@fabrika/provider-zerops 0.8.1 → 0.9.0-cloudflare.1

package/src/installation/topology/topology.ts

@@ -82,22 +82,27 @@ export type PublicAccess = 'custom-domain' | 'zerops-subdomain'
  * `standard` is the production shape: HA Postgres, a separate database and bucket for Operations, and
  * enough containers that no single one is a point of failure.
  *
- * `light` is one project, one `postgresql:single@18` and one bucket shared by IAM, Operations, control
- * AND the apps deployed alongside them, at one container per service. This tier exists because the standard
+ * `light` is one project with two `postgresql:single@18` services — `db` for IAM and control, `operationsdb`
+ * for Operations — and one bucket, at one container per service. This tier exists because the standard
  * shape costs ~13 containers before a single application is deployed, which is more platform than a
- * small fleet — or an evaluation — can justify.
+ * small fleet — or an evaluation — can justify. Applications run in their own namespace projects
+ * (ADR-0034); a production namespace that must keep its data through a node loss asks for HA there.
  *
- * Sharing is safe rather than merely cheap, and that is a property of the code, not of this comment:
+ * Operations gets its own database, not a schema beside IAM's, because Zerops backs up a whole service on
+ * one schedule: identity and deploy state is worth an hourly dump, error history is not, and only two
+ * services can carry two schedules. It also keeps Operations' high-volume writes off the identity path.
  *
- *   • The three services' table names do not intersect (IAM 10, Operations 24, control 16), and
- *     ADR-0017 already gives each its own migration ledger and advisory lock, so one database holds
- *     all three without coordination.
+ * Sharing the rest is safe rather than merely cheap, and that is a property of the code, not of this comment:
+ *
+ *   • IAM's and control's table names do not intersect, and ADR-0017 gives each its own migration ledger
+ *     and advisory lock, so one database holds both without coordination. A light installation created
+ *     before Operations moved out still holds all three in `db`, which the same property covers.
  *   • Their blob keys are prefix-disjoint — control writes `runs/`, Operations writes `events/`,
  *     `dead/` and `source-maps/` — so one bucket cannot collide.
  *
- * What `light` genuinely gives up is FAILURE-DOMAIN isolation: Operations' high-volume error history
- * now shares capacity with the identity path, and losing the one database loses all three services.
- * That is the trade, and it is why `standard` remains the default rather than the special case.
+ * What `light` genuinely gives up is AVAILABILITY and DURABILITY: one container per service, and a
+ * single-node database loses everything since its last backup when its node fails (Zerops has no
+ * point-in-time recovery). That is the trade, and it is why `standard` remains the default rather than the special case.
  */
 export type PlatformTier = 'standard' | 'light'
 
@@ -188,9 +193,9 @@ export const platformTopology = (options: TopologyOptions): ProjectTopology => {
 			hostname: 'db',
 			// HA is encoded in the TYPE. The deprecated `mode` field is not merely avoided here — it
 			// is absent from `ZeropsServiceSpec`, so it cannot be written. One database serves both
-			// IAM and the control plane; they are separate schemas in it, not separate services,
-			// because a second HA Postgres triples the cost of the isolation the private network
-			// already gives us.
+			// IAM and the control plane; both use its default schema with disjoint tables and their own
+			// migration ledgers (ADR-0017), not separate services, because a second HA Postgres triples
+			// the cost of the isolation the private network already gives us.
 			type: 'postgresql:ha@18',
 			// The identity and control-plane database: every login, every token mint, every run's
 			// state. `oltp-production` is also what an HA service gets by DEFAULT — stated here so
@@ -315,10 +320,9 @@ const lightPlatformTopology = (options: TopologyOptions, publicAccess: PublicAcc
 	// that creates the project. Same shape as `compileZeropsNamespaceTopology` in `src/namespace/topology.ts`.
 	const services = (): ZeropsServiceSpec[] => [
 		{
-			// ONE database for IAM, control, Operations and every app in this project. Which schema each
-			// one gets is not expressed here — it is `FABRIKA_*_DATABASE_URL`, written per installation
-			// through the env API, because this same repository-root `zerops.yaml` serves both tiers and
-			// a `${operationsdb_connectionString}` baked into it would name a service `light` does not have.
+			// IAM and control. Which schema each one gets is not expressed here — it is `FABRIKA_*_DATABASE_URL`,
+			// written per installation through the env API, because this same repository-root `zerops.yaml`
+			// serves both tiers.
 			hostname: 'db',
 			type: 'postgresql:single@18',
 			// `oltp-hobby`, written out because a default is not a choice — this type's default is
@@ -326,15 +330,21 @@ const lightPlatformTopology = (options: TopologyOptions, publicAccess: PublicAcc
 			//
 			// A floor is not headroom. Every PostgreSQL profile shares the same 8-core / 48 GB / 250 GB
 			// ceiling and the same vertical autoscaler, so `oltp-staging` does not let this service grow
-			// any further than `oltp-hobby` does — it only pre-pays for memory the tier is idle on. That
-			// this single service holds IAM, control, Operations and the apps beside them is an argument
-			// about the ceiling, which is unchanged.
+			// any further than `oltp-hobby` does — it only pre-pays for memory the tier is idle on.
 			//
 			// An installation that wants a specific floor sets one on the service — `minRam` accepts a
 			// float — which is where a per-installation value belongs (ADR-0004), not in this document.
 			profile: 'oltp-hobby',
 			priority: 100,
 		},
+		{
+			// Operations' own database: its own backup schedule (the Zerops default, daily) and its own
+			// capacity, off the identity path. Same type and profile as `db`, for the same reasons.
+			hostname: 'operationsdb',
+			type: 'postgresql:single@18',
+			profile: 'oltp-hobby',
+			priority: 100,
+		},
 		{
 			// ONE bucket. Prefix-disjoint by construction: `runs/` (control) vs `events/`, `dead/` and
 			// `source-maps/` (Operations).
@@ -367,7 +377,7 @@ const lightPlatformTopology = (options: TopologyOptions, publicAccess: PublicAcc
 			platform: 'zerops',
 			project: {
 				name: 'platform',
-				description: 'fabrika light tier: control plane, Operations, IAM, the auth proxy and the apps they serve, on shared data services.',
+				description: 'fabrika light tier: control plane, Operations, IAM and the auth proxy, on single-node data services.',
 				corePackage: 'LIGHT',
 				tags: ['fabrika', 'platform', 'light', options.env],
 			},

package/src/installation/upgrade-options.ts

@@ -8,8 +8,8 @@
 // The pin is checked BEFORE anything leaves this machine: `assertPinnedTag` refuses a branch or a SHA
 // (ADR-0025) without a network call, so `--to=main` fails on the spot rather than after a clone.
 
-import { describeArgument, readFlag } from '@fabrika/installation-init'
-import { assertPinnedTag, defaultCheckoutDir } from './sidecar'
+import { assertPinnedTag, describeArgument, readFlag } from '@fabrika/installation-init'
+import { defaultCheckoutDir } from './sidecar'
 
 /** Where the sidecar repository this command edits is found. */
 export type UpgradeSidecar =

package/src/managed-env.ts

@@ -1,18 +1,5 @@
-import {
-	FRAMEWORK_VARIABLE_PREFIXES,
-	type FrameworkVariableName,
-	frameworkVariableReference,
-	isConnectKeyVariable,
-	isConnectUrlVariable,
-	isEmailTransportVariable,
-	isFrameworkVariableName,
-	isPlatformTransportVariable,
-	isWorkloadKeyVariable,
-	PLATFORM_RECEIVERS,
-	platformTransportVariables,
-} from '@fabrika/auth-core'
+import { frameworkVariableReference, isFrameworkVariableName } from '@fabrika/auth-core'
 import type { JsonValue } from '@fabrika/provider-contract'
-import { z } from 'zod'
 import { renderYaml } from './compile'
 import {
 	assertOwnRunWhenExtending,
@@ -22,166 +9,6 @@ import {
 	selectZeropsDescriptorSetup,
 } from './descriptor'
 
-/** The framework-only names Control hands every Zerops deploy; the rest of the list is the provider's own. */
-export type ManagedKey = Extract<
-	FrameworkVariableName,
-	| 'FABRIKA_RELEASE'
-	| 'FABRIKA_OPERATIONS_DSN'
-	| 'FABRIKA_IAM_ISSUER'
-	| 'FABRIKA_IAM_APP_ID'
-	| 'FABRIKA_APP_ID'
-	| 'FABRIKA_ENVIRONMENT'
-	| 'FABRIKA_SERVICE_KEY'
-	| 'FABRIKA_PROXY_SECRET'
-	| 'FABRIKA_IAM_RPC_URL'
-	| 'FABRIKA_IAM_RPC_KEY'
-	| 'FABRIKA_APP_ORIGIN'
-	| 'FABRIKA_TOKEN_KEYS'
->
-
-export const MANAGED_KEYS: readonly ManagedKey[] = [
-	'FABRIKA_RELEASE',
-	'FABRIKA_OPERATIONS_DSN',
-	'FABRIKA_IAM_ISSUER',
-	'FABRIKA_IAM_APP_ID',
-	'FABRIKA_APP_ID',
-	'FABRIKA_ENVIRONMENT',
-	'FABRIKA_SERVICE_KEY',
-	'FABRIKA_PROXY_SECRET',
-	'FABRIKA_IAM_RPC_URL',
-	'FABRIKA_IAM_RPC_KEY',
-	'FABRIKA_APP_ORIGIN',
-	'FABRIKA_TOKEN_KEYS',
-]
-
-/** The managed keys written as service variables; `FABRIKA_RELEASE` travels only in the execution descriptor (ADR-0044). */
-export const SERVICE_MANAGED_KEYS: readonly Exclude<ManagedKey, 'FABRIKA_RELEASE'>[] = [
-	'FABRIKA_OPERATIONS_DSN',
-	'FABRIKA_IAM_ISSUER',
-	'FABRIKA_IAM_APP_ID',
-	'FABRIKA_APP_ID',
-	'FABRIKA_ENVIRONMENT',
-	'FABRIKA_SERVICE_KEY',
-	'FABRIKA_PROXY_SECRET',
-	'FABRIKA_IAM_RPC_URL',
-	'FABRIKA_IAM_RPC_KEY',
-	'FABRIKA_APP_ORIGIN',
-	'FABRIKA_TOKEN_KEYS',
-]
-
-/** The managed keys that carry a credential, written sensitive and therefore never compared. */
-export const SENSITIVE_MANAGED_KEYS: ReadonlySet<ManagedKey> = new Set<ManagedKey>([
-	'FABRIKA_OPERATIONS_DSN',
-	'FABRIKA_SERVICE_KEY',
-	'FABRIKA_PROXY_SECRET',
-	'FABRIKA_IAM_RPC_KEY',
-	'FABRIKA_TOKEN_KEYS',
-])
-
-const PLATFORM_URL_VARIABLES: ReadonlySet<string> = new Set(PLATFORM_RECEIVERS.map((receiver) => platformTransportVariables(receiver).url))
-
-/**
- * A workload, connect or platform transport key and every mail transport variable are written sensitive; a connect or
- * platform transport URL is an origin.
- */
-export const isSensitiveFamilyVariable = (name: string): boolean => !isConnectUrlVariable(name) && !PLATFORM_URL_VARIABLES.has(name)
-
-export type ManagedValues = Record<ManagedKey, string | null>
-
-const managedValuesSchema = z.object({
-	FABRIKA_RELEASE: z.string().nullable(),
-	FABRIKA_OPERATIONS_DSN: z.string().nullable(),
-	FABRIKA_IAM_ISSUER: z.string().nullable(),
-	FABRIKA_IAM_APP_ID: z.string().nullable(),
-	FABRIKA_APP_ID: z.string().nullable(),
-	FABRIKA_ENVIRONMENT: z.string().nullable(),
-	FABRIKA_SERVICE_KEY: z.string().nullable(),
-	FABRIKA_PROXY_SECRET: z.string().nullable(),
-	// IAM's membership transport (ADR-0022 rule 6): its public origin and this environment's key, or both null.
-	FABRIKA_IAM_RPC_URL: z.string().nullable(),
-	FABRIKA_IAM_RPC_KEY: z.string().nullable(),
-	// The environment's canonical origin (`ctx.url`), or null when it has no public origin.
-	FABRIKA_APP_ORIGIN: z.string().nullable(),
-	// The keys of the application's signed tokens, or null when its contract declares no token purpose.
-	FABRIKA_TOKEN_KEYS: z.string().nullable(),
-}).strict()
-
-export function parseManagedValues(value: unknown): ManagedValues {
-	const result = managedValuesSchema.safeParse(value)
-	if (!result.success) throw new Error('zerops: managed environment must name exactly the twelve managed keys')
-	return result.data
-}
-
-/**
- * What Control hands a deploy: the twelve managed keys, the key of each job and webhook of the approved contract, the
- * key and owner origin of each connector import, and the installation's mail transport when a job sends through it.
- */
-export interface ManagedEnvironment {
-	readonly values: ManagedValues
-	/**
-	 * `FABRIKA_<KIND>_<NAME>_KEY` → the workload's `px_` key, `FABRIKA_CONNECT_<IMPORT>_KEY` / `_URL`, each
-	 * `FABRIKA_EMAIL_*` of the installation's mail transport, and `FABRIKA_PLATFORM_<RECEIVER>_URL` / `_KEY`.
-	 */
-	readonly familyVariables: Readonly<Record<string, string>>
-}
-
-const keySchema = z.string().startsWith('px_').min(4)
-const mailValueSchema = z.string().min(1)
-const originSchema = (schemes: readonly string[]) =>
-	z.string().refine((value) => {
-		try {
-			const url = new URL(value)
-			return url.origin === value && schemes.includes(url.protocol)
-		} catch {
-			return false
-		}
-	})
-const connectOriginSchema = originSchema(['https:'])
-// Control's public origin is http in the local stack (`http://control.fabrika.localhost:18080`).
-const platformOriginSchema = originSchema(['http:', 'https:'])
-
-export function parseManagedEnvironment(value: Readonly<Record<string, string | null>>): ManagedEnvironment {
-	const managed: Record<string, string | null> = {}
-	const familyVariables: Record<string, string> = {}
-	for (const [name, entry] of Object.entries(value)) {
-		if (!isFrameworkFamilyVariable(name)) {
-			managed[name] = entry
-			continue
-		}
-		if (isEmailTransportVariable(name)) {
-			const parsed = mailValueSchema.safeParse(entry)
-			if (!parsed.success) throw new Error(`zerops: ${name} must not be empty`)
-			familyVariables[name] = parsed.data
-			continue
-		}
-		if (isPlatformTransportVariable(name)) {
-			const address = PLATFORM_URL_VARIABLES.has(name)
-			const parsed = (address ? platformOriginSchema : keySchema).safeParse(entry)
-			if (!parsed.success) throw new Error(`zerops: ${name} must be ${address ? 'an http(s) origin' : 'a px_ key'}`)
-			familyVariables[name] = parsed.data
-			continue
-		}
-		const origin = isConnectUrlVariable(name)
-		if (!origin && !isWorkloadKeyVariable(name) && !isConnectKeyVariable(name)) {
-			throw new Error(`zerops: ${name} is not a variable a deploy writes`)
-		}
-		const parsed = (origin ? connectOriginSchema : keySchema).safeParse(entry)
-		if (!parsed.success) {
-			throw new Error(`zerops: ${name} must be ${origin ? 'an https origin' : 'a px_ key'}`)
-		}
-		familyVariables[name] = parsed.data
-	}
-	return { values: parseManagedValues(managed), familyVariables }
-}
-
-/**
- * A service variable only the platform writes per workload, import, platform receiver or the installation's mail
- * transport: a stale one is removed when the deploy no longer hands it.
- */
-export function isFrameworkFamilyVariable(name: string): boolean {
-	return FRAMEWORK_VARIABLE_PREFIXES.some((prefix) => name.startsWith(prefix))
-}
-
 const refuse = (): never => {
 	throw new Error('zerops: application configuration uses a Fabrika-managed environment name')
 }

package/src/manifest.ts

@@ -1,3 +1,4 @@
+import { CONTRACT_JOB_NAME_PATTERN, CRON_SCHEDULE_PATTERN } from '@fabrika/app/build'
 import { appSchemaSchema } from '@fabrika/auth'
 import { type AppSchema, type ContractArtifact, contractDigest, isDigest } from '@fabrika/auth-core'
 import type { OperationsSourceMapBuildUpload } from '@fabrika/operations-contract/releases'
@@ -12,10 +13,12 @@ import {
 	FABRIKA_CHECK_VERSION,
 	LOCKED_APP_ID_PATTERN,
 	lockedAuthoredBuild,
+	READINESS_PATH_PATTERN,
 	ZEROPS_RUNTIME_PACKAGES,
 	zeropsAssetRoots,
 	type ZeropsContractRun,
 	zeropsContractRun,
+	type ZeropsDevExecution,
 	type ZeropsLockedExecution,
 	type ZeropsRuntimePackage,
 } from './execution'
@@ -310,15 +313,10 @@ const importDocumentSchema = z.object({ project: importProjectSchema.optional(),
 /** The import document a manifest carries: every service already holds the ADR-0004 invariants. */
 export type FabrikaManifestImportDocument = z.infer<typeof importDocumentSchema>
 
-/** A literal path of unreserved characters: it is written into the generated probes unquoted by any shell. */
-const READINESS_PATH = /^(?:\/[A-Za-z0-9_~-][A-Za-z0-9._~-]*)+$/
-const JOB_NAME = /^[A-Za-z][A-Za-z0-9_]*$/
-const CRON_SCHEDULE = /^[0-9*/,-]+(?: [0-9*/,-]+){4}$/
-
 const contractRunSchema = z.object({
 	digest: z.string().regex(CONTRACT_DIGEST_PATTERN),
-	readinessPath: z.string().regex(READINESS_PATH),
-	jobs: z.array(z.object({ name: z.string().regex(JOB_NAME), schedule: z.string().regex(CRON_SCHEDULE) }).strict()),
+	readinessPath: z.string().regex(READINESS_PATH_PATTERN),
+	jobs: z.array(z.object({ name: z.string().regex(CONTRACT_JOB_NAME_PATTERN), schedule: z.string().regex(CRON_SCHEDULE_PATTERN) }).strict()),
 	files: z.literal(true).optional(),
 	scan: z.literal(true).optional(),
 }).strict()
@@ -476,8 +474,11 @@ export const lockedExecutionOf = (manifest: FabrikaManifest): ZeropsLockedExecut
 	}
 }
 
-/** What Control lets a provider publish for one environment (`ProviderEnvironment.access`). */
-export type ZeropsAccess = Pick<ProviderEnvironment, 'access'>
+/**
+ * What Control lets a provider publish for one environment (`ProviderEnvironment.access`), and, for an environment of
+ * kind `dev`, the commit its bootstrap builds.
+ */
+export type ZeropsAccess = Pick<ProviderEnvironment, 'access'> & { readonly dev?: ZeropsDevExecution }
 
 /**
  * The execution descriptor's lock-down at deploy (ADR-0050): Control's approved contract decides it, not the artifact,
@@ -506,6 +507,7 @@ export function lockedExecutionFor(
 		storageHostname: applicationStorageHostname(manifest.target.importDocument.services),
 		runtimePackages: manifest.target.runtimePackages ?? [],
 		sourceMaps: artifactUpload === undefined ? null : sourceMapUpload(artifactUpload, access.contract),
+		...(granted.dev === undefined ? {} : { dev: granted.dev }),
 	}
 }
 
@@ -522,11 +524,6 @@ const sourceMapUpload = (upload: NonNullable<ProviderDeployInput['artifactUpload
 	assetRoots: zeropsAssetRoots(contract),
 })
 
-/** The IAM schema a deploy, cancel or reconcile applies: the approved contract's. `undefined` reconciles nothing. */
-export function approvedSchemaOf(granted: ZeropsAccess): AppSchema | undefined {
-	return granted.access?.schema
-}
-
 export const manifestServiceHostnames = (manifest: FabrikaManifest): string[] =>
 	manifest.target.importDocument.services.map((service) => service.hostname)
 

package/src/namespace/claims.ts

@@ -1,9 +1,16 @@
-import type { ProviderDeploymentNamespace, ProviderRegistration } from '@fabrika/provider-contract'
+import type {
+	ProviderClaimedResource,
+	ProviderClaimedResourcesInput,
+	ProviderDeploymentNamespace,
+	ProviderRegistration,
+} from '@fabrika/provider-contract'
 import { isProxyHost } from '@fabrika/proxy-core/manifest'
+import { type ZeropsApi, ZeropsApiError } from '../api'
 import { assertFabrikaManifestCoordinates, manifestServiceHostnames, zeropsArtifactCodec } from '../manifest'
 import { zeropsSharedServicePrefix } from '../service-names'
 import { decodeEnvelope } from './codec'
 import { ZEROPS_NAMESPACE_POSTGRES_HOSTNAME, ZEROPS_NAMESPACE_PROXY_HOSTNAME } from './constants'
+import { asNamespaceError } from './errors'
 
 export const namespaceResourceClaims = (namespace: ProviderDeploymentNamespace): string[] => {
 	const target = decodeEnvelope(namespace.target)
@@ -75,3 +82,51 @@ export const registrationResourceClaims = (registration: ProviderRegistration):
 	}
 	return hostnames.map((hostname) => `service:${hostname}`).sort()
 }
+
+/**
+ * The platform's answer for a project that does not exist, a deleted one included. A project the token holds no grant
+ * on answers `403 insufficientPermissions` instead (zerops-platform.md), so this never reads an unreachable one as gone.
+ */
+export const ZEROPS_PROJECT_NOT_FOUND = 'projectNotFound'
+
+const SERVICE_CLAIM_PREFIX = 'service:'
+
+/**
+ * Whether each claimed service still exists in the namespace's project. Gone means the project reads `projectNotFound`,
+ * or it exists and has no service under the claimed hostname. Any other answer, a key that names no service, or a
+ * namespace that never recorded its project throws: Control then releases nothing.
+ */
+export const claimedResources = async (
+	api: Pick<ZeropsApi, 'getProject' | 'findService'>,
+	input: ProviderClaimedResourcesInput,
+): Promise<ProviderClaimedResource[]> => {
+	try {
+		const services = input.resourceKeys.map((resourceKey) => {
+			const hostname = resourceKey.startsWith(SERVICE_CLAIM_PREFIX) ? resourceKey.slice(SERVICE_CLAIM_PREFIX.length) : ''
+			if (hostname === '') throw new Error(`Zerops cannot tell whether claimed resource \`${resourceKey}\` exists`)
+			return { resourceKey, hostname }
+		})
+		const projectId = decodeEnvelope(input.namespace.target).projectId
+		// An interrupted first provision can leave a project its marker names but the target does not.
+		if (projectId === undefined) {
+			throw new Error(`Zerops namespace \`${input.namespace.id}\` records no project, so its services cannot be read back`)
+		}
+		if (!(await projectExists(api, projectId, input.signal))) return services.map(({ resourceKey }) => ({ resourceKey, exists: false }))
+		return await Promise.all(services.map(async ({ resourceKey, hostname }) => ({
+			resourceKey,
+			exists: (await api.findService({ projectId, hostname, signal: input.signal })) !== null,
+		})))
+	} catch (cause) {
+		throw asNamespaceError(cause, 'claim check')
+	}
+}
+
+export const projectExists = async (api: Pick<ZeropsApi, 'getProject'>, projectId: string, signal: AbortSignal): Promise<boolean> => {
+	try {
+		await api.getProject({ projectId, signal })
+		return true
+	} catch (error) {
+		if (error instanceof ZeropsApiError && error.code === ZEROPS_PROJECT_NOT_FOUND) return false
+		throw error
+	}
+}

package/src/namespace/errors.ts

@@ -42,7 +42,7 @@ const splitApiMessage = (message: string, code: string): { summary: string; deta
 }
 
 /** Every namespace lifecycle failure leaves this provider as one typed, coded error. */
-export const asNamespaceError = (cause: unknown, mode: 'provision' | 'reconcile' | 'update'): ProviderNamespaceError => {
+export const asNamespaceError = (cause: unknown, mode: 'provision' | 'reconcile' | 'update' | 'claim check'): ProviderNamespaceError => {
 	if (cause instanceof ProviderNamespaceError) return cause
 	// The same value is refused again on every retry; only a smaller manifest or a new carrier fixes it.
 	if (cause instanceof ZeropsServiceEnvValueTooLargeError) return namespaceError(cause.code, cause.message, false)

package/src/namespace/manifest.ts

@@ -1,7 +1,6 @@
 import { appEnvironmentId } from '@fabrika/auth-core'
 import { decodeEnvelope, type ProviderNamespaceMember } from '@fabrika/provider-contract'
-import { isCrossOrigin, isPolicyOrigin, MAX_CROSS_ORIGINS } from '@fabrika/proxy-core/headers'
-import { contractProxyTable, type ProxyManifest } from '@fabrika/proxy-core/manifest'
+import { contractProxyEntry, contractProxyTable, type ProxyManifest } from '@fabrika/proxy-core/manifest'
 import { assertFabrikaManifestCoordinates, zeropsArtifactCodec } from '../manifest'
 
 /** Compile every public member of one deployment namespace into its strict proxy manifest. */
@@ -28,29 +27,17 @@ export function compileNamespaceProxyManifest(namespaceId: string, members: read
 		if (hosts.has(host)) throw new Error(`duplicate proxy host \`${host}\` in deployment namespace ${namespaceId}`)
 		ids.add(id)
 		hosts.add(host)
-		const operationsOrigin = member.operationsOrigin
-		if (operationsOrigin !== undefined && !isPolicyOrigin(operationsOrigin, ['https:', 'http:'])) {
-			throw new Error(`Zerops proxy target ${member.appId}/${member.env} has an Operations ingest origin that is not an http(s) origin`)
-		}
-		const crossOrigins = member.crossOrigins ?? []
-		if (
-			crossOrigins.length > MAX_CROSS_ORIGINS
-			|| new Set(crossOrigins).size !== crossOrigins.length
-			|| crossOrigins.some((origin) => !isCrossOrigin(origin) || new URL(origin).hostname === host)
-		) {
-			throw new Error(`Zerops proxy target ${member.appId}/${member.env} has a cross-origin list the proxy manifest refuses`)
-		}
-		apps.push({
+		apps.push(contractProxyEntry({
 			id,
 			hosts: [host],
 			upstream: proxy.upstream,
 			// A Zerops public domain is always served over the project's TLS-terminating L7 balancer, so the
 			// browser speaks https even though the proxy itself is reached over plain HTTP (ADR-0022).
 			scheme: 'https',
-			...contractProxyTable(access.contract, access.contractDigest),
-			...(operationsOrigin === undefined ? {} : { operationsOrigin }),
-			...(crossOrigins.length === 0 ? {} : { crossOrigins: [...crossOrigins] }),
-		})
+			table: contractProxyTable(access.contract, access.contractDigest),
+			...(member.operationsOrigin === undefined ? {} : { operationsOrigin: member.operationsOrigin }),
+			...(member.crossOrigins === undefined ? {} : { crossOrigins: member.crossOrigins }),
+		}))
 	}
 	return { apps }
 }

package/src/namespace/provisioning.ts

@@ -17,7 +17,7 @@ import {
 	type ZeropsService,
 } from '../api'
 import { defaultSleep } from '../collaborators'
-import { namespaceResourceClaims, registrationResourceClaims } from './claims'
+import { claimedResources, namespaceResourceClaims, projectExists, registrationResourceClaims, ZEROPS_PROJECT_NOT_FOUND } from './claims'
 import { checkpoint, decodeEnvelope, normalizedNamespace, normalizeTarget } from './codec'
 import { ZEROPS_NAMESPACE_POSTGRES_HOSTNAME, ZEROPS_NAMESPACE_PROXY_HOSTNAME, ZEROPS_NAMESPACE_SUBDOMAIN_VARIABLE } from './constants'
 import { asNamespaceError, namespaceError, ZEROPS_NAMESPACE_CANCELLED, ZEROPS_SUBDOMAIN_NOT_PUBLISHED } from './errors'
@@ -67,10 +67,18 @@ const validateProject = (
 	target: NormalizedZeropsNamespaceTarget,
 	project: ZeropsProject,
 	adopting: boolean,
+	installationProjectId: string | undefined,
 ): void => {
 	if (project.id === '') {
 		throw new Error('Zerops namespace project returned an empty id')
 	}
+	// Checked on every reconcile, before the import and the proxy build, so a namespace that already adopted it stops
+	// here instead of rebuilding the platform's enforcement point with an empty manifest (ADR-0034).
+	if (project.id === installationProjectId) {
+		throw new Error(
+			`Zerops project ${project.id} is the installation's own project; a deployment namespace needs a project of its own`,
+		)
+	}
 	if (target.projectName !== project.name) {
 		throw new Error(`Zerops namespace project name mismatch: expected \`${target.projectName}\`, got \`${project.name}\``)
 	}
@@ -222,6 +230,7 @@ const deployProxy = async (
 	target: NormalizedZeropsNamespaceTarget,
 	options: ZeropsNamespaceOptions,
 	wait: ProviderNamespaceRepublishInput['wait'],
+	reuseActive: boolean,
 ): Promise<{ namespace: ProviderDeploymentNamespace; target: NormalizedZeropsNamespaceTarget }> => {
 	let currentNamespace = namespace
 	const manifest = compileNamespaceProxyManifest(namespace.id, input.members)
@@ -229,6 +238,7 @@ const deployProxy = async (
 		namespaceId: namespace.id,
 		target,
 		manifest,
+		brand: input.brand ?? null,
 		proxySecrets: namespaceProxySecrets(manifest, input.members),
 		...(options.source === undefined ? {} : { source: options.source }),
 		api: options.api,
@@ -236,6 +246,7 @@ const deployProxy = async (
 		iamKey: options.iamKey,
 		signal: input.signal,
 		wait,
+		reuseActive,
 		sleep: options.sleep ?? defaultSleep,
 		boundary: () => input.events.boundary(),
 		checkpoint: async next => {
@@ -255,7 +266,7 @@ const republishNamespace = async (
 	if (target.proxyServiceId === undefined || (target.proxyBuild === undefined && !target.ready)) {
 		throw new Error(`Namespace ${namespace.id} is not ready`)
 	}
-	const deployed = await deployProxy(input, namespace, target, options, input.wait)
+	const deployed = await deployProxy(input, namespace, target, options, input.wait, true)
 	return { namespace: deployed.namespace, settled: deployed.target.proxyBuild === undefined && deployed.target.ready }
 }
 
@@ -358,6 +369,14 @@ const runNamespaceMutation = async (
 		} catch {
 			input.signal.throwIfAborted()
 			await checkpoint(input, namespace, { ...target, ready: false })
+			// A deleted project never resolves the version: retrying would hold the namespace `provisioning`, unremovable.
+			if (target.projectId !== undefined && !(await projectExists(options.api, target.projectId, input.signal))) {
+				throw namespaceError(
+					ZEROPS_PROJECT_NOT_FOUND,
+					`Zerops project ${target.projectId} of namespace \`${namespace.id}\` no longer exists; remove the namespace`,
+					false,
+				)
+			}
 			throw namespaceError('proxyAttemptUnresolved', `Proxy version ${target.proxyDeployment.appVersionId} remains unresolved`, true)
 		}
 	}
@@ -398,7 +417,7 @@ const runNamespaceMutation = async (
 		target = { ...target, projectName: project.name }
 		namespace = await checkpoint(input, namespace, target)
 	}
-	validateProject(namespace, target, project, initiallyAdopted)
+	validateProject(namespace, target, project, initiallyAdopted, options.installationProjectId)
 
 	if (initiallyAdopted) {
 		// Validate before the first mutation; the import below then enforces service-level envIsolation.
@@ -433,7 +452,7 @@ const runNamespaceMutation = async (
 	}
 	namespace = await checkpoint(input, namespace, target)
 
-	const deployed = await deployProxy(input, namespace, target, options, 'active')
+	const deployed = await deployProxy(input, namespace, target, options, 'active', false)
 	namespace = deployed.namespace
 	target = { ...deployed.target, proxyConfigured: true }
 	// After the deploy, because the platform refuses a service with no HTTP port — and never before `ready`
@@ -470,6 +489,7 @@ export const createZeropsNamespaceCapabilities = (options: ZeropsNamespaceOption
 		provision: (input) => mutateNamespace(input, options, 'provision'),
 		reconcile: (input) => mutateNamespace(input, options, 'reconcile'),
 		republish: (input) => republishNamespace(input, options),
+		claimedResources: (input) => claimedResources(options.api, input),
 		updates: createZeropsNamespaceUpdates(options),
 		operator: createZeropsNamespaceOperator({ proxySource: options.proxySource }),
 	}