@fabrika/provider-zerops 0.4.2 → 0.4.4

package/src/installation/install.ts

@@ -11,7 +11,8 @@ import {
 	warn as consoleWarn,
 } from '@fabrika/installation-init'
 import type { SchemaReconciler } from '@fabrika/provider-contract'
-import { createZeropsApi, defaultSleep, type ZeropsNamespaceProxySource } from '../index'
+import { createZeropsApi, defaultSleep, readableContent, type ZeropsNamespaceProxySource } from '../index'
+import { assertCheckerPublished, npmCheckerPublication } from './checker-release'
 import {
 	deployPlatformService,
 	deployPreparedPlatform,
@@ -26,7 +27,7 @@ import { PLATFORM_PROXY_MANIFEST_TEMPLATE } from './generated/platform-proxy-man
 import { derivePlatformHosts, type PlatformHosts, platformOrigin, ZEROPS_SUBDOMAIN_VARIABLE } from './hosts'
 import { checkedEnvironmentName } from './init-options'
 import { assertRunning, type InstallCollaborators, type InstallPrompts } from './install-collaborators'
-import { installationServiceEnv, passOneProxyEnv, writeServiceEnv } from './install-environment'
+import { installationServiceEnv, PASS_ONE_PROXY_MANIFEST, passOneProxyEnv, writeServiceEnv } from './install-environment'
 import type { PlatformInstallInput } from './install-options'
 import { resolveInstallationProject } from './install-project'
 import {
@@ -38,6 +39,8 @@ import {
 	resolvePlatformServices,
 	serviceOf,
 } from './install-provisioning'
+import { renderSecretsFile, writeSecretsFile } from './install-secrets'
+import { explainMintFailure } from './install-token'
 import { prepareInstallationSource, prepareNamespaceProxySource, validateInstallationSetups } from './installation-source'
 import type { PreparedPlatformSource } from './platform-source'
 import { generateInstallationSecrets, type InstallationSecrets } from './secrets'
@@ -61,14 +64,14 @@ const passOne = async (
 	const { log, prompts } = collaborators
 	log.step('Pass 1 — build the proxy so the installation has public hostnames')
 	log.info('An empty manifest is a legal one: the proxy comes up answering 404 and publishes one hostname per HTTP port.')
-	if (!(await prompts.confirm(`Write 4 variables on \`proxy\` and build commit ${source.commitSha}? (about 4 minutes)`, true))) {
+	if (!(await prompts.confirm(`Write 3 variables on \`proxy\` and build commit ${source.commitSha}? (about 4 minutes)`, true))) {
 		throw new Error('declined: no variable was written, and re-running the install is safe')
 	}
 	await writeServiceEnv(proxy, passOneProxyEnv(secrets), collaborators)
-	await deployPlatformService(proxy, { source, dryRun: false }, collaborators)
+	await deployPlatformService(proxy, { source, dryRun: false, proxyManifest: PASS_ONE_PROXY_MANIFEST }, collaborators)
 
 	const proxyEnv = await readServiceEnv(proxy.id, collaborators)
-	const subdomains = proxyEnv.get(ZEROPS_SUBDOMAIN_VARIABLE)
+	const subdomains = readableContent(proxyEnv.get(ZEROPS_SUBDOMAIN_VARIABLE))
 	if (subdomains === undefined || subdomains.trim() === '') {
 		throw new Error('the proxy published no Zerops subdomain after its first deploy — this installation has no address to be named by')
 	}
@@ -88,6 +91,7 @@ export const runInstall = async (input: PlatformInstallInput, collaborators: Ins
 	const source = await collaborators.prepareSource(input.sourceDir, collaborators.signal)
 	try {
 		validateInstallationSetups(source, PLATFORM_DEPLOY_ORDER)
+		await assertCheckerPublished(collaborators.checkerPublished, collaborators.signal)
 		const proxySource = await prepareNamespaceProxySource(source)
 		await installPreparedPlatform(input, collaborators, source, proxySource)
 	} finally {
@@ -114,7 +118,7 @@ const installPreparedPlatform = async (
 	log.ok(`project ${project.name} (${project.id})`)
 
 	log.step('Provision the topology')
-	const document = provisioningDocument(environment)
+	const document = provisioningDocument(environment, input.tier)
 	const declared = document.document.services.map((service) => service.hostname)
 	const existing = existingServices(declared, await collaborators.api.listProjectServices({ projectId: project.id, signal }))
 	assertNoServiceIsBeingCreated(existing)
@@ -143,12 +147,21 @@ const installPreparedPlatform = async (
 		// application at all (ADR-0034). `NO_ACCESS` still keeps every project it did not create out of reach.
 		canCreateProjects: true,
 		signal,
+	}).catch((failure: unknown) => {
+		throw explainMintFailure(failure, project.id)
 	})
 	if (token.token === '') {
 		throw new Error('Zerops minted an integration token with no value — the control plane cannot deploy anything without one')
 	}
 	log.ok(`integration token ${token.id} minted, ${token.projects.length} project grant(s)`)
 
+	log.step('Store the credentials locally')
+	// BEFORE the first one is placed: Zerops keeps them sensitive and will not hand them back.
+	await collaborators.storeSecrets(
+		renderSecretsFile({ environment, projectId: project.id, clientId: input.clientId, secrets, zeropsAccessToken: token.token }),
+	)
+	log.ok(`wrote ${input.secretsFile} (mode 0600) — every credential this installation was created with; nothing else holds a readable copy`)
+
 	const hosts = await passOne(source, serviceOf(services, PLATFORM_PROXY_SERVICE), secrets, collaborators)
 	log.ok(`iam ${hosts.iam}`)
 	log.ok(`console ${hosts.control}`)
@@ -157,6 +170,7 @@ const installPreparedPlatform = async (
 	log.step('Write every remaining variable')
 	const desired = installationServiceEnv({
 		environment,
+		tier: input.tier,
 		scheme: input.scheme,
 		hosts,
 		clientId: input.clientId,
@@ -170,7 +184,7 @@ const installPreparedPlatform = async (
 		throw new Error(
 			'declined: the proxy is built but the installation is not configured. Its generated proxy key is already placed, so '
 				+ 're-running `platform install` is refused. Neither `platform deploy` nor `platform init` completes a partial bootstrap. '
-				+ 'Preserve the existing keys and arrange operator-owned recovery, or start a fresh installation in a separate empty project',
+				+ `Keep ${input.secretsFile} and arrange operator-owned recovery, or start a fresh installation in a separate empty project`,
 		)
 	}
 	for (const hostname of PLATFORM_DEPLOY_ORDER) {
@@ -178,9 +192,9 @@ const installPreparedPlatform = async (
 	}
 
 	log.step('Pass 2 — deploy the installation')
+	const withSecrets = (command: string): string => `( set -a && . ${shellQuoted(input.secretsFile)} && set +a && ${command} )`
 	log.info(
-		'Every bootstrap variable is placed. If this deploy fails, read FABRIKA_IAM_PROVISIONING_KEY from `iam` or `control` '
-			+ 'and FABRIKA_ZEROPS_ACCESS_TOKEN from `control` in Zerops, then run `fabrika platform deploy --provider=zerops` with this project and source checkout.',
+		`Every bootstrap variable is placed. If this deploy fails, finish it with \`platform deploy\`, which takes its credentials from ${input.secretsFile}.`,
 	)
 	log.info(
 		`\`platform deploy\` owns the whole ordered sequence: ${PLATFORM_CONCURRENT_DEPLOY.join(' + ')} together, then ${
@@ -189,7 +203,7 @@ const installPreparedPlatform = async (
 	)
 	if (!(await prompts.confirm('Deploy the installation now? (about 15 minutes)', true))) {
 		log.action('OPERATOR ACTION — every variable is placed; the installation is one command from running', [
-			`FABRIKA_ZEROPS_ACCESS_TOKEN=… FABRIKA_IAM_PROVISIONING_KEY=… fabrika platform deploy --provider=zerops --source-dir=. --project-id=${project.id} --env=${environment}`,
+			withSecrets(`fabrika platform deploy --provider=zerops --source-dir=. --project-id=${project.id} --env=${environment}`),
 		])
 	} else {
 		await deployPreparedPlatform(
@@ -209,22 +223,19 @@ const installPreparedPlatform = async (
 	}
 
 	log.step('Hand off')
-	// The intentional secret-output exception: init needs the key IAM was seeded with, never a new value.
-	log.action('CAPTURE THIS NOW — the CLI keeps no copy; recover it from the `iam` or `control` service environment in Zerops', [
-		`FABRIKA_IAM_PROVISIONING_KEY=${secrets.provisioningKey}`,
-	])
-	log.info('`fabrika platform init --provider=zerops <installation>` asks for two required deployment secrets:')
-	log.info('  FABRIKA_IAM_PROVISIONING_KEY   the key above')
-	log.info('  FABRIKA_ZEROPS_ACCESS_TOKEN    the integration token just minted — read it back from the `control` service, never printed here')
+	log.info(`Every credential is in ${input.secretsFile}, and nothing prints one. Keep that file private and backed up:`)
+	log.info('it holds the vault key, whose loss is unrecoverable, and Zerops does not hand any of them back.')
+	log.info('`platform init` and `control key issue` read their credentials from it under the names it uses.')
 	log.info(`The console answers at ${platformOrigin(input.scheme, hosts.control)}, once someone can sign in: nobody can yet.`)
-	// Through the SAME boxed path as the key above, deliberately: `action` is already the one output
-	// that carries a secret value, so the ready-to-run command does not become a second place one is
-	// printed. `platform admin` is idempotent, so re-running it is safe.
+	// `platform admin` is idempotent, so re-running it is safe.
 	log.action('ADMIT YOURSELF — the console has no administrator until this runs', [
-		`FABRIKA_IAM_PROVISIONING_KEY=${secrets.provisioningKey} fabrika platform admin --provider=zerops --email=<you> --iam-host=${hosts.iam}`,
+		withSecrets(`fabrika platform admin --provider=zerops --email=<you> --iam-host=${hosts.iam}`),
 	])
 }
 
+/** A path as one shell word. */
+const shellQuoted = (path: string): string => `'${path.replaceAll("'", "'\\''")}'`
+
 /**
  * The confirmations stand between a stray invocation and an installation: this command generates six
  * credentials, mints a Zerops token on the account and deploys.
@@ -242,6 +253,7 @@ export const consoleInstallCollaborators = (input: PlatformInstallInput, reconci
 	const prompts = installPrompts(input, process.stdin, (line) => consoleInfo(line))
 	return {
 		prepareSource: prepareInstallationSource,
+		checkerPublished: npmCheckerPublication(),
 		uploadFetch: (url, init) => fetch(url, init),
 		api: createZeropsApi({
 			token: input.accessToken,
@@ -258,5 +270,6 @@ export const consoleInstallCollaborators = (input: PlatformInstallInput, reconci
 		},
 		prompts,
 		signal: new AbortController().signal,
+		storeSecrets: (text) => writeSecretsFile(input.secretsFile, text),
 	}
 }

package/src/installation/machine-key.ts

@@ -50,8 +50,9 @@ export const machineKeyNextStepLines = (step: MachineKeyNextStep = {}): readonly
 		// Never a guessed origin: the control service records the real one, and reading it is one command.
 		? readFrom('FABRIKA_IAM_RPC_URL', "`control`'s own FABRIKA_IAM_ISSUER, in the Zerops project")
 		: `export FABRIKA_IAM_RPC_URL=${step.iamOrigin}`,
-	readFrom('FABRIKA_IAM_RPC_KEY', "the `iam` or `control` service's env, in the Zerops project"),
-	readFrom('FABRIKA_IAM_PROVISIONING_KEY', 'the same env — the copy anyone with the project can read;'),
+	// Not the service env: Zerops reads a sensitive value back as `REDACTED` outside sudo mode.
+	readFrom('FABRIKA_IAM_RPC_KEY', 'the secrets file `platform install` wrote (--secrets-file)'),
+	readFrom('FABRIKA_IAM_PROVISIONING_KEY', 'the same file — the copy an operator can read;'),
 	continued(
 		step.sidecarEnvironment === undefined
 			? "the sidecar repository's Environment holds the copy the pipeline uses"

package/src/installation/platform-archive.ts

@@ -0,0 +1,87 @@
+import type { ZeropsSourceDataFile } from '../source/port'
+
+const BLOCK = 512
+const END_OF_ARCHIVE = new Uint8Array(BLOCK * 2)
+
+const text = (block: Uint8Array, start: number, length: number): string => {
+	const field = block.subarray(start, start + length)
+	const end = field.indexOf(0)
+	return new TextDecoder().decode(end < 0 ? field : field.subarray(0, end))
+}
+
+const octal = (block: Uint8Array, start: number, length: number): number => {
+	const raw = text(block, start, length).trim()
+	const value = raw === '' ? 0 : Number.parseInt(raw, 8)
+	if (!/^[0-7]*$/.test(raw) || !Number.isSafeInteger(value)) throw new Error('the prepared platform archive is not a tar archive')
+	return value
+}
+
+const blocksOf = (size: number): number => Math.ceil(size / BLOCK) * BLOCK
+
+/** The `path` record of a pax extended header, the form `git archive` uses for a name over 100 bytes. */
+const paxPath = (payload: Uint8Array): string | undefined => {
+	for (const record of new TextDecoder().decode(payload).split('\n')) {
+		const match = /^\d+ path=(.*)$/.exec(record)
+		if (match?.[1] !== undefined) return match[1]
+	}
+	return undefined
+}
+
+const header = (path: string, size: number): Uint8Array => {
+	const block = new Uint8Array(BLOCK)
+	const write = (start: number, value: string): void => void block.set(new TextEncoder().encode(value), start)
+	write(0, path)
+	write(100, '0000644\0')
+	write(108, '0000000\0')
+	write(116, '0000000\0')
+	write(124, `${size.toString(8).padStart(11, '0')}\0`)
+	write(136, '00000000000\0')
+	block.fill(0x20, 148, 156)
+	write(156, '0')
+	write(257, 'ustar\0')
+	write(263, '00')
+	const checksum = block.reduce((sum, byte) => sum + byte, 0)
+	write(148, `${checksum.toString(8).padStart(6, '0')}\0 `)
+	return block
+}
+
+/**
+ * The prepared platform archive plus the one generated data file (ADR-0045): every entry of the commit is copied
+ * byte for byte, and the file is appended after the last one. A commit that already holds the path, as a file or
+ * as a directory, is refused rather than overridden.
+ */
+export const archiveWithDataFile = (compressed: Uint8Array<ArrayBuffer>, file: ZeropsSourceDataFile): Uint8Array<ArrayBuffer> => {
+	const path = new TextEncoder().encode(file.path)
+	if (path.byteLength === 0 || path.byteLength > 100 || file.path.includes('..') || file.path.startsWith('/')) {
+		throw new Error(`the data file path \`${file.path}\` is not one a ustar header holds`)
+	}
+	const tar = Bun.gunzipSync(compressed)
+	let offset = 0
+	let pendingPath: string | undefined
+	for (;;) {
+		const block = tar.subarray(offset, offset + BLOCK)
+		if (block.byteLength < BLOCK) throw new Error('the prepared platform archive ends without its end-of-archive blocks')
+		if (block.every((byte) => byte === 0)) break
+		const size = octal(block, 124, 12)
+		const type = text(block, 156, 1)
+		const content = tar.subarray(offset + BLOCK, offset + BLOCK + size)
+		if (type === 'x') {
+			pendingPath = paxPath(content)
+		} else if (type !== 'g') {
+			const prefix = text(block, 345, 155)
+			const named = pendingPath ?? (prefix === '' ? text(block, 0, 100) : `${prefix}/${text(block, 0, 100)}`)
+			pendingPath = undefined
+			const entry = named.replace(/\/$/, '')
+			if (entry === file.path || entry.startsWith(`${file.path}/`)) {
+				throw new Error(`the platform source already holds \`${file.path}\`, the proxy manifest's place in the build archive`)
+			}
+		}
+		offset += BLOCK + blocksOf(size)
+	}
+	const contents = new TextEncoder().encode(file.contents)
+	const appended = new Uint8Array(offset + BLOCK + blocksOf(contents.byteLength) + END_OF_ARCHIVE.byteLength)
+	appended.set(tar.subarray(0, offset))
+	appended.set(header(file.path, contents.byteLength), offset)
+	appended.set(contents, offset + BLOCK)
+	return Bun.gzipSync(appended)
+}

package/src/installation/platform-upload.ts

@@ -10,13 +10,13 @@ export const validatePlatformUploadUrl = (value: string): void => {
 
 export const uploadPlatformArchive = async (
 	url: string,
-	archivePath: string,
+	archive: Blob,
 	signal: AbortSignal,
 	uploadFetch: PlatformUploadFetch,
 ): Promise<void> => {
 	validatePlatformUploadUrl(url)
 	const uploadSignal = AbortSignal.any([signal, AbortSignal.timeout(10 * 60_000)])
-	const body = Bun.file(archivePath).stream()
+	const body = archive.stream()
 	try {
 		const response = await uploadFetch(url, {
 			method: 'PUT',

package/src/installation/secrets.ts

@@ -1,8 +1,7 @@
 // The six values `fabrika platform install --provider=zerops` GENERATES, and their shapes.
 //
-// Every one of them is written to a Zerops service and never stored anywhere else — there is no `.env`
-// on this path, deliberately (see `init.ts`). Only the provisioning key is ever printed, once, at the
-// end of the install, because `platform init` asks the operator for it afterwards.
+// Every one of them is written to a Zerops service as a SENSITIVE variable, which Zerops does not hand
+// back, and to the operator's local secrets file (`install-secrets.ts`) before that. None is printed.
 //
 // The shapes are not free choices. Each one is what the consuming code already parses:
 //
@@ -59,7 +58,7 @@ export interface InstallationSecrets {
 	readonly rpcKey: string
 	/** Authenticates IAM's `/auth/mint/*` surface, which the proxy calls on the cold path. */
 	readonly proxyKey: string
-	/** The `px_` admin bearer IAM admits as a synthetic global admin. The one value this command prints. */
+	/** The `px_` admin bearer IAM admits as a synthetic global admin. `platform init` and `admin` take it. */
 	readonly provisioningKey: string
 	/** The catalog credential control and Operations share. No `px_` prefix — it is not an IAM credential. */
 	readonly operationsSyncKey: string

package/src/installation/sidecar.ts

@@ -24,6 +24,7 @@
 // Cloudflare builds a runner image and needs a GitHub App; Zerops has no runner at all (ADR-0003).
 
 import { resolve } from 'node:path'
+import { z } from 'zod'
 
 const TEMPLATES = resolve(import.meta.dir, 'templates')
 
@@ -33,6 +34,9 @@ export const SIDECAR_FILES = ['.gitignore', 'README.md', 'fabrika.ref', '.github
 /** The file that pins which published fabrika tag this installation runs. */
 export const FABRIKA_REF_FILE = 'fabrika.ref'
 
+/** The generated pipeline. CLI-owned: `init` and `upgrade` both rewrite it. */
+export const SIDECAR_WORKFLOW_PATH = '.github/workflows/platform.yml'
+
 /** What a rendered sidecar repository is named after. */
 export interface SidecarValues {
 	/** The operator's name for this installation. The GitHub Environment is named after it too. */
@@ -75,6 +79,37 @@ const render = async (name: string, values: SidecarValues): Promise<string> => {
 		.replaceAll('{{FABRIKA_REF}}', values.fabrikaRef)
 }
 
+/** The generated pipeline for one installation. Its only placeholder is the installation, which names its GitHub Environment. */
+export const renderSidecarWorkflow = async (installation: string): Promise<string> =>
+	(await Bun.file(resolve(TEMPLATES, 'platform.yml')).text()).replaceAll('{{INSTALLATION}}', installation)
+
+const sidecarWorkflowSchema = z.object({ jobs: z.object({ deploy: z.object({ environment: z.string().trim().min(1) }) }) })
+
+/**
+ * The installation a sidecar's current workflow was rendered for, read back from its GitHub Environment.
+ *
+ * Not from the repository name: `init --repo` accepts any name, and a workflow rendered for the wrong
+ * Environment deploys with no credentials.
+ */
+export const readSidecarWorkflowInstallation = async (dir: string): Promise<string> => {
+	const regenerate = 'run `fabrika platform init --provider=zerops <installation>` to regenerate it'
+	const file = Bun.file(resolve(dir, SIDECAR_WORKFLOW_PATH))
+	if (!(await file.exists())) {
+		throw new Error(`${dir} has no ${SIDECAR_WORKFLOW_PATH} — ${regenerate}`)
+	}
+	let document: unknown
+	try {
+		document = Bun.YAML.parse(await file.text())
+	} catch {
+		throw new Error(`${dir}/${SIDECAR_WORKFLOW_PATH} is not valid YAML — ${regenerate}`)
+	}
+	const parsed = sidecarWorkflowSchema.safeParse(document)
+	if (!parsed.success) {
+		throw new Error(`${dir}/${SIDECAR_WORKFLOW_PATH} names no \`jobs.deploy.environment\` — ${regenerate}`)
+	}
+	return parsed.data.jobs.deploy.environment
+}
+
 const write = async (dir: string, rel: string, content: string): Promise<void> => {
 	await Bun.write(resolve(dir, rel), content)
 }
@@ -83,7 +118,8 @@ const write = async (dir: string, rel: string, content: string): Promise<void> =
  * Write the sidecar files into `dir`.
  *
  * The workflow, the README and the `.gitignore` are CLI-owned and refreshed on every run, so a fix to
- * the generated pipeline reaches every installation on its operator's next `init`. `fabrika.ref` is
+ * the generated pipeline reaches every installation on its operator's next `init` (and the workflow on
+ * the next `upgrade`). `fabrika.ref` is
  * written ONLY when absent: bumping it is how an operator rolls the installation forward, and a refresh
  * that reset it would silently roll them back.
  *
@@ -99,7 +135,7 @@ export const materializeSidecarScaffold = async (dir: string, values: SidecarVal
 	}
 	await write(dir, '.gitignore', await Bun.file(resolve(TEMPLATES, 'gitignore')).text())
 	await write(dir, 'README.md', await render('README.md', values))
-	await write(dir, '.github/workflows/platform.yml', await render('platform.yml', values))
+	await write(dir, SIDECAR_WORKFLOW_PATH, await renderSidecarWorkflow(values.installation))
 	if (existing === undefined) {
 		await write(dir, FABRIKA_REF_FILE, await render('fabrika.ref', values))
 	}

package/src/installation/templates/README.md

@@ -122,4 +122,4 @@ Only a change to `fabrika.ref` or to the workflow triggers a push-driven run; ed
 not deploy.
 
 `fabrika.ref` is operator-owned: `fabrika platform init` writes it once and never overwrites a later
-version pin.
+version pin. The workflow is not: `init` and `upgrade` both rewrite it to the one their CLI generates.

package/src/installation/templates/platform.yml

@@ -21,7 +21,8 @@ name: platform
 #
 # contember/fabrika-platform is public and checked out tokenless at the TAG pinned in `fabrika.ref`.
 # Bump that tag and push to roll this installation forward — `fabrika platform upgrade --provider=zerops
-# --to=<tag> {{INSTALLATION}}` does exactly that and then follows the run this file starts.
+# --to=<tag> {{INSTALLATION}}` does exactly that, rewrites this file to the one its CLI generates in the
+# same commit, and then follows the run this file starts. `init` rewrites it too: an edit here does not last.
 
 on:
   workflow_dispatch:
@@ -87,9 +88,29 @@ jobs:
         working-directory: fabrika-platform
         run: echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
+      - name: Resolve the Bun release of the pinned tag
+        id: bun
+        working-directory: fabrika-platform
+        env:
+          PINNED_REF: ${{ steps.ref.outputs.fabrika }}
+        # Exactly the Bun the tag was built and released with, never `latest`: a newer Bun rewrites the
+        # lockfile and `--frozen-lockfile` refuses it. Tags up to v0.4.3 carry no `.bun-version` and were
+        # all released with Bun 1.3.14.
+        run: |
+          if [ -f .bun-version ]; then
+            version="$(tr -d '[:space:]' < .bun-version)"
+          else
+            version=1.3.14
+          fi
+          if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "fabrika-platform@$PINNED_REF names no exact Bun release in .bun-version: '$version'." >&2
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ steps.bun.outputs.version }}
 
       - name: Install fabrika
         working-directory: fabrika-platform

package/src/installation/topology/setups.ts

@@ -89,7 +89,6 @@
 // resolves nested references (a `RUNTIME_` lift of a variable that is itself `${db_connectionString}`
 // arrives fully resolved). Only the proxy needs this, and it declares it explicitly below.
 
-import { FABRIKA_PROXY_MANIFEST_JSON } from '@fabrika/proxy-core/manifest'
 import type { ZeropsHealthCheckSpec, ZeropsReadinessCheckSpec, ZeropsYamlSetupSpec, ZeropsYamlSpec } from '../../index'
 
 // ── Readiness and liveness: two mechanisms, two questions ──────────────────────────────────────────
@@ -324,37 +323,28 @@ const operations: ZeropsYamlSetupSpec = {
  *
  * Per-service variables (env API): `FABRIKA_IAM_ISSUER` — `http://iam:3000` in the platform project, the
  * IAM service's PUBLIC origin in an apps project, because there is no private network between projects
- * (ADR-0006). And `FABRIKA_PROXY_MANIFEST_JSON`; see below.
+ * (ADR-0006). The manifest is not a variable; see below.
  *
  * Secret (`envSecrets`): `FABRIKA_IAM_KEY` — the value IAM knows as `FABRIKA_IAM_PROXY_KEY`.
  *
- * ── How the manifest reaches the build, and what is unverified about it ───────────────────────────
+ * ── How the manifest reaches the build ───────────────────────────────────────────────────────────
  *
  * `proxy.manifest.json` tells the proxy which apps it fronts, at which upstream, under which endpoint table. It
  * is baked into the artifact at BUILD time, which is what `docs/backlog/08` chose ("redeploy") over
- * pushing to Caddy's admin API. But on Zerops fabrika has no filesystem in the deploy path — a Zerops
- * deploy is five HTTP calls (ADR-0003) — so the driver cannot write a file into the build the way the
- * Cloudflare path can. The only write channel it has is the service-level env API, the same one it uses
- * for secrets, so the manifest travels as a service variable and the build materializes it to a file.
+ * pushing to Caddy's admin API. It arrives as the one generated data file of the uploaded build archive
+ * (ADR-0045), beside the exact public commit, at a path the commit does not hold: Control streams it into a
+ * namespace proxy's archive (`republishProxy`, `packages/provider-zerops/src/namespace/proxy-attempt.ts`), and
+ * `platform install` / `platform deploy` append it to the platform proxy's (`installation/platform-archive.ts`).
+ * It never travels through the service environment, whose values Zerops caps at ~32 KB.
  *
- * The control plane writes `FABRIKA_PROXY_MANIFEST_JSON` through the service-level env API and rolls
- * this service before each app deploy (`republishProxy`, `packages/provider-zerops/src/namespace/proxy-attempt.ts`).
+ * Releases before this one lifted `FABRIKA_PROXY_MANIFEST_JSON` from the env API into the build instead.
+ * A namespace pinned to such a release keeps that descriptor, and Control keeps writing the variable for it
+ * (`zeropsProxyManifestCarrier`): never add the lift back, or a pin of this release would get the variable.
  *
- * That live-account fact is now settled, and the answer was the bad one: **a build container sees none
- * of its service's env-API variables.** Read directly, `${FABRIKA_PROXY_MANIFEST_JSON}` in a build
- * command is the empty string — no error, no warning. Left uncorrected, every proxy build would have
- * written an empty manifest, failed `generate-config.ts`, and made this service undeployable on Zerops.
- *
- * The fix is the `build.envVariables` declaration below rather than the move into `run.initCommands`
- * this header used to anticipate: `${RUNTIME_x}` lifts a service's own runtime variable into its build
- * context, and it resolves nested references too. The delivery channel and the fail-closed parser are
- * unchanged, which is what that contingency promised.
- *
- * What IS structural: missing or malformed JSON makes `generate-config.ts` exit non-zero, so the
+ * What IS structural: a missing or malformed file makes `generate-config.ts` exit non-zero, so the
  * pipeline fails and the previous version keeps serving. A valid empty app list generates only the
  * terminal 404 route, and the auth service denies every forwarded request.
  */
-const proxyManifestReference = `\${${FABRIKA_PROXY_MANIFEST_JSON}}`
 
 /**
  * The proxy's public listeners.
@@ -395,19 +385,17 @@ const proxy: ZeropsYamlSetupSpec = {
 		// database, a stronger supply-chain guarantee than a release tarball with a hand-copied hash — and
 		// the toolchain floats. If a future Go release breaks the build, this is the line that moved.
 		base: ['alpine/go@latest', 'alpine/bun@1.3'],
-		// Runtime values reach the build only through the explicit RUNTIME_ bridge.
+		// Runtime values reach the build only through the explicit RUNTIME_ bridge. The manifest is not one:
+		// it is the archive's data file (see the header).
 		envVariables: {
-			[FABRIKA_PROXY_MANIFEST_JSON]: `\${RUNTIME_${FABRIKA_PROXY_MANIFEST_JSON}}`,
 			FABRIKA_PROXY_SESSION_OWNER_JSON: '${RUNTIME_FABRIKA_PROXY_SESSION_OWNER_JSON}',
 		},
 		// CGO off makes the binary static, which is what lets it run on Alpine/musl.
 		prepareCommands: ['CGO_ENABLED=0 GOBIN=/tmp/gobin go install github.com/caddyserver/caddy/v2/cmd/caddy@v2.10.2'],
 		buildCommands: [
 			'bun install --frozen-lockfile',
-			// See the header: the manifest arrives as a service variable because the driver has no
-			// filesystem. `printf` rather than `echo` so a leading `-` or a backslash survives intact.
-			`printf %s "${proxyManifestReference}" > ./proxy.manifest.json`,
-			// Missing/malformed JSON fails the build; an empty app list emits only deny/404 routes.
+			// The archive's data file (see the header). Missing/malformed JSON fails the build; an empty app list
+			// emits only deny/404 routes.
 			`bun run packages/proxy/src/generate-config.ts ./proxy.manifest.json ./caddy.json --auth-upstream 127.0.0.1:9000 --listen ${
 				PROXY_PUBLIC_PORTS.map((port) => `:${port}`).join(',')
 			}`,