@fabrika/provider-zerops 0.8.0 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.8.0",
+	"version": "0.8.1",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -43,14 +43,14 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth": "0.8.0",
-		"@fabrika/auth-core": "0.8.0",
-		"@fabrika/email": "0.8.0",
-		"@fabrika/iam-contract": "0.8.0",
-		"@fabrika/installation-init": "0.8.0",
-		"@fabrika/operations-contract": "0.8.0",
-		"@fabrika/provider-contract": "0.8.0",
-		"@fabrika/proxy-core": "0.8.0",
+		"@fabrika/auth": "0.8.1",
+		"@fabrika/auth-core": "0.8.1",
+		"@fabrika/email": "0.8.1",
+		"@fabrika/iam-contract": "0.8.1",
+		"@fabrika/installation-init": "0.8.1",
+		"@fabrika/operations-contract": "0.8.1",
+		"@fabrika/provider-contract": "0.8.1",
+		"@fabrika/proxy-core": "0.8.1",
 		"yaml": "^2.9.1"
 	}
 }

package/src/database-budget.ts

@@ -15,7 +15,7 @@ export const ZEROPS_POSTGRES_MIN_RAM_GB = 0.25
 export const ZEROPS_POSTGRES_UNAVAILABLE_CONNECTIONS = 7
 
 /**
- * The most connections one container's start script holds at once: `fabrika db test-isolation` peaks at 4 since the
+ * The most connections one container's init commands hold at once: `fabrika db test-isolation` peaks at 4 since the
  * test kit opens a file's connections together, and at 5 with a `@fabrika/db` before that (measured locally,
  * 2026-10-16, with the Notes and CRM examples). Migrating and reading the schema take fewer, one after the other.
  */
@@ -53,7 +53,7 @@ export function zeropsPostgresMaxConnections(ramGB: number, profile: string | un
 const poolHolders = (demand: ZeropsDatabaseDemand): number => 2 * demand.maxContainers + demand.jobs
 
 /**
- * The connections each process may open so that all of them, with one container's start script, stay within what the
+ * The connections each process may open so that all of them, with one container's init commands, stay within what the
  * application's roles can take; `null` when that is below `MIN_PROCESS_CONNECTIONS`.
  */
 export function zeropsProcessConnections(maxConnections: number, demand: ZeropsDatabaseDemand): number | null {

package/src/execution.ts

@@ -55,7 +55,7 @@ const FILE_SWEEP_SCHEDULE = '41 * * * *'
 export const ZEROPS_SCAN_MIN_RAM_GB = 2
 
 /**
- * The RAM in GB a container of an application with a database starts with. Its start script runs `fabrika db
+ * The RAM in GB a container of an application with a database starts with. Its init commands run `fabrika db
  * test-isolation`, whose CLI and `bun test` child together peak at 161 MiB of anonymous memory for the Notes example
  * and 225 MiB for the CRM example (measured locally, 2026-10-15), beside Bun's own mapped binary. Zerops' 0.125 GB
  * floor kills that within a second, faster than vertical autoscaling reacts.
@@ -243,6 +243,7 @@ const SOURCE_ROOT = '/build/source'
 const RUNTIME_ROOT = '/var/www'
 const FABRIKA_BIN = './node_modules/.bin/fabrika'
 const MIGRATE_SCRIPT = 'fabrika/migrate.generated.sh'
+const VERIFY_SCRIPT = 'fabrika/verify.generated.sh'
 const START_SCRIPT = 'fabrika/start.generated.sh'
 const PLATFORM_TSCONFIG = 'fabrika/tsconfig.platform.json'
 
@@ -281,24 +282,26 @@ const migrateScript = (appId: string): readonly string[] => [
 	`FABRIKA_APP_ID=${appId} exec ${FABRIKA_BIN} db migrate`,
 ]
 
-// The server starts only after the migrations it expects are applied, the committed schema types match the migrated
-// schema and every generated isolation test passed on a throwaway schema, so any failure fails the readiness check,
-// whether or not a failed `initCommands` stops the activation (it does, verified live). The build has no
-// database, so this is where the types and the generated tests run.
-const startScript = (appId: string, database: boolean): readonly string[] => [
+// The committed schema types must match the migrated schema and every generated isolation test must pass on a throwaway
+// schema. The build has no database, so they run at container start, after the migrations, as init commands: a failed
+// init command stops the activation, and the readiness window opens only with `run.start`, after the init commands (both
+// verified live), so a run as long as the CRM's ~3 minutes of generated cases does not race it.
+const verifyScript = (appId: string): readonly string[] => [
 	'#!/bin/sh',
 	'set -eu',
 	`cd ${RUNTIME_ROOT}`,
-	...(database
-		? [
-			`sh ${RUNTIME_ROOT}/${MIGRATE_SCRIPT}`,
-			`FABRIKA_APP_ID=${appId} ${FABRIKA_BIN} db codegen --verify`,
-			`FABRIKA_APP_ID=${appId} ${FABRIKA_BIN} db test-isolation`,
-		]
-		: []),
-	'exec bun fabrika/entry.generated.ts',
+	`FABRIKA_APP_ID=${appId} ${FABRIKA_BIN} db codegen --verify`,
+	`FABRIKA_APP_ID=${appId} exec ${FABRIKA_BIN} db test-isolation`,
 ]
 
+const startScript: readonly string[] = ['#!/bin/sh', 'set -eu', `cd ${RUNTIME_ROOT}`, 'exec bun fabrika/entry.generated.ts']
+
+/** The scripts the build writes and every container's init commands run, in this order. */
+const initScripts = (execution: ZeropsLockedExecution): readonly { readonly path: string; readonly lines: readonly string[] }[] =>
+	execution.databaseUrl === null
+		? []
+		: [{ path: MIGRATE_SCRIPT, lines: migrateScript(execution.appId) }, { path: VERIFY_SCRIPT, lines: verifyScript(execution.appId) }]
+
 const INSTALL = 'bun install --frozen-lockfile --ignore-scripts'
 
 // After every check: a map is uploaded only for a build that can deploy. A failed upload never fails the build; the
@@ -324,7 +327,6 @@ const sourceMapBuildVariables = (upload: OperationsSourceMapBuildUpload): Record
 export function generatedBuildCommands(execution: ZeropsLockedExecution): readonly string[] {
 	if (!LOCKED_APP_ID_PATTERN.test(execution.appId)) throw new Error('zerops: a contract application id must match [a-z0-9][a-z0-9-]*')
 	if (!FRAMEWORK_RELEASE_PATTERN.test(execution.checkRelease)) throw new Error('zerops: the checker release must be a release version')
-	const database = execution.databaseUrl !== null
 	return [
 		INSTALL,
 		'bun test --isolate --pass-with-no-tests',
@@ -333,8 +335,8 @@ export function generatedBuildCommands(execution: ZeropsLockedExecution): readon
 		`cd /tmp && bun x --bun -p @fabrika/check@${execution.checkRelease} fabrika-check ${SOURCE_ROOT}`,
 		writeFileCommand(PLATFORM_TSCONFIG, [PLATFORM_TSCONFIG_CONTENTS]),
 		`cd /tmp && bun x --bun -p typescript@${PLATFORM_TYPESCRIPT_VERSION} tsc -p ${SOURCE_ROOT}/${PLATFORM_TSCONFIG}`,
-		...(database ? [writeFileCommand(MIGRATE_SCRIPT, migrateScript(execution.appId))] : []),
-		writeFileCommand(START_SCRIPT, startScript(execution.appId, database)),
+		...initScripts(execution).map((script) => writeFileCommand(script.path, script.lines)),
+		writeFileCommand(START_SCRIPT, startScript),
 		...(execution.sourceMaps === null ? [] : [sourceMapUpload(execution.checkRelease)]),
 	]
 }
@@ -363,6 +365,16 @@ const jobCrontab = (contract: ZeropsContractRun): { readonly timing: string; rea
 /** How many job processes the crontab may run at once, each opening the application's database. */
 export const zeropsJobProcesses = (contract: ZeropsContractRun): number => jobCrontab(contract).length
 
+/** The commands every container runs before `run.start`, in order; any failure stops the activation. */
+export function generatedInitCommands(execution: ZeropsLockedExecution): string[] {
+	return [
+		// A container starts from the prepared image, whose signatures are as old as its build; a failed refresh leaves
+		// them to the daily one, and the scanner refuses signatures older than three days, so the scan fails closed.
+		...(execution.contract.scan === true ? [`${FRESHCLAM} || echo 'fabrika: freshclam did not refresh the malware signatures'`] : []),
+		...initScripts(execution).map((script) => `sh ${RUNTIME_ROOT}/${script.path}`),
+	]
+}
+
 /** The generated selected setup: the authored build kept, everything else the platform's. */
 export function renderLockedSetup(
 	setup: string,
@@ -385,12 +397,7 @@ export function renderLockedSetup(
 	const packages = sortedUnique([...execution.runtimePackages, ...(scan ? [SCANNER_PACKAGE] : [])])
 	// Every container keeps its own signatures; one scan pass at a time holds the job's lease.
 	const crontab = [...jobCrontab(contract), ...(scan ? [{ timing: FRESHCLAM_SCHEDULE, command: FRESHCLAM, allContainers: true }] : [])]
-	// A container starts from the prepared image, whose signatures are as old as its build; a failed refresh leaves
-	// them to the daily one, and the scanner refuses signatures older than three days, so the scan fails closed.
-	const initCommands = [
-		...(scan ? [`${FRESHCLAM} || echo 'fabrika: freshclam did not refresh the malware signatures'`] : []),
-		...(execution.databaseUrl === null ? [] : [`sh ${RUNTIME_ROOT}/${MIGRATE_SCRIPT}`]),
-	]
+	const initCommands = generatedInitCommands(execution)
 	const prepareCommands = packages.length === 0 ? [] : [`sudo apk add --no-cache ${packages.join(' ')}`, ...(scan ? [FRESHCLAM] : [])]
 	return {
 		setup,

package/src/plan.ts

@@ -48,7 +48,7 @@ export const buildZeropsPlan = (manifest: FabrikaManifest, target: ZeropsRuntime
 	steps.push({
 		id: 'raise-start-memory',
 		kind: 'raise-start-memory',
-		description: "Raise the deploy service's minimum RAM to what its start script needs",
+		description: "Raise the deploy service's minimum RAM to what its init commands need",
 	})
 	steps.push({
 		id: 'size-database',

package/src/provider.ts

@@ -280,14 +280,27 @@ export function interpolateManifest(
 }
 
 /** Human-readable failure for a version that finished in a non-`ACTIVE` state. */
-const terminalFailure = (version: ZeropsAppVersion): string => {
+const terminalFailure = (version: ZeropsAppVersion, checks: boolean): string => {
 	if (version.status === 'BACKUP') {
 		return `app-version ${version.id} was superseded by a newer version before it went live`
 	}
 	if (version.status === 'CANCELLED') {
 		return `app-version ${version.id} was cancelled`
 	}
-	return `Zerops pipeline failed: app-version ${version.id} is ${version.status ?? 'in an unknown state'}`
+	return `Zerops pipeline failed: app-version ${version.id} is ${version.status ?? 'in an unknown state'}${activationHint(version, checks)}`
+}
+
+/**
+ * What a version that built but did not activate tells the operator. Zerops' own log of it is the refused readiness
+ * attempts, which read as a server that never started whatever stopped it. `checks`: the generated init commands run
+ * the migrations, the schema check and the isolation tests, as for a contract application with a database.
+ */
+const activationHint = (version: ZeropsAppVersion, checks: boolean): string => {
+	if (version.status !== 'DEPLOY_FAILED') return ''
+	const failed = ': an init command failed or the readiness check never answered'
+	return checks
+		? `${failed}. The init commands run the migrations, the schema check and the generated isolation tests; the runtime lines above show how far they got`
+		: failed
 }
 
 /**
@@ -415,7 +428,7 @@ const openLog = async (env: StepEnv): Promise<ZeropsLogAccess | null> => {
  * poll loop without telling it leaves a build container burning through the pipeline's hour. A lost lease
  * gives no such permission (ADR-0044), so it stops without touching the build.
  */
-const awaitVersion = async (env: StepEnv, appVersionId: string, processId: string | undefined): Promise<void> => {
+const awaitVersion = async (env: StepEnv, appVersionId: string, processId: string | undefined, checks: boolean): Promise<void> => {
 	const { zerops, signal, log } = env
 	const access = await openLog(env)
 	const seen = new Set<string>()
@@ -461,14 +474,16 @@ const awaitVersion = async (env: StepEnv, appVersionId: string, processId: strin
 
 		if (process?.status !== undefined && ZEROPS_PROCESS_TERMINAL.has(process.status) && process.status !== ZEROPS_PROCESS_FINISHED) {
 			throw new Error(
-				`zerops: pipeline process ${process.id} is ${process.status} while app-version ${appVersionId} is ${version.status ?? 'in an unknown state'}`,
+				`zerops: pipeline process ${process.id} is ${process.status} while app-version ${appVersionId} is ${version.status ?? 'in an unknown state'}${
+					activationHint(version, checks)
+				}`,
 			)
 		}
 		if (version.status !== undefined && ZEROPS_TERMINAL.has(version.status)) {
 			if (version.status === ZEROPS_ACTIVE) {
 				return
 			}
-			throw new Error(terminalFailure(version))
+			throw new Error(terminalFailure(version, checks))
 		}
 		if (Date.now() > env.deadlineMs) await timedOut()
 		await zerops.sleep(POLL_INTERVAL_MS, signal)
@@ -669,7 +684,7 @@ const withMinRam = (custom: ZeropsServiceAutoscaling, minRam: number): ZeropsSer
 })
 
 /**
- * Raises the deploy service's minimum RAM to what the generated start script needs (`zeropsStartMinRam`), before the
+ * Raises the deploy service's minimum RAM to what the generated init commands need (`zeropsStartMinRam`), before the
  * version's containers start. An import cannot: Zerops ignores a changed `verticalAutoscaling` of an existing service,
  * so an existing service converges here, on every deploy. It only raises, and decides by reading the service back.
  */
@@ -970,7 +985,8 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 			}
 			const appVersionId = requireVersion(env, 'await-version')
 			assertRunning(signal)
-			await awaitVersion(env, appVersionId, attempt.processId)
+			const locked = lockedExecutionFor(artifact, run, dryRun)
+			await awaitVersion(env, appVersionId, attempt.processId, locked !== null && locked.databaseUrl !== null)
 			return
 		}