@fabrika/provider-zerops 0.4.2 → 0.4.4

package/src/namespace/update.ts

@@ -9,8 +9,9 @@ import {
 } from '@fabrika/provider-contract'
 import { waitForProcess, ZeropsApiError, type ZeropsProcess } from '../api'
 import { defaultSleep } from '../collaborators'
-import { envelope, namespaceUpdatePayloadSchema, normalizeTarget, zeropsNamespaceTargetCodec } from './codec'
+import { envelope, namespaceUpdatePayloadSchema, normalizeTarget, ZEROPS_PROXY_SOURCE_CURRENT, zeropsNamespaceTargetCodec } from './codec'
 import { asNamespaceError, namespaceError, ZEROPS_NAMESPACE_CANCELLED } from './errors'
+import { verifyZeropsNamespaceProxySource } from './proxy-source'
 import type { NormalizedZeropsNamespaceTarget, ZeropsNamespaceOptions, ZeropsNamespacePostgres, ZeropsNamespaceTarget } from './types'
 import { validateService } from './validation'
 
@@ -21,11 +22,16 @@ const READBACK_INTERVAL_MS = 3_000
 /** UNVERIFIED: how soon `autoscalingProfileId` reads the new profile after the PUT and its process finish. */
 const READBACK_ATTEMPTS = 10
 
-type FixedField = Exclude<keyof ZeropsNamespaceTarget, 'postgres'>
+/** The plan field of a re-pin, which moves only the stored target; the reconcile core queues rebuilds the proxy. */
+export const ZEROPS_PROXY_SOURCE_FIELD = 'proxySource'
 
-/** Every target field but `postgres`, whose profile is the one thing an update may move. A new field fails to compile until listed. */
+type FixedField = Exclude<keyof ZeropsNamespaceTarget, 'postgres' | 'proxySource'>
+
+/**
+ * Every target field but the two an update may move: the PostgreSQL profile, and the proxy source pin, which only an
+ * explicit re-pin to the installation's default moves (ADR-0045). A new field fails to compile until listed.
+ */
 const FIXED_FIELDS: { readonly [K in FixedField]: (target: ZeropsNamespaceTarget) => ZeropsNamespaceTarget[K] } = {
-	proxySource: (target) => target.proxySource,
 	proxyBuild: (target) => target.proxyBuild,
 	proxyDeployment: (target) => target.proxyDeployment,
 	projectName: (target) => target.projectName,
@@ -69,10 +75,17 @@ const mergedTarget = (
 	if (typeof stored !== 'object' || stored === null || Array.isArray(stored)) {
 		throw new Error('Zerops namespace target did not encode to an object')
 	}
-	return normalizeTarget({ ...namespace, target: { ...requested, payload: { ...stored, ...payload } } }, options)
+	if (checked.data.proxySource !== ZEROPS_PROXY_SOURCE_CURRENT) {
+		return normalizeTarget({ ...namespace, target: { ...requested, payload: { ...stored, ...payload } } }, options)
+	}
+	const fields = Object.fromEntries(Object.entries(payload).filter(([key]) => key !== 'proxySource'))
+	return {
+		...normalizeTarget({ ...namespace, target: { ...requested, payload: { ...stored, ...fields } } }, options),
+		proxySource: options.proxySource,
+	}
 }
 
-/** Refuse every difference except the PostgreSQL profile, naming the fields. */
+/** Refuse every difference except the PostgreSQL profile and a re-pin of the proxy source, naming the fields. */
 const planUpdate = (
 	namespace: ProviderDeploymentNamespace,
 	requested: ProviderEnvelope,
@@ -84,8 +97,32 @@ const planUpdate = (
 		.filter(([, read]) => JSON.stringify(read(current)) !== JSON.stringify(read(merged)))
 		.map(([field]) => field)
 	if (changed.length > 0) {
-		throw immutable(`Zerops namespace ${namespace.id} cannot change ${changed.join(', ')} in place; only the PostgreSQL profile can`)
+		throw immutable(
+			`Zerops namespace ${namespace.id} cannot change ${changed.join(', ')} in place; only the PostgreSQL profile and the proxy source can`,
+		)
+	}
+	if (JSON.stringify(current.proxySource) === JSON.stringify(merged.proxySource)) return planProfile(namespace, current, merged)
+	if (JSON.stringify(merged.proxySource) !== JSON.stringify(options.proxySource)) {
+		throw new Error(`Zerops namespace ${namespace.id} can re-pin its proxy source only to the installation's default: proxySource "current"`)
+	}
+	if (JSON.stringify(current.postgres) !== JSON.stringify(merged.postgres)) {
+		throw new Error(`Zerops namespace ${namespace.id}: re-pin the proxy source and change the PostgreSQL profile in separate updates`)
+	}
+	// Rebuilding under a new pin settles an attempt first, and would record that attempt's version as the new pin's.
+	if (current.proxyBuild !== undefined) {
+		throw new Error(`Zerops namespace ${namespace.id} has a proxy build in flight; reconcile it before re-pinning the proxy source`)
+	}
+	return {
+		namespace: { ...namespace, target: envelope(merged) },
+		change: { field: ZEROPS_PROXY_SOURCE_FIELD, from: current.proxySource.commitSha, to: merged.proxySource.commitSha },
 	}
+}
+
+const planProfile = (
+	namespace: ProviderDeploymentNamespace,
+	current: NormalizedZeropsNamespaceTarget,
+	merged: NormalizedZeropsNamespaceTarget,
+): ProviderNamespaceUpdatePlan => {
 	const was = current.postgres
 	const wanted = merged.postgres
 	const unchanged: ProviderNamespaceUpdatePlan = { namespace: { ...namespace, target: envelope(current) }, change: null }
@@ -186,10 +223,15 @@ const applyProfile = async (
 
 const applyUpdate = async (input: ProviderNamespaceUpdateInput, options: ZeropsNamespaceOptions): Promise<ProviderDeploymentNamespace> => {
 	const current = normalizeTarget(input.namespace, options)
+	const plan = planUpdate(input.namespace, input.next.target, options)
+	// A re-pin touches no platform resource: it stores the pin, and the reconcile core queues builds from it.
+	if (plan.change?.field === ZEROPS_PROXY_SOURCE_FIELD) {
+		await verifyZeropsNamespaceProxySource(normalizeTarget(plan.namespace, options).proxySource)
+		return plan.namespace
+	}
 	if (!current.ready) {
 		throw new Error(`Zerops namespace ${input.namespace.id} is not ready`)
 	}
-	const plan = planUpdate(input.namespace, input.next.target, options)
 	const wanted = normalizeTarget(plan.namespace, options).postgres
 	// Checked even with no planned change: after an unconfirmed update, confirming the live service is
 	// what lets core return the namespace to ready.

package/src/provider.ts

@@ -8,19 +8,22 @@
 // runs. Recovery never resumes a deploy (ADR-0044): a version reserved but never triggered is deleted, and
 // one whose build may have been requested is settled only by polling it.
 
-import { appEnvironmentId } from '@fabrika/auth-core'
+import { appEnvironmentId, FABRIKA_SOURCE_MAP_UPLOAD_KEY } from '@fabrika/auth-core'
+import { type OperationsSourceMapUploadState, readSourceMapUploadReport } from '@fabrika/operations-contract/releases'
 import {
 	type DeployStepResult,
 	followLeaseLoss,
 	isLeaseLoss,
 	type JsonValue,
 	type ProviderApprovedAccess,
+	type ProviderDeployInput,
 	ProviderInvocationAbort,
 	type ProviderManagedEnvironment,
 	type ProviderRunEvents,
 	runSteps,
 } from '@fabrika/provider-contract'
 import {
+	readableContent,
 	waitForProcess,
 	ZEROPS_ACTIVE,
 	ZEROPS_PROCESS_FINISHED,
@@ -47,9 +50,11 @@ import {
 	assertAuthoredManagedDocument,
 	assertAuthoredManagedInputs,
 	isFrameworkFamilyVariable,
+	isSensitiveFamilyVariable,
 	type ManagedValues,
 	overlayRelease,
 	parseManagedEnvironment,
+	SENSITIVE_MANAGED_KEYS,
 	SERVICE_MANAGED_KEYS,
 } from './managed-env'
 import {
@@ -81,6 +86,8 @@ export interface ZeropsDeployRun {
 	readonly artifact: FabrikaManifest
 	/** Control's approved access for the environment (ADR-0050); the lock-down and the IAM schema come from it. */
 	readonly access?: ProviderApprovedAccess
+	/** The run-scoped source-map destination Control minted; the build uploads to it. */
+	readonly artifactUpload?: ProviderDeployInput['artifactUpload']
 	readonly dryRun: boolean
 	readonly signal: AbortSignal
 	readonly events: ProviderRunEvents
@@ -91,6 +98,8 @@ export interface ZeropsDeployResult {
 	readonly env: string
 	readonly status: 'succeeded' | 'failed'
 	readonly steps: readonly DeployStepResult[]
+	/** Whether the build's source maps reached Operations; absent when the run had no upload to make. */
+	readonly artifactState?: OperationsSourceMapUploadState
 }
 
 /** How often `await-version` asks Zerops for the version's status. */
@@ -271,6 +280,8 @@ interface Attempt {
 	uploadUrl?: string
 	processId?: string
 	triggered: boolean
+	/** What the build's source-map upload reported in its log, once a relayed line said so. */
+	sourceMaps?: OperationsSourceMapUploadState
 }
 
 /** Everything one step's executor needs, bundled so the per-kind handlers stay small. */
@@ -353,6 +364,8 @@ const relayLog = async (
 			}
 			seen.add(key)
 			env.log(`  │ ${line.message}`)
+			const reported = readSourceMapUploadReport(line.message)
+			if (reported !== null) env.attempt.sourceMaps = reported
 		}
 	} catch (error) {
 		env.log(`  [warn] build-log relay unavailable: ${error instanceof Error ? error.message : 'unknown error'}`)
@@ -452,8 +465,8 @@ const verifyExposure = async (env: StepEnv): Promise<void> => {
 	const created = env.attempt.created ?? new Map<string, string>()
 	const buckets = artifact.target.importDocument.services.filter((service) => isObjectStorageType(service.type)).map((service) => service.hostname)
 	const records = buckets.length === 0 ? [] : await zerops.api.listServiceEnv({ serviceId: target.serviceId, signal })
-	const marker = records.find((record) => record.key === STORAGE_PROVENANCE_KEY)
-	const known = new Set([...parseStorageProvenance(marker?.content), ...(target.createdBuckets ?? [])])
+	const marker = readableContent(records.find((record) => record.key === STORAGE_PROVENANCE_KEY))
+	const known = new Set([...parseStorageProvenance(marker), ...(target.createdBuckets ?? [])])
 	const findings: ExposureFinding[] = []
 	const bucketIds: string[] = []
 	for (const hostname of manifestServiceHostnames(artifact)) {
@@ -502,8 +515,13 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 	const { zerops, log, signal, managedValues, familyVariables } = env
 	const serviceId = env.run.target.serviceId
 	if (env.dryRun) {
-		const written = [...SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] !== null), ...Object.keys(familyVariables)]
-		const removed = SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] === null)
+		const upload = env.run.artifactUpload !== undefined
+		const written = [
+			...SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] !== null),
+			...Object.keys(familyVariables),
+			...(upload ? [FABRIKA_SOURCE_MAP_UPLOAD_KEY] : []),
+		]
+		const removed = [...SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] === null), ...(upload ? [] : [FABRIKA_SOURCE_MAP_UPLOAD_KEY])]
 		log(`  [dry-run] would write service variables on ${serviceId}: ${written.join(', ') || '(none)'}`)
 		log(`  [dry-run] would remove service variables on ${serviceId} if present: ${removed.join(', ') || '(none)'}`)
 		if (Object.keys(familyVariables).length > 0) {
@@ -517,9 +535,10 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 	for (const key of SERVICE_MANAGED_KEYS) {
 		const value = managedValues[key]
 		const existing = records.find((record) => record.key === key)
+		const sensitive = SENSITIVE_MANAGED_KEYS.has(key)
 		assertRunning(signal)
-		if (value !== null && existing?.content !== value) {
-			await zerops.api.putServiceEnv({ serviceId, key, value, signal })
+		if (value !== null && (sensitive || readableContent(existing) !== value)) {
+			await zerops.api.putServiceEnv({ serviceId, key, value, sensitive, signal })
 			log(`  ${key}: updated`)
 		} else if (value === null && existing !== undefined) {
 			await zerops.api.deleteServiceEnv({ envId: existing.id, signal })
@@ -530,9 +549,10 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 	}
 	const provenance = env.attempt.storageProvenance
 	const marker = records.find((record) => record.key === STORAGE_PROVENANCE_KEY)
-	if (typeof provenance === 'string' && marker?.content !== provenance) {
+	if (typeof provenance === 'string' && readableContent(marker) !== provenance) {
 		assertRunning(signal)
-		await zerops.api.putServiceEnv({ serviceId, key: STORAGE_PROVENANCE_KEY, value: provenance, signal })
+		// Not a credential, and the exposure read-back above reads it: it must stay readable.
+		await zerops.api.putServiceEnv({ serviceId, key: STORAGE_PROVENANCE_KEY, value: provenance, sensitive: false, signal })
 		log(`  ${STORAGE_PROVENANCE_KEY}: updated`)
 	} else if (provenance === null && marker !== undefined) {
 		assertRunning(signal)
@@ -542,9 +562,10 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 	// A workload key is written like a managed key; one whose workload is gone is removed, so no stale key stays readable.
 	for (const [key, value] of Object.entries(familyVariables)) {
 		const existing = records.find((record) => record.key === key)
+		const sensitive = isSensitiveFamilyVariable(key)
 		assertRunning(signal)
-		if (existing?.content !== value) {
-			await zerops.api.putServiceEnv({ serviceId, key, value, signal })
+		if (sensitive || readableContent(existing) !== value) {
+			await zerops.api.putServiceEnv({ serviceId, key, value, sensitive, signal })
 			log(`  ${key}: updated`)
 		} else {
 			log(`  ${key}: unchanged`)
@@ -557,6 +578,18 @@ const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 			log(`  ${record.key}: removed`)
 		}
 	}
+	// The build lifts the upload's bearer from here (`${RUNTIME_…}`), so the descriptor never holds it.
+	const bearer = env.run.artifactUpload?.bearer ?? null
+	const uploadKey = records.find((record) => record.key === FABRIKA_SOURCE_MAP_UPLOAD_KEY)
+	if (bearer !== null) {
+		assertRunning(signal)
+		await zerops.api.putServiceEnv({ serviceId, key: FABRIKA_SOURCE_MAP_UPLOAD_KEY, value: bearer, sensitive: true, signal })
+		log(`  ${FABRIKA_SOURCE_MAP_UPLOAD_KEY}: updated`)
+	} else if (uploadKey !== undefined) {
+		assertRunning(signal)
+		await zerops.api.deleteServiceEnv({ envId: uploadKey.id, signal })
+		log(`  ${FABRIKA_SOURCE_MAP_UPLOAD_KEY}: removed`)
+	}
 }
 
 /** Run one step's effect. Resolves on success, throws on failure (caught + recorded by `runSteps`). */
@@ -655,7 +688,7 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 		}
 
 		case 'trigger-build': {
-			const locked = lockedExecutionFor(artifact, run, dryRun)
+			const locked = lockedExecutionFor(artifact, run, dryRun, run.artifactUpload)
 			if (dryRun) {
 				log(
 					locked === null
@@ -673,6 +706,7 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 				: renderLockedExecutionDescriptor(contents, artifact.target.zeropsSetup, release, locked)
 			if (locked !== null) {
 				log(`  generated run section; build checks @fabrika/check@${FABRIKA_CHECK_VERSION}, typescript@${PLATFORM_TYPESCRIPT_VERSION}`)
+				if (locked.sourceMaps !== null) log(`  the build uploads the source maps of ${locked.sourceMaps.assetRoots.length} asset root(s)`)
 			}
 			assertRunning(signal)
 			// Recorded BEFORE the request: from here on the version is settled only by polling it (ADR-0044).
@@ -804,5 +838,15 @@ async (run: ZeropsDeployRun): Promise<ZeropsDeployResult> => {
 			run.events.log(`  [warn] app-version ${appVersionId} could not be deleted; it was never built`)
 		}
 	}
-	return { appId: run.appId, env: run.env, ...result }
+	return { appId: run.appId, env: run.env, ...result, ...artifactStateOf(run, result.status, env.attempt) }
+}
+
+/** A run that uploads reports `complete` only when its build log said so; a missing or unread report is `incomplete`. */
+const artifactStateOf = (
+	run: ZeropsDeployRun,
+	status: ZeropsDeployResult['status'],
+	attempt: Attempt,
+): Pick<ZeropsDeployResult, 'artifactState'> => {
+	if (run.artifactUpload === undefined || run.dryRun || status !== 'succeeded') return {}
+	return { artifactState: attempt.sourceMaps === 'complete' ? 'complete' : 'incomplete' }
 }

package/src/proxy-manifest-carrier.ts

@@ -0,0 +1,32 @@
+import { FABRIKA_PROXY_MANIFEST_JSON } from '@fabrika/proxy-core/manifest'
+import { z } from 'zod'
+import { appliedZeropsSetups, parseZeropsDescriptor, selectZeropsDescriptorSetup } from './descriptor'
+
+/** The path of the proxy manifest in the build archive: the archive's one data file (ADR-0045), read by the proxy build. */
+export const ZEROPS_PROXY_MANIFEST_PATH = 'proxy.manifest.json'
+
+/**
+ * How a proxy build receives its manifest.
+ *
+ * - `environment`: the build lifts `FABRIKA_PROXY_MANIFEST_JSON` from the service and writes it to the file, as every
+ *   release before the archive carrier did. A namespace pinned to such a commit keeps its descriptor (ADR-0045), so it
+ *   gets the variable, bound by the Zerops value limit.
+ * - `archive`: the build reads the file the uploaded archive carries.
+ */
+export type ZeropsProxyManifestCarrier = 'environment' | 'archive'
+
+const buildSectionSchema = z.object({ build: z.object({ envVariables: z.record(z.string()).optional() }).passthrough() }).passthrough()
+
+/**
+ * The carrier a descriptor's proxy setup reads. Decided by the build section Zerops applies (the selected setup's, else
+ * the nearest one it `extends`): a lifted `FABRIKA_PROXY_MANIFEST_JSON` would overwrite an archived file, so it wins.
+ */
+export const zeropsProxyManifestCarrier = (descriptorContents: string, setup = 'proxy'): ZeropsProxyManifestCarrier => {
+	const parsed = parseZeropsDescriptor(descriptorContents)
+	for (const entry of appliedZeropsSetups(parsed, selectZeropsDescriptorSetup(parsed, setup))) {
+		const read = buildSectionSchema.safeParse(entry)
+		if (!read.success) continue
+		return read.data.build.envVariables?.[FABRIKA_PROXY_MANIFEST_JSON] === undefined ? 'archive' : 'environment'
+	}
+	return 'archive'
+}

package/src/source/port.ts

@@ -20,10 +20,16 @@ export interface ZeropsSourceResolution {
 	readonly descriptorSha256: string
 }
 
+/** ADR-0045: the one generated data file a platform archive carries beside the exact commit, at a path the commit lacks. */
+export interface ZeropsSourceDataFile {
+	readonly path: string
+	readonly contents: string
+}
+
 /** ADR-0045: platform archives are anonymous, tree-prechecked, keep relative symlinks. */
 export type ZeropsSourceArchive =
 	| { readonly kind: 'application'; readonly privateBinding?: ZeropsSourcePrivateBinding }
-	| { readonly kind: 'platform' }
+	| { readonly kind: 'platform'; readonly dataFile?: ZeropsSourceDataFile }
 
 export interface ZeropsSourceUploadInput {
 	readonly repository: ZeropsSourceRepository
@@ -38,6 +44,8 @@ export interface ZeropsSourceUploadInput {
 export interface ZeropsSourceUploadResult {
 	readonly commitSha: string
 	readonly descriptorSha256: string
+	/** The sha256 of the data file the archive carried; absent without one. */
+	readonly dataFileSha256?: string
 	readonly entryCount: number
 	readonly expandedBytes: number
 }

package/src/installation/manifest.ts

@@ -1,95 +0,0 @@
-// Composing the platform's three apps with whatever else the installation's one proxy already fronts.
-//
-// ── Why this is a MERGE and not a write ───────────────────────────────────────────────────────────
-//
-// On the `light` tier an application shares the platform's project and therefore the platform proxy's
-// single `FABRIKA_PROXY_MANIFEST_JSON`. The live document on `fabrika-test` carries a fourth app —
-// `notes` → `notesapi:3000` on listener 8084 — beside the three platform ones. `platformProxyManifest`
-// deliberately emits only the platform apps (it is generated from the platform's own service contracts and
-// knows nothing about applications), so writing it alone would DELETE every application entry and take
-// the deployed applications offline at the next proxy build.
-//
-// So: read the live value, compose, write. That composition is this command's job and nothing else's.
-//
-// ── What happens to an entry the platform does not know about ─────────────────────────────────────
-//
-// Carried through byte-for-byte, in its live order, after the platform apps — with ONE exception. A
-// host belongs to exactly one app (`parseProxyManifest` refuses two apps claiming one, and rightly:
-// route order would otherwise decide which app answers). The platform's three listeners are addresses
-// the platform OWNS, so a live entry standing on one of them is superseded rather than carried, and
-// the deploy says so out loud.
-//
-// That exception is not hypothetical: WU1 corrected IAM's app id from `iam-local` to `iam`, so the
-// live document's `iam-local` claims the platform's own IAM host under a name the platform no longer
-// uses. Carrying it would produce a manifest `parseProxyManifest` rejects, which the proxy build then
-// fails on — a fail-closed outcome, but a needlessly confusing one.
-//
-// Superseding is itself CLOSED: the dropped host stops resolving to anything, it does not fall through
-// to some other app. A genuinely misplaced application therefore goes dark and is reported, instead of
-// quietly being served by the console.
-
-import { findDuplicateProxyHost, parseProxyManifestJson, type ProxyManifest } from '@fabrika/proxy-core/manifest'
-
-/** The composed document plus what happened to every live entry that was not the platform's. */
-export interface MergedProxyManifest {
-	readonly manifest: ProxyManifest
-	/** App ids carried through from the live manifest, in their live order. */
-	readonly carried: readonly string[]
-	/** Live entries the platform's own listeners displaced, with the host that collided. */
-	readonly superseded: readonly { readonly id: string; readonly host: string }[]
-}
-
-/**
- * Compose the platform's apps with the application entries already in a live manifest.
- *
- * `live` is `null` when the proxy carries no manifest yet (a first deploy) — the result is then the
- * platform document alone. An UNPARSEABLE live value is a different thing entirely and throws: it may
- * be a manifest this build is too old to read, and silently replacing it would drop applications this
- * code cannot see. Refusing is what keeps "must not take a deployed app offline" true in the one case
- * where the deploy genuinely cannot tell.
- */
-export const mergePlatformProxyManifest = (platform: ProxyManifest, live: ProxyManifest | null): MergedProxyManifest => {
-	const platformIds = new Set(platform.apps.map((app) => app.id))
-	const platformHosts = new Set(platform.apps.flatMap((app) => app.hosts))
-	const carried: string[] = []
-	const superseded: { id: string; host: string }[] = []
-	const apps = [...platform.apps]
-	for (const app of live?.apps ?? []) {
-		if (platformIds.has(app.id)) {
-			continue
-		}
-		const collision = app.hosts.find((host) => platformHosts.has(host))
-		if (collision !== undefined) {
-			superseded.push({ id: app.id, host: collision })
-			continue
-		}
-		carried.push(app.id)
-		apps.push(app)
-	}
-	// Both inputs are already parsed manifests, so a duplicate host is the one invariant composing can break.
-	// A duplicate host between two APPLICATION entries — which this function cannot fix — is refused
-	// here rather than at the proxy's next build.
-	if (findDuplicateProxyHost(apps) !== null) {
-		throw new Error('the composed proxy manifest is not one the proxy would accept — two application entries claim one host')
-	}
-	return { manifest: { apps }, carried, superseded }
-}
-
-/**
- * The live manifest a proxy service currently carries.
- *
- * Absent means "no manifest yet". Present-but-unparseable throws: see `mergePlatformProxyManifest`.
- */
-export const readLiveProxyManifest = (value: string | undefined): ProxyManifest | null => {
-	if (value === undefined || value.trim() === '') {
-		return null
-	}
-	const manifest = parseProxyManifestJson(value)
-	if (manifest === null) {
-		throw new Error(
-			`the proxy's current FABRIKA_PROXY_MANIFEST_JSON cannot be parsed by this build — refusing to replace a document whose `
-				+ 'application entries cannot be read',
-		)
-	}
-	return manifest
-}