v0.8.2

A patch release: three new email providers, broadcast mail, hourly backups of the Zerops platform database, and a set of security fixes in IAM and the proxy. No migration, no framework break: applications on 0.4–0.8 keep deploying unchanged.

Upgrade steps for operators

• Zerops: re-pin every namespace after the upgrade. A namespace proxy is pinned to a fixed commit, so after any platform upgrade it is judged by the 0.4–0.6 parsers until it is re-pinned. Until then a deploy with a form newer than 0.6 is refused, and a proxy built before this release keeps forwarding a caller's px_ key to the application (see Security). Run fabrika control namespaces update --namespace=<id> --proxy-source=current for each one.
• Cloudflare: a proxy Worker takes the new code when its environment deploys again. Nothing else to do.
• Zerops: hourly backup of db. platform upgrade sets the platform database's backup to hourly, but only on a project that has a separate operationsdb and still runs the daily default. A light installation from before this release keeps Operations in db and keeps its schedule, with a warning. The step reads the Zerops API from its OpenAPI and is not yet measured on a live account, so a refusal is a warning naming the manual step, never a failed deploy.
• Cloudflare: a new email provider needs a re-run of platform init. Only init rewrites the sidecar workflow; an existing workflow keeps passing the Resend and SmartEmailing variables and keeps working.
• During the upgrade window IAM deploys before the platform proxy. For those minutes IAM attributes login attempts to one shared bucket and generates request ids. It refuses nothing.

New

• Postmark, AhaSend and Lettermint join Resend and SmartEmailing as built-in email providers (FABRIKA_EMAIL_PROVIDER=postmark|ahasend|lettermint). An application that sends through its own transport needs @fabrika/* 0.8.2 for them, and Control refuses a deploy that would hand an older application a provider it lacks, before any effect. The adapters are built from each provider's documentation and tested against a stubbed API; Postmark and Resend broadcast mail was checked on live accounts.
• Broadcast mail. ctx.mail.send({ broadcast: true, unsubscribe }) marks a message sent to many recipients, so the provider keeps it apart from transactional mail (Postmark pauses a server whose transactional stream carries it). Postmark sends it through the server's broadcast stream, Lettermint through the project's broadcast route, Resend with the tag category: broadcast, and AhaSend from a Marketing domain named in FABRIKA_EMAIL_AHASEND_BROADCAST_FROM. A transport that cannot send it refuses it. Postmark's broadcast stream manages unsubscribes itself: an unsubscribe reaches Postmark's suppression list, not the application.
• Zerops light tier: Operations gets its own database (operationsdb, about $1.45 a month) on new installations, so the identity and deploy database can be backed up hourly without copying error history.
• fabrika control namespaces plan|create accepts --postgres-type together with --postgres-profile, and the installation guide prices three presets.
• Console: clearer environment overview and editing; access assignment starts with the application and its roles, with permissions, scopes and expiry under advanced options.

Security

• The proxy no longer forwards a caller's px_ key to an application. On a credentialed row it replaces Authorization with the minted token, so an application that receives a request can no longer reuse the caller's key to act as the caller at another application. Zerops namespaces need the re-pin above.
• A narrowed px_ key can no longer administer IAM or approve a device authorization. Both now require a signed-in session.
• A user administrator without an email sender no longer receives a manual enrollment or reset URL. Only iam.admin does.
• IAM's own mail (enrollment, reset, invitation links) is withheld in the console from every caller while it is queued or sending.
• OIDC login is protected against cookie tossing from a sibling host: the flight cookie is now __Host-fabrika_oidc.
• A returning user is no longer locked out by someone else's failed logins. A successful login sets a signed known-device cookie that spends its own rate-limit bucket.
• IAM on Zerops trusts the client address and request id only from the platform proxy, which now proves itself with a derived secret.
• Operations bounds source-map work per event, so one crafted event can no longer block the event detail view.

Fixes

• An older queued or late-approved run no longer deploys over a newer successful one; it fails with superseded by run <id>. To deploy an older commit, start a new run.
• A push of an annotated tag (this repository's own release tags) deploys again; it failed source resolution on both providers.
• The GitHub webhook answers 204 to every event other than push and to a ref deletion. A custom sender must send X-GitHub-Event: push.
• Password login works on a Cloudflare IAM: the Worker hashes within Cloudflare's PBKDF2 limit of 100,000 iterations.
• A namespace pinned to an older proxy is no longer handed rows only 0.7 reads, which made its proxy refuse the whole manifest.
• A Zerops deployment namespace refuses the installation's own project; adopting it rebuilt the platform proxy and logged everyone out.
• --postgres-type without --postgres-profile is refused: on HA it picked the dedicated profile at about $72 instead of $11.
• The UI kit's challenge widget follows the kit's theme and no longer shows the ALTCHA logo and footer. ChallengeStrings.ariaLinkLabel is optional and deprecated.

Full changelog: v0.8.1...v0.8.2

v0.8.1

A patch release for contract applications with a database on Zerops: the schema check and the isolation tests no longer run inside the readiness window.

Upgrade steps for operators

• None on the installation. fabrika platform upgrade and each application's next deploy move the checks; the application needs no package update.
• A version deployed before the upgrade keeps its old start script until its next deploy, so a restart of it still runs the checks inside the readiness window. Redeploy an application whose checks take long.

Fixes

• Zerops: fabrika db codegen --verify and fabrika db test-isolation run as init commands, after the migrations, from a generated fabrika/verify.generated.sh. They used to run in the start script, inside the 180 s readiness window an application cannot raise: an application with many generated cases (605 took almost three minutes on a small database) failed with DEPLOY_FAILED although every check passed. A failed init command still stops the activation, so a stale schema module or a failed generated case keeps the previous version serving. The start script no longer runs the migrations a second time.
• A DEPLOY_FAILED version says why it may have failed: an init command failed or the readiness check never answered, naming the migrations, the schema check and the isolation tests for a contract application with a database.
• Verified on a live Zerops account: the readiness window opens only after the init commands, and an init command may run at least 240 s.

Full changelog: v0.8.0...v0.8.1

v0.8.0

A minor release that adds ALTCHA as a second challenge provider for public procedures. It changes no 0.7 form: an application raises its pin and nothing else changes (0.7 → 0.8). Its framework window is 0.4, 0.5, 0.6, 0.7 and 0.8.

Upgrade steps for operators

• Upgrade the platform before any application raises its pin to 0.8. Control refuses an application whose framework release is newer than the platform.
• Zerops: a namespace whose proxy is pinned to an older source refuses the first deploy of an application with an ALTCHA challenge until the proxy is re-pinned: fabrika control namespaces update --namespace=<id> --proxy-source=current. Every other application deploys there as before.
• No generated file, environment variable or provider state changes on upgrade.

New

• ALTCHA challenge. challenge: { provider: 'altcha', secret: 'ALTCHA_HMAC_KEY' } on a public procedure is a proof of work the application issues and verifies itself: no request leaves the installation, and there is no third-party account or site key. Turnstile stays available.
  • The build adds an anonymous issuer row GET /__fabrika/challenge/<action> beside each such procedure, with rate-limit buckets of its own. The /__fabrika/challenge/ prefix is reserved.
  • ALTCHA_HMAC_KEY is an application variable the operator sets, at least 32 characters (openssl rand -base64 32). boot refuses a shorter one.
  • On the page: Challenge from @fabrika/ui/challenge at challengeUrl(api.<procedure>), with altcha added to the dependencies. The widget solves in workers, so the CSP gains worker-src 'self' blob:, which the approval shows like any other directive.
  • Tests: kit.solveChallenge(api.<procedure>); fabrika app dev issues the cheapest challenge and verifies it as production does.
  • The agent skill's public intake now uses ALTCHA.
• The platform reads 0.7 applications with the 0.7 reader. Their snapshot and contract digests are the ones 0.7.0's own Control recorded, so stored approvals stay valid.

Fixes

• A deploy whose access the pinned namespace proxy cannot parse is refused before it becomes the published snapshot, so a refused deploy cannot block later rebuilds of the namespace.
• An older namespace proxy is judged by its own CSP parser too, so a directive it does not know can no longer take every member's proxy down at the next republish.
• A deployment that shortens maxAgeMs keeps refusing replays of challenges its predecessor signed.
• A mount's compatibility promise covers its generated challenge routes, so renaming an action or removing an issuer is refused instead of breaking existing clients.

Full changelog: v0.7.0...v0.8.0