,7 +90,6 @@ export const parseZeropsCliArgs = (argv: readonly string[]): ZeropsCliArgs => {
 		publicAccess,
 		postgresType,
 		postgresProfile,
-		proxyBuildFromGit,
 		controlUrl,
 		help,
 	}

package/src/cli.ts

@@ -2,6 +2,7 @@
 import { constants } from 'node:fs'
 import { open } from 'node:fs/promises'
 import { resolve } from 'node:path'
+import { z } from 'zod'
 import { isZeropsAppConfig } from './authoring'
 import { parseZeropsCliArgs } from './cli-args'
 import {
@@ -10,44 +11,26 @@ import {
 	manifestServiceHostnames,
 	ZEROPS_SOURCE_DESCRIPTOR_MAX_BYTES,
 } from './manifest'
-import { runZeropsNamespaceCommand } from './namespace-command'
 import type { ZeropsAppConfig } from './types'
 
 const USAGE = `Zerops app tools
 
 Usage:
   fabrika app build --provider=zerops --env=<env> [--config=<path>] [--output=<path>]
-  fabrika namespace plan --provider=zerops --id=<id> --env=<env> --preset=<cheap|mid|full> [namespace options]
-  fabrika namespace create --provider=zerops --id=<id> --env=<env> --preset=<cheap|mid|full> [namespace options] [--control-url=<url>]
-  fabrika namespace adopt --provider=zerops --id=<id> --env=<env> --preset=<cheap|mid|full> --project-id=<id> [namespace options] [--control-url=<url>]
-  fabrika namespace reconcile --provider=zerops --id=<id> [--control-url=<url>]
 
 Options:
   --env=<env>                    Environment.
   --config=<path>                App config (default: ./fabrika.config.ts).
   --output=<path>                Artifact path (default: ./fabrika.manifest.json).
-  --id=<id>                      Namespace id.
-  --preset=<cheap|mid|full>      Provider-owned namespace preset.
-  --exclusive-app=<id>           App reserved by a full namespace.
-  --project-id=<id>              Existing Zerops project id for adoption.
-  --project-name=<name>          Zerops project name (default: namespace id).
-  --core-package=<tier>          LIGHT or SERIOUS.
-  --public-access=<mode>         custom-domain or zerops-subdomain.
-  --postgres-type=<type>         Cheap-tier PostgreSQL type.
-  --postgres-profile=<profile>   Cheap-tier PostgreSQL profile.
-  --proxy-build-from-git=<url>   Public proxy source; or FABRIKA_ZEROPS_PROXY_BUILD_FROM_GIT.
-  --control-url=<url>            Control origin; or FABRIKA_CONTROL_URL.
   -h, --help                     Show this help.
-
-Mutating namespace commands read the Bearer credential from FABRIKA_CONTROL_TOKEN.
 `
 
-const property = (value: unknown, key: string): unknown => typeof value === 'object' && value !== null ? Reflect.get(value, key) : undefined
+const configModuleSchema = z.object({ default: z.unknown() })
 
 const loadConfig = async (path: string): Promise<ZeropsAppConfig> => {
 	const absolute = resolve(process.cwd(), path)
 	const loaded: unknown = await import(absolute)
-	const config = property(loaded, 'default')
+	const config = configModuleSchema.safeParse(loaded).data?.default
 	if (!isZeropsAppConfig(config)) {
 		throw new Error(`Config at ${absolute} must default-export defineApp({ target: { platform: 'zerops', ... } })`)
 	}
@@ -92,14 +75,6 @@ export const runZeropsCli = async (argv: readonly string[]): Promise<void> => {
 		console.info(USAGE)
 		return
 	}
-	if (args.command === 'namespace') {
-		await runZeropsNamespaceCommand(args, {
-			source: process.env,
-			fetch: globalThis.fetch,
-			write: (value) => console.info(value.trimEnd()),
-		})
-		return
-	}
 	if (args.command !== 'build') {
 		throw new Error(`Unknown command: ${args.command}\n${USAGE}`)
 	}

package/src/collaborators.ts

@@ -1,7 +1,7 @@
 import { reconcileSchema } from '@fabrika/auth'
 import type { SchemaReconciler } from '@fabrika/provider-contract'
 import { createZeropsApi, type ZeropsApi } from './api'
-import type { ZeropsSourceClient } from './source'
+import type { ZeropsSourcePort } from './source/port'
 import type { ZeropsRuntimeTarget } from './types'
 
 export type Sleeper = (ms: number, signal: AbortSignal) => Promise<void>
@@ -26,9 +26,7 @@ export const defaultSleep: Sleeper = (ms, signal) =>
 export interface ZeropsCollaborators {
 	api: ZeropsApi
 	/** Injected by the Zerops control composition; dry runs do not require it. */
-	source?: ZeropsSourceClient
-	/** Independently bounds best-effort source cancellation without delaying Zerops cleanup. */
-	sourceCancelSleep?: Sleeper
+	source?: ZeropsSourcePort
 	reconcileSchema: SchemaReconciler
 	sleep: Sleeper
 }

package/src/compile.ts

@@ -18,6 +18,7 @@
 // credentials leak to app B. "Never write to project-level env" alone does not prevent that; the isolation
 // setting is the other half.
 
+import type { JsonValue } from '@fabrika/provider-contract'
 import type { ZeropsImportProject, ZeropsImportService } from './schema.generated'
 import type { ZeropsProjectSpec, ZeropsResourceContext, ZeropsServiceSpec, ZeropsSourceTarget } from './types'
 
@@ -37,6 +38,16 @@ export interface ZeropsImportDocument {
 	services: ZeropsImportService[]
 }
 
+/**
+ * The same document once it has been through JSON — a manifest's stored `importDocument`, or one whose
+ * values were substituted. Structurally identical, leaves typed as JSON, so `assertZeropsInvariants`
+ * checks it too rather than trusting whoever produced it.
+ */
+export interface ZeropsJsonImportDocument {
+	readonly project?: { readonly [key: string]: JsonValue }
+	readonly services: ReadonlyArray<{ readonly [key: string]: JsonValue }>
+}
+
 /** What the compiler needs beyond the app's declaration. */
 export interface CompileInput {
 	target: ZeropsSourceTarget
@@ -185,14 +196,14 @@ const compileProject = (spec: ZeropsProjectSpec): ZeropsImportProject => {
  *
  * Deliberately checks the emitted document rather than the input: it is the document that reaches Zerops.
  */
-export const assertZeropsInvariants = (document: ZeropsImportDocument): void => {
+export const assertZeropsInvariants = (document: ZeropsImportDocument | ZeropsJsonImportDocument): void => {
 	const project = document.project
 	if (project !== undefined) {
-		if (project.envVariables !== undefined) {
+		if (project['envVariables'] !== undefined) {
 			throw new Error('zerops: refusing to write PROJECT-level env variables — they reach every service in the project (ADR-0004)')
 		}
-		if (project.envIsolation !== ENV_ISOLATION) {
-			throw new Error(`zerops: project envIsolation must be \`${ENV_ISOLATION}\`, got \`${String(project.envIsolation)}\` (ADR-0004)`)
+		if (project['envIsolation'] !== ENV_ISOLATION) {
+			throw new Error(`zerops: project envIsolation must be \`${ENV_ISOLATION}\`, got \`${String(project['envIsolation'])}\` (ADR-0004)`)
 		}
 	}
 	if (document.services.length === 0) {
@@ -200,23 +211,24 @@ export const assertZeropsInvariants = (document: ZeropsImportDocument): void =>
 	}
 	const seen = new Set<string>()
 	for (const service of document.services) {
-		if (service.envIsolation !== ENV_ISOLATION) {
+		const hostname = String(service['hostname'])
+		if (service['envIsolation'] !== ENV_ISOLATION) {
 			throw new Error(
-				`zerops: service \`${service.hostname}\` envIsolation must be \`${ENV_ISOLATION}\`, got \`${String(service.envIsolation)}\` (ADR-0004)`,
+				`zerops: service \`${hostname}\` envIsolation must be \`${ENV_ISOLATION}\`, got \`${String(service['envIsolation'])}\` (ADR-0004)`,
 			)
 		}
 		// Every service class, managed included. A document missing it anywhere cannot be re-applied at
 		// all: the platform answers `400 serviceStackNameUnavailable` on the first hostname that exists
 		// and rejects the whole import, so one omission breaks every later apply, not just that service.
-		if (service.override !== OVERRIDE) {
+		if (service['override'] !== OVERRIDE) {
 			throw new Error(
-				`zerops: service \`${service.hostname}\` must carry \`override: true\`; without it a re-apply is rejected as a name collision`,
+				`zerops: service \`${hostname}\` must carry \`override: true\`; without it a re-apply is rejected as a name collision`,
 			)
 		}
-		if (service.envSecrets !== undefined || service.dotEnvSecrets !== undefined) {
+		if (service['envSecrets'] !== undefined || service['dotEnvSecrets'] !== undefined) {
 			// Never assert on the VALUE — only that the field is present.
 			throw new Error(
-				`zerops: service \`${service.hostname}\` carries secrets in the import document; secrets are written through the env API (ADR-0004)`,
+				`zerops: service \`${hostname}\` carries secrets in the import document; secrets are written through the env API (ADR-0004)`,
 			)
 		}
 		// `zeropsSetup` is part of the import's pipeline configuration, and the platform rejects the WHOLE
@@ -230,15 +242,15 @@ export const assertZeropsInvariants = (document: ZeropsImportDocument): void =>
 		// Nothing is lost by dropping the setup name here: it is only redundant restatement of Zerops' own
 		// "setup name defaults to the hostname" rule, and a deploy that needs to say otherwise passes
 		// `zeropsSetup` at TRIGGER time, where no repository is required.
-		if (service.zeropsSetup !== undefined && service.buildFromGit === undefined) {
+		if (service['zeropsSetup'] !== undefined && service['buildFromGit'] === undefined) {
 			throw new Error(
-				`zerops: service \`${service.hostname}\` names \`zeropsSetup\` without \`buildFromGit\`; the platform rejects the import (pass the setup when triggering the pipeline instead)`,
+				`zerops: service \`${hostname}\` names \`zeropsSetup\` without \`buildFromGit\`; the platform rejects the import (pass the setup when triggering the pipeline instead)`,
 			)
 		}
-		if (seen.has(service.hostname)) {
-			throw new Error(`zerops: duplicate service hostname \`${service.hostname}\` in the import document`)
+		if (seen.has(hostname)) {
+			throw new Error(`zerops: duplicate service hostname \`${hostname}\` in the import document`)
 		}
-		seen.add(service.hostname)
+		seen.add(hostname)
 	}
 }
 
@@ -257,13 +269,57 @@ export const compileImport = (input: CompileInput): ZeropsImportDocument => {
 /** Keys/scalars that are safe unquoted in YAML. Everything else gets a double-quoted, JSON-escaped form. */
 const PLAIN = /^[A-Za-z_][A-Za-z0-9_./@+-]*$/
 
+/**
+ * Code points a YAML 1.1 reader (go-yaml, which parses this on Zerops) ends a line on or refuses outright,
+ * while Bun's 1.2 reader takes them for ordinary text — so no test using Bun can see the difference. `\n`
+ * and `\r` are excluded: the block form owns one and `blockScalarSafe` refuses the other.
+ */
+const isYamlHostileCodePoint = (code: number): boolean =>
+	(code < 0x20 && code !== 0x09 && code !== 0x0a && code !== 0x0d)
+	|| (code >= 0x7f && code <= 0x9f)
+	|| code === 0x2028
+	|| code === 0x2029
+	|| code === 0xfeff
+	|| code === 0xfffe
+	|| code === 0xffff
+	|| (code >= 0xd800 && code <= 0xdfff)
+
+/** `JSON.stringify` leaves DEL, the C1 block, U+2028/9 and U+FEFF raw; YAML's own `\uXXXX` carries them. */
+const escapeYamlHostile = (quoted: string): string =>
+	[...quoted].map((character) => {
+		const code = character.codePointAt(0) ?? 0
+		return isYamlHostileCodePoint(code) ? `\\u${code.toString(16).padStart(4, '0')}` : character
+	}).join('')
+
 const scalar = (value: string): string => {
 	// Reserved plain scalars that YAML would read as booleans/null, plus anything with structure.
-	const reserved = new Set(['true', 'false', 'null', 'yes', 'no', 'on', 'off', '~'])
+	const reserved = new Set(['true', 'false', 'null', 'yes', 'no', 'y', 'n', 'on', 'off', '~'])
 	if (value !== '' && PLAIN.test(value) && !reserved.has(value.toLowerCase())) {
 		return value
 	}
-	return JSON.stringify(value)
+	return escapeYamlHostile(JSON.stringify(value))
+}
+
+/**
+ * A `|-` block reproduces the string only when the text owns its own lines. An indented or blank first
+ * line moves (or breaks) the block's own indentation, `\r` and a blank line do not survive it, and `-`
+ * eats a trailing newline. A code point a YAML 1.1 reader breaks a line on cannot go in at all — the block
+ * is the one form with no escapes. Everything else goes out double-quoted, which is exact YAML.
+ */
+const blockScalarSafe = (value: string): boolean => {
+	if (!value.includes('\n') || value.includes('\r')) {
+		return false
+	}
+	if ([...value].some((character) => isYamlHostileCodePoint(character.codePointAt(0) ?? 0))) {
+		return false
+	}
+	const lines = value.split('\n')
+	const first = lines[0] ?? ''
+	if (first === '' || first.startsWith(' ') || first.startsWith('\t')) {
+		return false
+	}
+	// A blank line loses its whitespace, and an empty last line is the trailing newline `-` strips.
+	return !lines.some((line, index) => line.trim() === '' && (line !== '' || index === lines.length - 1))
 }
 
 const isArray = (value: unknown): value is unknown[] => Array.isArray(value)
@@ -316,9 +372,8 @@ const emit = (value: unknown, indent: number): string[] => {
 		return lines
 	}
 	if (typeof value === 'string') {
-		if (value.includes('\n')) {
-			const body = value.replace(/\n$/, '').split('\n').map((line) => `${pad}  ${line}`)
-			return [`${pad}|-`, ...body]
+		if (blockScalarSafe(value)) {
+			return [`${pad}|-`, ...value.split('\n').map((line) => `${pad}  ${line}`)]
 		}
 		return [`${pad}${scalar(value)}`]
 	}