@fabrika/provider-zerops 0.6.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.6.0",
+	"version": "0.7.0",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -43,14 +43,14 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth": "0.6.0",
-		"@fabrika/auth-core": "0.6.0",
-		"@fabrika/email": "0.6.0",
-		"@fabrika/iam-contract": "0.6.0",
-		"@fabrika/installation-init": "0.6.0",
-		"@fabrika/operations-contract": "0.6.0",
-		"@fabrika/provider-contract": "0.6.0",
-		"@fabrika/proxy-core": "0.6.0",
+		"@fabrika/auth": "0.7.0",
+		"@fabrika/auth-core": "0.7.0",
+		"@fabrika/email": "0.7.0",
+		"@fabrika/iam-contract": "0.7.0",
+		"@fabrika/installation-init": "0.7.0",
+		"@fabrika/operations-contract": "0.7.0",
+		"@fabrika/provider-contract": "0.7.0",
+		"@fabrika/proxy-core": "0.7.0",
 		"yaml": "^2.9.1"
 	}
 }

package/src/control.ts

@@ -48,6 +48,7 @@ import {
 	type ZeropsNamespaceTarget,
 	zeropsNamespaceTargetCodec,
 } from './namespace'
+import { assertNamespaceProxyReads, type OlderProxyRowReaders } from './namespace/proxy-reads'
 import { createZeropsDeployer, ZEROPS_VERSION_DEADLINE_MS } from './provider'
 import { allowedReferenceHosts, assertNoPlatformOnlyReference, foreignReferenceHost, serviceReferenceHosts } from './service-references'
 import { normalizeZeropsSourceRepository } from './source'
@@ -101,6 +102,8 @@ export interface ZeropsControlProviderOptions {
 		readonly proxySource: ZeropsNamespaceProxySource
 		readonly iamUrl: string
 		readonly iamKey: string
+		/** The row parsers of the older releases' proxies, which a namespace pinned to an older source may run. */
+		readonly olderProxies: OlderProxyRowReaders
 	}
 }
 
@@ -345,6 +348,7 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 			const binding = privateBinding(input.sourceBinding)
 			assertEnvironmentOfApp(input.app, input.environment)
 			const placement = resolvedEnvironment(input.environment, { requireReady: true })
+			assertNamespaceProxyReads(placement.namespace.id, input.environment.access, placement.namespaceTarget.proxySource, options.namespaces)
 			const artifact = artifactFor(input.environment)
 			await verifyZeropsArtifactSourceDescriptor(artifact.target.sourceDescriptor)
 			let source: ZeropsRuntimeTarget['source']

package/src/execution.ts

@@ -4,14 +4,13 @@
 
 import {
 	type ContractArtifact,
-	contractDigest,
 	FABRIKA_CONTRACT_DIGEST,
 	FABRIKA_SOURCE_MAP_UPLOAD,
 	FABRIKA_SOURCE_MAP_UPLOAD_KEY,
 	type FrameworkVariableName,
 } from '@fabrika/auth-core'
 import type { OperationsAssetRoot, OperationsSourceMapBuildUpload } from '@fabrika/operations-contract/releases'
-import type { JsonValue } from '@fabrika/provider-contract'
+import { FRAMEWORK_RELEASE_PATTERN, type JsonValue } from '@fabrika/provider-contract'
 import packageManifest from '../package.json'
 import { renderYaml } from './compile'
 import { parseZeropsDescriptor, type PreparedZeropsDescriptor, selectZeropsDescriptorSetup } from './descriptor'
@@ -24,9 +23,9 @@ export const ZEROPS_APPLICATION_PORT = 3000
 export const ZEROPS_APPLICATION_RUNTIME = 'alpine/bun@1.3'
 
 /**
- * The checker every build runs, pinned to this package's own version. Control runs the git checkout of its release
- * tag, so this reads the source version, which `release:validate` holds equal to the tag; the public packages are
- * released together, so it is the checker of the installation that renders the build.
+ * This package's own version. Control runs the git checkout of its release tag, so this reads the source version,
+ * which `release:validate` holds equal to the tag; the public packages are released together, so it is the checker
+ * release of the installation. A build checks with the application's own release instead (`checkRelease`).
  */
 export const FABRIKA_CHECK_VERSION: string = packageManifest.version
 
@@ -91,6 +90,11 @@ export interface ZeropsContractRun {
 export interface ZeropsLockedExecution {
 	readonly appId: string
 	readonly contract: ZeropsContractRun
+	/**
+	 * The release of the reader that read the application (`ProviderApprovedAccess.checker`), the newest patch of the
+	 * framework minor it pins: the build runs `fabrika-check` and `fabrika-source-maps` of `@fabrika/check` at it.
+	 */
+	readonly checkRelease: string
 	/** A `${host_…}` reference to the application's PostgreSQL service, or null when it has none. */
 	readonly databaseUrl: string | null
 	/**
@@ -112,20 +116,24 @@ export const CONTRACT_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/
 
 const byName = <T extends { readonly name: string }>(left: T, right: T): number => left.name < right.name ? -1 : left.name > right.name ? 1 : 0
 
-/** The run facts of a contract. A contract without a health endpoint has nothing a readiness check can request. */
-export function zeropsContractRun(artifact: ContractArtifact): ZeropsContractRun {
+/**
+ * The run facts of a contract, with the digest the application's own release computes for it. A contract without a
+ * health endpoint has nothing a readiness check can request.
+ */
+export function zeropsContractRun(artifact: ContractArtifact, digest: string): ZeropsContractRun {
 	const health = artifact.endpoints.filter((row) => row.kind === 'health').sort((left, right) => left.id < right.id ? -1 : 1)[0]
 	if (health === undefined) {
 		throw new Error(
 			"fabrika app build: a contract application on Zerops needs a health endpoint for its readiness check (allowed form: health: c.health('/healthz'))",
 		)
 	}
+	const fileKinds = Object.values(artifact.fileKinds ?? {})
 	return {
-		digest: contractDigest(artifact),
+		digest,
 		readinessPath: health.path,
 		jobs: Object.entries(artifact.jobs).map(([name, job]) => ({ name, schedule: job.schedule })).sort(byName),
-		...(Object.keys(artifact.files).length > 0 ? { files: true } : {}),
-		...(Object.values(artifact.files).some((collection) => collection.scan === true) ? { scan: true } : {}),
+		...(Object.keys(artifact.files).length > 0 || fileKinds.length > 0 ? { files: true } : {}),
+		...([...Object.values(artifact.files), ...fileKinds].some((declared) => declared.scan === true) ? { scan: true } : {}),
 	}
 }
 
@@ -295,7 +303,7 @@ const INSTALL = 'bun install --frozen-lockfile --ignore-scripts'
 
 // After every check: a map is uploaded only for a build that can deploy. A failed upload never fails the build; the
 // provider reads the state from the report line.
-const SOURCE_MAP_UPLOAD = `cd /tmp && bun x --bun -p @fabrika/check@${FABRIKA_CHECK_VERSION} fabrika-source-maps ${SOURCE_ROOT} || true`
+const sourceMapUpload = (release: string): string => `cd /tmp && bun x --bun -p @fabrika/check@${release} fabrika-source-maps ${SOURCE_ROOT} || true`
 
 /**
  * The upload's build variables: the destination and asset roots as a literal, and the bearer lifted from the service
@@ -315,18 +323,19 @@ const sourceMapBuildVariables = (upload: OperationsSourceMapBuildUpload): Record
  */
 export function generatedBuildCommands(execution: ZeropsLockedExecution): readonly string[] {
 	if (!LOCKED_APP_ID_PATTERN.test(execution.appId)) throw new Error('zerops: a contract application id must match [a-z0-9][a-z0-9-]*')
+	if (!FRAMEWORK_RELEASE_PATTERN.test(execution.checkRelease)) throw new Error('zerops: the checker release must be a release version')
 	const database = execution.databaseUrl !== null
 	return [
 		INSTALL,
 		'bun test --isolate --pass-with-no-tests',
 		`rm -rf node_modules && ${INSTALL}`,
 		`bun -e "await import('@fabrika/app/build').then((build) => build.writeGeneratedEntry('.', 'bun'))"`,
-		`cd /tmp && bun x --bun -p @fabrika/check@${FABRIKA_CHECK_VERSION} fabrika-check ${SOURCE_ROOT}`,
+		`cd /tmp && bun x --bun -p @fabrika/check@${execution.checkRelease} fabrika-check ${SOURCE_ROOT}`,
 		writeFileCommand(PLATFORM_TSCONFIG, [PLATFORM_TSCONFIG_CONTENTS]),
 		`cd /tmp && bun x --bun -p typescript@${PLATFORM_TYPESCRIPT_VERSION} tsc -p ${SOURCE_ROOT}/${PLATFORM_TSCONFIG}`,
 		...(database ? [writeFileCommand(MIGRATE_SCRIPT, migrateScript(execution.appId))] : []),
 		writeFileCommand(START_SCRIPT, startScript(execution.appId, database)),
-		...(execution.sourceMaps === null ? [] : [SOURCE_MAP_UPLOAD]),
+		...(execution.sourceMaps === null ? [] : [sourceMapUpload(execution.checkRelease)]),
 	]
 }
 

package/src/index.ts

@@ -101,6 +101,8 @@ export type {
 	ZeropsProxyRepublishInput,
 } from './namespace'
 export { postgresSchema as zeropsNamespacePostgresSchema } from './namespace/codec'
+export { rowsNeedingCurrentProxy } from './namespace/proxy-reads'
+export type { OlderProxyRowReader, OlderProxyRowReaders } from './namespace/proxy-reads'
 export { buildZeropsPlan, resolveDeployHostname } from './plan'
 export type { ZeropsStep, ZeropsStepKind } from './plan'
 export { CANCELLED, createZeropsDeployer, interpolateManifest } from './provider'

package/src/installation/generated/platform-console-schema.ts

@@ -27,6 +27,9 @@ export const PLATFORM_CONSOLE_APP_SCHEMA: AppSchema = {
 		{ action: 'source.workspace.write', description: 'Create and commit to own Git workspaces on an authoring target' },
 		{ action: 'source.pull-request.create', description: 'Open a pull request from an own Git workspace' },
 		{ action: 'access.approve', description: 'Approve an access change and protect an environment (a person in the console only)' },
+		{ action: 'mail.read', description: 'List relayed mail and read its metadata' },
+		{ action: 'mail.content.read', description: 'Read the recipient, subject and bodies of relayed mail' },
+		{ action: 'mail.manage', description: 'Release or drop held mail and manage the mail rules' },
 		{ action: 'operations.read', description: 'Read Operations errors and activity' },
 		{ action: 'operations.triage', description: 'Triage Operations errors' },
 		{ action: 'operations.manage', description: 'Manage Operations sources, alerts, and retention' },

package/src/installation/generated/platform-proxy-manifest.ts

@@ -248,6 +248,16 @@ export const PLATFORM_PROXY_MANIFEST_TEMPLATE: PlatformProxyManifestTemplate = {
 						admission: null,
 						oauth: null,
 					},
+					{
+						id: 'mail-relay',
+						kind: 'protocol',
+						method: 'POST',
+						path: '/platform/mail/*',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
 					{
 						id: 'webhooks-root',
 						kind: 'service',
@@ -433,6 +443,16 @@ export const PLATFORM_PROXY_MANIFEST_TEMPLATE: PlatformProxyManifestTemplate = {
 						admission: null,
 						oauth: null,
 					},
+					{
+						id: 'mail-relay',
+						kind: 'protocol',
+						method: 'POST',
+						path: '/platform/mail/*',
+						callers: [],
+						requirement: null,
+						admission: null,
+						oauth: null,
+					},
 					{
 						id: 'webhooks-root',
 						kind: 'service',

package/src/installation/topology/setups.ts

@@ -216,7 +216,11 @@ const iam: ZeropsYamlSetupSpec = {
 		// The Cloudflare `scheduled` handler's replacement, running the same code path. `allContainers:
 		// false` so a horizontally scaled service still prunes once.
 		crontab: [{ timing: '0 3 * * *', command: 'bun packages/iam/src/node/prune.ts', allContainers: false }],
-		envVariables: { PORT: '3000' },
+		envVariables: {
+			PORT: '3000',
+			// Control's private origin: with a provider configured, IAM hands its mail to Control's relay.
+			FABRIKA_CONTROL_URL: 'http://control:3000',
+		},
 	},
 }
 

package/src/managed-env.ts

@@ -6,7 +6,10 @@ import {
 	isConnectUrlVariable,
 	isEmailTransportVariable,
 	isFrameworkVariableName,
+	isPlatformTransportVariable,
 	isWorkloadKeyVariable,
+	PLATFORM_RECEIVERS,
+	platformTransportVariables,
 } from '@fabrika/auth-core'
 import type { JsonValue } from '@fabrika/provider-contract'
 import { z } from 'zod'
@@ -32,6 +35,8 @@ export type ManagedKey = Extract<
 	| 'FABRIKA_PROXY_SECRET'
 	| 'FABRIKA_IAM_RPC_URL'
 	| 'FABRIKA_IAM_RPC_KEY'
+	| 'FABRIKA_APP_ORIGIN'
+	| 'FABRIKA_TOKEN_KEYS'
 >
 
 export const MANAGED_KEYS: readonly ManagedKey[] = [
@@ -45,6 +50,8 @@ export const MANAGED_KEYS: readonly ManagedKey[] = [
 	'FABRIKA_PROXY_SECRET',
 	'FABRIKA_IAM_RPC_URL',
 	'FABRIKA_IAM_RPC_KEY',
+	'FABRIKA_APP_ORIGIN',
+	'FABRIKA_TOKEN_KEYS',
 ]
 
 /** The managed keys written as service variables; `FABRIKA_RELEASE` travels only in the execution descriptor (ADR-0044). */
@@ -58,6 +65,8 @@ export const SERVICE_MANAGED_KEYS: readonly Exclude<ManagedKey, 'FABRIKA_RELEASE
 	'FABRIKA_PROXY_SECRET',
 	'FABRIKA_IAM_RPC_URL',
 	'FABRIKA_IAM_RPC_KEY',
+	'FABRIKA_APP_ORIGIN',
+	'FABRIKA_TOKEN_KEYS',
 ]
 
 /** The managed keys that carry a credential, written sensitive and therefore never compared. */
@@ -66,10 +75,16 @@ export const SENSITIVE_MANAGED_KEYS: ReadonlySet<ManagedKey> = new Set<ManagedKe
 	'FABRIKA_SERVICE_KEY',
 	'FABRIKA_PROXY_SECRET',
 	'FABRIKA_IAM_RPC_KEY',
+	'FABRIKA_TOKEN_KEYS',
 ])
 
-/** A workload or connect key and every mail transport variable are written sensitive; a connect URL is an origin. */
-export const isSensitiveFamilyVariable = (name: string): boolean => !isConnectUrlVariable(name)
+const PLATFORM_URL_VARIABLES: ReadonlySet<string> = new Set(PLATFORM_RECEIVERS.map((receiver) => platformTransportVariables(receiver).url))
+
+/**
+ * A workload, connect or platform transport key and every mail transport variable are written sensitive; a connect or
+ * platform transport URL is an origin.
+ */
+export const isSensitiveFamilyVariable = (name: string): boolean => !isConnectUrlVariable(name) && !PLATFORM_URL_VARIABLES.has(name)
 
 export type ManagedValues = Record<ManagedKey, string | null>
 
@@ -85,36 +100,45 @@ const managedValuesSchema = z.object({
 	// IAM's membership transport (ADR-0022 rule 6): its public origin and this environment's key, or both null.
 	FABRIKA_IAM_RPC_URL: z.string().nullable(),
 	FABRIKA_IAM_RPC_KEY: z.string().nullable(),
+	// The environment's canonical origin (`ctx.url`), or null when it has no public origin.
+	FABRIKA_APP_ORIGIN: z.string().nullable(),
+	// The keys of the application's signed tokens, or null when its contract declares no token purpose.
+	FABRIKA_TOKEN_KEYS: z.string().nullable(),
 }).strict()
 
 export function parseManagedValues(value: unknown): ManagedValues {
 	const result = managedValuesSchema.safeParse(value)
-	if (!result.success) throw new Error('zerops: managed environment must name exactly the ten managed keys')
+	if (!result.success) throw new Error('zerops: managed environment must name exactly the twelve managed keys')
 	return result.data
 }
 
 /**
- * What Control hands a deploy: the ten managed keys, the key of each job and webhook of the approved contract, the
+ * What Control hands a deploy: the twelve managed keys, the key of each job and webhook of the approved contract, the
  * key and owner origin of each connector import, and the installation's mail transport when a job sends through it.
  */
 export interface ManagedEnvironment {
 	readonly values: ManagedValues
 	/**
-	 * `FABRIKA_<KIND>_<NAME>_KEY` → the workload's `px_` key, `FABRIKA_CONNECT_<IMPORT>_KEY` / `_URL`, and each
-	 * `FABRIKA_EMAIL_*` of the installation's mail transport.
+	 * `FABRIKA_<KIND>_<NAME>_KEY` → the workload's `px_` key, `FABRIKA_CONNECT_<IMPORT>_KEY` / `_URL`, each
+	 * `FABRIKA_EMAIL_*` of the installation's mail transport, and `FABRIKA_PLATFORM_<RECEIVER>_URL` / `_KEY`.
 	 */
 	readonly familyVariables: Readonly<Record<string, string>>
 }
 
 const keySchema = z.string().startsWith('px_').min(4)
 const mailValueSchema = z.string().min(1)
-const originSchema = z.string().refine((value) => {
-	try {
-		return new URL(value).origin === value && value.startsWith('https://')
-	} catch {
-		return false
-	}
-})
+const originSchema = (schemes: readonly string[]) =>
+	z.string().refine((value) => {
+		try {
+			const url = new URL(value)
+			return url.origin === value && schemes.includes(url.protocol)
+		} catch {
+			return false
+		}
+	})
+const connectOriginSchema = originSchema(['https:'])
+// Control's public origin is http in the local stack (`http://control.fabrika.localhost:18080`).
+const platformOriginSchema = originSchema(['http:', 'https:'])
 
 export function parseManagedEnvironment(value: Readonly<Record<string, string | null>>): ManagedEnvironment {
 	const managed: Record<string, string | null> = {}
@@ -130,11 +154,18 @@ export function parseManagedEnvironment(value: Readonly<Record<string, string |
 			familyVariables[name] = parsed.data
 			continue
 		}
+		if (isPlatformTransportVariable(name)) {
+			const address = PLATFORM_URL_VARIABLES.has(name)
+			const parsed = (address ? platformOriginSchema : keySchema).safeParse(entry)
+			if (!parsed.success) throw new Error(`zerops: ${name} must be ${address ? 'an http(s) origin' : 'a px_ key'}`)
+			familyVariables[name] = parsed.data
+			continue
+		}
 		const origin = isConnectUrlVariable(name)
 		if (!origin && !isWorkloadKeyVariable(name) && !isConnectKeyVariable(name)) {
 			throw new Error(`zerops: ${name} is not a variable a deploy writes`)
 		}
-		const parsed = (origin ? originSchema : keySchema).safeParse(entry)
+		const parsed = (origin ? connectOriginSchema : keySchema).safeParse(entry)
 		if (!parsed.success) {
 			throw new Error(`zerops: ${name} must be ${origin ? 'an https origin' : 'a px_ key'}`)
 		}
@@ -144,8 +175,8 @@ export function parseManagedEnvironment(value: Readonly<Record<string, string |
 }
 
 /**
- * A service variable only the platform writes per workload, import or the installation's mail transport: a stale one is
- * removed when the deploy no longer hands it.
+ * A service variable only the platform writes per workload, import, platform receiver or the installation's mail
+ * transport: a stale one is removed when the deploy no longer hands it.
  */
 export function isFrameworkFamilyVariable(name: string): boolean {
 	return FRAMEWORK_VARIABLE_PREFIXES.some((prefix) => name.startsWith(prefix))

package/src/manifest.ts

@@ -1,5 +1,5 @@
 import { appSchemaSchema } from '@fabrika/auth'
-import { type AppSchema, type ContractArtifact, isDigest } from '@fabrika/auth-core'
+import { type AppSchema, type ContractArtifact, contractDigest, isDigest } from '@fabrika/auth-core'
 import type { OperationsSourceMapBuildUpload } from '@fabrika/operations-contract/releases'
 import type { JsonValue, ProviderCodec, ProviderDeployInput, ProviderEnvironment } from '@fabrika/provider-contract'
 import { proxyEndpointRowSchema } from '@fabrika/proxy-core/manifest'
@@ -9,6 +9,7 @@ import { assertOwnRunWhenExtending, executionZeropsDocument, parseZeropsDescript
 import {
 	assertScanMemory,
 	CONTRACT_DIGEST_PATTERN,
+	FABRIKA_CHECK_VERSION,
 	LOCKED_APP_ID_PATTERN,
 	lockedAuthoredBuild,
 	ZEROPS_RUNTIME_PACKAGES,
@@ -456,13 +457,17 @@ const applicationStorageHostname = (services: FabrikaManifestImportDocument['ser
 	return own[0] ?? null
 }
 
-/** What the platform renders a contract application's execution descriptor from, or null for any other application. */
+/**
+ * What the platform renders a contract application's execution descriptor from, or null for any other application.
+ * The manifest is the one this release's `fabrika app build` wrote, so its build checks with this release.
+ */
 export const lockedExecutionOf = (manifest: FabrikaManifest): ZeropsLockedExecution | null => {
 	const { contract } = manifest.target
 	if (contract === undefined) return null
 	return {
 		appId: manifest.app.id,
 		contract,
+		checkRelease: FABRIKA_CHECK_VERSION,
 		databaseUrl: applicationDatabaseUrl(manifest.target.importDocument.services, manifest.target.namespaceResources),
 		databaseConnections: null,
 		storageHostname: applicationStorageHostname(manifest.target.importDocument.services),
@@ -490,11 +495,12 @@ export function lockedExecutionFor(
 		throw new Error('zerops: Control approved no access for this environment')
 	}
 	if (!LOCKED_APP_ID_PATTERN.test(manifest.app.id)) throw new Error('zerops: a contract application id must match [a-z0-9][a-z0-9-]*')
-	const contract = zeropsContractRun(access.contract)
+	const contract = zeropsContractRun(access.contract, access.contractDigest)
 	assertScanMemory(manifest.target.importDocument.services, manifest.target.deployService, contract)
 	return {
 		appId: manifest.app.id,
 		contract,
+		checkRelease: access.checker,
 		databaseUrl: applicationDatabaseUrl(manifest.target.importDocument.services, manifest.target.namespaceResources),
 		databaseConnections: null,
 		storageHostname: applicationStorageHostname(manifest.target.importDocument.services),
@@ -658,7 +664,9 @@ export function compileFabrikaManifest(config: ZeropsAppConfig, env: string, sou
 				zeropsSetup: config.target.zeropsSetup,
 				proxy: config.target.proxy,
 				namespaceResources: config.target.namespaceResources,
-				contract: config.target.contract === undefined ? undefined : zeropsContractRun(config.target.contract),
+				contract: config.target.contract === undefined
+					? undefined
+					: zeropsContractRun(config.target.contract, contractDigest(config.target.contract)),
 				runtimePackages: config.target.runtimePackages,
 			},
 		}

package/src/namespace/manifest.ts

@@ -47,7 +47,7 @@ export function compileNamespaceProxyManifest(namespaceId: string, members: read
 			// A Zerops public domain is always served over the project's TLS-terminating L7 balancer, so the
 			// browser speaks https even though the proxy itself is reached over plain HTTP (ADR-0022).
 			scheme: 'https',
-			...contractProxyTable(access.contract),
+			...contractProxyTable(access.contract, access.contractDigest),
 			...(operationsOrigin === undefined ? {} : { operationsOrigin }),
 			...(crossOrigins.length === 0 ? {} : { crossOrigins: [...crossOrigins] }),
 		})

package/src/namespace/proxy-reads.ts

@@ -0,0 +1,54 @@
+// What a namespace proxy pinned to an older source cannot read. Its manifest parser is strict: one row of a form it does
+// not know refuses the whole manifest, and every member of the namespace loses its proxy at the next republish. So a
+// deploy that would publish such a row is refused while the namespace's proxy source is not this control plane's own.
+
+import type { ProviderApprovedAccess } from '@fabrika/provider-contract'
+import { contractProxyTable, type ProxyEndpointRow } from '@fabrika/proxy-core/manifest'
+import type { ZeropsNamespaceProxySource } from './types'
+
+/** Whether the namespace proxy of one older platform release parses a manifest row: that release's own row parser. */
+export type OlderProxyRowReader = (row: ProxyEndpointRow) => boolean
+
+/**
+ * The namespace proxies of the older releases this platform serves (ADR-0062). Control holds their parsers, as it holds
+ * their contract readers; a pin's release is not recorded, so a row any of them reads is one the pin may read.
+ */
+export type OlderProxyRowReaders = readonly [OlderProxyRowReader, ...OlderProxyRowReader[]]
+
+/** The rows of the approved contract's proxy table that no older release's proxy parses, as the namespace publishes them. */
+export function rowsNeedingCurrentProxy(access: ProviderApprovedAccess, olderProxies: OlderProxyRowReaders): string[] {
+	return contractProxyTable(access.contract, access.contractDigest).endpoints
+		.filter((row) => !olderProxies.some((reads) => reads(row)))
+		.map((row) => row.id)
+}
+
+/** This control plane's own proxy source, and the parsers of the older releases a pinned proxy may run. */
+export interface PlatformProxies {
+	readonly proxySource: ZeropsNamespaceProxySource
+	readonly olderProxies: OlderProxyRowReaders
+}
+
+/**
+ * Refuses a deploy whose approved contract holds a row the namespace's pinned proxy may not read: its source is not the
+ * one this control plane deploys new placements from. `platform` is absent where this control plane manages no
+ * namespace proxy, which then has nothing to compare.
+ */
+export function assertNamespaceProxyReads(
+	namespace: string,
+	access: ProviderApprovedAccess | undefined,
+	pinned: ZeropsNamespaceProxySource,
+	platform: PlatformProxies | undefined,
+): void {
+	if (access === undefined || platform === undefined || pinned.commitSha === platform.proxySource.commitSha) {
+		return
+	}
+	const rows = rowsNeedingCurrentProxy(access, platform.olderProxies)
+	if (rows.length === 0) {
+		return
+	}
+	throw new Error(
+		`the proxy of deployment namespace \`${namespace}\` is pinned to an older source than this platform's, and no older release's proxy reads ${
+			rows.map((row) => `\`${row}\``).join(', ')
+		}; re-pin it with \`fabrika control namespaces update --namespace=${namespace} --proxy-source=current\`, then deploy again`,
+	)
+}

package/src/provider.ts

@@ -48,7 +48,6 @@ import {
 	zeropsProcessConnections,
 } from './database-budget'
 import {
-	FABRIKA_CHECK_VERSION,
 	PLATFORM_TYPESCRIPT_VERSION,
 	renderLockedExecutionDescriptor,
 	zeropsJobProcesses,
@@ -581,7 +580,7 @@ const verifyExposure = async (env: StepEnv): Promise<void> => {
 	)
 }
 
-/** Write the nine service-level managed keys; `FABRIKA_RELEASE` is never a service variable (ADR-0044). */
+/** Write the eleven service-level managed keys; `FABRIKA_RELEASE` is never a service variable (ADR-0044). */
 const writeServiceEnv = async (env: StepEnv): Promise<void> => {
 	const { zerops, log, signal, managedValues, familyVariables } = env
 	const serviceId = env.run.target.serviceId
@@ -930,7 +929,7 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 				? overlayRelease(contents, artifact.target.zeropsSetup, release)
 				: renderLockedExecutionDescriptor(contents, artifact.target.zeropsSetup, release, sizedExecution(locked, attempt))
 			if (locked !== null) {
-				log(`  generated run section; build checks @fabrika/check@${FABRIKA_CHECK_VERSION}, typescript@${PLATFORM_TYPESCRIPT_VERSION}`)
+				log(`  generated run section; build checks @fabrika/check@${locked.checkRelease}, typescript@${PLATFORM_TYPESCRIPT_VERSION}`)
 				if (locked.sourceMaps !== null) log(`  the build uploads the source maps of ${locked.sourceMaps.assetRoots.length} asset root(s)`)
 			}
 			assertRunning(signal)