@fabrika/provider-zerops 0.4.2 → 0.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.4.2",
+	"version": "0.4.3",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -43,12 +43,13 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth": "^0.4.2",
-		"@fabrika/auth-core": "^0.4.2",
-		"@fabrika/iam-contract": "^0.4.2",
-		"@fabrika/installation-init": "^0.4.2",
-		"@fabrika/provider-contract": "^0.4.2",
-		"@fabrika/proxy-core": "^0.4.2",
+		"@fabrika/auth": "^0.4.3",
+		"@fabrika/auth-core": "^0.4.3",
+		"@fabrika/iam-contract": "^0.4.3",
+		"@fabrika/installation-init": "^0.4.3",
+		"@fabrika/operations-contract": "^0.4.3",
+		"@fabrika/provider-contract": "^0.4.3",
+		"@fabrika/proxy-core": "^0.4.3",
 		"yaml": "^2.9.1"
 	}
 }

package/src/api/client.ts

@@ -14,19 +14,12 @@ import {
 	readResponse,
 	serviceEnvSchema,
 	serviceSchema,
+	userInfoSchema,
 } from './readers'
+import { assertServiceEnvValueFits } from './service-env-limit'
 import { parseServiceEnvResponse } from './service-env-response'
 import type { ZeropsApi, ZeropsApiOptions, ZeropsAppVersion, ZeropsLogLine } from './types'
 
-/**
- * `sensitive` on every user-data WRITE, create and update alike. Required by the platform — omitting it answers
- * `400 invalidUserInput` with `{"sensitive":["field is required"]}` (measured live, 2026-08-18) — and
- * `true` because most of what fabrika writes is a credential. It costs nothing to read: a sensitive
- * variable's `content` still comes back verbatim from `GET /service-stack/{id}/env`, also measured, so the
- * compare-before-write both `platform deploy` and the create-only credential slots depend on still works.
- */
-const SENSITIVE_USER_DATA = true
-
 /** The RFC3339 stamp the plaintext log window puts first on every line. Anchored so a bare year cannot pass. */
 const LOG_LINE_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/
 
@@ -403,11 +396,12 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 
 		listServiceEnv,
 
-		createServiceEnv: async ({ serviceId, key, value, signal }) => {
+		createServiceEnv: async ({ serviceId, key, value, sensitive, signal }) => {
+			assertServiceEnvValueFits(key, value)
 			let started: unknown
 			try {
 				started = await request('create-only service env', 'POST', `/service-stack/${serviceId}/user-data`, {
-					body: { key, content: value, sensitive: SENSITIVE_USER_DATA },
+					body: { key, content: value, sensitive },
 					signal,
 					omitErrorResponseDetails: true,
 				})
@@ -418,12 +412,13 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 			await awaitUserDataSync(started, `the user-data sync on service ${serviceId}`, signal)
 		},
 
-		putServiceEnv: async ({ serviceId, key, value, signal }) => {
+		putServiceEnv: async ({ serviceId, key, value, sensitive, signal }) => {
+			assertServiceEnvValueFits(key, value)
 			const label = `the user-data sync on service ${serviceId}`
 			// `redactDetail` on both writes: this is the one place a secret VALUE is in the request body.
 			try {
 				const created = await request('create service env', 'POST', `/service-stack/${serviceId}/user-data`, {
-					body: { key, content: value, sensitive: SENSITIVE_USER_DATA },
+					body: { key, content: value, sensitive },
 					signal,
 					redactDetail: true,
 				})
@@ -445,7 +440,7 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 				)
 			}
 			const updated = await request('update service env', 'PUT', `/user-data/${existing.id}`, {
-				body: { key, content: value, sensitive: SENSITIVE_USER_DATA },
+				body: { key, content: value, sensitive },
 				signal,
 				redactDetail: true,
 			})
@@ -460,6 +455,8 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 		getProjectEnv: async ({ projectEnvId, signal }) =>
 			readResponse('get project env', serviceEnvSchema, await request('get project env', 'GET', `/project-env/${projectEnvId}`, { signal })),
 
+		getUserInfo: async ({ signal }) => readResponse('get user info', userInfoSchema, await request('get user info', 'GET', '/user/info', { signal })),
+
 		createIntegrationToken: async ({ clientId, name, projects, roleCode, canCreateProjects, signal }) =>
 			// `redactDetail`: unlike every other write here the SECRET is in the RESPONSE, not the request, so
 			// this is the one error envelope that could quote a minted token back at us.

package/src/api/polling.ts

@@ -1,4 +1,5 @@
 import type { Sleeper } from '../collaborators'
+import { ZEROPS_SERVICE_NOT_HTTP, ZeropsApiError } from './errors'
 import { ZEROPS_PROCESS_FINISHED, ZEROPS_PROCESS_TERMINAL, type ZeropsApi, type ZeropsProcess } from './types'
 
 // ── waiting on a process ────────────────────────────────────────────────────────
@@ -57,3 +58,44 @@ export const waitForProcess = async (input: {
 		await input.sleep(intervalMs, input.signal)
 	}
 }
+
+// ── waiting for a service's HTTP ports ──────────────────────────────────────────
+
+/** How often `enableSubdomainAccessWhenHttp` asks again while the platform still answers `serviceStackIsNotHttp`. */
+const HTTP_PORT_POLL_INTERVAL_MS = 5_000
+
+/** ~3 minutes. The live lag measured between ACTIVE and the HTTP ports was under a minute. */
+const HTTP_PORT_POLL_ATTEMPTS = 36
+
+/**
+ * `enableSubdomainAccess`, repeated while the service does not yet publish an HTTP port.
+ *
+ * Live-verified: right after a service's first app version reads ACTIVE the platform still answers
+ * `serviceStackIsNotHttp`, and a minute later the same call is accepted. The ports lag ACTIVE, so that
+ * answer means "not yet" for a bounded window. Past it the last refusal is rethrown unchanged, so a caller
+ * still names the missing port. Any other failure is rethrown at once. The 2xx still proves nothing: the
+ * caller decides by reading `subdomainAccess` back.
+ */
+export const enableSubdomainAccessWhenHttp = async (input: {
+	api: Pick<ZeropsApi, 'enableSubdomainAccess'>
+	serviceId: string
+	sleep: Sleeper
+	signal: AbortSignal
+	intervalMs?: number
+	attempts?: number
+}): Promise<void> => {
+	const intervalMs = input.intervalMs ?? HTTP_PORT_POLL_INTERVAL_MS
+	const attempts = input.attempts ?? HTTP_PORT_POLL_ATTEMPTS
+	for (let attempt = 0;; attempt += 1) {
+		input.signal.throwIfAborted()
+		try {
+			await input.api.enableSubdomainAccess({ serviceId: input.serviceId, signal: input.signal })
+			return
+		} catch (error) {
+			if (!(error instanceof ZeropsApiError) || error.code !== ZEROPS_SERVICE_NOT_HTTP || attempt >= attempts) {
+				throw error
+			}
+		}
+		await input.sleep(intervalMs, input.signal)
+	}
+}

package/src/api/readers.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { withoutSensitiveContent } from './service-env-response'
 import type {
 	ZeropsAppVersion,
 	ZeropsAppVersionStatus,
@@ -13,6 +14,7 @@ import type {
 	ZeropsService,
 	ZeropsServiceEnv,
 	ZeropsServiceStatus,
+	ZeropsUserInfo,
 } from './types'
 
 /** Zerops sends `null` for an absent optional field; nothing reads one of these as required, so a malformed one reads as absent. */
@@ -148,14 +150,19 @@ export const integrationTokenSchema = z.object({
 	roleCode: optional(roleCodeSchema),
 }) satisfies z.ZodType<ZeropsIntegrationToken, z.ZodTypeDef, unknown>
 
+export const userInfoSchema = z.object({
+	id: idSchema,
+	email: z.string(),
+}) satisfies z.ZodType<ZeropsUserInfo, z.ZodTypeDef, unknown>
+
 export const serviceEnvSchema = z.object({
 	id: idSchema,
 	key: nonBlankSchema,
 	content: z.string(),
 	serviceStackId: optional(idSchema),
 	type: optional(z.string()),
-	sensitive: optional(z.boolean()),
-}) satisfies z.ZodType<ZeropsServiceEnv, z.ZodTypeDef, unknown>
+	sensitive: z.boolean(),
+}).transform(withoutSensitiveContent) satisfies z.ZodType<ZeropsServiceEnv, z.ZodTypeDef, unknown>
 
 export const importResultSchema = z.object({
 	projectId: idSchema,

package/src/api/service-env-limit.ts

@@ -0,0 +1,29 @@
+/**
+ * The largest service variable value fabrika writes, in UTF-8 bytes. Measured live on 2026-10-15 (issue #3): a value
+ * of 32,000 bytes is created, one of 32,768 bytes or more answers a bare `500` with no error code. The bytes between
+ * were not probed, so the bound is the largest size that was seen to work.
+ */
+export const ZEROPS_SERVICE_ENV_VALUE_MAX_BYTES = 32_000
+
+/** The provider's code for a value over the bound; the platform has none of its own, only the 500. */
+export const ZEROPS_SERVICE_ENV_VALUE_TOO_LARGE = 'serviceEnvValueTooLarge'
+
+/** A write refused before it was sent. The message names the variable and the sizes, never the value. */
+export class ZeropsServiceEnvValueTooLargeError extends Error {
+	readonly code = ZEROPS_SERVICE_ENV_VALUE_TOO_LARGE
+
+	constructor(readonly key: string, readonly bytes: number) {
+		super(
+			`zerops: service variable \`${key}\` is ${bytes} bytes (UTF-8), over the ${ZEROPS_SERVICE_ENV_VALUE_MAX_BYTES}-byte limit of a Zerops service variable`,
+		)
+		this.name = 'ZeropsServiceEnvValueTooLargeError'
+	}
+}
+
+/** Refuse a value Zerops would answer with a bare 500, which reads as an outage and is retried for ever. */
+export const assertServiceEnvValueFits = (key: string, value: string): void => {
+	const bytes = new TextEncoder().encode(value).byteLength
+	if (bytes > ZEROPS_SERVICE_ENV_VALUE_MAX_BYTES) {
+		throw new ZeropsServiceEnvValueTooLargeError(key, bytes)
+	}
+}

package/src/api/service-env-response.ts

@@ -5,13 +5,45 @@ const invalid = (): never => {
 	throw new Error('zerops: invalid service environment response')
 }
 const nonemptySchema = z.string().refine((value) => value.trim() !== '')
+
+/** One user-data record as the platform sends it, before `withoutSensitiveContent`. */
+interface RawServiceEnv {
+	readonly id: string
+	readonly key: string
+	readonly content: string
+	readonly serviceStackId?: string | undefined
+	readonly type?: string | undefined
+	readonly sensitive: boolean
+}
+
+/**
+ * Drop a sensitive record's `content`, whatever it says.
+ *
+ * Zerops answers `REDACTED` outside sudo mode and the real value inside it (measured 2026-10-15), so the
+ * same call reads differently depending on the token. Dropping it here makes every caller behave the
+ * same for both, and no caller can compare, merge or leak a secret it read back.
+ */
+export const withoutSensitiveContent = (raw: RawServiceEnv): ZeropsServiceEnv => {
+	const record = {
+		id: raw.id,
+		key: raw.key,
+		...(raw.serviceStackId === undefined ? {} : { serviceStackId: raw.serviceStackId }),
+		...(raw.type === undefined ? {} : { type: raw.type }),
+	}
+	return raw.sensitive ? { ...record, sensitive: true } : { ...record, sensitive: false, content: raw.content }
+}
+
+/** The value of a record fabrika can read: absent when there is no record or it is sensitive. */
+export const readableContent = (record: ZeropsServiceEnv | undefined): string | undefined =>
+	record === undefined || record.sensitive ? undefined : record.content
+
 const serviceEnvEntrySchema = z.object({
 	id: nonemptySchema,
 	key: nonemptySchema,
 	content: z.string(),
 	serviceStackId: nonemptySchema.optional(),
 	type: nonemptySchema.optional(),
-	sensitive: z.boolean().optional(),
+	sensitive: z.boolean(),
 }).superRefine((entry, ctx) => {
 	if (Object.values(entry).some((value) => value === undefined)) ctx.addIssue({ code: 'custom', message: 'present fields must have values' })
 })
@@ -29,6 +61,6 @@ export function parseServiceEnvResponse(value: unknown, serviceId: string): Zero
 		ids.add(id)
 		keys.add(key)
 		if (serviceStackId !== undefined && serviceStackId !== serviceId) return invalid()
-		return entry
+		return withoutSensitiveContent(entry)
 	})
 }

package/src/api/types.ts

@@ -231,22 +231,46 @@ export interface ZeropsIntegrationToken {
 	roleCode?: ZeropsRoleCode
 }
 
+/**
+ * The identity a token authenticates as, narrowed to what fabrika reads. VERIFIED: `GET /user/info`,
+ * `ResponseUserAuthorize` — `id` and `email` are in its `required` list.
+ *
+ * Read with an integration token, `id` is the token's own id (measured live, 2026-08-21) and `email` is
+ * `token-<id>@zerops.io` (reported by an operator, not measured here).
+ */
+export interface ZeropsUserInfo {
+	id: string
+	email: string
+}
+
 /**
  * ONE service-level environment variable. VERIFIED: `OutDtoUserData`.
  *
- * UNVERIFIED BEHAVIOUR: whether `content` carries the real value for a variable Zerops stores as a
- * SECRET, or a blurred placeholder. `docs/backlog/06-can-zerops-secrets-be-read-back.md` is open on
- * exactly this; the dashboard UX depends on the answer. Never log `content`.
+ * A SENSITIVE record carries no `content`. Measured 2026-10-15: Zerops answers `REDACTED` to a token
+ * outside sudo mode and the value itself to one inside it, so nothing may depend on reading a secret
+ * back, and the reader drops it. Never log `content`.
  */
-export interface ZeropsServiceEnv {
+export type ZeropsServiceEnv = ZeropsServiceEnvRecord & ({ sensitive: false; content: string } | { sensitive: true })
+
+export interface ZeropsServiceEnvRecord {
 	id: string
 	key: string
-	content: string
 	serviceStackId?: string
 	/** Record classification, not a sensitivity or ownership guarantee; sensitive records can be USER. */
 	type?: string
-	/** Live service-env responses identify sensitive USER records independently of their type. */
-	sensitive?: boolean
+}
+
+/** One service-level variable to write. */
+export interface ZeropsServiceEnvWrite {
+	serviceId: string
+	key: string
+	value: string
+	/**
+	 * `true` for a credential, `false` for everything else. A sensitive value can never be read back
+	 * (see `ZeropsServiceEnv`), so a value fabrika compares or merges later must be written `false`.
+	 */
+	sensitive: boolean
+	signal: AbortSignal
 }
 
 /**
@@ -481,7 +505,7 @@ export interface ZeropsApi {
 	 * details are intentionally unavailable because both the request and an upstream response can contain
 	 * the secret value.
 	 */
-	createServiceEnv(input: { serviceId: string; key: string; value: string; signal: AbortSignal }): Promise<void>
+	createServiceEnv(input: ZeropsServiceEnvWrite): Promise<void>
 
 	/**
 	 * Create-or-update ONE service-level variable — the only way fabrika ever writes a secret, and it is
@@ -491,8 +515,9 @@ export interface ZeropsApi {
 	 *
 	 * WRITE FIRST, READ ONLY ON CONFLICT. A read before the write cannot be part of this: the create
 	 * must work on a service that has never been deployed, which is exactly ADR-0004's bring-up order.
+	 * An update also sets `sensitive`, so a record written sensitive by an older release becomes readable.
 	 */
-	putServiceEnv(input: { serviceId: string; key: string; value: string; signal: AbortSignal }): Promise<void>
+	putServiceEnv(input: ZeropsServiceEnvWrite): Promise<void>
 
 	/** Delete one service-level variable by its record id. VERIFIED: `DELETE /user-data/{id}`. */
 	deleteServiceEnv(input: { envId: string; signal: AbortSignal }): Promise<void>
@@ -503,6 +528,11 @@ export interface ZeropsApi {
 	 */
 	getProjectEnv(input: { projectEnvId: string; signal: AbortSignal }): Promise<ZeropsServiceEnv>
 
+	// ── user: who the token is ────────────────────────────────────────────────────
+
+	/** The identity this client's token authenticates as. VERIFIED: `GET /user/info` (`GetUserInfo`). */
+	getUserInfo(input: { signal: AbortSignal }): Promise<ZeropsUserInfo>
+
 	// ── client: minting a credential ──────────────────────────────────────────────
 
 	/**

package/src/api.ts

@@ -1,6 +1,13 @@
 export { createZeropsApi, ZEROPS_API_BASE } from './api/client'
 export { ZEROPS_SERVICE_NOT_HTTP, ZeropsApiError } from './api/errors'
-export { waitForProcess } from './api/polling'
+export { enableSubdomainAccessWhenHttp, waitForProcess } from './api/polling'
+export {
+	assertServiceEnvValueFits,
+	ZEROPS_SERVICE_ENV_VALUE_MAX_BYTES,
+	ZEROPS_SERVICE_ENV_VALUE_TOO_LARGE,
+	ZeropsServiceEnvValueTooLargeError,
+} from './api/service-env-limit'
+export { readableContent } from './api/service-env-response'
 export {
 	type FetchLike,
 	ZEROPS_ACTIVE,
@@ -24,6 +31,8 @@ export {
 	type ZeropsRoleCode,
 	type ZeropsService,
 	type ZeropsServiceEnv,
+	type ZeropsServiceEnvWrite,
 	type ZeropsServiceStatus,
 	type ZeropsTokenProjectGrant,
+	type ZeropsUserInfo,
 } from './api/types'

package/src/control.ts

@@ -20,7 +20,15 @@ import type {
 } from '@fabrika/provider-contract'
 import { decodeEnvelope, ProviderSecretError } from '@fabrika/provider-contract'
 import { z } from 'zod'
-import { createZeropsApi, waitForProcess, ZEROPS_ACTIVE, ZEROPS_TERMINAL, type ZeropsApi, type ZeropsAppVersion } from './api'
+import {
+	createZeropsApi,
+	waitForProcess,
+	ZEROPS_ACTIVE,
+	ZEROPS_TERMINAL,
+	type ZeropsApi,
+	type ZeropsAppVersion,
+	ZeropsServiceEnvValueTooLargeError,
+} from './api'
 import { defaultSleep, defaultZeropsCollaborators, type Sleeper } from './collaborators'
 import { createdServices, type ExposureAlerter, isObjectStorageType } from './exposure'
 import { assertAuthoredManagedInputs, assertAuthoredManagedName, assertNoFrameworkReference, parseManagedEnvironment } from './managed-env'
@@ -371,12 +379,13 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 				target: runtimeTarget,
 				artifact,
 				...(input.environment.access === undefined ? {} : { access: input.environment.access }),
+				...(input.artifactUpload === undefined ? {} : { artifactUpload: input.artifactUpload }),
 				dryRun: input.dryRun,
 				signal: input.signal,
 				events: input.events,
 			})
 			input.signal.throwIfAborted()
-			return { state: result.status }
+			return { state: result.status, ...(result.artifactState === undefined ? {} : { artifactState: result.artifactState }) }
 		},
 		cancel: async (input): Promise<ProviderCancelOutcome> => {
 			const signal = input.signal
@@ -459,12 +468,18 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 				assertNoFrameworkReference(input.value)
 				assertOwnReferencesOnly(input.environment, input.name, input.value)
 				const target = decodeEnvironment(input.environment).target
-				await api.putServiceEnv({
-					serviceId: target.serviceId,
-					key: input.name,
-					value: input.value,
-					signal: abortSignal(),
-				})
+				try {
+					await api.putServiceEnv({
+						serviceId: target.serviceId,
+						key: input.name,
+						value: input.value,
+						sensitive: true,
+						signal: abortSignal(),
+					})
+				} catch (cause) {
+					if (cause instanceof ZeropsServiceEnvValueTooLargeError) throw new ProviderSecretError(cause.message, cause.code)
+					throw cause
+				}
 				return { valueRef: `zerops:${target.serviceId}/${encodeURIComponent(input.name)}` }
 			},
 			delete: async (input) => {

package/src/execution.ts

@@ -2,7 +2,15 @@
 // runs. Of the authored setup only `build.base`, `build.os` and the SPA's `build.buildCommands` survive; the rest of
 // the build, the deploy gate and the whole `run` section are generated here. PURE — no network, no filesystem.
 
-import { type ContractArtifact, contractDigest, FABRIKA_CONTRACT_DIGEST, type FrameworkVariableName } from '@fabrika/auth-core'
+import {
+	type ContractArtifact,
+	contractDigest,
+	FABRIKA_CONTRACT_DIGEST,
+	FABRIKA_SOURCE_MAP_UPLOAD,
+	FABRIKA_SOURCE_MAP_UPLOAD_KEY,
+	type FrameworkVariableName,
+} from '@fabrika/auth-core'
+import type { OperationsAssetRoot, OperationsSourceMapBuildUpload } from '@fabrika/operations-contract/releases'
 import type { JsonValue } from '@fabrika/provider-contract'
 import packageManifest from '../package.json'
 import { renderYaml } from './compile'
@@ -16,8 +24,9 @@ export const ZEROPS_APPLICATION_PORT = 3000
 export const ZEROPS_APPLICATION_RUNTIME = 'alpine/bun@1.3'
 
 /**
- * The checker every build runs, pinned to this package's own version: the public packages are released together
- * (`release:validate`), so this is the checker of the installation that renders the build.
+ * The checker every build runs, pinned to this package's own version. Control runs the git checkout of its release
+ * tag, so this reads the source version, which `release:validate` holds equal to the tag; the public packages are
+ * released together, so it is the checker of the installation that renders the build.
  */
 export const FABRIKA_CHECK_VERSION: string = packageManifest.version
 
@@ -73,6 +82,8 @@ export interface ZeropsLockedExecution {
 	/** The hostname of the application's one object-storage service, or null when it has none. */
 	readonly storageHostname: string | null
 	readonly runtimePackages: readonly ZeropsRuntimePackage[]
+	/** Where the build uploads its source maps, without the bearer; null when Control minted no upload for the run. */
+	readonly sourceMaps: OperationsSourceMapBuildUpload | null
 }
 
 /** The application ids the generated scripts may name: the contract's own id rule, so a script needs no quoting. */
@@ -148,6 +159,16 @@ const refuse = (setup: string, key: string, reason: string): never => {
 	throw new Error(`invalid fabrika manifest: zerops.yaml setup \`${setup}\` sets \`${key}\`; ${reason} (allowed form: ${LOCKED_BUILD_FORM})`)
 }
 
+/** The directories a contract serves its pages from: each SPA mount's and each share link's SPA, by URL prefix. */
+export function zeropsAssetRoots(artifact: ContractArtifact): OperationsAssetRoot[] {
+	const roots: OperationsAssetRoot[] = []
+	for (const mount of Object.values(artifact.mounts)) {
+		if (mount.kind === 'spa') roots.push({ prefix: mount.prefix, dir: mount.dir })
+		if (mount.kind === 'link') roots.push({ prefix: mount.prefix, dir: mount.spa })
+	}
+	return roots.sort((left, right) => left.prefix < right.prefix ? -1 : left.prefix > right.prefix ? 1 : 0)
+}
+
 interface AuthoredBuild {
 	readonly base: string | string[] | null
 	readonly os: string | null
@@ -253,6 +274,21 @@ const startScript = (appId: string, database: boolean): readonly string[] => [
 
 const INSTALL = 'bun install --frozen-lockfile --ignore-scripts'
 
+// After every check: a map is uploaded only for a build that can deploy. A failed upload never fails the build; the
+// provider reads the state from the report line.
+const SOURCE_MAP_UPLOAD = `cd /tmp && bun x --bun -p @fabrika/check@${FABRIKA_CHECK_VERSION} fabrika-source-maps ${SOURCE_ROOT} || true`
+
+/**
+ * The upload's build variables: the destination and asset roots as a literal, and the bearer lifted from the service
+ * variable the deploy wrote sensitive, so the descriptor never holds it.
+ */
+const sourceMapBuildVariables = (upload: OperationsSourceMapBuildUpload): Record<string, string> => {
+	const value = JSON.stringify(upload)
+	// Zerops resolves `${…}` in a build variable, so an SPA directory carrying one would read another variable.
+	if (value.includes('${')) throw new Error('zerops: an SPA directory or prefix must not contain `${`')
+	return { [FABRIKA_SOURCE_MAP_UPLOAD]: value, [FABRIKA_SOURCE_MAP_UPLOAD_KEY]: `\${RUNTIME_${FABRIKA_SOURCE_MAP_UPLOAD_KEY}}` }
+}
+
 /**
  * The generated build commands, in order; the authored SPA commands run before all of them. The application's tests
  * run first: they are authored code, so everything after them is reinstalled, regenerated or checked again.
@@ -270,6 +306,7 @@ export function generatedBuildCommands(execution: ZeropsLockedExecution): readon
 		`cd /tmp && bun x --bun -p typescript@${PLATFORM_TYPESCRIPT_VERSION} tsc -p ${SOURCE_ROOT}/${PLATFORM_TSCONFIG}`,
 		...(database ? [writeFileCommand(MIGRATE_SCRIPT, migrateScript(execution.appId))] : []),
 		writeFileCommand(START_SCRIPT, startScript(execution.appId, database)),
+		...(execution.sourceMaps === null ? [] : [SOURCE_MAP_UPLOAD]),
 	]
 }
 
@@ -330,6 +367,7 @@ export function renderLockedSetup(
 			base: authored.base ?? [ZEROPS_APPLICATION_RUNTIME],
 			...(authored.os === null ? {} : { os: authored.os }),
 			buildCommands: [...authored.commands, ...generatedBuildCommands(execution)],
+			...(execution.sourceMaps === null ? {} : { envVariables: sourceMapBuildVariables(execution.sourceMaps) }),
 			deployFiles: ['./'],
 			cache: ['node_modules'],
 		},

package/src/index.ts

@@ -1,5 +1,7 @@
 export {
 	createZeropsApi,
+	enableSubdomainAccessWhenHttp,
+	readableContent,
 	waitForProcess,
 	ZEROPS_ACTIVE,
 	ZEROPS_API_BASE,
@@ -28,8 +30,10 @@ export type {
 	ZeropsRoleCode,
 	ZeropsService,
 	ZeropsServiceEnv,
+	ZeropsServiceEnvWrite,
 	ZeropsServiceStatus,
 	ZeropsTokenProjectGrant,
+	ZeropsUserInfo,
 } from './api'
 export { defineApp, isZeropsAppConfig, useSharedPostgres, zeropsSharedServiceHostname, zeropsSharedServicePrefix } from './authoring'
 export type { ZeropsAuthoredAppConfig } from './authoring'
@@ -100,6 +104,7 @@ export { buildZeropsPlan, resolveDeployHostname } from './plan'
 export type { ZeropsStep, ZeropsStepKind } from './plan'
 export { CANCELLED, createZeropsDeployer, interpolateManifest } from './provider'
 export type { ZeropsDeployResult, ZeropsDeployRun } from './provider'
+export { ZEROPS_PROXY_MANIFEST_PATH, type ZeropsProxyManifestCarrier, zeropsProxyManifestCarrier } from './proxy-manifest-carrier'
 export type * from './schema.generated'
 export { isZeropsUploadDestination, normalizeZeropsSourceRepository } from './source'
 export type { ZeropsSourceRepository } from './source'

package/src/installation/admin.ts

@@ -84,7 +84,7 @@ export const runPlatformAdmin = async (input: PlatformAdminInput, collaborators:
 const report = (result: FirstAdministratorResult, log: AdminLog): void => {
 	log.ok(
 		result.principal === 'invited'
-			? `invited ${result.email} as principal ${result.principalId}`
+			? `created principal ${result.principalId} for ${result.email} — no e-mail was sent`
 			: `${result.email} already exists as principal ${result.principalId}`,
 	)
 	// `app: null` is the whole point: an `admin` grant scoped to the console's own app id leaves
@@ -113,7 +113,9 @@ const announceEnrollment = (result: FirstAdministratorResult, log: AdminLog, pri
 		return
 	}
 	log.ok(`enrollment issued, valid until ${expiry(result.enrollment.expiresAt)}`)
-	log.info('The URL below sets the first password. It is a credential: it is printed once, stored nowhere, and it expires.')
+	// IAM answers with the URL only when it has no mail service, so nobody else will deliver it.
+	log.info('Nothing was e-mailed: this installation has no mail service. Give the URL below to the administrator yourself.')
+	log.info('It sets the first password. It is a credential: it is printed once, stored nowhere, and it expires.')
 	print(result.enrollment.url)
 }
 

package/src/installation/checker-release.ts

@@ -0,0 +1,44 @@
+import { FABRIKA_CHECK_VERSION } from '../execution'
+
+/** The package every contract application build fetches by this checkout's version. */
+export const FABRIKA_CHECK_PACKAGE = '@fabrika/check'
+
+/** Whether npm has `@fabrika/check` at `version`. Throws when it cannot tell. */
+export type CheckerPublication = (version: string, signal: AbortSignal) => Promise<boolean>
+
+const NPM_REGISTRY = 'https://registry.npmjs.org'
+
+export type RegistryFetch = (url: string, init: RequestInit) => Promise<Response>
+
+export const npmCheckerPublication = (fetchImpl: RegistryFetch = (url, init) => fetch(url, init)): CheckerPublication => async (version, signal) => {
+	const url = `${NPM_REGISTRY}/${FABRIKA_CHECK_PACKAGE.replace('/', '%2F')}/${encodeURIComponent(version)}`
+	let response: Response
+	try {
+		response = await fetchImpl(url, { headers: { accept: 'application/json' }, signal })
+	} catch {
+		signal.throwIfAborted()
+		throw new Error(`could not reach npm to check that ${FABRIKA_CHECK_PACKAGE}@${version} is published; retry when npm answers`)
+	}
+	await response.body?.cancel()
+	if (response.ok) return true
+	if (response.status === 404) return false
+	throw new Error(`npm answered ${response.status} for ${FABRIKA_CHECK_PACKAGE}@${version}; retry when npm answers`)
+}
+
+/**
+ * Refuse a checkout whose checker npm does not have. Every contract application build of the installation fetches
+ * `@fabrika/check` at this checkout's version, so without it no application could deploy. Between a release's bump
+ * commit and its publish, `main` is such a checkout.
+ */
+export const assertCheckerPublished = async (
+	published: CheckerPublication,
+	signal: AbortSignal,
+	version: string = FABRIKA_CHECK_VERSION,
+): Promise<void> => {
+	if (await published(version, signal)) return
+	throw new Error(
+		`this checkout is version ${version}, which is not published yet: npm has no ${FABRIKA_CHECK_PACKAGE}@${version}, and every `
+			+ 'application build of this installation fetches it. Deploy a released tag of contember/fabrika-platform, '
+			+ `or wait until v${version} is published.`,
+	)
+}