@varde-flyt/vfac 0.12.0 → 0.14.0

package/dist/vfac.mjs

@@ -7378,6 +7378,8 @@ var VALUED = /* @__PURE__ */ new Set([
   // an organization and part of a catalogue, silently, once either passed 25.
   "cursor",
   "page-size",
+  // `get operations --resource pri_…`: the history of one resource.
+  "resource",
   "product",
   "name",
   "key",
@@ -7700,263 +7702,7 @@ async function probeMachineApi(args) {
 }
 
 // src/manifest.ts
-var import_yaml = __toESM(require_dist(), 1);
 import { readFileSync as readFileSync2 } from "node:fs";
-function readManifest(path) {
-  let text;
-  try {
-    text = readFileSync2(path, "utf8");
-  } catch {
-    return { ok: false, message: `Could not read ${path}.` };
-  }
-  let parsed;
-  try {
-    parsed = (0, import_yaml.parse)(text);
-  } catch (error) {
-    return {
-      ok: false,
-      message: `${path} is not valid YAML or JSON: ${error instanceof Error ? error.message : "unknown error"}`
-    };
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return { ok: false, message: `${path} does not contain a manifest document.` };
-  }
-  return { ok: true, document: parsed };
-}
-function resolveSecrets(pairs, environment = process.env) {
-  const secrets = {};
-  for (const pair of pairs) {
-    const separator = pair.indexOf("=");
-    if (separator <= 0) {
-      return { ok: false, message: `--secret expects name=env:VARIABLE, got "${pair}".` };
-    }
-    const name = pair.slice(0, separator);
-    const source = pair.slice(separator + 1);
-    if (!source.startsWith("env:")) {
-      return {
-        ok: false,
-        message: `--secret ${name} must read from the environment: --secret ${name}=env:VARIABLE. A value on the command line is in your shell history and in the process table.`
-      };
-    }
-    const variable = source.slice("env:".length);
-    if (variable.length === 0) {
-      return { ok: false, message: `--secret ${name}=env: names no variable.` };
-    }
-    const value = environment[variable];
-    if (value === void 0 || value === "") {
-      return { ok: false, message: `${variable} is not set, so ${name} has no value.` };
-    }
-    secrets[name] = value;
-  }
-  return { ok: true, secrets };
-}
-function manifestKeyOf(document) {
-  const metadata = document["metadata"];
-  if (typeof metadata !== "object" || metadata === null) return null;
-  const key = metadata["key"];
-  return typeof key === "string" ? key : null;
-}
-
-// src/endpoint.ts
-function isLoopback(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function validateEndpoint(raw, source) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return { ok: false, message: `${source} is not a URL: "${raw}".` };
-  }
-  if (url.protocol === "https:") return { ok: true, endpoint: url.origin };
-  if (url.protocol === "http:" && isLoopback(url.hostname)) {
-    return { ok: true, endpoint: url.origin };
-  }
-  return {
-    ok: false,
-    message: `${source} must be https \u2014 a credential is sent to it, and "${url.protocol}//" would send it in the clear. Plain http is accepted for localhost only.`
-  };
-}
-
-// src/session.ts
-async function ensureSession(args) {
-  const stored = readStored();
-  const resolved = resolveEndpoint(args.endpointFlag, stored);
-  if (!resolved) {
-    return {
-      ok: false,
-      message: "No endpoint. Run `vfac context set --endpoint https://your-organization.cloud.vardeflyt.no`, or set VFAC_ENDPOINT."
-    };
-  }
-  const checked = validateEndpoint(resolved.value, resolved.source);
-  if (!checked.ok) return { ok: false, message: checked.message };
-  const endpoint = checked.endpoint;
-  const credential = credentialFromEnvironment();
-  if (args.forceExchange !== true && sessionUsable(stored.session, endpoint, args.now ?? /* @__PURE__ */ new Date(), credential?.keyId)) {
-    return { ok: true, ready: { endpoint, token: stored.session.token, stored, via: "stored" } };
-  }
-  const signedIn = await signIn({
-    endpoint,
-    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
-  });
-  if (!signedIn.ok) return { ok: false, message: signedIn.message };
-  const next = { ...stored, session: signedIn.session };
-  writeStored(next);
-  return {
-    ok: true,
-    ready: {
-      endpoint,
-      token: signedIn.session.token,
-      stored: next,
-      via: "exchanged",
-      ...signedIn.gate ? { gate: signedIn.gate } : {}
-    }
-  };
-}
-function resolveProject(flag, stored) {
-  return flag ?? stored.context?.projectId ?? null;
-}
-
-// src/operations.ts
-var OPERATION_STATUSES = [
-  "PENDING",
-  "RUNNING",
-  "SUCCEEDED",
-  "FAILED",
-  "CANCELLED"
-];
-var TERMINAL_STATUSES = ["SUCCEEDED", "FAILED", "CANCELLED"];
-var POLL_INTERVAL_MS = 5e3;
-var MAX_WAIT_MS = 60 * 60 * 1e3;
-function withProject(path, projectId) {
-  return projectId === null ? path : `${path}?project=${encodeURIComponent(projectId)}`;
-}
-function operationPath(operationId, projectId) {
-  return withProject(`/api/v1/operations/${encodeURIComponent(operationId)}`, projectId);
-}
-function classify(data) {
-  const status = data["status"];
-  if (typeof status !== "string") return "unknown";
-  if (TERMINAL_STATUSES.includes(status)) return "terminal";
-  if (OPERATION_STATUSES.includes(status)) return "working";
-  return "unknown";
-}
-async function readOperation(args) {
-  const result = await call({
-    endpoint: args.endpoint,
-    path: operationPath(args.operationId, args.projectId),
-    token: args.token,
-    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
-  });
-  return result.ok ? { ok: true, data: result.data } : { ok: false, error: result.error };
-}
-async function waitForOperation(args) {
-  const deps = args.deps ?? {};
-  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = deps.now ?? (() => Date.now());
-  const deadline = now() + MAX_WAIT_MS;
-  let token = args.token;
-  let refreshed = false;
-  let last = null;
-  for (; ; ) {
-    const read = await readOperation({
-      endpoint: args.endpoint,
-      token,
-      operationId: args.operationId,
-      projectId: args.projectId,
-      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-    });
-    if (!read.ok) {
-      if (read.error.status === 401 && !refreshed && deps.refreshToken) {
-        refreshed = true;
-        const next = await deps.refreshToken();
-        if (next !== null) {
-          token = next;
-          continue;
-        }
-      }
-      return { kind: "read-failed", error: read.error };
-    }
-    last = read.data;
-    const verdict = classify(read.data);
-    if (verdict === "terminal") {
-      return { kind: "settled", status: String(read.data["status"]), data: read.data };
-    }
-    if (verdict === "unknown") {
-      return { kind: "unknown-status", status: String(read.data["status"]), data: read.data };
-    }
-    args.onProgress?.(read.data);
-    if (now() + POLL_INTERVAL_MS >= deadline) return { kind: "timed-out", data: last };
-    await sleep(POLL_INTERVAL_MS);
-  }
-}
-function renderOperation(operationId, data) {
-  const status = String(data["status"] ?? "UNKNOWN");
-  const phase = data["phase"];
-  const lines = [
-    typeof phase === "string" && phase !== "" ? `${operationId}  ${status}  (${phase})` : `${operationId}  ${status}`
-  ];
-  const type = data["type"];
-  if (typeof type === "string") lines[0] += `  ${type}`;
-  const steps = Array.isArray(data["steps"]) ? data["steps"] : [];
-  if (steps.length > 0) {
-    lines.push("");
-    for (const step of steps) {
-      const state = String(step["state"] ?? "");
-      lines.push(`  ${markerFor(state)} ${String(step["label"] ?? step["key"] ?? "")}`);
-    }
-  }
-  const failure = asRecord(data["failure"]);
-  if (failure) {
-    lines.push("");
-    const stage = failure["stage"];
-    lines.push(`  Failed${typeof stage === "string" ? ` at ${stage}` : ""}`);
-    const summary = failure["summary"];
-    if (typeof summary === "string") lines.push(`    ${summary}`);
-    const cause = failure["cause"];
-    if (typeof cause === "string") lines.push(`    cause: ${cause}`);
-    const services = failure["services"];
-    if (Array.isArray(services)) {
-      for (const entry of services) {
-        const one = asRecord(entry);
-        if (one === null) continue;
-        const dependency = one["dependency"];
-        if (typeof dependency !== "string" || dependency === "") continue;
-        const code = one["code"];
-        lines.push(
-          typeof code === "string" && code !== "" ? `    ${dependency} \u2014 the service reported: ${code}` : `    ${dependency} \u2014 the service reported nothing usable`
-        );
-      }
-    }
-    const retryable = failure["retryable"];
-    if (typeof retryable === "boolean") {
-      const again = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "`vfac lifecycle upgrade <pri_\u2026>`" : "`vfac lifecycle reconcile <pri_\u2026>`";
-      const changeIt = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "" : ", or `vfac apply` a corrected manifest";
-      const cause2 = failure["cause"];
-      lines.push(
-        retryable ? `    Another attempt can succeed: ${again}.` : cause2 === "unknown" ? `    The platform could not classify this, so there is nothing here to correct. Read the whole record with \`vfac get operation ${operationId} --output json\`, and quote that id if you ask for help. Repeating it unchanged fails the same way.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
-      );
-    }
-  }
-  return lines.join("\n");
-}
-function markerFor(state) {
-  switch (state) {
-    case "completed":
-      return "\u2713";
-    case "failed":
-      return "\u2717";
-    case "active":
-      return "\u203A";
-    case "pending":
-      return "\xB7";
-    default:
-      return "-";
-  }
-}
-function asRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-}
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -12245,6 +11991,29 @@ var ValueConditionSchema = external_exports.object({
   anyOf: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20),
   anyRow: external_exports.boolean().optional()
 }).strict();
+var ValueReferenceSchema = external_exports.object({
+  /**
+   * The setting whose VALUES form the allowed set — a canonical declaration
+   * path, or a bare root key, which is the same string at depth 1.
+   */
+  path: external_exports.string().min(1).max(400)
+}).strict();
+var RowCardinalitySchema = external_exports.object({
+  /** A setting declared DIRECTLY on the row. */
+  property: PropertyNameSchema,
+  /** The answers that count toward the limit. Non-empty. */
+  anyOf: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20),
+  /**
+   * How many rows may answer that way. Zero is meaningful and allowed — "no
+   * row may, under this release" is a thing an upgrade needs to be able to
+   * say.
+   */
+  max: external_exports.number().int().min(0).max(99)
+}).strict();
+var RowRulesSchema = external_exports.object({
+  unique: external_exports.array(PropertyNameSchema).min(1).max(MAX_CONFIGURATION_CHILDREN).optional(),
+  atMost: external_exports.array(RowCardinalitySchema).min(1).max(10).optional()
+}).strict();
 var TitleSchema = external_exports.string().min(2).max(80).describe("Customer-facing field label.");
 var V1_LEAF_BOUNDS = {
   help: 400,
@@ -12318,7 +12087,16 @@ function leafShapes(bounds) {
      * what `requiredSecrets` reports, which is one answer with one reader.
      * Opening it wider is a separate decision with its own blast radius.
      */
-    "x-required-when": ValueConditionSchema.optional()
+    "x-required-when": ValueConditionSchema.optional(),
+    /**
+     * The values this one must be chosen from — see {@link ValueReferenceSchema}.
+     *
+     * ON A STRING ONLY, and not on a secret: the platform never reads a
+     * secret's value, so a membership test on one could never be evaluated.
+     * The publish rules say so rather than leaving it to be discovered, the
+     * same way they already do for a condition pointed at a secret.
+     */
+    "x-value-in": ValueReferenceSchema.optional()
   }).strict();
   withJsonSchemaAnnex(string, SECRET_COUPLING_ANNEX);
   const number = external_exports.object({
@@ -12329,14 +12107,23 @@ function leafShapes(bounds) {
     /** Both bounds required — "numeric limits" in the guide is not optional. */
     minimum: external_exports.number(),
     maximum: external_exports.number(),
-    default: external_exports.number().optional()
+    default: external_exports.number().optional(),
+    /**
+     * WIDENED FROM SECRETS TO EVERY ROOT SETTING, which this shape's own
+     * comment on the string leaf used to record as a known gap: "a
+     * value-conditioned requirement for an ORDINARY setting is a real gap
+     * too". It is the same keyword, the same evaluator and the same publish
+     * rules; what changes is which settings may carry it.
+     */
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   const boolean = external_exports.object({
     type: external_exports.literal("boolean"),
     title: TitleSchema,
     description: help.optional(),
     group: ConfigurationGroupSchema,
-    default: external_exports.boolean().optional()
+    default: external_exports.boolean().optional(),
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   const items = external_exports.object({
     type: external_exports.literal("string"),
@@ -12353,7 +12140,8 @@ function leafShapes(bounds) {
     /** Required: an unbounded list is an unbounded write. */
     maxItems: external_exports.number().int().min(1).max(100),
     uniqueItems: external_exports.boolean().optional(),
-    default: external_exports.array(external_exports.string().max(200)).max(100).optional()
+    default: external_exports.array(external_exports.string().max(200)).max(100).optional(),
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   return { string, number, boolean, items, array };
 }
@@ -12373,9 +12161,9 @@ var ConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
 var NestedStringPropertySchema = V2_LEAVES.string.omit({ "x-secret": true, writeOnly: true, "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() });
 var V2_NESTED_LEAVES = {
   string: NestedStringPropertySchema,
-  number: V2_LEAVES.number.extend({ group: ConfigurationGroupSchema.optional() }),
-  boolean: V2_LEAVES.boolean.extend({ group: ConfigurationGroupSchema.optional() }),
-  array: V2_LEAVES.array.extend({ group: ConfigurationGroupSchema.optional() }),
+  number: V2_LEAVES.number.omit({ "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() }),
+  boolean: V2_LEAVES.boolean.omit({ "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() }),
+  array: V2_LEAVES.array.omit({ "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() }),
   items: V2_LEAVES.items
 };
 function childBagShape(child) {
@@ -12419,7 +12207,23 @@ function propertyUnion(levelsBelow, leafSet) {
     // discriminator, which is also what keeps a v1 document's
     // `items: {type: 'string'}` reading exactly as it always did.
     leafSet.array.extend({
-      items: external_exports.discriminatedUnion("type", [V2_LEAVES.items, groupItems])
+      items: external_exports.discriminatedUnion("type", [V2_LEAVES.items, groupItems]),
+      /**
+       * Rules over the ROWS of this list — see {@link RowRulesSchema}.
+       *
+       * HERE RATHER THAN ON THE LEAF SHAPE, and that placement is the whole
+       * enforcement. `leafShapes().array` is also a v1 list and a last-level
+       * list, both of which hold STRINGS: a rule naming a field of a row would
+       * name nothing there, and `uniqueItems` is already the right keyword for
+       * comparing whole scalar entries. This branch is the only one in the chain
+       * where a list can hold groups, so declaring the keyword here makes "rows
+       * have fields" a property of the shape rather than a rule to remember.
+       *
+       * The refinement still has to refuse a rule on a list of STRINGS, because
+       * `items` is a discriminated union INSIDE this branch — the shape narrows
+       * where a row can exist, not whether this particular list has one.
+       */
+      "x-row-rules": RowRulesSchema.optional()
     }),
     /**
      * A group of related settings.
@@ -13122,6 +12926,9 @@ function canonicalJson(value) {
 }
 
 // ../product-configuration/dist/configuration-tree.js
+function immediateContainer(node) {
+  return node.containers[node.containers.length - 1] ?? null;
+}
 function underList(node) {
   return node.containers.some((container) => container.kind === "array");
 }
@@ -13183,6 +12990,11 @@ function walkDeclarations(properties, ancestors, base, onLeaf, onContainer = ()
     walkDeclarations(children.properties, [...ancestors, container], segments, onLeaf, onContainer);
   }
 }
+function declaredDefault(property) {
+  if (property.type === "object")
+    return void 0;
+  return property.default;
+}
 function leafAt(schema, path) {
   const declaration = declarationPathOf(path);
   return configurationLeaves(schema).find((leaf) => leaf.path === declaration) ?? null;
@@ -13195,6 +13007,29 @@ function declaresPath(schema, path) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function expandDeclarationPath(configuration, declaration) {
+  const out = [];
+  const walk = (cursor, remaining, soFar) => {
+    if (remaining.length === 0) {
+      const path = configurationPath(...soFar);
+      if (path !== null)
+        out.push(path);
+      return;
+    }
+    if (Array.isArray(cursor)) {
+      cursor.forEach((element, index) => walk(element, remaining, [...soFar, index]));
+      return;
+    }
+    if (!isPlainObject(cursor))
+      return;
+    const [head, ...rest] = remaining;
+    if (head === void 0)
+      return;
+    walk(cursor[String(head)], rest, [...soFar, head]);
+  };
+  walk(configuration, segmentsOf(declaration), []);
+  return out;
+}
 function valueAt(configuration, path) {
   let cursor = configuration;
   for (const segment of segmentsOf(path)) {
@@ -13290,6 +13125,7 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
   const secrets = {};
   const configuration = validateObject({ properties: schema.properties, required: schema.required }, input, null, walk, { secrets, supplied });
   drain(walk, crossFieldIssues(schema, supplied, presence, configuration));
+  drain(walk, rowAndReferenceIssues(schema, presence, configuration));
   if (walk.suppressed > 0) {
     walk.issues.push({
       field: "",
@@ -13533,6 +13369,106 @@ function crossFieldIssues(schema, supplied, presence, configuration = {}) {
   }
   return issues;
 }
+function referenceOf(property) {
+  return property?.["x-value-in"];
+}
+function rowRulesOf(property) {
+  return property?.["x-row-rules"];
+}
+function comparableValue(value) {
+  if (value === void 0 || value === null)
+    return null;
+  if (typeof value === "string")
+    return value === "" ? null : JSON.stringify(value);
+  if (typeof value === "number" || typeof value === "boolean")
+    return JSON.stringify(value);
+  return null;
+}
+function rowAndReferenceIssues(schema, presence, configuration) {
+  const issues = [];
+  const referenced = new Set(presence.referenced ?? []);
+  for (const leaf of configurationLeaves(schema)) {
+    const reference = referenceOf(leaf.property);
+    if (reference === void 0)
+      continue;
+    const targetPath = parseConfigurationPath(reference.path);
+    if (targetPath === null)
+      continue;
+    const allowed = new Set(valuesAt(configuration, targetPath).filter((value) => typeof value === "string"));
+    for (const valuePath of expandDeclarationPath(configuration, leaf.path)) {
+      if (referenced.has(valuePath))
+        continue;
+      const held = valueAt(configuration, valuePath);
+      if (typeof held !== "string" || held === "")
+        continue;
+      if (allowed.has(held))
+        continue;
+      issues.push({
+        field: valuePath,
+        message: `This must be one of the values configured under ${labelOfPath(schema, targetPath)}. ` + (allowed.size === 0 ? "Nothing is configured there yet." : "No entry there currently holds this one.")
+      });
+    }
+  }
+  for (const container of configurationContainers(schema)) {
+    if (container.kind !== "array")
+      continue;
+    const rules = rowRulesOf(container.property);
+    if (rules === void 0)
+      continue;
+    for (const listPath of expandDeclarationPath(configuration, container.path)) {
+      const rows = valueAt(configuration, listPath);
+      if (!Array.isArray(rows))
+        continue;
+      const fieldOf = (index, name) => configurationPath(...pathSegments(listPath), index, name) ?? listPath;
+      for (const name of rules.unique ?? []) {
+        const firstAt = /* @__PURE__ */ new Map();
+        rows.forEach((row, index) => {
+          const held = comparableValue(isPlainObject2(row) ? row[name] : void 0);
+          if (held === null)
+            return;
+          const earlier = firstAt.get(held);
+          if (earlier === void 0) {
+            firstAt.set(held, index);
+            return;
+          }
+          issues.push({
+            field: fieldOf(index, name),
+            message: `${labelOfChild(container, name)} must be different in every entry; entry ${earlier + 1} already uses this one.`
+          });
+        });
+      }
+      for (const rule of rules.atMost ?? []) {
+        let counted = 0;
+        rows.forEach((row, index) => {
+          const held = isPlainObject2(row) ? row[rule.property] : void 0;
+          if (typeof held !== "string" || !rule.anyOf.includes(held))
+            return;
+          counted += 1;
+          if (counted <= rule.max)
+            return;
+          issues.push({
+            field: fieldOf(index, rule.property),
+            message: rule.max === 0 ? `No entry may be set to this.` : `At most ${rule.max} ${rule.max === 1 ? "entry" : "entries"} may be set to this, and ${counted - 1} already ${counted - 1 === 1 ? "is" : "are"}.`
+          });
+        });
+      }
+    }
+  }
+  return issues;
+}
+function labelOfPath(schema, path) {
+  const leaf = leafAt(schema, path);
+  const titleOf = (node) => node?.property.title;
+  const field = titleOf(leaf) ?? printableConfigurationPath(path);
+  const container = leaf?.containers[0];
+  const outer = container === void 0 ? void 0 : titleOf(container);
+  return outer === void 0 ? `"${field}"` : `"${field}" in "${outer}"`;
+}
+function labelOfChild(container, name) {
+  const items = container.property.items;
+  const title = items?.properties?.[name]?.title;
+  return title === void 0 ? `"${name}"` : `"${title}"`;
+}
 function conditionOf(property) {
   return property?.["x-required-when"];
 }
@@ -13541,19 +13477,48 @@ function labelOf(schema, name) {
   return property?.title === void 0 ? `"${name}"` : `"${property.title}"`;
 }
 function withoutCrossFieldRules(schema) {
-  const conditioned = Object.entries(schema.properties).some(([, property]) => property["x-required-when"] !== void 0);
-  if (conditioned) {
-    const properties = Object.fromEntries(Object.entries(schema.properties).map(([name, property]) => {
-      const { "x-required-when": _dropped, ...bare } = property;
-      return [name, bare];
-    }));
-    return withoutCrossFieldRules({ ...schema, properties });
-  }
-  if (schema.dependentRequired === void 0)
-    return schema;
-  const { dependentRequired: _removed, ...rest } = schema;
+  const properties = withoutPropertyRules(schema.properties);
+  const stripped = properties === null ? schema : { ...schema, properties };
+  if (stripped.dependentRequired === void 0)
+    return stripped;
+  const { dependentRequired: _removed, ...rest } = stripped;
   return rest;
 }
+var PROPERTY_RULE_KEYWORDS = ["x-required-when", "x-value-in", "x-row-rules"];
+function withoutPropertyRules(properties) {
+  let out = null;
+  const edit = (name) => {
+    out ??= { ...properties };
+    const copy = { ...out[name] };
+    out[name] = copy;
+    return copy;
+  };
+  for (const [name, property] of Object.entries(properties)) {
+    if (!isPlainObject2(property))
+      continue;
+    for (const keyword of PROPERTY_RULE_KEYWORDS) {
+      if (property[keyword] === void 0)
+        continue;
+      delete edit(name)[keyword];
+    }
+    const children = out?.[name] ?? property;
+    if (isPlainObject2(children["properties"])) {
+      const bare = withoutPropertyRules(children["properties"]);
+      if (bare !== null)
+        edit(name)["properties"] = bare;
+    }
+    const items = children["items"];
+    if (isPlainObject2(items) && isPlainObject2(items["properties"])) {
+      const bare = withoutPropertyRules(items["properties"]);
+      if (bare !== null)
+        edit(name)["items"] = { ...items, properties: bare };
+    }
+  }
+  return out;
+}
+function declaredSecretNames(schema) {
+  return Object.entries(schema.properties).filter(([, property]) => isSecretProperty(property)).map(([name]) => name).sort();
+}
 function defaultOf(property) {
   switch (property.type) {
     case "string":
@@ -14760,11 +14725,19 @@ function checkProductDefinition(definition, ctx) {
     if (condition === void 0)
       continue;
     const at = ["configuration", "properties", name, "x-required-when"];
-    if (!isSecretProperty(property)) {
+    if ((definition.configuration.required ?? []).includes(name)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at],
+        message: `"${name}" is already required, so "x-required-when" can only narrow a rule that is already unconditional. Drop one: \`required\` is always, \`x-required-when\` is the condition.`
+      });
+      continue;
+    }
+    if (declaredDefault(property) !== void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: [...at],
-        message: `"${name}" is not a secret, so "x-required-when" has nothing to report through. Declare it "x-secret": true with "writeOnly": true, or use "dependentRequired" to require one ordinary setting alongside another.`
+        message: `"${name}" declares a default, so it is never absent and this condition could never make it required. Remove the default, or the condition.`
       });
       continue;
     }
@@ -14840,6 +14813,8 @@ function checkProductDefinition(definition, ctx) {
       });
     }
   }
+  checkValueReferences(definition.configuration, ctx);
+  checkRowRules(definition.configuration, ctx);
   const provides = definition.serviceInterfaces?.provides ?? [];
   const provideKeys = provides.map((provide) => provide.key);
   const duplicateProvideKeys = provideKeys.filter((key, i) => provideKeys.indexOf(key) !== i);
@@ -14951,6 +14926,203 @@ function checkProductDefinition(definition, ctx) {
     });
   }
 }
+function declarationIssuePath(node) {
+  const out = ["configuration"];
+  for (const container of node.containers) {
+    out.push("properties", container.name);
+    if (container.kind === "array")
+      out.push("items");
+  }
+  out.push("properties", node.name);
+  return out;
+}
+function directChildren(leaves, container) {
+  return leaves.filter((leaf) => immediateContainer(leaf)?.path === container.path);
+}
+function valuesOutsideSpace(configuration, leaf, values) {
+  const single = withoutCrossFieldRules({
+    ...configuration,
+    properties: { [leaf.name]: leaf.property },
+    required: [leaf.name]
+  });
+  return values.filter((value) => !validateSubmittedConfiguration(single, { [leaf.name]: value }).ok);
+}
+function checkValueReferences(configuration, ctx) {
+  const leaves = configurationLeaves(configuration);
+  for (const leaf of leaves) {
+    const reference = leaf.property["x-value-in"];
+    if (reference === void 0)
+      continue;
+    const at = [...declarationIssuePath(leaf), "x-value-in"];
+    const here = printableConfigurationPath(leaf.path);
+    if (isSecretProperty(leaf.property)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" is a secret. The platform never reads a secret's value, so it could never check one against a set of values.`
+      });
+      continue;
+    }
+    if (leaf.property.enum !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" already fixes its values with "enum". A setting takes its values from the contract or from another setting, not from both.`
+      });
+      continue;
+    }
+    if (declaredDefault(leaf.property) !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" declares a default, which would be written into every row and then refused until the setting it points at happens to hold the same value. Remove the default.`
+      });
+      continue;
+    }
+    const parsed = parseConfigurationPath(reference.path);
+    const target = parsed === null ? null : leafAt(configuration, parsed);
+    if (target === null) {
+      const isGroup = parsed !== null && declaresPath(configuration, parsed);
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: isGroup ? `"${reference.path}" is a group of settings, which holds no value to choose from. Name one setting inside it.` : `"${reference.path}" is not a declared customer configuration property.`
+      });
+      continue;
+    }
+    if (target.path === leaf.path) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${here}" cannot take its values from itself.`
+      });
+      continue;
+    }
+    if (target.property.type !== "string") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${reference.path}" is a ${target.property.type} setting; a reference compares string values.`
+      });
+      continue;
+    }
+    if (isSecretProperty(target.property)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${reference.path}" is a secret. The platform never reads a secret's value, so it could never be the set a reference is checked against.`
+      });
+      continue;
+    }
+  }
+}
+function checkRowRules(configuration, ctx) {
+  const leaves = configurationLeaves(configuration);
+  for (const leaf of leaves) {
+    if (leaf.property["x-row-rules"] === void 0)
+      continue;
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [...declarationIssuePath(leaf), "x-row-rules"],
+      message: `"${printableConfigurationPath(leaf.path)}" is a list of text entries, whose rows have no fields to name. Use "uniqueItems" to compare whole entries, or declare "items" as a group.`
+    });
+  }
+  for (const container of configurationContainers(configuration)) {
+    const rules = container.property["x-row-rules"];
+    if (rules === void 0)
+      continue;
+    const at = [...declarationIssuePath(container), "x-row-rules"];
+    const here = printableConfigurationPath(container.path);
+    if (rules.unique === void 0 && rules.atMost === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" declares "x-row-rules" with no rule in it. Declare "unique", "atMost", or both.`
+      });
+      continue;
+    }
+    const children = directChildren(leaves, container);
+    const childAt = (name) => children.find((child) => child.name === name);
+    const maxItems = container.property.maxItems;
+    const seen = /* @__PURE__ */ new Set();
+    (rules.unique ?? []).forEach((name, index) => {
+      if (seen.has(name)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is named twice.`
+        });
+        return;
+      }
+      seen.add(name);
+      const child = childAt(name);
+      if (child === void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is not a setting declared on a row of "${here}".`
+        });
+        return;
+      }
+      if (child.property.type === "array") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is a list, which holds no single value to compare across rows.`
+        });
+      }
+      if (child.property.type === "boolean") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is a true/false setting, so requiring it to be unique would cap "${here}" at two rows rather than make anything distinct. Use "atMost" to limit how many rows may answer one way.`
+        });
+      }
+    });
+    (rules.atMost ?? []).forEach((rule, index) => {
+      const ruleAt = [...at, "atMost", index];
+      const child = childAt(rule.property);
+      if (child === void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "property"],
+          message: `"${rule.property}" is not a setting declared on a row of "${here}".`
+        });
+        return;
+      }
+      if (child.property.type !== "string") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "property"],
+          message: `"${rule.property}" is a ${child.property.type} setting; a row rule compares string values.`
+        });
+        return;
+      }
+      if (new Set(rule.anyOf).size !== rule.anyOf.length) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "anyOf"],
+          message: "Repeated values in `anyOf`."
+        });
+      }
+      if (maxItems !== void 0 && rule.max >= maxItems) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "max"],
+          message: `"${here}" holds at most ${maxItems} rows, so a limit of ${rule.max} could never be exceeded. Lower it, or remove the rule.`
+        });
+      }
+      const outside = valuesOutsideSpace(configuration, child, rule.anyOf);
+      if (outside.length > 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "anyOf"],
+          message: `"${rule.property}" never accepts ${outside.map((value) => `"${value}"`).join(", ")}, so this rule could never count a row.`
+        });
+      }
+    });
+  }
+}
 
 // ../product-contracts/dist/announcements.js
 var ANNOUNCED_PRODUCTS = Object.freeze([
@@ -16846,7 +17018,23 @@ function isTerminalAction(action) {
 var ManifestActionSchema = external_exports.enum(MANIFEST_ACTIONS);
 
 // ../product-contracts/dist/contract-issue.js
+var PATH_SEGMENT = /^[A-Za-z_][A-Za-z0-9_-]{0,63}$/;
+var UNPRINTABLE_SEGMENT = "<unprintable>";
 var MAX_SEGMENTS = MAX_CONFIGURATION_PATH_SEGMENTS + 2;
+function printableContractPath(path) {
+  const printable = path.slice(0, MAX_SEGMENTS).map((segment) => typeof segment === "number" || PATH_SEGMENT.test(segment) ? String(segment) : UNPRINTABLE_SEGMENT);
+  return printable.join(".") || "(document)";
+}
+function manifestConfigurationField(field) {
+  if (field === "")
+    return "spec.configuration";
+  const parsed = parseConfigurationPath(field);
+  return printableContractPath([
+    "spec",
+    "configuration",
+    ...parsed === null ? [field] : pathSegments(parsed)
+  ]);
+}
 
 // ../product-contracts/dist/resource-output-reference.js
 var OUTPUT_KEY_RULE = "Output keys are camelCase.";
@@ -16860,6 +17048,9 @@ var ResourceOutputReferenceSchema = external_exports.object({
     }).strict()
   }).strict()
 }).strict();
+function looksLikeReference(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && "valueFrom" in value;
+}
 
 // ../product-contracts/dist/dependency-binding.js
 var DependencyBindingSelectorSchema = external_exports.object({
@@ -16995,6 +17186,23 @@ var ProductInstanceTemplateSchema = external_exports.object({
     dependencyBindings: DependencyBindingsSchema.optional()
   }).strict()
 }).strict();
+function secretValuesInDocument(schema, configuration) {
+  if (!isPlainRecord(configuration) || !isPlainRecord(schema.properties))
+    return [];
+  const declarations = Object.fromEntries(Object.entries(schema.properties).filter(([, property]) => isPlainRecord(property)));
+  return declaredSecretNames({
+    properties: declarations
+  }).filter((name) => Object.hasOwn(configuration, name) && !looksLikeReference(configuration[name]));
+}
+function secretValueIssue(name) {
+  return {
+    field: manifestConfigurationField(name),
+    message: `"${name}" is secret input and must never appear in a template. Supply it separately when applying, so it goes to the secret manager rather than into a document.`
+  };
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 
 // ../product-contracts/dist/product-submission.schema.js
 var PRODUCT_SUBMISSION_KIND = "ProductSubmission";
@@ -17094,50 +17302,383 @@ var PUBLISH_RULE_ANNEX = {
 };
 withJsonSchemaAnnex(ProductSubmissionSchema, PUBLISH_RULE_ANNEX);
 
-// src/render.ts
-function isUnconverged(plan) {
-  return plan.health !== void 0 && !plan.health.converged;
-}
-function secretWriteConsequence(plan) {
-  if ((plan.secretsToWrite ?? []).length === 0) return [];
-  const lines = ["the value you send REPLACES the stored one, and the resource redeploys."];
-  if (plan.action === "UPDATE" && (plan.changes ?? []).length === 0) {
-    lines.push("Nothing else changed \u2014 sending a secret is itself the change.");
-    lines.push(
-      "Omit --secret on a run that is not setting or changing one; that is what answers NO_CHANGE."
-    );
-  }
-  return lines;
-}
-function printPlan(plan, json) {
-  if (json) {
-    process.stdout.write(`${JSON.stringify(plan)}
-`);
-    return;
+// src/manifest.ts
+var import_yaml = __toESM(require_dist(), 1);
+function readManifest(path) {
+  let text;
+  try {
+    text = readFileSync2(path, "utf8");
+  } catch {
+    return { ok: false, message: `Could not read ${path}.` };
   }
-  const lines = [`${plan.action}${plan.manifestKey ? ` ${plan.manifestKey}` : ""}`];
-  for (const change of plan.changes ?? []) {
-    lines.push(`  ~ ${change.field}`);
-    lines.push(`      ${change.from} \u2192 ${change.to}`);
+  let parsed;
+  try {
+    parsed = (0, import_yaml.parse)(text, { prettyErrors: false });
+  } catch (error) {
+    return {
+      ok: false,
+      message: `${path} is not valid YAML or JSON${whereItFailed(text, error)}.`
+    };
   }
-  for (const reference of plan.references ?? []) {
-    lines.push(`  ${reference.property}`);
-    lines.push(
-      `      from ${reference.resourceKey}.${reference.output}${reference.secret ? " [secret]" : ""}`
-    );
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { ok: false, message: `${path} does not contain a manifest document.` };
   }
-  const bindings = plan.dependencyBindings ?? [];
-  if (bindings.length > 0) {
-    lines.push("  dependency bindings:");
-    for (const binding of bindings) {
-      lines.push(`    ${binding.dependencyKey}`);
-      lines.push(
-        `      resource:  ${binding.resourceKey}${binding.projectId ? ` (in ${binding.projectId})` : ""}`
-      );
-      if (binding.interfaceId !== void 0) {
-        lines.push(
-          `      interface: ${binding.interfaceId}${binding.interfaceVersion ? `/${binding.interfaceVersion}` : ""}`
-        );
+  return { ok: true, document: parsed };
+}
+function resolveSecrets(pairs, environment = process.env) {
+  const secrets = {};
+  for (const [index, pair] of pairs.entries()) {
+    const label = pairs.length === 1 ? "--secret" : `--secret #${index + 1}`;
+    const separator = pair.indexOf("=");
+    if (separator <= 0) {
+      return {
+        ok: false,
+        message: `${label} expects name=env:VARIABLE, and there is no name before "=".`
+      };
+    }
+    const name = pair.slice(0, separator);
+    const source = pair.slice(separator + 1);
+    if (!source.startsWith("env:")) {
+      return {
+        ok: false,
+        message: `${label} must read from the environment: --secret <name>=env:VARIABLE. A value on the command line is in your shell history and in the process table.`
+      };
+    }
+    const variable = source.slice("env:".length);
+    if (variable.length === 0) {
+      return { ok: false, message: `${label} names no variable after "env:".` };
+    }
+    const value = environment[variable];
+    if (value === void 0 || value === "") {
+      return {
+        ok: false,
+        message: `${label} reads an environment variable that is not set, or is empty.`
+      };
+    }
+    secrets[name] = value;
+  }
+  return { ok: true, secrets };
+}
+function manifestKeyOf(document) {
+  const metadata = document["metadata"];
+  if (typeof metadata !== "object" || metadata === null) return null;
+  const key = metadata["key"];
+  return typeof key === "string" ? key : null;
+}
+function whereItFailed(text, error) {
+  if (typeof error !== "object" || error === null) return "";
+  const code = error.code;
+  const pos = error.pos;
+  const kind = typeof code === "string" && /^[A-Z_]+$/.test(code) ? code : null;
+  const offset = Array.isArray(pos) && typeof pos[0] === "number" ? pos[0] : null;
+  if (offset === null) return kind ? ` (${kind})` : "";
+  const before = text.slice(0, offset);
+  const line = before.split("\n").length;
+  const column = offset - before.lastIndexOf("\n");
+  return ` (${kind ?? "error"} at line ${line}, column ${column})`;
+}
+function pinnedRelease(document) {
+  const spec = document["spec"];
+  if (typeof spec !== "object" || spec === null || Array.isArray(spec)) return null;
+  const { productId, productVersion } = spec;
+  if (typeof productId !== "string" || productId === "") return null;
+  if (typeof productVersion !== "string" || productVersion === "") return null;
+  return { productId, productVersion };
+}
+function carriesLiteralSettings(document) {
+  const configuration = configurationOf(document);
+  return configuration !== null && Object.values(configuration).some((value) => !looksLikeReference(value));
+}
+function pastedSecretSettings(document, view) {
+  const pinned = pinnedRelease(document);
+  if (!pinned || typeof view !== "object" || view === null) return [];
+  const { productId, version, configuration } = view;
+  if (productId !== pinned.productId || version !== pinned.productVersion) return [];
+  if (typeof configuration !== "object" || configuration === null) return [];
+  try {
+    return secretValuesInDocument(
+      configuration,
+      configurationOf(document)
+    );
+  } catch {
+    return [];
+  }
+}
+function configurationOf(document) {
+  const spec = document["spec"];
+  if (typeof spec !== "object" || spec === null || Array.isArray(spec)) return null;
+  const configuration = spec["configuration"];
+  if (typeof configuration !== "object" || configuration === null || Array.isArray(configuration)) {
+    return null;
+  }
+  return configuration;
+}
+
+// src/endpoint.ts
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function validateEndpoint(raw, source) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return { ok: false, message: `${source} is not a URL: "${raw}".` };
+  }
+  if (url.protocol === "https:") return { ok: true, endpoint: url.origin };
+  if (url.protocol === "http:" && isLoopback(url.hostname)) {
+    return { ok: true, endpoint: url.origin };
+  }
+  return {
+    ok: false,
+    message: `${source} must be https \u2014 a credential is sent to it, and "${url.protocol}//" would send it in the clear. Plain http is accepted for localhost only.`
+  };
+}
+
+// src/session.ts
+async function ensureSession(args) {
+  const stored = readStored();
+  const resolved = resolveEndpoint(args.endpointFlag, stored);
+  if (!resolved) {
+    return {
+      ok: false,
+      message: "No endpoint. Run `vfac context set --endpoint https://your-organization.cloud.vardeflyt.no`, or set VFAC_ENDPOINT."
+    };
+  }
+  const checked = validateEndpoint(resolved.value, resolved.source);
+  if (!checked.ok) return { ok: false, message: checked.message };
+  const endpoint = checked.endpoint;
+  const credential = credentialFromEnvironment();
+  if (args.forceExchange !== true && sessionUsable(stored.session, endpoint, args.now ?? /* @__PURE__ */ new Date(), credential?.keyId)) {
+    return { ok: true, ready: { endpoint, token: stored.session.token, stored, via: "stored" } };
+  }
+  const signedIn = await signIn({
+    endpoint,
+    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
+  });
+  if (!signedIn.ok) return { ok: false, message: signedIn.message };
+  const next = { ...stored, session: signedIn.session };
+  writeStored(next);
+  return {
+    ok: true,
+    ready: {
+      endpoint,
+      token: signedIn.session.token,
+      stored: next,
+      via: "exchanged",
+      ...signedIn.gate ? { gate: signedIn.gate } : {}
+    }
+  };
+}
+function resolveProject(flag, stored) {
+  return flag ?? stored.context?.projectId ?? null;
+}
+
+// src/operations.ts
+var OPERATION_STATUSES = [
+  "PENDING",
+  "RUNNING",
+  "SUCCEEDED",
+  "FAILED",
+  "CANCELLED"
+];
+var TERMINAL_STATUSES = ["SUCCEEDED", "FAILED", "CANCELLED"];
+var POLL_INTERVAL_MS = 5e3;
+var MAX_WAIT_MS = 60 * 60 * 1e3;
+function withProject(path, projectId) {
+  return projectId === null ? path : `${path}?project=${encodeURIComponent(projectId)}`;
+}
+function operationPath(operationId, projectId) {
+  return withProject(`/api/v1/operations/${encodeURIComponent(operationId)}`, projectId);
+}
+function classify(data) {
+  const status = data["status"];
+  if (typeof status !== "string") return "unknown";
+  if (TERMINAL_STATUSES.includes(status)) return "terminal";
+  if (OPERATION_STATUSES.includes(status)) return "working";
+  return "unknown";
+}
+async function readOperation(args) {
+  const result = await call({
+    endpoint: args.endpoint,
+    path: operationPath(args.operationId, args.projectId),
+    token: args.token,
+    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
+  });
+  return result.ok ? { ok: true, data: result.data } : { ok: false, error: result.error };
+}
+async function waitForOperation(args) {
+  const deps = args.deps ?? {};
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const deadline = now() + MAX_WAIT_MS;
+  let token = args.token;
+  let refreshed = false;
+  let last = null;
+  for (; ; ) {
+    const read = await readOperation({
+      endpoint: args.endpoint,
+      token,
+      operationId: args.operationId,
+      projectId: args.projectId,
+      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
+    });
+    if (!read.ok) {
+      if (read.error.status === 401 && !refreshed && deps.refreshToken) {
+        refreshed = true;
+        const next = await deps.refreshToken();
+        if (next !== null) {
+          token = next;
+          continue;
+        }
+      }
+      return { kind: "read-failed", error: read.error };
+    }
+    last = read.data;
+    const verdict = classify(read.data);
+    if (verdict === "terminal") {
+      return { kind: "settled", status: String(read.data["status"]), data: read.data };
+    }
+    if (verdict === "unknown") {
+      return { kind: "unknown-status", status: String(read.data["status"]), data: read.data };
+    }
+    args.onProgress?.(read.data);
+    if (now() + POLL_INTERVAL_MS >= deadline) return { kind: "timed-out", data: last };
+    await sleep(POLL_INTERVAL_MS);
+  }
+}
+function renderOperation(operationId, data) {
+  const status = String(data["status"] ?? "UNKNOWN");
+  const phase = data["phase"];
+  const lines = [
+    typeof phase === "string" && phase !== "" ? `${operationId}  ${status}  (${phase})` : `${operationId}  ${status}`
+  ];
+  const type = data["type"];
+  if (typeof type === "string") lines[0] += `  ${type}`;
+  const steps = Array.isArray(data["steps"]) ? data["steps"] : [];
+  if (steps.length > 0) {
+    lines.push("");
+    for (const step of steps) {
+      const state = String(step["state"] ?? "");
+      lines.push(`  ${markerFor(state)} ${String(step["label"] ?? step["key"] ?? "")}`);
+    }
+  }
+  const failure = asRecord(data["failure"]);
+  if (failure) {
+    lines.push("");
+    const stage = failure["stage"];
+    lines.push(`  Failed${typeof stage === "string" ? ` at ${stage}` : ""}`);
+    const summary = failure["summary"];
+    if (typeof summary === "string") lines.push(`    ${summary}`);
+    const cause = failure["cause"];
+    if (typeof cause === "string") lines.push(`    cause: ${cause}`);
+    const services = failure["services"];
+    if (Array.isArray(services)) {
+      for (const entry of services) {
+        const one = asRecord(entry);
+        if (one === null) continue;
+        const dependency = one["dependency"];
+        if (typeof dependency !== "string" || dependency === "") continue;
+        const code = one["code"];
+        lines.push(
+          typeof code === "string" && code !== "" ? `    ${dependency} \u2014 the service reported: ${code}` : `    ${dependency} \u2014 the service reported nothing usable`
+        );
+      }
+    }
+    const product = failure["product"];
+    const reportedSettings = [];
+    if (Array.isArray(product)) {
+      for (const entry of product) {
+        const one = asRecord(entry);
+        if (one === null) continue;
+        const component = one["component"];
+        const code = one["code"];
+        if (typeof component !== "string" || typeof code !== "string") continue;
+        if (component === "" || code === "") continue;
+        const setting = one["setting"];
+        if (typeof setting === "string" && setting !== "") {
+          reportedSettings.push(setting);
+          lines.push(`    ${component} refused to start: ${code} (setting: ${setting})`);
+        } else {
+          lines.push(`    ${component} refused to start: ${code}`);
+        }
+      }
+    }
+    const retryable = failure["retryable"];
+    if (typeof retryable === "boolean") {
+      const again = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "`vfac lifecycle upgrade <pri_\u2026>`" : "`vfac lifecycle reconcile <pri_\u2026>`";
+      const changeIt = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "" : ", or `vfac apply` a corrected manifest";
+      const cause2 = failure["cause"];
+      const named = reportedSettings[0];
+      lines.push(
+        retryable ? `    Another attempt can succeed: ${again}.` : named !== void 0 ? `    Correct \`${named}\` in your manifest, then \`vfac apply\` it${data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? ` and ${again}` : ""}. Repeating it unchanged fails the same way.` : cause2 === "unknown" ? `    The platform could not classify this, so there is nothing here to correct. Read the whole record with \`vfac get operation ${operationId} --output json\`, and quote that id if you ask for help. Repeating it unchanged fails the same way.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function markerFor(state) {
+  switch (state) {
+    case "completed":
+      return "\u2713";
+    case "failed":
+      return "\u2717";
+    case "active":
+      return "\u203A";
+    case "pending":
+      return "\xB7";
+    default:
+      return "-";
+  }
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+
+// src/render.ts
+function isUnconverged(plan) {
+  return plan.health !== void 0 && !plan.health.converged;
+}
+function secretWriteConsequence(plan) {
+  if ((plan.secretsToWrite ?? []).length === 0) return [];
+  const lines = ["the value you send REPLACES the stored one, and the resource redeploys."];
+  if (plan.action === "UPDATE" && (plan.changes ?? []).length === 0) {
+    lines.push("Nothing else changed \u2014 sending a secret is itself the change.");
+    lines.push(
+      "Omit --secret on a run that is not setting or changing one; that is what answers NO_CHANGE."
+    );
+  }
+  return lines;
+}
+function printPlan(plan, json) {
+  if (json) {
+    process.stdout.write(`${JSON.stringify(plan)}
+`);
+    return;
+  }
+  const lines = [`${plan.action}${plan.manifestKey ? ` ${plan.manifestKey}` : ""}`];
+  for (const change of plan.changes ?? []) {
+    lines.push(`  ~ ${change.field}`);
+    lines.push(`      ${change.from} \u2192 ${change.to}`);
+  }
+  for (const reference of plan.references ?? []) {
+    lines.push(`  ${reference.property}`);
+    lines.push(
+      `      from ${reference.resourceKey}.${reference.output}${reference.secret ? " [secret]" : ""}`
+    );
+  }
+  const bindings = plan.dependencyBindings ?? [];
+  if (bindings.length > 0) {
+    lines.push("  dependency bindings:");
+    for (const binding of bindings) {
+      lines.push(`    ${binding.dependencyKey}`);
+      lines.push(
+        `      resource:  ${binding.resourceKey}${binding.projectId ? ` (in ${binding.projectId})` : ""}`
+      );
+      if (binding.interfaceId !== void 0) {
+        lines.push(
+          `      interface: ${binding.interfaceId}${binding.interfaceVersion ? `/${binding.interfaceVersion}` : ""}`
+        );
       }
     }
   }
@@ -17206,6 +17747,12 @@ async function runApply(verb, parsed, deps = {}) {
     return 1;
   }
   const json = parsed.flags["output"] === "json";
+  const pasted = await pastedSecretsIn(manifest2.document, {
+    endpoint: session.ready.endpoint,
+    token: session.ready.token,
+    projectId
+  });
+  if (pasted.length > 0) return refusePastedSecrets(file, pasted, json);
   const path = `/api/v1/projects/${encodeURIComponent(projectId)}/manifest`;
   const envelope = {
     template: manifest2.document,
@@ -17399,6 +17946,39 @@ Read the operation that failed: \`vfac get operation <id>\`, or \`vfac get produ
     }
   }
 }
+async function pastedSecretsIn(document, target) {
+  const pinned = pinnedRelease(document);
+  if (!pinned || !carriesLiteralSettings(document)) return [];
+  const view = await call({
+    endpoint: target.endpoint,
+    path: `/api/v1/projects/${encodeURIComponent(target.projectId)}/products/${encodeURIComponent(pinned.productId)}`,
+    token: target.token
+  });
+  return view.ok ? pastedSecretSettings(document, view.data) : [];
+}
+function refusePastedSecrets(file, names, json) {
+  const fields = names.map(secretValueIssue);
+  if (json) {
+    return printError(
+      {
+        status: 400,
+        code: "REQUEST_INVALID",
+        message: `${file} contains a secret value, so it was not sent. Nothing was changed.`,
+        fields
+      },
+      true
+    );
+  }
+  for (const field of fields) {
+    process.stderr.write(`${field.field} contains a secret value.
+`);
+  }
+  process.stderr.write(
+    "\nSecrets must not be stored in a manifest, so this file was not sent and nothing was changed.\nRemove the value and supply it with:\n" + names.map((name) => `  --secret ${name}=env:VARIABLE
+`).join("") + "\nIf the value was a real credential and this file has been committed or shared,\nrotate it.\n"
+  );
+  return 1;
+}
 
 // src/commands/context.ts
 function runContext(parsed) {
@@ -17780,9 +18360,9 @@ var MAX_PAGES = 50;
 async function readAllPages(args) {
   const items = [];
   let cursor = args.cursor;
-  const onePage = args.cursor !== void 0 || args.pageSize !== void 0;
+  const onePage = args.onePage === true || args.cursor !== void 0 || args.pageSize !== void 0;
   for (let page = 0; page < MAX_PAGES; page += 1) {
-    const query = new URLSearchParams();
+    const query = new URLSearchParams(args.query ?? {});
     if (cursor !== void 0) query.set("cursor", cursor);
     if (args.pageSize !== void 0) query.set("pageSize", args.pageSize);
     const suffix = query.toString();
@@ -17817,7 +18397,7 @@ async function readAllPages(args) {
 }
 
 // src/commands/get.ts
-async function runGet(parsed) {
+async function runGet(parsed, deps = {}) {
   const noun = parsed.command[1];
   const json = parsed.flags["output"] === "json";
   const session = await ensureSession({ endpointFlag: parsed.flags["endpoint"] });
@@ -17894,8 +18474,10 @@ async function runGet(parsed) {
         const label = String(one["displayName"] ?? one["key"] ?? "");
         const state = String(one["state"] ?? "UNKNOWN");
         const reason = one["reason"];
+        const observedAt = one["observedAt"];
+        const stale = one["freshness"] === "STALE" && typeof observedAt === "string" ? `  [stale \u2014 last observed ${ageOf(observedAt, (deps.now ?? (() => /* @__PURE__ */ new Date()))())} ago]` : "";
         lines.push(
-          `    ${label.padEnd(width)}  ${state}${typeof reason === "string" && reason !== "" ? `  (${reason})` : ""}`
+          `    ${label.padEnd(width)}  ${state}${typeof reason === "string" && reason !== "" ? `  (${reason})` : ""}${stale}`
         );
         const description = one["description"];
         if (typeof description === "string") {
@@ -17932,6 +18514,10 @@ async function runGet(parsed) {
     if (allowed.length > 0) {
       lines.push("", `  You may: ${allowed.join(", ")}  (vfac lifecycle <command> ${instanceId})`);
     }
+    const notNow = (lifecycle["refused"] ?? []).filter(
+      (entry) => typeof entry["command"] === "string" && typeof entry["reason"] === "string" && entry["reason"] !== "permission_required"
+    ).map((entry) => `${String(entry["command"])} (${String(entry["reason"])})`);
+    if (notNow.length > 0) lines.push(`  Not now: ${notNow.join(", ")}`);
     process.stdout.write(`${lines.join("\n")}
 `);
     return 0;
@@ -17978,7 +18564,75 @@ This is one page. Continue with --cursor ${result.nextCursor ?? ""}
     }
     return 0;
   }
-  process.stderr.write("Usage: vfac get product-instances | vfac get operation op_\u2026\n");
+  if (noun === "operations") {
+    const projectId = resolveProject(parsed.flags["project"], session.ready.stored);
+    if (!projectId) {
+      process.stderr.write("No Project. Use --project prj_\u2026 or set one in your context.\n");
+      return 2;
+    }
+    const resource = parsed.flags["resource"];
+    const result = await readAllPages({
+      endpoint: session.ready.endpoint,
+      token: session.ready.token,
+      path: `/api/v1/projects/${encodeURIComponent(projectId)}/operations`,
+      key: "operations",
+      cursor: parsed.flags["cursor"],
+      pageSize: parsed.flags["page-size"],
+      onePage: true,
+      ...resource === void 0 ? {} : { query: { productInstanceId: resource } }
+    });
+    if (!result.ok) {
+      if (result.error.status === 404 && result.error.code === "NOT_FOUND") {
+        process.stderr.write(
+          "This Tenant Portal does not list operations yet \u2014 it is running an older build.\n"
+        );
+        return 1;
+      }
+      return printError(result.error, json);
+    }
+    if (json) {
+      process.stdout.write(
+        `${JSON.stringify({ operations: result.items, nextCursor: result.nextCursor })}
+`
+      );
+      return 0;
+    }
+    if (result.items.length === 0) {
+      process.stdout.write(
+        resource === void 0 ? "No operations in this project.\n" : "No operations for this resource in this project.\n"
+      );
+      return 0;
+    }
+    const rows = result.items.map((operation) => [
+      operation.operationId ?? "(no id)",
+      // `PRODUCT_INSTANCE_UPDATE` is every line's prefix and says nothing a
+      // reader scanning the column needs. JSON keeps the platform's word.
+      (operation.type ?? "").replace(/^PRODUCT_INSTANCE_/, ""),
+      operation.status ?? "",
+      operation.productInstanceId ?? "-",
+      operation.createdAt ?? ""
+    ]);
+    const widths = rows[0].map(
+      (_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length))
+    );
+    for (const row of rows) {
+      process.stdout.write(
+        `${row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column])).join("   ")}
+`
+      );
+    }
+    if (!result.complete) {
+      process.stderr.write(
+        `
+This is one page. Continue with --cursor ${result.nextCursor ?? ""}
+`
+      );
+    }
+    return 0;
+  }
+  process.stderr.write(
+    "Usage: vfac get product-instances | vfac get operation op_\u2026 | vfac get operations [--resource pri_\u2026]\n"
+  );
   return 2;
 }
 function wrapOutput(text, width) {
@@ -17995,6 +18649,13 @@ function wrapOutput(text, width) {
   if (current !== "") out.push(current);
   return out;
 }
+function ageOf(iso, now) {
+  const seconds = Math.max(0, Math.floor((now.getTime() - Date.parse(iso)) / 1e3));
+  if (Number.isNaN(seconds)) return "an unknown time";
+  if (seconds < 3600) return `${Math.max(1, Math.floor(seconds / 60))}m`;
+  if (seconds < 72 * 3600) return `${Math.floor(seconds / 3600)}h`;
+  return `${Math.floor(seconds / 86400)}d`;
+}
 
 // src/commands/product.ts
 async function runProduct(parsed) {
@@ -18601,6 +19262,7 @@ var USAGE = `vfac \u2014 deploy Varde Flyt resources from a manifest
   vfac get product-instances
   vfac get product-instance pri_\u2026        what it is, and its outputs
   vfac get operation op_\u2026
+  vfac get operations [--resource pri_\u2026]  newest first \u2014 find an operation id again
   vfac lifecycle <suspend|resume|upgrade|reconcile|delete> pri_\u2026
                      delete is irreversible and needs --yes
   vfac export product-instance pri_\u2026
@@ -18618,7 +19280,10 @@ Options
                   --secret inputs the apply will carry; without them the plan
                   answers about a different request. A value on the command line
                   is in your shell history and in the process table, so it is
-                  refused
+                  refused. A value for a secret setting written into the
+                  manifest itself is refused too: before the file is sent when it
+                  pins the release the catalog offers, by the platform otherwise
+      --resource  get operations: only that resource's history
       --product   which Product to write a starting manifest for
       --name      what a person will call the resource
       --key       its stable identity. Derived from --name when omitted
@@ -18646,8 +19311,10 @@ Reading the catalogue
   Products are read UNDER a Project, because that is the scope a credential is
   granted in. Pass --project, or store one with: vfac context set --project prj_\u2026
 
-  project list and product list read the WHOLE list, following the server's
-  cursor. Pass --cursor or --page-size only when you want a single page.
+  project list, product list and get product-instances read the WHOLE list,
+  following the server's cursor. Pass --cursor or --page-size only when you want
+  a single page. get operations reads ONE page, newest first \u2014 a history only
+  grows \u2014 and prints the --cursor that continues into older operations.
 
 Authentication
   As yourself:  vfac login \u2014 approve the code in your browser. The terminal then