@fabrika/provider-zerops 0.4.1 → 0.4.3

package/src/installation/index.ts

@@ -9,9 +9,11 @@ import {
 } from '@fabrika/installation-init'
 import type { SchemaReconciler } from '@fabrika/provider-contract'
 import type { InstallationCli, InstallationCommand } from '@fabrika/provider-contract/installation'
+import { fileURLToPath } from 'node:url'
 import { createZeropsApi, defaultSleep } from '../index'
 import { consoleAdminCollaborators, runPlatformAdmin } from './admin'
 import { parsePlatformAdminArgs, REISSUE_FLAG } from './admin-options'
+import { npmCheckerPublication } from './checker-release'
 import { deployPlatform, PLATFORM_CONCURRENT_DEPLOY, PLATFORM_DEPLOY_ORDER, PLATFORM_SEQUENTIAL_DEPLOY } from './deploy'
 import { parsePlatformDeployArgs } from './deploy-options'
 import { consoleInitCollaborators, runInit } from './init'
@@ -44,7 +46,11 @@ export {
 
 const USAGE = `Zerops installation
 
+New here, or an agent? Run \`fabrika platform guide --provider=zerops\` first: the whole bring-up in order,
+what to ask the human for, and the traps this text cannot show.
+
 Commands:
+  fabrika platform guide   --provider=zerops
   fabrika platform install --provider=zerops [options]
   fabrika platform init    --provider=zerops <installation> --tag=<tag> --project-id=<id> [options]
   fabrika platform plan    --provider=zerops
@@ -61,9 +67,9 @@ deploy that push triggers.
 
 ── platform install ──────────────────────────────────────────────────────────────────────────────
 
-The from-scratch bring-up. With \`--create-project\` it creates the project too, with core package
-LIGHT and \`envIsolation: service\` — the two settings Zerops accepts at project CREATION only and never
-afterwards. \`--project-id=<id>\` installs into an empty project you created yourself instead, with both
+The from-scratch bring-up. With \`--create-project\` it creates the project too, with the tier's core
+package (LIGHT or SERIOUS) and \`envIsolation: service\` — the two settings Zerops accepts at project
+CREATION only and never afterwards. \`--project-id=<id>\` installs into an empty project you created yourself instead, with both
 already right; nothing here can read \`envIsolation\` back or correct it.
 
 Interactive and laptop-side. It CONFIRMS before every step that leaves your machine: reading the
@@ -74,27 +80,30 @@ is not consent.
 
   1. create the project and wait for it to be ACTIVE (\`--create-project\`; its id is printed before
      the wait), or read the one you named — and refuse a core package the tier does not match
-  2. import ${PLATFORM_DEPLOY_ORDER.length + 2} services without code, and wait for the import's processes
+  2. import the tier's services without code, and wait for the import's processes
   3. generate six secrets and mint the control plane's Zerops INTEGRATION token
-     (client role NO_ACCESS, ADMIN on this project only — never your personal token)
+     (client role NO_ACCESS, ADMIN on this project only — never your personal token), and write
+     all of them to \`--secrets-file\` (mode 0600) before the first one is placed
   4. pass 1: give the proxy an EMPTY manifest and build it, so it publishes one public hostname per
      HTTP port; the three platform hosts are then READ off those, never composed
   5. write every remaining variable on all four runtime services
   6. pass 2: hand the whole ordered sequence to \`platform deploy\`
-  7. print the provisioning key — the CLI keeps no copy; it is held by iam and control in Zerops
+  7. print the next commands; they read their credentials from the secrets file. Zerops holds the
+     same values as SENSITIVE variables and does not hand them back, so that file is the only copy
 
 It REFUSES a project that already holds an installation's generated secrets: a second bring-up would
 roll a new vault key over the old one, which is unrecoverable, and new signing keys, which logs
 everyone out. Once every bootstrap variable is placed, \`platform deploy\` can update the installation
-or finish a failed pass 2. Read FABRIKA_IAM_PROVISIONING_KEY from iam or control and
-FABRIKA_ZEROPS_ACCESS_TOKEN from control in Zerops if the handoff was interrupted.
+or finish a failed pass 2, with the credentials from the secrets file.
 Neither deploy nor init completes a partial bootstrap. If interrupted after a generated secret was
 placed but before every bootstrap variable was placed, preserve the existing keys and arrange
 operator-owned recovery, or start a fresh installation in a separate empty project.
 Re-running install after any generated secret was placed is refused.
 
-Only the LIGHT tier can be installed this way — it is the one topology that emits a services-only
-import document. Authentication is PASSWORD ONLY; no administrator exists yet when this finishes.
+Two tiers, one project each. \`light\` (core LIGHT): one single-node PostgreSQL and one bucket shared by
+IAM, control and Operations, one container per service. \`standard\` (core SERIOUS): an HA PostgreSQL for
+IAM and control, a second HA PostgreSQL and bucket for Operations, two containers of IAM and the proxy.
+Authentication is PASSWORD ONLY; no administrator exists yet when this finishes.
 
 Options (a flag beats the environment variable beside it):
 
@@ -107,7 +116,8 @@ Options (a flag beats the environment variable beside it):
   --env=<name>                      FABRIKA_PLATFORM_ENVIRONMENT    written to every service as ENVIRONMENT
   --scheme=<http|https>             FABRIKA_PLATFORM_SCHEME         default https
   --source-dir=<checkout>           required                       clean full checkout running this CLI
-  --tier=light                      FABRIKA_PLATFORM_TIER           default light, and the only value
+  --tier=<light|standard>           FABRIKA_PLATFORM_TIER           default light
+  --secrets-file=<path>             FABRIKA_PLATFORM_SECRETS_FILE   required: a NEW file outside the checkout
   ${UNATTENDED_FLAG}                                                             answer every confirmation yes —
                                                                     required when stdin is not a terminal
 
@@ -243,23 +253,24 @@ commit availability before its effects; a local commit is not thereby published
 The first human. A fresh installation has none — nothing seeds an admission list, and this command is
 why it does not have to. It is unattended, prompts for nothing, and changes nothing on a re-run:
 
-  1. find the principal holding that mailbox, or invite one
+  1. find the principal holding that address, or create one
   2. grant it the CROSS-APP \`admin\` role, unless it already holds one
   3. issue ONE password enrollment and print its URL
 
 The grant is cross-app (\`app: null\`) and that is load-bearing: grants filter to the calling app, so an
 \`admin\` grant scoped to the console's own app id leaves Delivery and Operations working while the
-Access plane refuses. A re-run invites nobody twice, grants nothing twice and issues no second
+Access plane refuses. A re-run creates nobody twice, grants nothing twice and issues no second
 enrollment — a password that is already set, or an enrollment already outstanding, is REPORTED. Pass
 \`${REISSUE_FLAG}\` to replace an outstanding one, which is the way out when the first expired unopened.
 
-The enrollment URL is a credential: it is printed once, on a line of its own, and stored nowhere.
+Nothing is e-mailed: a Zerops installation has no mail service. Hand the URL to the administrator
+yourself. It is a credential: it is printed once, on a line of its own, and stored nowhere.
 
 \`install\` reports the host this needs as \`✓ iam <host>\` and ends with this command ready to run.
 
 Options (a flag beats the environment variable beside it):
 
-  --email=<address>                 FABRIKA_PLATFORM_ADMIN_EMAIL    the administrator's mailbox
+  --email=<address>                 FABRIKA_PLATFORM_ADMIN_EMAIL    the administrator's sign-in address
   --iam-host=<host>                 FABRIKA_PLATFORM_IAM_HOST       IAM's public hostname, as \`deploy\` names it
   --scheme=<http|https>             FABRIKA_PLATFORM_SCHEME         default https
   ${REISSUE_FLAG}                                                         replace an outstanding enrollment
@@ -305,6 +316,16 @@ laptop and not in the pipeline it triggers.
 /** No cancellation source exists behind a CLI invocation; the ports all take a signal regardless. */
 const neverAborted = (): AbortSignal => new AbortController().signal
 
+/** The operator's guide of this release, shipped beside this module. */
+export const readInstallationGuide = (): Promise<string> => Bun.file(fileURLToPath(new URL('./guide.md', import.meta.url))).text()
+
+const runGuide = async (argv: readonly string[]): Promise<void> => {
+	if (argv.length > 0) {
+		throw new Error(`Unexpected Zerops guide arguments: ${argv.map(describeArgument).join(' ')}`)
+	}
+	console.info(await readInstallationGuide())
+}
+
 const runPlan = (argv: readonly string[]): void => {
 	if (argv.length > 0) {
 		throw new Error(`Unexpected Zerops plan arguments: ${argv.map(describeArgument).join(' ')}`)
@@ -332,6 +353,7 @@ const runDeploy = async (argv: readonly string[]): Promise<void> => {
 	const input = parsePlatformDeployArgs(argv, process.env)
 	await deployPlatform(input, {
 		prepareSource: prepareInstallationSource,
+		checkerPublished: npmCheckerPublication(),
 		uploadFetch: (url, init) => fetch(url, init),
 		api: createZeropsApi({
 			token: input.accessToken,
@@ -368,9 +390,13 @@ const runPlatformUpgrade = async (argv: readonly string[]): Promise<void> => {
 
 export const installationCli: InstallationCli = {
 	provider: 'zerops',
-	commands: ['install', 'init', 'plan', 'deploy', 'admin', 'upgrade'],
+	commands: ['install', 'init', 'plan', 'deploy', 'admin', 'upgrade', 'guide'],
 	usage: USAGE,
 	run: async (command: InstallationCommand, argv: readonly string[]) => {
+		if (command === 'guide') {
+			await runGuide(argv)
+			return
+		}
 		if (command === 'install') {
 			await runPlatformInstall(argv)
 			return

package/src/installation/init-options.ts

@@ -138,9 +138,9 @@ export const parseInitArgs = (argv: readonly string[], env: CommandEnv, cwd: str
 		accessToken: credential(
 			env,
 			'FABRIKA_ZEROPS_ACCESS_TOKEN',
-			"the Zerops INTEGRATION token `platform install` minted, read from the `control` service's environment",
+			'the Zerops INTEGRATION token `platform install` minted, from its secrets file',
 		),
-		provisioningKey: credential(env, 'FABRIKA_IAM_PROVISIONING_KEY', 'the px_ key `platform install` printed'),
+		provisioningKey: credential(env, 'FABRIKA_IAM_PROVISIONING_KEY', 'the px_ key from the secrets file `platform install` wrote'),
 		unattended: argv.includes(UNATTENDED_FLAG),
 		...(hosts === undefined ? {} : { hosts }),
 		...(apiBaseUrl === undefined ? {} : { apiBaseUrl }),

package/src/installation/init.ts

@@ -95,8 +95,14 @@ export const inspectPlatform = async (projectId: string, api: ZeropsApi, signal:
 	if (control === undefined || control.id === '') throw new Error(`Zerops project ${projectId} has no \`control\` service`)
 	const proxy = oneService(services, 'proxy')
 	if (proxy === undefined || proxy.id === '') throw new Error(`Zerops project ${projectId} has no \`proxy\` service`)
-	const readEnv = async (serviceId: string): Promise<Map<string, string>> =>
-		new Map((await api.listServiceEnv({ serviceId, signal })).map((item) => [item.key, item.content]))
+	// Only the readable values: everything init prints is derived from non-secret configuration.
+	const readEnv = async (serviceId: string): Promise<Map<string, string>> => {
+		const readable = new Map<string, string>()
+		for (const item of await api.listServiceEnv({ serviceId, signal })) {
+			if (!item.sensitive) readable.set(item.key, item.content)
+		}
+		return readable
+	}
 	return {
 		controlEnv: await readEnv(control.id),
 		proxyEnv: await readEnv(proxy.id),

package/src/installation/install-collaborators.ts

@@ -1,6 +1,7 @@
 import type { Confirmations } from '@fabrika/installation-init'
 import type { SchemaReconciler } from '@fabrika/provider-contract'
 import type { Sleeper, ZeropsApi } from '../index'
+import type { CheckerPublication } from './checker-release'
 import type { PlatformSourcePreparer } from './installation-source'
 import type { InitLog } from './log'
 import type { PlatformUploadFetch } from './platform-upload'
@@ -11,6 +12,7 @@ export type InstallPrompts = Confirmations
 /** Everything `runInstall` reaches the outside world through. */
 export interface InstallCollaborators {
 	readonly prepareSource: PlatformSourcePreparer
+	readonly checkerPublished: CheckerPublication
 	readonly uploadFetch: PlatformUploadFetch
 	readonly api: ZeropsApi
 	readonly reconcileSchema: SchemaReconciler
@@ -18,6 +20,8 @@ export interface InstallCollaborators {
 	readonly log: InitLog
 	readonly prompts: InstallPrompts
 	readonly signal: AbortSignal
+	/** Create the local secrets file (`--secrets-file`) with this text. Never logged. */
+	readonly storeSecrets: (text: string) => Promise<void>
 }
 
 export const assertRunning = (signal: AbortSignal): void => {

package/src/installation/install-environment.ts

@@ -1,45 +1,61 @@
-import { encodeProxyManifestJson, FABRIKA_PROXY_MANIFEST_JSON } from '@fabrika/proxy-core/manifest'
+import { encodeProxyManifestJson } from '@fabrika/proxy-core/manifest'
 import type { ZeropsNamespaceProxySource } from '../index'
 import type { PlatformDeployService, ResolvedService } from './deploy'
 import { type PlatformHosts, platformOrigin } from './hosts'
 import { assertRunning, type InstallCollaborators } from './install-collaborators'
 import { FABRIKA_ZEROPS_PROXY_SOURCE_JSON, serializeNamespaceProxySource } from './installation-source'
 import type { InstallationSecrets } from './secrets'
+import type { PlatformTier } from './topology/topology'
 
 /** The private address the proxy dials IAM at inside the project, and pass 1's placeholder issuer. */
 export const PRIVATE_IAM_UPSTREAM = 'iam:3000'
 const PRIVATE_IAM_URL = `http://${PRIVATE_IAM_UPSTREAM}`
 
 /** The canonical fabrika PostgreSQL DSN on Zerops — see `src/topology/setups.ts` for why both suffixes exist. */
-const POSTGRES_URL = '${db_connectionTlsString}/${db_dbName}?sslmode=require'
+const postgresUrl = (service: string): string => `\${${service}_connectionTlsString}/\${${service}_dbName}?sslmode=require`
 
-/** The light tier's one object-storage service, as the platform's own `${service_variable}` references. */
-const STORAGE = {
-	bucket: '${storage_bucketName}',
-	accessKeyId: '${storage_accessKeyId}',
-	secretAccessKey: '${storage_secretAccessKey}',
-	endpoint: '${storage_apiUrl}',
-} as const
+/** An object-storage service's coordinates, as the platform's own `${service_variable}` references. */
+interface StorageReferences {
+	readonly bucket: string
+	readonly accessKeyId: string
+	readonly secretAccessKey: string
+	readonly endpoint: string
+}
+
+const storageOf = (service: string): StorageReferences => ({
+	bucket: `\${${service}_bucketName}`,
+	accessKeyId: `\${${service}_accessKeyId}`,
+	secretAccessKey: `\${${service}_secretAccessKey}`,
+	endpoint: `\${${service}_apiUrl}`,
+})
+
+/** IAM and control share `db` and `storage` on both tiers; `standard` gives Operations its own pair. */
+const OPERATIONS_DATA: Readonly<Record<PlatformTier, { readonly database: string; readonly storage: string }>> = {
+	light: { database: 'db', storage: 'storage' },
+	standard: { database: 'operationsdb', storage: 'operationsstorage' },
+}
 
 /**
- * The four variables pass 1 writes on the proxy, and nothing else.
+ * The three variables pass 1 writes on the proxy, and nothing else.
  *
- * The manifest is EMPTY on purpose: it is the only legal document that can be written before the hosts
- * exist, and the build bakes whatever is here (`src/topology/setups.ts`). `FABRIKA_IAM_ISSUER` is the private
- * address rather than the public issuer for the same reason — the public one is not known yet — and
- * `deployPlatform` corrects it in pass 2, before the manifest it belongs to is applied.
+ * `FABRIKA_IAM_ISSUER` is the private address rather than the public issuer because the public one is not known
+ * yet; `deployPlatform` corrects it in pass 2, before the manifest it belongs to is applied. The pass-1 manifest is
+ * `PASS_ONE_PROXY_MANIFEST`, which the proxy's archive carries.
  */
 export const passOneProxyEnv = (secrets: InstallationSecrets): ReadonlyMap<string, string> =>
 	new Map([
-		[FABRIKA_PROXY_MANIFEST_JSON, encodeProxyManifestJson({ apps: [] })],
 		['FABRIKA_IAM_ISSUER', PRIVATE_IAM_URL],
 		['FABRIKA_IAM_KEY', secrets.proxyKey],
 		['FABRIKA_PROXY_SESSION_OWNER_JSON', 'null'],
 	])
 
+/** EMPTY on purpose: the only legal document before the hosts exist. The proxy comes up answering 404. */
+export const PASS_ONE_PROXY_MANIFEST = encodeProxyManifestJson({ apps: [] })
+
 /** What `installationServiceEnv` needs. Everything in it is settled before the first write. */
 export interface InstallationEnvInput {
 	readonly environment: string
+	readonly tier: PlatformTier
 	readonly scheme: 'http' | 'https'
 	readonly hosts: PlatformHosts
 	readonly clientId: string
@@ -72,17 +88,21 @@ export const installationServiceEnv = (input: InstallationEnvInput): ReadonlyMap
 	const { secrets } = input
 	const iamOrigin = platformOrigin(input.scheme, input.hosts.iam)
 	const operationsOrigin = platformOrigin(input.scheme, input.hosts.operations)
+	const platformDatabase = postgresUrl('db')
+	const runLogs = storageOf('storage')
+	const operationsData = OPERATIONS_DATA[input.tier]
+	const operationsBlobs = storageOf(operationsData.storage)
 	const control = new Map([
-		['FABRIKA_CONTROL_DATABASE_URL', POSTGRES_URL],
+		['FABRIKA_CONTROL_DATABASE_URL', platformDatabase],
 		['ENVIRONMENT', input.environment],
 		// A bare HOST, not an origin: `controlPublicOrigin` accepts either.
 		['FABRIKA_CONTROL_DOMAIN', input.hosts.control],
 		['FABRIKA_IAM_ISSUER', iamOrigin],
 		['OPERATIONS_ARTIFACT_ORIGIN', operationsOrigin],
-		['FABRIKA_CONTROL_RUN_LOGS_BUCKET', STORAGE.bucket],
-		['FABRIKA_CONTROL_RUN_LOGS_ACCESS_KEY_ID', STORAGE.accessKeyId],
-		['FABRIKA_CONTROL_RUN_LOGS_SECRET_ACCESS_KEY', STORAGE.secretAccessKey],
-		['FABRIKA_CONTROL_RUN_LOGS_ENDPOINT', STORAGE.endpoint],
+		['FABRIKA_CONTROL_RUN_LOGS_BUCKET', runLogs.bucket],
+		['FABRIKA_CONTROL_RUN_LOGS_ACCESS_KEY_ID', runLogs.accessKeyId],
+		['FABRIKA_CONTROL_RUN_LOGS_SECRET_ACCESS_KEY', runLogs.secretAccessKey],
+		['FABRIKA_CONTROL_RUN_LOGS_ENDPOINT', runLogs.endpoint],
 		['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
 		['OPERATIONS_SYNC_KEY', secrets.operationsSyncKey],
 		['FABRIKA_CONTROL_VAULT_KEY', secrets.vaultKey],
@@ -104,7 +124,7 @@ export const installationServiceEnv = (input: InstallationEnvInput): ReadonlyMap
 		[
 			'iam',
 			new Map([
-				['FABRIKA_IAM_DATABASE_URL', POSTGRES_URL],
+				['FABRIKA_IAM_DATABASE_URL', platformDatabase],
 				['ENVIRONMENT', input.environment],
 				['ISSUER', iamOrigin],
 				// Password only, by decision: OIDC needs an identity provider the operator has not been
@@ -121,11 +141,11 @@ export const installationServiceEnv = (input: InstallationEnvInput): ReadonlyMap
 		[
 			'operations',
 			new Map([
-				['FABRIKA_OPERATIONS_DATABASE_URL', POSTGRES_URL],
-				['FABRIKA_OPERATIONS_BLOB_BUCKET', STORAGE.bucket],
-				['FABRIKA_OPERATIONS_BLOB_ACCESS_KEY_ID', STORAGE.accessKeyId],
-				['FABRIKA_OPERATIONS_BLOB_SECRET_ACCESS_KEY', STORAGE.secretAccessKey],
-				['FABRIKA_OPERATIONS_BLOB_ENDPOINT', STORAGE.endpoint],
+				['FABRIKA_OPERATIONS_DATABASE_URL', postgresUrl(operationsData.database)],
+				['FABRIKA_OPERATIONS_BLOB_BUCKET', operationsBlobs.bucket],
+				['FABRIKA_OPERATIONS_BLOB_ACCESS_KEY_ID', operationsBlobs.accessKeyId],
+				['FABRIKA_OPERATIONS_BLOB_SECRET_ACCESS_KEY', operationsBlobs.secretAccessKey],
+				['FABRIKA_OPERATIONS_BLOB_ENDPOINT', operationsBlobs.endpoint],
 				['FABRIKA_OPERATIONS_PUBLIC_HOST', input.hosts.operations],
 				['ENVIRONMENT', input.environment],
 				['FABRIKA_IAM_ISSUER', iamOrigin],
@@ -175,18 +195,20 @@ export const GENERATED_SECRET_KEYS: ReadonlyMap<PlatformDeployService, readonly
 /**
  * Write a set of variables, reporting the KEYS — never a value, not even in a debug line.
  *
- * Write-first and unconditional: half of these are generated secrets, and a read-compare-write over a
- * value the platform may or may not hand back verbatim would make the outcome depend on something
- * nobody has pinned. `PUT /user-data/{id}` replaces in place, so a repeat costs a call and nothing else.
+ * Write-first and unconditional: a generated secret cannot be read back to compare, and `PUT
+ * /user-data/{id}` replaces in place, so a repeat costs a call and nothing else. Exactly the generated
+ * secrets are written sensitive; everything else stays readable, because `platform deploy` compares
+ * and merges it later.
  */
 export const writeServiceEnv = async (
 	service: ResolvedService,
 	desired: ReadonlyMap<string, string>,
 	{ api, log, signal }: InstallCollaborators,
 ): Promise<void> => {
+	const secrets = GENERATED_SECRET_KEYS.get(service.hostname) ?? []
 	for (const [key, value] of desired) {
 		assertRunning(signal)
-		await api.putServiceEnv({ serviceId: service.id, key, value, signal })
+		await api.putServiceEnv({ serviceId: service.id, key, value, sensitive: secrets.includes(key), signal })
 	}
 	log.ok(`${service.hostname}: wrote ${[...desired.keys()].join(', ')}`)
 }

package/src/installation/install-options.ts

@@ -9,11 +9,12 @@
 // and the variable that would supply it, so a mistyped install fails before it contacts anything.
 
 import { describeArgument, readEnv, readFlag, requiredSetting, setting, UNATTENDED_FLAG } from '@fabrika/installation-init'
+import { checkedSecretsFilePath, SECRETS_FILE_FLAG, SECRETS_FILE_VARIABLE } from './install-secrets'
 import { parsePlatformScheme } from './placement-options'
 import { readInstallationSourceDir } from './source-options'
+import type { PlatformTier } from './topology/topology'
 
-/** The only tier a bootstrap can install. See `assertInstallableTier`. */
-export type InstallablePlatformTier = 'light'
+const PLATFORM_TIERS: readonly PlatformTier[] = ['light', 'standard']
 
 /**
  * Where the installation's project comes from.
@@ -43,7 +44,9 @@ export interface PlatformInstallInput {
 	/** The scheme a browser speaks to this installation. */
 	readonly scheme: 'http' | 'https'
 	readonly sourceDir: string
-	readonly tier: InstallablePlatformTier
+	/** Where every credential this run creates is written, mode 0600, before the first is placed. */
+	readonly secretsFile: string
+	readonly tier: PlatformTier
 	/** `--yes`: answer every confirmation yes, for a bring-up with nobody at the keyboard. */
 	readonly unattended: boolean
 }
@@ -51,7 +54,7 @@ export interface PlatformInstallInput {
 /** The canonical public release repository used for namespace proxy source identities. */
 export const FABRIKA_REPOSITORY_URL = 'https://github.com/contember/fabrika-platform'
 
-const FLAGS = ['--project-id', '--project-name', '--client-id', '--env', '--scheme', '--source-dir', '--tier'] as const
+const FLAGS = ['--project-id', '--project-name', '--client-id', '--env', '--scheme', '--source-dir', '--tier', SECRETS_FILE_FLAG] as const
 
 /** `--create-project`: bring the project up too, instead of naming one the operator made. */
 export const CREATE_PROJECT_FLAG = '--create-project'
@@ -74,22 +77,16 @@ const assertKnownArguments = (argv: readonly string[]): void => {
 	}
 }
 
-/**
- * The tier this command can bring up.
- *
- * Only `light`, and that is a property of the topology rather than a limitation of the flow: the light
- * tier is the only one that emits a services-only provisioning document, because it is the only one an
- * operator installs into a project they created themselves. The standard tier is TWO projects that
- * fabrika creates, which is a different command with a different failure mode.
- */
-const assertInstallableTier = (raw: string | undefined): InstallablePlatformTier => {
-	if (raw === undefined || raw === 'light') {
+/** The platform tier to bring up. `light` stays the default, so an existing invocation installs what it did. */
+const readTier = (raw: string | undefined): PlatformTier => {
+	if (raw === undefined) {
 		return 'light'
 	}
-	throw new Error(
-		`--tier=${raw} cannot be installed into a project you created: only the light tier emits a services-only `
-			+ 'provisioning document. The standard tier is two projects fabrika creates itself',
-	)
+	const tier = PLATFORM_TIERS.find((candidate) => candidate === raw)
+	if (tier === undefined) {
+		throw new Error(`--tier=${raw} is not a platform tier — pass --tier=light or --tier=standard`)
+	}
+	return tier
 }
 
 const readScheme = (argv: readonly string[], env: Record<string, string | undefined>): 'http' | 'https' => {
@@ -149,7 +146,11 @@ export const parsePlatformInstallArgs = (
 		environment: readEnvironment(argv, env),
 		scheme: readScheme(argv, env),
 		sourceDir,
-		tier: assertInstallableTier(setting(argv, env, '--tier', 'FABRIKA_PLATFORM_TIER')),
+		secretsFile: checkedSecretsFilePath(
+			requiredSetting(setting(argv, env, SECRETS_FILE_FLAG, SECRETS_FILE_VARIABLE), SECRETS_FILE_FLAG, SECRETS_FILE_VARIABLE),
+			sourceDir,
+		),
+		tier: readTier(setting(argv, env, '--tier', 'FABRIKA_PLATFORM_TIER')),
 		unattended: argv.includes(UNATTENDED_FLAG),
 		...(apiBaseUrl === undefined ? {} : { apiBaseUrl }),
 	}

package/src/installation/install-project.ts

@@ -1,10 +1,12 @@
 import { ENV_ISOLATION, renderYaml, type ZeropsProjectMode, type ZeropsProjectStatus } from '../index'
 import { assertRunning, type InstallCollaborators } from './install-collaborators'
 import type { PlatformInstallInput } from './install-options'
-import { lightTopology } from './install-provisioning'
+import { installationTopology } from './install-provisioning'
+import { assertPersonalAccessToken } from './install-token'
+import type { PlatformTier } from './topology/topology'
 
-/** The project compute tier each installable platform tier requires. `corePackage` is upgrade-only. */
-const REQUIRED_PROJECT_MODE: ZeropsProjectMode = 'LIGHT'
+/** The project compute tier each platform tier requires. `corePackage` is upgrade-only. */
+const REQUIRED_PROJECT_MODE: Readonly<Record<PlatformTier, ZeropsProjectMode>> = { light: 'LIGHT', standard: 'SERIOUS' }
 
 /** The one project state this command may install into. */
 const PROJECT_ACTIVE: ZeropsProjectStatus = 'ACTIVE'
@@ -32,15 +34,16 @@ const PROJECT_READ_FAILURES = 3
  * The document `--create-project` applies, carrying a `project:` block and NO services.
  *
  * Taken from the same declaration the provisioning import is compiled from, so `envIsolation: service`
- * and `corePackage: LIGHT` — the two settings a project accepts at CREATION only and never afterwards —
+ * and `corePackage` — the two settings a project accepts at CREATION only and never afterwards —
  * have exactly one source. Only the name is this run's. `renderImportYaml` is not the renderer here
  * because it refuses a document with no services, and this one deliberately has none: the services arrive
  * through the services-only import, into the project this creates.
  */
-const createProjectYaml = (environment: string, projectName: string): string => {
-	const declared = lightTopology(environment).provision.document.project
-	if (declared === undefined || declared.corePackage !== REQUIRED_PROJECT_MODE || declared.envIsolation !== ENV_ISOLATION) {
-		throw new Error(`the light platform topology declares no \`${REQUIRED_PROJECT_MODE}\` project with \`envIsolation: ${ENV_ISOLATION}\` to create`)
+const createProjectYaml = (environment: string, tier: PlatformTier, projectName: string): string => {
+	const declared = installationTopology(environment, tier).provision.document.project
+	const mode = REQUIRED_PROJECT_MODE[tier]
+	if (declared === undefined || declared.corePackage !== mode || declared.envIsolation !== ENV_ISOLATION) {
+		throw new Error(`the ${tier} platform topology declares no \`${mode}\` project with \`envIsolation: ${ENV_ISOLATION}\` to create`)
 	}
 	return renderYaml({ project: { ...declared, name: projectName }, services: [] })
 }
@@ -122,7 +125,7 @@ const createProject = async (
 	assertRunning(signal)
 	const result = await api.importProject({
 		clientId: input.clientId,
-		yaml: createProjectYaml(environment, projectName),
+		yaml: createProjectYaml(environment, input.tier, projectName),
 		signal,
 	})
 	if (result.projectId === '') {
@@ -143,18 +146,19 @@ const resolveProject = async (
 	{ api, log, signal }: InstallCollaborators,
 ): Promise<{ id: string; name: string }> => {
 	const project = await api.getProject({ projectId, signal })
+	const mode = REQUIRED_PROJECT_MODE[input.tier]
 	if (project.id === '') {
 		throw new Error(`Zerops project ${projectId} could not be read with this token`)
 	}
 	if (project.mode === undefined) {
 		// Not a mismatch, so not a refusal: the client narrows an unknown value to absent, and blocking an
 		// install on a field the API did not state would be refusing on an absence of evidence.
-		log.warn(`Zerops did not state project ${project.name}'s mode; the ${input.tier} tier expects ${REQUIRED_PROJECT_MODE}`)
-	} else if (project.mode !== REQUIRED_PROJECT_MODE) {
+		log.warn(`Zerops did not state project ${project.name}'s mode; the ${input.tier} tier expects ${mode}`)
+	} else if (project.mode !== mode) {
 		throw new Error(
-			`Zerops project ${project.name} is ${project.mode} and the ${input.tier} tier needs ${REQUIRED_PROJECT_MODE}. \`corePackage\` is `
+			`Zerops project ${project.name} is ${project.mode} and the ${input.tier} tier needs ${mode}. \`corePackage\` is `
 				+ 'upgrade-only and its upgrade is partly destructive, so this is not something an install may change — create the project '
-				+ `with core package ${REQUIRED_PROJECT_MODE}, or install a tier that matches`,
+				+ `with core package ${mode}, or install a tier that matches`,
 		)
 	}
 	return { id: project.id, name: project.name }
@@ -163,7 +167,7 @@ const resolveProject = async (
 /**
  * Settle which project this run installs into — the operator's, or one created here.
  *
- * ONE confirmation either way, and both cover the read that follows: a created project is read back
+ * ONE confirmation either way, and both cover the token check and the read that follows: a created project is read back
  * through the same `resolveProject` an operator-made one goes through, so the core package is checked on
  * the project that will actually be installed into rather than on the document that asked for it.
  */
@@ -183,19 +187,23 @@ export const resolveInstallationProject = async (
 		) {
 			throw new Error('declined: nothing was contacted, and re-running the install is safe')
 		}
+		await assertPersonalAccessToken(collaborators)
 		return resolveProject(input, source.projectId, collaborators)
 	}
 	log.step('Create the project this installation is brought up in')
 	log.info('`envIsolation` and `corePackage` are settable at project CREATION only, which is why the project is created from here.')
 	if (
 		!(await prompts.confirm(
-			`CREATE Zerops project \`${source.projectName}\` (core package ${REQUIRED_PROJECT_MODE}, envIsolation ${ENV_ISOLATION}) on client `
+			`Check the token, then CREATE Zerops project \`${source.projectName}\` (core package ${
+				REQUIRED_PROJECT_MODE[input.tier]
+			}, envIsolation ${ENV_ISOLATION}) on client `
 				+ `${input.clientId}, then read it back?`,
 			true,
 		))
 	) {
 		throw new Error('declined: no project was created, and re-running the install is safe')
 	}
+	await assertPersonalAccessToken(collaborators)
 	const projectId = await createProject(input, environment, source.projectName, collaborators)
 	return resolveProject(input, projectId, collaborators)
 }

package/src/installation/install-provisioning.ts

@@ -2,24 +2,24 @@ import { waitForProcess, type ZeropsImportResult, type ZeropsService, type Zerop
 import { PLATFORM_DEPLOY_ORDER, type PlatformDeployService, readServiceEnv, type ResolvedService } from './deploy'
 import { assertRunning, type InstallCollaborators } from './install-collaborators'
 import { GENERATED_SECRET_KEYS } from './install-environment'
-import { type CompiledDocument, type CompiledTopology, compileTopology, platformTopology } from './topology/topology'
+import { type CompiledDocument, type CompiledTopology, compileTopology, type PlatformTier, platformTopology } from './topology/topology'
 
-/** The one topology this command installs, so the project document and the services document cannot drift. */
-export const lightTopology = (environment: string): CompiledTopology =>
-	compileTopology(platformTopology({ env: environment, tier: 'light', publicAccess: 'zerops-subdomain' }), environment)
+/** The topology this command installs for a tier, so the project document and the services document cannot drift. */
+export const installationTopology = (environment: string, tier: PlatformTier): CompiledTopology =>
+	compileTopology(platformTopology({ env: environment, tier, publicAccess: 'zerops-subdomain' }), environment)
 
 /**
  * The services-only provisioning document (WU2), compiled from the declaration the committed artifact
  * is rendered from.
  *
  * Not read off disk: `gen:check` already proves
- * `packages/platform-artifacts/generated/platform-light.services.provision.zerops-import.yaml` is this exact text, and a
- * value needs no filesystem in a published package.
+ * `packages/platform-artifacts/generated/platform{,-light}.services.provision.zerops-import.yaml` is this exact text,
+ * and a value needs no filesystem in a published package.
  */
-export const provisioningDocument = (environment: string): CompiledDocument => {
-	const document = lightTopology(environment).servicesProvision
+export const provisioningDocument = (environment: string, tier: PlatformTier): CompiledDocument => {
+	const document = installationTopology(environment, tier).servicesProvision
 	if (document === undefined) {
-		throw new Error('the light platform topology declares no services-only provisioning document')
+		throw new Error(`the ${tier} platform topology declares no services-only provisioning document`)
 	}
 	return document
 }
@@ -64,7 +64,7 @@ export const assertNoServiceIsBeingCreated = (existing: ReadonlyMap<string, Exis
 	if (creating.length > 0) {
 		throw new Error(
 			`Zerops is still creating ${creating.join(', ')} — a service reads NEW with no environment at all, so nothing can be `
-				+ 'read from it or written to it yet. The light topology settles in about a minute; run the install again then',
+				+ 'read from it or written to it yet. The topology settles in a few minutes; run the install again then',
 		)
 	}
 }
@@ -99,8 +99,8 @@ export const assertNotAlreadyInstalled = async (
 			`this project already holds an installation's generated secrets — ${placed.join(', ')} ${placed.length === 1 ? 'is' : 'are'} already set. `
 				+ '`platform install` is a BRING-UP and would roll a new vault key and new signing keys over them, which is unrecoverable '
 				+ 'for the vault and logs everyone out. If every bootstrap variable was placed, use `fabrika platform deploy --provider=zerops` '
-				+ 'to update or finish deploying the installation; recover FABRIKA_IAM_PROVISIONING_KEY from `iam` or `control` and '
-				+ 'FABRIKA_ZEROPS_ACCESS_TOKEN from `control` in Zerops. Neither deploy nor init completes a partial bootstrap. '
+				+ 'to update or finish deploying the installation, with the credentials from the secrets file the first install wrote. '
+				+ 'Neither deploy nor init completes a partial bootstrap. '
 				+ 'For partial bootstrap, preserve the existing keys and arrange operator-owned recovery, or start a fresh installation in a separate empty project',
 		)
 	}