@fabrika/provider-zerops 0.2.0 → 0.3.2

package/src/installation/templates/README.md

@@ -0,0 +1,116 @@
+# {{REPO}} — the {{INSTALLATION}} fabrika installation (Zerops)
+
+The **per-installation root of trust** for the `{{INSTALLATION}}` fabrika installation on Zerops. Its
+GitHub pipeline deploys the platform so that the platform never deploys itself: the credentials for
+this Zerops account live here, in a GitHub Environment, and not in the public
+[contember/fabrika-platform](https://github.com/contember/fabrika-platform) repository that many
+operators install from.
+
+## This pipeline UPDATES an installation. It does not create one.
+
+Running it against a project that has no `iam`, `operations`, `proxy` and `control` service fails and
+changes nothing. The first bring-up is `fabrika platform install --provider=zerops --source-dir=.`, run once from the
+operator's machine: it imports the Zerops topology without code, generates and writes every secret each
+service holds, and deploys, so the proxy has HTTP ports and therefore a public address.
+`fabrika platform admin --provider=zerops` then admits the first administrator. The whole procedure is
+in [installing-on-zerops.md](https://github.com/contember/fabrika-platform/blob/main/docs/reference/installing-on-zerops.md).
+
+From then on, this pipeline owns the installation.
+
+## One step, and why
+
+The whole ordered sequence lives inside `fabrika platform deploy --provider=zerops`:
+
+```
+resolve the project and its services
+  → write every service's environment (the composed proxy manifest, the environment name, the origins)
+  → deploy iam + operations together, then proxy → control, waiting for each
+  → ensure the public entry point
+  → reconcile the console's app schema with IAM
+```
+
+That order is a security property, not just a dependency: a fabrika application enforces nothing by
+itself, so the enforcement proxy is deployed **before** the control plane whose gates just changed. It
+therefore lives in code with a test, rather than in a workflow file that can be edited. The Cloudflare
+sidecar repository keeps its order in the workflow instead; the two providers differ deliberately.
+
+The run is unattended and idempotent. A re-run redeploys; it writes only the variables that differ,
+enables no subdomain that is already published, and reconciles the same schema. A run that cannot
+apply the proxy manifest never reaches the deploy, so new code never ends up behind an older, more
+permissive manifest.
+
+## What `fabrika.ref` pins
+
+[`fabrika.ref`](./fabrika.ref) pins a **published tag** of `contember/fabrika-platform` — never a
+branch. The workflow refuses anything that does not look like a tag.
+
+That tag decides everything this pipeline DOES: the deploy order, the proxy manifest it composes (the
+gate rules that enforce the whole installation), the console schema it reconciles, and every variable
+it writes.
+
+The workflow runs with `--source-dir=.` from the selected checkout and uploads one exact committed
+archive for every installation build. The summary reports the resolved commit. Install and deploy
+require a clean full checkout containing the executing CLI, generated manifest and console schema.
+They reject `--from-git` and `FABRIKA_ZEROPS_BUILD_FROM_GIT`; remove those settings before upgrading.
+
+Install and deploy write `FABRIKA_ZEROPS_PROXY_SOURCE_JSON` on Control as the default for new
+namespace planning: the public `contember/fabrika-platform` repository, this snapshot's exact commit,
+and its verified descriptor. Existing namespace pins are retained when that default changes.
+Namespace source resolution verifies public commit availability before its effects. Preparing a local snapshot does not publish its commit to GitHub.
+
+## The `{{INSTALLATION}}` GitHub Environment
+
+Written by `fabrika platform init --provider=zerops {{INSTALLATION}}`, not by hand.
+
+Public repositories deploy without a GitHub App. Configure an organization-owned GitHub App in the
+authenticated Control console at **Settings → Source**. Its private key and webhook secret stay in
+Control's encrypted vault; neither is copied into this repository or Environment. Init never reads or
+writes a GitHub App credential or a local credential recovery file.
+If an older init left such a file, adopt a complete remote credential set in Control and delete the
+file only after the UI reports connected. If the remote state is empty or partial and the file is the
+only complete copy, use the last compatible CLI release to finish remote persistence first.
+
+**Secrets** — both belong to the installation and are placed on it at bring-up. `init` copies them
+here; it never generates one, because a value this repository invented would not be the value the
+installation already holds.
+
+| Secret                         | What it is                                                                                                                                             |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `FABRIKA_ZEROPS_ACCESS_TOKEN`  | A Zerops **integration** token scoped to this installation's projects (client role `NO_ACCESS`, per-project `ADMIN`) — never a personal access token.  |
+| `FABRIKA_IAM_PROVISIONING_KEY` | The `px_` admin key the installation's IAM already holds as `FABRIKA_IAM_PROVISIONING_KEY`. The deploy authenticates the console's schema PUT with it. |
+
+**Variables** — the rest of the configuration, all non-secret.
+
+| Variable                           | Required | What it is                                                                                         |
+| ---------------------------------- | -------- | -------------------------------------------------------------------------------------------------- |
+| `FABRIKA_ZEROPS_PROJECT_ID`        | yes      | The Zerops project holding the four platform runtime services.                                     |
+| `FABRIKA_PLATFORM_ENVIRONMENT`     | yes      | The name this installation calls itself; written to every service as `ENVIRONMENT`. Never `local`. |
+| `FABRIKA_PLATFORM_SCHEME`          | yes      | `https` for anything reachable from a browser.                                                     |
+| `FABRIKA_PLATFORM_IAM_HOST`        | no       | Where IAM answers publicly.                                                                        |
+| `FABRIKA_PLATFORM_CONSOLE_HOST`    | no       | Where the console answers publicly.                                                                |
+| `FABRIKA_PLATFORM_OPERATIONS_HOST` | no       | Where Operations ingest answers publicly.                                                          |
+| `FABRIKA_ZEROPS_API_URL`           | no       | Region API base, when this installation is not on the default one.                                 |
+
+The three host variables go together: **all three, or none.** Naming none derives them from the
+proxy's generated Zerops subdomains, and the deploy publishes that subdomain. Naming all three makes
+this a custom-domain installation — the domains are bound to the project balancer out of band, and the
+deploy publishes no subdomain, because that would add a second public address nobody asked for.
+
+There is deliberately **no bootstrap-admin variable here.** This pipeline writes no credential and no
+admission list — it configures where the installation answers and deploys it. Who may administer the
+installation is IAM's to say, and it is said through IAM's own admin surface. Nothing about this
+repository has to be closed off later.
+
+## Roll forward, or redeploy
+
+- Run `fabrika platform upgrade --provider=zerops --to=<tag> {{INSTALLATION}}`, or bump
+  [`fabrika.ref`](./fabrika.ref) to a newer published tag and push. That is the version bump.
+- Or run _Actions → platform → Run workflow_ for a redeploy at the same tag.
+- Tick **dry_run** on that manual run to read the installation and report what would change without
+  writing or deploying anything. It is the safe first run after editing the Environment.
+
+Only a change to `fabrika.ref` or to the workflow triggers a push-driven run; editing this README does
+not deploy.
+
+`fabrika.ref` is operator-owned: `fabrika platform init` writes it once and never overwrites a later
+version pin.

package/src/installation/templates/fabrika.ref

@@ -0,0 +1 @@
+{{FABRIKA_REF}}

package/src/installation/templates/gitignore

@@ -0,0 +1,3 @@
+# `fabrika platform init --provider=zerops` writes no credential to disk. Nothing generated here needs
+# to be ignored — this entry exists so a stray local .env can never be committed by accident.
+.env

package/src/installation/templates/platform.yml

@@ -0,0 +1,144 @@
+name: platform
+
+# Deploys the {{INSTALLATION}} fabrika installation on Zerops. THIS repository is the per-installation
+# root of trust: it holds the account's credentials, so the platform never deploys itself (ADR-0025).
+#
+# IT UPDATES AN INSTALLATION THAT ALREADY EXISTS — it never creates one. `fabrika platform install`
+# owns the first bring-up: import the topology without code, write every secret, then deploy.
+#
+# ONE step, deliberately. On Zerops `fabrika platform deploy` owns the whole ordered sequence: resolve
+# the project and its services, write every service's environment (including the composed proxy
+# manifest), deploy iam + operations together and then proxy -> control waiting for each,
+# ensure the public entry point, and reconcile the console's app schema. That sequence carries a security
+# property — since ADR-0022 the application enforces nothing, so the enforcement point is deployed BEFORE
+# the service whose gates just widened — and it therefore lives in code with a test rather than in this
+# file, which an operator owns and may edit (ADR-0027). The Cloudflare sidecar keeps three steps here;
+# the asymmetry is deliberate.
+#
+# Generated and maintained by `fabrika platform init --provider=zerops {{INSTALLATION}}`. Secrets and
+# variables live in the `{{INSTALLATION}}` GitHub Environment (Settings -> Environments -> {{INSTALLATION}})
+# and are written there by that command — do not hand-edit them.
+#
+# contember/fabrika-platform is public and checked out tokenless at the TAG pinned in `fabrika.ref`.
+# Bump that tag and push to roll this installation forward — `fabrika platform upgrade --provider=zerops
+# --to=<tag> {{INSTALLATION}}` does exactly that and then follows the run this file starts.
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: >-
+          Read the installation and report what would change, writing nothing and deploying nothing.
+          The safe first run after an Environment edit.
+        type: boolean
+        default: false
+  push:
+    branches: [main]
+    # Only a version bump (or a workflow edit) redeploys — not a README tweak.
+    paths: ['fabrika.ref', '.github/workflows/platform.yml']
+
+concurrency:
+  group: platform-deploy
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    # MEASURED (2026-08-21, two warm-cache runs): ~9 min 35 s for five builds one after another, when a
+    # `source` service still existed. With four services and iam + operations built at once the critical
+    # path is shorter still — projected, not yet measured. The command itself polls each build for up to 70
+    # minutes (Zerops caps a pipeline at one hour), so this is the outer guard, not the gate.
+    timeout-minutes: 90
+    # Secrets + variables resolve from this GitHub Environment (created + populated by `fabrika platform init`).
+    environment: {{INSTALLATION}}
+    steps:
+      - name: Checkout this repository (the pinned ref and this workflow)
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Resolve the pinned fabrika tag
+        id: ref
+        # A published TAG, never a branch, selects the installation checkout.
+        run: |
+          ref="$(tr -d '[:space:]' < fabrika.ref)"
+          case "$ref" in
+            v[0-9]*) ;;
+            *)
+              echo "fabrika.ref must pin a published tag such as v0.1.0, not '$ref'." >&2
+              exit 1
+              ;;
+          esac
+          echo "fabrika=$ref" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout contember/fabrika-platform@${{ steps.ref.outputs.fabrika }}
+        env:
+          PINNED_REF: ${{ steps.ref.outputs.fabrika }}
+          GIT_TERMINAL_PROMPT: '0'
+        run: |
+          git clone --no-checkout https://github.com/contember/fabrika-platform.git fabrika-platform
+          git -C fabrika-platform checkout --detach "refs/tags/$PINNED_REF"
+
+      - name: Record the resolved source commit
+        id: source
+        working-directory: fabrika-platform
+        run: echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install fabrika
+        working-directory: fabrika-platform
+        run: bun install --frozen-lockfile
+
+      - name: Put the fabrika workspace bin on PATH
+        working-directory: fabrika-platform
+        # Asserted, not assumed: `bun install` links a workspace package's bin only when the root package
+        # depends on it, so an older pinned tag can install cleanly and still have no `fabrika` at all.
+        # Without this the failure is a bare `command not found` two steps later, which names nothing.
+        run: |
+          if [ ! -x node_modules/.bin/fabrika ]; then
+            echo "fabrika-platform@${{ steps.ref.outputs.fabrika }} installed no \`fabrika\` binary." >&2
+            echo "Pin a tag whose root package.json depends on @fabrika/cli." >&2
+            exit 1
+          fi
+          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
+
+      - name: Deploy the platform
+        id: platform
+        working-directory: fabrika-platform
+        env:
+          # ── Credentials ──────────────────────────────────────────────────────────────────────────────
+          # `platform deploy` reads every credential from the environment and offers no flag for one, so
+          # none of these can reach a CI log line or a process listing. It writes no credential either.
+          FABRIKA_ZEROPS_ACCESS_TOKEN: ${{ secrets.FABRIKA_ZEROPS_ACCESS_TOKEN }}
+          FABRIKA_IAM_PROVISIONING_KEY: ${{ secrets.FABRIKA_IAM_PROVISIONING_KEY }}
+          # ── Which installation ───────────────────────────────────────────────────────────────────────
+          # An empty variable is treated as absent, so an unset optional one below changes nothing.
+          FABRIKA_ZEROPS_PROJECT_ID: ${{ vars.FABRIKA_ZEROPS_PROJECT_ID }}
+          FABRIKA_PLATFORM_ENVIRONMENT: ${{ vars.FABRIKA_PLATFORM_ENVIRONMENT }}
+          FABRIKA_PLATFORM_SCHEME: ${{ vars.FABRIKA_PLATFORM_SCHEME }}
+          # All three, or none. None derives them from the proxy's Zerops subdomains and publishes one;
+          # all three make this a custom-domain installation and publish nothing.
+          FABRIKA_PLATFORM_IAM_HOST: ${{ vars.FABRIKA_PLATFORM_IAM_HOST }}
+          FABRIKA_PLATFORM_CONSOLE_HOST: ${{ vars.FABRIKA_PLATFORM_CONSOLE_HOST }}
+          FABRIKA_PLATFORM_OPERATIONS_HOST: ${{ vars.FABRIKA_PLATFORM_OPERATIONS_HOST }}
+          # Only for an installation outside the default region.
+          FABRIKA_ZEROPS_API_URL: ${{ vars.FABRIKA_ZEROPS_API_URL }}
+        run: fabrika platform deploy --provider=zerops --source-dir=. ${{ inputs.dry_run && '--dry-run' || '' }}
+
+      - name: Summary
+        if: always()
+        run: |
+          {
+            echo "### platform deploy → {{INSTALLATION}} (zerops)"
+            echo ""
+            echo "- fabrika tag: \`${{ steps.ref.outputs.fabrika || '(unresolved)' }}\`"
+            echo "- source commit: \`${{ steps.source.outputs.commit || '(unresolved)' }}\`"
+            echo "- mode: \`${{ inputs.dry_run && 'dry-run' || 'deploy' }}\`"
+            echo "- platform deploy: \`${{ steps.platform.outcome || 'not run' }}\`"
+          } >> "$GITHUB_STEP_SUMMARY"

package/src/installation/topology/artifacts.ts

@@ -0,0 +1,141 @@
+// The generated artifacts, as pure values: every file `render.ts` in `@fabrika/platform-artifacts` writes,
+// computed with no filesystem access at all. That package's tests compare these against what is on disk, so
+// a committed artifact that has drifted from the declarations fails `bun test` rather than surprising an
+// operator who applies it.
+//
+// Generated-but-COMMITTED is the same call the repo already makes for `wrangler.jsonc`: the artifact is
+// what an operator actually feeds to the platform, so it should be reviewable in a diff — but nobody
+// should hand-edit it, because the types are upstream of it.
+
+import { renderYaml, type ZeropsImportDocument } from '../../index'
+import { fabrikaZeropsYaml } from './setups'
+import { type CompiledDocument, compileTopology, fabrikaTopologies } from './topology'
+
+/** One file to write, with a path relative to the repository root. */
+export interface Artifact {
+	/** Repo-relative, POSIX-separated. */
+	path: string
+	content: string
+}
+
+const banner = (lines: string[]): string => `${lines.map((line) => (line === '' ? '#' : `# ${line}`)).join('\n')}\n#\n`
+
+/**
+ * Which endpoint takes THIS document, read off the document rather than off the form it was compiled in.
+ *
+ * A `project:` block is only valid at the endpoint that CREATES a project; the service-stack endpoint
+ * imports into one that already exists. Both forms of a project-bearing topology therefore name the
+ * project-import endpoint — the steady form used to claim the other one, which was wrong in the file's
+ * own first instruction.
+ */
+const applyTo = (document: ZeropsImportDocument): string =>
+	document.project === undefined
+		? 'POST /project/{projectId}/service-stack/import  { yaml }'
+		: 'POST /client/{clientId}/project/import  { yaml }'
+
+/**
+ * ADR-0004's line, told truthfully for each shape.
+ *
+ * A services-only document sets no project-level isolation and cannot: `envIsolation` is settable at
+ * project CREATION only. The per-service value the compiler writes overrides the project's, which is
+ * what makes dropping the block safe — but the project it lands in still has to have been created right,
+ * and nothing in this document can check that.
+ */
+const isolationNote = (document: ZeropsImportDocument): string[] =>
+	document.project === undefined
+		? [
+			'`envIsolation: service` on EVERY service is written by the compiler, not by the declaration, and',
+			"re-checked before serialization; a service-level value overrides the project's (ADR-0004). This",
+			'document sets NO project-level isolation and cannot — the field is settable at project CREATION',
+			'only, so the project this is imported into must already carry `envIsolation: service`.',
+		]
+		: [
+			'`envIsolation: service` at BOTH levels and the absence of any project-level `envVariables` are',
+			'written by the compiler, not by the declaration, and re-checked before serialization (ADR-0004).',
+		]
+
+const IMPORT_HEADER = (source: string, document: ZeropsImportDocument, notes: string[]): string =>
+	banner([
+		'GENERATED FILE — DO NOT EDIT BY HAND.',
+		'',
+		`Source: packages/provider-zerops/src/installation/topology/${source}`,
+		'Regenerate: bun run --filter @fabrika/platform-artifacts gen',
+		'',
+		`Apply with: ${applyTo(document)}`,
+		'',
+		...isolationNote(document),
+		...notes,
+	])
+
+/**
+ * The step applying this file does NOT perform, stated in the file itself.
+ *
+ * `enableSubdomainAccess: true` is accepted by the import and then silently dropped — live-verified, on a
+ * service the document creates as well as on one it overrides. An operator who applies a subdomain
+ * topology and stops there gets a project with no public entry point and no error, which is the one
+ * outcome worth spending header lines on. (The namespace lifecycle makes this call itself; the platform
+ * installation has no such driver, so here it is a hand step.)
+ */
+const publicAccessNote = (publicService: string): string[] => [
+	'',
+	`APPLYING THIS FILE PUBLISHES NOTHING. \`enableSubdomainAccess: true\` on \`${publicService}\` is a`,
+	'declaration of intent that the platform accepts and drops; the service reads back',
+	`\`subdomainAccess: false\`. Once \`${publicService}\` has deployed an HTTP port, publish it with`,
+	'`PUT /service-stack/{id}/enable-subdomain-access` and confirm `subdomainAccess: true` on the service.',
+]
+
+/**
+ * The forms every project topology is emitted in.
+ *
+ *   *.provision.*  every service `startWithoutCode: true`. FIRST bring-up: the services exist, so their
+ *                  secrets can be written through the env API (which is addressed BY SERVICE), and only
+ *                  then does anything build. This is the cost ADR-0004 accepted, paid.
+ *   (plain)        steady state. Re-applying it is how a Zerops deploy is idempotent — every service
+ *                  carries `override: true`, so an existing hostname is tolerated rather than a
+ *                  collision. It does NOT reconcile: a changed field in this document is ignored.
+ *   *.services.*   the same two, with no `project:` block, for a project the OPERATOR created. Emitted
+ *                  only for a topology that declares a `servicesTarget`.
+ */
+const topologyArtifacts = (): Artifact[] =>
+	fabrikaTopologies().flatMap((topology) => {
+		const compiled = compileTopology(topology, 'prod')
+		const subdomain = compiled.steady.document.services.find((service) => service.enableSubdomainAccess === true)
+		const notes = subdomain === undefined ? [] : publicAccessNote(subdomain.hostname)
+		const forms: Array<{ suffix: string; form: CompiledDocument }> = [
+			{ suffix: '.provision', form: compiled.provision },
+			{ suffix: '', form: compiled.steady },
+			...(compiled.servicesProvision === undefined ? [] : [{ suffix: '.services.provision', form: compiled.servicesProvision }]),
+			...(compiled.servicesSteady === undefined ? [] : [{ suffix: '.services', form: compiled.servicesSteady }]),
+		]
+		return forms.map(({ suffix, form }) => ({
+			path: `packages/platform-artifacts/generated/${topology.id}${suffix}.zerops-import.yaml`,
+			content: IMPORT_HEADER('topology.ts', form.document, notes) + form.yaml,
+		}))
+	})
+
+/**
+ * The repository-root `zerops.yaml`. One file, four named setups, selected by `zeropsSetup` (which
+ * defaults to the service hostname) — see `./setups.ts` for why this rather than inline `zeropsYaml`.
+ */
+const zeropsYamlArtifact = (): Artifact => ({
+	path: 'zerops.yaml',
+	content: banner([
+		'GENERATED FILE — DO NOT EDIT BY HAND.',
+		'',
+		'Source: packages/provider-zerops/src/installation/topology/setups.ts  (which is where the per-field commentary lives)',
+		'Regenerate: bun run --filter @fabrika/platform-artifacts gen',
+		'',
+		"Zerops reads `zerops.yaml` from the REPOSITORY ROOT, so fabrika's four deployable services share",
+		'ONE file with four named setups. A service selects its setup by name; the name defaults to the',
+		'service hostname, which is why `iam`, `operations`, `proxy` and `control` below are also hostnames in',
+		'packages/platform-artifacts/generated/*.zerops-import.yaml.',
+		'',
+		'NO SECRETS AND NO PER-INSTALLATION VALUES ARE IN HERE — including no `${x_y}` reference to a',
+		'DATA service, because which data services exist differs between the standard and light tiers.',
+		'Database and object-storage coordinates, public origins, auth/email coordinates, ENVIRONMENT and every',
+		'secret are service-level variables written through the env API (ADR-0004).',
+	]) + renderYaml(fabrikaZeropsYaml),
+})
+
+/** Every artifact this package generates, in a stable order. */
+export const generatedArtifacts = (): Artifact[] => [...topologyArtifacts(), zeropsYamlArtifact()]

package/src/installation/topology/index.ts

@@ -0,0 +1,13 @@
+export { type Artifact, generatedArtifacts } from './artifacts'
+export { assertCorePackageIsExplicit, assertOnlyPublicService, assertZeropsHostnames } from './invariants'
+export { fabrikaZeropsYaml, PROXY_HEALTH_PORT, PROXY_PUBLIC_PORTS } from './setups'
+export {
+	appsTopology,
+	type CompiledDocument,
+	type CompiledTopology,
+	compileTopology,
+	fabrikaTopologies,
+	platformTopology,
+	PROXY_HOSTNAME,
+} from './topology'
+export { assertArtifactMatchesSchema, parseYaml, validateYaml } from './validate'

package/src/installation/topology/installation-schemas.ts

@@ -0,0 +1,225 @@
+import { z } from 'zod'
+
+const strings = z.array(z.string())
+const stringOrList = z.union([z.string(), strings])
+const environment = z.record(z.union([z.string(), z.number(), z.boolean()]))
+// Installation images only; the provider's public catalog remains independent.
+const runtime = z.enum(['alpine/bun@1.3', 'alpine@3.21', 'alpine/go@latest', 'alpine/nodejs@22', 'ubuntu/bun@1.3'])
+// Live probes require strings; generated-value tests enforce the installation's [10s, 1h] policy.
+const duration = z.string()
+const httpGet = z.object({ scheme: z.string().optional(), host: z.string().optional(), port: z.number().int(), path: z.string() }).strict()
+const exec = z.object({ command: z.string() }).strict()
+const readinessCheck = z.object({
+	httpGet: httpGet.optional(),
+	exec: exec.optional(),
+	failureTimeout: duration.optional(),
+	retryPeriod: duration.optional(),
+}).strict()
+const healthCheck = z.object({
+	httpGet: httpGet.optional(),
+	exec: exec.optional(),
+	failureTimeout: duration.optional(),
+	disconnectTimeout: duration.optional(),
+	recoveryTimeout: duration.optional(),
+	execPeriod: duration.optional(),
+}).strict()
+const routing = z.object({
+	root: z.string().optional(),
+	cors: z.string().optional(),
+	redirects: z.array(
+		z.object({
+			from: z.string(),
+			to: z.string(),
+			status: z.number().int().optional(),
+			preservePath: z.boolean().optional(),
+			preserveQuery: z.boolean().optional(),
+		}).strict(),
+	).optional(),
+	headers: z.array(z.object({ for: z.string(), values: z.record(z.string()) }).strict()).optional(),
+}).strict()
+export const setupSchema = z.object({
+	setup: z.string(),
+	extends: stringOrList.optional(),
+	build: z.object({
+		os: z.enum(['alpine', 'ubuntu']).optional(),
+		base: z.union([runtime, z.array(runtime)]).optional(),
+		prepareCommands: strings.optional(),
+		buildCommands: strings.optional(),
+		deploy: stringOrList.optional(),
+		deployFiles: stringOrList,
+		cache: z.union([z.boolean(), stringOrList]).optional(),
+		addToRunPrepare: stringOrList.optional(),
+		envVariables: environment.optional(),
+	}).strict().optional(),
+	deploy: z.object({ readinessCheck: readinessCheck.optional(), temporaryShutdown: z.boolean().optional() }).strict().optional(),
+	run: z.object({
+		initCommands: strings.optional(),
+		prepareCommands: strings.optional(),
+		os: z.enum(['alpine', 'ubuntu']).optional(),
+		base: runtime.optional(),
+		start: z.string().optional(),
+		documentRoot: z.string().optional(),
+		siteConfigPath: z.string().optional(),
+		envReplace: z.object({ target: stringOrList, delimiter: stringOrList }).strict().optional(),
+		healthCheck: healthCheck.optional(),
+		routing: routing.optional(),
+		ports: z.array(z.object({ protocol: z.enum(['tcp', 'udp']).optional(), port: z.number().int(), httpSupport: z.boolean().optional() }).strict())
+			.optional(),
+		envVariables: environment.optional(),
+		startCommands: z.array(
+			z.object({ name: z.string().optional(), command: z.string(), workingDir: z.string().optional(), initCommands: strings.optional() }).strict(),
+		).optional(),
+		crontab: z.array(z.object({ timing: z.string(), command: z.string(), workingDir: z.string().optional(), allContainers: z.boolean() }).strict())
+			.optional(),
+	}).strict().optional(),
+}).strict()
+export const zeropsYamlSchema = z.object({ zerops: z.array(setupSchema) }).strict()
+
+const autoscaling = z.object({
+	cpu: z.number().int().min(1).max(8).optional(),
+	minCpu: z.number().int().min(1).max(8).optional(),
+	maxCpu: z.number().int().min(1).max(8).optional(),
+	ram: z.number().min(0.125).max(48).optional(),
+	minRam: z.number().min(0.125).max(48).optional(),
+	maxRam: z.number().min(0.125).max(48).optional(),
+	disk: z.number().min(1).max(250).optional(),
+	minDisk: z.number().min(1).max(250).optional(),
+	maxDisk: z.number().min(1).max(250).optional(),
+	cpuMode: z.enum(['DEDICATED', 'SHARED']).optional(),
+	startCpuCoreCount: z.number().int().optional(),
+	swapEnabled: z.boolean().optional(),
+	minFreeCpuCores: z.number().optional(),
+	minFreeCpuPercent: z.number().optional(),
+	minFreeRamGB: z.number().optional(),
+	minFreeRamPercent: z.number().optional(),
+	minVCpu: z.number().int().optional(),
+	maxVCpu: z.number().int().optional(),
+}).strict()
+const postgresOverrides = z.object({
+	autovacuum_analyze_scale_factor: z.number().optional(),
+	autovacuum_max_workers: z.number().int().optional(),
+	autovacuum_naptime: z.number().int().optional(),
+	autovacuum_vacuum_cost_delay: z.number().int().optional(),
+	autovacuum_vacuum_cost_limit: z.number().int().optional(),
+	autovacuum_vacuum_scale_factor: z.number().optional(),
+	autovacuum_work_mem: z.number().int().optional(),
+	commit_delay: z.number().int().optional(),
+	commit_siblings: z.number().int().optional(),
+	default_statistics_target: z.number().int().optional(),
+	effective_cache_size: z.number().int().optional(),
+	effective_io_concurrency: z.number().int().optional(),
+	hash_mem_multiplier: z.number().int().optional(),
+	idle_in_transaction_session_timeout: z.number().int().optional(),
+	jit_above_cost: z.number().optional(),
+	maintenance_io_concurrency: z.number().int().optional(),
+	maintenance_work_mem: z.number().int().optional(),
+	max_parallel_maintenance_workers: z.number().int().optional(),
+	max_parallel_workers: z.number().int().optional(),
+	max_parallel_workers_per_gather: z.number().int().optional(),
+	max_wal_size: z.number().int().optional(),
+	max_worker_processes: z.number().int().optional(),
+	min_wal_size: z.number().int().optional(),
+	random_page_cost: z.number().optional(),
+	temp_buffers: z.number().int().optional(),
+	temp_file_limit: z.number().int().optional(),
+	vacuum_cost_delay: z.number().int().optional(),
+	wal_buffers: z.number().int().optional(),
+	wal_compression: z.string().optional(),
+	wal_writer_delay: z.number().int().optional(),
+	wal_writer_flush_after: z.number().int().optional(),
+	work_mem: z.number().int().optional(),
+}).strict()
+const commonService = z.object({
+	hostname: z.string(),
+	mode: z.string().optional(),
+	envSecrets: z.record(z.string()).optional(),
+	dotEnvSecrets: z.string().optional(),
+	nginxConfig: z.string().optional(),
+	objectStorageSize: z.number().optional(),
+	objectStoragePolicy: z.enum(['custom', 'private', 'public-read', 'public-objects-read', 'public-write', 'public-read-write']).optional(),
+	objectStorageRawPolicy: z.string().optional(),
+	buildFromGit: z.string().optional(),
+	startWithoutCode: z.boolean().optional(),
+	enableSubdomainAccess: z.boolean().optional(),
+	priority: z.number().int().optional(),
+	mount: strings.optional(),
+	enableCdn: z.boolean().optional(),
+	envIsolation: z.string().optional(),
+	sshIsolation: z.string().optional(),
+	os: z.string().optional(),
+	zeropsSetup: z.string().optional(),
+	override: z.boolean().optional(),
+}).strict()
+const runtimeService = commonService.extend({
+	type: runtime,
+	minContainers: z.number().int().min(1).max(10).optional(),
+	maxContainers: z.number().int().min(1).max(10).optional(),
+	verticalAutoscaling: autoscaling.optional(),
+})
+const postgresService = commonService.extend({
+	type: z.enum([
+		'postgresql:ha@14',
+		'postgresql:ha@16',
+		'postgresql:ha@17',
+		'postgresql:ha@18',
+		'postgresql:single@14',
+		'postgresql:single@16',
+		'postgresql:single@17',
+		'postgresql:single@18',
+	]),
+	profile: z.enum(['oltp-hobby', 'oltp-staging', 'oltp-production', 'oltp-enterprise', 'olap-production', 'writeheavy-production', 'custom'])
+		.optional(),
+	// Upstream leaves overrides unconstrained when no profile is selected.
+	profileOverrides: z.unknown().optional(),
+	verticalAutoscaling: autoscaling.extend({
+		ram: z.number().min(0.25).max(48).optional(),
+		minRam: z.number().min(0.25).max(48).optional(),
+		maxRam: z.number().min(0.25).max(48).optional(),
+	}).optional(),
+}).superRefine((service, ctx) => {
+	if (
+		(service.type.startsWith('postgresql:ha@') && service.profile === 'oltp-hobby')
+		|| (service.type.startsWith('postgresql:single@') && service.profile === 'oltp-enterprise')
+	) {
+		ctx.addIssue({ code: 'custom', path: ['profile'], message: 'profile is not supported by this PostgreSQL availability mode' })
+	}
+	if (service.profile !== undefined && service.profile !== 'custom' && service.profileOverrides !== undefined) {
+		ctx.addIssue({ code: 'custom', path: ['profileOverrides'], message: 'profileOverrides requires the custom PostgreSQL profile' })
+	}
+	if (service.profile === 'custom' && service.profileOverrides !== undefined) {
+		const overrides = postgresOverrides.safeParse(service.profileOverrides)
+		if (!overrides.success) {
+			for (const issue of overrides.error.issues) {
+				ctx.addIssue({ ...issue, path: ['profileOverrides', ...issue.path] })
+			}
+		}
+	}
+})
+const storageService = commonService.extend({
+	type: z.enum(['object-storage', 'objectstorage']),
+	verticalAutoscaling: autoscaling.omit({
+		cpu: true,
+		minCpu: true,
+		maxCpu: true,
+		ram: true,
+		minRam: true,
+		maxRam: true,
+		disk: true,
+		minDisk: true,
+		maxDisk: true,
+	}).optional(),
+})
+export const importSchema = z.object({
+	project: z.object({
+		name: z.string(),
+		description: z.string().optional(),
+		corePackage: z.enum(['LIGHT', 'SERIOUS']).optional(),
+		tags: strings.optional(),
+		envVariables: z.record(z.string()).optional(),
+		envIsolation: z.string().optional(),
+		sshIsolation: z.string().optional(),
+		sharedIpv4: z.boolean().optional(),
+		location: z.enum(['eu-central', 'us-east-1', 'us-west-1']).optional(),
+	}).strict().optional(),
+	services: z.array(z.union([runtimeService, postgresService, storageService])).optional(),
+}).strict()