@fabrika/provider-zerops 0.8.2 → 0.9.0-cloudflare.2

package/src/managed-env.ts

@@ -1,18 +1,5 @@
-import {
-	FRAMEWORK_VARIABLE_PREFIXES,
-	type FrameworkVariableName,
-	frameworkVariableReference,
-	isConnectKeyVariable,
-	isConnectUrlVariable,
-	isEmailTransportVariable,
-	isFrameworkVariableName,
-	isPlatformTransportVariable,
-	isWorkloadKeyVariable,
-	PLATFORM_RECEIVERS,
-	platformTransportVariables,
-} from '@fabrika/auth-core'
+import { frameworkVariableReference, isFrameworkVariableName } from '@fabrika/auth-core'
 import type { JsonValue } from '@fabrika/provider-contract'
-import { z } from 'zod'
 import { renderYaml } from './compile'
 import {
 	assertOwnRunWhenExtending,
@@ -22,166 +9,6 @@ import {
 	selectZeropsDescriptorSetup,
 } from './descriptor'
 
-/** The framework-only names Control hands every Zerops deploy; the rest of the list is the provider's own. */
-export type ManagedKey = Extract<
-	FrameworkVariableName,
-	| 'FABRIKA_RELEASE'
-	| 'FABRIKA_OPERATIONS_DSN'
-	| 'FABRIKA_IAM_ISSUER'
-	| 'FABRIKA_IAM_APP_ID'
-	| 'FABRIKA_APP_ID'
-	| 'FABRIKA_ENVIRONMENT'
-	| 'FABRIKA_SERVICE_KEY'
-	| 'FABRIKA_PROXY_SECRET'
-	| 'FABRIKA_IAM_RPC_URL'
-	| 'FABRIKA_IAM_RPC_KEY'
-	| 'FABRIKA_APP_ORIGIN'
-	| 'FABRIKA_TOKEN_KEYS'
->
-
-export const MANAGED_KEYS: readonly ManagedKey[] = [
-	'FABRIKA_RELEASE',
-	'FABRIKA_OPERATIONS_DSN',
-	'FABRIKA_IAM_ISSUER',
-	'FABRIKA_IAM_APP_ID',
-	'FABRIKA_APP_ID',
-	'FABRIKA_ENVIRONMENT',
-	'FABRIKA_SERVICE_KEY',
-	'FABRIKA_PROXY_SECRET',
-	'FABRIKA_IAM_RPC_URL',
-	'FABRIKA_IAM_RPC_KEY',
-	'FABRIKA_APP_ORIGIN',
-	'FABRIKA_TOKEN_KEYS',
-]
-
-/** The managed keys written as service variables; `FABRIKA_RELEASE` travels only in the execution descriptor (ADR-0044). */
-export const SERVICE_MANAGED_KEYS: readonly Exclude<ManagedKey, 'FABRIKA_RELEASE'>[] = [
-	'FABRIKA_OPERATIONS_DSN',
-	'FABRIKA_IAM_ISSUER',
-	'FABRIKA_IAM_APP_ID',
-	'FABRIKA_APP_ID',
-	'FABRIKA_ENVIRONMENT',
-	'FABRIKA_SERVICE_KEY',
-	'FABRIKA_PROXY_SECRET',
-	'FABRIKA_IAM_RPC_URL',
-	'FABRIKA_IAM_RPC_KEY',
-	'FABRIKA_APP_ORIGIN',
-	'FABRIKA_TOKEN_KEYS',
-]
-
-/** The managed keys that carry a credential, written sensitive and therefore never compared. */
-export const SENSITIVE_MANAGED_KEYS: ReadonlySet<ManagedKey> = new Set<ManagedKey>([
-	'FABRIKA_OPERATIONS_DSN',
-	'FABRIKA_SERVICE_KEY',
-	'FABRIKA_PROXY_SECRET',
-	'FABRIKA_IAM_RPC_KEY',
-	'FABRIKA_TOKEN_KEYS',
-])
-
-const PLATFORM_URL_VARIABLES: ReadonlySet<string> = new Set(PLATFORM_RECEIVERS.map((receiver) => platformTransportVariables(receiver).url))
-
-/**
- * A workload, connect or platform transport key and every mail transport variable are written sensitive; a connect or
- * platform transport URL is an origin.
- */
-export const isSensitiveFamilyVariable = (name: string): boolean => !isConnectUrlVariable(name) && !PLATFORM_URL_VARIABLES.has(name)
-
-export type ManagedValues = Record<ManagedKey, string | null>
-
-const managedValuesSchema = z.object({
-	FABRIKA_RELEASE: z.string().nullable(),
-	FABRIKA_OPERATIONS_DSN: z.string().nullable(),
-	FABRIKA_IAM_ISSUER: z.string().nullable(),
-	FABRIKA_IAM_APP_ID: z.string().nullable(),
-	FABRIKA_APP_ID: z.string().nullable(),
-	FABRIKA_ENVIRONMENT: z.string().nullable(),
-	FABRIKA_SERVICE_KEY: z.string().nullable(),
-	FABRIKA_PROXY_SECRET: z.string().nullable(),
-	// IAM's membership transport (ADR-0022 rule 6): its public origin and this environment's key, or both null.
-	FABRIKA_IAM_RPC_URL: z.string().nullable(),
-	FABRIKA_IAM_RPC_KEY: z.string().nullable(),
-	// The environment's canonical origin (`ctx.url`), or null when it has no public origin.
-	FABRIKA_APP_ORIGIN: z.string().nullable(),
-	// The keys of the application's signed tokens, or null when its contract declares no token purpose.
-	FABRIKA_TOKEN_KEYS: z.string().nullable(),
-}).strict()
-
-export function parseManagedValues(value: unknown): ManagedValues {
-	const result = managedValuesSchema.safeParse(value)
-	if (!result.success) throw new Error('zerops: managed environment must name exactly the twelve managed keys')
-	return result.data
-}
-
-/**
- * What Control hands a deploy: the twelve managed keys, the key of each job and webhook of the approved contract, the
- * key and owner origin of each connector import, and the installation's mail transport when a job sends through it.
- */
-export interface ManagedEnvironment {
-	readonly values: ManagedValues
-	/**
-	 * `FABRIKA_<KIND>_<NAME>_KEY` → the workload's `px_` key, `FABRIKA_CONNECT_<IMPORT>_KEY` / `_URL`, each
-	 * `FABRIKA_EMAIL_*` of the installation's mail transport, and `FABRIKA_PLATFORM_<RECEIVER>_URL` / `_KEY`.
-	 */
-	readonly familyVariables: Readonly<Record<string, string>>
-}
-
-const keySchema = z.string().startsWith('px_').min(4)
-const mailValueSchema = z.string().min(1)
-const originSchema = (schemes: readonly string[]) =>
-	z.string().refine((value) => {
-		try {
-			const url = new URL(value)
-			return url.origin === value && schemes.includes(url.protocol)
-		} catch {
-			return false
-		}
-	})
-const connectOriginSchema = originSchema(['https:'])
-// Control's public origin is http in the local stack (`http://control.fabrika.localhost:18080`).
-const platformOriginSchema = originSchema(['http:', 'https:'])
-
-export function parseManagedEnvironment(value: Readonly<Record<string, string | null>>): ManagedEnvironment {
-	const managed: Record<string, string | null> = {}
-	const familyVariables: Record<string, string> = {}
-	for (const [name, entry] of Object.entries(value)) {
-		if (!isFrameworkFamilyVariable(name)) {
-			managed[name] = entry
-			continue
-		}
-		if (isEmailTransportVariable(name)) {
-			const parsed = mailValueSchema.safeParse(entry)
-			if (!parsed.success) throw new Error(`zerops: ${name} must not be empty`)
-			familyVariables[name] = parsed.data
-			continue
-		}
-		if (isPlatformTransportVariable(name)) {
-			const address = PLATFORM_URL_VARIABLES.has(name)
-			const parsed = (address ? platformOriginSchema : keySchema).safeParse(entry)
-			if (!parsed.success) throw new Error(`zerops: ${name} must be ${address ? 'an http(s) origin' : 'a px_ key'}`)
-			familyVariables[name] = parsed.data
-			continue
-		}
-		const origin = isConnectUrlVariable(name)
-		if (!origin && !isWorkloadKeyVariable(name) && !isConnectKeyVariable(name)) {
-			throw new Error(`zerops: ${name} is not a variable a deploy writes`)
-		}
-		const parsed = (origin ? connectOriginSchema : keySchema).safeParse(entry)
-		if (!parsed.success) {
-			throw new Error(`zerops: ${name} must be ${origin ? 'an https origin' : 'a px_ key'}`)
-		}
-		familyVariables[name] = parsed.data
-	}
-	return { values: parseManagedValues(managed), familyVariables }
-}
-
-/**
- * A service variable only the platform writes per workload, import, platform receiver or the installation's mail
- * transport: a stale one is removed when the deploy no longer hands it.
- */
-export function isFrameworkFamilyVariable(name: string): boolean {
-	return FRAMEWORK_VARIABLE_PREFIXES.some((prefix) => name.startsWith(prefix))
-}
-
 const refuse = (): never => {
 	throw new Error('zerops: application configuration uses a Fabrika-managed environment name')
 }

package/src/manifest.ts

@@ -1,3 +1,4 @@
+import { CONTRACT_JOB_NAME_PATTERN, CRON_SCHEDULE_PATTERN } from '@fabrika/app/build'
 import { appSchemaSchema } from '@fabrika/auth'
 import { type AppSchema, type ContractArtifact, contractDigest, isDigest } from '@fabrika/auth-core'
 import type { OperationsSourceMapBuildUpload } from '@fabrika/operations-contract/releases'
@@ -12,10 +13,12 @@ import {
 	FABRIKA_CHECK_VERSION,
 	LOCKED_APP_ID_PATTERN,
 	lockedAuthoredBuild,
+	READINESS_PATH_PATTERN,
 	ZEROPS_RUNTIME_PACKAGES,
 	zeropsAssetRoots,
 	type ZeropsContractRun,
 	zeropsContractRun,
+	type ZeropsDevExecution,
 	type ZeropsLockedExecution,
 	type ZeropsRuntimePackage,
 } from './execution'
@@ -310,15 +313,10 @@ const importDocumentSchema = z.object({ project: importProjectSchema.optional(),
 /** The import document a manifest carries: every service already holds the ADR-0004 invariants. */
 export type FabrikaManifestImportDocument = z.infer<typeof importDocumentSchema>
 
-/** A literal path of unreserved characters: it is written into the generated probes unquoted by any shell. */
-const READINESS_PATH = /^(?:\/[A-Za-z0-9_~-][A-Za-z0-9._~-]*)+$/
-const JOB_NAME = /^[A-Za-z][A-Za-z0-9_]*$/
-const CRON_SCHEDULE = /^[0-9*/,-]+(?: [0-9*/,-]+){4}$/
-
 const contractRunSchema = z.object({
 	digest: z.string().regex(CONTRACT_DIGEST_PATTERN),
-	readinessPath: z.string().regex(READINESS_PATH),
-	jobs: z.array(z.object({ name: z.string().regex(JOB_NAME), schedule: z.string().regex(CRON_SCHEDULE) }).strict()),
+	readinessPath: z.string().regex(READINESS_PATH_PATTERN),
+	jobs: z.array(z.object({ name: z.string().regex(CONTRACT_JOB_NAME_PATTERN), schedule: z.string().regex(CRON_SCHEDULE_PATTERN) }).strict()),
 	files: z.literal(true).optional(),
 	scan: z.literal(true).optional(),
 }).strict()
@@ -476,8 +474,11 @@ export const lockedExecutionOf = (manifest: FabrikaManifest): ZeropsLockedExecut
 	}
 }
 
-/** What Control lets a provider publish for one environment (`ProviderEnvironment.access`). */
-export type ZeropsAccess = Pick<ProviderEnvironment, 'access'>
+/**
+ * What Control lets a provider publish for one environment (`ProviderEnvironment.access`), and, for an environment of
+ * kind `dev`, the commit its bootstrap builds.
+ */
+export type ZeropsAccess = Pick<ProviderEnvironment, 'access'> & { readonly dev?: ZeropsDevExecution }
 
 /**
  * The execution descriptor's lock-down at deploy (ADR-0050): Control's approved contract decides it, not the artifact,
@@ -506,6 +507,7 @@ export function lockedExecutionFor(
 		storageHostname: applicationStorageHostname(manifest.target.importDocument.services),
 		runtimePackages: manifest.target.runtimePackages ?? [],
 		sourceMaps: artifactUpload === undefined ? null : sourceMapUpload(artifactUpload, access.contract),
+		...(granted.dev === undefined ? {} : { dev: granted.dev }),
 	}
 }
 
@@ -522,11 +524,6 @@ const sourceMapUpload = (upload: NonNullable<ProviderDeployInput['artifactUpload
 	assetRoots: zeropsAssetRoots(contract),
 })
 
-/** The IAM schema a deploy, cancel or reconcile applies: the approved contract's. `undefined` reconciles nothing. */
-export function approvedSchemaOf(granted: ZeropsAccess): AppSchema | undefined {
-	return granted.access?.schema
-}
-
 export const manifestServiceHostnames = (manifest: FabrikaManifest): string[] =>
 	manifest.target.importDocument.services.map((service) => service.hostname)
 

package/src/namespace/claims.ts

@@ -1,9 +1,16 @@
-import type { ProviderDeploymentNamespace, ProviderRegistration } from '@fabrika/provider-contract'
+import type {
+	ProviderClaimedResource,
+	ProviderClaimedResourcesInput,
+	ProviderDeploymentNamespace,
+	ProviderRegistration,
+} from '@fabrika/provider-contract'
 import { isProxyHost } from '@fabrika/proxy-core/manifest'
+import { type ZeropsApi, ZeropsApiError } from '../api'
 import { assertFabrikaManifestCoordinates, manifestServiceHostnames, zeropsArtifactCodec } from '../manifest'
 import { zeropsSharedServicePrefix } from '../service-names'
 import { decodeEnvelope } from './codec'
 import { ZEROPS_NAMESPACE_POSTGRES_HOSTNAME, ZEROPS_NAMESPACE_PROXY_HOSTNAME } from './constants'
+import { asNamespaceError } from './errors'
 
 export const namespaceResourceClaims = (namespace: ProviderDeploymentNamespace): string[] => {
 	const target = decodeEnvelope(namespace.target)
@@ -75,3 +82,51 @@ export const registrationResourceClaims = (registration: ProviderRegistration):
 	}
 	return hostnames.map((hostname) => `service:${hostname}`).sort()
 }
+
+/**
+ * The platform's answer for a project that does not exist, a deleted one included. A project the token holds no grant
+ * on answers `403 insufficientPermissions` instead (zerops-platform.md), so this never reads an unreachable one as gone.
+ */
+export const ZEROPS_PROJECT_NOT_FOUND = 'projectNotFound'
+
+const SERVICE_CLAIM_PREFIX = 'service:'
+
+/**
+ * Whether each claimed service still exists in the namespace's project. Gone means the project reads `projectNotFound`,
+ * or it exists and has no service under the claimed hostname. Any other answer, a key that names no service, or a
+ * namespace that never recorded its project throws: Control then releases nothing.
+ */
+export const claimedResources = async (
+	api: Pick<ZeropsApi, 'getProject' | 'findService'>,
+	input: ProviderClaimedResourcesInput,
+): Promise<ProviderClaimedResource[]> => {
+	try {
+		const services = input.resourceKeys.map((resourceKey) => {
+			const hostname = resourceKey.startsWith(SERVICE_CLAIM_PREFIX) ? resourceKey.slice(SERVICE_CLAIM_PREFIX.length) : ''
+			if (hostname === '') throw new Error(`Zerops cannot tell whether claimed resource \`${resourceKey}\` exists`)
+			return { resourceKey, hostname }
+		})
+		const projectId = decodeEnvelope(input.namespace.target).projectId
+		// An interrupted first provision can leave a project its marker names but the target does not.
+		if (projectId === undefined) {
+			throw new Error(`Zerops namespace \`${input.namespace.id}\` records no project, so its services cannot be read back`)
+		}
+		if (!(await projectExists(api, projectId, input.signal))) return services.map(({ resourceKey }) => ({ resourceKey, exists: false }))
+		return await Promise.all(services.map(async ({ resourceKey, hostname }) => ({
+			resourceKey,
+			exists: (await api.findService({ projectId, hostname, signal: input.signal })) !== null,
+		})))
+	} catch (cause) {
+		throw asNamespaceError(cause, 'claim check')
+	}
+}
+
+export const projectExists = async (api: Pick<ZeropsApi, 'getProject'>, projectId: string, signal: AbortSignal): Promise<boolean> => {
+	try {
+		await api.getProject({ projectId, signal })
+		return true
+	} catch (error) {
+		if (error instanceof ZeropsApiError && error.code === ZEROPS_PROJECT_NOT_FOUND) return false
+		throw error
+	}
+}

package/src/namespace/errors.ts

@@ -42,7 +42,7 @@ const splitApiMessage = (message: string, code: string): { summary: string; deta
 }
 
 /** Every namespace lifecycle failure leaves this provider as one typed, coded error. */
-export const asNamespaceError = (cause: unknown, mode: 'provision' | 'reconcile' | 'update'): ProviderNamespaceError => {
+export const asNamespaceError = (cause: unknown, mode: 'provision' | 'reconcile' | 'update' | 'claim check'): ProviderNamespaceError => {
 	if (cause instanceof ProviderNamespaceError) return cause
 	// The same value is refused again on every retry; only a smaller manifest or a new carrier fixes it.
 	if (cause instanceof ZeropsServiceEnvValueTooLargeError) return namespaceError(cause.code, cause.message, false)

package/src/namespace/manifest.ts

@@ -1,7 +1,6 @@
 import { appEnvironmentId } from '@fabrika/auth-core'
 import { decodeEnvelope, type ProviderNamespaceMember } from '@fabrika/provider-contract'
-import { isCrossOrigin, isPolicyOrigin, MAX_CROSS_ORIGINS } from '@fabrika/proxy-core/headers'
-import { contractProxyTable, type ProxyManifest } from '@fabrika/proxy-core/manifest'
+import { contractProxyEntry, contractProxyTable, type ProxyManifest } from '@fabrika/proxy-core/manifest'
 import { assertFabrikaManifestCoordinates, zeropsArtifactCodec } from '../manifest'
 
 /** Compile every public member of one deployment namespace into its strict proxy manifest. */
@@ -28,29 +27,17 @@ export function compileNamespaceProxyManifest(namespaceId: string, members: read
 		if (hosts.has(host)) throw new Error(`duplicate proxy host \`${host}\` in deployment namespace ${namespaceId}`)
 		ids.add(id)
 		hosts.add(host)
-		const operationsOrigin = member.operationsOrigin
-		if (operationsOrigin !== undefined && !isPolicyOrigin(operationsOrigin, ['https:', 'http:'])) {
-			throw new Error(`Zerops proxy target ${member.appId}/${member.env} has an Operations ingest origin that is not an http(s) origin`)
-		}
-		const crossOrigins = member.crossOrigins ?? []
-		if (
-			crossOrigins.length > MAX_CROSS_ORIGINS
-			|| new Set(crossOrigins).size !== crossOrigins.length
-			|| crossOrigins.some((origin) => !isCrossOrigin(origin) || new URL(origin).hostname === host)
-		) {
-			throw new Error(`Zerops proxy target ${member.appId}/${member.env} has a cross-origin list the proxy manifest refuses`)
-		}
-		apps.push({
+		apps.push(contractProxyEntry({
 			id,
 			hosts: [host],
 			upstream: proxy.upstream,
 			// A Zerops public domain is always served over the project's TLS-terminating L7 balancer, so the
 			// browser speaks https even though the proxy itself is reached over plain HTTP (ADR-0022).
 			scheme: 'https',
-			...contractProxyTable(access.contract, access.contractDigest),
-			...(operationsOrigin === undefined ? {} : { operationsOrigin }),
-			...(crossOrigins.length === 0 ? {} : { crossOrigins: [...crossOrigins] }),
-		})
+			table: contractProxyTable(access.contract, access.contractDigest),
+			...(member.operationsOrigin === undefined ? {} : { operationsOrigin: member.operationsOrigin }),
+			...(member.crossOrigins === undefined ? {} : { crossOrigins: member.crossOrigins }),
+		}))
 	}
 	return { apps }
 }

package/src/namespace/provisioning.ts

@@ -17,7 +17,7 @@ import {
 	type ZeropsService,
 } from '../api'
 import { defaultSleep } from '../collaborators'
-import { namespaceResourceClaims, registrationResourceClaims } from './claims'
+import { claimedResources, namespaceResourceClaims, projectExists, registrationResourceClaims, ZEROPS_PROJECT_NOT_FOUND } from './claims'
 import { checkpoint, decodeEnvelope, normalizedNamespace, normalizeTarget } from './codec'
 import { ZEROPS_NAMESPACE_POSTGRES_HOSTNAME, ZEROPS_NAMESPACE_PROXY_HOSTNAME, ZEROPS_NAMESPACE_SUBDOMAIN_VARIABLE } from './constants'
 import { asNamespaceError, namespaceError, ZEROPS_NAMESPACE_CANCELLED, ZEROPS_SUBDOMAIN_NOT_PUBLISHED } from './errors'
@@ -230,6 +230,7 @@ const deployProxy = async (
 	target: NormalizedZeropsNamespaceTarget,
 	options: ZeropsNamespaceOptions,
 	wait: ProviderNamespaceRepublishInput['wait'],
+	reuseActive: boolean,
 ): Promise<{ namespace: ProviderDeploymentNamespace; target: NormalizedZeropsNamespaceTarget }> => {
 	let currentNamespace = namespace
 	const manifest = compileNamespaceProxyManifest(namespace.id, input.members)
@@ -237,6 +238,7 @@ const deployProxy = async (
 		namespaceId: namespace.id,
 		target,
 		manifest,
+		brand: input.brand ?? null,
 		proxySecrets: namespaceProxySecrets(manifest, input.members),
 		...(options.source === undefined ? {} : { source: options.source }),
 		api: options.api,
@@ -244,6 +246,7 @@ const deployProxy = async (
 		iamKey: options.iamKey,
 		signal: input.signal,
 		wait,
+		reuseActive,
 		sleep: options.sleep ?? defaultSleep,
 		boundary: () => input.events.boundary(),
 		checkpoint: async next => {
@@ -263,7 +266,7 @@ const republishNamespace = async (
 	if (target.proxyServiceId === undefined || (target.proxyBuild === undefined && !target.ready)) {
 		throw new Error(`Namespace ${namespace.id} is not ready`)
 	}
-	const deployed = await deployProxy(input, namespace, target, options, input.wait)
+	const deployed = await deployProxy(input, namespace, target, options, input.wait, true)
 	return { namespace: deployed.namespace, settled: deployed.target.proxyBuild === undefined && deployed.target.ready }
 }
 
@@ -366,6 +369,14 @@ const runNamespaceMutation = async (
 		} catch {
 			input.signal.throwIfAborted()
 			await checkpoint(input, namespace, { ...target, ready: false })
+			// A deleted project never resolves the version: retrying would hold the namespace `provisioning`, unremovable.
+			if (target.projectId !== undefined && !(await projectExists(options.api, target.projectId, input.signal))) {
+				throw namespaceError(
+					ZEROPS_PROJECT_NOT_FOUND,
+					`Zerops project ${target.projectId} of namespace \`${namespace.id}\` no longer exists; remove the namespace`,
+					false,
+				)
+			}
 			throw namespaceError('proxyAttemptUnresolved', `Proxy version ${target.proxyDeployment.appVersionId} remains unresolved`, true)
 		}
 	}
@@ -441,7 +452,7 @@ const runNamespaceMutation = async (
 	}
 	namespace = await checkpoint(input, namespace, target)
 
-	const deployed = await deployProxy(input, namespace, target, options, 'active')
+	const deployed = await deployProxy(input, namespace, target, options, 'active', false)
 	namespace = deployed.namespace
 	target = { ...deployed.target, proxyConfigured: true }
 	// After the deploy, because the platform refuses a service with no HTTP port — and never before `ready`
@@ -478,6 +489,7 @@ export const createZeropsNamespaceCapabilities = (options: ZeropsNamespaceOption
 		provision: (input) => mutateNamespace(input, options, 'provision'),
 		reconcile: (input) => mutateNamespace(input, options, 'reconcile'),
 		republish: (input) => republishNamespace(input, options),
+		claimedResources: (input) => claimedResources(options.api, input),
 		updates: createZeropsNamespaceUpdates(options),
 		operator: createZeropsNamespaceOperator({ proxySource: options.proxySource }),
 	}

package/src/namespace/proxy-attempt.ts

@@ -1,4 +1,5 @@
 import { followLeaseLoss, isLeaseLoss, ProviderNamespaceError } from '@fabrika/provider-contract'
+import type { InstallationBrand } from '@fabrika/proxy-core/brand'
 import { encodeProxyManifestJson, FABRIKA_PROXY_MANIFEST_JSON, type ProxyManifest } from '@fabrika/proxy-core/manifest'
 import {
 	readableContent,
@@ -11,7 +12,12 @@ import {
 } from '../api'
 import type { Sleeper } from '../collaborators'
 import { prepareZeropsDescriptor } from '../descriptor'
-import { ZEROPS_PROXY_MANIFEST_PATH, type ZeropsProxyManifestCarrier, zeropsProxyManifestCarrier } from '../proxy-manifest-carrier'
+import {
+	ZEROPS_PROXY_MANIFEST_PATH,
+	zeropsProxyAcceptsBrand,
+	type ZeropsProxyManifestCarrier,
+	zeropsProxyManifestCarrier,
+} from '../proxy-manifest-carrier'
 import { isZeropsUploadDestination } from '../source'
 import type { ZeropsSourcePort } from '../source/port'
 import { deleteVersion } from '../version-attempt'
@@ -35,6 +41,8 @@ export interface ZeropsProxyRepublishInput {
 	readonly namespaceId: string
 	readonly target: ZeropsNamespaceTarget
 	readonly manifest: ProxyManifest
+	/** The installation's client logo (ADR-0066); added to the manifest only when the pinned proxy can parse it. */
+	readonly brand?: InstallationBrand | null
 	readonly source?: ZeropsSourcePort
 	readonly api: ZeropsProxyApi
 	readonly iamUrl: string
@@ -44,6 +52,11 @@ export interface ZeropsProxyRepublishInput {
 	/** Aborts with `lease_lost` when the namespace lease goes, and with `cancel_requested` when a deploy is cancelled. */
 	readonly signal: AbortSignal
 	readonly wait: 'started' | 'active'
+	/**
+	 * Reuse the proxy's ACTIVE version when it was built from this pin with this manifest identity. A deploy and a
+	 * registry change pass true; provisioning and reconcile rebuild, so an operator's repair always reaches the platform.
+	 */
+	readonly reuseActive: boolean
 	/** Persist the target; the caller fences the write on the namespace lease. */
 	readonly checkpoint: (target: ZeropsNamespaceTarget) => Promise<void>
 	readonly boundary: () => Promise<void>
@@ -88,6 +101,28 @@ const writeProxyIam = async (input: ZeropsProxyRepublishInput, serviceId: string
 const proxySecretsDigest = async (secrets: ReadonlyMap<string, string>): Promise<string> =>
 	digest([...secrets].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([key, value]) => `${key}=${value}`).join('\n'))
 
+/**
+ * Whether the proxy already runs `manifestSha256` on this pin: the recorded deployment names both, and its version is
+ * still the service's ACTIVE one. Any doubt, a failed read included, answers false, and the proxy is rebuilt.
+ */
+const servesManifest = async (input: ZeropsProxyRepublishInput, target: ZeropsNamespaceTarget, manifestSha256: string): Promise<boolean> => {
+	const deployed = target.proxyDeployment
+	const pin = target.proxySource
+	if (
+		target.ready !== true || deployed === undefined || deployed.manifestSha256 !== manifestSha256
+		|| deployed.commitSha !== pin.commitSha || deployed.descriptorSha256 !== pin.descriptor.sha256
+		|| deployed.repository.owner !== pin.repository.owner || deployed.repository.name !== pin.repository.name
+	) return false
+	await input.boundary()
+	try {
+		const version = await input.api.getAppVersion({ appVersionId: deployed.appVersionId, signal: input.signal })
+		return version.id === deployed.appVersionId && version.status === ZEROPS_ACTIVE && version.serviceStackId === target.proxyServiceId
+	} catch {
+		input.signal.throwIfAborted()
+		return false
+	}
+}
+
 /**
  * Rebuild the namespace proxy with `manifest` (ADR-0044). The attempt is recorded as `proxyBuild` and never
  * resumed: an inherited attempt not yet `triggered` is deleted, a triggered one is polled to a terminal state.
@@ -100,7 +135,11 @@ export async function republishProxy(input: ZeropsProxyRepublishInput): Promise<
 	await verifyZeropsNamespaceProxySource(pin)
 	// The pinned descriptor decides: a namespace kept on an older proxy revision still lifts the variable (ADR-0045).
 	const carrier = zeropsProxyManifestCarrier(pin.descriptor.contents)
-	const manifest = encodeProxyManifestJson(input.manifest)
+	// So does it for the logo: an older parser refuses the key, and the namespace keeps the mark until it is re-pinned.
+	const brand = input.brand ?? null
+	const manifest = encodeProxyManifestJson(
+		brand !== null && zeropsProxyAcceptsBrand(pin.descriptor.contents) ? { ...input.manifest, brand } : input.manifest,
+	)
 	// The attempt's identity covers the IAM configuration and the proxy secrets too, so rotating any forces a rebuild.
 	const proxySecrets = input.proxySecrets ?? new Map<string, string>()
 	const secrets = proxySecrets.size === 0 ? '' : `\n${await proxySecretsDigest(proxySecrets)}`
@@ -173,6 +212,8 @@ export async function republishProxy(input: ZeropsProxyRepublishInput): Promise<
 		if (inherited.manifestSha256 === manifestSha256) return target
 	}
 
+	if (input.reuseActive && target.proxyBuild === undefined && await servesManifest(input, target, manifestSha256)) return target
+
 	if (input.source === undefined) throw new Error('Zerops namespace source client is required')
 	const runId = crypto.randomUUID()
 	const resolved = await input.source.resolve({

package/src/namespace/proxy-reads.ts

@@ -1,36 +1,26 @@
-// What a namespace proxy pinned to an older source cannot read. Its manifest parser is strict: one row of a form it does
-// not know, or a CSP directive it does not know, refuses the whole manifest and blocks the namespace's next republish.
-// So a deploy that would publish either is refused before publication while the namespace's proxy source is not
-// this control plane's own.
+// What a namespace proxy pinned to an older source cannot read or serve. Its manifest parser is strict: one row of a form
+// it does not know, or a CSP directive it does not know, refuses the whole manifest and blocks the namespace's next
+// republish; and it has no terminal sign-out. So a deploy that would publish either, or a terminal, is refused before
+// publication while the namespace's proxy source is not this control plane's own.
 
 import type { ProviderApprovedAccess } from '@fabrika/provider-contract'
-import type { CspOrigins } from '@fabrika/proxy-core/headers'
-import { contractProxyTable, type ProxyEndpointRow } from '@fabrika/proxy-core/manifest'
+import { contractProxyTable, type OlderProxyReaders } from '@fabrika/proxy-core/manifest'
 import type { ZeropsNamespaceProxySource } from './types'
 
-/**
- * What the namespace proxy of one older platform release parses of an application's manifest entry: a row, and the
- * entry's CSP directives, each by that release's own parser.
- */
-export interface OlderProxyReader {
-	readonly row: (row: ProxyEndpointRow) => boolean
-	readonly csp: (csp: CspOrigins) => boolean
-}
-
-/**
- * The namespace proxies of the older releases a pin may run whose parsers Control holds (ADR-0062). A pin's release is not
- * recorded, so what any of them reads is what the pin may read.
- */
-export type OlderProxyReaders = readonly [OlderProxyReader, ...OlderProxyReader[]]
+export type { OlderProxyReader, OlderProxyReaders } from '@fabrika/proxy-core/manifest'
 
 /**
  * What of the approved contract's manifest entry no older release's proxy parses, as the namespace publishes it: each
  * such row by its id, and `csp` when no older proxy parses the entry's CSP (`workerSrc`, which only this release knows).
+ * A contract that declares a terminal adds `terminal` when no older proxy serves the sign-out its sessions end at
+ * (ADR-0067 §5).
  */
 export function entriesNeedingCurrentProxy(access: ProviderApprovedAccess, olderProxies: OlderProxyReaders): string[] {
 	const table = contractProxyTable(access.contract, access.contractDigest)
 	const rows = table.endpoints.filter((row) => !olderProxies.some((proxy) => proxy.row(row))).map((row) => row.id)
-	return olderProxies.some((proxy) => proxy.csp(table.csp)) ? rows : [...rows, 'csp']
+	const csp = olderProxies.some((proxy) => proxy.csp(table.csp)) ? [] : ['csp']
+	const terminal = access.contract.terminal === undefined || olderProxies.some((proxy) => proxy.signsOut) ? [] : ['terminal']
+	return [...rows, ...csp, ...terminal]
 }
 
 /** This control plane's own proxy source, and the parsers of the older releases a pinned proxy may run. */
@@ -58,7 +48,7 @@ export function assertNamespaceProxyReads(
 		return
 	}
 	throw new Error(
-		`the proxy of deployment namespace \`${namespace}\` is pinned to an older source than this platform's, and no older release's proxy reads ${
+		`the proxy of deployment namespace \`${namespace}\` is pinned to an older source than this platform's, and no older release's proxy reads or serves ${
 			rows.map((row) => `\`${row}\``).join(', ')
 		}; re-pin it with \`fabrika control namespaces update --namespace=${namespace} --proxy-source=current\`, then deploy again`,
 	)