@fabrika/provider-zerops 0.8.2 → 0.9.0-cloudflare.2

package/src/installation/init-options.ts

@@ -6,6 +6,7 @@
 // so a pipeline or an agent drives init end to end. Its confirmations stay, answered by `--yes`.
 
 import {
+	assertPinnedTag,
 	CHECKOUT_FLAG,
 	type CommandEnv,
 	describeArgument,
@@ -17,7 +18,7 @@ import {
 	UNATTENDED_FLAG,
 } from '@fabrika/installation-init'
 import { parsePlatformHosts } from './placement-options'
-import { assertPinnedTag, defaultCheckoutName, defaultSidecarRepo } from './sidecar'
+import { defaultCheckoutName, defaultSidecarRepo } from './sidecar'
 
 /** The name every bypass in this platform is gated on, and therefore the one name an installation cannot take. */
 const LOCAL_ENVIRONMENT = 'local'

package/src/installation/install-environment.ts

@@ -1,11 +1,17 @@
-import type { InstallationEmail } from '@fabrika/installation-init'
+import {
+	INSTALLATION_SECRET_VARIABLES,
+	type InstallationEmail,
+	type InstallationSecrets,
+	installationServiceEnvironment,
+	type PlatformHosts,
+	platformOrigin,
+	type PlatformStorage,
+} from '@fabrika/installation-init'
 import { encodeProxyManifestJson } from '@fabrika/proxy-core/manifest'
 import type { ZeropsNamespaceProxySource } from '../index'
 import type { PlatformDeployService, ResolvedService } from './deploy'
-import { type PlatformHosts, platformOrigin } from './hosts'
 import { assertRunning, type InstallCollaborators } from './install-collaborators'
 import { FABRIKA_ZEROPS_PROXY_SOURCE_JSON, serializeNamespaceProxySource } from './installation-source'
-import type { InstallationSecrets } from './secrets'
 import type { PlatformTier } from './topology/topology'
 
 /** The private address the proxy dials IAM at inside the project, and pass 1's placeholder issuer. */
@@ -16,14 +22,7 @@ const PRIVATE_IAM_URL = `http://${PRIVATE_IAM_UPSTREAM}`
 const postgresUrl = (service: string): string => `\${${service}_connectionTlsString}/\${${service}_dbName}?sslmode=require`
 
 /** An object-storage service's coordinates, as the platform's own `${service_variable}` references. */
-interface StorageReferences {
-	readonly bucket: string
-	readonly accessKeyId: string
-	readonly secretAccessKey: string
-	readonly endpoint: string
-}
-
-const storageOf = (service: string): StorageReferences => ({
+const storageOf = (service: string): PlatformStorage => ({
 	bucket: `\${${service}_bucketName}`,
 	accessKeyId: `\${${service}_accessKeyId}`,
 	secretAccessKey: `\${${service}_secretAccessKey}`,
@@ -72,51 +71,40 @@ export interface InstallationEnvInput {
 }
 
 /**
- * EVERY variable this command places, per service.
+ * EVERY variable this command places, per service: fabrika's (`installationServiceEnvironment`) over this
+ * project's own references, and control's Zerops variables after them.
  *
  * Pure, and exported, because the matrix is the thing most worth pinning: a name that is right on
- * Cloudflare and wrong on Bun is a silent no-op rather than a failure. Two spelling rules run through
- * it, both verified against the runtimes rather than assumed:
- *
- *   • IAM's Bun runtime reads `ISSUER` and `ENVIRONMENT` UNPREFIXED and everything else with the
- *     `FABRIKA_IAM_` prefix (`packages/iam/src/node/runtime.ts`). The prefixed spellings below are the
- *     ones that file actually reads; the unprefixed ones are the ones it actually reads too.
- *   • No key any service declares in its own `zerops.yaml` appears here — `PORT`,
- *     `FABRIKA_IAM_RPC_URL`, `FABRIKA_OPERATIONS_URL`, `FABRIKA_CONTROL_ASSETS_DIR`,
- *     `FABRIKA_CONTROL_URL`, `FABRIKA_PROXY_MANIFEST`, `FABRIKA_PROXY_PORT`. The env API refuses those
- *     (`provider-zerops/src/api.ts`), because the conflict cannot be resolved to a record id.
- *
- * The proxy manifest is deliberately absent: pass 1 writes an empty one and `deployPlatform` owns the
- * real one, in the same run as the code it describes (ADR-0027).
+ * Cloudflare and wrong on Bun is a silent no-op rather than a failure. No key any service declares in its
+ * own `zerops.yaml` appears here — `PORT`, `FABRIKA_IAM_RPC_URL`, `FABRIKA_OPERATIONS_URL`,
+ * `FABRIKA_CONTROL_ASSETS_DIR`, `FABRIKA_CONTROL_URL`, `FABRIKA_PROXY_MANIFEST`, `FABRIKA_PROXY_PORT`. The env
+ * API refuses those (`provider-zerops/src/api.ts`), because the conflict cannot be resolved to a record id.
  */
 export const installationServiceEnv = (input: InstallationEnvInput): ReadonlyMap<PlatformDeployService, ReadonlyMap<string, string>> => {
 	const { secrets } = input
-	const iamOrigin = platformOrigin(input.scheme, input.hosts.iam)
-	const operationsOrigin = platformOrigin(input.scheme, input.hosts.operations)
-	const platformDatabase = postgresUrl('db')
-	const runLogs = storageOf('storage')
 	const operationsData = OPERATIONS_DATA[input.tier]
-	const operationsBlobs = storageOf(operationsData.storage)
+	const fabrika = installationServiceEnvironment({
+		environment: input.environment,
+		scheme: input.scheme,
+		hosts: input.hosts,
+		iamUpstream: PRIVATE_IAM_UPSTREAM,
+		secrets,
+		email: input.email,
+		data: {
+			iamDatabase: postgresUrl('db'),
+			controlDatabase: postgresUrl('db'),
+			operationsDatabase: postgresUrl(operationsData.database),
+			runLogs: storageOf('storage'),
+			operationsBlobs: storageOf(operationsData.storage),
+		},
+	})
 	const control = new Map([
-		['FABRIKA_CONTROL_DATABASE_URL', platformDatabase],
-		['ENVIRONMENT', input.environment],
-		// A bare HOST, not an origin: `controlPublicOrigin` accepts either.
-		['FABRIKA_CONTROL_DOMAIN', input.hosts.control],
-		['FABRIKA_IAM_ISSUER', iamOrigin],
-		['OPERATIONS_ARTIFACT_ORIGIN', operationsOrigin],
-		['FABRIKA_CONTROL_RUN_LOGS_BUCKET', runLogs.bucket],
-		['FABRIKA_CONTROL_RUN_LOGS_ACCESS_KEY_ID', runLogs.accessKeyId],
-		['FABRIKA_CONTROL_RUN_LOGS_SECRET_ACCESS_KEY', runLogs.secretAccessKey],
-		['FABRIKA_CONTROL_RUN_LOGS_ENDPOINT', runLogs.endpoint],
-		['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
-		['OPERATIONS_SYNC_KEY', secrets.operationsSyncKey],
-		['FABRIKA_CONTROL_VAULT_KEY', secrets.vaultKey],
-		['FABRIKA_IAM_PROVISIONING_KEY', secrets.provisioningKey],
+		...fabrika.control,
 		['FABRIKA_ZEROPS_CLIENT_ID', input.clientId],
 		[FABRIKA_ZEROPS_PROXY_SOURCE_JSON, serializeNamespaceProxySource(input.proxySource)],
 		// The PUBLIC IAM origin an application project's proxy reaches: there is no private network
 		// between Zerops projects (ADR-0006).
-		['FABRIKA_ZEROPS_PROXY_IAM_URL', iamOrigin],
+		['FABRIKA_ZEROPS_PROXY_IAM_URL', platformOrigin(input.scheme, input.hosts.iam)],
 		['FABRIKA_ZEROPS_PROXY_IAM_KEY', secrets.proxyKey],
 		['FABRIKA_ZEROPS_ACCESS_TOKEN', input.zeropsAccessToken],
 		['FABRIKA_ZEROPS_PLATFORM_PROJECT_ID', input.projectId],
@@ -126,79 +114,27 @@ export const installationServiceEnv = (input: InstallationEnvInput): ReadonlyMap
 		// the CLI reads `FABRIKA_ZEROPS_API_URL`; they are different processes reading different sources.
 		control.set('FABRIKA_ZEROPS_API_BASE_URL', input.apiBaseUrl)
 	}
-	const email = input.email.kind === 'none' ? [] : [...input.email.variables]
-	for (const [key, value] of email) control.set(key, value)
 	return new Map<PlatformDeployService, ReadonlyMap<string, string>>([
-		[
-			'iam',
-			new Map([
-				['FABRIKA_IAM_DATABASE_URL', platformDatabase],
-				['ENVIRONMENT', input.environment],
-				['ISSUER', iamOrigin],
-				// Password only, by decision: OIDC needs an identity provider the operator has not been
-				// asked for. Both are STATED because IAM's own defaults are the other way round — OIDC on,
-				// password off — and it refuses to boot with neither.
-				['FABRIKA_IAM_OIDC_ENABLED', 'false'],
-				['FABRIKA_IAM_PASSWORD_ENABLED', 'true'],
-				['FABRIKA_IAM_SIGNING_KEYS', secrets.signingKeys],
-				['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
-				['FABRIKA_IAM_PROXY_KEY', secrets.proxyKey],
-				['FABRIKA_IAM_PROVISIONING_KEY', secrets.provisioningKey],
-				...email,
-			]),
-		],
-		[
-			'operations',
-			new Map([
-				['FABRIKA_OPERATIONS_DATABASE_URL', postgresUrl(operationsData.database)],
-				['FABRIKA_OPERATIONS_BLOB_BUCKET', operationsBlobs.bucket],
-				['FABRIKA_OPERATIONS_BLOB_ACCESS_KEY_ID', operationsBlobs.accessKeyId],
-				['FABRIKA_OPERATIONS_BLOB_SECRET_ACCESS_KEY', operationsBlobs.secretAccessKey],
-				['FABRIKA_OPERATIONS_BLOB_ENDPOINT', operationsBlobs.endpoint],
-				['FABRIKA_OPERATIONS_PUBLIC_HOST', input.hosts.operations],
-				['ENVIRONMENT', input.environment],
-				['FABRIKA_IAM_ISSUER', iamOrigin],
-				['OPERATIONS_SYNC_KEY', secrets.operationsSyncKey],
-				['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
-			]),
-		],
+		['iam', fabrika.iam],
+		['operations', fabrika.operations],
 		['control', control],
-		[
-			'proxy',
-			new Map([
-				['ENVIRONMENT', input.environment],
-				// Compared byte-for-byte against a token's `iss`, so this is the PUBLIC issuer and not the
-				// private `iam:3000` pass 1 wrote.
-				['FABRIKA_IAM_ISSUER', iamOrigin],
-				['FABRIKA_IAM_KEY', secrets.proxyKey],
-				['FABRIKA_PROXY_SESSION_OWNER_JSON', JSON.stringify({ issuer: iamOrigin, upstream: PRIVATE_IAM_UPSTREAM })],
-			]),
-		],
+		['proxy', fabrika.proxy],
 	])
 }
 
 /**
- * The keys whose VALUE this command generates, per service.
+ * The keys whose VALUE this command generates, per service: fabrika's, and the two Zerops names on control
+ * that carry the proxy key and the minted token.
  *
  * Their presence on a live service is what "this project already holds an installation" means, and it is
  * checked by KEY only — a value is never read back for comparison. `__tests__/install.test.ts` pins this
  * against the matrix above, so a new generated secret cannot be added without appearing here.
  */
 export const GENERATED_SECRET_KEYS: ReadonlyMap<PlatformDeployService, readonly string[]> = new Map<PlatformDeployService, readonly string[]>([
-	['iam', ['FABRIKA_IAM_SIGNING_KEYS', 'FABRIKA_IAM_RPC_KEY', 'FABRIKA_IAM_PROXY_KEY', 'FABRIKA_IAM_PROVISIONING_KEY']],
-	['operations', ['OPERATIONS_SYNC_KEY', 'FABRIKA_IAM_RPC_KEY']],
-	[
-		'control',
-		[
-			'FABRIKA_IAM_RPC_KEY',
-			'OPERATIONS_SYNC_KEY',
-			'FABRIKA_CONTROL_VAULT_KEY',
-			'FABRIKA_IAM_PROVISIONING_KEY',
-			'FABRIKA_ZEROPS_PROXY_IAM_KEY',
-			'FABRIKA_ZEROPS_ACCESS_TOKEN',
-		],
-	],
-	['proxy', ['FABRIKA_IAM_KEY']],
+	['iam', INSTALLATION_SECRET_VARIABLES.iam],
+	['operations', INSTALLATION_SECRET_VARIABLES.operations],
+	['control', [...INSTALLATION_SECRET_VARIABLES.control, 'FABRIKA_ZEROPS_PROXY_IAM_KEY', 'FABRIKA_ZEROPS_ACCESS_TOKEN']],
+	['proxy', INSTALLATION_SECRET_VARIABLES.proxy],
 ])
 
 /**

package/src/installation/install-options.ts

@@ -10,6 +10,7 @@
 
 import { builtinEmailProviders } from '@fabrika/email/providers'
 import {
+	checkedSecretsFilePath,
 	describeArgument,
 	EMAIL_FLAGS,
 	type InstallationEmail,
@@ -17,10 +18,11 @@ import {
 	readFlag,
 	readInstallationEmail,
 	requiredSetting,
+	SECRETS_FILE_FLAG,
+	SECRETS_FILE_VARIABLE,
 	setting,
 	UNATTENDED_FLAG,
 } from '@fabrika/installation-init'
-import { checkedSecretsFilePath, SECRETS_FILE_FLAG, SECRETS_FILE_VARIABLE } from './install-secrets'
 import { parsePlatformScheme } from './placement-options'
 import { readInstallationSourceDir } from './source-options'
 import type { PlatformTier } from './topology/topology'

package/src/installation/install-secrets.ts

@@ -1,36 +1,10 @@
-// The local copy of every credential `platform install` creates.
+// What a Zerops installation's secrets file records.
 //
 // The services hold the same values in Zerops, but stored SENSITIVE, and Zerops hands a sensitive value
-// back only to a token in sudo mode (measured 2026-10-15). So the operator's copy is the one this
-// command writes, before the first of them is placed: a run that fails later loses nothing.
+// back only to a token in sudo mode (measured 2026-10-15). The file's path rule, quoting and 0600 write
+// are `@fabrika/installation-init`'s `secrets-file.ts`.
 
-import { existsSync } from 'node:fs'
-import { open } from 'node:fs/promises'
-import { isAbsolute, relative, resolve } from 'node:path'
-import type { InstallationSecrets } from './secrets'
-
-/** `--secrets-file`: where the local copy goes. A new file, outside the source checkout. */
-export const SECRETS_FILE_FLAG = '--secrets-file'
-export const SECRETS_FILE_VARIABLE = 'FABRIKA_PLATFORM_SECRETS_FILE'
-
-/**
- * Settle the path before anything is contacted.
- *
- * Refused when it exists, because overwriting one would destroy another installation's only copy, and
- * when it is inside the source checkout, where it would dirty the checkout `platform deploy` uploads
- * and could be committed.
- */
-export const checkedSecretsFilePath = (path: string, sourceDir: string): string => {
-	const absolute = resolve(path)
-	const fromSource = relative(resolve(sourceDir), absolute)
-	if (fromSource === '' || (!fromSource.startsWith('..') && !isAbsolute(fromSource))) {
-		throw new Error(`${SECRETS_FILE_FLAG}=${path} is inside the source checkout — name a path outside it, so it is never uploaded or committed`)
-	}
-	if (existsSync(absolute)) {
-		throw new Error(`${SECRETS_FILE_FLAG}=${path} already exists — it may be another installation's only copy; name a new file`)
-	}
-	return absolute
-}
+import { type InstallationSecrets, renderSecretsFile } from '@fabrika/installation-init'
 
 /** What the file records beside the credentials, so it identifies its installation on its own. */
 export interface InstallationSecretsRecord {
@@ -43,47 +17,29 @@ export interface InstallationSecretsRecord {
 }
 
 /**
- * The file's text: shell-sourceable assignments, named as the commands that read them name them.
+ * The file's text, named as the commands that read it name each value.
  *
  * `FABRIKA_ZEROPS_ACCESS_TOKEN` is the INTEGRATION token, which is what `platform init` and
  * `platform deploy` take; the personal token the install ran with is not written.
  */
-export const renderSecretsFile = (record: InstallationSecretsRecord): string => {
+export const renderInstallationSecretsFile = (record: InstallationSecretsRecord): string => {
 	const { secrets } = record
-	const assignments: readonly (readonly [string, string])[] = [
-		['FABRIKA_ZEROPS_PROJECT_ID', record.projectId],
-		['FABRIKA_ZEROPS_CLIENT_ID', record.clientId],
-		['FABRIKA_IAM_PROVISIONING_KEY', secrets.provisioningKey],
-		['FABRIKA_ZEROPS_ACCESS_TOKEN', record.zeropsAccessToken],
-		['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
-		['FABRIKA_IAM_PROXY_KEY', secrets.proxyKey],
-		['OPERATIONS_SYNC_KEY', secrets.operationsSyncKey],
-		['FABRIKA_CONTROL_VAULT_KEY', secrets.vaultKey],
-		['FABRIKA_IAM_SIGNING_KEYS', secrets.signingKeys],
-	]
-	const lines = assignments.map(([name, value]) => {
-		// Single quotes keep every character literal; none of these values can contain one.
-		if (value.includes("'") || value.includes('\n')) {
-			throw new Error(`${name} cannot be written to the secrets file as one quoted line`)
-		}
-		return `${name}='${value}'`
-	})
-	return [
-		`# fabrika on Zerops — installation \`${record.environment}\`, project ${record.projectId}.`,
-		'# Written by `fabrika platform install`. Every value below is a credential: keep this file private.',
-		'# Zerops holds the same values as sensitive variables and does not hand them back.',
-		'# Load it in a subshell: ( set -a && . <this file> && set +a && fabrika … )',
-		...lines,
-		'',
-	].join('\n')
-}
-
-/** Create the file with mode 0600, failing rather than replacing one that appeared since the check. */
-export const writeSecretsFile = async (path: string, text: string): Promise<void> => {
-	const file = await open(path, 'wx', 0o600)
-	try {
-		await file.writeFile(text)
-	} finally {
-		await file.close()
-	}
+	return renderSecretsFile(
+		[
+			`fabrika on Zerops — installation \`${record.environment}\`, project ${record.projectId}.`,
+			'Written by `fabrika platform install`. Every value below is a credential: keep this file private.',
+			'Zerops holds the same values as sensitive variables and does not hand them back.',
+		],
+		[
+			['FABRIKA_ZEROPS_PROJECT_ID', record.projectId],
+			['FABRIKA_ZEROPS_CLIENT_ID', record.clientId],
+			['FABRIKA_IAM_PROVISIONING_KEY', secrets.provisioningKey],
+			['FABRIKA_ZEROPS_ACCESS_TOKEN', record.zeropsAccessToken],
+			['FABRIKA_IAM_RPC_KEY', secrets.rpcKey],
+			['FABRIKA_IAM_PROXY_KEY', secrets.proxyKey],
+			['OPERATIONS_SYNC_KEY', secrets.operationsSyncKey],
+			['FABRIKA_CONTROL_VAULT_KEY', secrets.vaultKey],
+			['FABRIKA_IAM_SIGNING_KEYS', secrets.signingKeys],
+		],
+	)
 }

package/src/installation/install.ts

@@ -5,10 +5,15 @@
 import {
 	action as consoleAction,
 	confirmations,
+	generateInstallationSecrets,
 	info as consoleInfo,
+	type InstallationSecrets,
 	ok as consoleOk,
+	type PlatformHosts,
+	platformOrigin,
 	step as consoleStep,
 	warn as consoleWarn,
+	writeSecretsFile,
 } from '@fabrika/installation-init'
 import type { SchemaReconciler } from '@fabrika/provider-contract'
 import { createZeropsApi, defaultSleep, readableContent, type ZeropsNamespaceProxySource } from '../index'
@@ -24,7 +29,7 @@ import {
 	type ResolvedService,
 } from './deploy'
 import { PLATFORM_PROXY_MANIFEST_TEMPLATE } from './generated/platform-proxy-manifest'
-import { derivePlatformHosts, type PlatformHosts, platformOrigin, ZEROPS_SUBDOMAIN_VARIABLE } from './hosts'
+import { derivePlatformHosts, ZEROPS_SUBDOMAIN_VARIABLE } from './hosts'
 import { checkedEnvironmentName } from './init-options'
 import { assertRunning, type InstallCollaborators, type InstallPrompts } from './install-collaborators'
 import { GENERATED_SECRET_KEYS, installationServiceEnv, PASS_ONE_PROXY_MANIFEST, passOneProxyEnv, writeServiceEnv } from './install-environment'
@@ -39,11 +44,10 @@ import {
 	resolvePlatformServices,
 	serviceOf,
 } from './install-provisioning'
-import { renderSecretsFile, writeSecretsFile } from './install-secrets'
+import { renderInstallationSecretsFile } from './install-secrets'
 import { explainMintFailure } from './install-token'
 import { prepareInstallationSource, prepareNamespaceProxySource, validateInstallationSetups } from './installation-source'
 import type { PreparedPlatformSource } from './platform-source'
-import { generateInstallationSecrets, type InstallationSecrets } from './secrets'
 
 export type { InstallCollaborators, InstallPrompts } from './install-collaborators'
 export { GENERATED_SECRET_KEYS, type InstallationEnvInput, installationServiceEnv } from './install-environment'
@@ -158,7 +162,7 @@ const installPreparedPlatform = async (
 	log.step('Store the credentials locally')
 	// BEFORE the first one is placed: Zerops keeps them sensitive and will not hand them back.
 	await collaborators.storeSecrets(
-		renderSecretsFile({ environment, projectId: project.id, clientId: input.clientId, secrets, zeropsAccessToken: token.token }),
+		renderInstallationSecretsFile({ environment, projectId: project.id, clientId: input.clientId, secrets, zeropsAccessToken: token.token }),
 	)
 	log.ok(`wrote ${input.secretsFile} (mode 0600) — every credential this installation was created with; nothing else holds a readable copy`)
 

package/src/installation/sidecar.ts

@@ -12,9 +12,10 @@
 //
 // `fabrika.ref` names a published tag of `contember/fabrika-platform`, never a branch: a namespace
 // proxy and an installation both build from tags, so a moving ref would make "which version is this
-// installation running" unanswerable. `assertPinnedTag` refuses a branch when init writes the file, and
-// the generated workflow refuses one again at run time — two gates, because the file is operator-owned
-// after creation and the second gate is the only one that sees what the operator later wrote.
+// installation running" unanswerable. `assertPinnedTag` (`@fabrika/installation-init`) refuses a branch
+// when init writes the file, and the generated workflow refuses one again at run time — two gates,
+// because the file is operator-owned after creation and the second gate is the only one that sees what
+// the operator later wrote.
 //
 // ── The templates are not Cloudflare's ────────────────────────────────────────────────────────────
 //
@@ -23,6 +24,7 @@
 // pipeline; this one runs a single step because on Zerops the order is inside the command (ADR-0027).
 // Cloudflare builds a runner image and needs a GitHub App; Zerops has no runner at all (ADR-0003).
 
+import { assertPinnedTag } from '@fabrika/installation-init'
 import { resolve } from 'node:path'
 import { z } from 'zod'
 
@@ -47,29 +49,6 @@ export interface SidecarValues {
 	readonly fabrikaRef: string
 }
 
-/**
- * A published release tag: `v` and a semantic version.
- *
- * The same shape `scripts/release.ts` accepts, restated rather than imported — that script is not a
- * package and this check has to hold in a published tarball.
- */
-const TAG_PATTERN = /^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
-
-/** The pinned ref, or an error naming what was found. A branch is refused, deliberately and loudly. */
-export const assertPinnedTag = (ref: string): string => {
-	const trimmed = ref.trim()
-	if (trimmed === '') {
-		throw new Error('a published fabrika tag is required, for example v0.1.0')
-	}
-	if (!TAG_PATTERN.test(trimmed)) {
-		throw new Error(
-			`\`${trimmed}\` is not a published tag. A sidecar repository pins a TAG such as v0.1.0 and never a branch: `
-				+ 'an installation that tracked a moving ref could not say which version it runs (ADR-0025)',
-		)
-	}
-	return trimmed
-}
-
 /** Substitute every placeholder in a template. */
 const render = async (name: string, values: SidecarValues): Promise<string> => {
 	const raw = await Bun.file(resolve(TEMPLATES, name)).text()

package/src/installation/topology/setups.ts

@@ -92,6 +92,7 @@
 // arrives fully resolved). Only the proxy needs this, and it declares it explicitly below.
 
 import type { ZeropsHealthCheckSpec, ZeropsReadinessCheckSpec, ZeropsYamlSetupSpec, ZeropsYamlSpec } from '../../index'
+import { FABRIKA_PROXY_MANIFEST_BRAND } from '../../proxy-manifest-carrier'
 
 // ── Readiness and liveness: two mechanisms, two questions ──────────────────────────────────────────
 //
@@ -401,6 +402,10 @@ const proxy: ZeropsYamlSetupSpec = {
 		// it is the archive's data file (see the header).
 		envVariables: {
 			FABRIKA_PROXY_SESSION_OWNER_JSON: '${RUNTIME_FABRIKA_PROXY_SESSION_OWNER_JSON}',
+			// A marker, read by nothing at build time: a namespace pinned to this source has a manifest parser that knows
+			// `brand`, so Control may send the installation's client logo (ADR-0066). An older pin's parser refuses the
+			// key and fails its build, so it is sent only where this is (`zeropsProxyAcceptsBrand`).
+			[FABRIKA_PROXY_MANIFEST_BRAND]: '1',
 		},
 		// CGO off makes the binary static, which is what lets it run on Alpine/musl.
 		prepareCommands: ['CGO_ENABLED=0 GOBIN=/tmp/gobin go install github.com/caddyserver/caddy/v2/cmd/caddy@v2.10.2'],

package/src/installation/upgrade-options.ts

@@ -8,8 +8,8 @@
 // The pin is checked BEFORE anything leaves this machine: `assertPinnedTag` refuses a branch or a SHA
 // (ADR-0025) without a network call, so `--to=main` fails on the spot rather than after a clone.
 
-import { describeArgument, readFlag } from '@fabrika/installation-init'
-import { assertPinnedTag, defaultCheckoutDir } from './sidecar'
+import { assertPinnedTag, describeArgument, readFlag } from '@fabrika/installation-init'
+import { defaultCheckoutDir } from './sidecar'
 
 /** Where the sidecar repository this command edits is found. */
 export type UpgradeSidecar =