v0.8.2

A patch release: three new email providers, broadcast mail, hourly backups of the Zerops platform database, and a set of security fixes in IAM and the proxy. No migration, no framework break: applications on 0.4–0.8 keep deploying unchanged.

Upgrade steps for operators

• Zerops: re-pin every namespace after the upgrade. A namespace proxy is pinned to a fixed commit, so after any platform upgrade it is judged by the 0.4–0.6 parsers until it is re-pinned. Until then a deploy with a form newer than 0.6 is refused, and a proxy built before this release keeps forwarding a caller's px_ key to the application (see Security). Run fabrika control namespaces update --namespace=<id> --proxy-source=current for each one.
• Cloudflare: a proxy Worker takes the new code when its environment deploys again. Nothing else to do.
• Zerops: hourly backup of db. platform upgrade sets the platform database's backup to hourly, but only on a project that has a separate operationsdb and still runs the daily default. A light installation from before this release keeps Operations in db and keeps its schedule, with a warning. The step reads the Zerops API from its OpenAPI and is not yet measured on a live account, so a refusal is a warning naming the manual step, never a failed deploy.
• Cloudflare: a new email provider needs a re-run of platform init. Only init rewrites the sidecar workflow; an existing workflow keeps passing the Resend and SmartEmailing variables and keeps working.
• During the upgrade window IAM deploys before the platform proxy. For those minutes IAM attributes login attempts to one shared bucket and generates request ids. It refuses nothing.

New

• Postmark, AhaSend and Lettermint join Resend and SmartEmailing as built-in email providers (FABRIKA_EMAIL_PROVIDER=postmark|ahasend|lettermint). An application that sends through its own transport needs @fabrika/* 0.8.2 for them, and Control refuses a deploy that would hand an older application a provider it lacks, before any effect. The adapters are built from each provider's documentation and tested against a stubbed API; Postmark and Resend broadcast mail was checked on live accounts.
• Broadcast mail. ctx.mail.send({ broadcast: true, unsubscribe }) marks a message sent to many recipients, so the provider keeps it apart from transactional mail (Postmark pauses a server whose transactional stream carries it). Postmark sends it through the server's broadcast stream, Lettermint through the project's broadcast route, Resend with the tag category: broadcast, and AhaSend from a Marketing domain named in FABRIKA_EMAIL_AHASEND_BROADCAST_FROM. A transport that cannot send it refuses it. Postmark's broadcast stream manages unsubscribes itself: an unsubscribe reaches Postmark's suppression list, not the application.
• Zerops light tier: Operations gets its own database (operationsdb, about $1.45 a month) on new installations, so the identity and deploy database can be backed up hourly without copying error history.
• fabrika control namespaces plan|create accepts --postgres-type together with --postgres-profile, and the installation guide prices three presets.
• Console: clearer environment overview and editing; access assignment starts with the application and its roles, with permissions, scopes and expiry under advanced options.

Security

• The proxy no longer forwards a caller's px_ key to an application. On a credentialed row it replaces Authorization with the minted token, so an application that receives a request can no longer reuse the caller's key to act as the caller at another application. Zerops namespaces need the re-pin above.
• A narrowed px_ key can no longer administer IAM or approve a device authorization. Both now require a signed-in session.
• A user administrator without an email sender no longer receives a manual enrollment or reset URL. Only iam.admin does.
• IAM's own mail (enrollment, reset, invitation links) is withheld in the console from every caller while it is queued or sending.
• OIDC login is protected against cookie tossing from a sibling host: the flight cookie is now __Host-fabrika_oidc.
• A returning user is no longer locked out by someone else's failed logins. A successful login sets a signed known-device cookie that spends its own rate-limit bucket.
• IAM on Zerops trusts the client address and request id only from the platform proxy, which now proves itself with a derived secret.
• Operations bounds source-map work per event, so one crafted event can no longer block the event detail view.

Fixes

• An older queued or late-approved run no longer deploys over a newer successful one; it fails with superseded by run <id>. To deploy an older commit, start a new run.
• A push of an annotated tag (this repository's own release tags) deploys again; it failed source resolution on both providers.
• The GitHub webhook answers 204 to every event other than push and to a ref deletion. A custom sender must send X-GitHub-Event: push.
• Password login works on a Cloudflare IAM: the Worker hashes within Cloudflare's PBKDF2 limit of 100,000 iterations.
• A namespace pinned to an older proxy is no longer handed rows only 0.7 reads, which made its proxy refuse the whole manifest.
• A Zerops deployment namespace refuses the installation's own project; adopting it rebuilt the platform proxy and logged everyone out.
• --postgres-type without --postgres-profile is refused: on HA it picked the dedicated profile at about $72 instead of $11.
• The UI kit's challenge widget follows the kit's theme and no longer shows the ALTCHA logo and footer. ChallengeStrings.ariaLinkLabel is optional and deprecated.

Full changelog: v0.8.1...v0.8.2