@fabrika/provider-zerops 0.8.1 → 0.9.0-cloudflare.1

package/src/namespace/proxy-attempt.ts

@@ -1,4 +1,5 @@
 import { followLeaseLoss, isLeaseLoss, ProviderNamespaceError } from '@fabrika/provider-contract'
+import type { InstallationBrand } from '@fabrika/proxy-core/brand'
 import { encodeProxyManifestJson, FABRIKA_PROXY_MANIFEST_JSON, type ProxyManifest } from '@fabrika/proxy-core/manifest'
 import {
 	readableContent,
@@ -11,7 +12,12 @@ import {
 } from '../api'
 import type { Sleeper } from '../collaborators'
 import { prepareZeropsDescriptor } from '../descriptor'
-import { ZEROPS_PROXY_MANIFEST_PATH, type ZeropsProxyManifestCarrier, zeropsProxyManifestCarrier } from '../proxy-manifest-carrier'
+import {
+	ZEROPS_PROXY_MANIFEST_PATH,
+	zeropsProxyAcceptsBrand,
+	type ZeropsProxyManifestCarrier,
+	zeropsProxyManifestCarrier,
+} from '../proxy-manifest-carrier'
 import { isZeropsUploadDestination } from '../source'
 import type { ZeropsSourcePort } from '../source/port'
 import { deleteVersion } from '../version-attempt'
@@ -35,6 +41,8 @@ export interface ZeropsProxyRepublishInput {
 	readonly namespaceId: string
 	readonly target: ZeropsNamespaceTarget
 	readonly manifest: ProxyManifest
+	/** The installation's client logo (ADR-0066); added to the manifest only when the pinned proxy can parse it. */
+	readonly brand?: InstallationBrand | null
 	readonly source?: ZeropsSourcePort
 	readonly api: ZeropsProxyApi
 	readonly iamUrl: string
@@ -44,6 +52,11 @@ export interface ZeropsProxyRepublishInput {
 	/** Aborts with `lease_lost` when the namespace lease goes, and with `cancel_requested` when a deploy is cancelled. */
 	readonly signal: AbortSignal
 	readonly wait: 'started' | 'active'
+	/**
+	 * Reuse the proxy's ACTIVE version when it was built from this pin with this manifest identity. A deploy and a
+	 * registry change pass true; provisioning and reconcile rebuild, so an operator's repair always reaches the platform.
+	 */
+	readonly reuseActive: boolean
 	/** Persist the target; the caller fences the write on the namespace lease. */
 	readonly checkpoint: (target: ZeropsNamespaceTarget) => Promise<void>
 	readonly boundary: () => Promise<void>
@@ -88,6 +101,28 @@ const writeProxyIam = async (input: ZeropsProxyRepublishInput, serviceId: string
 const proxySecretsDigest = async (secrets: ReadonlyMap<string, string>): Promise<string> =>
 	digest([...secrets].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([key, value]) => `${key}=${value}`).join('\n'))
 
+/**
+ * Whether the proxy already runs `manifestSha256` on this pin: the recorded deployment names both, and its version is
+ * still the service's ACTIVE one. Any doubt, a failed read included, answers false, and the proxy is rebuilt.
+ */
+const servesManifest = async (input: ZeropsProxyRepublishInput, target: ZeropsNamespaceTarget, manifestSha256: string): Promise<boolean> => {
+	const deployed = target.proxyDeployment
+	const pin = target.proxySource
+	if (
+		target.ready !== true || deployed === undefined || deployed.manifestSha256 !== manifestSha256
+		|| deployed.commitSha !== pin.commitSha || deployed.descriptorSha256 !== pin.descriptor.sha256
+		|| deployed.repository.owner !== pin.repository.owner || deployed.repository.name !== pin.repository.name
+	) return false
+	await input.boundary()
+	try {
+		const version = await input.api.getAppVersion({ appVersionId: deployed.appVersionId, signal: input.signal })
+		return version.id === deployed.appVersionId && version.status === ZEROPS_ACTIVE && version.serviceStackId === target.proxyServiceId
+	} catch {
+		input.signal.throwIfAborted()
+		return false
+	}
+}
+
 /**
  * Rebuild the namespace proxy with `manifest` (ADR-0044). The attempt is recorded as `proxyBuild` and never
  * resumed: an inherited attempt not yet `triggered` is deleted, a triggered one is polled to a terminal state.
@@ -100,7 +135,11 @@ export async function republishProxy(input: ZeropsProxyRepublishInput): Promise<
 	await verifyZeropsNamespaceProxySource(pin)
 	// The pinned descriptor decides: a namespace kept on an older proxy revision still lifts the variable (ADR-0045).
 	const carrier = zeropsProxyManifestCarrier(pin.descriptor.contents)
-	const manifest = encodeProxyManifestJson(input.manifest)
+	// So does it for the logo: an older parser refuses the key, and the namespace keeps the mark until it is re-pinned.
+	const brand = input.brand ?? null
+	const manifest = encodeProxyManifestJson(
+		brand !== null && zeropsProxyAcceptsBrand(pin.descriptor.contents) ? { ...input.manifest, brand } : input.manifest,
+	)
 	// The attempt's identity covers the IAM configuration and the proxy secrets too, so rotating any forces a rebuild.
 	const proxySecrets = input.proxySecrets ?? new Map<string, string>()
 	const secrets = proxySecrets.size === 0 ? '' : `\n${await proxySecretsDigest(proxySecrets)}`
@@ -173,6 +212,8 @@ export async function republishProxy(input: ZeropsProxyRepublishInput): Promise<
 		if (inherited.manifestSha256 === manifestSha256) return target
 	}
 
+	if (input.reuseActive && target.proxyBuild === undefined && await servesManifest(input, target, manifestSha256)) return target
+
 	if (input.source === undefined) throw new Error('Zerops namespace source client is required')
 	const runId = crypto.randomUUID()
 	const resolved = await input.source.resolve({

package/src/namespace/proxy-reads.ts

@@ -1,36 +1,26 @@
-// What a namespace proxy pinned to an older source cannot read. Its manifest parser is strict: one row of a form it does
-// not know, or a CSP directive it does not know, refuses the whole manifest and blocks the namespace's next republish.
-// So a deploy that would publish either is refused before publication while the namespace's proxy source is not
-// this control plane's own.
+// What a namespace proxy pinned to an older source cannot read or serve. Its manifest parser is strict: one row of a form
+// it does not know, or a CSP directive it does not know, refuses the whole manifest and blocks the namespace's next
+// republish; and it has no terminal sign-out. So a deploy that would publish either, or a terminal, is refused before
+// publication while the namespace's proxy source is not this control plane's own.
 
 import type { ProviderApprovedAccess } from '@fabrika/provider-contract'
-import type { CspOrigins } from '@fabrika/proxy-core/headers'
-import { contractProxyTable, type ProxyEndpointRow } from '@fabrika/proxy-core/manifest'
+import { contractProxyTable, type OlderProxyReaders } from '@fabrika/proxy-core/manifest'
 import type { ZeropsNamespaceProxySource } from './types'
 
-/**
- * What the namespace proxy of one older platform release parses of an application's manifest entry: a row, and the
- * entry's CSP directives, each by that release's own parser.
- */
-export interface OlderProxyReader {
-	readonly row: (row: ProxyEndpointRow) => boolean
-	readonly csp: (csp: CspOrigins) => boolean
-}
-
-/**
- * The namespace proxies of the older releases this platform serves (ADR-0062). Control holds their parsers, as it holds
- * their contract readers; a pin's release is not recorded, so what any of them reads is what the pin may read.
- */
-export type OlderProxyReaders = readonly [OlderProxyReader, ...OlderProxyReader[]]
+export type { OlderProxyReader, OlderProxyReaders } from '@fabrika/proxy-core/manifest'
 
 /**
  * What of the approved contract's manifest entry no older release's proxy parses, as the namespace publishes it: each
  * such row by its id, and `csp` when no older proxy parses the entry's CSP (`workerSrc`, which only this release knows).
+ * A contract that declares a terminal adds `terminal` when no older proxy serves the sign-out its sessions end at
+ * (ADR-0067 §5).
  */
 export function entriesNeedingCurrentProxy(access: ProviderApprovedAccess, olderProxies: OlderProxyReaders): string[] {
 	const table = contractProxyTable(access.contract, access.contractDigest)
 	const rows = table.endpoints.filter((row) => !olderProxies.some((proxy) => proxy.row(row))).map((row) => row.id)
-	return olderProxies.some((proxy) => proxy.csp(table.csp)) ? rows : [...rows, 'csp']
+	const csp = olderProxies.some((proxy) => proxy.csp(table.csp)) ? [] : ['csp']
+	const terminal = access.contract.terminal === undefined || olderProxies.some((proxy) => proxy.signsOut) ? [] : ['terminal']
+	return [...rows, ...csp, ...terminal]
 }
 
 /** This control plane's own proxy source, and the parsers of the older releases a pinned proxy may run. */
@@ -58,7 +48,7 @@ export function assertNamespaceProxyReads(
 		return
 	}
 	throw new Error(
-		`the proxy of deployment namespace \`${namespace}\` is pinned to an older source than this platform's, and no older release's proxy reads ${
+		`the proxy of deployment namespace \`${namespace}\` is pinned to an older source than this platform's, and no older release's proxy reads or serves ${
 			rows.map((row) => `\`${row}\``).join(', ')
 		}; re-pin it with \`fabrika control namespaces update --namespace=${namespace} --proxy-source=current\`, then deploy again`,
 	)

package/src/namespace/types.ts

@@ -81,6 +81,8 @@ export interface ZeropsNamespaceOptions {
 	readonly iamUrl: string
 	/** Same credential IAM receives as `FABRIKA_IAM_PROXY_KEY`. */
 	readonly iamKey: string
+	/** The installation's own project, which no namespace may create into or adopt. Absent until `platform deploy` writes it. */
+	readonly installationProjectId?: string
 	readonly api: ZeropsApi
 	readonly sleep?: Sleeper
 }

package/src/namespace-cli.ts

@@ -0,0 +1,152 @@
+// `fabrika namespace` on Zerops: the provider options, the plan, and the namespace each command hands Control. The
+// `fabrika` command holds Control's origin and credential, and prints the result.
+
+import type { JsonValue, ProviderDeploymentNamespace, ProviderNamespacePlan } from '@fabrika/provider-contract'
+import type { NamespaceCli, NamespaceCommandContext, NamespaceCommandResult } from '@fabrika/provider-contract/app-cli'
+import { parseZeropsCliArgs, type ZeropsCliArgs } from './cli-args'
+import {
+	createZeropsNamespaceOperator,
+	decodeZeropsNamespaceProxySource,
+	verifyZeropsNamespaceProxySource,
+	zeropsNamespaceTargetCodec,
+} from './namespace'
+import type { ZeropsNamespacePostgres } from './namespace'
+import { postgresSchema } from './namespace/codec'
+
+const NAMESPACE_USAGE = `fabrika namespace — Zerops deployment namespaces
+
+Usage:
+  fabrika namespace plan --provider=zerops --id=<id> --env=<env> --preset=<cheap|mid|full> [namespace options]
+  fabrika namespace create --provider=zerops --id=<id> --env=<env> --preset=<cheap|mid|full> [namespace options] [--control-url=<url>]
+  fabrika namespace adopt --provider=zerops --id=<id> --env=<env> --preset=<cheap|mid|full> --project-id=<id> [namespace options] [--control-url=<url>]
+  fabrika namespace reconcile --provider=zerops --id=<id> [--control-url=<url>]
+
+Options:
+  --id=<id>                      Namespace id.
+  --env=<env>                    Environment.
+  --preset=<cheap|mid|full>      Provider-owned namespace preset.
+  --exclusive-app=<id>           App reserved by a full namespace.
+  --project-id=<id>              Existing Zerops project id for adoption.
+  --project-name=<name>          Zerops project name (create: default fabrika-<env>-<id>;
+                                 adopt: the existing project's name, default the namespace id).
+  --core-package=<tier>          LIGHT or SERIOUS.
+  --public-access=<mode>         custom-domain or zerops-subdomain.
+  --postgres-type=<type>         Cheap-tier PostgreSQL type.
+  --postgres-profile=<profile>   Cheap-tier PostgreSQL profile.
+  --control-url=<url>            Control origin; or FABRIKA_CONTROL_URL.
+  --json                         Print the result as JSON instead of rows.
+  -h, --help                     Show this help.
+
+\`plan\` prints one \`<path>\\t<value>\` row per field of the plan, keyed by its path in --json; a multi-line
+value such as the proxy's descriptor file is shown by size only. The other commands print one
+\`<id>\\t<env>\\t<state>\\t<exclusive app>\` row.
+
+Mutating namespace commands read the Bearer credential from FABRIKA_CONTROL_TOKEN.
+Plan/create/adopt require FABRIKA_ZEROPS_PROXY_SOURCE_JSON:
+  {"repository":{"owner":"...","name":"..."},"commitSha":"...","descriptor":{"path":"zerops.yaml","contents":"...","sha256":"..."}}
+Reconcile uses the persisted namespace source.
+`
+
+const required = (value: string | undefined, label: string): string => {
+	if (value === undefined || value.trim() === '') {
+		throw new Error(`${label} is required`)
+	}
+	return value.trim()
+}
+
+const postgres = (args: ZeropsCliArgs): ZeropsNamespacePostgres | undefined => {
+	const type = args.postgresType
+	const profile = args.postgresProfile
+	if (type === undefined && profile === undefined) return undefined
+	if (type === undefined) {
+		throw new Error('--postgres-type is required with --postgres-profile')
+	}
+	const result = postgresSchema.safeParse({ type, profile })
+	if (result.success) return result.data
+	if (result.error.issues[0]?.path[0] === 'type') throw new Error('--postgres-type must be postgresql:ha@18 or postgresql:single@18')
+	throw new Error(`--postgres-profile ${profile} is not supported by ${type}`)
+}
+
+const planOptions = (args: ZeropsCliArgs): { [key: string]: JsonValue } | undefined => {
+	const values: { [key: string]: JsonValue } = {}
+	if (args.projectName !== undefined) values['projectName'] = required(args.projectName, '--project-name')
+	if (args.corePackage !== undefined) values['corePackage'] = required(args.corePackage, '--core-package')
+	if (args.publicAccess !== undefined) values['publicAccess'] = required(args.publicAccess, '--public-access')
+	const database = postgres(args)
+	if (database !== undefined) {
+		values['postgres'] = database.profile === undefined ? { type: database.type } : { type: database.type, profile: database.profile }
+	}
+	return Object.keys(values).length === 0 ? undefined : values
+}
+
+const namespacePlan = async (
+	args: ZeropsCliArgs,
+	source: Readonly<Record<string, string | undefined>>,
+): Promise<ProviderNamespacePlan> => {
+	// `FABRIKA_ZEROPS_*` because Zerops reserves the bare `ZEROPS_` prefix and refuses to store a custom
+	// variable using it (`userDataZeropsPrefixForbidden`).
+	const serialized = required(source['FABRIKA_ZEROPS_PROXY_SOURCE_JSON'], 'FABRIKA_ZEROPS_PROXY_SOURCE_JSON')
+	let value: unknown
+	try {
+		value = JSON.parse(serialized)
+	} catch {
+		throw new Error('FABRIKA_ZEROPS_PROXY_SOURCE_JSON must contain valid JSON')
+	}
+	const proxySource = decodeZeropsNamespaceProxySource(value)
+	await verifyZeropsNamespaceProxySource(proxySource)
+	const operator = createZeropsNamespaceOperator({ proxySource })
+	const options = planOptions(args)
+	return operator.plan({
+		id: required(args.namespaceId, '--id'),
+		env: required(args.env, '--env'),
+		preset: required(args.preset, '--preset'),
+		...(args.exclusiveAppId === undefined ? {} : { exclusiveAppId: required(args.exclusiveAppId, '--exclusive-app') }),
+		...(options === undefined ? {} : { options }),
+	})
+}
+
+/** One namespace command. Every input is validated before `context.control()` is read. */
+const runZeropsNamespaceCommand = async (
+	subcommand: string,
+	argv: readonly string[],
+	context: NamespaceCommandContext,
+): Promise<NamespaceCommandResult> => {
+	const args = parseZeropsCliArgs(['namespace', subcommand, ...argv])
+	if (subcommand === 'plan') {
+		return { plan: await namespacePlan(args, context.source) }
+	}
+	if (subcommand === 'reconcile') {
+		const id = required(args.namespaceId, '--id')
+		return { namespace: await context.control().reconcile(id) }
+	}
+	if (subcommand !== 'create' && subcommand !== 'adopt') {
+		throw new Error(`Unknown namespace command: ${subcommand}`)
+	}
+
+	const planned = await namespacePlan(args, context.source)
+	const control = context.control()
+	if (subcommand === 'create') {
+		return { namespace: await control.create(planned.namespace) }
+	}
+
+	const projectId = required(args.projectId, '--project-id')
+	const decoded = zeropsNamespaceTargetCodec.decode(planned.namespace.target.payload)
+	const namespace: ProviderDeploymentNamespace = {
+		...planned.namespace,
+		target: {
+			provider: 'zerops',
+			version: zeropsNamespaceTargetCodec.version,
+			payload: zeropsNamespaceTargetCodec.encode({
+				...decoded,
+				// An adopted project keeps its own name, so the plan's default for a created one does not apply.
+				projectName: args.projectName ?? planned.namespace.id,
+				managed: false,
+				projectId,
+				ready: false,
+			}),
+		},
+	}
+	return { namespace: await control.adopt(namespace) }
+}
+
+export const zeropsNamespaceCli: NamespaceCli = { usage: NAMESPACE_USAGE, run: runZeropsNamespaceCommand }

package/src/plan.ts

@@ -1,5 +1,4 @@
 import { type FabrikaManifest, manifestServiceHostnames } from './manifest'
-import type { ZeropsRuntimeTarget } from './types'
 
 export type ZeropsStepKind =
 	| 'apply-import'
@@ -11,7 +10,6 @@ export type ZeropsStepKind =
 	| 'upload-source'
 	| 'trigger-build'
 	| 'await-version'
-	| 'reconcile-schema'
 
 export interface ZeropsStep {
 	readonly id: string
@@ -30,7 +28,7 @@ export const resolveDeployHostname = (manifest: FabrikaManifest): string => {
 }
 
 /** Build the provider-owned deploy order without touching the platform. */
-export const buildZeropsPlan = (manifest: FabrikaManifest, target: ZeropsRuntimeTarget): readonly ZeropsStep[] => {
+export const buildZeropsPlan = (manifest: FabrikaManifest): readonly ZeropsStep[] => {
 	const serviceHostnames = manifestServiceHostnames(manifest)
 	const steps: ZeropsStep[] = []
 
@@ -48,7 +46,7 @@ export const buildZeropsPlan = (manifest: FabrikaManifest, target: ZeropsRuntime
 	steps.push({
 		id: 'raise-start-memory',
 		kind: 'raise-start-memory',
-		description: "Raise the deploy service's minimum RAM to what its init commands need",
+		description: "Raise the deploy service's minimum RAM to what its init commands need, and pin a dev environment to one container",
 	})
 	steps.push({
 		id: 'size-database',
@@ -59,9 +57,6 @@ export const buildZeropsPlan = (manifest: FabrikaManifest, target: ZeropsRuntime
 	steps.push({ id: 'upload-source', kind: 'upload-source', description: 'Upload the resolved repository snapshot' })
 	steps.push({ id: 'trigger-build', kind: 'trigger-build', description: 'Trigger the Zerops build+deploy pipeline' })
 	steps.push({ id: 'await-version', kind: 'await-version', description: 'Await the Zerops pipeline and relay its build log' })
-	if (manifest.app.schema !== undefined && target.propustkaUrl !== undefined) {
-		steps.push({ id: 'reconcile-schema', kind: 'reconcile-schema', description: 'Reconcile authz schema into IAM' })
-	}
 
 	return steps
 }