@varde-flyt/vfac 0.11.0 → 0.13.0

package/README.md

@@ -74,14 +74,21 @@ vfac manifest init --product <productId> --name "My resource" > resource.yaml
 
 ```sh
 vfac validate -f resource.yaml
-vfac plan     -f resource.yaml
+vfac plan     -f resource.yaml --secret SETTING=env:VARIABLE
 vfac apply    -f resource.yaml --secret SETTING=env:VARIABLE
 vfac get operation <operationId>
 vfac get product-instance <productInstanceId>
 ```
 
 Secrets are supplied per apply and never belong in the manifest — a manifest is a
-file you commit. `vfac plan` lists the ones an apply will still need.
+file you commit. **Plan the run that sets one with the same `--secret` inputs the
+apply will carry**: `plan` takes the flag exactly as `apply` does, and without it
+the plan describes a different request.
+
+`requiredSecrets` in a plan is what the Product requires for the configuration in
+your document — not a list of what the platform is missing. It names a credential
+whether or not this resource already holds one, so it is not a shopping list to
+act on. `secretsToWrite` is the field that says what this apply would write.
 
 ### `metadata.key` is the name you choose
 
@@ -176,7 +183,8 @@ spec:
 `vfac manifest init` names the exact property for every dependency you have to
 choose, and `vfac plan` prints the connections an apply would establish before
 you approve it. The dependency key comes from the Product, not from you —
-`vfac product show <productId>` lists them.
+`vfac product show <productId>` lists every dependency with its key, its
+capability, and whether a setting is what turns it on.
 
 This is not the same thing as the section above, and the difference is worth
 holding on to:
@@ -198,7 +206,8 @@ it.
 
 Every command takes `--output json`, and it is the same data rather than a
 prettier subset — the human format of `vfac product show` prints a readable
-selection on purpose, and the JSON carries the whole Product contract.
+selection on purpose and says so at the foot of its output, and the JSON carries
+the whole Product contract.
 
 ```sh
 vfac product show <productId> --output json
@@ -261,12 +270,15 @@ so this answers `UPDATE` and redeploys, even when the value is the value already
 stored:
 
 ```sh
+vfac plan  -f resource.yaml --secret SETTING=env:VARIABLE
 vfac apply -f resource.yaml --secret SETTING=env:VARIABLE
 ```
 
-Send secrets on the apply that creates the resource and on the run that rotates
-one, and on no other run. A pipeline that passes its secrets every run restarts
-your service every time somebody pushes a README.
+Three runs carry a secret: the apply that creates the resource, the first time a
+setting needs a credential on a resource that already exists, and a rotation. Send
+none on any other run — a pipeline that passes its secrets every run restarts your
+service every time somebody pushes a README. Plan each of those three with the
+same `--secret` inputs: with no secret to write, a rotation plans as `NO_CHANGE`.
 
 ## Where the Gate Secret goes
 

package/dist/vfac.mjs

@@ -7928,12 +7928,33 @@ function renderOperation(operationId, data) {
         );
       }
     }
+    const product = failure["product"];
+    const reportedSettings = [];
+    if (Array.isArray(product)) {
+      for (const entry of product) {
+        const one = asRecord(entry);
+        if (one === null) continue;
+        const component = one["component"];
+        const code = one["code"];
+        if (typeof component !== "string" || typeof code !== "string") continue;
+        if (component === "" || code === "") continue;
+        const setting = one["setting"];
+        if (typeof setting === "string" && setting !== "") {
+          reportedSettings.push(setting);
+          lines.push(`    ${component} refused to start: ${code} (setting: ${setting})`);
+        } else {
+          lines.push(`    ${component} refused to start: ${code}`);
+        }
+      }
+    }
     const retryable = failure["retryable"];
     if (typeof retryable === "boolean") {
       const again = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "`vfac lifecycle upgrade <pri_\u2026>`" : "`vfac lifecycle reconcile <pri_\u2026>`";
       const changeIt = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "" : ", or `vfac apply` a corrected manifest";
+      const cause2 = failure["cause"];
+      const named = reportedSettings[0];
       lines.push(
-        retryable ? `    Another attempt can succeed: ${again}.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
+        retryable ? `    Another attempt can succeed: ${again}.` : named !== void 0 ? `    Correct \`${named}\` in your manifest, then \`vfac apply\` it${data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? ` and ${again}` : ""}. Repeating it unchanged fails the same way.` : cause2 === "unknown" ? `    The platform could not classify this, so there is nothing here to correct. Read the whole record with \`vfac get operation ${operationId} --output json\`, and quote that id if you ask for help. Repeating it unchanged fails the same way.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
       );
     }
   }
@@ -12244,6 +12265,29 @@ var ValueConditionSchema = external_exports.object({
   anyOf: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20),
   anyRow: external_exports.boolean().optional()
 }).strict();
+var ValueReferenceSchema = external_exports.object({
+  /**
+   * The setting whose VALUES form the allowed set — a canonical declaration
+   * path, or a bare root key, which is the same string at depth 1.
+   */
+  path: external_exports.string().min(1).max(400)
+}).strict();
+var RowCardinalitySchema = external_exports.object({
+  /** A setting declared DIRECTLY on the row. */
+  property: PropertyNameSchema,
+  /** The answers that count toward the limit. Non-empty. */
+  anyOf: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20),
+  /**
+   * How many rows may answer that way. Zero is meaningful and allowed — "no
+   * row may, under this release" is a thing an upgrade needs to be able to
+   * say.
+   */
+  max: external_exports.number().int().min(0).max(99)
+}).strict();
+var RowRulesSchema = external_exports.object({
+  unique: external_exports.array(PropertyNameSchema).min(1).max(MAX_CONFIGURATION_CHILDREN).optional(),
+  atMost: external_exports.array(RowCardinalitySchema).min(1).max(10).optional()
+}).strict();
 var TitleSchema = external_exports.string().min(2).max(80).describe("Customer-facing field label.");
 var V1_LEAF_BOUNDS = {
   help: 400,
@@ -12317,7 +12361,16 @@ function leafShapes(bounds) {
      * what `requiredSecrets` reports, which is one answer with one reader.
      * Opening it wider is a separate decision with its own blast radius.
      */
-    "x-required-when": ValueConditionSchema.optional()
+    "x-required-when": ValueConditionSchema.optional(),
+    /**
+     * The values this one must be chosen from — see {@link ValueReferenceSchema}.
+     *
+     * ON A STRING ONLY, and not on a secret: the platform never reads a
+     * secret's value, so a membership test on one could never be evaluated.
+     * The publish rules say so rather than leaving it to be discovered, the
+     * same way they already do for a condition pointed at a secret.
+     */
+    "x-value-in": ValueReferenceSchema.optional()
   }).strict();
   withJsonSchemaAnnex(string, SECRET_COUPLING_ANNEX);
   const number = external_exports.object({
@@ -12328,14 +12381,23 @@ function leafShapes(bounds) {
     /** Both bounds required — "numeric limits" in the guide is not optional. */
     minimum: external_exports.number(),
     maximum: external_exports.number(),
-    default: external_exports.number().optional()
+    default: external_exports.number().optional(),
+    /**
+     * WIDENED FROM SECRETS TO EVERY ROOT SETTING, which this shape's own
+     * comment on the string leaf used to record as a known gap: "a
+     * value-conditioned requirement for an ORDINARY setting is a real gap
+     * too". It is the same keyword, the same evaluator and the same publish
+     * rules; what changes is which settings may carry it.
+     */
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   const boolean = external_exports.object({
     type: external_exports.literal("boolean"),
     title: TitleSchema,
     description: help.optional(),
     group: ConfigurationGroupSchema,
-    default: external_exports.boolean().optional()
+    default: external_exports.boolean().optional(),
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   const items = external_exports.object({
     type: external_exports.literal("string"),
@@ -12352,7 +12414,8 @@ function leafShapes(bounds) {
     /** Required: an unbounded list is an unbounded write. */
     maxItems: external_exports.number().int().min(1).max(100),
     uniqueItems: external_exports.boolean().optional(),
-    default: external_exports.array(external_exports.string().max(200)).max(100).optional()
+    default: external_exports.array(external_exports.string().max(200)).max(100).optional(),
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   return { string, number, boolean, items, array };
 }
@@ -12372,9 +12435,9 @@ var ConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
 var NestedStringPropertySchema = V2_LEAVES.string.omit({ "x-secret": true, writeOnly: true, "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() });
 var V2_NESTED_LEAVES = {
   string: NestedStringPropertySchema,
-  number: V2_LEAVES.number.extend({ group: ConfigurationGroupSchema.optional() }),
-  boolean: V2_LEAVES.boolean.extend({ group: ConfigurationGroupSchema.optional() }),
-  array: V2_LEAVES.array.extend({ group: ConfigurationGroupSchema.optional() }),
+  number: V2_LEAVES.number.omit({ "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() }),
+  boolean: V2_LEAVES.boolean.omit({ "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() }),
+  array: V2_LEAVES.array.omit({ "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() }),
   items: V2_LEAVES.items
 };
 function childBagShape(child) {
@@ -12418,7 +12481,23 @@ function propertyUnion(levelsBelow, leafSet) {
     // discriminator, which is also what keeps a v1 document's
     // `items: {type: 'string'}` reading exactly as it always did.
     leafSet.array.extend({
-      items: external_exports.discriminatedUnion("type", [V2_LEAVES.items, groupItems])
+      items: external_exports.discriminatedUnion("type", [V2_LEAVES.items, groupItems]),
+      /**
+       * Rules over the ROWS of this list — see {@link RowRulesSchema}.
+       *
+       * HERE RATHER THAN ON THE LEAF SHAPE, and that placement is the whole
+       * enforcement. `leafShapes().array` is also a v1 list and a last-level
+       * list, both of which hold STRINGS: a rule naming a field of a row would
+       * name nothing there, and `uniqueItems` is already the right keyword for
+       * comparing whole scalar entries. This branch is the only one in the chain
+       * where a list can hold groups, so declaring the keyword here makes "rows
+       * have fields" a property of the shape rather than a rule to remember.
+       *
+       * The refinement still has to refuse a rule on a list of STRINGS, because
+       * `items` is a discriminated union INSIDE this branch — the shape narrows
+       * where a row can exist, not whether this particular list has one.
+       */
+      "x-row-rules": RowRulesSchema.optional()
     }),
     /**
      * A group of related settings.
@@ -13121,6 +13200,9 @@ function canonicalJson(value) {
 }
 
 // ../product-configuration/dist/configuration-tree.js
+function immediateContainer(node) {
+  return node.containers[node.containers.length - 1] ?? null;
+}
 function underList(node) {
   return node.containers.some((container) => container.kind === "array");
 }
@@ -13182,6 +13264,11 @@ function walkDeclarations(properties, ancestors, base, onLeaf, onContainer = ()
     walkDeclarations(children.properties, [...ancestors, container], segments, onLeaf, onContainer);
   }
 }
+function declaredDefault(property) {
+  if (property.type === "object")
+    return void 0;
+  return property.default;
+}
 function leafAt(schema, path) {
   const declaration = declarationPathOf(path);
   return configurationLeaves(schema).find((leaf) => leaf.path === declaration) ?? null;
@@ -13194,6 +13281,29 @@ function declaresPath(schema, path) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function expandDeclarationPath(configuration, declaration) {
+  const out = [];
+  const walk = (cursor, remaining, soFar) => {
+    if (remaining.length === 0) {
+      const path = configurationPath(...soFar);
+      if (path !== null)
+        out.push(path);
+      return;
+    }
+    if (Array.isArray(cursor)) {
+      cursor.forEach((element, index) => walk(element, remaining, [...soFar, index]));
+      return;
+    }
+    if (!isPlainObject(cursor))
+      return;
+    const [head, ...rest] = remaining;
+    if (head === void 0)
+      return;
+    walk(cursor[String(head)], rest, [...soFar, head]);
+  };
+  walk(configuration, segmentsOf(declaration), []);
+  return out;
+}
 function valueAt(configuration, path) {
   let cursor = configuration;
   for (const segment of segmentsOf(path)) {
@@ -13255,6 +13365,7 @@ function conditionHolds(condition, configuration) {
 // ../product-configuration/dist/customer-configuration-input.js
 var ABSOLUTE_MAX_STRING = MAX_DECLARABLE_STRING_LENGTH;
 var MAX_REPORTED_UNDECLARED_KEYS = 10;
+var UNDECLARED_SETTING_MESSAGE = "This Product does not declare a setting with that name.";
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -13288,6 +13399,7 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
   const secrets = {};
   const configuration = validateObject({ properties: schema.properties, required: schema.required }, input, null, walk, { secrets, supplied });
   drain(walk, crossFieldIssues(schema, supplied, presence, configuration));
+  drain(walk, rowAndReferenceIssues(schema, presence, configuration));
   if (walk.suppressed > 0) {
     walk.issues.push({
       field: "",
@@ -13338,7 +13450,7 @@ function validateObject(declaration, input, container, walk, root) {
   };
   const undeclared = Object.keys(input).filter((name) => !Object.hasOwn(declaration.properties, name));
   for (const name of undeclared.slice(0, MAX_REPORTED_UNDECLARED_KEYS)) {
-    report(walk, fieldFor(name), "This Product does not declare a setting with that name.");
+    report(walk, fieldFor(name), UNDECLARED_SETTING_MESSAGE);
   }
   if (undeclared.length > MAX_REPORTED_UNDECLARED_KEYS) {
     report(walk, container === null ? "" : container, `${undeclared.length - MAX_REPORTED_UNDECLARED_KEYS} further settings are not declared by this Product.`);
@@ -13531,6 +13643,106 @@ function crossFieldIssues(schema, supplied, presence, configuration = {}) {
   }
   return issues;
 }
+function referenceOf(property) {
+  return property?.["x-value-in"];
+}
+function rowRulesOf(property) {
+  return property?.["x-row-rules"];
+}
+function comparableValue(value) {
+  if (value === void 0 || value === null)
+    return null;
+  if (typeof value === "string")
+    return value === "" ? null : JSON.stringify(value);
+  if (typeof value === "number" || typeof value === "boolean")
+    return JSON.stringify(value);
+  return null;
+}
+function rowAndReferenceIssues(schema, presence, configuration) {
+  const issues = [];
+  const referenced = new Set(presence.referenced ?? []);
+  for (const leaf of configurationLeaves(schema)) {
+    const reference = referenceOf(leaf.property);
+    if (reference === void 0)
+      continue;
+    const targetPath = parseConfigurationPath(reference.path);
+    if (targetPath === null)
+      continue;
+    const allowed = new Set(valuesAt(configuration, targetPath).filter((value) => typeof value === "string"));
+    for (const valuePath of expandDeclarationPath(configuration, leaf.path)) {
+      if (referenced.has(valuePath))
+        continue;
+      const held = valueAt(configuration, valuePath);
+      if (typeof held !== "string" || held === "")
+        continue;
+      if (allowed.has(held))
+        continue;
+      issues.push({
+        field: valuePath,
+        message: `This must be one of the values configured under ${labelOfPath(schema, targetPath)}. ` + (allowed.size === 0 ? "Nothing is configured there yet." : "No entry there currently holds this one.")
+      });
+    }
+  }
+  for (const container of configurationContainers(schema)) {
+    if (container.kind !== "array")
+      continue;
+    const rules = rowRulesOf(container.property);
+    if (rules === void 0)
+      continue;
+    for (const listPath of expandDeclarationPath(configuration, container.path)) {
+      const rows = valueAt(configuration, listPath);
+      if (!Array.isArray(rows))
+        continue;
+      const fieldOf = (index, name) => configurationPath(...pathSegments(listPath), index, name) ?? listPath;
+      for (const name of rules.unique ?? []) {
+        const firstAt = /* @__PURE__ */ new Map();
+        rows.forEach((row, index) => {
+          const held = comparableValue(isPlainObject2(row) ? row[name] : void 0);
+          if (held === null)
+            return;
+          const earlier = firstAt.get(held);
+          if (earlier === void 0) {
+            firstAt.set(held, index);
+            return;
+          }
+          issues.push({
+            field: fieldOf(index, name),
+            message: `${labelOfChild(container, name)} must be different in every entry; entry ${earlier + 1} already uses this one.`
+          });
+        });
+      }
+      for (const rule of rules.atMost ?? []) {
+        let counted = 0;
+        rows.forEach((row, index) => {
+          const held = isPlainObject2(row) ? row[rule.property] : void 0;
+          if (typeof held !== "string" || !rule.anyOf.includes(held))
+            return;
+          counted += 1;
+          if (counted <= rule.max)
+            return;
+          issues.push({
+            field: fieldOf(index, rule.property),
+            message: rule.max === 0 ? `No entry may be set to this.` : `At most ${rule.max} ${rule.max === 1 ? "entry" : "entries"} may be set to this, and ${counted - 1} already ${counted - 1 === 1 ? "is" : "are"}.`
+          });
+        });
+      }
+    }
+  }
+  return issues;
+}
+function labelOfPath(schema, path) {
+  const leaf = leafAt(schema, path);
+  const titleOf = (node) => node?.property.title;
+  const field = titleOf(leaf) ?? printableConfigurationPath(path);
+  const container = leaf?.containers[0];
+  const outer = container === void 0 ? void 0 : titleOf(container);
+  return outer === void 0 ? `"${field}"` : `"${field}" in "${outer}"`;
+}
+function labelOfChild(container, name) {
+  const items = container.property.items;
+  const title = items?.properties?.[name]?.title;
+  return title === void 0 ? `"${name}"` : `"${title}"`;
+}
 function conditionOf(property) {
   return property?.["x-required-when"];
 }
@@ -13539,19 +13751,45 @@ function labelOf(schema, name) {
   return property?.title === void 0 ? `"${name}"` : `"${property.title}"`;
 }
 function withoutCrossFieldRules(schema) {
-  const conditioned = Object.entries(schema.properties).some(([, property]) => property["x-required-when"] !== void 0);
-  if (conditioned) {
-    const properties = Object.fromEntries(Object.entries(schema.properties).map(([name, property]) => {
-      const { "x-required-when": _dropped, ...bare } = property;
-      return [name, bare];
-    }));
-    return withoutCrossFieldRules({ ...schema, properties });
-  }
-  if (schema.dependentRequired === void 0)
-    return schema;
-  const { dependentRequired: _removed, ...rest } = schema;
+  const properties = withoutPropertyRules(schema.properties);
+  const stripped = properties === null ? schema : { ...schema, properties };
+  if (stripped.dependentRequired === void 0)
+    return stripped;
+  const { dependentRequired: _removed, ...rest } = stripped;
   return rest;
 }
+var PROPERTY_RULE_KEYWORDS = ["x-required-when", "x-value-in", "x-row-rules"];
+function withoutPropertyRules(properties) {
+  let out = null;
+  const edit = (name) => {
+    out ??= { ...properties };
+    const copy = { ...out[name] };
+    out[name] = copy;
+    return copy;
+  };
+  for (const [name, property] of Object.entries(properties)) {
+    if (!isPlainObject2(property))
+      continue;
+    for (const keyword of PROPERTY_RULE_KEYWORDS) {
+      if (property[keyword] === void 0)
+        continue;
+      delete edit(name)[keyword];
+    }
+    const children = out?.[name] ?? property;
+    if (isPlainObject2(children["properties"])) {
+      const bare = withoutPropertyRules(children["properties"]);
+      if (bare !== null)
+        edit(name)["properties"] = bare;
+    }
+    const items = children["items"];
+    if (isPlainObject2(items) && isPlainObject2(items["properties"])) {
+      const bare = withoutPropertyRules(items["properties"]);
+      if (bare !== null)
+        edit(name)["items"] = { ...items, properties: bare };
+    }
+  }
+  return out;
+}
 function defaultOf(property) {
   switch (property.type) {
     case "string":
@@ -13604,7 +13842,11 @@ function checkString(field, property, value, issues) {
     return void 0;
   }
   if (property.pattern !== void 0 && !matches(property.pattern, value)) {
-    issues.push({ field, message: "Value is not in the required format." });
+    const expectation = property.description;
+    issues.push({
+      field,
+      message: expectation === void 0 ? "Value is not in the required format." : `Value is not in the required format. ${expectation.replace(/\s+$/, "")}`
+    });
     return void 0;
   }
   return value;
@@ -14754,11 +14996,19 @@ function checkProductDefinition(definition, ctx) {
     if (condition === void 0)
       continue;
     const at = ["configuration", "properties", name, "x-required-when"];
-    if (!isSecretProperty(property)) {
+    if ((definition.configuration.required ?? []).includes(name)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at],
+        message: `"${name}" is already required, so "x-required-when" can only narrow a rule that is already unconditional. Drop one: \`required\` is always, \`x-required-when\` is the condition.`
+      });
+      continue;
+    }
+    if (declaredDefault(property) !== void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: [...at],
-        message: `"${name}" is not a secret, so "x-required-when" has nothing to report through. Declare it "x-secret": true with "writeOnly": true, or use "dependentRequired" to require one ordinary setting alongside another.`
+        message: `"${name}" declares a default, so it is never absent and this condition could never make it required. Remove the default, or the condition.`
       });
       continue;
     }
@@ -14834,6 +15084,8 @@ function checkProductDefinition(definition, ctx) {
       });
     }
   }
+  checkValueReferences(definition.configuration, ctx);
+  checkRowRules(definition.configuration, ctx);
   const provides = definition.serviceInterfaces?.provides ?? [];
   const provideKeys = provides.map((provide) => provide.key);
   const duplicateProvideKeys = provideKeys.filter((key, i) => provideKeys.indexOf(key) !== i);
@@ -14945,6 +15197,203 @@ function checkProductDefinition(definition, ctx) {
     });
   }
 }
+function declarationIssuePath(node) {
+  const out = ["configuration"];
+  for (const container of node.containers) {
+    out.push("properties", container.name);
+    if (container.kind === "array")
+      out.push("items");
+  }
+  out.push("properties", node.name);
+  return out;
+}
+function directChildren(leaves, container) {
+  return leaves.filter((leaf) => immediateContainer(leaf)?.path === container.path);
+}
+function valuesOutsideSpace(configuration, leaf, values) {
+  const single = withoutCrossFieldRules({
+    ...configuration,
+    properties: { [leaf.name]: leaf.property },
+    required: [leaf.name]
+  });
+  return values.filter((value) => !validateSubmittedConfiguration(single, { [leaf.name]: value }).ok);
+}
+function checkValueReferences(configuration, ctx) {
+  const leaves = configurationLeaves(configuration);
+  for (const leaf of leaves) {
+    const reference = leaf.property["x-value-in"];
+    if (reference === void 0)
+      continue;
+    const at = [...declarationIssuePath(leaf), "x-value-in"];
+    const here = printableConfigurationPath(leaf.path);
+    if (isSecretProperty(leaf.property)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" is a secret. The platform never reads a secret's value, so it could never check one against a set of values.`
+      });
+      continue;
+    }
+    if (leaf.property.enum !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" already fixes its values with "enum". A setting takes its values from the contract or from another setting, not from both.`
+      });
+      continue;
+    }
+    if (declaredDefault(leaf.property) !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" declares a default, which would be written into every row and then refused until the setting it points at happens to hold the same value. Remove the default.`
+      });
+      continue;
+    }
+    const parsed = parseConfigurationPath(reference.path);
+    const target = parsed === null ? null : leafAt(configuration, parsed);
+    if (target === null) {
+      const isGroup = parsed !== null && declaresPath(configuration, parsed);
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: isGroup ? `"${reference.path}" is a group of settings, which holds no value to choose from. Name one setting inside it.` : `"${reference.path}" is not a declared customer configuration property.`
+      });
+      continue;
+    }
+    if (target.path === leaf.path) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${here}" cannot take its values from itself.`
+      });
+      continue;
+    }
+    if (target.property.type !== "string") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${reference.path}" is a ${target.property.type} setting; a reference compares string values.`
+      });
+      continue;
+    }
+    if (isSecretProperty(target.property)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${reference.path}" is a secret. The platform never reads a secret's value, so it could never be the set a reference is checked against.`
+      });
+      continue;
+    }
+  }
+}
+function checkRowRules(configuration, ctx) {
+  const leaves = configurationLeaves(configuration);
+  for (const leaf of leaves) {
+    if (leaf.property["x-row-rules"] === void 0)
+      continue;
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [...declarationIssuePath(leaf), "x-row-rules"],
+      message: `"${printableConfigurationPath(leaf.path)}" is a list of text entries, whose rows have no fields to name. Use "uniqueItems" to compare whole entries, or declare "items" as a group.`
+    });
+  }
+  for (const container of configurationContainers(configuration)) {
+    const rules = container.property["x-row-rules"];
+    if (rules === void 0)
+      continue;
+    const at = [...declarationIssuePath(container), "x-row-rules"];
+    const here = printableConfigurationPath(container.path);
+    if (rules.unique === void 0 && rules.atMost === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" declares "x-row-rules" with no rule in it. Declare "unique", "atMost", or both.`
+      });
+      continue;
+    }
+    const children = directChildren(leaves, container);
+    const childAt = (name) => children.find((child) => child.name === name);
+    const maxItems = container.property.maxItems;
+    const seen = /* @__PURE__ */ new Set();
+    (rules.unique ?? []).forEach((name, index) => {
+      if (seen.has(name)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is named twice.`
+        });
+        return;
+      }
+      seen.add(name);
+      const child = childAt(name);
+      if (child === void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is not a setting declared on a row of "${here}".`
+        });
+        return;
+      }
+      if (child.property.type === "array") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is a list, which holds no single value to compare across rows.`
+        });
+      }
+      if (child.property.type === "boolean") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is a true/false setting, so requiring it to be unique would cap "${here}" at two rows rather than make anything distinct. Use "atMost" to limit how many rows may answer one way.`
+        });
+      }
+    });
+    (rules.atMost ?? []).forEach((rule, index) => {
+      const ruleAt = [...at, "atMost", index];
+      const child = childAt(rule.property);
+      if (child === void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "property"],
+          message: `"${rule.property}" is not a setting declared on a row of "${here}".`
+        });
+        return;
+      }
+      if (child.property.type !== "string") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "property"],
+          message: `"${rule.property}" is a ${child.property.type} setting; a row rule compares string values.`
+        });
+        return;
+      }
+      if (new Set(rule.anyOf).size !== rule.anyOf.length) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "anyOf"],
+          message: "Repeated values in `anyOf`."
+        });
+      }
+      if (maxItems !== void 0 && rule.max >= maxItems) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "max"],
+          message: `"${here}" holds at most ${maxItems} rows, so a limit of ${rule.max} could never be exceeded. Lower it, or remove the rule.`
+        });
+      }
+      const outside = valuesOutsideSpace(configuration, child, rule.anyOf);
+      if (outside.length > 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "anyOf"],
+          message: `"${rule.property}" never accepts ${outside.map((value) => `"${value}"`).join(", ")}, so this rule could never count a row.`
+        });
+      }
+    });
+  }
+}
 
 // ../product-contracts/dist/announcements.js
 var ANNOUNCED_PRODUCTS = Object.freeze([
@@ -16801,8 +17250,16 @@ var MANIFEST_ACTIONS = [
   "ADOPT",
   /** The key names a resource and something in the document differs. */
   "UPDATE",
-  /** The key names a resource and the document matches it. A pipeline that runs
-   *  on every push and changes nothing reports this, and it is SUCCESS. */
+  /** The key names a resource and this REQUEST asks for nothing: no field
+   *  differs and no secret would be written.
+   *
+   *  NOT "the document matches it", which is how it read and is a stronger claim
+   *  than the planner makes. What a document OMITS is left alone rather than
+   *  compared — a manifest naming no connections answers this beside a resource
+   *  that holds several — so this never means the file mirrors stored state.
+   *
+   *  A pipeline that runs on every push and changes nothing reports it, and it
+   *  is SUCCESS. */
   "NO_CHANGE",
   /** `adopt` points at a resource that was DELETED. Its own verb, because both
    *  alternatives are wrong: `NO_CHANGE` would call a missing resource fine, and
@@ -17089,7 +17546,9 @@ function secretWriteConsequence(plan) {
   const lines = ["the value you send REPLACES the stored one, and the resource redeploys."];
   if (plan.action === "UPDATE" && (plan.changes ?? []).length === 0) {
     lines.push("Nothing else changed \u2014 sending a secret is itself the change.");
-    lines.push("Omit --secret on runs that are not rotating one to get NO_CHANGE.");
+    lines.push(
+      "Omit --secret on a run that is not setting or changing one; that is what answers NO_CHANGE."
+    );
   }
   return lines;
 }
@@ -17893,9 +18352,9 @@ async function runGet(parsed) {
       lines.push("", "  Outputs");
       const width = Math.max(...names.map((name) => name.length));
       for (const name of names) {
-        lines.push(
-          `    ${name.padEnd(width)}  ${isSecret2(name) ? "[secret]" : String(outputs[name] ?? "")}`
-        );
+        const value = outputs[name];
+        const shown = isSecret2(name) ? "[secret]" : value === void 0 || value === null ? "[not available]" : String(value);
+        lines.push(`    ${name.padEnd(width)}  ${shown}`);
         const meaning = declared.find((entry) => entry["key"] === name);
         const description = meaning?.["description"];
         if (typeof description === "string") {
@@ -18085,14 +18544,41 @@ function renderProduct(product) {
       lines.push(`    ${setting.label}  ${setting.type ?? ""}`.trimEnd());
     }
   }
-  const needed = (product.dependencies ?? []).filter((dependency) => dependency.required);
-  if (needed.length > 0) {
-    lines.push("", "  Requires a connection to another resource:");
-    for (const dependency of needed) {
-      lines.push(`    ${dependency.productId ?? "(a Product providing a service)"}`);
+  const dependencies = product.dependencies ?? [];
+  if (dependencies.length > 0) {
+    lines.push("", "  Connections to another resource");
+    for (const dependency of dependencies) {
+      const when = dependency.requiredWhen?.property;
+      const need = dependency.required ? "required" : when === void 0 ? "optional" : `required when ${when} is ${(dependency.requiredWhen?.anyOf ?? []).join(" or ")}`;
+      lines.push(`    ${dependency.key ?? "(no key)"}  ${need}`);
+      const capability = dependency.interface?.id;
+      if (capability !== void 0) {
+        lines.push(
+          `      ${capability}${dependency.interface?.version ? `/${dependency.interface.version}` : ""}`
+        );
+      } else if (dependency.productId !== void 0) {
+        lines.push(`      ${dependency.productId}`);
+      }
       if (dependency.reason) lines.push(`      ${dependency.reason}`);
     }
   }
+  const outputs = product.outputs ?? [];
+  if (outputs.length > 0) {
+    lines.push("", "  Publishes");
+    for (const output of outputs) {
+      lines.push(
+        `    ${output.key ?? ""}  ${output.secret === true ? "secret" : output.type ?? ""}`.trimEnd()
+      );
+    }
+  }
+  const conditions = product.conditions ?? [];
+  if (conditions.length > 0) {
+    lines.push("", "  Needs setting up outside the platform");
+    for (const condition of conditions) {
+      lines.push(`    ${condition.key ?? ""}  ${condition.displayName ?? ""}`.trimEnd());
+    }
+  }
+  lines.push("", "  `--output json` carries the whole declaration, this is a readable subset.");
   return lines.join("\n");
 }
 function wrap(text, width) {
@@ -18441,6 +18927,12 @@ Run \`vfac get product-instance pri_\u2026\` to see which ones this credential m
 `);
     return 2;
   }
+  if (parsed.booleans.has("wait")) {
+    process.stderr.write(
+      "`--wait` belongs to `vfac apply`; `vfac lifecycle` does not support it.\nThis command answers with an operation id. Follow it with:\n  vfac get operation op_\u2026\nand branch on the status it reports: SUCCEEDED, FAILED or CANCELLED. That\ncommand's exit code says whether the READ worked, never whether the operation\ndid \u2014 so a script that only checks the exit code reports a failed deploy as a\nsuccess.\n"
+    );
+    return 2;
+  }
   if (command === "delete" && !parsed.booleans.has("yes")) {
     process.stderr.write(
       `delete removes ${instanceId} and everything it is serving. This cannot be undone.
@@ -18547,7 +19039,7 @@ var USAGE = `vfac \u2014 deploy Varde Flyt resources from a manifest
   vfac manifest init --product <productId> --name <name> [--key <key>]
                      [--region <region>] [--profile <profile>]
   vfac validate -f resource.yaml
-  vfac plan     -f resource.yaml
+  vfac plan     -f resource.yaml [--secret NAME=env:VAR]
   vfac apply    -f resource.yaml [--secret NAME=env:VAR] [--adopt pri_\u2026] [--wait]
   vfac get product-instances
   vfac get product-instance pri_\u2026        what it is, and its outputs
@@ -18564,9 +19056,12 @@ Options
       --project   the Project to act in. Defaults to the stored context
       --endpoint  your organization's portal. Defaults to VFAC_ENDPOINT, then the
                   stored context
-      --secret    NAME=env:VARIABLE \u2014 the value is read from the environment.
-                  A value on the command line is in your shell history and in the
-                  process table, so it is refused
+      --secret    plan and apply: NAME=env:VARIABLE \u2014 the value is read from the
+                  environment. Plan a run that sets a secret with the same
+                  --secret inputs the apply will carry; without them the plan
+                  answers about a different request. A value on the command line
+                  is in your shell history and in the process table, so it is
+                  refused
       --product   which Product to write a starting manifest for
       --name      what a person will call the resource
       --key       its stable identity. Derived from --name when omitted

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",