@fabrika/provider-zerops 0.8.2 → 0.9.0-cloudflare.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.8.2",
+	"version": "0.9.0-cloudflare.1",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -12,27 +12,28 @@
 	},
 	"files": [
 		"src",
-		"!src/**/__tests__/**"
+		"!src/**/__tests__/**",
+		"types"
 	],
 	"exports": {
 		".": {
 			"bun": "./src/index.ts",
-			"types": "./src/index.ts",
+			"types": "./types/src/index.d.ts",
 			"default": "./src/index.ts"
 		},
 		"./cli": {
 			"bun": "./src/cli.ts",
-			"types": "./src/cli.ts",
+			"types": "./types/src/cli.d.ts",
 			"default": "./src/cli.ts"
 		},
 		"./installation": {
 			"bun": "./src/installation/index.ts",
-			"types": "./src/installation/index.ts",
+			"types": "./types/src/installation/index.d.ts",
 			"default": "./src/installation/index.ts"
 		},
 		"./installation/topology": {
 			"bun": "./src/installation/topology/index.ts",
-			"types": "./src/installation/topology/index.ts",
+			"types": "./types/src/installation/topology/index.d.ts",
 			"default": "./src/installation/topology/index.ts"
 		}
 	},
@@ -43,14 +44,15 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth": "0.8.2",
-		"@fabrika/auth-core": "0.8.2",
-		"@fabrika/email": "0.8.2",
-		"@fabrika/iam-contract": "0.8.2",
-		"@fabrika/installation-init": "0.8.2",
-		"@fabrika/operations-contract": "0.8.2",
-		"@fabrika/provider-contract": "0.8.2",
-		"@fabrika/proxy-core": "0.8.2",
+		"@fabrika/app": "0.9.0-cloudflare.1",
+		"@fabrika/auth": "0.9.0-cloudflare.1",
+		"@fabrika/auth-core": "0.9.0-cloudflare.1",
+		"@fabrika/email": "0.9.0-cloudflare.1",
+		"@fabrika/iam-contract": "0.9.0-cloudflare.1",
+		"@fabrika/installation-init": "0.9.0-cloudflare.1",
+		"@fabrika/operations-contract": "0.9.0-cloudflare.1",
+		"@fabrika/provider-contract": "0.9.0-cloudflare.1",
+		"@fabrika/proxy-core": "0.9.0-cloudflare.1",
 		"yaml": "^2.9.1"
 	}
 }

package/src/api/client.ts

@@ -347,6 +347,12 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 			await request('enable subdomain access', 'PUT', `/service-stack/${serviceId}/enable-subdomain-access`, { signal })
 		},
 
+		startService: async ({ serviceId, signal }) =>
+			readResponse('start service', processSchema, await request('start service', 'PUT', `/service-stack/${serviceId}/start`, { signal })),
+
+		stopService: async ({ serviceId, signal }) =>
+			readResponse('stop service', processSchema, await request('stop service', 'PUT', `/service-stack/${serviceId}/stop`, { signal })),
+
 		configureAutoscaling: async ({ serviceId, autoscalingProfileId, signal }) => {
 			const payload = await request('configure autoscaling', 'PUT', `/service-stack/${serviceId}/autoscaling`, {
 				body: { autoscalingProfileId },

package/src/api/types.ts

@@ -500,6 +500,18 @@ export interface ZeropsApi {
 	 */
 	enableSubdomainAccess(input: { serviceId: string; signal: AbortSignal }): Promise<void>
 
+	// ── service-stack: running state ──────────────────────────────────────────────
+
+	/**
+	 * Start a stopped service. VERIFIED AS A SHAPE: `PUT /service-stack/{id}/start` (`StartServiceStack`), no body,
+	 * `ResponseProcess`. Measured 2026-10-21: a stopped Bun service served again about 9 s after the call. Files written
+	 * at runtime survive a stop and a start; a deploy replaces the container and loses them.
+	 */
+	startService(input: { serviceId: string; signal: AbortSignal }): Promise<ZeropsProcess>
+
+	/** Stop a service. VERIFIED AS A SHAPE: `PUT /service-stack/{id}/stop` (`StopServiceStack`), no body, `ResponseProcess`. */
+	stopService(input: { serviceId: string; signal: AbortSignal }): Promise<ZeropsProcess>
+
 	// ── service-stack: autoscaling ────────────────────────────────────────────────
 
 	/**

package/src/cli.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import type { AppCli } from '@fabrika/provider-contract/app-cli'
 import { constants } from 'node:fs'
 import { open } from 'node:fs/promises'
 import { resolve } from 'node:path'
@@ -12,6 +13,7 @@ import {
 	manifestServiceHostnames,
 	ZEROPS_SOURCE_DESCRIPTOR_MAX_BYTES,
 } from './manifest'
+import { zeropsNamespaceCli } from './namespace-cli'
 import type { ZeropsAppConfig } from './types'
 
 const USAGE = `Zerops app tools
@@ -106,6 +108,15 @@ export const runZeropsCli = async (argv: readonly string[]): Promise<void> => {
 	console.info(`wrote ${output} (${manifestServiceHostnames(manifest).length} service(s))`)
 }
 
+/** What `fabrika app build`, `app register` and `fabrika namespace` run for an application on Zerops. */
+export const appCli: AppCli = {
+	provider: 'zerops',
+	entryRuntime: 'bun',
+	build: (argv) => runZeropsCli(['build', ...argv]),
+	registrationManifest: buildZeropsManifestText,
+	namespaces: zeropsNamespaceCli,
+}
+
 if (import.meta.main) {
 	await runZeropsCli(process.argv.slice(2)).catch((error: unknown) => {
 		console.error(error instanceof Error ? error.message : String(error))

package/src/collaborators.ts

@@ -1,5 +1,3 @@
-import { reconcileSchema } from '@fabrika/auth'
-import type { SchemaReconciler } from '@fabrika/provider-contract'
 import { createZeropsApi, type ZeropsApi } from './api'
 import { type ExposureAlerter, sendExposureAlert } from './exposure'
 import type { ZeropsSourcePort } from './source/port'
@@ -28,7 +26,6 @@ export interface ZeropsCollaborators {
 	api: ZeropsApi
 	/** Injected by the Zerops control composition; dry runs do not require it. */
 	source?: ZeropsSourcePort
-	reconcileSchema: SchemaReconciler
 	/** Raises the Operations alert for a refused activation; best-effort. */
 	alertExposure: ExposureAlerter
 	sleep: Sleeper
@@ -36,19 +33,8 @@ export interface ZeropsCollaborators {
 
 export type ZeropsCollaboratorFactory = (target: ZeropsRuntimeTarget) => ZeropsCollaborators
 
-const defaultReconcileSchema: SchemaReconciler = (input) =>
-	reconcileSchema({
-		url: input.url,
-		app: input.app,
-		schema: input.schema,
-		...(input.returnOrigins === undefined ? {} : { returnOrigins: input.returnOrigins }),
-		adminKey: input.adminKey,
-		signal: input.signal,
-	})
-
 export const defaultZeropsCollaborators: ZeropsCollaboratorFactory = (target) => ({
 	api: createZeropsApi({ token: target.accessToken, baseUrl: target.apiBaseUrl }),
-	reconcileSchema: defaultReconcileSchema,
 	alertExposure: sendExposureAlert,
 	sleep: defaultSleep,
 })

package/src/control.ts

@@ -1,4 +1,3 @@
-import { appEnvironmentId } from '@fabrika/auth-core'
 import type {
 	ControlProvider,
 	JsonValue,
@@ -8,6 +7,7 @@ import type {
 	ProviderDeployInput,
 	ProviderDeploymentNamespace,
 	ProviderDeployOutcome,
+	ProviderDevEnvironmentInput,
 	ProviderEnvelope,
 	ProviderEnvironment,
 	ProviderReconcileOutcome,
@@ -16,7 +16,6 @@ import type {
 	ProviderSourceBinding,
 	ProviderSourceResolution,
 	ProviderSourceResolutionInput,
-	SchemaReconciler,
 } from '@fabrika/provider-contract'
 import { decodeEnvelope, ProviderSecretError } from '@fabrika/provider-contract'
 import { z } from 'zod'
@@ -31,9 +30,8 @@ import {
 } from './api'
 import { defaultSleep, defaultZeropsCollaborators, type Sleeper } from './collaborators'
 import { createdServices, type ExposureAlerter, isObjectStorageType } from './exposure'
-import { assertAuthoredManagedInputs, assertAuthoredManagedName, assertNoFrameworkReference, parseManagedEnvironment } from './managed-env'
+import { assertAuthoredManagedInputs, assertAuthoredManagedName, assertNoFrameworkReference } from './managed-env'
 import {
-	approvedSchemaOf,
 	assertFabrikaManifestCoordinates,
 	type FabrikaManifest,
 	manifestServiceHostnames,
@@ -90,11 +88,8 @@ const envelope = <T>(codec: ProviderCodec<T>, value: T): ProviderEnvelope => ({
 export interface ZeropsControlProviderOptions {
 	readonly accessToken: string
 	readonly apiBaseUrl?: string
-	readonly propustkaUrl?: string
-	readonly adminKey?: string
 	readonly api?: ZeropsApi
 	readonly source: ZeropsSourcePort
-	readonly reconcileSchema?: SchemaReconciler
 	readonly alertExposure?: ExposureAlerter
 	readonly sleep?: Sleeper
 	readonly namespaces?: {
@@ -228,7 +223,6 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 		return {
 			api,
 			source: options.source,
-			reconcileSchema: options.reconcileSchema ?? defaults.reconcileSchema,
 			alertExposure: options.alertExposure ?? defaults.alertExposure,
 			sleep: options.sleep ?? defaultSleep,
 		}
@@ -262,34 +256,6 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 		}
 	}
 
-	const reconcileActiveSchema = async (
-		input: { environment: ProviderEnvironment; returnOrigins?: readonly string[] },
-		signal: AbortSignal,
-	): Promise<void> => {
-		const artifact = artifactFor(input.environment)
-		const schema = approvedSchemaOf(input.environment)
-		if (schema === undefined || options.propustkaUrl === undefined) return
-		const placement = resolvedEnvironment(input.environment, { requireReady: false })
-		const runtimeTarget: ZeropsRuntimeTarget = {
-			projectId: placement.projectId,
-			serviceId: placement.target.serviceId,
-			accessToken: options.accessToken,
-			...(options.apiBaseUrl !== undefined ? { apiBaseUrl: options.apiBaseUrl } : {}),
-			propustkaUrl: options.propustkaUrl,
-			...(options.adminKey !== undefined ? { adminKey: options.adminKey } : {}),
-		}
-		const reconcileSchema = options.reconcileSchema ?? defaultZeropsCollaborators(runtimeTarget).reconcileSchema
-		signal.throwIfAborted()
-		await reconcileSchema({
-			url: options.propustkaUrl,
-			app: appEnvironmentId(artifact.app.id, artifact.app.env),
-			schema,
-			...(input.returnOrigins === undefined || input.returnOrigins.length === 0 ? {} : { returnOrigins: input.returnOrigins }),
-			adminKey: options.adminKey,
-			signal,
-		})
-	}
-
 	const assertVersionCoordinates = (environment: ProviderEnvironment, appVersionId: string, version: ZeropsAppVersion): void => {
 		const serviceId = decodeEnvironment(environment).target.serviceId
 		if (version.id !== appVersionId || (version.serviceStackId !== undefined && version.serviceStackId !== serviceId)) {
@@ -324,9 +290,31 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 		return { commitSha: result.commitSha }
 	}
 
+	/** Stop or start the service of a `dev` environment outside a run, and wait for the platform's process. */
+	const runningState = async (input: ProviderDevEnvironmentInput, action: 'start' | 'stop'): Promise<void> => {
+		if (input.environment.kind !== 'dev') throw new Error('zerops: only a dev environment is stopped and started outside a run')
+		const placement = resolvedEnvironment(input.environment, { requireReady: false })
+		const serviceId = placement.target.serviceId
+		// Idempotent: Control's record of a stopped service can lag behind a start from elsewhere.
+		const status = (await api.getService({ serviceId, signal: input.signal })).status
+		if (status === (action === 'stop' ? 'STOPPED' : 'ACTIVE')) return
+		const process = action === 'stop'
+			? await api.stopService({ serviceId, signal: input.signal })
+			: await api.startService({ serviceId, signal: input.signal })
+		await waitForProcess({
+			api,
+			processId: process.id,
+			sleep: options.sleep ?? defaultSleep,
+			signal: input.signal,
+			label: `the ${action} of ${input.environment.appId}/${input.environment.env}`,
+		})
+	}
+
 	const controlProvider: ControlProvider = {
 		id: 'zerops',
 		normalizeRegistration,
+		// The deploy reads `zerops.yaml` from the repository, so a workspace may not change it (ADR-0049 D6).
+		authoring: { protectedFiles: ['zerops.yaml', 'zerops.yml'] },
 		source: { binding: 'connection' },
 		/**
 		 * A Zerops artifact IS the compiled manifest, so the declaration is right here and core can refuse
@@ -349,8 +337,6 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 		deploy: async (input: ProviderDeployInput): Promise<ProviderDeployOutcome> => {
 			input.signal.throwIfAborted()
 			assertAuthoredManagedInputs({ variableNames: Object.keys(input.vars), secretNames: Object.keys(input.secrets) })
-			const handed = parseManagedEnvironment(input.managedEnvironment)
-			const managedEnvironment = { ...handed.values, ...handed.familyVariables }
 			const binding = privateBinding(input.sourceBinding)
 			assertEnvironmentOfApp(input.app, input.environment)
 			const placement = resolvedEnvironment(input.environment, { requireReady: true })
@@ -376,16 +362,14 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 				...(placement.target.createdBuckets === undefined ? {} : { createdBuckets: placement.target.createdBuckets }),
 				...(source === undefined ? {} : { source }),
 				...(options.apiBaseUrl !== undefined ? { apiBaseUrl: options.apiBaseUrl } : {}),
-				...(options.propustkaUrl !== undefined ? { propustkaUrl: options.propustkaUrl } : {}),
-				...(options.adminKey !== undefined ? { adminKey: options.adminKey } : {}),
 			}
 			const result = await deployRun({
 				appId: input.app.id,
 				env: input.environment.env,
-				...(input.returnOrigins === undefined ? {} : { returnOrigins: input.returnOrigins }),
+				...(input.environment.kind === 'dev' && source !== undefined ? { dev: { head: source.commitSha } } : {}),
 				secrets: input.secrets,
 				vars: input.vars,
-				managedEnvironment,
+				managedEnvironment: input.managedEnvironment,
 				target: runtimeTarget,
 				artifact,
 				...(input.environment.access === undefined ? {} : { access: input.environment.access }),
@@ -397,6 +381,10 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 			input.signal.throwIfAborted()
 			return { state: result.status, ...(result.artifactState === undefined ? {} : { artifactState: result.artifactState }) }
 		},
+		devEnvironments: {
+			stop: (input) => runningState(input, 'stop'),
+			start: (input) => runningState(input, 'start'),
+		},
 		cancel: async (input): Promise<ProviderCancelOutcome> => {
 			const signal = input.signal
 			signal.throwIfAborted()
@@ -414,17 +402,8 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 			const version = await getVersion({ appVersionId: checkpoint.appVersionId, signal })
 			if (version === null) return { state: 'settled', outcome: 'failed' }
 			assertVersionCoordinates(input.environment, checkpoint.appVersionId, version)
-			// Cancellation never implies rollback: a version that activated first makes the run a success,
-			// which finishes the same IAM touchpoint a deploy does.
-			if (version.status === ZEROPS_ACTIVE) {
-				try {
-					await reconcileActiveSchema(input, signal)
-				} catch {
-					signal.throwIfAborted()
-					return { state: 'pending' }
-				}
-				return { state: 'settled', outcome: 'succeeded' }
-			}
+			// Cancellation never implies rollback: a version that activated first makes the run a success.
+			if (version.status === ZEROPS_ACTIVE) return { state: 'settled', outcome: 'succeeded' }
 			if (version.status !== undefined && ZEROPS_TERMINAL.has(version.status)) return { state: 'settled', outcome: 'failed' }
 			await cancelBuildQuietly(checkpoint.appVersionId, signal)
 			// A build request that never landed leaves the version UPLOADING for good; the deadline settles it.
@@ -461,10 +440,7 @@ export const createZeropsControlProvider = (options: ZeropsControlProviderOption
 			}
 			if (version === null) return { state: 'failed' }
 			assertVersionCoordinates(input.environment, checkpoint.appVersionId, version)
-			if (version.status === ZEROPS_ACTIVE) {
-				await reconcileActiveSchema(input, signal)
-				return { state: 'succeeded' }
-			}
+			if (version.status === ZEROPS_ACTIVE) return { state: 'succeeded' }
 			if (version.status !== undefined && ZEROPS_TERMINAL.has(version.status)) return { state: 'failed' }
 			if (pastDeadline(input.startedAtMs)) {
 				await cancelBuildQuietly(checkpoint.appVersionId, signal)