@fabrika/provider-zerops 0.8.2 → 0.9.0-cloudflare.2

package/src/namespace-cli.ts

@@ -0,0 +1,152 @@
+// `fabrika namespace` on Zerops: the provider options, the plan, and the namespace each command hands Control. The
+// `fabrika` command holds Control's origin and credential, and prints the result.
+
+import type { JsonValue, ProviderDeploymentNamespace, ProviderNamespacePlan } from '@fabrika/provider-contract'
+import type { NamespaceCli, NamespaceCommandContext, NamespaceCommandResult } from '@fabrika/provider-contract/app-cli'
+import { parseZeropsCliArgs, type ZeropsCliArgs } from './cli-args'
+import {
+	createZeropsNamespaceOperator,
+	decodeZeropsNamespaceProxySource,
+	verifyZeropsNamespaceProxySource,
+	zeropsNamespaceTargetCodec,
+} from './namespace'
+import type { ZeropsNamespacePostgres } from './namespace'
+import { postgresSchema } from './namespace/codec'
+
+const NAMESPACE_USAGE = `fabrika namespace — Zerops deployment namespaces
+
+Usage:
+  fabrika namespace plan --provider=zerops --id=<id> --env=<env> --preset=<cheap|mid|full> [namespace options]
+  fabrika namespace create --provider=zerops --id=<id> --env=<env> --preset=<cheap|mid|full> [namespace options] [--control-url=<url>]
+  fabrika namespace adopt --provider=zerops --id=<id> --env=<env> --preset=<cheap|mid|full> --project-id=<id> [namespace options] [--control-url=<url>]
+  fabrika namespace reconcile --provider=zerops --id=<id> [--control-url=<url>]
+
+Options:
+  --id=<id>                      Namespace id.
+  --env=<env>                    Environment.
+  --preset=<cheap|mid|full>      Provider-owned namespace preset.
+  --exclusive-app=<id>           App reserved by a full namespace.
+  --project-id=<id>              Existing Zerops project id for adoption.
+  --project-name=<name>          Zerops project name (create: default fabrika-<env>-<id>;
+                                 adopt: the existing project's name, default the namespace id).
+  --core-package=<tier>          LIGHT or SERIOUS.
+  --public-access=<mode>         custom-domain or zerops-subdomain.
+  --postgres-type=<type>         Cheap-tier PostgreSQL type.
+  --postgres-profile=<profile>   Cheap-tier PostgreSQL profile.
+  --control-url=<url>            Control origin; or FABRIKA_CONTROL_URL.
+  --json                         Print the result as JSON instead of rows.
+  -h, --help                     Show this help.
+
+\`plan\` prints one \`<path>\\t<value>\` row per field of the plan, keyed by its path in --json; a multi-line
+value such as the proxy's descriptor file is shown by size only. The other commands print one
+\`<id>\\t<env>\\t<state>\\t<exclusive app>\` row.
+
+Mutating namespace commands read the Bearer credential from FABRIKA_CONTROL_TOKEN.
+Plan/create/adopt require FABRIKA_ZEROPS_PROXY_SOURCE_JSON:
+  {"repository":{"owner":"...","name":"..."},"commitSha":"...","descriptor":{"path":"zerops.yaml","contents":"...","sha256":"..."}}
+Reconcile uses the persisted namespace source.
+`
+
+const required = (value: string | undefined, label: string): string => {
+	if (value === undefined || value.trim() === '') {
+		throw new Error(`${label} is required`)
+	}
+	return value.trim()
+}
+
+const postgres = (args: ZeropsCliArgs): ZeropsNamespacePostgres | undefined => {
+	const type = args.postgresType
+	const profile = args.postgresProfile
+	if (type === undefined && profile === undefined) return undefined
+	if (type === undefined) {
+		throw new Error('--postgres-type is required with --postgres-profile')
+	}
+	const result = postgresSchema.safeParse({ type, profile })
+	if (result.success) return result.data
+	if (result.error.issues[0]?.path[0] === 'type') throw new Error('--postgres-type must be postgresql:ha@18 or postgresql:single@18')
+	throw new Error(`--postgres-profile ${profile} is not supported by ${type}`)
+}
+
+const planOptions = (args: ZeropsCliArgs): { [key: string]: JsonValue } | undefined => {
+	const values: { [key: string]: JsonValue } = {}
+	if (args.projectName !== undefined) values['projectName'] = required(args.projectName, '--project-name')
+	if (args.corePackage !== undefined) values['corePackage'] = required(args.corePackage, '--core-package')
+	if (args.publicAccess !== undefined) values['publicAccess'] = required(args.publicAccess, '--public-access')
+	const database = postgres(args)
+	if (database !== undefined) {
+		values['postgres'] = database.profile === undefined ? { type: database.type } : { type: database.type, profile: database.profile }
+	}
+	return Object.keys(values).length === 0 ? undefined : values
+}
+
+const namespacePlan = async (
+	args: ZeropsCliArgs,
+	source: Readonly<Record<string, string | undefined>>,
+): Promise<ProviderNamespacePlan> => {
+	// `FABRIKA_ZEROPS_*` because Zerops reserves the bare `ZEROPS_` prefix and refuses to store a custom
+	// variable using it (`userDataZeropsPrefixForbidden`).
+	const serialized = required(source['FABRIKA_ZEROPS_PROXY_SOURCE_JSON'], 'FABRIKA_ZEROPS_PROXY_SOURCE_JSON')
+	let value: unknown
+	try {
+		value = JSON.parse(serialized)
+	} catch {
+		throw new Error('FABRIKA_ZEROPS_PROXY_SOURCE_JSON must contain valid JSON')
+	}
+	const proxySource = decodeZeropsNamespaceProxySource(value)
+	await verifyZeropsNamespaceProxySource(proxySource)
+	const operator = createZeropsNamespaceOperator({ proxySource })
+	const options = planOptions(args)
+	return operator.plan({
+		id: required(args.namespaceId, '--id'),
+		env: required(args.env, '--env'),
+		preset: required(args.preset, '--preset'),
+		...(args.exclusiveAppId === undefined ? {} : { exclusiveAppId: required(args.exclusiveAppId, '--exclusive-app') }),
+		...(options === undefined ? {} : { options }),
+	})
+}
+
+/** One namespace command. Every input is validated before `context.control()` is read. */
+const runZeropsNamespaceCommand = async (
+	subcommand: string,
+	argv: readonly string[],
+	context: NamespaceCommandContext,
+): Promise<NamespaceCommandResult> => {
+	const args = parseZeropsCliArgs(['namespace', subcommand, ...argv])
+	if (subcommand === 'plan') {
+		return { plan: await namespacePlan(args, context.source) }
+	}
+	if (subcommand === 'reconcile') {
+		const id = required(args.namespaceId, '--id')
+		return { namespace: await context.control().reconcile(id) }
+	}
+	if (subcommand !== 'create' && subcommand !== 'adopt') {
+		throw new Error(`Unknown namespace command: ${subcommand}`)
+	}
+
+	const planned = await namespacePlan(args, context.source)
+	const control = context.control()
+	if (subcommand === 'create') {
+		return { namespace: await control.create(planned.namespace) }
+	}
+
+	const projectId = required(args.projectId, '--project-id')
+	const decoded = zeropsNamespaceTargetCodec.decode(planned.namespace.target.payload)
+	const namespace: ProviderDeploymentNamespace = {
+		...planned.namespace,
+		target: {
+			provider: 'zerops',
+			version: zeropsNamespaceTargetCodec.version,
+			payload: zeropsNamespaceTargetCodec.encode({
+				...decoded,
+				// An adopted project keeps its own name, so the plan's default for a created one does not apply.
+				projectName: args.projectName ?? planned.namespace.id,
+				managed: false,
+				projectId,
+				ready: false,
+			}),
+		},
+	}
+	return { namespace: await control.adopt(namespace) }
+}
+
+export const zeropsNamespaceCli: NamespaceCli = { usage: NAMESPACE_USAGE, run: runZeropsNamespaceCommand }

package/src/plan.ts

@@ -1,5 +1,4 @@
 import { type FabrikaManifest, manifestServiceHostnames } from './manifest'
-import type { ZeropsRuntimeTarget } from './types'
 
 export type ZeropsStepKind =
 	| 'apply-import'
@@ -11,7 +10,6 @@ export type ZeropsStepKind =
 	| 'upload-source'
 	| 'trigger-build'
 	| 'await-version'
-	| 'reconcile-schema'
 
 export interface ZeropsStep {
 	readonly id: string
@@ -30,7 +28,7 @@ export const resolveDeployHostname = (manifest: FabrikaManifest): string => {
 }
 
 /** Build the provider-owned deploy order without touching the platform. */
-export const buildZeropsPlan = (manifest: FabrikaManifest, target: ZeropsRuntimeTarget): readonly ZeropsStep[] => {
+export const buildZeropsPlan = (manifest: FabrikaManifest): readonly ZeropsStep[] => {
 	const serviceHostnames = manifestServiceHostnames(manifest)
 	const steps: ZeropsStep[] = []
 
@@ -48,7 +46,7 @@ export const buildZeropsPlan = (manifest: FabrikaManifest, target: ZeropsRuntime
 	steps.push({
 		id: 'raise-start-memory',
 		kind: 'raise-start-memory',
-		description: "Raise the deploy service's minimum RAM to what its init commands need",
+		description: "Raise the deploy service's minimum RAM to what its init commands need, and pin a dev environment to one container",
 	})
 	steps.push({
 		id: 'size-database',
@@ -59,9 +57,6 @@ export const buildZeropsPlan = (manifest: FabrikaManifest, target: ZeropsRuntime
 	steps.push({ id: 'upload-source', kind: 'upload-source', description: 'Upload the resolved repository snapshot' })
 	steps.push({ id: 'trigger-build', kind: 'trigger-build', description: 'Trigger the Zerops build+deploy pipeline' })
 	steps.push({ id: 'await-version', kind: 'await-version', description: 'Await the Zerops pipeline and relay its build log' })
-	if (manifest.app.schema !== undefined && target.propustkaUrl !== undefined) {
-		steps.push({ id: 'reconcile-schema', kind: 'reconcile-schema', description: 'Reconcile authz schema into IAM' })
-	}
 
 	return steps
 }

package/src/provider.ts

@@ -1,14 +1,14 @@
 // The Zerops provider owns its plan and every effect needed to execute it.
 //
 // A Zerops deploy is HTTP and nothing else (ADR-0003) — no container, no shell, no filesystem — so this
-// driver's whole side-effect surface is one REST client plus the portable schema reconciler
-// (`./collaborators.ts`). It never spawns a process and has no `runCommand` to be handed.
+// driver's whole side-effect surface is one REST client (`./collaborators.ts`). It never spawns a process and has
+// no `runCommand` to be handed.
 //
 // The interesting step is `await-version`: fabrika does not RUN the build, it WATCHES one the platform
 // runs. Recovery never resumes a deploy (ADR-0044): a version reserved but never triggered is deleted, and
 // one whose build may have been requested is settled only by polling it.
 
-import { appEnvironmentId, FABRIKA_SOURCE_MAP_UPLOAD_KEY } from '@fabrika/auth-core'
+import { FABRIKA_SOURCE_MAP_UPLOAD_KEY, managedValue, staleManagedVariables } from '@fabrika/auth-core'
 import { type OperationsSourceMapUploadState, readSourceMapUploadReport } from '@fabrika/operations-contract/releases'
 import {
 	type DeployStepResult,
@@ -50,6 +50,7 @@ import {
 import {
 	PLATFORM_TYPESCRIPT_VERSION,
 	renderLockedExecutionDescriptor,
+	type ZeropsDevExecution,
 	zeropsJobProcesses,
 	type ZeropsLockedExecution,
 	zeropsStartMinRam,
@@ -65,20 +66,9 @@ import {
 	type StorageProvenanceMarker,
 	unprovenBucketReason,
 } from './exposure'
-import {
-	assertAuthoredManagedDocument,
-	assertAuthoredManagedInputs,
-	isFrameworkFamilyVariable,
-	isSensitiveFamilyVariable,
-	type ManagedValues,
-	overlayRelease,
-	parseManagedEnvironment,
-	SENSITIVE_MANAGED_KEYS,
-	SERVICE_MANAGED_KEYS,
-} from './managed-env'
+import { assertAuthoredManagedDocument, assertAuthoredManagedInputs, overlayRelease } from './managed-env'
 import {
 	applicationDatabaseOf,
-	approvedSchemaOf,
 	type FabrikaImportDocument,
 	type FabrikaManifest,
 	lockedExecutionFor,
@@ -96,8 +86,6 @@ export const CANCELLED = 'deploy cancelled'
 export interface ZeropsDeployRun {
 	readonly appId: string
 	readonly env: string
-	/** Every origin IAM may hand this app a session at; app-wide, because IAM's registry is keyed by app id. */
-	readonly returnOrigins?: readonly string[]
 	readonly secrets: Readonly<Record<string, string>>
 	readonly vars: Readonly<Record<string, string>>
 	/** Platform-owned runtime configuration, separate from operator-managed application vars. */
@@ -108,6 +96,8 @@ export interface ZeropsDeployRun {
 	readonly access?: ProviderApprovedAccess
 	/** The run-scoped source-map destination Control minted; the build uploads to it. */
 	readonly artifactUpload?: ProviderDeployInput['artifactUpload']
+	/** Present for an environment of kind `dev`: the launcher starts instead of the serving entry, on one container. */
+	readonly dev?: ZeropsDevExecution
 	readonly dryRun: boolean
 	readonly signal: AbortSignal
 	readonly events: ProviderRunEvents
@@ -332,9 +322,8 @@ interface StepEnv {
 	signal: AbortSignal
 	dryRun: boolean
 	attempt: Attempt
-	managedValues: ManagedValues
-	/** The key of each job and webhook of the approved contract, by its variable (ADR-0022 "Principal kinds"). */
-	familyVariables: Readonly<Record<string, string>>
+	/** What Control handed (`parseManagedEnvironment`). */
+	managed: ProviderManagedEnvironment
 	/** `await-version` gives up at this instant. */
 	deadlineMs: number
 }
@@ -577,9 +566,9 @@ const verifyExposure = async (env: StepEnv): Promise<void> => {
 		}
 	}
 	if (findings.length > 0) {
-		const dsn = env.managedValues.FABRIKA_OPERATIONS_DSN
+		const dsn = managedValue(env.managed, 'FABRIKA_OPERATIONS_DSN')
 		if (dsn !== null) {
-			const alert = { appId: run.appId, env: run.env, release: env.managedValues.FABRIKA_RELEASE, findings }
+			const alert = { appId: run.appId, env: run.env, release: managedValue(env.managed, 'FABRIKA_RELEASE'), findings }
 			await zerops.alertExposure({ dsn, alert, signal }).then(
 				() => log('  raised an Operations alert'),
 				() => log('  [warn] the Operations alert could not be sent'),
@@ -595,86 +584,101 @@ const verifyExposure = async (env: StepEnv): Promise<void> => {
 	)
 }
 
-/** Write the eleven service-level managed keys; `FABRIKA_RELEASE` is never a service variable (ADR-0044). */
+/** Write the managed variables Control handed; `FABRIKA_RELEASE` is never a service variable (ADR-0044). */
 const writeServiceEnv = async (env: StepEnv): Promise<void> => {
-	const { zerops, log, signal, managedValues, familyVariables } = env
+	const { zerops, log, signal, managed } = env
 	const serviceId = env.run.target.serviceId
+	const written = Object.entries(managed).flatMap(([key, { value, credential }]) =>
+		key === 'FABRIKA_RELEASE' || value === null ? [] : [{ key, value, credential }]
+	)
+	const writtenKeys = new Set(written.map(({ key }) => key))
 	if (env.dryRun) {
 		const upload = env.run.artifactUpload !== undefined
-		const written = [
-			...SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] !== null),
-			...Object.keys(familyVariables),
-			...(upload ? [FABRIKA_SOURCE_MAP_UPLOAD_KEY] : []),
-		]
-		const removed = [...SERVICE_MANAGED_KEYS.filter((key) => managedValues[key] === null), ...(upload ? [] : [FABRIKA_SOURCE_MAP_UPLOAD_KEY])]
-		log(`  [dry-run] would write service variables on ${serviceId}: ${written.join(', ') || '(none)'}`)
-		log(`  [dry-run] would remove service variables on ${serviceId} if present: ${removed.join(', ') || '(none)'}`)
-		if (Object.keys(familyVariables).length > 0) {
-			log(`  [dry-run] would remove every other job, webhook, connector and mail variable on ${serviceId}`)
-		}
+		const removed = Object.keys(managed).filter((key) => key !== 'FABRIKA_RELEASE' && !writtenKeys.has(key))
+		log(
+			`  [dry-run] would write service variables on ${serviceId}: ${
+				[...writtenKeys, ...(upload ? [FABRIKA_SOURCE_MAP_UPLOAD_KEY] : [])].join(', ') || '(none)'
+			}`,
+		)
+		log(
+			`  [dry-run] would remove service variables on ${serviceId} if present: ${
+				[...removed, ...(upload ? [] : [FABRIKA_SOURCE_MAP_UPLOAD_KEY])].join(', ') || '(none)'
+			}`,
+		)
+		log(`  [dry-run] would remove every other job, webhook, connector, mail and platform variable on ${serviceId}`)
 		return
 	}
 	assertRunning(signal)
 	// One read: every write below waits for its own user-data sync, so the build request never meets `userDataSyncRunning`.
 	const records = await zerops.api.listServiceEnv({ serviceId, signal })
-	for (const key of SERVICE_MANAGED_KEYS) {
-		const value = managedValues[key]
-		const existing = records.find((record) => record.key === key)
-		const sensitive = SENSITIVE_MANAGED_KEYS.has(key)
-		assertRunning(signal)
-		if (value !== null && (sensitive || readableContent(existing) !== value)) {
-			await zerops.api.putServiceEnv({ serviceId, key, value, sensitive, signal })
-			log(`  ${key}: updated`)
-		} else if (value === null && existing !== undefined) {
-			await zerops.api.deleteServiceEnv({ envId: existing.id, signal })
-			log(`  ${key}: removed`)
-		} else {
-			log(`  ${key}: unchanged`)
-		}
+	const changes: ServiceEnvChange[] = []
+	const put = (key: string, value: string, sensitive: boolean): void => {
+		changes.push({ line: `${key}: updated`, apply: () => zerops.api.putServiceEnv({ serviceId, key, value, sensitive, signal }) })
 	}
-	const provenance = env.attempt.storageProvenance
-	const marker = records.find((record) => record.key === STORAGE_PROVENANCE_KEY)
-	if (typeof provenance === 'string' && readableContent(marker) !== provenance) {
-		assertRunning(signal)
-		// Not a credential, and the exposure read-back above reads it: it must stay readable.
-		await zerops.api.putServiceEnv({ serviceId, key: STORAGE_PROVENANCE_KEY, value: provenance, sensitive: false, signal })
-		log(`  ${STORAGE_PROVENANCE_KEY}: updated`)
-	} else if (provenance === null && marker !== undefined) {
-		assertRunning(signal)
-		await zerops.api.deleteServiceEnv({ envId: marker.id, signal })
-		log(`  ${STORAGE_PROVENANCE_KEY}: removed`)
+	const remove = (key: string, envId: string): void => {
+		changes.push({ line: `${key}: removed`, apply: () => zerops.api.deleteServiceEnv({ envId, signal }) })
 	}
-	// A workload key is written like a managed key; one whose workload is gone is removed, so no stale key stays readable.
-	for (const [key, value] of Object.entries(familyVariables)) {
+	// A credential is written sensitive and never read back, so it is written every time.
+	for (const { key, value, credential } of written) {
 		const existing = records.find((record) => record.key === key)
-		const sensitive = isSensitiveFamilyVariable(key)
-		assertRunning(signal)
-		if (sensitive || readableContent(existing) !== value) {
-			await zerops.api.putServiceEnv({ serviceId, key, value, sensitive, signal })
-			log(`  ${key}: updated`)
-		} else {
-			log(`  ${key}: unchanged`)
-		}
+		if (credential || readableContent(existing) !== value) put(key, value, credential)
+		else changes.push({ line: `${key}: unchanged`, apply: null })
 	}
+	// A variable Control no longer hands is removed, so no stale key stays readable. `/env` also reports the descriptor's
+	// `FABRIKA_RELEASE`, which Zerops refuses to delete.
+	const stale = new Set(staleManagedVariables(records.map((record) => record.key), new Set([...writtenKeys, 'FABRIKA_RELEASE'])))
 	for (const record of records) {
-		if (isFrameworkFamilyVariable(record.key) && !Object.hasOwn(familyVariables, record.key)) {
-			assertRunning(signal)
-			await zerops.api.deleteServiceEnv({ envId: record.id, signal })
-			log(`  ${record.key}: removed`)
-		}
+		if (stale.has(record.key)) remove(record.key, record.id)
 	}
+	const provenance = env.attempt.storageProvenance
+	const marker = records.find((record) => record.key === STORAGE_PROVENANCE_KEY)
+	// Not a credential, and the exposure read-back above reads it: it must stay readable.
+	if (typeof provenance === 'string' && readableContent(marker) !== provenance) put(STORAGE_PROVENANCE_KEY, provenance, false)
+	else if (provenance === null && marker !== undefined) remove(STORAGE_PROVENANCE_KEY, marker.id)
 	// The build lifts the upload's bearer from here (`${RUNTIME_…}`), so the descriptor never holds it.
 	const bearer = env.run.artifactUpload?.bearer ?? null
 	const uploadKey = records.find((record) => record.key === FABRIKA_SOURCE_MAP_UPLOAD_KEY)
-	if (bearer !== null) {
-		assertRunning(signal)
-		await zerops.api.putServiceEnv({ serviceId, key: FABRIKA_SOURCE_MAP_UPLOAD_KEY, value: bearer, sensitive: true, signal })
-		log(`  ${FABRIKA_SOURCE_MAP_UPLOAD_KEY}: updated`)
-	} else if (uploadKey !== undefined) {
-		assertRunning(signal)
-		await zerops.api.deleteServiceEnv({ envId: uploadKey.id, signal })
-		log(`  ${FABRIKA_SOURCE_MAP_UPLOAD_KEY}: removed`)
+	if (bearer !== null) put(FABRIKA_SOURCE_MAP_UPLOAD_KEY, bearer, true)
+	else if (uploadKey !== undefined) remove(FABRIKA_SOURCE_MAP_UPLOAD_KEY, uploadKey.id)
+	await applyServiceEnvChanges(changes, log, signal)
+}
+
+/** One service variable write or removal `write-service-env` decided on, or a key it leaves as it is (`apply: null`). */
+interface ServiceEnvChange {
+	readonly line: string
+	readonly apply: (() => Promise<void>) | null
+}
+
+/** Each write waits ~3 s for its own user-data sync; concurrent writes to one service do not conflict (zerops-platform.md). */
+const SERVICE_ENV_WRITE_CONCURRENCY = 6
+
+/**
+ * Applies the changes `SERVICE_ENV_WRITE_CONCURRENCY` at a time and waits for every started one, so no sync still runs
+ * when the step ends. A failure or a cancel starts no further write; lines follow the decision order.
+ */
+const applyServiceEnvChanges = async (changes: readonly ServiceEnvChange[], log: (line: string) => void, signal: AbortSignal): Promise<void> => {
+	const applied = new Set<number>()
+	const failures: unknown[] = []
+	let next = 0
+	const worker = async (): Promise<void> => {
+		while (next < changes.length && failures.length === 0 && !signal.aborted) {
+			const index = next++
+			const apply = changes[index]?.apply ?? null
+			if (apply === null) continue
+			try {
+				await apply()
+				applied.add(index)
+			} catch (error) {
+				failures.push(error)
+			}
+		}
 	}
+	await Promise.all(Array.from({ length: SERVICE_ENV_WRITE_CONCURRENCY }, worker))
+	for (const [index, change] of changes.entries()) {
+		if (change.apply === null || applied.has(index)) log(`  ${change.line}`)
+	}
+	if (failures.length > 0) throw failures[0]
+	assertRunning(signal)
 }
 
 /** The custom autoscaling with its minimum RAM raised to `minRam`; every other field is sent back as it was read. */
@@ -690,6 +694,7 @@ const withMinRam = (custom: ZeropsServiceAutoscaling, minRam: number): ZeropsSer
  */
 const raiseStartMemory = async (env: StepEnv): Promise<void> => {
 	const { run, zerops, log, signal, dryRun } = env
+	if (run.dev !== undefined) await pinOneContainer(env)
 	const locked = lockedExecutionFor(run.artifact, run, dryRun)
 	const minRam = locked === null ? null : zeropsStartMinRam(locked)
 	const hostname = run.artifact.target.deployService
@@ -712,6 +717,42 @@ const raiseStartMemory = async (env: StepEnv): Promise<void> => {
 	log(`  minimum RAM of ${hostname}: ${before ?? 'the platform default'} → ${after} GB`)
 }
 
+/**
+ * A dev environment runs on exactly one container: the launcher writes the files it syncs into that container, and a
+ * second one would serve the bootstrap head. Sends the custom autoscaling whole with only the container counts changed,
+ * and decides by reading it back.
+ */
+const pinOneContainer = async (env: StepEnv): Promise<void> => {
+	const { run, zerops, log, signal, dryRun } = env
+	const hostname = run.artifact.target.deployService
+	if (dryRun) {
+		log(`  [dry-run] would pin ${hostname} to one container`)
+		return
+	}
+	assertRunning(signal)
+	const service = await zerops.api.getService({ serviceId: run.target.serviceId, signal })
+	const custom = service.customAutoscaling
+	const horizontal = service.currentAutoscaling?.horizontal
+	if (horizontal?.minContainerCount === 1 && horizontal.maxContainerCount === 1) {
+		log(`  ${hostname} runs on one container, unchanged`)
+		return
+	}
+	if (custom === undefined) throw new Error(`zerops: ${hostname} did not report its autoscaling whole, so it cannot be pinned to one container`)
+	const process = await zerops.api.configureCustomAutoscaling({
+		serviceId: service.id,
+		autoscaling: { ...custom, horizontal: { minContainerCount: 1, maxContainerCount: 1 } },
+		signal,
+	})
+	if (process !== null) {
+		await waitForProcess({ api: zerops.api, processId: process.id, sleep: zerops.sleep, signal, label: `the autoscaling change of ${hostname}` })
+	}
+	const after = (await zerops.api.getService({ serviceId: service.id, signal })).currentAutoscaling?.horizontal
+	if (after?.minContainerCount !== 1 || after.maxContainerCount !== 1) {
+		throw new Error(`zerops: ${hostname} reads back ${after?.maxContainerCount ?? 'no'} container(s) after it was pinned to one`)
+	}
+	log(`  ${hostname} pinned to one container`)
+}
+
 /** What raising a minimum RAM calls; the deploy's collaborators, and the live platform-facts probe of the same path. */
 export interface MinRamRaise {
 	zerops: Pick<ZeropsCollaborators, 'api' | 'sleep'>
@@ -777,7 +818,7 @@ const sizeDatabase = async (env: StepEnv): Promise<void> => {
 	const deploy = await zerops.api.getService({ serviceId: run.target.serviceId, signal })
 	const demand: ZeropsDatabaseDemand = {
 		maxContainers: deploy.currentAutoscaling?.horizontal.maxContainerCount ?? ZEROPS_MAX_CONTAINERS,
-		jobs: zeropsJobProcesses(locked.contract),
+		jobs: zeropsJobProcesses(locked),
 	}
 	const service = await zerops.api.findService({ projectId: run.target.projectId, hostname: database.hostname, signal })
 	if (service === null) throw new Error(`zerops: the database ${database.hostname} does not exist, so its connections cannot be sized`)
@@ -939,7 +980,7 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 			const appVersionId = requireVersion(env, 'trigger-build')
 			await verifyZeropsArtifactSourceDescriptor(artifact.target.sourceDescriptor)
 			const { contents } = artifact.target.sourceDescriptor
-			const release = env.managedValues.FABRIKA_RELEASE
+			const release = managedValue(env.managed, 'FABRIKA_RELEASE')
 			const descriptor = locked === null
 				? overlayRelease(contents, artifact.target.zeropsSetup, release)
 				: renderLockedExecutionDescriptor(contents, artifact.target.zeropsSetup, release, sizedExecution(locked, attempt))
@@ -989,35 +1030,6 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 			await awaitVersion(env, appVersionId, attempt.processId, locked !== null && locked.databaseUrl !== null)
 			return
 		}
-
-		case 'reconcile-schema': {
-			const schema = approvedSchemaOf(run)
-			const propustkaUrl = target.propustkaUrl
-			if (schema === undefined || propustkaUrl === undefined) {
-				return
-			}
-			// Return origins ride this step because `apps.setReturnOrigins` 404s for an app IAM has never
-			// heard of, and the schema reconcile is what registers it. Separate call, same moment.
-			const returnOrigins = run.returnOrigins !== undefined && run.returnOrigins.length > 0 ? run.returnOrigins : undefined
-			const iamApp = appEnvironmentId(artifact.app.id, artifact.app.env)
-			if (dryRun) {
-				log(`  [dry-run] would reconcile schema for \`${iamApp}\` against ${propustkaUrl}`)
-				if (returnOrigins !== undefined) {
-					log(`  [dry-run] would register return origins for \`${iamApp}\`: ${returnOrigins.join(', ')}`)
-				}
-				return
-			}
-			assertRunning(signal)
-			await zerops.reconcileSchema({
-				url: propustkaUrl,
-				app: iamApp,
-				schema,
-				...(returnOrigins === undefined ? {} : { returnOrigins }),
-				adminKey: target.adminKey,
-				signal,
-			})
-			return
-		}
 	}
 }
 
@@ -1039,15 +1051,6 @@ async (run: ZeropsDeployRun): Promise<ZeropsDeployResult> => {
 		throw new Error(`zerops: artifact environment drift: expected \`${run.env}\`, got \`${run.artifact.app.env}\``)
 	}
 	assertAuthoredManagedInputs({ variableNames: Object.keys(run.vars), secretNames: Object.keys(run.secrets) })
-	// The proxy serves an endpoint table exactly when Control approved a contract, whatever the artifact says.
-	const contractProxy = run.access !== undefined
-	const { values: handed, familyVariables } = parseManagedEnvironment(run.managedEnvironment)
-	// Only a contract application checks the secret; any other would merely hold a credential its own code can print.
-	const managedValues: ManagedValues = contractProxy ? handed : { ...handed, FABRIKA_PROXY_SECRET: null }
-	if (!run.dryRun && contractProxy && managedValues.FABRIKA_PROXY_SECRET === null) {
-		// The application would refuse every request its proxy sends (ADR-0022 rule 5).
-		throw new Error('zerops: a contract application needs its proxy secret, and Control supplied none')
-	}
 	const hostnames = manifestServiceHostnames(run.artifact)
 	const document = interpolateManifest(run.artifact.target.importDocument, run.artifact.app.pipeline.vars, run.vars, hostnames)
 	const compiled = { yaml: renderYaml(document), hostnames }
@@ -1061,11 +1064,10 @@ async (run: ZeropsDeployRun): Promise<ZeropsDeployResult> => {
 		signal: run.signal,
 		dryRun: run.dryRun,
 		attempt: { triggered: false },
-		managedValues,
-		familyVariables,
+		managed: run.managedEnvironment,
 		deadlineMs: Date.now() + ZEROPS_VERSION_DEADLINE_MS,
 	}
-	const steps = buildZeropsPlan(run.artifact, run.target)
+	const steps = buildZeropsPlan(run.artifact)
 	const options = { appId: run.appId, env: run.env, dryRun: run.dryRun, signal: run.signal, log: run.events.log }
 	const result = await runSteps(steps, options, (step) => runStep(step, env))
 	const { appVersionId, triggered } = env.attempt

package/src/proxy-manifest-carrier.ts

@@ -30,3 +30,21 @@ export const zeropsProxyManifestCarrier = (descriptorContents: string, setup = '
 	}
 	return 'archive'
 }
+
+/** The build variable that marks a proxy source whose manifest parser knows `brand` (ADR-0066). */
+export const FABRIKA_PROXY_MANIFEST_BRAND = 'FABRIKA_PROXY_MANIFEST_BRAND'
+
+/**
+ * Whether a pinned descriptor's proxy reads a manifest that carries the installation's client logo. An older parser
+ * refuses the unknown key and fails the build, so a namespace kept on such a pin gets no logo and keeps the fabrika
+ * mark until it is re-pinned (`--proxy-source=current`). Decided by the build section Zerops applies, as the carrier is.
+ */
+export const zeropsProxyAcceptsBrand = (descriptorContents: string, setup = 'proxy'): boolean => {
+	const parsed = parseZeropsDescriptor(descriptorContents)
+	for (const entry of appliedZeropsSetups(parsed, selectZeropsDescriptorSetup(parsed, setup))) {
+		const read = buildSectionSchema.safeParse(entry)
+		if (!read.success) continue
+		return read.data.build.envVariables?.[FABRIKA_PROXY_MANIFEST_BRAND] === '1'
+	}
+	return false
+}

package/src/types.ts

@@ -150,6 +150,4 @@ export interface ZeropsRuntimeTarget {
 	/** Absent only for dry runs, which perform no source or Zerops mutation. */
 	source?: ZeropsRuntimeSource
 	apiBaseUrl?: string
-	propustkaUrl?: string
-	adminKey?: string
 }

package/types/src/api/client.d.ts

@@ -0,0 +1,5 @@
+import type { ZeropsApi, ZeropsApiOptions } from './types';
+/** Base URL of the Zerops public REST API. */
+export declare const ZEROPS_API_BASE = "https://api.app-prg1.zerops.io/api/rest/public";
+/** Build the real client. Every request carries the bearer and the run's signal. */
+export declare const createZeropsApi: (options: ZeropsApiOptions) => ZeropsApi;

package/types/src/api/errors.d.ts

@@ -0,0 +1,24 @@
+export declare const isAppVersionNotFoundResponse: (value: unknown) => boolean;
+/**
+ * A non-2xx answer from the Zerops API. `code` is the platform's own error identifier, so a caller can
+ * branch on `userDataDuplicateKey` rather than matching a prose message.
+ */
+export declare class ZeropsApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(message: string, status: number, code: string);
+}
+/**
+ * The platform's code for "this service publishes no HTTP port", the answer `enableSubdomainAccess` gives
+ * before a service's first deploy. Exported so a caller can say what is missing instead of relaying prose.
+ */
+export declare const ZEROPS_SERVICE_NOT_HTTP = "serviceStackIsNotHttp";
+/**
+ * Turn a non-2xx response into a `ZeropsApiError`. Zerops answers with `{ error: { code, message, meta } }`
+ * (the envelope observed live; the OpenAPI `Error` schema shows the inner `{ code, message }`).
+ *
+ * `redactDetail` drops the server's MESSAGE, which a validation error can fill with the value it
+ * rejected. The CODE is a fixed identifier and is kept either way — without it nothing downstream can
+ * tell a duplicate key from a missing service.
+ */
+export declare const apiError: (label: string, status: number, body: unknown, redactDetail: boolean) => ZeropsApiError;