@fabrika/provider-zerops 0.4.1 → 0.4.3

package/src/installation/topology/topology.ts

@@ -117,12 +117,11 @@ export interface ProjectTopology {
 	/** The source declaration compiled into the generated topology artifacts. */
 	target: ZeropsSourceTarget
 	/**
-	 * The SAME services with no `project` block, for a project the operator created by hand.
+	 * The SAME services with no `project` block, for the project `platform install` created or was handed.
 	 *
 	 * A document carrying `project:` is only valid at `POST /client/{clientId}/project/import`, which
 	 * CREATES a project — and Zerops permits duplicate project names, so applying one at an existing
-	 * installation risks a second project rather than failing. Present only on the tiers a bootstrap
-	 * imports into an existing project.
+	 * installation risks a second project rather than failing. Present on both platform tiers.
 	 */
 	servicesTarget?: ZeropsSourceTarget
 	/** The one service allowed to be publicly routed (ADR-0022). Always the proxy. */
@@ -182,6 +181,107 @@ export const platformTopology = (options: TopologyOptions): ProjectTopology => {
 	if (tier === 'light') {
 		return lightPlatformTopology(options, publicAccess)
 	}
+	// ONE services function behind both targets, as on the light tier.
+	const services = (): ZeropsServiceSpec[] => [
+		// ── data, created first (priority is descending) ──────────────────────────────────
+		{
+			hostname: 'db',
+			// HA is encoded in the TYPE. The deprecated `mode` field is not merely avoided here — it
+			// is absent from `ZeropsServiceSpec`, so it cannot be written. One database serves both
+			// IAM and the control plane; they are separate schemas in it, not separate services,
+			// because a second HA Postgres triples the cost of the isolation the private network
+			// already gives us.
+			type: 'postgresql:ha@18',
+			// The identity and control-plane database: every login, every token mint, every run's
+			// state. `oltp-production` is also what an HA service gets by DEFAULT — stated here so
+			// the bill is a decision rather than a discovery, and because this is the one place the
+			// standard tier should pay for it: dedicated CPU is what keeps auth latency off the
+			// noisy-neighbour curve.
+			profile: 'oltp-production',
+			priority: 100,
+		},
+		{
+			hostname: 'storage',
+			// S3-compatible object storage: run logs (`FABRIKA_CONTROL_RUN_LOGS_*`) and deploy artifacts.
+			// `@fabrika/platform-node`'s `S3BlobStore` speaks to this unchanged — it is the same
+			// implementation that speaks to R2.
+			type: 'object-storage',
+			objectStorageSize: 25,
+			// Never `public-read`: a run log can quote a build's environment.
+			objectStoragePolicy: 'private',
+			// A CDN in front of private run logs would be a cache in front of a thing nobody reads twice.
+			enableCdn: false,
+			priority: 100,
+		},
+		{
+			hostname: 'operationsdb',
+			// Operations has an independent database service. This prevents its high-volume error
+			// history and migrations from sharing IAM/control's failure and capacity domain.
+			type: 'postgresql:ha@18',
+			// NOT `db`'s profile, and that is the point of stating both. `oltp-staging` keeps the
+			// same three-container redundancy and the same 8-core/48 GB ceiling, but starts at one
+			// SHARED core and 1 GB instead of two DEDICATED cores and 4 GB — measured off a live
+			// HA service, see `docs/reference/zerops-platform.md`. Error history is bursty and
+			// tolerant of jitter: slow ingest is a queue, not an outage. Holding two dedicated
+			// cores idle for it is the half of the default nobody chose.
+			profile: 'oltp-staging',
+			priority: 100,
+		},
+		{
+			hostname: 'operationsstorage',
+			type: 'object-storage',
+			objectStorageSize: 25,
+			objectStoragePolicy: 'private',
+			enableCdn: false,
+			priority: 100,
+		},
+		// ── services ──────────────────────────────────────────────────────────────────────
+		runtime({
+			hostname: 'iam',
+			type: 'alpine/bun@1.3',
+			priority: 50,
+			// Identity is on the critical path of every login and every cold-path token mint, and the
+			// service is stateless (its state is in `db`), so two containers cost little and remove a
+			// single point of failure the product cannot afford.
+			minContainers: 2,
+			maxContainers: 4,
+		}),
+		runtime({
+			hostname: 'operations',
+			type: 'alpine/bun@1.3',
+			priority: 40,
+			minContainers: 1,
+			maxContainers: 3,
+		}),
+		runtime({
+			hostname: 'control',
+			type: 'alpine/bun@1.3',
+			// IAM → Operations → proxy → control is the code deployment order too:
+			// control must never start against a missing private dependency.
+			priority: 20,
+			// Deliberately allowed to be a single container. The control plane is CRASH-SAFE across a
+			// deploy by design — it may trigger its own redeploy and die, then reconcile in-flight runs
+			// by polling `/app-version` on restart (ADR-0003) — so an outage window here is a delay,
+			// not a lost run. Scaling it out would also multiply the queue consumers for no gain.
+			minContainers: 1,
+			maxContainers: 2,
+		}),
+		runtime({
+			hostname: PROXY_HOSTNAME,
+			// Alpine custom runtime: a Caddy binary plus a compiled Bun auth service, no interpreter
+			// (ADR-0022). `run.os` is deprecated — the OS is the service type.
+			type: 'alpine@3.21',
+			priority: 30,
+			// THE ONLY PUBLICLY ROUTED SERVICE. Everything above is reachable only over the project's
+			// private network; the proxy is what the internet talks to, including for IAM's own OIDC
+			// login and the control-plane dashboard.
+			public: publicAccess === 'zerops-subdomain',
+			// It is on every request to every service in this project, and it is stateless by
+			// construction (ADR-0022 insists on that precisely so this line is allowed to exist).
+			minContainers: 2,
+			maxContainers: 6,
+		}),
+	]
 	return {
 		id: 'platform',
 		publicService: PROXY_HOSTNAME,
@@ -193,107 +293,9 @@ export const platformTopology = (options: TopologyOptions): ProjectTopology => {
 				corePackage: 'SERIOUS',
 				tags: ['fabrika', 'platform', options.env],
 			},
-			services: () => [
-				// ── data, created first (priority is descending) ──────────────────────────────────
-				{
-					hostname: 'db',
-					// HA is encoded in the TYPE. The deprecated `mode` field is not merely avoided here — it
-					// is absent from `ZeropsServiceSpec`, so it cannot be written. One database serves both
-					// IAM and the control plane; they are separate schemas in it, not separate services,
-					// because a second HA Postgres triples the cost of the isolation the private network
-					// already gives us.
-					type: 'postgresql:ha@18',
-					// The identity and control-plane database: every login, every token mint, every run's
-					// state. `oltp-production` is also what an HA service gets by DEFAULT — stated here so
-					// the bill is a decision rather than a discovery, and because this is the one place the
-					// standard tier should pay for it: dedicated CPU is what keeps auth latency off the
-					// noisy-neighbour curve.
-					profile: 'oltp-production',
-					priority: 100,
-				},
-				{
-					hostname: 'storage',
-					// S3-compatible object storage: run logs (`FABRIKA_CONTROL_RUN_LOGS_*`) and deploy artifacts.
-					// `@fabrika/platform-node`'s `S3BlobStore` speaks to this unchanged — it is the same
-					// implementation that speaks to R2.
-					type: 'object-storage',
-					objectStorageSize: 25,
-					// Never `public-read`: a run log can quote a build's environment.
-					objectStoragePolicy: 'private',
-					// A CDN in front of private run logs would be a cache in front of a thing nobody reads twice.
-					enableCdn: false,
-					priority: 100,
-				},
-				{
-					hostname: 'operationsdb',
-					// Operations has an independent database service. This prevents its high-volume error
-					// history and migrations from sharing IAM/control's failure and capacity domain.
-					type: 'postgresql:ha@18',
-					// NOT `db`'s profile, and that is the point of stating both. `oltp-staging` keeps the
-					// same three-container redundancy and the same 8-core/48 GB ceiling, but starts at one
-					// SHARED core and 1 GB instead of two DEDICATED cores and 4 GB — measured off a live
-					// HA service, see `docs/reference/zerops-platform.md`. Error history is bursty and
-					// tolerant of jitter: slow ingest is a queue, not an outage. Holding two dedicated
-					// cores idle for it is the half of the default nobody chose.
-					profile: 'oltp-staging',
-					priority: 100,
-				},
-				{
-					hostname: 'operationsstorage',
-					type: 'object-storage',
-					objectStorageSize: 25,
-					objectStoragePolicy: 'private',
-					enableCdn: false,
-					priority: 100,
-				},
-				// ── services ──────────────────────────────────────────────────────────────────────
-				runtime({
-					hostname: 'iam',
-					type: 'alpine/bun@1.3',
-					priority: 50,
-					// Identity is on the critical path of every login and every cold-path token mint, and the
-					// service is stateless (its state is in `db`), so two containers cost little and remove a
-					// single point of failure the product cannot afford.
-					minContainers: 2,
-					maxContainers: 4,
-				}),
-				runtime({
-					hostname: 'operations',
-					type: 'alpine/bun@1.3',
-					priority: 40,
-					minContainers: 1,
-					maxContainers: 3,
-				}),
-				runtime({
-					hostname: 'control',
-					type: 'alpine/bun@1.3',
-					// IAM → Operations → proxy → control is the code deployment order too:
-					// control must never start against a missing private dependency.
-					priority: 20,
-					// Deliberately allowed to be a single container. The control plane is CRASH-SAFE across a
-					// deploy by design — it may trigger its own redeploy and die, then reconcile in-flight runs
-					// by polling `/app-version` on restart (ADR-0003) — so an outage window here is a delay,
-					// not a lost run. Scaling it out would also multiply the queue consumers for no gain.
-					minContainers: 1,
-					maxContainers: 2,
-				}),
-				runtime({
-					hostname: PROXY_HOSTNAME,
-					// Alpine custom runtime: a Caddy binary plus a compiled Bun auth service, no interpreter
-					// (ADR-0022). `run.os` is deprecated — the OS is the service type.
-					type: 'alpine@3.21',
-					priority: 30,
-					// THE ONLY PUBLICLY ROUTED SERVICE. Everything above is reachable only over the project's
-					// private network; the proxy is what the internet talks to, including for IAM's own OIDC
-					// login and the control-plane dashboard.
-					public: publicAccess === 'zerops-subdomain',
-					// It is on every request to every service in this project, and it is stateless by
-					// construction (ADR-0022 insists on that precisely so this line is allowed to exist).
-					minContainers: 2,
-					maxContainers: 6,
-				}),
-			],
+			services,
 		},
+		servicesTarget: { platform: 'zerops', services },
 	}
 }
 
@@ -371,7 +373,6 @@ const lightPlatformTopology = (options: TopologyOptions, publicAccess: PublicAcc
 			},
 			services,
 		},
-		// The light tier is the one an operator installs into a project they created themselves.
 		servicesTarget: { platform: 'zerops', services },
 	}
 }

package/src/managed-env.ts

@@ -59,6 +59,17 @@ export const SERVICE_MANAGED_KEYS: readonly Exclude<ManagedKey, 'FABRIKA_RELEASE
 	'FABRIKA_IAM_RPC_KEY',
 ]
 
+/** The managed keys that carry a credential, written sensitive and therefore never compared. */
+export const SENSITIVE_MANAGED_KEYS: ReadonlySet<ManagedKey> = new Set<ManagedKey>([
+	'FABRIKA_OPERATIONS_DSN',
+	'FABRIKA_SERVICE_KEY',
+	'FABRIKA_PROXY_SECRET',
+	'FABRIKA_IAM_RPC_KEY',
+])
+
+/** A workload or connect key is a credential; a connect URL is an origin. */
+export const isSensitiveFamilyVariable = (name: string): boolean => !isConnectUrlVariable(name)
+
 export type ManagedValues = Record<ManagedKey, string | null>
 
 const managedValuesSchema = z.object({

package/src/manifest.ts

@@ -1,6 +1,7 @@
 import { appSchemaSchema } from '@fabrika/auth'
-import { type AppSchema, isDigest } from '@fabrika/auth-core'
-import type { JsonValue, ProviderCodec, ProviderEnvironment } from '@fabrika/provider-contract'
+import { type AppSchema, type ContractArtifact, isDigest } from '@fabrika/auth-core'
+import type { OperationsSourceMapBuildUpload } from '@fabrika/operations-contract/releases'
+import type { JsonValue, ProviderCodec, ProviderDeployInput, ProviderEnvironment } from '@fabrika/provider-contract'
 import { proxyEndpointRowSchema } from '@fabrika/proxy-core/manifest'
 import { z } from 'zod'
 import { compileImport, ENV_ISOLATION, OVERRIDE, renderYaml } from './compile'
@@ -11,6 +12,7 @@ import {
 	LOCKED_APP_ID_PATTERN,
 	lockedAuthoredBuild,
 	ZEROPS_RUNTIME_PACKAGES,
+	zeropsAssetRoots,
 	type ZeropsContractRun,
 	zeropsContractRun,
 	type ZeropsLockedExecution,
@@ -420,6 +422,7 @@ export const lockedExecutionOf = (manifest: FabrikaManifest): ZeropsLockedExecut
 		databaseUrl: applicationDatabaseUrl(manifest.target.importDocument.services, manifest.target.namespaceResources),
 		storageHostname: applicationStorageHostname(manifest.target.importDocument.services),
 		runtimePackages: manifest.target.runtimePackages ?? [],
+		sourceMaps: null,
 	}
 }
 
@@ -430,7 +433,12 @@ export type ZeropsAccess = Pick<ProviderEnvironment, 'access'>
  * The execution descriptor's lock-down at deploy (ADR-0050): Control's approved contract decides it, not the artifact,
  * so a configuration cannot drop it. Without an approved contract nothing deploys outside a dry run.
  */
-export function lockedExecutionFor(manifest: FabrikaManifest, granted: ZeropsAccess, dryRun: boolean): ZeropsLockedExecution | null {
+export function lockedExecutionFor(
+	manifest: FabrikaManifest,
+	granted: ZeropsAccess,
+	dryRun: boolean,
+	artifactUpload?: ProviderDeployInput['artifactUpload'],
+): ZeropsLockedExecution | null {
 	const access = granted.access
 	if (access === undefined) {
 		if (dryRun) return null
@@ -445,9 +453,23 @@ export function lockedExecutionFor(manifest: FabrikaManifest, granted: ZeropsAcc
 		databaseUrl: applicationDatabaseUrl(manifest.target.importDocument.services, manifest.target.namespaceResources),
 		storageHostname: applicationStorageHostname(manifest.target.importDocument.services),
 		runtimePackages: manifest.target.runtimePackages ?? [],
+		sourceMaps: artifactUpload === undefined ? null : sourceMapUpload(artifactUpload, access.contract),
 	}
 }
 
+/** The build's upload: Control's destination without its bearer, and the approved contract's asset roots. */
+const sourceMapUpload = (upload: NonNullable<ProviderDeployInput['artifactUpload']>, contract: ContractArtifact): OperationsSourceMapBuildUpload => ({
+	destination: {
+		url: upload.url,
+		appId: upload.appId,
+		environment: upload.environment,
+		serviceKey: upload.serviceKey,
+		release: upload.release,
+		runId: upload.runId,
+	},
+	assetRoots: zeropsAssetRoots(contract),
+})
+
 /** The IAM schema a deploy, cancel or reconcile applies: the approved contract's. `undefined` reconciles nothing. */
 export function approvedSchemaOf(granted: ZeropsAccess): AppSchema | undefined {
 	return granted.access?.schema

package/src/namespace/codec.ts

@@ -10,6 +10,9 @@ import { commitShaSchema, identifierSchema, rejectExplicitUndefined, repositoryS
 import { namespaceProxySourceSchema } from './proxy-source'
 import type { NormalizedZeropsNamespaceTarget, ZeropsNamespaceOptions, ZeropsNamespaceProxySource, ZeropsNamespaceTarget } from './types'
 
+/** The one value an update may give `proxySource`: re-pin the namespace's proxy to the installation's default. */
+export const ZEROPS_PROXY_SOURCE_CURRENT = 'current'
+
 const encodeSource = (source: ZeropsNamespaceProxySource): JsonValue => ({
 	repository: { ...source.repository },
 	commitSha: source.commitSha,
@@ -73,10 +76,12 @@ const namespaceTargetSchema = namespaceTargetShape.transform((target) => {
 /**
  * What an update request's payload may name: any target field, each optional, and no field the target
  * does not have — at the top level or inside `postgres`. The target schema STRIPS an unknown key, which
- * would turn a misspelt field into a silent no-op.
+ * would turn a misspelt field into a silent no-op. `proxySource` also takes `current`, the installation's
+ * default pin; the plan refuses any other pin than that one (ADR-0045).
  */
 export const namespaceUpdatePayloadSchema = namespaceTargetShape.partial().extend({
 	postgres: z.discriminatedUnion('type', [haPostgresSchema.strict(), singlePostgresSchema.strict()]).optional(),
+	proxySource: z.union([z.literal(ZEROPS_PROXY_SOURCE_CURRENT), namespaceProxySourceSchema]).optional(),
 }).strict()
 
 export const zeropsNamespaceTargetCodec: ProviderCodec<ZeropsNamespaceTarget> = {

package/src/namespace/errors.ts

@@ -1,5 +1,5 @@
 import { ProviderNamespaceError } from '@fabrika/provider-contract'
-import { ZeropsApiError } from '../api'
+import { ZeropsApiError, ZeropsServiceEnvValueTooLargeError } from '../api'
 
 /**
  * Lifecycle codes this provider defines where the platform has none of its own. They are an
@@ -41,6 +41,8 @@ const splitApiMessage = (message: string, code: string): { summary: string; deta
 /** Every namespace lifecycle failure leaves this provider as one typed, coded error. */
 export const asNamespaceError = (cause: unknown, mode: 'provision' | 'reconcile' | 'update'): ProviderNamespaceError => {
 	if (cause instanceof ProviderNamespaceError) return cause
+	// The same value is refused again on every retry; only a smaller manifest or a new carrier fixes it.
+	if (cause instanceof ZeropsServiceEnvValueTooLargeError) return namespaceError(cause.code, cause.message, false)
 	if (cause instanceof ZeropsApiError) {
 		const { summary, detail } = splitApiMessage(cause.message, cause.code)
 		return namespaceError(

package/src/namespace/provisioning.ts

@@ -6,7 +6,16 @@ import {
 	type ProviderNamespaceRepublishInput,
 	type ProviderNamespaceRepublishResult,
 } from '@fabrika/provider-contract'
-import { waitForProcess, ZEROPS_SERVICE_NOT_HTTP, ZEROPS_TERMINAL, ZeropsApiError, type ZeropsProject, type ZeropsService } from '../api'
+import {
+	enableSubdomainAccessWhenHttp,
+	readableContent,
+	waitForProcess,
+	ZEROPS_SERVICE_NOT_HTTP,
+	ZEROPS_TERMINAL,
+	ZeropsApiError,
+	type ZeropsProject,
+	type ZeropsService,
+} from '../api'
 import { defaultSleep } from '../collaborators'
 import { namespaceResourceClaims, registrationResourceClaims } from './claims'
 import { checkpoint, decodeEnvelope, normalizedNamespace, normalizeTarget } from './codec'
@@ -179,8 +188,8 @@ const readProxyHosts = async (
 	}
 	try {
 		const variables = await options.api.listServiceEnv({ serviceId: proxyServiceId, signal })
-		const subdomains = variables.find((variable) => variable.key === ZEROPS_NAMESPACE_SUBDOMAIN_VARIABLE)
-		return subdomains === undefined ? [] : parseZeropsProxyHosts(subdomains.content)
+		const subdomains = readableContent(variables.find((variable) => variable.key === ZEROPS_NAMESPACE_SUBDOMAIN_VARIABLE))
+		return subdomains === undefined ? [] : parseZeropsProxyHosts(subdomains)
 	} catch {
 		// A host listing is a convenience; the proxy is already built, deployed and published. Failing the
 		// namespace over it would report a placement that WORKS as broken. Never the cause: it can carry
@@ -217,6 +226,7 @@ const deployProxy = async (
 	let currentNamespace = namespace
 	const manifest = compileNamespaceProxyManifest(namespace.id, input.members)
 	const result = await republishProxy({
+		namespaceId: namespace.id,
 		target,
 		manifest,
 		proxySecrets: namespaceProxySecrets(manifest, input.members),
@@ -264,6 +274,9 @@ const republishNamespace = async (
  *
  * The decision is the READ-BACK, never the call returning. On an already-published service the platform
  * answers 2xx and then fails the process it handed back — live-verified — so a 2xx proves nothing.
+ *
+ * The HTTP ports lag the proxy's ACTIVE version, so `serviceStackIsNotHttp` is retried for a bounded
+ * window (`enableSubdomainAccessWhenHttp`) before it fails the namespace.
  */
 const ensureSubdomainAccess = async (
 	target: NormalizedZeropsNamespaceTarget,
@@ -279,12 +292,12 @@ const ensureSubdomainAccess = async (
 		return
 	}
 	try {
-		await options.api.enableSubdomainAccess({ serviceId: proxyServiceId, signal })
+		await enableSubdomainAccessWhenHttp({ api: options.api, serviceId: proxyServiceId, sleep: options.sleep ?? defaultSleep, signal })
 	} catch (error) {
 		if (error instanceof ZeropsApiError && error.code === ZEROPS_SERVICE_NOT_HTTP) {
 			throw namespaceError(
 				ZEROPS_SERVICE_NOT_HTTP,
-				`Zerops namespace proxy ${proxyServiceId} cannot be published on a zerops.app subdomain: it exposes no deployed HTTP port (${ZEROPS_SERVICE_NOT_HTTP})`,
+				`Zerops namespace proxy ${proxyServiceId} cannot be published on a zerops.app subdomain: it still exposes no deployed HTTP port (${ZEROPS_SERVICE_NOT_HTTP}) minutes after its deploy`,
 				false,
 			)
 		}

package/src/namespace/proxy-attempt.ts

@@ -1,8 +1,17 @@
 import { followLeaseLoss, isLeaseLoss, ProviderNamespaceError } from '@fabrika/provider-contract'
 import { encodeProxyManifestJson, FABRIKA_PROXY_MANIFEST_JSON, type ProxyManifest } from '@fabrika/proxy-core/manifest'
-import { ZEROPS_ACTIVE, ZEROPS_TERMINAL, type ZeropsApi, ZeropsApiError, type ZeropsAppVersion } from '../api'
+import {
+	readableContent,
+	ZEROPS_ACTIVE,
+	ZEROPS_TERMINAL,
+	type ZeropsApi,
+	ZeropsApiError,
+	type ZeropsAppVersion,
+	ZeropsServiceEnvValueTooLargeError,
+} from '../api'
 import type { Sleeper } from '../collaborators'
 import { prepareZeropsDescriptor } from '../descriptor'
+import { ZEROPS_PROXY_MANIFEST_PATH, type ZeropsProxyManifestCarrier, zeropsProxyManifestCarrier } from '../proxy-manifest-carrier'
 import { isZeropsUploadDestination } from '../source'
 import type { ZeropsSourcePort } from '../source/port'
 import { deleteVersion } from '../version-attempt'
@@ -12,10 +21,18 @@ import type { ZeropsNamespaceProxyBuild, ZeropsNamespaceTarget } from './types'
 
 export type ZeropsProxyApi = Pick<
 	ZeropsApi,
-	'listServiceEnv' | 'putServiceEnv' | 'createAppVersion' | 'deleteAppVersion' | 'buildAndDeployAppVersion' | 'getAppVersion'
+	| 'listServiceEnv'
+	| 'putServiceEnv'
+	| 'deleteServiceEnv'
+	| 'createAppVersion'
+	| 'deleteAppVersion'
+	| 'buildAndDeployAppVersion'
+	| 'getAppVersion'
 >
 
 export interface ZeropsProxyRepublishInput {
+	/** The namespace's id, named in the one refusal an operator acts on: re-pin it. */
+	readonly namespaceId: string
 	readonly target: ZeropsNamespaceTarget
 	readonly manifest: ProxyManifest
 	readonly source?: ZeropsSourcePort
@@ -46,19 +63,24 @@ const digest = async (text: string): Promise<string> =>
 		'',
 	)
 
-const writeProxyIam = async (input: ZeropsProxyRepublishInput, serviceId: string): Promise<void> => {
+const writeProxyIam = async (input: ZeropsProxyRepublishInput, serviceId: string, carrier: ZeropsProxyManifestCarrier): Promise<void> => {
 	const { api, signal } = input
 	const variables = await api.listServiceEnv({ serviceId, signal })
-	if (variables.find(variable => variable.key === SESSION_OWNER_VARIABLE)?.content !== 'null') {
-		await api.putServiceEnv({ serviceId, key: SESSION_OWNER_VARIABLE, value: 'null', signal })
+	// The archive carries the manifest now; a copy left in the environment would describe nothing the proxy serves.
+	const stale = variables.find(variable => variable.key === FABRIKA_PROXY_MANIFEST_JSON)
+	if (carrier === 'archive' && stale !== undefined) {
+		await api.deleteServiceEnv({ envId: stale.id, signal })
 	}
-	if (variables.find(variable => variable.key === ZEROPS_NAMESPACE_IAM_ISSUER_VARIABLE)?.content !== input.iamUrl) {
-		await api.putServiceEnv({ serviceId, key: ZEROPS_NAMESPACE_IAM_ISSUER_VARIABLE, value: input.iamUrl, signal })
+	if (readableContent(variables.find(variable => variable.key === SESSION_OWNER_VARIABLE)) !== 'null') {
+		await api.putServiceEnv({ serviceId, key: SESSION_OWNER_VARIABLE, value: 'null', sensitive: false, signal })
 	}
-	// Secret read-back is not trustworthy, so overwrite it without inspecting its value.
-	await api.putServiceEnv({ serviceId, key: ZEROPS_NAMESPACE_IAM_KEY_VARIABLE, value: input.iamKey, signal })
+	if (readableContent(variables.find(variable => variable.key === ZEROPS_NAMESPACE_IAM_ISSUER_VARIABLE)) !== input.iamUrl) {
+		await api.putServiceEnv({ serviceId, key: ZEROPS_NAMESPACE_IAM_ISSUER_VARIABLE, value: input.iamUrl, sensitive: false, signal })
+	}
+	// A secret cannot be read back, so it is overwritten without inspecting its value.
+	await api.putServiceEnv({ serviceId, key: ZEROPS_NAMESPACE_IAM_KEY_VARIABLE, value: input.iamKey, sensitive: true, signal })
 	for (const [key, value] of input.proxySecrets ?? []) {
-		await api.putServiceEnv({ serviceId, key, value, signal })
+		await api.putServiceEnv({ serviceId, key, value, sensitive: true, signal })
 	}
 }
 
@@ -76,6 +98,8 @@ export async function republishProxy(input: ZeropsProxyRepublishInput): Promise<
 	const serviceId = input.target.proxyServiceId
 	if (serviceId === undefined) throw new Error('Zerops namespace has no proxy service id')
 	await verifyZeropsNamespaceProxySource(pin)
+	// The pinned descriptor decides: a namespace kept on an older proxy revision still lifts the variable (ADR-0045).
+	const carrier = zeropsProxyManifestCarrier(pin.descriptor.contents)
 	const manifest = encodeProxyManifestJson(input.manifest)
 	// The attempt's identity covers the IAM configuration and the proxy secrets too, so rotating any forces a rebuild.
 	const proxySecrets = input.proxySecrets ?? new Map<string, string>()
@@ -162,8 +186,20 @@ export async function republishProxy(input: ZeropsProxyRepublishInput): Promise<
 		throw new Error('Proxy source resolution identity mismatch')
 	}
 	await input.boundary()
-	await input.api.putServiceEnv({ serviceId, key: FABRIKA_PROXY_MANIFEST_JSON, value: manifest, signal: input.signal })
-	await writeProxyIam(input, serviceId)
+	if (carrier === 'environment') {
+		try {
+			await input.api.putServiceEnv({ serviceId, key: FABRIKA_PROXY_MANIFEST_JSON, value: manifest, sensitive: false, signal: input.signal })
+		} catch (cause) {
+			if (!(cause instanceof ZeropsServiceEnvValueTooLargeError)) throw cause
+			throw new ProviderNamespaceError(
+				`${cause.message}. The namespace's proxy source predates the manifest file in the build archive; re-pin it with `
+					+ `\`fabrika control namespaces update --namespace=${input.namespaceId} --proxy-source=current\``,
+				cause.code,
+				false,
+			)
+		}
+	}
+	await writeProxyIam(input, serviceId, carrier)
 	input.signal.throwIfAborted()
 	const reserved = await input.api.createAppVersion({ serviceId, name: runId, signal: input.signal })
 	let build: ZeropsNamespaceProxyBuild = { appVersionId: reserved.id, triggered: false, manifestSha256 }
@@ -176,11 +212,17 @@ export async function republishProxy(input: ZeropsProxyRepublishInput): Promise<
 			repository: pin.repository,
 			commitSha: pin.commitSha,
 			descriptorSha256: pin.descriptor.sha256,
-			archive: { kind: 'platform' },
+			archive: carrier === 'archive'
+				? { kind: 'platform', dataFile: { path: ZEROPS_PROXY_MANIFEST_PATH, contents: manifest } }
+				: { kind: 'platform' },
 			uploadUrl: reserved.uploadUrl,
 			signal: input.signal,
 		})
-		if (uploaded.commitSha !== pin.commitSha || uploaded.descriptorSha256 !== pin.descriptor.sha256) {
+		const expectedDataFile = carrier === 'archive' ? await digest(manifest) : undefined
+		if (
+			uploaded.commitSha !== pin.commitSha || uploaded.descriptorSha256 !== pin.descriptor.sha256
+			|| uploaded.dataFileSha256 !== expectedDataFile
+		) {
 			throw new Error('Proxy source upload identity mismatch')
 		}
 		const descriptor = prepareZeropsDescriptor(pin.descriptor.contents, 'proxy')

package/src/namespace/update.ts

@@ -9,8 +9,9 @@ import {
 } from '@fabrika/provider-contract'
 import { waitForProcess, ZeropsApiError, type ZeropsProcess } from '../api'
 import { defaultSleep } from '../collaborators'
-import { envelope, namespaceUpdatePayloadSchema, normalizeTarget, zeropsNamespaceTargetCodec } from './codec'
+import { envelope, namespaceUpdatePayloadSchema, normalizeTarget, ZEROPS_PROXY_SOURCE_CURRENT, zeropsNamespaceTargetCodec } from './codec'
 import { asNamespaceError, namespaceError, ZEROPS_NAMESPACE_CANCELLED } from './errors'
+import { verifyZeropsNamespaceProxySource } from './proxy-source'
 import type { NormalizedZeropsNamespaceTarget, ZeropsNamespaceOptions, ZeropsNamespacePostgres, ZeropsNamespaceTarget } from './types'
 import { validateService } from './validation'
 
@@ -21,11 +22,16 @@ const READBACK_INTERVAL_MS = 3_000
 /** UNVERIFIED: how soon `autoscalingProfileId` reads the new profile after the PUT and its process finish. */
 const READBACK_ATTEMPTS = 10
 
-type FixedField = Exclude<keyof ZeropsNamespaceTarget, 'postgres'>
+/** The plan field of a re-pin, which moves only the stored target; the reconcile core queues rebuilds the proxy. */
+export const ZEROPS_PROXY_SOURCE_FIELD = 'proxySource'
 
-/** Every target field but `postgres`, whose profile is the one thing an update may move. A new field fails to compile until listed. */
+type FixedField = Exclude<keyof ZeropsNamespaceTarget, 'postgres' | 'proxySource'>
+
+/**
+ * Every target field but the two an update may move: the PostgreSQL profile, and the proxy source pin, which only an
+ * explicit re-pin to the installation's default moves (ADR-0045). A new field fails to compile until listed.
+ */
 const FIXED_FIELDS: { readonly [K in FixedField]: (target: ZeropsNamespaceTarget) => ZeropsNamespaceTarget[K] } = {
-	proxySource: (target) => target.proxySource,
 	proxyBuild: (target) => target.proxyBuild,
 	proxyDeployment: (target) => target.proxyDeployment,
 	projectName: (target) => target.projectName,
@@ -69,10 +75,17 @@ const mergedTarget = (
 	if (typeof stored !== 'object' || stored === null || Array.isArray(stored)) {
 		throw new Error('Zerops namespace target did not encode to an object')
 	}
-	return normalizeTarget({ ...namespace, target: { ...requested, payload: { ...stored, ...payload } } }, options)
+	if (checked.data.proxySource !== ZEROPS_PROXY_SOURCE_CURRENT) {
+		return normalizeTarget({ ...namespace, target: { ...requested, payload: { ...stored, ...payload } } }, options)
+	}
+	const fields = Object.fromEntries(Object.entries(payload).filter(([key]) => key !== 'proxySource'))
+	return {
+		...normalizeTarget({ ...namespace, target: { ...requested, payload: { ...stored, ...fields } } }, options),
+		proxySource: options.proxySource,
+	}
 }
 
-/** Refuse every difference except the PostgreSQL profile, naming the fields. */
+/** Refuse every difference except the PostgreSQL profile and a re-pin of the proxy source, naming the fields. */
 const planUpdate = (
 	namespace: ProviderDeploymentNamespace,
 	requested: ProviderEnvelope,
@@ -84,8 +97,32 @@ const planUpdate = (
 		.filter(([, read]) => JSON.stringify(read(current)) !== JSON.stringify(read(merged)))
 		.map(([field]) => field)
 	if (changed.length > 0) {
-		throw immutable(`Zerops namespace ${namespace.id} cannot change ${changed.join(', ')} in place; only the PostgreSQL profile can`)
+		throw immutable(
+			`Zerops namespace ${namespace.id} cannot change ${changed.join(', ')} in place; only the PostgreSQL profile and the proxy source can`,
+		)
+	}
+	if (JSON.stringify(current.proxySource) === JSON.stringify(merged.proxySource)) return planProfile(namespace, current, merged)
+	if (JSON.stringify(merged.proxySource) !== JSON.stringify(options.proxySource)) {
+		throw new Error(`Zerops namespace ${namespace.id} can re-pin its proxy source only to the installation's default: proxySource "current"`)
+	}
+	if (JSON.stringify(current.postgres) !== JSON.stringify(merged.postgres)) {
+		throw new Error(`Zerops namespace ${namespace.id}: re-pin the proxy source and change the PostgreSQL profile in separate updates`)
+	}
+	// Rebuilding under a new pin settles an attempt first, and would record that attempt's version as the new pin's.
+	if (current.proxyBuild !== undefined) {
+		throw new Error(`Zerops namespace ${namespace.id} has a proxy build in flight; reconcile it before re-pinning the proxy source`)
+	}
+	return {
+		namespace: { ...namespace, target: envelope(merged) },
+		change: { field: ZEROPS_PROXY_SOURCE_FIELD, from: current.proxySource.commitSha, to: merged.proxySource.commitSha },
 	}
+}
+
+const planProfile = (
+	namespace: ProviderDeploymentNamespace,
+	current: NormalizedZeropsNamespaceTarget,
+	merged: NormalizedZeropsNamespaceTarget,
+): ProviderNamespaceUpdatePlan => {
 	const was = current.postgres
 	const wanted = merged.postgres
 	const unchanged: ProviderNamespaceUpdatePlan = { namespace: { ...namespace, target: envelope(current) }, change: null }
@@ -186,10 +223,15 @@ const applyProfile = async (
 
 const applyUpdate = async (input: ProviderNamespaceUpdateInput, options: ZeropsNamespaceOptions): Promise<ProviderDeploymentNamespace> => {
 	const current = normalizeTarget(input.namespace, options)
+	const plan = planUpdate(input.namespace, input.next.target, options)
+	// A re-pin touches no platform resource: it stores the pin, and the reconcile core queues builds from it.
+	if (plan.change?.field === ZEROPS_PROXY_SOURCE_FIELD) {
+		await verifyZeropsNamespaceProxySource(normalizeTarget(plan.namespace, options).proxySource)
+		return plan.namespace
+	}
 	if (!current.ready) {
 		throw new Error(`Zerops namespace ${input.namespace.id} is not ready`)
 	}
-	const plan = planUpdate(input.namespace, input.next.target, options)
 	const wanted = normalizeTarget(plan.namespace, options).postgres
 	// Checked even with no planned change: after an unconfirmed update, confirming the live service is
 	// what lets core return the namespace to ready.