@fabrika/provider-zerops 0.3.2 → 0.4.0

package/src/manifest.ts

@@ -1,10 +1,21 @@
 import { appSchemaSchema } from '@fabrika/auth'
-import type { AppSchema } from '@fabrika/auth-core'
-import type { JsonValue, ProviderCodec } from '@fabrika/provider-contract'
-import { normalizeGateRule, proxyGateRuleFieldsSchema } from '@fabrika/proxy-core/manifest'
+import { type AppSchema, isDigest } from '@fabrika/auth-core'
+import type { JsonValue, ProviderCodec, ProviderEnvironment } from '@fabrika/provider-contract'
+import { proxyEndpointRowSchema } from '@fabrika/proxy-core/manifest'
 import { z } from 'zod'
 import { compileImport, ENV_ISOLATION, OVERRIDE, renderYaml } from './compile'
 import { assertOwnRunWhenExtending, executionZeropsDocument, parseZeropsDescriptor, selectZeropsDescriptorSetup } from './descriptor'
+import {
+	assertScanMemory,
+	CONTRACT_DIGEST_PATTERN,
+	LOCKED_APP_ID_PATTERN,
+	lockedAuthoredBuild,
+	ZEROPS_RUNTIME_PACKAGES,
+	type ZeropsContractRun,
+	zeropsContractRun,
+	type ZeropsLockedExecution,
+	type ZeropsRuntimePackage,
+} from './execution'
 import { assertAuthoredManagedDocument, assertAuthoredManagedInputs } from './managed-env'
 import { allowedReferenceHosts, foreignReferenceHost } from './service-references'
 import type { ZeropsAppConfig, ZeropsNamespaceResourceRequirement, ZeropsProxySpec, ZeropsSharedPostgresBinding } from './types'
@@ -57,6 +68,9 @@ export interface FabrikaManifest {
 		zeropsSetup?: string
 		proxy?: ZeropsProxySpec
 		namespaceResources?: ZeropsNamespaceResourceRequirement[]
+		/** Present for a contract application, whose run section and server build the platform generates. */
+		contract?: ZeropsContractRun
+		runtimePackages?: ZeropsRuntimePackage[]
 	}
 }
 
@@ -95,11 +109,14 @@ const jsonValue = (value: unknown): JsonValue => {
 }
 
 const nonEmptyStringsSchema = z.array(z.string().min(1))
-// Unlike the proxy wire contract, the manifest refuses a null service credential.
-const manifestGateSchema = proxyGateRuleFieldsSchema
-	.refine((rule) => rule.kind !== 'service' || rule.credential !== null)
-	.transform(normalizeGateRule)
-const manifestProxySchema = z.object({ upstream: z.string().min(1), gates: z.object({ rules: z.array(manifestGateSchema) }) })
+// An application is protected by its contract's endpoint table; a `gates` key is refused, never ignored.
+const manifestProxySchema = z.object({
+	upstream: z.string().min(1),
+	endpoints: z.array(proxyEndpointRowSchema),
+	reservedPrefixes: z.array(z.string()),
+	snapshot: z.string().refine(isDigest),
+	gates: z.undefined(),
+}).transform(({ gates: _gates, ...proxy }) => proxy) satisfies z.ZodType<ZeropsProxySpec, z.ZodTypeDef, unknown>
 const namespaceResourcesSchema = z.array(z.object({
 	resourceKey: z.literal('service:postgres'),
 	hostname: z.literal('postgres'),
@@ -126,6 +143,91 @@ const forbidFields = (fields: readonly string[], message: string) => (record: Re
 		if (Object.hasOwn(record, field)) ctx.addIssue({ code: 'custom', path: [field], message })
 	}
 }
+
+interface RefusedServiceField {
+	readonly field: string
+	readonly accepts: (value: JsonValue) => boolean
+	readonly reason: string
+	readonly allowedForm: string
+}
+
+const refusedOutright = (): boolean => false
+
+/**
+ * Import fields an APPLICATION service may not set, with no approval path (ADR-0043). The installation and
+ * the namespace proxy compile their own documents and never pass through this manifest, so they keep them.
+ */
+const REFUSED_APPLICATION_SERVICE_FIELDS: readonly RefusedServiceField[] = [
+	{
+		field: 'objectStoragePolicy',
+		accepts: (value) => value === 'private',
+		reason: 'a bucket that is not private is read past the namespace proxy',
+		allowedForm: 'omit it or set `private`',
+	},
+	{
+		field: 'objectStorageRawPolicy',
+		accepts: refusedOutright,
+		reason: 'a raw bucket policy cannot be checked to be private',
+		allowedForm: 'omit it',
+	},
+	{
+		field: 'enableSubdomainAccess',
+		accepts: (value) => value === false,
+		reason: 'a `.zerops.app` subdomain reaches the service past the namespace proxy',
+		allowedForm: 'omit it or set `false`',
+	},
+	{
+		field: 'buildFromGit',
+		accepts: refusedOutright,
+		reason: "the platform builds the run's recorded commit, never a repository the import names",
+		allowedForm: 'omit it',
+	},
+	{
+		field: 'zeropsYaml',
+		accepts: refusedOutright,
+		reason: "the build descriptor is the repository's `zerops.yaml`, never an inline copy",
+		allowedForm: 'omit it',
+	},
+	{
+		field: 'mount',
+		accepts: refusedOutright,
+		reason: 'a shared-storage mount reaches a volume outside the application',
+		allowedForm: 'omit it',
+	},
+	{
+		field: 'startWithoutCode',
+		accepts: refusedOutright,
+		reason: 'an import that carries it activates an empty version, replacing the running code before any read-back',
+		allowedForm: 'omit it; the platform provisions a new service without code itself',
+	},
+	{
+		field: 'enableCdn',
+		accepts: (value) => value === false,
+		reason: 'a CDN serves the service past the namespace proxy',
+		allowedForm: 'omit it or set `false`',
+	},
+]
+
+const refuseApplicationExposure = (service: { readonly hostname: string } & Record<string, JsonValue>, ctx: z.RefinementCtx): void => {
+	for (const { field, accepts, reason, allowedForm } of REFUSED_APPLICATION_SERVICE_FIELDS) {
+		const value = service[field]
+		if (value === undefined || accepts(value)) continue
+		ctx.addIssue({
+			code: 'custom',
+			path: [field],
+			message: `invalid fabrika manifest: Zerops service \`${service.hostname}\` sets \`${field}\`; ${reason} (${allowedForm})`,
+		})
+	}
+}
+
+const OBJECT_STORAGE_TYPES: ReadonlySet<string> = new Set(['object-storage', 'objectstorage'])
+
+/** Nothing establishes what Zerops does with an omitted policy, so an application bucket always says `private`. */
+const withExplicitPrivateStorage = <Service extends { readonly type: string } & Record<string, JsonValue>>(service: Service): Service =>
+	OBJECT_STORAGE_TYPES.has(service.type) && service['objectStoragePolicy'] === undefined
+		? { ...service, objectStoragePolicy: 'private' }
+		: service
+
 const importServiceSchema = z.intersection(
 	z.record(manifestJsonSchema),
 	z.object({
@@ -134,7 +236,10 @@ const importServiceSchema = z.intersection(
 		envIsolation: z.literal(ENV_ISOLATION),
 		override: z.literal(OVERRIDE),
 	}),
-).superRefine(forbidFields(['envSecrets', 'dotEnvSecrets'], 'invalid fabrika manifest: Zerops import contains a forbidden environment field'))
+)
+	.superRefine(forbidFields(['envSecrets', 'dotEnvSecrets'], 'invalid fabrika manifest: Zerops import contains a forbidden environment field'))
+	.superRefine(refuseApplicationExposure)
+	.transform(withExplicitPrivateStorage)
 const importProjectSchema = z.intersection(z.record(manifestJsonSchema), z.object({ envIsolation: z.literal(ENV_ISOLATION) }))
 	.superRefine(forbidFields(['envVariables'], 'invalid fabrika manifest: Zerops import contains a forbidden project environment field'))
 
@@ -187,6 +292,21 @@ const importDocumentSchema = z.object({ project: importProjectSchema.optional(),
 /** The import document a manifest carries: every service already holds the ADR-0004 invariants. */
 export type FabrikaManifestImportDocument = z.infer<typeof importDocumentSchema>
 
+/** A literal path of unreserved characters: it is written into the generated probes unquoted by any shell. */
+const READINESS_PATH = /^(?:\/[A-Za-z0-9_~-][A-Za-z0-9._~-]*)+$/
+const JOB_NAME = /^[A-Za-z][A-Za-z0-9_]*$/
+const CRON_SCHEDULE = /^[0-9*/,-]+(?: [0-9*/,-]+){4}$/
+
+const contractRunSchema = z.object({
+	digest: z.string().regex(CONTRACT_DIGEST_PATTERN),
+	readinessPath: z.string().regex(READINESS_PATH),
+	jobs: z.array(z.object({ name: z.string().regex(JOB_NAME), schedule: z.string().regex(CRON_SCHEDULE) }).strict()),
+	files: z.literal(true).optional(),
+	scan: z.literal(true).optional(),
+}).strict()
+
+const runtimePackagesSchema = z.array(z.enum(ZEROPS_RUNTIME_PACKAGES)).refine((packages) => new Set(packages).size === packages.length)
+
 const manifestTargetSchema = z.object({
 	sourceDescriptor: zeropsArtifactSourceDescriptorSchema,
 	platform: z.literal('zerops'),
@@ -195,6 +315,8 @@ const manifestTargetSchema = z.object({
 	zeropsSetup: z.string().min(1).optional(),
 	proxy: manifestProxySchema.optional(),
 	namespaceResources: namespaceResourcesSchema.optional(),
+	contract: contractRunSchema.optional(),
+	runtimePackages: runtimePackagesSchema.optional(),
 })
 
 const importDocumentError = (issue: z.ZodIssue, path: readonly (string | number)[]): string => {
@@ -224,9 +346,15 @@ const targetError = (issue: z.ZodIssue | undefined): string => {
 		case 'zeropsSetup':
 			return 'invalid fabrika manifest zeropsSetup'
 		case 'proxy':
-			return 'invalid fabrika manifest proxy declaration'
+			return rest[0] === 'gates'
+				? 'invalid fabrika manifest proxy: `gates` is gone; an application is protected by its endpoint table (`contractProxyTable(artifact)`)'
+				: 'invalid fabrika manifest proxy declaration'
 		case 'namespaceResources':
 			return 'invalid fabrika manifest namespace resources'
+		case 'contract':
+			return 'invalid fabrika manifest contract run'
+		case 'runtimePackages':
+			return `invalid fabrika manifest runtime packages (allowed: ${ZEROPS_RUNTIME_PACKAGES.join(', ')}, each once)`
 		default:
 			return 'invalid fabrika manifest Zerops target'
 	}
@@ -252,6 +380,79 @@ export const verifyZeropsArtifactSourceDescriptor = async (descriptor: ZeropsArt
 	}
 }
 
+const isDescriptorSetup = (value: JsonValue, setup: string): value is { readonly [key: string]: JsonValue } =>
+	typeof value === 'object' && value !== null && !Array.isArray(value) && value['setup'] === setup
+
+/**
+ * The `${host_…}` reference `FABRIKA_APP_DATABASE_URL` is generated from: the namespace's shared PostgreSQL, or the
+ * application's one PostgreSQL service. Two candidates would make the generated migration pick one.
+ */
+const applicationDatabaseUrl = (
+	services: FabrikaManifestImportDocument['services'],
+	namespaceResources: readonly ZeropsNamespaceResourceRequirement[] | undefined,
+): string | null => {
+	const own = services.filter((service) => service.type.startsWith('postgresql')).map((service) => service.hostname)
+	const shared = namespaceResources?.find((resource) => resource.resourceKey === 'service:postgres')
+	if (own.length + (shared === undefined ? 0 : 1) > 1) {
+		throw new Error('invalid fabrika manifest: a contract application has one PostgreSQL database; it declares more than one')
+	}
+	if (shared !== undefined) return shared.connectionString
+	const host = own[0]
+	return host === undefined ? null : `\${${host}_connectionTlsString}/\${${host}_dbName}?sslmode=require`
+}
+
+/** The hostname the `FABRIKA_APP_STORAGE_*` references name: the application's one object-storage service. */
+const applicationStorageHostname = (services: FabrikaManifestImportDocument['services']): string | null => {
+	const own = services.filter((service) => OBJECT_STORAGE_TYPES.has(service.type)).map((service) => service.hostname)
+	if (own.length > 1) {
+		throw new Error('invalid fabrika manifest: a contract application has one object storage; it declares more than one')
+	}
+	return own[0] ?? null
+}
+
+/** What the platform renders a contract application's execution descriptor from, or null for any other application. */
+export const lockedExecutionOf = (manifest: FabrikaManifest): ZeropsLockedExecution | null => {
+	const { contract } = manifest.target
+	if (contract === undefined) return null
+	return {
+		appId: manifest.app.id,
+		contract,
+		databaseUrl: applicationDatabaseUrl(manifest.target.importDocument.services, manifest.target.namespaceResources),
+		storageHostname: applicationStorageHostname(manifest.target.importDocument.services),
+		runtimePackages: manifest.target.runtimePackages ?? [],
+	}
+}
+
+/** What Control lets a provider publish for one environment (`ProviderEnvironment.access`). */
+export type ZeropsAccess = Pick<ProviderEnvironment, 'access'>
+
+/**
+ * The execution descriptor's lock-down at deploy (ADR-0050): Control's approved contract decides it, not the artifact,
+ * so a configuration cannot drop it. Without an approved contract nothing deploys outside a dry run.
+ */
+export function lockedExecutionFor(manifest: FabrikaManifest, granted: ZeropsAccess, dryRun: boolean): ZeropsLockedExecution | null {
+	const access = granted.access
+	if (access === undefined) {
+		if (dryRun) return null
+		throw new Error('zerops: Control approved no access for this environment')
+	}
+	if (!LOCKED_APP_ID_PATTERN.test(manifest.app.id)) throw new Error('zerops: a contract application id must match [a-z0-9][a-z0-9-]*')
+	const contract = zeropsContractRun(access.contract)
+	assertScanMemory(manifest.target.importDocument.services, manifest.target.deployService, contract)
+	return {
+		appId: manifest.app.id,
+		contract,
+		databaseUrl: applicationDatabaseUrl(manifest.target.importDocument.services, manifest.target.namespaceResources),
+		storageHostname: applicationStorageHostname(manifest.target.importDocument.services),
+		runtimePackages: manifest.target.runtimePackages ?? [],
+	}
+}
+
+/** The IAM schema a deploy, cancel or reconcile applies: the approved contract's. `undefined` reconciles nothing. */
+export function approvedSchemaOf(granted: ZeropsAccess): AppSchema | undefined {
+	return granted.access?.schema
+}
+
 export const manifestServiceHostnames = (manifest: FabrikaManifest): string[] =>
 	manifest.target.importDocument.services.map((service) => service.hostname)
 
@@ -276,9 +477,11 @@ export function parseFabrikaManifest(value: unknown, expected: ManifestExpectati
 
 	const target = manifestTargetSchema.safeParse(envelope.data.target)
 	if (!target.success) {
-		throw new Error(targetError(target.error.issues[0]))
+		// A refused `gates` key is the answer to give, whatever else the stale proxy declaration lacks.
+		const gates = target.error.issues.find((issue) => issue.path[0] === 'proxy' && issue.path[1] === 'gates')
+		throw new Error(targetError(gates ?? target.error.issues[0]))
 	}
-	const { sourceDescriptor, deployService, importDocument, zeropsSetup, proxy, namespaceResources } = target.data
+	const { sourceDescriptor, deployService, importDocument, zeropsSetup, proxy, namespaceResources, contract, runtimePackages } = target.data
 	assertAuthoredManagedDocument(importDocument.services)
 	if (importDocument.project !== undefined) assertAuthoredManagedDocument(importDocument.project)
 	assertAuthoredManagedInputs({ variableNames: vars, secretNames: secrets })
@@ -288,10 +491,17 @@ export function parseFabrikaManifest(value: unknown, expected: ManifestExpectati
 	if (!serviceHostnames.includes(deployService)) {
 		throw new Error('invalid fabrika manifest Zerops deploy service')
 	}
+	const selectedSetup = selectZeropsDescriptorSetup(parsedDescriptor, zeropsSetup)
+	if (contract !== undefined) {
+		// Refused first: a contract application's setup may not extend another, so its executed setup is the selected one alone.
+		const entries = parsedDescriptor.document['zerops']
+		const entry = Array.isArray(entries) ? entries.find((candidate) => isDescriptorSetup(candidate, selectedSetup)) : undefined
+		if (entry !== undefined) lockedAuthoredBuild(entry, selectedSetup)
+	} else {
+		assertOwnRunWhenExtending(parsedDescriptor, selectedSetup)
+	}
 	// Only the selected setup and what it extends reach this app's service, so a sibling setup for another
 	// placement may reference services this app does not own.
-	const selectedSetup = selectZeropsDescriptorSetup(parsedDescriptor, zeropsSetup)
-	assertOwnRunWhenExtending(parsedDescriptor, selectedSetup)
 	const foreignInDescriptor = foreignReferenceInValue(
 		executionZeropsDocument(parsedDescriptor, selectedSetup),
 		allowedReferenceHosts(serviceHostnames),
@@ -299,6 +509,23 @@ export function parseFabrikaManifest(value: unknown, expected: ManifestExpectati
 	if (foreignInDescriptor !== null) {
 		throw new Error(`invalid fabrika manifest: zerops.yaml references service \`${foreignInDescriptor}\`, which this app does not own`)
 	}
+	if (contract === undefined && (proxy !== undefined || schema?.contract === true)) {
+		// An endpoint table without the contract would deploy a contract application with an authored run section.
+		throw new Error('invalid fabrika manifest: a contract application carries its contract (`target.contract`), which locks its setup down')
+	}
+	if (contract !== undefined && proxy?.snapshot !== contract.digest) {
+		throw new Error(
+			'invalid fabrika manifest: a contract application is served behind the endpoint table of the same contract (`proxy: { upstream, ...contractProxyTable(artifact) }`)',
+		)
+	}
+	if (contract !== undefined) {
+		if (!LOCKED_APP_ID_PATTERN.test(id)) throw new Error('invalid fabrika manifest: a contract application id must match [a-z0-9][a-z0-9-]*')
+		applicationDatabaseUrl(importDocument.services, namespaceResources)
+		applicationStorageHostname(importDocument.services)
+		assertScanMemory(importDocument.services, deployService, contract)
+	} else if (runtimePackages !== undefined) {
+		throw new Error('invalid fabrika manifest: runtime packages are generated for a contract application only')
+	}
 	if (proxy !== undefined) {
 		const separator = proxy.upstream.indexOf(':')
 		const upstreamHostname = separator === -1 ? proxy.upstream : proxy.upstream.slice(0, separator)
@@ -326,6 +553,8 @@ export function parseFabrikaManifest(value: unknown, expected: ManifestExpectati
 			...(zeropsSetup !== undefined ? { zeropsSetup } : {}),
 			...(proxy !== undefined ? { proxy } : {}),
 			...(namespaceResources !== undefined ? { namespaceResources } : {}),
+			...(contract !== undefined ? { contract } : {}),
+			...(runtimePackages !== undefined ? { runtimePackages } : {}),
 		},
 	}
 }
@@ -334,6 +563,9 @@ export function compileFabrikaManifest(config: ZeropsAppConfig, env: string, sou
 	if (config.target.services === undefined) {
 		throw new Error('fabrika app build requires a source Zerops config')
 	}
+	if (config.target.contract !== undefined && config.target.contract.app !== config.id) {
+		throw new Error(`fabrika app build: the contract declares app \`${config.target.contract.app}\`, but the config is app \`${config.id}\``)
+	}
 	const declaredVars = config.pipeline?.vars ?? []
 	const prior: Record<string, string | undefined> = {}
 	for (const name of declaredVars) {
@@ -358,6 +590,8 @@ export function compileFabrikaManifest(config: ZeropsAppConfig, env: string, sou
 				zeropsSetup: config.target.zeropsSetup,
 				proxy: config.target.proxy,
 				namespaceResources: config.target.namespaceResources,
+				contract: config.target.contract === undefined ? undefined : zeropsContractRun(config.target.contract),
+				runtimePackages: config.target.runtimePackages,
 			},
 		}
 		// The JSON copy is the artifact's own form: authored objects lose inherited fields and undefined keys once, here.

package/src/namespace/codec.ts

@@ -30,21 +30,21 @@ const proxyDeploymentSchema = z.object({
 	descriptorSha256: sha256Schema,
 }).strict().superRefine(rejectExplicitUndefined)
 
-export const postgresSchema = z.discriminatedUnion('type', [
-	z.object({
-		type: z.literal('postgresql:ha@18'),
-		profile: z.enum(['oltp-staging', 'oltp-production', 'oltp-enterprise', 'olap-production', 'writeheavy-production']).optional(),
-	}),
-	z.object({
-		type: z.literal('postgresql:single@18'),
-		profile: z.enum(['oltp-hobby', 'oltp-staging', 'oltp-production', 'olap-production', 'writeheavy-production']).optional(),
-	}),
-]).transform((value) => {
+const haPostgresSchema = z.object({
+	type: z.literal('postgresql:ha@18'),
+	profile: z.enum(['oltp-staging', 'oltp-production', 'oltp-enterprise', 'olap-production', 'writeheavy-production']).optional(),
+})
+const singlePostgresSchema = z.object({
+	type: z.literal('postgresql:single@18'),
+	profile: z.enum(['oltp-hobby', 'oltp-staging', 'oltp-production', 'olap-production', 'writeheavy-production']).optional(),
+})
+
+export const postgresSchema = z.discriminatedUnion('type', [haPostgresSchema, singlePostgresSchema]).transform((value) => {
 	if (value.profile === undefined) delete value.profile
 	return value
 })
 
-const namespaceTargetSchema = z.object({
+const namespaceTargetShape = z.object({
 	proxyDeployment: proxyDeploymentSchema.optional(),
 	proxySource: namespaceProxySourceSchema,
 	proxyBuild: proxyBuildSchema.optional(),
@@ -61,13 +61,24 @@ const namespaceTargetSchema = z.object({
 	proxyAppVersionId: z.string().min(1).optional(),
 	proxyHosts: z.array(z.object({ host: z.string().min(1), port: z.number().int().positive() })).optional(),
 	ready: z.boolean().optional(),
-}).transform((target) => {
+})
+
+const namespaceTargetSchema = namespaceTargetShape.transform((target) => {
 	for (const key of Object.keys(target)) {
 		if (Reflect.get(target, key) === undefined) Reflect.deleteProperty(target, key)
 	}
 	return target
 })
 
+/**
+ * What an update request's payload may name: any target field, each optional, and no field the target
+ * does not have — at the top level or inside `postgres`. The target schema STRIPS an unknown key, which
+ * would turn a misspelt field into a silent no-op.
+ */
+export const namespaceUpdatePayloadSchema = namespaceTargetShape.partial().extend({
+	postgres: z.discriminatedUnion('type', [haPostgresSchema.strict(), singlePostgresSchema.strict()]).optional(),
+}).strict()
+
 export const zeropsNamespaceTargetCodec: ProviderCodec<ZeropsNamespaceTarget> = {
 	version: 1,
 	encode: (target) => ({

package/src/namespace/errors.ts

@@ -39,7 +39,7 @@ const splitApiMessage = (message: string, code: string): { summary: string; deta
 }
 
 /** Every namespace lifecycle failure leaves this provider as one typed, coded error. */
-export const asNamespaceError = (cause: unknown, mode: 'provision' | 'reconcile'): ProviderNamespaceError => {
+export const asNamespaceError = (cause: unknown, mode: 'provision' | 'reconcile' | 'update'): ProviderNamespaceError => {
 	if (cause instanceof ProviderNamespaceError) return cause
 	if (cause instanceof ZeropsApiError) {
 		const { summary, detail } = splitApiMessage(cause.message, cause.code)

package/src/namespace/manifest.ts

@@ -1,5 +1,7 @@
+import { appEnvironmentId } from '@fabrika/auth-core'
 import { decodeEnvelope, type ProviderNamespaceMember } from '@fabrika/provider-contract'
-import type { ProxyManifest } from '@fabrika/proxy-core/manifest'
+import { isPolicyOrigin } from '@fabrika/proxy-core/headers'
+import { contractProxyTable, type ProxyManifest } from '@fabrika/proxy-core/manifest'
 import { assertFabrikaManifestCoordinates, zeropsArtifactCodec } from '../manifest'
 
 /** Compile every public member of one deployment namespace into its strict proxy manifest. */
@@ -8,6 +10,10 @@ export function compileNamespaceProxyManifest(namespaceId: string, members: read
 	const ids = new Set<string>()
 	const hosts = new Set<string>()
 	for (const member of members) {
+		// Only Control decides what routes a member (ADR-0050): its approved contract's endpoint table. A member without
+		// one is not routed, and its artifact is not decoded, so a legacy one cannot stop the others' republish.
+		const access = member.access
+		if (access === undefined) continue
 		const manifest = decodeEnvelope('artifact', 'zerops', member.artifact, zeropsArtifactCodec)
 		assertFabrikaManifestCoordinates(manifest.app, { appId: member.appId, env: member.env })
 		const proxy = manifest.target.proxy
@@ -16,13 +22,26 @@ export function compileNamespaceProxyManifest(namespaceId: string, members: read
 			throw new Error(`Zerops proxy target ${member.appId}/${member.env} requires a public domain`)
 		}
 		const host = member.domain.toLowerCase()
-		if (ids.has(member.appId)) throw new Error(`duplicate proxy app id \`${member.appId}\` in deployment namespace ${namespaceId}`)
+		// The proxy mints for the IAM application id of this environment (ADR-0022 rule 6).
+		const id = appEnvironmentId(member.appId, member.env)
+		if (ids.has(id)) throw new Error(`duplicate proxy app id \`${id}\` in deployment namespace ${namespaceId}`)
 		if (hosts.has(host)) throw new Error(`duplicate proxy host \`${host}\` in deployment namespace ${namespaceId}`)
-		ids.add(member.appId)
+		ids.add(id)
 		hosts.add(host)
-		// A Zerops public domain is always served over the project's TLS-terminating L7 balancer, so the
-		// browser speaks https even though the proxy itself is reached over plain HTTP (ADR-0022).
-		apps.push({ id: member.appId, hosts: [host], upstream: proxy.upstream, gates: proxy.gates, scheme: 'https' })
+		const operationsOrigin = member.operationsOrigin
+		if (operationsOrigin !== undefined && !isPolicyOrigin(operationsOrigin, ['https:', 'http:'])) {
+			throw new Error(`Zerops proxy target ${member.appId}/${member.env} has an Operations ingest origin that is not an http(s) origin`)
+		}
+		apps.push({
+			id,
+			hosts: [host],
+			upstream: proxy.upstream,
+			// A Zerops public domain is always served over the project's TLS-terminating L7 balancer, so the
+			// browser speaks https even though the proxy itself is reached over plain HTTP (ADR-0022).
+			scheme: 'https',
+			...contractProxyTable(access.contract),
+			...(operationsOrigin === undefined ? {} : { operationsOrigin }),
+		})
 	}
 	return { apps }
 }

package/src/namespace/provisioning.ts

@@ -15,9 +15,12 @@ import { asNamespaceError, namespaceError, ZEROPS_NAMESPACE_CANCELLED, ZEROPS_SU
 import { compileNamespaceProxyManifest } from './manifest'
 import { createZeropsNamespaceOperator } from './operator'
 import { republishProxy } from './proxy-attempt'
+import { namespaceProxySecrets } from './proxy-secrets'
 import { verifyZeropsNamespaceProxySource } from './proxy-source'
 import { compileZeropsNamespaceTopology, projectMarker, PROXY_TYPE } from './topology'
 import type { NormalizedZeropsNamespaceTarget, ZeropsNamespaceOptions, ZeropsNamespaceProxySource } from './types'
+import { createZeropsNamespaceUpdates } from './update'
+import { validateService } from './validation'
 
 const POLL_INTERVAL_MS = 3000
 
@@ -109,33 +112,6 @@ const uniqueService = (services: ZeropsService[], hostname: string): ZeropsServi
 	return matches[0] ?? null
 }
 
-const validateService = (
-	service: ZeropsService,
-	projectId: string,
-	expectedBase: string,
-	adopting: boolean,
-	expectedPublic?: boolean,
-	expectedProfile?: string,
-): void => {
-	if (service.id === '') {
-		throw new Error(`Zerops namespace service \`${service.name}\` returned an empty id`)
-	}
-	if (service.projectId !== undefined && service.projectId !== projectId) {
-		throw new Error(`Zerops namespace service \`${service.name}\` belongs to another project`)
-	}
-	if ((adopting || service.base !== undefined) && service.base !== expectedBase) {
-		throw new Error(`Zerops namespace service \`${service.name}\` uses ${service.base ?? 'an unknown type'}, expected ${expectedBase}`)
-	}
-	if (expectedPublic !== undefined && adopting && service.subdomainAccess !== expectedPublic) {
-		throw new Error(`Zerops namespace service \`${service.name}\` has incompatible public access`)
-	}
-	if (expectedProfile !== undefined && service.autoscalingProfileId !== expectedProfile) {
-		throw new Error(
-			`Zerops namespace service \`${service.name}\` uses profile ${service.autoscalingProfileId ?? 'unknown'}, expected ${expectedProfile}`,
-		)
-	}
-}
-
 const resolveServices = async (
 	namespace: ProviderDeploymentNamespace,
 	target: NormalizedZeropsNamespaceTarget,
@@ -167,7 +143,9 @@ const resolveServices = async (
 		if (postgres === null) {
 			throw new Error(`Zerops namespace project ${projectId} has no shared PostgreSQL service`)
 		}
-		validateService(postgres, projectId, target.postgres.type, adopting, undefined, target.postgres.profile)
+		validateService(postgres, projectId, target.postgres.type, adopting, undefined, {
+			...(target.postgres.profile === undefined ? {} : { declared: target.postgres.profile }),
+		})
 	}
 	if (adopting && namespace.exclusiveAppId !== undefined) {
 		const reserved = new Set([
@@ -237,9 +215,11 @@ const deployProxy = async (
 	wait: ProviderNamespaceRepublishInput['wait'],
 ): Promise<{ namespace: ProviderDeploymentNamespace; target: NormalizedZeropsNamespaceTarget }> => {
 	let currentNamespace = namespace
+	const manifest = compileNamespaceProxyManifest(namespace.id, input.members)
 	const result = await republishProxy({
 		target,
-		manifest: compileNamespaceProxyManifest(namespace.id, input.members),
+		manifest,
+		proxySecrets: namespaceProxySecrets(manifest, input.members),
 		...(options.source === undefined ? {} : { source: options.source }),
 		api: options.api,
 		iamUrl: options.iamUrl,
@@ -477,6 +457,7 @@ export const createZeropsNamespaceCapabilities = (options: ZeropsNamespaceOption
 		provision: (input) => mutateNamespace(input, options, 'provision'),
 		reconcile: (input) => mutateNamespace(input, options, 'reconcile'),
 		republish: (input) => republishNamespace(input, options),
+		updates: createZeropsNamespaceUpdates(options),
 		operator: createZeropsNamespaceOperator({ proxySource: options.proxySource }),
 	}
 }

package/src/namespace/proxy-attempt.ts

@@ -22,6 +22,8 @@ export interface ZeropsProxyRepublishInput {
 	readonly api: ZeropsProxyApi
 	readonly iamUrl: string
 	readonly iamKey: string
+	/** Proxy service variable → the secret of one contract application (`namespaceProxySecrets`); none without one. */
+	readonly proxySecrets?: ReadonlyMap<string, string>
 	/** Aborts with `lease_lost` when the namespace lease goes, and with `cancel_requested` when a deploy is cancelled. */
 	readonly signal: AbortSignal
 	readonly wait: 'started' | 'active'
@@ -55,8 +57,15 @@ const writeProxyIam = async (input: ZeropsProxyRepublishInput, serviceId: string
 	}
 	// Secret read-back is not trustworthy, so overwrite it without inspecting its value.
 	await api.putServiceEnv({ serviceId, key: ZEROPS_NAMESPACE_IAM_KEY_VARIABLE, value: input.iamKey, signal })
+	for (const [key, value] of input.proxySecrets ?? []) {
+		await api.putServiceEnv({ serviceId, key, value, signal })
+	}
 }
 
+/** One line per secret, sorted, so the attempt's identity changes when any secret does and never carries one. */
+const proxySecretsDigest = async (secrets: ReadonlyMap<string, string>): Promise<string> =>
+	digest([...secrets].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([key, value]) => `${key}=${value}`).join('\n'))
+
 /**
  * Rebuild the namespace proxy with `manifest` (ADR-0044). The attempt is recorded as `proxyBuild` and never
  * resumed: an inherited attempt not yet `triggered` is deleted, a triggered one is polled to a terminal state.
@@ -68,8 +77,10 @@ export async function republishProxy(input: ZeropsProxyRepublishInput): Promise<
 	if (serviceId === undefined) throw new Error('Zerops namespace has no proxy service id')
 	await verifyZeropsNamespaceProxySource(pin)
 	const manifest = encodeProxyManifestJson(input.manifest)
-	// The attempt's identity covers the IAM configuration too, so a rotated issuer or key forces a rebuild.
-	const manifestSha256 = await digest(`${manifest}\n${input.iamUrl}\n${await digest(input.iamKey)}`)
+	// The attempt's identity covers the IAM configuration and the proxy secrets too, so rotating any forces a rebuild.
+	const proxySecrets = input.proxySecrets ?? new Map<string, string>()
+	const secrets = proxySecrets.size === 0 ? '' : `\n${await proxySecretsDigest(proxySecrets)}`
+	const manifestSha256 = await digest(`${manifest}\n${input.iamUrl}\n${await digest(input.iamKey)}${secrets}`)
 	let target = input.target
 
 	const save = async (next: ZeropsNamespaceTarget): Promise<void> => {

package/src/namespace/proxy-secrets.ts

@@ -0,0 +1,21 @@
+import { appEnvironmentId, proxySecretVariable } from '@fabrika/auth-core'
+import type { ProviderNamespaceMember } from '@fabrika/provider-contract'
+import { isApplicationEntry, type ProxyManifest } from '@fabrika/proxy-core/manifest'
+
+/**
+ * The proxy service variables a manifest needs: for each contract application, the secret Caddy sends it
+ * (ADR-0022 rule 5), keyed by `proxySecretVariable`. A contract member without a secret is refused, because
+ * its application would refuse every request the proxy sends.
+ */
+export function namespaceProxySecrets(manifest: ProxyManifest, members: readonly ProviderNamespaceMember[]): ReadonlyMap<string, string> {
+	const secrets = new Map<string, string>()
+	for (const app of manifest.apps) {
+		if (!isApplicationEntry(app)) continue
+		const member = members.find((candidate) => appEnvironmentId(candidate.appId, candidate.env) === app.id)
+		if (member?.proxySecret === undefined || member.proxySecret === '') {
+			throw new Error(`Zerops proxy target ${app.id} is a contract application, and Control supplied no proxy secret for it`)
+		}
+		secrets.set(proxySecretVariable(app.id), member.proxySecret)
+	}
+	return secrets
+}