@fabrika/provider-zerops 0.0.9 → 0.0.12

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.0.9",
+	"version": "0.0.12",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -32,9 +32,9 @@
 		"gen:schema": "bun scripts/generate-zerops-types.ts"
 	},
 	"dependencies": {
-		"@fabrika/auth": "^0.0.9",
-		"@fabrika/auth-core": "^0.0.9",
-		"@fabrika/provider-contract": "^0.0.9",
-		"@fabrika/proxy-contract": "^0.0.9"
+		"@fabrika/auth": "^0.0.12",
+		"@fabrika/auth-core": "^0.0.12",
+		"@fabrika/provider-contract": "^0.0.12",
+		"@fabrika/proxy-contract": "^0.0.12"
 	}
 }

package/src/api.ts

@@ -32,6 +32,15 @@ export type ZeropsAppVersionStatus =
 	| 'BACKUP'
 	| 'CANCELLED'
 
+/**
+ * `sensitive` on every user-data WRITE, create and update alike. Required by the platform — omitting it answers
+ * `400 invalidUserInput` with `{"sensitive":["field is required"]}` (measured live, 2026-08-18) — and
+ * `true` because most of what fabrika writes is a credential. It costs nothing to read: a sensitive
+ * variable's `content` still comes back verbatim from `GET /service-stack/{id}/env`, also measured, so the
+ * compare-before-write both `platform deploy` and the create-only credential slots depend on still works.
+ */
+const SENSITIVE_USER_DATA = true
+
 /** The one status that means "this version is live". */
 export const ZEROPS_ACTIVE: ZeropsAppVersionStatus = 'ACTIVE'
 
@@ -497,9 +506,14 @@ export interface ZeropsApi {
 	 * `compile.ts` writes `envIsolation` instead of inheriting it: a security-relevant field that never
 	 * reaches the wire is a field nobody can review.
 	 *
-	 * NOT EXPOSED, deliberately: `canCreateProjects` — a token that creates projects receives `OWNER` on
-	 * what it creates, which is exactly the scope this call exists to avoid — and `canViewFinances` /
-	 * `canEditFinances`. All three default to `false`, and fabrika has no use for any of them.
+	 * `canCreateProjects` IS EXPOSED, because a control plane that provisions app namespaces cannot work
+	 * without it: every namespace preset creates a project, and `POST /client/{id}/project/import` answers
+	 * `403 insufficientPermissions` to a token without the flag (measured live, 2026-08-18; ADR-0034).
+	 * The cost is real and bounded — the token receives `OWNER` on what it creates, and nothing else:
+	 * `roleCode` stays `NO_ACCESS`, so a project it never created and was never granted stays unreachable.
+	 *
+	 * NOT EXPOSED, deliberately: `canViewFinances` / `canEditFinances`. Both default to `false`, and
+	 * fabrika has no use for either.
 	 *
 	 * UNVERIFIED BEHAVIOUR: EVERYTHING AT RUNTIME. No token has ever been minted against a real account —
 	 * doing so is a mutation, not an inspection — so the shapes below are the published document's and the
@@ -517,6 +531,8 @@ export interface ZeropsApi {
 		projects: readonly { projectId: string; roleCode: ZeropsRoleCode }[]
 		/** The client-wide role. Defaults to `NO_ACCESS`, which is the entire point of a scoped token. */
 		roleCode?: ZeropsRoleCode
+		/** Let the token create projects, which it then OWNS. Required to provision app namespaces (ADR-0034). */
+		canCreateProjects?: boolean
 		signal: AbortSignal
 	}): Promise<ZeropsIntegrationToken>
 
@@ -1087,7 +1103,7 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 		createServiceEnv: async ({ serviceId, key, value, signal }) => {
 			try {
 				await request('create-only service env', 'POST', `/service-stack/${serviceId}/user-data`, {
-					body: { key, content: value },
+					body: { key, content: value, sensitive: SENSITIVE_USER_DATA },
 					signal,
 					omitErrorResponseDetails: true,
 				})
@@ -1101,7 +1117,7 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 			// `redactDetail` on both writes: this is the one place a secret VALUE is in the request body.
 			try {
 				await request('create service env', 'POST', `/service-stack/${serviceId}/user-data`, {
-					body: { key, content: value },
+					body: { key, content: value, sensitive: SENSITIVE_USER_DATA },
 					signal,
 					redactDetail: true,
 				})
@@ -1121,7 +1137,11 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 					`zerops: service ${serviceId} already defines \`${key}\` outside the environment API — it cannot be written`,
 				)
 			}
-			await request('update service env', 'PUT', `/user-data/${existing.id}`, { body: { key, content: value }, signal, redactDetail: true })
+			await request('update service env', 'PUT', `/user-data/${existing.id}`, {
+				body: { key, content: value, sensitive: SENSITIVE_USER_DATA },
+				signal,
+				redactDetail: true,
+			})
 		},
 
 		deleteServiceEnv: async ({ envId, signal }) => {
@@ -1131,7 +1151,7 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 		getProjectEnv: async ({ projectEnvId, signal }) =>
 			readServiceEnv(await request('get project env', 'GET', `/project-env/${projectEnvId}`, { signal })),
 
-		createIntegrationToken: async ({ clientId, name, projects, roleCode, signal }) =>
+		createIntegrationToken: async ({ clientId, name, projects, roleCode, canCreateProjects, signal }) =>
 			// `redactDetail`: unlike every other write here the SECRET is in the RESPONSE, not the request, so
 			// this is the one error envelope that could quote a minted token back at us.
 			readIntegrationToken(
@@ -1139,6 +1159,9 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 					body: {
 						name,
 						roleCode: roleCode ?? 'NO_ACCESS',
+						// Always sent, like `roleCode`: a security-relevant field that never reaches the wire is a
+						// field nobody can review.
+						canCreateProjects: canCreateProjects ?? false,
 						projects: projects.map((grant) => ({ projectId: grant.projectId, roleCode: grant.roleCode })),
 					},
 					signal,

package/src/control.ts

@@ -92,6 +92,8 @@ export interface ZeropsBeforeDeployInput {
 	readonly target: ZeropsStoredTarget & {
 		readonly projectId: string
 		readonly proxyServiceId: string
+		/** The namespace proxy has no Git integration, so its pipeline must be told what to build. */
+		readonly proxyBuildFromGit: string
 	}
 	readonly artifact: FabrikaManifest
 	readonly api: ZeropsApi
@@ -175,7 +177,7 @@ const decodeNamespace = (
 const resolvedEnvironment = (
 	environment: ProviderEnvironment,
 	options: { requireReady: boolean },
-): DecodedZeropsEnvironment & { projectId: string; proxyServiceId?: string } => {
+): DecodedZeropsEnvironment & { projectId: string; proxyServiceId?: string; proxyBuildFromGit?: string } => {
 	const decoded = decodeEnvironment(environment)
 	const projectId = decoded.namespaceTarget.projectId
 	if (projectId === undefined) {
@@ -188,10 +190,15 @@ const resolvedEnvironment = (
 	if (options.requireReady && proxyServiceId === undefined) {
 		throw new Error(`Zerops deployment namespace \`${decoded.namespace.id}\` has no proxy service id`)
 	}
+	const proxyBuildFromGit = decoded.namespaceTarget.proxyBuildFromGit
+	if (options.requireReady && proxyBuildFromGit === undefined) {
+		throw new Error(`Zerops deployment namespace \`${decoded.namespace.id}\` has no proxy build source`)
+	}
 	return {
 		...decoded,
 		projectId,
 		...(proxyServiceId === undefined ? {} : { proxyServiceId }),
+		...(proxyBuildFromGit === undefined ? {} : { proxyBuildFromGit }),
 	}
 }
 
@@ -443,6 +450,10 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 			if (proxyServiceId === undefined) {
 				throw new Error(`Zerops deployment namespace \`${placement.namespace.id}\` has no proxy service id`)
 			}
+			const proxyBuildFromGit = placement.proxyBuildFromGit
+			if (proxyBuildFromGit === undefined) {
+				throw new Error(`Zerops deployment namespace \`${placement.namespace.id}\` has no proxy build source`)
+			}
 			const artifact = decodeEnvelope('artifact', registration.environment.artifact, zeropsArtifactCodec)
 			await verifyZeropsArtifactSourceDescriptor(artifact.target.sourceDescriptor)
 			let source: ZeropsRuntimeTarget['source']
@@ -468,6 +479,7 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 						serviceId: placement.target.serviceId,
 						projectId: placement.projectId,
 						proxyServiceId,
+						proxyBuildFromGit,
 					},
 					artifact,
 					api,

package/src/provider.ts

@@ -11,6 +11,7 @@
 
 import { createProvider, type ProviderDeploySession, type ProviderModule, type TypedProviderRun } from '@fabrika/provider-contract'
 import {
+	waitForProcess,
 	ZEROPS_ACTIVE,
 	ZEROPS_PROCESS_FINISHED,
 	ZEROPS_PROCESS_TERMINAL,
@@ -273,6 +274,17 @@ const runStep = async (spec: ZeropsJobSpec, env: StepEnv): Promise<void> => {
 			// `override: true` on every service (written by the compiler) is what makes re-applying safe.
 			const result = await zerops.api.importServices({ projectId: target.projectId, yaml: compiled.yaml, signal })
 			log(`  imported: ${result.services.map((service) => `${service.name} (${service.id})`).join(', ') || '(none reported)'}`)
+			// An import ANSWERS before its services exist. Triggering a pipeline on a service Zerops is
+			// still creating answers 400 `projectImportInvalidParameter`, which is what the first deploy
+			// into a fresh namespace hit; a re-apply onto services that already exist reports none.
+			const pending = result.services.flatMap((service) => service.processes.map((process) => ({ service: service.name, id: process.id })))
+			for (const process of pending) {
+				assertRunning(signal)
+				await waitForProcess({ api: zerops.api, processId: process.id, sleep: zerops.sleep, signal, label: `the ${process.service} import` })
+			}
+			if (pending.length > 0) {
+				log(`  awaited ${pending.length} import process(es)`)
+			}
 			return
 		}