@fabrika/provider-zerops 0.4.3 → 0.4.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.4.3",
+	"version": "0.4.5",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -43,13 +43,13 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth": "^0.4.3",
-		"@fabrika/auth-core": "^0.4.3",
-		"@fabrika/iam-contract": "^0.4.3",
-		"@fabrika/installation-init": "^0.4.3",
-		"@fabrika/operations-contract": "^0.4.3",
-		"@fabrika/provider-contract": "^0.4.3",
-		"@fabrika/proxy-core": "^0.4.3",
+		"@fabrika/auth": "^0.4.5",
+		"@fabrika/auth-core": "^0.4.5",
+		"@fabrika/iam-contract": "^0.4.5",
+		"@fabrika/installation-init": "^0.4.5",
+		"@fabrika/operations-contract": "^0.4.5",
+		"@fabrika/provider-contract": "^0.4.5",
+		"@fabrika/proxy-core": "^0.4.5",
 		"yaml": "^2.9.1"
 	}
 }

package/src/execution.ts

@@ -291,14 +291,15 @@ const sourceMapBuildVariables = (upload: OperationsSourceMapBuildUpload): Record
 
 /**
  * The generated build commands, in order; the authored SPA commands run before all of them. The application's tests
- * run first: they are authored code, so everything after them is reinstalled, regenerated or checked again.
+ * run first: they are authored code, so everything after them is reinstalled, regenerated or checked again. They run
+ * `--isolate`, as the application skill runs them: a test file's DOM globals otherwise leak into the next file.
  */
 export function generatedBuildCommands(execution: ZeropsLockedExecution): readonly string[] {
 	if (!LOCKED_APP_ID_PATTERN.test(execution.appId)) throw new Error('zerops: a contract application id must match [a-z0-9][a-z0-9-]*')
 	const database = execution.databaseUrl !== null
 	return [
 		INSTALL,
-		'bun test --pass-with-no-tests',
+		'bun test --isolate --pass-with-no-tests',
 		`rm -rf node_modules && ${INSTALL}`,
 		`bun -e "await import('@fabrika/app/build').then((build) => build.writeGeneratedEntry('.', 'bun'))"`,
 		`cd /tmp && bun x --bun -p @fabrika/check@${FABRIKA_CHECK_VERSION} fabrika-check ${SOURCE_ROOT}`,

package/src/installation/deploy.ts

@@ -19,9 +19,9 @@
 //
 // ── What this command writes, and what it deliberately does not ───────────────────────────────────
 //
-// It writes the composed proxy manifest, the exact namespace planning source default, and the
-// per-installation configuration derived from the resolved public hosts (each service's own origin,
-// the origins it must know about, and the installation's environment name). **It writes no credential at all** — every
+// It composes the proxy manifest and ships it in the proxy's build archive. It writes the exact namespace
+// planning source default and the per-installation configuration derived from the resolved public hosts
+// (each service's own origin, the origins it must know about, and the installation's environment name). **It writes no credential at all** — every
 // secret an installation holds is `platform init`'s to place, and a deploy that cannot write one cannot
 // leak one. The two credentials this command HOLDS are the Zerops access token and the IAM admin key,
 // both from the environment, neither ever logged.
@@ -68,7 +68,6 @@ import {
 	validateInstallationSetups,
 } from './installation-source'
 import type { DeployLog } from './log'
-import { mergePlatformProxyManifest, readLiveProxyManifest } from './manifest'
 import { type IamOAuthConfig, platformIamOAuthConfig } from './mcp'
 import { archiveWithDataFile } from './platform-archive'
 import type { PreparedPlatformSource } from './platform-source'
@@ -388,6 +387,26 @@ const applyServiceEnv = async (
 	return written
 }
 
+/**
+ * Delete, unread, the manifest copy older releases wrote sensitive: nothing reads it, as each proxy version serves
+ * the file its own build wrote, and the platform proxy fronts only the platform's apps (ADR-0034). True if one existed.
+ */
+const removeLegacyProxyManifest = async (
+	proxyEnv: LiveServiceEnv,
+	input: PlatformDeployInput,
+	collaborators: PlatformDeployCollaborators,
+): Promise<boolean> => {
+	const legacy = proxyEnv.get(FABRIKA_PROXY_MANIFEST_JSON)
+	if (legacy === undefined) {
+		return false
+	}
+	if (!input.dryRun) {
+		assertRunning(collaborators.signal)
+		await collaborators.api.deleteServiceEnv({ envId: legacy.id, signal: collaborators.signal })
+	}
+	return true
+}
+
 /** Only a known rejection permits another request against the same reservation. */
 const triggerPipeline = async (
 	service: ResolvedService,
@@ -647,18 +666,7 @@ export const deployPreparedPlatform = async (
 			? 'MCP authoring: off'
 			: `MCP authoring: on, ${oauthConfig.clients.length} client(s), resource(s) ${oauthConfig.resources.map((entry) => entry.resource).join(', ')}`,
 	)
-	// The variable is the application entries the platform proxy carries, held by the operator; nothing here writes it.
-	const merged = mergePlatformProxyManifest(platformManifest, readLiveProxyManifest(proxyEnv.get(FABRIKA_PROXY_MANIFEST_JSON)))
-	log.info(`${merged.manifest.apps.length} app(s): ${merged.manifest.apps.map((app) => app.id).join(', ')}`)
-	if (merged.carried.length > 0) {
-		log.info(`carried through from the live manifest: ${merged.carried.join(', ')}`)
-	}
-	for (const displaced of merged.superseded) {
-		log.warn(
-			`the live manifest entry \`${displaced.id}\` stood on the platform host ${displaced.host} and was replaced — `
-				+ 'that host now answers for the platform app that owns it',
-		)
-	}
+	log.info(`${platformManifest.apps.length} app(s): ${platformManifest.apps.map((app) => app.id).join(', ')}`)
 
 	log.step('Write the service environment')
 	const controlTableDigest = platformServiceTableDigest(platformManifest, platformProxyAppFor(PLATFORM_PROXY_MANIFEST_TEMPLATE, 'control').id)
@@ -679,13 +687,19 @@ export const deployPreparedPlatform = async (
 				: `${hostname}: ${input.dryRun ? 'would write' : 'wrote'} ${written.join(', ')}`,
 		)
 	}
+	if (await removeLegacyProxyManifest(proxyEnv, input, collaborators)) {
+		log.info(
+			`${PLATFORM_PROXY_SERVICE}: ${input.dryRun ? 'would remove' : 'removed'} ${FABRIKA_PROXY_MANIFEST_JSON}, the copy of the manifest a `
+				+ 'release before this one kept there',
+		)
+	}
 
 	// EVERY deploy is after EVERY write, and the manifest rides in the proxy's own archive. That is what makes
 	// the sequence fail closed: a proxy build that does not go ACTIVE leaves the previous manifest in front of
 	// the previous code, because control builds only after it — and `ENVIRONMENT` is in place before any
 	// service that refuses `local` restarts.
 	log.step(`Deploy ${PLATFORM_CONCURRENT_DEPLOY.join(' + ')} together, then ${PLATFORM_SEQUENTIAL_DEPLOY.join(' → ')}`)
-	const buildInput = { source, dryRun: input.dryRun, proxyManifest: encodeProxyManifestJson(merged.manifest) }
+	const buildInput = { source, dryRun: input.dryRun, proxyManifest: encodeProxyManifestJson(platformManifest) }
 	await deployConcurrently(services, buildInput, collaborators)
 	for (const hostname of PLATFORM_SEQUENTIAL_DEPLOY) {
 		await deployPlatformService(serviceOf(services, hostname), buildInput, collaborators)

package/src/installation/guide.md

@@ -293,7 +293,12 @@ fabrika platform upgrade --provider=zerops --to=<newer tag> --sidecar=<sidecar c
 ```
 
 It commits the tag to the sidecar's `fabrika.ref`, pushes, and follows the workflow run it triggers. It
-needs only the `gh` login. Existing namespaces keep their proxy version. To move one to the proxy of the
+needs only the `gh` login. When the sidecar's `.github/workflows/platform.yml` differs from the one this CLI
+generates, the same commit rewrites it, so run `upgrade` with the newest CLI: a hand edit of that file does not
+survive. The workflow installs the Bun release the pinned tag names in its `.bun-version` (1.3.14 for a tag
+that has none), never the newest one. From 0.4.2 or earlier, skip 0.4.3: its deploy stops at "Compose the proxy
+manifest" because the proxy's `FABRIKA_PROXY_MANIFEST_JSON` is sensitive. Do not re-save that variable. Upgrade to a
+later tag: its deploy deletes the variable, and needs no sudo mode. Existing namespaces keep their proxy version. To move one to the proxy of the
 new release, after the run succeeded:
 
 ```bash

package/src/installation/sidecar.ts

@@ -24,6 +24,7 @@
 // Cloudflare builds a runner image and needs a GitHub App; Zerops has no runner at all (ADR-0003).
 
 import { resolve } from 'node:path'
+import { z } from 'zod'
 
 const TEMPLATES = resolve(import.meta.dir, 'templates')
 
@@ -33,6 +34,9 @@ export const SIDECAR_FILES = ['.gitignore', 'README.md', 'fabrika.ref', '.github
 /** The file that pins which published fabrika tag this installation runs. */
 export const FABRIKA_REF_FILE = 'fabrika.ref'
 
+/** The generated pipeline. CLI-owned: `init` and `upgrade` both rewrite it. */
+export const SIDECAR_WORKFLOW_PATH = '.github/workflows/platform.yml'
+
 /** What a rendered sidecar repository is named after. */
 export interface SidecarValues {
 	/** The operator's name for this installation. The GitHub Environment is named after it too. */
@@ -75,6 +79,37 @@ const render = async (name: string, values: SidecarValues): Promise<string> => {
 		.replaceAll('{{FABRIKA_REF}}', values.fabrikaRef)
 }
 
+/** The generated pipeline for one installation. Its only placeholder is the installation, which names its GitHub Environment. */
+export const renderSidecarWorkflow = async (installation: string): Promise<string> =>
+	(await Bun.file(resolve(TEMPLATES, 'platform.yml')).text()).replaceAll('{{INSTALLATION}}', installation)
+
+const sidecarWorkflowSchema = z.object({ jobs: z.object({ deploy: z.object({ environment: z.string().trim().min(1) }) }) })
+
+/**
+ * The installation a sidecar's current workflow was rendered for, read back from its GitHub Environment.
+ *
+ * Not from the repository name: `init --repo` accepts any name, and a workflow rendered for the wrong
+ * Environment deploys with no credentials.
+ */
+export const readSidecarWorkflowInstallation = async (dir: string): Promise<string> => {
+	const regenerate = 'run `fabrika platform init --provider=zerops <installation>` to regenerate it'
+	const file = Bun.file(resolve(dir, SIDECAR_WORKFLOW_PATH))
+	if (!(await file.exists())) {
+		throw new Error(`${dir} has no ${SIDECAR_WORKFLOW_PATH} — ${regenerate}`)
+	}
+	let document: unknown
+	try {
+		document = Bun.YAML.parse(await file.text())
+	} catch {
+		throw new Error(`${dir}/${SIDECAR_WORKFLOW_PATH} is not valid YAML — ${regenerate}`)
+	}
+	const parsed = sidecarWorkflowSchema.safeParse(document)
+	if (!parsed.success) {
+		throw new Error(`${dir}/${SIDECAR_WORKFLOW_PATH} names no \`jobs.deploy.environment\` — ${regenerate}`)
+	}
+	return parsed.data.jobs.deploy.environment
+}
+
 const write = async (dir: string, rel: string, content: string): Promise<void> => {
 	await Bun.write(resolve(dir, rel), content)
 }
@@ -83,7 +118,8 @@ const write = async (dir: string, rel: string, content: string): Promise<void> =
  * Write the sidecar files into `dir`.
  *
  * The workflow, the README and the `.gitignore` are CLI-owned and refreshed on every run, so a fix to
- * the generated pipeline reaches every installation on its operator's next `init`. `fabrika.ref` is
+ * the generated pipeline reaches every installation on its operator's next `init` (and the workflow on
+ * the next `upgrade`). `fabrika.ref` is
  * written ONLY when absent: bumping it is how an operator rolls the installation forward, and a refresh
  * that reset it would silently roll them back.
  *
@@ -99,7 +135,7 @@ export const materializeSidecarScaffold = async (dir: string, values: SidecarVal
 	}
 	await write(dir, '.gitignore', await Bun.file(resolve(TEMPLATES, 'gitignore')).text())
 	await write(dir, 'README.md', await render('README.md', values))
-	await write(dir, '.github/workflows/platform.yml', await render('platform.yml', values))
+	await write(dir, SIDECAR_WORKFLOW_PATH, await renderSidecarWorkflow(values.installation))
 	if (existing === undefined) {
 		await write(dir, FABRIKA_REF_FILE, await render('fabrika.ref', values))
 	}

package/src/installation/templates/README.md

@@ -122,4 +122,4 @@ Only a change to `fabrika.ref` or to the workflow triggers a push-driven run; ed
 not deploy.
 
 `fabrika.ref` is operator-owned: `fabrika platform init` writes it once and never overwrites a later
-version pin.
+version pin. The workflow is not: `init` and `upgrade` both rewrite it to the one their CLI generates.

package/src/installation/templates/platform.yml

@@ -21,7 +21,8 @@ name: platform
 #
 # contember/fabrika-platform is public and checked out tokenless at the TAG pinned in `fabrika.ref`.
 # Bump that tag and push to roll this installation forward — `fabrika platform upgrade --provider=zerops
-# --to=<tag> {{INSTALLATION}}` does exactly that and then follows the run this file starts.
+# --to=<tag> {{INSTALLATION}}` does exactly that, rewrites this file to the one its CLI generates in the
+# same commit, and then follows the run this file starts. `init` rewrites it too: an edit here does not last.
 
 on:
   workflow_dispatch:
@@ -87,9 +88,29 @@ jobs:
         working-directory: fabrika-platform
         run: echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
+      - name: Resolve the Bun release of the pinned tag
+        id: bun
+        working-directory: fabrika-platform
+        env:
+          PINNED_REF: ${{ steps.ref.outputs.fabrika }}
+        # Exactly the Bun the tag was built and released with, never `latest`: a newer Bun rewrites the
+        # lockfile and `--frozen-lockfile` refuses it. Tags up to v0.4.3 carry no `.bun-version` and were
+        # all released with Bun 1.3.14.
+        run: |
+          if [ -f .bun-version ]; then
+            version="$(tr -d '[:space:]' < .bun-version)"
+          else
+            version=1.3.14
+          fi
+          if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "fabrika-platform@$PINNED_REF names no exact Bun release in .bun-version: '$version'." >&2
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ steps.bun.outputs.version }}
 
       - name: Install fabrika
         working-directory: fabrika-platform

package/src/installation/upgrade.ts

@@ -19,12 +19,20 @@
 //     answer, never "no such tag": reporting a rate limit as a missing tag sends the operator to look
 //     at the wrong repository.
 //   • A directory that is not a checkout, and a branch the workflow does not trigger on.
-//   • A dirty sidecar tree. The commit stages `fabrika.ref` alone, so anything else the operator was
-//     part-way through would be left behind on a branch that just deployed.
+//   • A dirty sidecar tree. The commit stages `fabrika.ref` and the workflow alone, so anything else the
+//     operator was part-way through would be left behind on a branch that just deployed.
 //   • A pin already equal to `--to` — but only when it is PUSHED. A pin committed and not pushed is
 //     the state a failed push leaves behind, and "already pins it" would be a lie there: the push that
 //     IS the trigger never happened, so nothing was deployed.
 //
+// ── The workflow rides along with the pin ─────────────────────────────────────────────────────────
+//
+// The workflow is CLI-owned (`sidecar.ts`), and a sidecar created by an older CLI keeps its old pipeline
+// until something rewrites it. `init` does, but a roll is the one command every operator runs, so the
+// roll re-renders it too, into the same commit: the pipeline that deploys the new tag is the current one.
+// It is rendered for the GitHub Environment the existing workflow names, never for a name guessed from
+// the repository.
+//
 // ── The commit carries no `[skip ci]`, deliberately ──────────────────────────────────────────────
 //
 // Both scaffold commits do (`@fabrika/installation-init`'s `scaffold.ts`), because a scaffold push must
@@ -38,7 +46,7 @@ import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { defaultSleep, type Sleeper } from '../index'
 import { consoleDeployLog, type DeployLog } from './log'
-import { FABRIKA_REF_FILE, readPinnedTag } from './sidecar'
+import { FABRIKA_REF_FILE, readPinnedTag, readSidecarWorkflowInstallation, renderSidecarWorkflow, SIDECAR_WORKFLOW_PATH } from './sidecar'
 import type { PlatformUpgradeInput } from './upgrade-options'
 import { carriesTag, firstRun } from './upgrade-output'
 
@@ -243,8 +251,8 @@ export const runUpgrade = async (input: PlatformUpgradeInput, collaborators: Upg
 	const repo = await effects.describeCheckout(dir)
 	if (await effects.isDirty(dir)) {
 		throw new Error(
-			`${dir} has uncommitted changes to tracked files — this command commits \`${FABRIKA_REF_FILE}\` alone, so commit or `
-				+ 'discard them first (untracked files are left alone)',
+			`${dir} has uncommitted changes to tracked files — this command commits \`${FABRIKA_REF_FILE}\` and \`${SIDECAR_WORKFLOW_PATH}\` `
+				+ 'alone, so commit or discard them first (untracked files are left alone)',
 		)
 	}
 	const unpushed = await checkedBranch(dir, repo, collaborators)
@@ -263,18 +271,27 @@ export const runUpgrade = async (input: PlatformUpgradeInput, collaborators: Upg
 	if (pinned === input.to) {
 		throw new Error(`${repo} already pins ${input.to}. Nothing to push, and the push is what triggers the deploy`)
 	}
+	const workflow = await renderSidecarWorkflow(await readSidecarWorkflowInstallation(dir))
+	const workflowChanged = (await Bun.file(resolve(dir, SIDECAR_WORKFLOW_PATH)).text()) !== workflow
+	const files = workflowChanged ? [FABRIKA_REF_FILE, SIDECAR_WORKFLOW_PATH] : [FABRIKA_REF_FILE]
 	const message = upgradeCommitMessage(installationLabel(input, repo), input.to)
 	log.info(`${repo}: ${pinned} → ${input.to}`)
+	if (workflowChanged) {
+		log.info(`${SIDECAR_WORKFLOW_PATH} differs from the one this CLI generates — the roll rewrites it`)
+	}
 
 	if (input.dryRun) {
 		log.step('Dry run complete — nothing was written')
-		log.info(`would write \`${input.to}\` to ${FABRIKA_REF_FILE} and commit it as \`${message}\``)
+		log.info(`would write \`${input.to}\` to ${FABRIKA_REF_FILE} and commit ${files.join(' and ')} as \`${message}\``)
 		return
 	}
 
 	log.step('Roll the pin forward')
 	await Bun.write(resolve(dir, FABRIKA_REF_FILE), `${input.to}\n`)
-	const sha = await effects.commit({ dir, files: [FABRIKA_REF_FILE], message })
+	if (workflowChanged) {
+		await Bun.write(resolve(dir, SIDECAR_WORKFLOW_PATH), workflow)
+	}
+	const sha = await effects.commit({ dir, files, message })
 	await effects.push(dir)
 	log.info(`pushed ${sha}`)
 

package/src/manifest.ts

@@ -400,7 +400,9 @@ const applicationDatabaseUrl = (
 	}
 	if (shared !== undefined) return shared.connectionString
 	const host = own[0]
-	return host === undefined ? null : `\${${host}_connectionTlsString}/\${${host}_dbName}?sslmode=require`
+	// The direct port, not `portTls`: the application's own roles (`app_<id>`, `run_<id>`) are refused by the TLS endpoint,
+	// which admits only the service's own users (measured 2026-10-15). `prefer` is TLS on `single`; `ha` offers none there.
+	return host === undefined ? null : `\${${host}_connectionString}/\${${host}_dbName}?sslmode=prefer`
 }
 
 /** The hostname the `FABRIKA_APP_STORAGE_*` references name: the application's one object-storage service. */

package/src/installation/manifest.ts

@@ -1,112 +0,0 @@
-// Composing the platform's three apps with whatever else the installation's one proxy already fronts.
-//
-// ── Why this is a MERGE and not a write ───────────────────────────────────────────────────────────
-//
-// On the `light` tier an application can share the platform's project and therefore the platform proxy.
-// Its entry is held by the operator in the proxy's `FABRIKA_PROXY_MANIFEST_JSON` variable — on `fabrika-test`
-// a fourth app, `notes` → `notesapi:3000` on listener 8084, beside the three platform ones. The variable is
-// no longer the carrier: the manifest travels as the data file of the proxy's build archive (ADR-0045), and
-// nothing in fabrika writes the variable any more; releases before that wrote the whole composed document
-// into it, which is why it may still hold platform entries. `platformProxyManifest` deliberately emits only
-// the platform apps (it is generated from the platform's own service contracts and knows nothing about
-// applications), so building it alone would DELETE every application entry and take the deployed
-// applications offline.
-//
-// So: read the variable, compose, and ship the result in the archive. That composition is this command's
-// job and nothing else's.
-//
-// ── What happens to an entry the platform does not know about ─────────────────────────────────────
-//
-// Carried through byte-for-byte, in its live order, after the platform apps — with ONE exception. A
-// host belongs to exactly one app (`parseProxyManifest` refuses two apps claiming one, and rightly:
-// route order would otherwise decide which app answers). The platform's three listeners are addresses
-// the platform OWNS, so a live entry standing on one of them is superseded rather than carried, and
-// the deploy says so out loud.
-//
-// That exception is not hypothetical: WU1 corrected IAM's app id from `iam-local` to `iam`, so the
-// live document's `iam-local` claims the platform's own IAM host under a name the platform no longer
-// uses. Carrying it would produce a manifest `parseProxyManifest` rejects, which the proxy build then
-// fails on — a fail-closed outcome, but a needlessly confusing one.
-//
-// Superseding is itself CLOSED: the dropped host stops resolving to anything, it does not fall through
-// to some other app. A genuinely misplaced application therefore goes dark and is reported, instead of
-// quietly being served by the console.
-
-import { FABRIKA_PROXY_MANIFEST_JSON, findDuplicateProxyHost, parseProxyManifestJson, type ProxyManifest } from '@fabrika/proxy-core/manifest'
-import type { ZeropsServiceEnv } from '../index'
-
-/** The composed document plus what happened to every live entry that was not the platform's. */
-export interface MergedProxyManifest {
-	readonly manifest: ProxyManifest
-	/** App ids carried through from the live manifest, in their live order. */
-	readonly carried: readonly string[]
-	/** Live entries the platform's own listeners displaced, with the host that collided. */
-	readonly superseded: readonly { readonly id: string; readonly host: string }[]
-}
-
-/**
- * Compose the platform's apps with the application entries already in a live manifest.
- *
- * `live` is `null` when the proxy carries no manifest yet (a first deploy) — the result is then the
- * platform document alone. An UNPARSEABLE live value is a different thing entirely and throws: it may
- * be a manifest this build is too old to read, and silently replacing it would drop applications this
- * code cannot see. Refusing is what keeps "must not take a deployed app offline" true in the one case
- * where the deploy genuinely cannot tell.
- */
-export const mergePlatformProxyManifest = (platform: ProxyManifest, live: ProxyManifest | null): MergedProxyManifest => {
-	const platformIds = new Set(platform.apps.map((app) => app.id))
-	const platformHosts = new Set(platform.apps.flatMap((app) => app.hosts))
-	const carried: string[] = []
-	const superseded: { id: string; host: string }[] = []
-	const apps = [...platform.apps]
-	for (const app of live?.apps ?? []) {
-		if (platformIds.has(app.id)) {
-			continue
-		}
-		const collision = app.hosts.find((host) => platformHosts.has(host))
-		if (collision !== undefined) {
-			superseded.push({ id: app.id, host: collision })
-			continue
-		}
-		carried.push(app.id)
-		apps.push(app)
-	}
-	// Both inputs are already parsed manifests, so a duplicate host is the one invariant composing can break.
-	// A duplicate host between two APPLICATION entries — which this function cannot fix — is refused
-	// here rather than at the proxy's next build.
-	if (findDuplicateProxyHost(apps) !== null) {
-		throw new Error('the composed proxy manifest is not one the proxy would accept — two application entries claim one host')
-	}
-	return { manifest: { apps }, carried, superseded }
-}
-
-/**
- * The application entries the operator holds in the platform proxy's variable, as a manifest.
- *
- * Absent means "none". Present-but-unparseable throws: see `mergePlatformProxyManifest`. So
- * does a SENSITIVE record, which an older release wrote: Zerops will not hand its value back.
- */
-export const readLiveProxyManifest = (record: ZeropsServiceEnv | undefined): ProxyManifest | null => {
-	if (record === undefined) {
-		return null
-	}
-	if (record.sensitive) {
-		throw new Error(
-			`the proxy's ${FABRIKA_PROXY_MANIFEST_JSON} is stored as a SENSITIVE variable, which Zerops returns as \`REDACTED\`, so the `
-				+ 'application entries it may carry cannot be read and are not replaced. A release before this one wrote it that way. '
-				+ 'Re-save it in the Zerops GUI as a non-sensitive variable with the same value, then run this again',
-		)
-	}
-	const value = record.content
-	if (value.trim() === '') {
-		return null
-	}
-	const manifest = parseProxyManifestJson(value)
-	if (manifest === null) {
-		throw new Error(
-			`the proxy's current FABRIKA_PROXY_MANIFEST_JSON cannot be parsed by this build — refusing to replace a document whose `
-				+ 'application entries cannot be read',
-		)
-	}
-	return manifest
-}