@fabrika/provider-zerops 0.4.1 → 0.4.3

package/src/provider.ts

@@ -8,19 +8,22 @@
 // runs. Recovery never resumes a deploy (ADR-0044): a version reserved but never triggered is deleted, and
 // one whose build may have been requested is settled only by polling it.
 
-import { appEnvironmentId } from '@fabrika/auth-core'
+import { appEnvironmentId, FABRIKA_SOURCE_MAP_UPLOAD_KEY } from '@fabrika/auth-core'
+import { type OperationsSourceMapUploadState, readSourceMapUploadReport } from '@fabrika/operations-contract/releases'
 import {
 	type DeployStepResult,
 	followLeaseLoss,
 	isLeaseLoss,
 	type JsonValue,
 	type ProviderApprovedAccess,
+	type ProviderDeployInput,
 	ProviderInvocationAbort,
 	type ProviderManagedEnvironment,
 	type ProviderRunEvents,
 	runSteps,
 } from '@fabrika/provider-contract'
 import {
+	readableContent,
 	waitForProcess,
 	ZEROPS_ACTIVE,
 	ZEROPS_PROCESS_FINISHED,
@@ -47,9 +50,11 @@ import {
 	assertAuthoredManagedDocument,
 	assertAuthoredManagedInputs,
 	isFrameworkFamilyVariable,
+	isSensitiveFamilyVariable,
 	type ManagedValues,
 	overlayRelease,
 	parseManagedEnvironment,
+	SENSITIVE_MANAGED_KEYS,
 	SERVICE_MANAGED_KEYS,
 } from './managed-env'
 import {
@@ -81,6 +86,8 @@ export interface ZeropsDeployRun {
 	readonly artifact: FabrikaManifest
 	/** Control's approved access for the environment (ADR-0050); the lock-down and the IAM schema come from it. */
 	readonly access?: ProviderApprovedAccess
+	/** The run-scoped source-map destination Control minted; the build uploads to it. */
+	readonly artifactUpload?: ProviderDeployInput['artifactUpload']
 	readonly dryRun: boolean
 	readonly signal: AbortSignal
 	readonly events: ProviderRunEvents
@@ -91,6 +98,8 @@ export interface ZeropsDeployResult {
 	readonly env: string
 	readonly status: 'succeeded' | 'failed'
 	readonly steps: readonly DeployStepResult[]
+	/** Whether the build's source maps reached Operations; absent when the run had no upload to make. */
+	readonly artifactState?: OperationsSourceMapUploadState
 }
 
 /** How often `await-version` asks Zerops for the version's status. */
@@ -271,6 +280,8 @@ interface Attempt {
 	uploadUrl?: string
 	processId?: string
 	triggered: boolean
+	/** What the build's source-map upload reported in its log, once a relayed line said so. */
+	sourceMaps?: OperationsSourceMapUploadState
 }
 
 /** Everything one step's executor needs, bundled so the per-kind handlers stay small. */
@@ -353,6 +364,8 @@ const relayLog = async (
 			}
 			seen.add(key)
 			env.log(`  │ ${line.message}`)
+			const reported = readSourceMapUploadReport(line.message)
+			if (reported !== null) env.attempt.sourceMaps = reported
 		}
 	} catch (error) {
 		env.log(`  [warn] build-log relay unavailable: ${error instanceof Error ? error.message : 'unknown error'}`)
@@ -452,8 +465,8 @@ const verifyExposure = async (env: StepEnv): Promise<void> => {
 	const created = env.attempt.created ?? new Map<string, string>()
 	const buckets = artifact.target.importDocument.services.filter((service) => isObjectStorageType(service.type)).map((service) => service.hostname)
 	const records = buckets.length === 0 ? [] : await zerops.api.listServiceEnv({ serviceId: target.serviceId, signal })
-	const marker = records.find((record) => record.key === STORAGE_PROVENANCE_KEY)
-	const known = new Set([...parseStorageProvenance(marker?.content), ...(target.createdBuckets ?? [])])
+	const marker = readableContent(records.find((record) => record.key === STORAGE_PROVENANCE_KEY))
+	const known = new Set([...parseStorageProvenance(marker), ...(target.createdBuckets ?? [])])
 	const findings: ExposureFinding[] = []
 	const bucketIds: string[] = []
 	for (const hostname of manifestServiceHostnames(artifact)) {
@@ -502,8 +515,13 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 	const { zerops, log, signal, managedValues, familyVariables } = env
 	const serviceId = env.run.target.serviceId
 	if (env.dryRun) {
-		const written = [...SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] !== null), ...Object.keys(familyVariables)]
-		const removed = SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] === null)
+		const upload = env.run.artifactUpload !== undefined
+		const written = [
+			...SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] !== null),
+			...Object.keys(familyVariables),
+			...(upload ? [FABRIKA_SOURCE_MAP_UPLOAD_KEY] : []),
+		]
+		const removed = [...SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] === null), ...(upload ? [] : [FABRIKA_SOURCE_MAP_UPLOAD_KEY])]
 		log(`  [dry-run] would write service variables on ${serviceId}: ${written.join(', ') || '(none)'}`)
 		log(`  [dry-run] would remove service variables on ${serviceId} if present: ${removed.join(', ') || '(none)'}`)
 		if (Object.keys(familyVariables).length > 0) {
@@ -517,9 +535,10 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 	for (const key of SERVICE_MANAGED_KEYS) {
 		const value = managedValues[key]
 		const existing = records.find((record) => record.key === key)
+		const sensitive = SENSITIVE_MANAGED_KEYS.has(key)
 		assertRunning(signal)
-		if (value !== null && existing?.content !== value) {
-			await zerops.api.putServiceEnv({ serviceId, key, value, signal })
+		if (value !== null && (sensitive || readableContent(existing) !== value)) {
+			await zerops.api.putServiceEnv({ serviceId, key, value, sensitive, signal })
 			log(`  ${key}: updated`)
 		} else if (value === null && existing !== undefined) {
 			await zerops.api.deleteServiceEnv({ envId: existing.id, signal })
@@ -530,9 +549,10 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 	}
 	const provenance = env.attempt.storageProvenance
 	const marker = records.find((record) => record.key === STORAGE_PROVENANCE_KEY)
-	if (typeof provenance === 'string' && marker?.content !== provenance) {
+	if (typeof provenance === 'string' && readableContent(marker) !== provenance) {
 		assertRunning(signal)
-		await zerops.api.putServiceEnv({ serviceId, key: STORAGE_PROVENANCE_KEY, value: provenance, signal })
+		// Not a credential, and the exposure read-back above reads it: it must stay readable.
+		await zerops.api.putServiceEnv({ serviceId, key: STORAGE_PROVENANCE_KEY, value: provenance, sensitive: false, signal })
 		log(`  ${STORAGE_PROVENANCE_KEY}: updated`)
 	} else if (provenance === null && marker !== undefined) {
 		assertRunning(signal)
@@ -542,9 +562,10 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 	// A workload key is written like a managed key; one whose workload is gone is removed, so no stale key stays readable.
 	for (const [key, value] of Object.entries(familyVariables)) {
 		const existing = records.find((record) => record.key === key)
+		const sensitive = isSensitiveFamilyVariable(key)
 		assertRunning(signal)
-		if (existing?.content !== value) {
-			await zerops.api.putServiceEnv({ serviceId, key, value, signal })
+		if (sensitive || readableContent(existing) !== value) {
+			await zerops.api.putServiceEnv({ serviceId, key, value, sensitive, signal })
 			log(`  ${key}: updated`)
 		} else {
 			log(`  ${key}: unchanged`)
@@ -557,6 +578,18 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 			log(`  ${record.key}: removed`)
 		}
 	}
+	// The build lifts the upload's bearer from here (`${RUNTIME_…}`), so the descriptor never holds it.
+	const bearer = env.run.artifactUpload?.bearer ?? null
+	const uploadKey = records.find((record) => record.key === FABRIKA_SOURCE_MAP_UPLOAD_KEY)
+	if (bearer !== null) {
+		assertRunning(signal)
+		await zerops.api.putServiceEnv({ serviceId, key: FABRIKA_SOURCE_MAP_UPLOAD_KEY, value: bearer, sensitive: true, signal })
+		log(`  ${FABRIKA_SOURCE_MAP_UPLOAD_KEY}: updated`)
+	} else if (uploadKey !== undefined) {
+		assertRunning(signal)
+		await zerops.api.deleteServiceEnv({ envId: uploadKey.id, signal })
+		log(`  ${FABRIKA_SOURCE_MAP_UPLOAD_KEY}: removed`)
+	}
 }
 
 /** Run one step's effect. Resolves on success, throws on failure (caught + recorded by `runSteps`). */
@@ -655,7 +688,7 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 		}
 
 		case 'trigger-build': {
-			const locked = lockedExecutionFor(artifact, run, dryRun)
+			const locked = lockedExecutionFor(artifact, run, dryRun, run.artifactUpload)
 			if (dryRun) {
 				log(
 					locked === null
@@ -673,6 +706,7 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 				: renderLockedExecutionDescriptor(contents, artifact.target.zeropsSetup, release, locked)
 			if (locked !== null) {
 				log(`  generated run section; build checks @fabrika/check@${FABRIKA_CHECK_VERSION}, typescript@${PLATFORM_TYPESCRIPT_VERSION}`)
+				if (locked.sourceMaps !== null) log(`  the build uploads the source maps of ${locked.sourceMaps.assetRoots.length} asset root(s)`)
 			}
 			assertRunning(signal)
 			// Recorded BEFORE the request: from here on the version is settled only by polling it (ADR-0044).
@@ -804,5 +838,15 @@ async (run: ZeropsDeployRun): Promise<ZeropsDeployResult> => {
 			run.events.log(`  [warn] app-version ${appVersionId} could not be deleted; it was never built`)
 		}
 	}
-	return { appId: run.appId, env: run.env, ...result }
+	return { appId: run.appId, env: run.env, ...result, ...artifactStateOf(run, result.status, env.attempt) }
+}
+
+/** A run that uploads reports `complete` only when its build log said so; a missing or unread report is `incomplete`. */
+const artifactStateOf = (
+	run: ZeropsDeployRun,
+	status: ZeropsDeployResult['status'],
+	attempt: Attempt,
+): Pick<ZeropsDeployResult, 'artifactState'> => {
+	if (run.artifactUpload === undefined || run.dryRun || status !== 'succeeded') return {}
+	return { artifactState: attempt.sourceMaps === 'complete' ? 'complete' : 'incomplete' }
 }

package/src/proxy-manifest-carrier.ts

@@ -0,0 +1,32 @@
+import { FABRIKA_PROXY_MANIFEST_JSON } from '@fabrika/proxy-core/manifest'
+import { z } from 'zod'
+import { appliedZeropsSetups, parseZeropsDescriptor, selectZeropsDescriptorSetup } from './descriptor'
+
+/** The path of the proxy manifest in the build archive: the archive's one data file (ADR-0045), read by the proxy build. */
+export const ZEROPS_PROXY_MANIFEST_PATH = 'proxy.manifest.json'
+
+/**
+ * How a proxy build receives its manifest.
+ *
+ * - `environment`: the build lifts `FABRIKA_PROXY_MANIFEST_JSON` from the service and writes it to the file, as every
+ *   release before the archive carrier did. A namespace pinned to such a commit keeps its descriptor (ADR-0045), so it
+ *   gets the variable, bound by the Zerops value limit.
+ * - `archive`: the build reads the file the uploaded archive carries.
+ */
+export type ZeropsProxyManifestCarrier = 'environment' | 'archive'
+
+const buildSectionSchema = z.object({ build: z.object({ envVariables: z.record(z.string()).optional() }).passthrough() }).passthrough()
+
+/**
+ * The carrier a descriptor's proxy setup reads. Decided by the build section Zerops applies (the selected setup's, else
+ * the nearest one it `extends`): a lifted `FABRIKA_PROXY_MANIFEST_JSON` would overwrite an archived file, so it wins.
+ */
+export const zeropsProxyManifestCarrier = (descriptorContents: string, setup = 'proxy'): ZeropsProxyManifestCarrier => {
+	const parsed = parseZeropsDescriptor(descriptorContents)
+	for (const entry of appliedZeropsSetups(parsed, selectZeropsDescriptorSetup(parsed, setup))) {
+		const read = buildSectionSchema.safeParse(entry)
+		if (!read.success) continue
+		return read.data.build.envVariables?.[FABRIKA_PROXY_MANIFEST_JSON] === undefined ? 'archive' : 'environment'
+	}
+	return 'archive'
+}

package/src/source/port.ts

@@ -20,10 +20,16 @@ export interface ZeropsSourceResolution {
 	readonly descriptorSha256: string
 }
 
+/** ADR-0045: the one generated data file a platform archive carries beside the exact commit, at a path the commit lacks. */
+export interface ZeropsSourceDataFile {
+	readonly path: string
+	readonly contents: string
+}
+
 /** ADR-0045: platform archives are anonymous, tree-prechecked, keep relative symlinks. */
 export type ZeropsSourceArchive =
 	| { readonly kind: 'application'; readonly privateBinding?: ZeropsSourcePrivateBinding }
-	| { readonly kind: 'platform' }
+	| { readonly kind: 'platform'; readonly dataFile?: ZeropsSourceDataFile }
 
 export interface ZeropsSourceUploadInput {
 	readonly repository: ZeropsSourceRepository
@@ -38,6 +44,8 @@ export interface ZeropsSourceUploadInput {
 export interface ZeropsSourceUploadResult {
 	readonly commitSha: string
 	readonly descriptorSha256: string
+	/** The sha256 of the data file the archive carried; absent without one. */
+	readonly dataFileSha256?: string
 	readonly entryCount: number
 	readonly expandedBytes: number
 }