@fabrika/provider-zerops 0.8.1 → 0.9.0-cloudflare.1

package/src/installation/index.ts

@@ -31,22 +31,18 @@ import { parsePlatformUpgradeArgs, UPGRADE_DRY_RUN_FLAG } from './upgrade-option
 export { PLATFORM_CONCURRENT_DEPLOY, PLATFORM_DEPLOY_ORDER, PLATFORM_PROXY_SERVICE, PLATFORM_SEQUENTIAL_DEPLOY } from './deploy'
 export { PLATFORM_CONSOLE_APP_SCHEMA } from './generated/platform-console-schema'
 export { PLATFORM_PROXY_MANIFEST_TEMPLATE } from './generated/platform-proxy-manifest'
-export { type IamOAuthConfig, type McpClient, parseMcpClientsJson, platformIamOAuthConfig } from './mcp'
-export {
-	type PlatformOAuthResourceTemplate,
-	type PlatformProxyApp,
-	platformProxyAppFor,
-	type PlatformProxyComposition,
-	type PlatformProxyManifest,
-	type PlatformProxyManifestTemplate,
-	type PlatformProxyPlacement,
-	type PlatformProxyService,
-	platformServiceTableDigest,
-	resolvePlatformProxyManifest,
-} from './proxy-manifest'
 
 const EMAIL_PROVIDERS = Object.keys(builtinEmailProviders).join(', ')
-const EMAIL_PROVIDER_VARIABLES = Object.values(builtinEmailProviders).flatMap((provider) => provider.variables.map((variable) => variable.name))
+/** One line per provider: its variables, each marked secret or optional where it is. */
+const EMAIL_PROVIDER_VARIABLES = Object.entries(builtinEmailProviders)
+	.map(([name, provider]) => {
+		const variables = provider.variables.map((variable) => {
+			const marks = [variable.secret ? 'secret' : '', variable.required ? '' : 'optional'].filter((mark) => mark !== '')
+			return marks.length === 0 ? variable.name : `${variable.name} (${marks.join(', ')})`
+		})
+		return `\t                                  ${name}: ${variables.join(', ')}`
+	})
+	.join('\n')
 
 const USAGE = `Zerops installation
 
@@ -132,7 +128,7 @@ Options (a flag beats the environment variable beside it):
 	FABRIKA_ZEROPS_ACCESS_TOKEN       required   Zerops access token, environment only and no flag
 	FABRIKA_ZEROPS_API_URL            optional   region API base, when not the default
 	FABRIKA_EMAIL_<PROVIDER>_*        the selected provider's variables, environment only and no flag:
-	                                  ${EMAIL_PROVIDER_VARIABLES.join(', ')}
+${EMAIL_PROVIDER_VARIABLES}
 
 With a mail provider, IAM sends its own mail and Control hands the same transport to every application
 whose job declares \`mailer: 'installation'\`. To set or rotate it later, see \`platform guide\`.
@@ -254,7 +250,8 @@ process listing:
                                                (a --dry-run does not need it)
   FABRIKA_ZEROPS_API_URL            optional   region API base, when not the default
 
-This command writes NO credential. Every secret an installation holds is placed at bring-up.
+This command writes one credential, derived from FABRIKA_IAM_PROVISIONING_KEY: the secret the proxy
+proves its requests to IAM with. Every other secret an installation holds is placed at bring-up.
 
 Install and deploy require --source-dir explicitly. Run the CLI from that same clean full checkout;
 a packaged CLI cannot supply another revision's manifest or schema. --from-git and

package/src/installation/init-options.ts

@@ -6,6 +6,7 @@
 // so a pipeline or an agent drives init end to end. Its confirmations stay, answered by `--yes`.
 
 import {
+	assertPinnedTag,
 	CHECKOUT_FLAG,
 	type CommandEnv,
 	describeArgument,
@@ -17,7 +18,7 @@ import {
 	UNATTENDED_FLAG,
 } from '@fabrika/installation-init'
 import { parsePlatformHosts } from './placement-options'
-import { assertPinnedTag, defaultCheckoutName, defaultSidecarRepo } from './sidecar'
+import { defaultCheckoutName, defaultSidecarRepo } from './sidecar'
 
 /** The name every bypass in this platform is gated on, and therefore the one name an installation cannot take. */
 const LOCAL_ENVIRONMENT = 'local'

package/src/installation/install-environment.ts

@@ -1,11 +1,17 @@
-import type { InstallationEmail } from '@fabrika/installation-init'
+import {
+	INSTALLATION_SECRET_VARIABLES,
+	type InstallationEmail,
+	type InstallationSecrets,
+	installationServiceEnvironment,
+	type PlatformHosts,
+	platformOrigin,
+	type PlatformStorage,
+} from '@fabrika/installation-init'
 import { encodeProxyManifestJson } from '@fabrika/proxy-core/manifest'
 import type { ZeropsNamespaceProxySource } from '../index'
 import type { PlatformDeployService, ResolvedService } from './deploy'
-import { type PlatformHosts, platformOrigin } from './hosts'
 import { assertRunning, type InstallCollaborators } from './install-collaborators'
 import { FABRIKA_ZEROPS_PROXY_SOURCE_JSON, serializeNamespaceProxySource } from './installation-source'
-import type { InstallationSecrets } from './secrets'
 import type { PlatformTier } from './topology/topology'
 
 /** The private address the proxy dials IAM at inside the project, and pass 1's placeholder issuer. */
@@ -16,23 +22,16 @@ const PRIVATE_IAM_URL = `http://${PRIVATE_IAM_UPSTREAM}`
 const postgresUrl = (service: string): string => `\${${service}_connectionTlsString}/\${${service}_dbName}?sslmode=require`
 
 /** An object-storage service's coordinates, as the platform's own `${service_variable}` references. */
-interface StorageReferences {
-	readonly bucket: string
-	readonly accessKeyId: string
-	readonly secretAccessKey: string
-	readonly endpoint: string
-}
-
-const storageOf = (service: string): StorageReferences => ({
+const storageOf = (service: string): PlatformStorage => ({
 	bucket: `\${${service}_bucketName}`,
 	accessKeyId: `\${${service}_accessKeyId}`,
 	secretAccessKey: `\${${service}_secretAccessKey}`,
 	endpoint: `\${${service}_apiUrl}`,
 })
 
-/** IAM and control share `db` and `storage` on both tiers; `standard` gives Operations its own pair. */
+/** IAM and control share `db` and `storage` on both tiers; Operations has its own database on both, and its own bucket on `standard`. */
 const OPERATIONS_DATA: Readonly<Record<PlatformTier, { readonly database: string; readonly storage: string }>> = {
-	light: { database: 'db', storage: 'storage' },
+	light: { database: 'operationsdb', storage: 'storage' },
 	standard: { database: 'operationsdb', storage: 'operationsstorage' },
 }
 
@@ -56,6 +55,8 @@ export const PASS_ONE_PROXY_MANIFEST = encodeProxyManifestJson({ apps: [] })
 /** What `installationServiceEnv` needs. Everything in it is settled before the first write. */
 export interface InstallationEnvInput {
 	readonly environment: string
+	/** The installation's own Zerops project, which no deployment namespace may adopt. */
+	readonly projectId: string
 	readonly tier: PlatformTier
 	readonly scheme: 'http' | 'https'
 	readonly hosts: PlatformHosts
@@ -70,132 +71,70 @@ export interface InstallationEnvInput {
 }
 
 /**
- * EVERY variable this command places, per service.
+ * EVERY variable this command places, per service: fabrika's (`installationServiceEnvironment`) over this
+ * project's own references, and control's Zerops variables after them.
  *
  * Pure, and exported, because the matrix is the thing most worth pinning: a name that is right on
- * Cloudflare and wrong on Bun is a silent no-op rather than a failure. Two spelling rules run through
- * it, both verified against the runtimes rather than assumed:
- *
- *   • IAM's Bun runtime reads `ISSUER` and `ENVIRONMENT` UNPREFIXED and everything else with the
- *     `FABRIKA_IAM_` prefix (`packages/iam/src/node/runtime.ts`). The prefixed spellings below are the
- *     ones that file actually reads; the unprefixed ones are the ones it actually reads too.
- *   • No key any service declares in its own `zerops.yaml` appears here — `PORT`,
- *     `FABRIKA_IAM_RPC_URL`, `FABRIKA_OPERATIONS_URL`, `FABRIKA_CONTROL_ASSETS_DIR`,
- *     `FABRIKA_CONTROL_URL`, `FABRIKA_PROXY_MANIFEST`, `FABRIKA_PROXY_PORT`. The env API refuses those
- *     (`provider-zerops/src/api.ts`), because the conflict cannot be resolved to a record id.
- *
- * The proxy manifest is deliberately absent: pass 1 writes an empty one and `deployPlatform` owns the
- * real one, in the same run as the code it describes (ADR-0027).
+ * Cloudflare and wrong on Bun is a silent no-op rather than a failure. No key any service declares in its
+ * own `zerops.yaml` appears here — `PORT`, `FABRIKA_IAM_RPC_URL`, `FABRIKA_OPERATIONS_URL`,
+ * `FABRIKA_CONTROL_ASSETS_DIR`, `FABRIKA_CONTROL_URL`, `FABRIKA_PROXY_MANIFEST`, `FABRIKA_PROXY_PORT`. The env
+ * API refuses those (`provider-zerops/src/api.ts`), because the conflict cannot be resolved to a record id.
  */
 export const installationServiceEnv = (input: InstallationEnvInput): ReadonlyMap<PlatformDeployService, ReadonlyMap<string, string>> => {
 	const { secrets } = input
-	const iamOrigin = platformOrigin(input.scheme, input.hosts.iam)
-	const operationsOrigin = platformOrigin(input.scheme, input.hosts.operations)
-	const platformDatabase = postgresUrl('db')
-	const runLogs = storageOf('storage')
 	const operationsData = OPERATIONS_DATA[input.tier]
-	const operationsBlobs = storageOf(operationsData.storage)
+	const fabrika = installationServiceEnvironment({
+		environment: input.environment,
+		scheme: input.scheme,
+		hosts: input.hosts,
+		iamUpstream: PRIVATE_IAM_UPSTREAM,
+		secrets,
+		email: input.email,
+		data: {
+			iamDatabase: postgresUrl('db'),
+			controlDatabase: postgresUrl('db'),
+			operationsDatabase: postgresUrl(operationsData.database),
+			runLogs: storageOf('storage'),
+			operationsBlobs: storageOf(operationsData.storage),
+		},
+	})
 	const control = new Map([
-		['FABRIKA_CONTROL_DATABASE_URL', platformDatabase],
-		['ENVIRONMENT', input.environment],
-		// A bare HOST, not an origin: `controlPublicOrigin` accepts either.
-		['FABRIKA_CONTROL_DOMAIN', input.hosts.control],
-		['FABRIKA_IAM_ISSUER', iamOrigin],
-		['OPERATIONS_ARTIFACT_ORIGIN', operationsOrigin],
-		['FABRIKA_CONTROL_RUN_LOGS_BUCKET', runLogs.bucket],
-		['FABRIKA_CONTROL_RUN_LOGS_ACCESS_KEY_ID', runLogs.accessKeyId],
-		['FABRIKA_CONTROL_RUN_LOGS_SECRET_ACCESS_KEY', runLogs.secretAccessKey],
-		['FABRIKA_CONTROL_RUN_LOGS_ENDPOINT', runLogs.endpoint],
-		['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
-		['OPERATIONS_SYNC_KEY', secrets.operationsSyncKey],
-		['FABRIKA_CONTROL_VAULT_KEY', secrets.vaultKey],
-		['FABRIKA_IAM_PROVISIONING_KEY', secrets.provisioningKey],
+		...fabrika.control,
 		['FABRIKA_ZEROPS_CLIENT_ID', input.clientId],
 		[FABRIKA_ZEROPS_PROXY_SOURCE_JSON, serializeNamespaceProxySource(input.proxySource)],
 		// The PUBLIC IAM origin an application project's proxy reaches: there is no private network
 		// between Zerops projects (ADR-0006).
-		['FABRIKA_ZEROPS_PROXY_IAM_URL', iamOrigin],
+		['FABRIKA_ZEROPS_PROXY_IAM_URL', platformOrigin(input.scheme, input.hosts.iam)],
 		['FABRIKA_ZEROPS_PROXY_IAM_KEY', secrets.proxyKey],
 		['FABRIKA_ZEROPS_ACCESS_TOKEN', input.zeropsAccessToken],
+		['FABRIKA_ZEROPS_PLATFORM_PROJECT_ID', input.projectId],
 	])
 	if (input.apiBaseUrl !== undefined) {
 		// Only when the installation is not on the default region. Control spells it `_API_BASE_URL` while
 		// the CLI reads `FABRIKA_ZEROPS_API_URL`; they are different processes reading different sources.
 		control.set('FABRIKA_ZEROPS_API_BASE_URL', input.apiBaseUrl)
 	}
-	const email = input.email.kind === 'none' ? [] : [...input.email.variables]
-	for (const [key, value] of email) control.set(key, value)
 	return new Map<PlatformDeployService, ReadonlyMap<string, string>>([
-		[
-			'iam',
-			new Map([
-				['FABRIKA_IAM_DATABASE_URL', platformDatabase],
-				['ENVIRONMENT', input.environment],
-				['ISSUER', iamOrigin],
-				// Password only, by decision: OIDC needs an identity provider the operator has not been
-				// asked for. Both are STATED because IAM's own defaults are the other way round — OIDC on,
-				// password off — and it refuses to boot with neither.
-				['FABRIKA_IAM_OIDC_ENABLED', 'false'],
-				['FABRIKA_IAM_PASSWORD_ENABLED', 'true'],
-				['FABRIKA_IAM_SIGNING_KEYS', secrets.signingKeys],
-				['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
-				['FABRIKA_IAM_PROXY_KEY', secrets.proxyKey],
-				['FABRIKA_IAM_PROVISIONING_KEY', secrets.provisioningKey],
-				...email,
-			]),
-		],
-		[
-			'operations',
-			new Map([
-				['FABRIKA_OPERATIONS_DATABASE_URL', postgresUrl(operationsData.database)],
-				['FABRIKA_OPERATIONS_BLOB_BUCKET', operationsBlobs.bucket],
-				['FABRIKA_OPERATIONS_BLOB_ACCESS_KEY_ID', operationsBlobs.accessKeyId],
-				['FABRIKA_OPERATIONS_BLOB_SECRET_ACCESS_KEY', operationsBlobs.secretAccessKey],
-				['FABRIKA_OPERATIONS_BLOB_ENDPOINT', operationsBlobs.endpoint],
-				['FABRIKA_OPERATIONS_PUBLIC_HOST', input.hosts.operations],
-				['ENVIRONMENT', input.environment],
-				['FABRIKA_IAM_ISSUER', iamOrigin],
-				['OPERATIONS_SYNC_KEY', secrets.operationsSyncKey],
-				['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
-			]),
-		],
+		['iam', fabrika.iam],
+		['operations', fabrika.operations],
 		['control', control],
-		[
-			'proxy',
-			new Map([
-				['ENVIRONMENT', input.environment],
-				// Compared byte-for-byte against a token's `iss`, so this is the PUBLIC issuer and not the
-				// private `iam:3000` pass 1 wrote.
-				['FABRIKA_IAM_ISSUER', iamOrigin],
-				['FABRIKA_IAM_KEY', secrets.proxyKey],
-				['FABRIKA_PROXY_SESSION_OWNER_JSON', JSON.stringify({ issuer: iamOrigin, upstream: PRIVATE_IAM_UPSTREAM })],
-			]),
-		],
+		['proxy', fabrika.proxy],
 	])
 }
 
 /**
- * The keys whose VALUE this command generates, per service.
+ * The keys whose VALUE this command generates, per service: fabrika's, and the two Zerops names on control
+ * that carry the proxy key and the minted token.
  *
  * Their presence on a live service is what "this project already holds an installation" means, and it is
  * checked by KEY only — a value is never read back for comparison. `__tests__/install.test.ts` pins this
  * against the matrix above, so a new generated secret cannot be added without appearing here.
  */
 export const GENERATED_SECRET_KEYS: ReadonlyMap<PlatformDeployService, readonly string[]> = new Map<PlatformDeployService, readonly string[]>([
-	['iam', ['FABRIKA_IAM_SIGNING_KEYS', 'FABRIKA_IAM_RPC_KEY', 'FABRIKA_IAM_PROXY_KEY', 'FABRIKA_IAM_PROVISIONING_KEY']],
-	['operations', ['OPERATIONS_SYNC_KEY', 'FABRIKA_IAM_RPC_KEY']],
-	[
-		'control',
-		[
-			'FABRIKA_IAM_RPC_KEY',
-			'OPERATIONS_SYNC_KEY',
-			'FABRIKA_CONTROL_VAULT_KEY',
-			'FABRIKA_IAM_PROVISIONING_KEY',
-			'FABRIKA_ZEROPS_PROXY_IAM_KEY',
-			'FABRIKA_ZEROPS_ACCESS_TOKEN',
-		],
-	],
-	['proxy', ['FABRIKA_IAM_KEY']],
+	['iam', INSTALLATION_SECRET_VARIABLES.iam],
+	['operations', INSTALLATION_SECRET_VARIABLES.operations],
+	['control', [...INSTALLATION_SECRET_VARIABLES.control, 'FABRIKA_ZEROPS_PROXY_IAM_KEY', 'FABRIKA_ZEROPS_ACCESS_TOKEN']],
+	['proxy', INSTALLATION_SECRET_VARIABLES.proxy],
 ])
 
 /**

package/src/installation/install-options.ts

@@ -10,6 +10,7 @@
 
 import { builtinEmailProviders } from '@fabrika/email/providers'
 import {
+	checkedSecretsFilePath,
 	describeArgument,
 	EMAIL_FLAGS,
 	type InstallationEmail,
@@ -17,10 +18,11 @@ import {
 	readFlag,
 	readInstallationEmail,
 	requiredSetting,
+	SECRETS_FILE_FLAG,
+	SECRETS_FILE_VARIABLE,
 	setting,
 	UNATTENDED_FLAG,
 } from '@fabrika/installation-init'
-import { checkedSecretsFilePath, SECRETS_FILE_FLAG, SECRETS_FILE_VARIABLE } from './install-secrets'
 import { parsePlatformScheme } from './placement-options'
 import { readInstallationSourceDir } from './source-options'
 import type { PlatformTier } from './topology/topology'

package/src/installation/install-secrets.ts

@@ -1,36 +1,10 @@
-// The local copy of every credential `platform install` creates.
+// What a Zerops installation's secrets file records.
 //
 // The services hold the same values in Zerops, but stored SENSITIVE, and Zerops hands a sensitive value
-// back only to a token in sudo mode (measured 2026-10-15). So the operator's copy is the one this
-// command writes, before the first of them is placed: a run that fails later loses nothing.
+// back only to a token in sudo mode (measured 2026-10-15). The file's path rule, quoting and 0600 write
+// are `@fabrika/installation-init`'s `secrets-file.ts`.
 
-import { existsSync } from 'node:fs'
-import { open } from 'node:fs/promises'
-import { isAbsolute, relative, resolve } from 'node:path'
-import type { InstallationSecrets } from './secrets'
-
-/** `--secrets-file`: where the local copy goes. A new file, outside the source checkout. */
-export const SECRETS_FILE_FLAG = '--secrets-file'
-export const SECRETS_FILE_VARIABLE = 'FABRIKA_PLATFORM_SECRETS_FILE'
-
-/**
- * Settle the path before anything is contacted.
- *
- * Refused when it exists, because overwriting one would destroy another installation's only copy, and
- * when it is inside the source checkout, where it would dirty the checkout `platform deploy` uploads
- * and could be committed.
- */
-export const checkedSecretsFilePath = (path: string, sourceDir: string): string => {
-	const absolute = resolve(path)
-	const fromSource = relative(resolve(sourceDir), absolute)
-	if (fromSource === '' || (!fromSource.startsWith('..') && !isAbsolute(fromSource))) {
-		throw new Error(`${SECRETS_FILE_FLAG}=${path} is inside the source checkout — name a path outside it, so it is never uploaded or committed`)
-	}
-	if (existsSync(absolute)) {
-		throw new Error(`${SECRETS_FILE_FLAG}=${path} already exists — it may be another installation's only copy; name a new file`)
-	}
-	return absolute
-}
+import { type InstallationSecrets, renderSecretsFile } from '@fabrika/installation-init'
 
 /** What the file records beside the credentials, so it identifies its installation on its own. */
 export interface InstallationSecretsRecord {
@@ -43,47 +17,29 @@ export interface InstallationSecretsRecord {
 }
 
 /**
- * The file's text: shell-sourceable assignments, named as the commands that read them name them.
+ * The file's text, named as the commands that read it name each value.
  *
  * `FABRIKA_ZEROPS_ACCESS_TOKEN` is the INTEGRATION token, which is what `platform init` and
  * `platform deploy` take; the personal token the install ran with is not written.
  */
-export const renderSecretsFile = (record: InstallationSecretsRecord): string => {
+export const renderInstallationSecretsFile = (record: InstallationSecretsRecord): string => {
 	const { secrets } = record
-	const assignments: readonly (readonly [string, string])[] = [
-		['FABRIKA_ZEROPS_PROJECT_ID', record.projectId],
-		['FABRIKA_ZEROPS_CLIENT_ID', record.clientId],
-		['FABRIKA_IAM_PROVISIONING_KEY', secrets.provisioningKey],
-		['FABRIKA_ZEROPS_ACCESS_TOKEN', record.zeropsAccessToken],
-		['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
-		['FABRIKA_IAM_PROXY_KEY', secrets.proxyKey],
-		['OPERATIONS_SYNC_KEY', secrets.operationsSyncKey],
-		['FABRIKA_CONTROL_VAULT_KEY', secrets.vaultKey],
-		['FABRIKA_IAM_SIGNING_KEYS', secrets.signingKeys],
-	]
-	const lines = assignments.map(([name, value]) => {
-		// Single quotes keep every character literal; none of these values can contain one.
-		if (value.includes("'") || value.includes('\n')) {
-			throw new Error(`${name} cannot be written to the secrets file as one quoted line`)
-		}
-		return `${name}='${value}'`
-	})
-	return [
-		`# fabrika on Zerops — installation \`${record.environment}\`, project ${record.projectId}.`,
-		'# Written by `fabrika platform install`. Every value below is a credential: keep this file private.',
-		'# Zerops holds the same values as sensitive variables and does not hand them back.',
-		'# Load it in a subshell: ( set -a && . <this file> && set +a && fabrika … )',
-		...lines,
-		'',
-	].join('\n')
-}
-
-/** Create the file with mode 0600, failing rather than replacing one that appeared since the check. */
-export const writeSecretsFile = async (path: string, text: string): Promise<void> => {
-	const file = await open(path, 'wx', 0o600)
-	try {
-		await file.writeFile(text)
-	} finally {
-		await file.close()
-	}
+	return renderSecretsFile(
+		[
+			`fabrika on Zerops — installation \`${record.environment}\`, project ${record.projectId}.`,
+			'Written by `fabrika platform install`. Every value below is a credential: keep this file private.',
+			'Zerops holds the same values as sensitive variables and does not hand them back.',
+		],
+		[
+			['FABRIKA_ZEROPS_PROJECT_ID', record.projectId],
+			['FABRIKA_ZEROPS_CLIENT_ID', record.clientId],
+			['FABRIKA_IAM_PROVISIONING_KEY', secrets.provisioningKey],
+			['FABRIKA_ZEROPS_ACCESS_TOKEN', record.zeropsAccessToken],
+			['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
+			['FABRIKA_IAM_PROXY_KEY', secrets.proxyKey],
+			['OPERATIONS_SYNC_KEY', secrets.operationsSyncKey],
+			['FABRIKA_CONTROL_VAULT_KEY', secrets.vaultKey],
+			['FABRIKA_IAM_SIGNING_KEYS', secrets.signingKeys],
+		],
+	)
 }

package/src/installation/install.ts

@@ -5,10 +5,15 @@
 import {
 	action as consoleAction,
 	confirmations,
+	generateInstallationSecrets,
 	info as consoleInfo,
+	type InstallationSecrets,
 	ok as consoleOk,
+	type PlatformHosts,
+	platformOrigin,
 	step as consoleStep,
 	warn as consoleWarn,
+	writeSecretsFile,
 } from '@fabrika/installation-init'
 import type { SchemaReconciler } from '@fabrika/provider-contract'
 import { createZeropsApi, defaultSleep, readableContent, type ZeropsNamespaceProxySource } from '../index'
@@ -24,7 +29,7 @@ import {
 	type ResolvedService,
 } from './deploy'
 import { PLATFORM_PROXY_MANIFEST_TEMPLATE } from './generated/platform-proxy-manifest'
-import { derivePlatformHosts, type PlatformHosts, platformOrigin, ZEROPS_SUBDOMAIN_VARIABLE } from './hosts'
+import { derivePlatformHosts, ZEROPS_SUBDOMAIN_VARIABLE } from './hosts'
 import { checkedEnvironmentName } from './init-options'
 import { assertRunning, type InstallCollaborators, type InstallPrompts } from './install-collaborators'
 import { GENERATED_SECRET_KEYS, installationServiceEnv, PASS_ONE_PROXY_MANIFEST, passOneProxyEnv, writeServiceEnv } from './install-environment'
@@ -39,11 +44,10 @@ import {
 	resolvePlatformServices,
 	serviceOf,
 } from './install-provisioning'
-import { renderSecretsFile, writeSecretsFile } from './install-secrets'
+import { renderInstallationSecretsFile } from './install-secrets'
 import { explainMintFailure } from './install-token'
 import { prepareInstallationSource, prepareNamespaceProxySource, validateInstallationSetups } from './installation-source'
 import type { PreparedPlatformSource } from './platform-source'
-import { generateInstallationSecrets, type InstallationSecrets } from './secrets'
 
 export type { InstallCollaborators, InstallPrompts } from './install-collaborators'
 export { GENERATED_SECRET_KEYS, type InstallationEnvInput, installationServiceEnv } from './install-environment'
@@ -158,7 +162,7 @@ const installPreparedPlatform = async (
 	log.step('Store the credentials locally')
 	// BEFORE the first one is placed: Zerops keeps them sensitive and will not hand them back.
 	await collaborators.storeSecrets(
-		renderSecretsFile({ environment, projectId: project.id, clientId: input.clientId, secrets, zeropsAccessToken: token.token }),
+		renderInstallationSecretsFile({ environment, projectId: project.id, clientId: input.clientId, secrets, zeropsAccessToken: token.token }),
 	)
 	log.ok(`wrote ${input.secretsFile} (mode 0600) — every credential this installation was created with; nothing else holds a readable copy`)
 
@@ -170,6 +174,7 @@ const installPreparedPlatform = async (
 	log.step('Write every remaining variable')
 	const desired = installationServiceEnv({
 		environment,
+		projectId: project.id,
 		tier: input.tier,
 		scheme: input.scheme,
 		hosts,

package/src/installation/sidecar.ts

@@ -12,9 +12,10 @@
 //
 // `fabrika.ref` names a published tag of `contember/fabrika-platform`, never a branch: a namespace
 // proxy and an installation both build from tags, so a moving ref would make "which version is this
-// installation running" unanswerable. `assertPinnedTag` refuses a branch when init writes the file, and
-// the generated workflow refuses one again at run time — two gates, because the file is operator-owned
-// after creation and the second gate is the only one that sees what the operator later wrote.
+// installation running" unanswerable. `assertPinnedTag` (`@fabrika/installation-init`) refuses a branch
+// when init writes the file, and the generated workflow refuses one again at run time — two gates,
+// because the file is operator-owned after creation and the second gate is the only one that sees what
+// the operator later wrote.
 //
 // ── The templates are not Cloudflare's ────────────────────────────────────────────────────────────
 //
@@ -23,6 +24,7 @@
 // pipeline; this one runs a single step because on Zerops the order is inside the command (ADR-0027).
 // Cloudflare builds a runner image and needs a GitHub App; Zerops has no runner at all (ADR-0003).
 
+import { assertPinnedTag } from '@fabrika/installation-init'
 import { resolve } from 'node:path'
 import { z } from 'zod'
 
@@ -47,29 +49,6 @@ export interface SidecarValues {
 	readonly fabrikaRef: string
 }
 
-/**
- * A published release tag: `v` and a semantic version.
- *
- * The same shape `scripts/release.ts` accepts, restated rather than imported — that script is not a
- * package and this check has to hold in a published tarball.
- */
-const TAG_PATTERN = /^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
-
-/** The pinned ref, or an error naming what was found. A branch is refused, deliberately and loudly. */
-export const assertPinnedTag = (ref: string): string => {
-	const trimmed = ref.trim()
-	if (trimmed === '') {
-		throw new Error('a published fabrika tag is required, for example v0.1.0')
-	}
-	if (!TAG_PATTERN.test(trimmed)) {
-		throw new Error(
-			`\`${trimmed}\` is not a published tag. A sidecar repository pins a TAG such as v0.1.0 and never a branch: `
-				+ 'an installation that tracked a moving ref could not say which version it runs (ADR-0025)',
-		)
-	}
-	return trimmed
-}
-
 /** Substitute every placeholder in a template. */
 const render = async (name: string, values: SidecarValues): Promise<string> => {
 	const raw = await Bun.file(resolve(TEMPLATES, name)).text()

package/src/installation/topology/setups.ts

@@ -47,7 +47,9 @@
 // into the platform's variable store rather than carrying a credential. That reasoning is still sound
 // and it is no longer sufficient, because a reference names a SERVICE — and which data services exist
 // is exactly what differs between the `standard` and `light` tiers (`./topology.ts`). One committed
-// file cannot say `${operationsdb_connectionString}` on behalf of a tier that has no `operationsdb`.
+// file cannot say `${operationsstorage_bucketName}` on behalf of a tier that has no `operationsstorage`,
+// nor `${operationsdb_connectionString}` on behalf of a light installation created before Operations
+// had a database of its own.
 // So the file's own rule decides it: a data-service reference is not true for every installation, and
 // it moves to the env API alongside the origins and the secrets.
 //
@@ -90,6 +92,7 @@
 // arrives fully resolved). Only the proxy needs this, and it declares it explicitly below.
 
 import type { ZeropsHealthCheckSpec, ZeropsReadinessCheckSpec, ZeropsYamlSetupSpec, ZeropsYamlSpec } from '../../index'
+import { FABRIKA_PROXY_MANIFEST_BRAND } from '../../proxy-manifest-carrier'
 
 // ── Readiness and liveness: two mechanisms, two questions ──────────────────────────────────────────
 //
@@ -181,6 +184,8 @@ const WORKSPACE_DEPLOY_FILES = ['package.json', 'bun.lock', 'node_modules', 'pac
  * since the proxy is the only publicly routed component and must not also be able to write audit rows),
  * `FABRIKA_IAM_PROVISIONING_KEY`. Both shared secrets must be at least 32 characters; a shorter one fails
  * the boot rather than standing in front of an internet-reachable surface while looking configured.
+ * `FABRIKA_INSTALLATION_PROXY_SECRET_IAM`, which `platform deploy` derives and writes, lets IAM tell the proxy's
+ * client-address and request-id headers from a private caller's.
  */
 const iam: ZeropsYamlSetupSpec = {
 	setup: 'iam',
@@ -291,8 +296,9 @@ const control: ZeropsYamlSetupSpec = {
  * `FABRIKA_OPERATIONS_BLOB_*` coordinates, `ENVIRONMENT`, `FABRIKA_OPERATIONS_PUBLIC_HOST` and
  * `FABRIKA_IAM_ISSUER` (the public IAM issuer). `FABRIKA_OPERATIONS_DATABASE_URL` takes the canonical
  * form above. On the `standard` tier the data references are `${operationsdb_*}` and
- * `${operationsstorage_*}`; on `light` they are `${db_*}` and `${storage_*}`, which is precisely why
- * they cannot be written here.
+ * `${operationsstorage_*}`; on `light` they are `${operationsdb_*}` and `${storage_*}` (`${db_*}` on a
+ * light installation created before Operations had its own database), which is precisely why they cannot
+ * be written here.
  *
  * Secrets (`envSecrets`): `OPERATIONS_SYNC_KEY`, shared only with control for catalog projection, and
  * `FABRIKA_IAM_RPC_KEY`, used only for Operations → IAM management RPC.
@@ -331,7 +337,8 @@ const operations: ZeropsYamlSetupSpec = {
  * IAM service's PUBLIC origin in an apps project, because there is no private network between projects
  * (ADR-0006). The manifest is not a variable; see below.
  *
- * Secret (`envSecrets`): `FABRIKA_IAM_KEY` — the value IAM knows as `FABRIKA_IAM_PROXY_KEY`.
+ * Secret (`envSecrets`): `FABRIKA_IAM_KEY` — the value IAM knows as `FABRIKA_IAM_PROXY_KEY`. In the platform project
+ * also `FABRIKA_INSTALLATION_PROXY_SECRET_IAM`, which Caddy sends on IAM's route and IAM holds too.
  *
  * ── How the manifest reaches the build ───────────────────────────────────────────────────────────
  *
@@ -395,6 +402,10 @@ const proxy: ZeropsYamlSetupSpec = {
 		// it is the archive's data file (see the header).
 		envVariables: {
 			FABRIKA_PROXY_SESSION_OWNER_JSON: '${RUNTIME_FABRIKA_PROXY_SESSION_OWNER_JSON}',
+			// A marker, read by nothing at build time: a namespace pinned to this source has a manifest parser that knows
+			// `brand`, so Control may send the installation's client logo (ADR-0066). An older pin's parser refuses the
+			// key and fails its build, so it is sent only where this is (`zeropsProxyAcceptsBrand`).
+			[FABRIKA_PROXY_MANIFEST_BRAND]: '1',
 		},
 		// CGO off makes the binary static, which is what lets it run on Alpine/musl.
 		prepareCommands: ['CGO_ENABLED=0 GOBIN=/tmp/gobin go install github.com/caddyserver/caddy/v2/cmd/caddy@v2.10.2'],