@fabrika/provider-zerops 0.7.0 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.7.0",
+	"version": "0.8.1",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -43,14 +43,14 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth": "0.7.0",
-		"@fabrika/auth-core": "0.7.0",
-		"@fabrika/email": "0.7.0",
-		"@fabrika/iam-contract": "0.7.0",
-		"@fabrika/installation-init": "0.7.0",
-		"@fabrika/operations-contract": "0.7.0",
-		"@fabrika/provider-contract": "0.7.0",
-		"@fabrika/proxy-core": "0.7.0",
+		"@fabrika/auth": "0.8.1",
+		"@fabrika/auth-core": "0.8.1",
+		"@fabrika/email": "0.8.1",
+		"@fabrika/iam-contract": "0.8.1",
+		"@fabrika/installation-init": "0.8.1",
+		"@fabrika/operations-contract": "0.8.1",
+		"@fabrika/provider-contract": "0.8.1",
+		"@fabrika/proxy-core": "0.8.1",
 		"yaml": "^2.9.1"
 	}
 }

package/src/control.ts

@@ -48,7 +48,7 @@ import {
 	type ZeropsNamespaceTarget,
 	zeropsNamespaceTargetCodec,
 } from './namespace'
-import { assertNamespaceProxyReads, type OlderProxyRowReaders } from './namespace/proxy-reads'
+import { assertNamespaceProxyReads, type OlderProxyReaders } from './namespace/proxy-reads'
 import { createZeropsDeployer, ZEROPS_VERSION_DEADLINE_MS } from './provider'
 import { allowedReferenceHosts, assertNoPlatformOnlyReference, foreignReferenceHost, serviceReferenceHosts } from './service-references'
 import { normalizeZeropsSourceRepository } from './source'
@@ -102,8 +102,8 @@ export interface ZeropsControlProviderOptions {
 		readonly proxySource: ZeropsNamespaceProxySource
 		readonly iamUrl: string
 		readonly iamKey: string
-		/** The row parsers of the older releases' proxies, which a namespace pinned to an older source may run. */
-		readonly olderProxies: OlderProxyRowReaders
+		/** The manifest parsers of the older releases' proxies, which a namespace pinned to an older source may run. */
+		readonly olderProxies: OlderProxyReaders
 	}
 }
 
@@ -340,6 +340,10 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 			}
 		},
 		resolveSource,
+		validateAccess: ({ environment, access }) => {
+			const placement = resolvedEnvironment(environment, { requireReady: true })
+			assertNamespaceProxyReads(placement.namespace.id, access, placement.namespaceTarget.proxySource, options.namespaces)
+		},
 		deploy: async (input: ProviderDeployInput): Promise<ProviderDeployOutcome> => {
 			input.signal.throwIfAborted()
 			assertAuthoredManagedInputs({ variableNames: Object.keys(input.vars), secretNames: Object.keys(input.secrets) })

package/src/database-budget.ts

@@ -15,7 +15,7 @@ export const ZEROPS_POSTGRES_MIN_RAM_GB = 0.25
 export const ZEROPS_POSTGRES_UNAVAILABLE_CONNECTIONS = 7
 
 /**
- * The most connections one container's start script holds at once: `fabrika db test-isolation` peaks at 4 since the
+ * The most connections one container's init commands hold at once: `fabrika db test-isolation` peaks at 4 since the
  * test kit opens a file's connections together, and at 5 with a `@fabrika/db` before that (measured locally,
  * 2026-10-16, with the Notes and CRM examples). Migrating and reading the schema take fewer, one after the other.
  */
@@ -53,7 +53,7 @@ export function zeropsPostgresMaxConnections(ramGB: number, profile: string | un
 const poolHolders = (demand: ZeropsDatabaseDemand): number => 2 * demand.maxContainers + demand.jobs
 
 /**
- * The connections each process may open so that all of them, with one container's start script, stay within what the
+ * The connections each process may open so that all of them, with one container's init commands, stay within what the
  * application's roles can take; `null` when that is below `MIN_PROCESS_CONNECTIONS`.
  */
 export function zeropsProcessConnections(maxConnections: number, demand: ZeropsDatabaseDemand): number | null {

package/src/execution.ts

@@ -55,7 +55,7 @@ const FILE_SWEEP_SCHEDULE = '41 * * * *'
 export const ZEROPS_SCAN_MIN_RAM_GB = 2
 
 /**
- * The RAM in GB a container of an application with a database starts with. Its start script runs `fabrika db
+ * The RAM in GB a container of an application with a database starts with. Its init commands run `fabrika db
  * test-isolation`, whose CLI and `bun test` child together peak at 161 MiB of anonymous memory for the Notes example
  * and 225 MiB for the CRM example (measured locally, 2026-10-15), beside Bun's own mapped binary. Zerops' 0.125 GB
  * floor kills that within a second, faster than vertical autoscaling reacts.
@@ -243,6 +243,7 @@ const SOURCE_ROOT = '/build/source'
 const RUNTIME_ROOT = '/var/www'
 const FABRIKA_BIN = './node_modules/.bin/fabrika'
 const MIGRATE_SCRIPT = 'fabrika/migrate.generated.sh'
+const VERIFY_SCRIPT = 'fabrika/verify.generated.sh'
 const START_SCRIPT = 'fabrika/start.generated.sh'
 const PLATFORM_TSCONFIG = 'fabrika/tsconfig.platform.json'
 
@@ -281,24 +282,26 @@ const migrateScript = (appId: string): readonly string[] => [
 	`FABRIKA_APP_ID=${appId} exec ${FABRIKA_BIN} db migrate`,
 ]
 
-// The server starts only after the migrations it expects are applied, the committed schema types match the migrated
-// schema and every generated isolation test passed on a throwaway schema, so any failure fails the readiness check,
-// whether or not a failed `initCommands` stops the activation (it does, verified live). The build has no
-// database, so this is where the types and the generated tests run.
-const startScript = (appId: string, database: boolean): readonly string[] => [
+// The committed schema types must match the migrated schema and every generated isolation test must pass on a throwaway
+// schema. The build has no database, so they run at container start, after the migrations, as init commands: a failed
+// init command stops the activation, and the readiness window opens only with `run.start`, after the init commands (both
+// verified live), so a run as long as the CRM's ~3 minutes of generated cases does not race it.
+const verifyScript = (appId: string): readonly string[] => [
 	'#!/bin/sh',
 	'set -eu',
 	`cd ${RUNTIME_ROOT}`,
-	...(database
-		? [
-			`sh ${RUNTIME_ROOT}/${MIGRATE_SCRIPT}`,
-			`FABRIKA_APP_ID=${appId} ${FABRIKA_BIN} db codegen --verify`,
-			`FABRIKA_APP_ID=${appId} ${FABRIKA_BIN} db test-isolation`,
-		]
-		: []),
-	'exec bun fabrika/entry.generated.ts',
+	`FABRIKA_APP_ID=${appId} ${FABRIKA_BIN} db codegen --verify`,
+	`FABRIKA_APP_ID=${appId} exec ${FABRIKA_BIN} db test-isolation`,
 ]
 
+const startScript: readonly string[] = ['#!/bin/sh', 'set -eu', `cd ${RUNTIME_ROOT}`, 'exec bun fabrika/entry.generated.ts']
+
+/** The scripts the build writes and every container's init commands run, in this order. */
+const initScripts = (execution: ZeropsLockedExecution): readonly { readonly path: string; readonly lines: readonly string[] }[] =>
+	execution.databaseUrl === null
+		? []
+		: [{ path: MIGRATE_SCRIPT, lines: migrateScript(execution.appId) }, { path: VERIFY_SCRIPT, lines: verifyScript(execution.appId) }]
+
 const INSTALL = 'bun install --frozen-lockfile --ignore-scripts'
 
 // After every check: a map is uploaded only for a build that can deploy. A failed upload never fails the build; the
@@ -324,7 +327,6 @@ const sourceMapBuildVariables = (upload: OperationsSourceMapBuildUpload): Record
 export function generatedBuildCommands(execution: ZeropsLockedExecution): readonly string[] {
 	if (!LOCKED_APP_ID_PATTERN.test(execution.appId)) throw new Error('zerops: a contract application id must match [a-z0-9][a-z0-9-]*')
 	if (!FRAMEWORK_RELEASE_PATTERN.test(execution.checkRelease)) throw new Error('zerops: the checker release must be a release version')
-	const database = execution.databaseUrl !== null
 	return [
 		INSTALL,
 		'bun test --isolate --pass-with-no-tests',
@@ -333,8 +335,8 @@ export function generatedBuildCommands(execution: ZeropsLockedExecution): readon
 		`cd /tmp && bun x --bun -p @fabrika/check@${execution.checkRelease} fabrika-check ${SOURCE_ROOT}`,
 		writeFileCommand(PLATFORM_TSCONFIG, [PLATFORM_TSCONFIG_CONTENTS]),
 		`cd /tmp && bun x --bun -p typescript@${PLATFORM_TYPESCRIPT_VERSION} tsc -p ${SOURCE_ROOT}/${PLATFORM_TSCONFIG}`,
-		...(database ? [writeFileCommand(MIGRATE_SCRIPT, migrateScript(execution.appId))] : []),
-		writeFileCommand(START_SCRIPT, startScript(execution.appId, database)),
+		...initScripts(execution).map((script) => writeFileCommand(script.path, script.lines)),
+		writeFileCommand(START_SCRIPT, startScript),
 		...(execution.sourceMaps === null ? [] : [sourceMapUpload(execution.checkRelease)]),
 	]
 }
@@ -363,6 +365,16 @@ const jobCrontab = (contract: ZeropsContractRun): { readonly timing: string; rea
 /** How many job processes the crontab may run at once, each opening the application's database. */
 export const zeropsJobProcesses = (contract: ZeropsContractRun): number => jobCrontab(contract).length
 
+/** The commands every container runs before `run.start`, in order; any failure stops the activation. */
+export function generatedInitCommands(execution: ZeropsLockedExecution): string[] {
+	return [
+		// A container starts from the prepared image, whose signatures are as old as its build; a failed refresh leaves
+		// them to the daily one, and the scanner refuses signatures older than three days, so the scan fails closed.
+		...(execution.contract.scan === true ? [`${FRESHCLAM} || echo 'fabrika: freshclam did not refresh the malware signatures'`] : []),
+		...initScripts(execution).map((script) => `sh ${RUNTIME_ROOT}/${script.path}`),
+	]
+}
+
 /** The generated selected setup: the authored build kept, everything else the platform's. */
 export function renderLockedSetup(
 	setup: string,
@@ -385,12 +397,7 @@ export function renderLockedSetup(
 	const packages = sortedUnique([...execution.runtimePackages, ...(scan ? [SCANNER_PACKAGE] : [])])
 	// Every container keeps its own signatures; one scan pass at a time holds the job's lease.
 	const crontab = [...jobCrontab(contract), ...(scan ? [{ timing: FRESHCLAM_SCHEDULE, command: FRESHCLAM, allContainers: true }] : [])]
-	// A container starts from the prepared image, whose signatures are as old as its build; a failed refresh leaves
-	// them to the daily one, and the scanner refuses signatures older than three days, so the scan fails closed.
-	const initCommands = [
-		...(scan ? [`${FRESHCLAM} || echo 'fabrika: freshclam did not refresh the malware signatures'`] : []),
-		...(execution.databaseUrl === null ? [] : [`sh ${RUNTIME_ROOT}/${MIGRATE_SCRIPT}`]),
-	]
+	const initCommands = generatedInitCommands(execution)
 	const prepareCommands = packages.length === 0 ? [] : [`sudo apk add --no-cache ${packages.join(' ')}`, ...(scan ? [FRESHCLAM] : [])]
 	return {
 		setup,

package/src/index.ts

@@ -101,8 +101,8 @@ export type {
 	ZeropsProxyRepublishInput,
 } from './namespace'
 export { postgresSchema as zeropsNamespacePostgresSchema } from './namespace/codec'
-export { rowsNeedingCurrentProxy } from './namespace/proxy-reads'
-export type { OlderProxyRowReader, OlderProxyRowReaders } from './namespace/proxy-reads'
+export { entriesNeedingCurrentProxy } from './namespace/proxy-reads'
+export type { OlderProxyReader, OlderProxyReaders } from './namespace/proxy-reads'
 export { buildZeropsPlan, resolveDeployHostname } from './plan'
 export type { ZeropsStep, ZeropsStepKind } from './plan'
 export { CANCELLED, createZeropsDeployer, interpolateManifest } from './provider'

package/src/namespace/proxy-reads.ts

@@ -1,35 +1,46 @@
 // What a namespace proxy pinned to an older source cannot read. Its manifest parser is strict: one row of a form it does
-// not know refuses the whole manifest, and every member of the namespace loses its proxy at the next republish. So a
-// deploy that would publish such a row is refused while the namespace's proxy source is not this control plane's own.
+// not know, or a CSP directive it does not know, refuses the whole manifest and blocks the namespace's next republish.
+// So a deploy that would publish either is refused before publication while the namespace's proxy source is not
+// this control plane's own.
 
 import type { ProviderApprovedAccess } from '@fabrika/provider-contract'
+import type { CspOrigins } from '@fabrika/proxy-core/headers'
 import { contractProxyTable, type ProxyEndpointRow } from '@fabrika/proxy-core/manifest'
 import type { ZeropsNamespaceProxySource } from './types'
 
-/** Whether the namespace proxy of one older platform release parses a manifest row: that release's own row parser. */
-export type OlderProxyRowReader = (row: ProxyEndpointRow) => boolean
+/**
+ * What the namespace proxy of one older platform release parses of an application's manifest entry: a row, and the
+ * entry's CSP directives, each by that release's own parser.
+ */
+export interface OlderProxyReader {
+	readonly row: (row: ProxyEndpointRow) => boolean
+	readonly csp: (csp: CspOrigins) => boolean
+}
 
 /**
  * The namespace proxies of the older releases this platform serves (ADR-0062). Control holds their parsers, as it holds
- * their contract readers; a pin's release is not recorded, so a row any of them reads is one the pin may read.
+ * their contract readers; a pin's release is not recorded, so what any of them reads is what the pin may read.
  */
-export type OlderProxyRowReaders = readonly [OlderProxyRowReader, ...OlderProxyRowReader[]]
+export type OlderProxyReaders = readonly [OlderProxyReader, ...OlderProxyReader[]]
 
-/** The rows of the approved contract's proxy table that no older release's proxy parses, as the namespace publishes them. */
-export function rowsNeedingCurrentProxy(access: ProviderApprovedAccess, olderProxies: OlderProxyRowReaders): string[] {
-	return contractProxyTable(access.contract, access.contractDigest).endpoints
-		.filter((row) => !olderProxies.some((reads) => reads(row)))
-		.map((row) => row.id)
+/**
+ * What of the approved contract's manifest entry no older release's proxy parses, as the namespace publishes it: each
+ * such row by its id, and `csp` when no older proxy parses the entry's CSP (`workerSrc`, which only this release knows).
+ */
+export function entriesNeedingCurrentProxy(access: ProviderApprovedAccess, olderProxies: OlderProxyReaders): string[] {
+	const table = contractProxyTable(access.contract, access.contractDigest)
+	const rows = table.endpoints.filter((row) => !olderProxies.some((proxy) => proxy.row(row))).map((row) => row.id)
+	return olderProxies.some((proxy) => proxy.csp(table.csp)) ? rows : [...rows, 'csp']
 }
 
 /** This control plane's own proxy source, and the parsers of the older releases a pinned proxy may run. */
 export interface PlatformProxies {
 	readonly proxySource: ZeropsNamespaceProxySource
-	readonly olderProxies: OlderProxyRowReaders
+	readonly olderProxies: OlderProxyReaders
 }
 
 /**
- * Refuses a deploy whose approved contract holds a row the namespace's pinned proxy may not read: its source is not the
+ * Refuses a deploy whose approved contract holds a row or a CSP directive the namespace's pinned proxy may not read: its source is not the
  * one this control plane deploys new placements from. `platform` is absent where this control plane manages no
  * namespace proxy, which then has nothing to compare.
  */
@@ -42,7 +53,7 @@ export function assertNamespaceProxyReads(
 	if (access === undefined || platform === undefined || pinned.commitSha === platform.proxySource.commitSha) {
 		return
 	}
-	const rows = rowsNeedingCurrentProxy(access, platform.olderProxies)
+	const rows = entriesNeedingCurrentProxy(access, platform.olderProxies)
 	if (rows.length === 0) {
 		return
 	}

package/src/plan.ts

@@ -48,7 +48,7 @@ export const buildZeropsPlan = (manifest: FabrikaManifest, target: ZeropsRuntime
 	steps.push({
 		id: 'raise-start-memory',
 		kind: 'raise-start-memory',
-		description: "Raise the deploy service's minimum RAM to what its start script needs",
+		description: "Raise the deploy service's minimum RAM to what its init commands need",
 	})
 	steps.push({
 		id: 'size-database',

package/src/provider.ts

@@ -280,14 +280,27 @@ export function interpolateManifest(
 }
 
 /** Human-readable failure for a version that finished in a non-`ACTIVE` state. */
-const terminalFailure = (version: ZeropsAppVersion): string => {
+const terminalFailure = (version: ZeropsAppVersion, checks: boolean): string => {
 	if (version.status === 'BACKUP') {
 		return `app-version ${version.id} was superseded by a newer version before it went live`
 	}
 	if (version.status === 'CANCELLED') {
 		return `app-version ${version.id} was cancelled`
 	}
-	return `Zerops pipeline failed: app-version ${version.id} is ${version.status ?? 'in an unknown state'}`
+	return `Zerops pipeline failed: app-version ${version.id} is ${version.status ?? 'in an unknown state'}${activationHint(version, checks)}`
+}
+
+/**
+ * What a version that built but did not activate tells the operator. Zerops' own log of it is the refused readiness
+ * attempts, which read as a server that never started whatever stopped it. `checks`: the generated init commands run
+ * the migrations, the schema check and the isolation tests, as for a contract application with a database.
+ */
+const activationHint = (version: ZeropsAppVersion, checks: boolean): string => {
+	if (version.status !== 'DEPLOY_FAILED') return ''
+	const failed = ': an init command failed or the readiness check never answered'
+	return checks
+		? `${failed}. The init commands run the migrations, the schema check and the generated isolation tests; the runtime lines above show how far they got`
+		: failed
 }
 
 /**
@@ -415,7 +428,7 @@ const openLog = async (env: StepEnv): Promise<ZeropsLogAccess | null> => {
  * poll loop without telling it leaves a build container burning through the pipeline's hour. A lost lease
  * gives no such permission (ADR-0044), so it stops without touching the build.
  */
-const awaitVersion = async (env: StepEnv, appVersionId: string, processId: string | undefined): Promise<void> => {
+const awaitVersion = async (env: StepEnv, appVersionId: string, processId: string | undefined, checks: boolean): Promise<void> => {
 	const { zerops, signal, log } = env
 	const access = await openLog(env)
 	const seen = new Set<string>()
@@ -461,14 +474,16 @@ const awaitVersion = async (env: StepEnv, appVersionId: string, processId: strin
 
 		if (process?.status !== undefined && ZEROPS_PROCESS_TERMINAL.has(process.status) && process.status !== ZEROPS_PROCESS_FINISHED) {
 			throw new Error(
-				`zerops: pipeline process ${process.id} is ${process.status} while app-version ${appVersionId} is ${version.status ?? 'in an unknown state'}`,
+				`zerops: pipeline process ${process.id} is ${process.status} while app-version ${appVersionId} is ${version.status ?? 'in an unknown state'}${
+					activationHint(version, checks)
+				}`,
 			)
 		}
 		if (version.status !== undefined && ZEROPS_TERMINAL.has(version.status)) {
 			if (version.status === ZEROPS_ACTIVE) {
 				return
 			}
-			throw new Error(terminalFailure(version))
+			throw new Error(terminalFailure(version, checks))
 		}
 		if (Date.now() > env.deadlineMs) await timedOut()
 		await zerops.sleep(POLL_INTERVAL_MS, signal)
@@ -669,7 +684,7 @@ const withMinRam = (custom: ZeropsServiceAutoscaling, minRam: number): ZeropsSer
 })
 
 /**
- * Raises the deploy service's minimum RAM to what the generated start script needs (`zeropsStartMinRam`), before the
+ * Raises the deploy service's minimum RAM to what the generated init commands need (`zeropsStartMinRam`), before the
  * version's containers start. An import cannot: Zerops ignores a changed `verticalAutoscaling` of an existing service,
  * so an existing service converges here, on every deploy. It only raises, and decides by reading the service back.
  */
@@ -970,7 +985,8 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 			}
 			const appVersionId = requireVersion(env, 'await-version')
 			assertRunning(signal)
-			await awaitVersion(env, appVersionId, attempt.processId)
+			const locked = lockedExecutionFor(artifact, run, dryRun)
+			await awaitVersion(env, appVersionId, attempt.processId, locked !== null && locked.databaseUrl !== null)
 			return
 		}