@fabrika/provider-zerops 0.8.2 → 0.9.0-cloudflare.2

package/types/src/types.d.ts

@@ -0,0 +1,119 @@
+import type { ContractArtifact } from '@fabrika/auth-core';
+import type { AppConfigBase } from '@fabrika/provider-contract';
+import type { ContractProxyApp } from '@fabrika/proxy-core/manifest';
+import type { ZeropsRuntimePackage } from './execution';
+import type { ZeropsHealthCheck, ZeropsImportProject, ZeropsImportService, ZeropsReadinessCheck, ZeropsYamlDeploy, ZeropsYamlRun, ZeropsYamlSetup } from './schema.generated';
+import type { ZeropsSourceRepository } from './source';
+import type { ZeropsSourcePrivateBinding } from './source/port';
+export interface ZeropsResourceContext {
+    env: string;
+    domain?: string;
+}
+/**
+ * A probe interval or timeout, as the PLATFORM takes it — a Go duration with a unit, e.g. `30s`.
+ *
+ * The published JSON schema types all six of these as `integer`, and the platform refuses an integer:
+ * `POST /service-stack/zerops-yaml-validation` answers `yamlValidationInvalidYaml` with
+ * `cannot unmarshal !!int into time.Duration`. The account wins, so this type does. Every value is also
+ * bounded to **[10s, 1h]** — `5s` is refused with `invalid execPeriod <10s, 1h0m0s>` — which no
+ * published document states; see `docs/reference/zerops-platform.md`.
+ */
+export type ZeropsDuration = `${number}${'s' | 'm' | 'h'}`;
+/** `run.healthCheck`, with the four duration fields corrected to what the platform accepts. */
+export interface ZeropsHealthCheckSpec extends Omit<ZeropsHealthCheck, ZeropsHealthCheckDurationField> {
+    failureTimeout?: ZeropsDuration;
+    disconnectTimeout?: ZeropsDuration;
+    recoveryTimeout?: ZeropsDuration;
+    execPeriod?: ZeropsDuration;
+}
+type ZeropsHealthCheckDurationField = 'failureTimeout' | 'disconnectTimeout' | 'recoveryTimeout' | 'execPeriod';
+/** `deploy.readinessCheck`, with its two duration fields corrected. */
+export interface ZeropsReadinessCheckSpec extends Omit<ZeropsReadinessCheck, 'failureTimeout' | 'retryPeriod'> {
+    failureTimeout?: ZeropsDuration;
+    retryPeriod?: ZeropsDuration;
+}
+export interface ZeropsYamlRunSpec extends Omit<ZeropsYamlRun, 'healthCheck'> {
+    healthCheck?: ZeropsHealthCheckSpec;
+}
+export interface ZeropsYamlDeploySpec extends Omit<ZeropsYamlDeploy, 'readinessCheck'> {
+    readinessCheck?: ZeropsReadinessCheckSpec;
+}
+export interface ZeropsYamlSetupSpec extends Omit<ZeropsYamlSetup, 'run' | 'deploy'> {
+    run?: ZeropsYamlRunSpec;
+    deploy?: ZeropsYamlDeploySpec;
+}
+/**
+ * A `zerops.yaml` as fabrika AUTHORS it.
+ *
+ * Same relationship to `ZeropsYaml` that `ZeropsServiceSpec` has to `ZeropsImportService`: the generated
+ * transcription is the platform's published contract, and this is the authoring surface, which diverges
+ * from it only where a live account has proved the publication wrong.
+ */
+export interface ZeropsYamlSpec {
+    zerops: ZeropsYamlSetupSpec[];
+}
+export type ZeropsCompilerOwnedServiceField = 'envIsolation' | 'override' | 'envSecrets' | 'dotEnvSecrets' | 'mode' | 'os';
+export type ZeropsCompilerOwnedProjectField = 'envVariables' | 'envIsolation';
+export type ZeropsServiceSpec = Omit<ZeropsImportService, ZeropsCompilerOwnedServiceField>;
+export type ZeropsProjectSpec = Omit<ZeropsImportProject, ZeropsCompilerOwnedProjectField>;
+/** What the namespace proxy applies to the app: the manifest form of its compiled contract, from `contractProxyTable`. */
+export interface ZeropsProxySpec extends Pick<ContractProxyApp, 'endpoints' | 'reservedPrefixes' | 'snapshot'> {
+    upstream: string;
+}
+/**
+ * A typed reference to the namespace-owned PostgreSQL service; it never contains its credential.
+ *
+ * The reference names its PORT, its DATABASE and its TLS MODE rather than inheriting any from the driver — see
+ * `ZEROPS_SHARED_POSTGRES_CONNECTION_STRING` in `./namespace.ts` for what the account proved about each. It is the
+ * service user's; a contract application's `FABRIKA_APP_DATABASE_URL` is generated from `hostname` instead.
+ */
+export interface ZeropsSharedPostgresBinding {
+    readonly resourceKey: 'service:postgres';
+    readonly hostname: 'postgres';
+    readonly connectionString: '${postgres_connectionString}/${postgres_dbName}?sslmode=disable';
+}
+export type ZeropsNamespaceResourceRequirement = ZeropsSharedPostgresBinding;
+export interface ZeropsSourceTarget {
+    platform: 'zerops';
+    deployService?: string;
+    zeropsSetup?: string;
+    proxy?: ZeropsProxySpec;
+    namespaceResources?: ZeropsNamespaceResourceRequirement[];
+    /**
+     * The compiled contract of a contract application. Its presence locks the setup down (ADR-0043): the platform
+     * generates the run section and the server build, and the authored `zerops.yaml` keeps only the SPA build.
+     */
+    contract?: ContractArtifact;
+    /** System packages for the runtime image of a contract application, from a closed list. */
+    runtimePackages?: ZeropsRuntimePackage[];
+    services: (ctx: ZeropsResourceContext) => ZeropsServiceSpec[];
+    project?: ZeropsProjectSpec;
+}
+export interface ZeropsAppConfig extends AppConfigBase {
+    target: ZeropsSourceTarget;
+}
+/** Exact, credential-free source coordinates composed for one non-dry runtime invocation. */
+export interface ZeropsRuntimeSource {
+    runId: string;
+    repository: ZeropsSourceRepository;
+    commitSha: string;
+    /** Absent for a public repository. */
+    privateBinding?: ZeropsSourcePrivateBinding;
+}
+/** The run checkpoint (ADR-0044): the reserved version, and whether its build request may have been sent. */
+export interface ZeropsRunState {
+    appVersionId: string;
+    triggered: boolean;
+}
+/** Ephemeral runtime coordinates. This value is encoded only after credentials are composed. */
+export interface ZeropsRuntimeTarget {
+    projectId: string;
+    serviceId: string;
+    /** The buckets the environment's registration created, from its stored target (creation evidence, ADR-0043). */
+    createdBuckets?: readonly string[];
+    accessToken: string;
+    /** Absent only for dry runs, which perform no source or Zerops mutation. */
+    source?: ZeropsRuntimeSource;
+    apiBaseUrl?: string;
+}
+export {};

package/types/src/version-attempt.d.ts

@@ -0,0 +1,8 @@
+import type { ZeropsApi } from './api/types';
+export declare const isVersionNotFound: (error: unknown) => boolean;
+/**
+ * Delete a reserved version whose build was never requested. Deletion is the barrier: a later upload to
+ * it leaves nothing buildable and a build request fails `appVersionNotFound` (ADR-0044). An already
+ * absent version counts as deleted. Never call this once a build may have been submitted.
+ */
+export declare function deleteVersion(api: Pick<ZeropsApi, 'deleteAppVersion'>, appVersionId: string, signal: AbortSignal): Promise<void>;

package/src/installation/mcp.ts

@@ -1,102 +0,0 @@
-// MCP authoring, opt-in per installation (ADR-0049).
-//
-// The operator names the MCP clients it trusts; everything else is derived. One input turns on BOTH
-// halves, so they cannot disagree: the console's `oauth` row with its registered resource in the proxy
-// manifest, and IAM's `FABRIKA_IAM_OAUTH_CONFIG`, which issues tokens for exactly that resource.
-
-import { type OAuthManagedClient, type OAuthResourceDto, parseOAuthManagedClient } from '@fabrika/iam-contract'
-import { platformOAuthResourceUris, type PlatformProxyComposition, type PlatformProxyManifestTemplate } from './proxy-manifest'
-
-/** One operator-registered MCP client: its CIMD identity, plus where IAM fetches it when that differs. */
-export interface McpClient extends OAuthManagedClient {
-	readonly metadataUrl?: string
-}
-
-/** The document IAM parses from `FABRIKA_IAM_OAUTH_CONFIG`. */
-export interface IamOAuthConfig {
-	readonly clients: readonly McpClient[]
-	readonly resources: readonly OAuthResourceDto[]
-}
-
-const CLIENT_KEYS = ['provider', 'clientId', 'redirectUris', 'metadataUrl']
-/** IAM's own ceiling: it refuses to boot with more. */
-const MAX_CLIENTS = 16
-
-const isObject = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null && !Array.isArray(value)
-
-const isHttpsUrl = (value: string): boolean => {
-	try {
-		const url = new URL(value)
-		return url.protocol === 'https:' && url.username === '' && url.password === '' && url.hash === ''
-	} catch {
-		return false
-	}
-}
-
-const parseClient = (value: unknown, index: number): McpClient => {
-	const client = parseOAuthManagedClient(value)
-	if (client === null || !isObject(value) || !Object.keys(value).every((key) => CLIENT_KEYS.includes(key))) {
-		throw new Error(`MCP client ${index} must be { provider: 'claude' | 'chatgpt', clientId: <https URL>, redirectUris: [...], metadataUrl? }`)
-	}
-	const metadataUrl = value['metadataUrl']
-	if (metadataUrl === undefined) {
-		return client
-	}
-	if (typeof metadataUrl !== 'string' || !isHttpsUrl(metadataUrl)) {
-		throw new Error(`MCP client ${index}: metadataUrl must be an https URL`)
-	}
-	return { ...client, metadataUrl }
-}
-
-/**
- * Parse the operator's MCP client list — a JSON array. Anything malformed, an empty list or a repeated
- * client id is refused here, before a deploy writes a value IAM would refuse to boot with.
- */
-export const parseMcpClientsJson = (raw: string): readonly McpClient[] => {
-	let value: unknown
-	try {
-		value = JSON.parse(raw)
-	} catch {
-		throw new Error('the MCP client list is not valid JSON')
-	}
-	if (!Array.isArray(value) || value.length === 0) {
-		throw new Error('the MCP client list must be a non-empty JSON array')
-	}
-	if (value.length > MAX_CLIENTS) {
-		throw new Error(`the MCP client list names more than ${MAX_CLIENTS} clients, which IAM refuses`)
-	}
-	const clients = value.map(parseClient)
-	const ids = new Set(clients.map((client) => client.clientId))
-	if (ids.size !== clients.length) {
-		throw new Error('the MCP client list names one client id twice')
-	}
-	return clients
-}
-
-/** IAM's OAuth configuration for one placed installation: the clients, and one resource per app that serves one. */
-export const platformIamOAuthConfig = (
-	template: PlatformProxyManifestTemplate,
-	composition: PlatformProxyComposition,
-	clients: readonly McpClient[],
-): IamOAuthConfig => {
-	const resources: OAuthResourceDto[] = []
-	for (const app of template.apps) {
-		if (app.oauthResource === undefined) {
-			continue
-		}
-		const { resource } = platformOAuthResourceUris(composition, composition.placement[app.service].hosts, app.oauthResource)
-		resources.push({
-			app: app.id,
-			resource,
-			defaultScopes: [...app.oauthResource.scopes],
-			scopeGrants: app.oauthResource.scopeGrants.map((grant) => ({
-				scope: grant.scope,
-				permissions: grant.actions.map((action) => ({ action })),
-			})),
-		})
-	}
-	if (resources.length === 0) {
-		throw new Error('the platform proxy manifest template declares no OAuth resource for MCP clients to reach')
-	}
-	return { clients, resources }
-}

package/src/installation/proxy-manifest.ts

@@ -1,214 +0,0 @@
-// The proxy manifest a platform installation is configured with, split into the half that is the same
-// on every installation and the half that is one account's.
-//
-// ── Why a template rather than a `ProxyManifest` with the hosts left out ──────────────────────────
-//
-// `parseProxyManifest` refuses an app that declares no hosts, and rightly — a host-less app is fronted
-// by nothing and protects nothing. So the committed half cannot BE a manifest with empty hosts; it is a
-// type of its own, and `resolvePlatformProxyManifest` is the one way to turn it into the document the
-// proxy parses.
-//
-// ── The split ────────────────────────────────────────────────────────────────────────────────────
-//
-//   template   which apps exist, their ids, the private service each is dialed at, the public listener
-//              each answers on, and their service table. True of every installation, so it is GENERATED into
-//              `src/generated/` and reviewed in a diff.
-//   placement  the hostnames and the browser-facing scheme. `proxy-292c-8080.prg1.zerops.app` names one
-//              account's project, and a production installation binds custom domains instead, so
-//              whoever is deploying supplies these.
-//
-// Nothing in this file imports the packages that OWN the tables. That is the point of the split:
-// they live in the private service packages and reach a deployed installation as DATA, through the
-// generated artifact, so the published deploy path never depends on a package it cannot resolve.
-
-import { type InstallationEndpointTable, installationTableDigest } from '@fabrika/auth-core'
-import {
-	type InstallationProxyApp,
-	isApplicationEntry,
-	type OAuthProtectedResource,
-	parseProxyManifest,
-	serviceProxyTable,
-} from '@fabrika/proxy-core/manifest'
-
-/** The platform services an installation's proxy fronts. Each name is a service hostname in the topology. */
-export type PlatformProxyService = 'iam' | 'control' | 'operations'
-
-/** What one OAuth scope lets a token do: the owning app's actions, resolved by IAM at the token endpoint. */
-export interface PlatformOAuthScopeGrant {
-	readonly scope: string
-	readonly actions: readonly string[]
-}
-
-/**
- * A path an app serves to OAuth clients, protected only on an installation that enables it.
- *
- * The resource URI is the app's public origin plus `path`, so the template holds the path and a deploy
- * binds the origin. Copied from the owning service module by the generator, like `table`.
- */
-export interface PlatformOAuthResourceTemplate {
-	readonly path: string
-	readonly scopes: readonly string[]
-	readonly scopeGrants: readonly PlatformOAuthScopeGrant[]
-}
-
-/**
- * One fronted app, in the form that is the same on every installation: protected by its service contract (ADR-0022
- * "Installation entries"), copied in by the generator and never written by hand.
- */
-export interface PlatformProxyApp {
-	/** The IAM app id. It is the audience of every token the proxy mints for this app's host. */
-	readonly id: string
-	/** The topology service that answers for it. */
-	readonly service: PlatformProxyService
-	/**
-	 * The proxy's public listener this app answers on.
-	 *
-	 * On a `zerops-subdomain` installation a port IS a hostname — Zerops mints one generated host per
-	 * HTTP port — so this is the only installation-independent half of `hosts`. A custom-domain
-	 * installation ignores it: every domain arrives on one listener and the `Host` header decides.
-	 */
-	readonly port: number
-	/** Where the proxy dials it over the project's private network. */
-	readonly upstream: string
-	/** The service's rows; with an `oauthResource`, the table served when the composition names an authorization server. */
-	readonly table: InstallationEndpointTable
-	/** Present only on an app that can serve OAuth clients; off unless the composition names an authorization server. */
-	readonly oauthResource?: PlatformOAuthResourceTemplate
-	/**
-	 * Present exactly with `oauthResource`: the service's table when it serves no OAuth client. The service picks the
-	 * same one, by the digest the deploy writes beside it (`platformServiceTableDigest`).
-	 */
-	readonly tableWithoutOAuth?: InstallationEndpointTable
-}
-
-/** Everything about an installation's manifest that does not depend on WHICH installation it is. */
-export interface PlatformProxyManifestTemplate {
-	readonly apps: readonly PlatformProxyApp[]
-}
-
-/**
- * The template's entry for one platform service.
- *
- * The app IDS live in the template, so a caller that needs one — the deploy's schema reconcile needs
- * the console's — reads it from there rather than restating a literal that could drift from the
- * document the proxy is actually configured with.
- */
-export const platformProxyAppFor = (
-	template: PlatformProxyManifestTemplate,
-	service: PlatformProxyService,
-): PlatformProxyApp => {
-	const app = template.apps.find((candidate) => candidate.service === service)
-	if (app === undefined) {
-		throw new Error(`the platform proxy manifest template fronts no \`${service}\` service`)
-	}
-	return app
-}
-
-/** Where one app answers in a particular composition. */
-export interface PlatformProxyPlacement {
-	/** Public hostnames, without a port — `parseProxyManifest` refuses a `:port` suffix. */
-	readonly hosts: readonly string[]
-	/** Overrides the private dial address. The local composition runs IAM on a port of its own. */
-	readonly upstream?: string
-}
-
-/** One composition of the platform: a deployed installation, or the local Docker stack. */
-export interface PlatformProxyComposition {
-	/** The scheme the BROWSER speaks to these apps — configuration, never a header (see `ProxyApp.scheme`). */
-	readonly scheme: 'http' | 'https'
-	readonly placement: Readonly<Record<PlatformProxyService, PlatformProxyPlacement>>
-	/**
-	 * The public IAM origin that issues OAuth tokens. Present only when the installation enables MCP
-	 * authoring; absent leaves every `oauthResource` unregistered and serves each service's table without OAuth.
-	 */
-	readonly authorizationServer?: string
-	/** The port browsers reach every app on, when it is not the scheme's default. The local composition's is 18080. */
-	readonly publicPort?: number
-}
-
-/**
- * The RFC 8707 resource URI and RFC 9728 metadata URL of an app's OAuth resource, bound to the app's
- * FIRST host: the proxy refuses a resource on a host the app does not answer on.
- */
-export const platformOAuthResourceUris = (
-	composition: Pick<PlatformProxyComposition, 'scheme' | 'publicPort'>,
-	hosts: readonly string[],
-	template: PlatformOAuthResourceTemplate,
-): { readonly resource: string; readonly resourceMetadata: string } => {
-	const host = hosts[0]
-	if (host === undefined) {
-		throw new Error('an OAuth resource needs a host to stand on')
-	}
-	const origin = composition.publicPort === undefined
-		? `${composition.scheme}://${host}`
-		: `${composition.scheme}://${host}:${composition.publicPort}`
-	return {
-		resource: `${origin}${template.path}`,
-		resourceMetadata: `${origin}/.well-known/oauth-protected-resource${template.path}`,
-	}
-}
-
-const registeredResource = (
-	hosts: readonly string[],
-	template: PlatformOAuthResourceTemplate,
-	composition: PlatformProxyComposition,
-	authorizationServer: string,
-): OAuthProtectedResource => ({
-	...platformOAuthResourceUris(composition, hosts, template),
-	authorizationServers: [authorizationServer],
-	scopesSupported: [...template.scopes],
-})
-
-/** Only an installation that names an authorization server registers the resource and serves its OAuth rows. */
-const resolvedApp = (app: PlatformProxyApp, composition: PlatformProxyComposition): InstallationProxyApp => {
-	const placement = composition.placement[app.service]
-	const hosts = [...placement.hosts]
-	const registered = app.oauthResource === undefined || composition.authorizationServer === undefined
-		? undefined
-		: registeredResource(hosts, app.oauthResource, composition, composition.authorizationServer)
-	const table = registered === undefined ? (app.tableWithoutOAuth ?? app.table) : app.table
-	return {
-		id: app.id,
-		hosts,
-		upstream: placement.upstream ?? app.upstream,
-		scheme: composition.scheme,
-		...serviceProxyTable(table, { oauth: registered !== undefined }),
-		...(registered === undefined ? {} : { oauthResources: [registered] }),
-	}
-}
-
-/**
- * Bind a template to one composition and get the document the proxy actually parses.
- *
- * The result is returned THROUGH `parseProxyManifest`, so a duplicate id, a repeated host or a `:port`
- * suffix is refused right here instead of at a deployed proxy's next build.
- */
-export const resolvePlatformProxyManifest = (
-	template: PlatformProxyManifestTemplate,
-	composition: PlatformProxyComposition,
-): PlatformProxyManifest => {
-	const manifest = parseProxyManifest({ apps: template.apps.map((app) => resolvedApp(app, composition)) })
-	// Every platform service is an installation entry, never an application.
-	const services = manifest?.apps.flatMap((app) => isApplicationEntry(app) ? [] : [app]) ?? []
-	if (manifest === null || services.length !== manifest.apps.length) {
-		throw new Error('the resolved platform proxy manifest is not one the proxy would accept')
-	}
-	return { apps: services }
-}
-
-/** The platform proxy's manifest: one installation entry per platform service. */
-export interface PlatformProxyManifest {
-	apps: InstallationProxyApp[]
-}
-
-/**
- * `FABRIKA_SERVICE_TABLE_DIGEST` for a service: the digest of the table this manifest publishes for it, which the
- * service compares with its own and refuses to start under another.
- */
-export const platformServiceTableDigest = (manifest: PlatformProxyManifest, appId: string): string => {
-	const entry = manifest.apps.find((app) => app.id === appId)
-	if (entry === undefined) {
-		throw new Error(`the platform proxy manifest fronts no \`${appId}\``)
-	}
-	return installationTableDigest(entry)
-}

package/src/installation/secrets.ts

@@ -1,78 +0,0 @@
-// The six values `fabrika platform install --provider=zerops` GENERATES, and their shapes.
-//
-// Every one of them is written to a Zerops service as a SENSITIVE variable, which Zerops does not hand
-// back, and to the operator's local secrets file (`install-secrets.ts`) before that. None is printed.
-//
-// The shapes are not free choices. Each one is what the consuming code already parses:
-//
-//   • `FABRIKA_IAM_SIGNING_KEYS` is a JSON array of PRIVATE JWKs, index 0 the active signer
-//     (`@fabrika/iam`'s `Signer.fromPrivateJwks`). ES256 / P-256, RFC 7638 thumbprint `kid`.
-//   • A `px_` key is IAM's own credential spelling, and every shared secret must be at least 32
-//     characters or the service refuses to boot — 32 random bytes at base64url is 43.
-//   • The vault KEK is 32 RAW BYTES at base64, not base64url: `@fabrika/control` imports it as an
-//     AES key, and base64url is a different alphabet.
-//
-// Nothing here re-reads an existing value. `install` is a bring-up; rotating a live installation's
-// signing keys or vault KEK is not something a bring-up may do by accident, so the command refuses to
-// run against a project that already carries these keys rather than generating over them.
-
-import { createHash, generateKeyPairSync, randomBytes } from 'node:crypto'
-
-/**
- * A 256-bit secret in base64url, never starting with `-` or `_`.
- *
- * The re-roll is copied from `@fabrika/local-stack`'s `prepare.ts` and it is not superstition: a
- * credential beginning with `-` reads as a FLAG to anything that later takes it on a command line, no
- * matter how it is quoted. One rolled password beginning with `-` made `mc alias set` print its usage
- * and loop forever. It costs nothing and removes a bug that appears about one install in sixteen.
- */
-const randomSecret = (): string => {
-	for (;;) {
-		const value = randomBytes(32).toString('base64url')
-		if (!value.startsWith('-') && !value.startsWith('_')) {
-			return value
-		}
-	}
-}
-
-/** The `px_` prefix IAM's own credentials carry, so a key looks like what it is wherever it turns up. */
-const randomPxKey = (): string => `px_${randomSecret()}`
-
-/**
- * One ES256 (EC P-256) private JWK with an RFC 7638 thumbprint `kid`, shaped exactly as IAM's
- * `Signer.fromPrivateJwks` loads it.
- */
-const generateEs256Jwk = (): JsonWebKey & { kid: string; alg: string; use: string } => {
-	const { privateKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' })
-	const jwk = privateKey.export({ format: 'jwk' })
-	// RFC 7638 thumbprint over the canonical EC members, in lexicographic order (crv, kty, x, y).
-	const thumbprint = createHash('sha256').update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y })).digest('base64url')
-	return { ...jwk, kid: thumbprint, alg: 'ES256', use: 'sig' }
-}
-
-/** Everything one installation is seeded with. Several of these are shared by more than one service. */
-export interface InstallationSecrets {
-	/** IAM's token-signing material: a JSON array of ES256 private JWKs, index 0 active. */
-	readonly signingKeys: string
-	/** Authenticates IAM's management `/rpc/*` surface. Held by IAM, control and Operations. */
-	readonly rpcKey: string
-	/** Authenticates IAM's `/auth/mint/*` surface, which the proxy calls on the cold path. */
-	readonly proxyKey: string
-	/** The `px_` admin bearer IAM admits as a synthetic global admin. `platform init` and `admin` take it. */
-	readonly provisioningKey: string
-	/** The catalog credential control and Operations share. No `px_` prefix — it is not an IAM credential. */
-	readonly operationsSyncKey: string
-	/** The control plane's vault KEK: 32 raw bytes at base64. Its loss is unrecoverable by design. */
-	readonly vaultKey: string
-}
-
-/** Roll one installation's secrets. Pure entropy in, no I/O, nothing persisted. */
-export const generateInstallationSecrets = (): InstallationSecrets => ({
-	signingKeys: JSON.stringify([generateEs256Jwk()]),
-	rpcKey: randomPxKey(),
-	proxyKey: randomPxKey(),
-	provisioningKey: randomPxKey(),
-	operationsSyncKey: randomSecret(),
-	// base64, NOT base64url: the vault imports these bytes as an AES key.
-	vaultKey: randomBytes(32).toString('base64'),
-})