@varde-flyt/vfac 0.13.0 → 0.14.1

package/README.md

@@ -80,8 +80,18 @@ vfac get operation <operationId>
 vfac get product-instance <productInstanceId>
 ```
 
+Lost the operation id — a terminal that closed, a CI log nobody kept? The
+operations of a resource are listed newest first, one page at a time; the
+`--cursor` for older ones is printed, and is `nextCursor` in JSON:
+
+```sh
+vfac get operations --resource <productInstanceId>
+```
+
 Secrets are supplied per apply and never belong in the manifest — a manifest is a
-file you commit. **Plan the run that sets one with the same `--secret` inputs the
+file you commit. A value for a setting the Product declares secret is refused
+at every door by the platform, and by `vfac` before the file is sent when the
+file pins the release the catalog currently offers. **Plan the run that sets one with the same `--secret` inputs the
 apply will carry**: `plan` takes the flag exactly as `apply` does, and without it
 the plan describes a different request.
 
@@ -182,7 +192,9 @@ spec:
 
 `vfac manifest init` names the exact property for every dependency you have to
 choose, and `vfac plan` prints the connections an apply would establish before
-you approve it. The dependency key comes from the Product, not from you —
+you approve it. A resource in this Project that cannot provide the connection is
+refused on `spec.dependencyBindings.<dependency-key>`, saying why; one named in
+another Project answers only that it could not be used. The dependency key comes from the Product, not from you —
 `vfac product show <productId>` lists every dependency with its key, its
 capability, and whether a setting is what turns it on.
 
@@ -214,6 +226,7 @@ vfac product show <productId> --output json
 vfac plan -f resource.yaml --output json
 vfac get product-instance <productInstanceId> --output json
 vfac get product-instances --output json
+vfac get operations --resource <productInstanceId> --output json
 ```
 
 **Decide from the action, not from the exit code.** A plan that REFUSES still
@@ -235,8 +248,9 @@ The envelopes are stable at the top level:
 
 | Command | Answers with |
 | --- | --- |
-| `vfac get product-instance <id> --output json` | `resource` and `lifecycle` — `status`, `outputs` and `conditions` are under `resource` |
+| `vfac get product-instance <id> --output json` | `resource` and `lifecycle` — `status`, `outputs` and `conditions` are under `resource`; each condition carries `state` and `freshness` (`FRESH`, or `STALE` when not re-confirmed recently), and `lifecycle.refused[]` carries a `reason` |
 | `vfac get product-instances --output json` | `productInstances` and `nextCursor` |
+| `vfac get operations --resource <productInstanceId> --output json` | `operations` and `nextCursor` — one page, newest first, and `nextCursor` reads older ones; each line is `operationId`, `type`, `status`, `phase` and its timestamps |
 
 `vfac guide` is authoritative for what is inside them.
 

package/dist/vfac.mjs

@@ -7378,6 +7378,8 @@ var VALUED = /* @__PURE__ */ new Set([
   // an organization and part of a catalogue, silently, once either passed 25.
   "cursor",
   "page-size",
+  // `get operations --resource pri_…`: the history of one resource.
+  "resource",
   "product",
   "name",
   "key",
@@ -7700,283 +7702,7 @@ async function probeMachineApi(args) {
 }
 
 // src/manifest.ts
-var import_yaml = __toESM(require_dist(), 1);
 import { readFileSync as readFileSync2 } from "node:fs";
-function readManifest(path) {
-  let text;
-  try {
-    text = readFileSync2(path, "utf8");
-  } catch {
-    return { ok: false, message: `Could not read ${path}.` };
-  }
-  let parsed;
-  try {
-    parsed = (0, import_yaml.parse)(text);
-  } catch (error) {
-    return {
-      ok: false,
-      message: `${path} is not valid YAML or JSON: ${error instanceof Error ? error.message : "unknown error"}`
-    };
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return { ok: false, message: `${path} does not contain a manifest document.` };
-  }
-  return { ok: true, document: parsed };
-}
-function resolveSecrets(pairs, environment = process.env) {
-  const secrets = {};
-  for (const pair of pairs) {
-    const separator = pair.indexOf("=");
-    if (separator <= 0) {
-      return { ok: false, message: `--secret expects name=env:VARIABLE, got "${pair}".` };
-    }
-    const name = pair.slice(0, separator);
-    const source = pair.slice(separator + 1);
-    if (!source.startsWith("env:")) {
-      return {
-        ok: false,
-        message: `--secret ${name} must read from the environment: --secret ${name}=env:VARIABLE. A value on the command line is in your shell history and in the process table.`
-      };
-    }
-    const variable = source.slice("env:".length);
-    if (variable.length === 0) {
-      return { ok: false, message: `--secret ${name}=env: names no variable.` };
-    }
-    const value = environment[variable];
-    if (value === void 0 || value === "") {
-      return { ok: false, message: `${variable} is not set, so ${name} has no value.` };
-    }
-    secrets[name] = value;
-  }
-  return { ok: true, secrets };
-}
-function manifestKeyOf(document) {
-  const metadata = document["metadata"];
-  if (typeof metadata !== "object" || metadata === null) return null;
-  const key = metadata["key"];
-  return typeof key === "string" ? key : null;
-}
-
-// src/endpoint.ts
-function isLoopback(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function validateEndpoint(raw, source) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return { ok: false, message: `${source} is not a URL: "${raw}".` };
-  }
-  if (url.protocol === "https:") return { ok: true, endpoint: url.origin };
-  if (url.protocol === "http:" && isLoopback(url.hostname)) {
-    return { ok: true, endpoint: url.origin };
-  }
-  return {
-    ok: false,
-    message: `${source} must be https \u2014 a credential is sent to it, and "${url.protocol}//" would send it in the clear. Plain http is accepted for localhost only.`
-  };
-}
-
-// src/session.ts
-async function ensureSession(args) {
-  const stored = readStored();
-  const resolved = resolveEndpoint(args.endpointFlag, stored);
-  if (!resolved) {
-    return {
-      ok: false,
-      message: "No endpoint. Run `vfac context set --endpoint https://your-organization.cloud.vardeflyt.no`, or set VFAC_ENDPOINT."
-    };
-  }
-  const checked = validateEndpoint(resolved.value, resolved.source);
-  if (!checked.ok) return { ok: false, message: checked.message };
-  const endpoint = checked.endpoint;
-  const credential = credentialFromEnvironment();
-  if (args.forceExchange !== true && sessionUsable(stored.session, endpoint, args.now ?? /* @__PURE__ */ new Date(), credential?.keyId)) {
-    return { ok: true, ready: { endpoint, token: stored.session.token, stored, via: "stored" } };
-  }
-  const signedIn = await signIn({
-    endpoint,
-    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
-  });
-  if (!signedIn.ok) return { ok: false, message: signedIn.message };
-  const next = { ...stored, session: signedIn.session };
-  writeStored(next);
-  return {
-    ok: true,
-    ready: {
-      endpoint,
-      token: signedIn.session.token,
-      stored: next,
-      via: "exchanged",
-      ...signedIn.gate ? { gate: signedIn.gate } : {}
-    }
-  };
-}
-function resolveProject(flag, stored) {
-  return flag ?? stored.context?.projectId ?? null;
-}
-
-// src/operations.ts
-var OPERATION_STATUSES = [
-  "PENDING",
-  "RUNNING",
-  "SUCCEEDED",
-  "FAILED",
-  "CANCELLED"
-];
-var TERMINAL_STATUSES = ["SUCCEEDED", "FAILED", "CANCELLED"];
-var POLL_INTERVAL_MS = 5e3;
-var MAX_WAIT_MS = 60 * 60 * 1e3;
-function withProject(path, projectId) {
-  return projectId === null ? path : `${path}?project=${encodeURIComponent(projectId)}`;
-}
-function operationPath(operationId, projectId) {
-  return withProject(`/api/v1/operations/${encodeURIComponent(operationId)}`, projectId);
-}
-function classify(data) {
-  const status = data["status"];
-  if (typeof status !== "string") return "unknown";
-  if (TERMINAL_STATUSES.includes(status)) return "terminal";
-  if (OPERATION_STATUSES.includes(status)) return "working";
-  return "unknown";
-}
-async function readOperation(args) {
-  const result = await call({
-    endpoint: args.endpoint,
-    path: operationPath(args.operationId, args.projectId),
-    token: args.token,
-    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
-  });
-  return result.ok ? { ok: true, data: result.data } : { ok: false, error: result.error };
-}
-async function waitForOperation(args) {
-  const deps = args.deps ?? {};
-  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = deps.now ?? (() => Date.now());
-  const deadline = now() + MAX_WAIT_MS;
-  let token = args.token;
-  let refreshed = false;
-  let last = null;
-  for (; ; ) {
-    const read = await readOperation({
-      endpoint: args.endpoint,
-      token,
-      operationId: args.operationId,
-      projectId: args.projectId,
-      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-    });
-    if (!read.ok) {
-      if (read.error.status === 401 && !refreshed && deps.refreshToken) {
-        refreshed = true;
-        const next = await deps.refreshToken();
-        if (next !== null) {
-          token = next;
-          continue;
-        }
-      }
-      return { kind: "read-failed", error: read.error };
-    }
-    last = read.data;
-    const verdict = classify(read.data);
-    if (verdict === "terminal") {
-      return { kind: "settled", status: String(read.data["status"]), data: read.data };
-    }
-    if (verdict === "unknown") {
-      return { kind: "unknown-status", status: String(read.data["status"]), data: read.data };
-    }
-    args.onProgress?.(read.data);
-    if (now() + POLL_INTERVAL_MS >= deadline) return { kind: "timed-out", data: last };
-    await sleep(POLL_INTERVAL_MS);
-  }
-}
-function renderOperation(operationId, data) {
-  const status = String(data["status"] ?? "UNKNOWN");
-  const phase = data["phase"];
-  const lines = [
-    typeof phase === "string" && phase !== "" ? `${operationId}  ${status}  (${phase})` : `${operationId}  ${status}`
-  ];
-  const type = data["type"];
-  if (typeof type === "string") lines[0] += `  ${type}`;
-  const steps = Array.isArray(data["steps"]) ? data["steps"] : [];
-  if (steps.length > 0) {
-    lines.push("");
-    for (const step of steps) {
-      const state = String(step["state"] ?? "");
-      lines.push(`  ${markerFor(state)} ${String(step["label"] ?? step["key"] ?? "")}`);
-    }
-  }
-  const failure = asRecord(data["failure"]);
-  if (failure) {
-    lines.push("");
-    const stage = failure["stage"];
-    lines.push(`  Failed${typeof stage === "string" ? ` at ${stage}` : ""}`);
-    const summary = failure["summary"];
-    if (typeof summary === "string") lines.push(`    ${summary}`);
-    const cause = failure["cause"];
-    if (typeof cause === "string") lines.push(`    cause: ${cause}`);
-    const services = failure["services"];
-    if (Array.isArray(services)) {
-      for (const entry of services) {
-        const one = asRecord(entry);
-        if (one === null) continue;
-        const dependency = one["dependency"];
-        if (typeof dependency !== "string" || dependency === "") continue;
-        const code = one["code"];
-        lines.push(
-          typeof code === "string" && code !== "" ? `    ${dependency} \u2014 the service reported: ${code}` : `    ${dependency} \u2014 the service reported nothing usable`
-        );
-      }
-    }
-    const product = failure["product"];
-    const reportedSettings = [];
-    if (Array.isArray(product)) {
-      for (const entry of product) {
-        const one = asRecord(entry);
-        if (one === null) continue;
-        const component = one["component"];
-        const code = one["code"];
-        if (typeof component !== "string" || typeof code !== "string") continue;
-        if (component === "" || code === "") continue;
-        const setting = one["setting"];
-        if (typeof setting === "string" && setting !== "") {
-          reportedSettings.push(setting);
-          lines.push(`    ${component} refused to start: ${code} (setting: ${setting})`);
-        } else {
-          lines.push(`    ${component} refused to start: ${code}`);
-        }
-      }
-    }
-    const retryable = failure["retryable"];
-    if (typeof retryable === "boolean") {
-      const again = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "`vfac lifecycle upgrade <pri_\u2026>`" : "`vfac lifecycle reconcile <pri_\u2026>`";
-      const changeIt = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "" : ", or `vfac apply` a corrected manifest";
-      const cause2 = failure["cause"];
-      const named = reportedSettings[0];
-      lines.push(
-        retryable ? `    Another attempt can succeed: ${again}.` : named !== void 0 ? `    Correct \`${named}\` in your manifest, then \`vfac apply\` it${data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? ` and ${again}` : ""}. Repeating it unchanged fails the same way.` : cause2 === "unknown" ? `    The platform could not classify this, so there is nothing here to correct. Read the whole record with \`vfac get operation ${operationId} --output json\`, and quote that id if you ask for help. Repeating it unchanged fails the same way.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
-      );
-    }
-  }
-  return lines.join("\n");
-}
-function markerFor(state) {
-  switch (state) {
-    case "completed":
-      return "\u2713";
-    case "failed":
-      return "\u2717";
-    case "active":
-      return "\u203A";
-    case "pending":
-      return "\xB7";
-    default:
-      return "-";
-  }
-}
-function asRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-}
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -13790,6 +13516,9 @@ function withoutPropertyRules(properties) {
   }
   return out;
 }
+function declaredSecretNames(schema) {
+  return Object.entries(schema.properties).filter(([, property]) => isSecretProperty(property)).map(([name]) => name).sort();
+}
 function defaultOf(property) {
   switch (property.type) {
     case "string":
@@ -17289,7 +17018,23 @@ function isTerminalAction(action) {
 var ManifestActionSchema = external_exports.enum(MANIFEST_ACTIONS);
 
 // ../product-contracts/dist/contract-issue.js
+var PATH_SEGMENT = /^[A-Za-z_][A-Za-z0-9_-]{0,63}$/;
+var UNPRINTABLE_SEGMENT = "<unprintable>";
 var MAX_SEGMENTS = MAX_CONFIGURATION_PATH_SEGMENTS + 2;
+function printableContractPath(path) {
+  const printable = path.slice(0, MAX_SEGMENTS).map((segment) => typeof segment === "number" || PATH_SEGMENT.test(segment) ? String(segment) : UNPRINTABLE_SEGMENT);
+  return printable.join(".") || "(document)";
+}
+function manifestConfigurationField(field) {
+  if (field === "")
+    return "spec.configuration";
+  const parsed = parseConfigurationPath(field);
+  return printableContractPath([
+    "spec",
+    "configuration",
+    ...parsed === null ? [field] : pathSegments(parsed)
+  ]);
+}
 
 // ../product-contracts/dist/resource-output-reference.js
 var OUTPUT_KEY_RULE = "Output keys are camelCase.";
@@ -17303,6 +17048,9 @@ var ResourceOutputReferenceSchema = external_exports.object({
     }).strict()
   }).strict()
 }).strict();
+function looksLikeReference(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && "valueFrom" in value;
+}
 
 // ../product-contracts/dist/dependency-binding.js
 var DependencyBindingSelectorSchema = external_exports.object({
@@ -17438,6 +17186,23 @@ var ProductInstanceTemplateSchema = external_exports.object({
     dependencyBindings: DependencyBindingsSchema.optional()
   }).strict()
 }).strict();
+function secretValuesInDocument(schema, configuration) {
+  if (!isPlainRecord(configuration) || !isPlainRecord(schema.properties))
+    return [];
+  const declarations = Object.fromEntries(Object.entries(schema.properties).filter(([, property]) => isPlainRecord(property)));
+  return declaredSecretNames({
+    properties: declarations
+  }).filter((name) => Object.hasOwn(configuration, name) && !looksLikeReference(configuration[name]));
+}
+function secretValueIssue(name) {
+  return {
+    field: manifestConfigurationField(name),
+    message: `"${name}" is secret input and must never appear in a template. Supply it separately when applying, so it goes to the secret manager rather than into a document.`
+  };
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 
 // ../product-contracts/dist/product-submission.schema.js
 var PRODUCT_SUBMISSION_KIND = "ProductSubmission";
@@ -17506,36 +17271,369 @@ function checkProductSubmission(submission, ctx) {
     });
   }
 }
-var PUBLISH_RULE_ANNEX = {
-  allOf: [
-    {
-      $comment: 'displayName reads "<Product name> \u2014 <Short description>": an em dash (U+2014) with one space on each side. A hyphen and an en dash are different characters and are refused.',
-      properties: {
-        definition: { properties: { displayName: { pattern: PRODUCT_DISPLAY_NAME_PATTERN } } }
+var PUBLISH_RULE_ANNEX = {
+  allOf: [
+    {
+      $comment: 'displayName reads "<Product name> \u2014 <Short description>": an em dash (U+2014) with one space on each side. A hyphen and an en dash are different characters and are refused.',
+      properties: {
+        definition: { properties: { displayName: { pattern: PRODUCT_DISPLAY_NAME_PATTERN } } }
+      }
+    },
+    {
+      // THE SAME ASYMMETRY, one field along. `portfolio` is optional on a
+      // Definition because frozen releases carry none; a Submission is by
+      // construction a new release, so it must say where the Product belongs.
+      // The `enum` is the LIVE list — narrower than the Definition's, which
+      // still admits the retired ids a stored document may name.
+      $comment: "A new release must declare portfolio.category, the catalog section a customer finds this Product under. Retired section ids still parse in a published Definition but may not be published again.",
+      properties: {
+        definition: {
+          required: ["portfolio"],
+          properties: {
+            portfolio: {
+              required: ["category"],
+              properties: { category: { enum: [...PORTFOLIO_CATEGORY_IDS] } }
+            }
+          }
+        }
+      }
+    }
+  ]
+};
+withJsonSchemaAnnex(ProductSubmissionSchema, PUBLISH_RULE_ANNEX);
+
+// src/manifest.ts
+var import_yaml = __toESM(require_dist(), 1);
+function readManifest(path) {
+  let text;
+  try {
+    text = readFileSync2(path, "utf8");
+  } catch {
+    return { ok: false, message: `Could not read ${path}.` };
+  }
+  let parsed;
+  try {
+    parsed = (0, import_yaml.parse)(text, { prettyErrors: false });
+  } catch (error) {
+    return {
+      ok: false,
+      message: `${path} is not valid YAML or JSON${whereItFailed(text, error)}.`
+    };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { ok: false, message: `${path} does not contain a manifest document.` };
+  }
+  return { ok: true, document: parsed };
+}
+function resolveSecrets(pairs, environment = process.env) {
+  const secrets = {};
+  for (const [index, pair] of pairs.entries()) {
+    const label = pairs.length === 1 ? "--secret" : `--secret #${index + 1}`;
+    const separator = pair.indexOf("=");
+    if (separator <= 0) {
+      return {
+        ok: false,
+        message: `${label} expects name=env:VARIABLE, and there is no name before "=".`
+      };
+    }
+    const name = pair.slice(0, separator);
+    const source = pair.slice(separator + 1);
+    if (!source.startsWith("env:")) {
+      return {
+        ok: false,
+        message: `${label} must read from the environment: --secret <name>=env:VARIABLE. A value on the command line is in your shell history and in the process table.`
+      };
+    }
+    const variable = source.slice("env:".length);
+    if (variable.length === 0) {
+      return { ok: false, message: `${label} names no variable after "env:".` };
+    }
+    const value = environment[variable];
+    if (value === void 0 || value === "") {
+      return {
+        ok: false,
+        message: `${label} reads an environment variable that is not set, or is empty.`
+      };
+    }
+    secrets[name] = value;
+  }
+  return { ok: true, secrets };
+}
+function manifestKeyOf(document) {
+  const metadata = document["metadata"];
+  if (typeof metadata !== "object" || metadata === null) return null;
+  const key = metadata["key"];
+  return typeof key === "string" ? key : null;
+}
+function whereItFailed(text, error) {
+  if (typeof error !== "object" || error === null) return "";
+  const code = error.code;
+  const pos = error.pos;
+  const kind = typeof code === "string" && /^[A-Z_]+$/.test(code) ? code : null;
+  const offset = Array.isArray(pos) && typeof pos[0] === "number" ? pos[0] : null;
+  if (offset === null) return kind ? ` (${kind})` : "";
+  const before = text.slice(0, offset);
+  const line = before.split("\n").length;
+  const column = offset - before.lastIndexOf("\n");
+  return ` (${kind ?? "error"} at line ${line}, column ${column})`;
+}
+function pinnedRelease(document) {
+  const spec = document["spec"];
+  if (typeof spec !== "object" || spec === null || Array.isArray(spec)) return null;
+  const { productId, productVersion } = spec;
+  if (typeof productId !== "string" || productId === "") return null;
+  if (typeof productVersion !== "string" || productVersion === "") return null;
+  return { productId, productVersion };
+}
+function carriesLiteralSettings(document) {
+  const configuration = configurationOf(document);
+  return configuration !== null && Object.values(configuration).some((value) => !looksLikeReference(value));
+}
+function pastedSecretSettings(document, view) {
+  const pinned = pinnedRelease(document);
+  if (!pinned || typeof view !== "object" || view === null) return [];
+  const { productId, version, configuration } = view;
+  if (productId !== pinned.productId || version !== pinned.productVersion) return [];
+  if (typeof configuration !== "object" || configuration === null) return [];
+  try {
+    return secretValuesInDocument(
+      configuration,
+      configurationOf(document)
+    );
+  } catch {
+    return [];
+  }
+}
+function configurationOf(document) {
+  const spec = document["spec"];
+  if (typeof spec !== "object" || spec === null || Array.isArray(spec)) return null;
+  const configuration = spec["configuration"];
+  if (typeof configuration !== "object" || configuration === null || Array.isArray(configuration)) {
+    return null;
+  }
+  return configuration;
+}
+
+// src/endpoint.ts
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function validateEndpoint(raw, source) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return { ok: false, message: `${source} is not a URL: "${raw}".` };
+  }
+  if (url.protocol === "https:") return { ok: true, endpoint: url.origin };
+  if (url.protocol === "http:" && isLoopback(url.hostname)) {
+    return { ok: true, endpoint: url.origin };
+  }
+  return {
+    ok: false,
+    message: `${source} must be https \u2014 a credential is sent to it, and "${url.protocol}//" would send it in the clear. Plain http is accepted for localhost only.`
+  };
+}
+
+// src/session.ts
+async function ensureSession(args) {
+  const stored = readStored();
+  const resolved = resolveEndpoint(args.endpointFlag, stored);
+  if (!resolved) {
+    return {
+      ok: false,
+      message: "No endpoint. Run `vfac context set --endpoint https://your-organization.cloud.vardeflyt.no`, or set VFAC_ENDPOINT."
+    };
+  }
+  const checked = validateEndpoint(resolved.value, resolved.source);
+  if (!checked.ok) return { ok: false, message: checked.message };
+  const endpoint = checked.endpoint;
+  const credential = credentialFromEnvironment();
+  if (args.forceExchange !== true && sessionUsable(stored.session, endpoint, args.now ?? /* @__PURE__ */ new Date(), credential?.keyId)) {
+    return { ok: true, ready: { endpoint, token: stored.session.token, stored, via: "stored" } };
+  }
+  const signedIn = await signIn({
+    endpoint,
+    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
+  });
+  if (!signedIn.ok) return { ok: false, message: signedIn.message };
+  const next = { ...stored, session: signedIn.session };
+  writeStored(next);
+  return {
+    ok: true,
+    ready: {
+      endpoint,
+      token: signedIn.session.token,
+      stored: next,
+      via: "exchanged",
+      ...signedIn.gate ? { gate: signedIn.gate } : {}
+    }
+  };
+}
+function resolveProject(flag, stored) {
+  return flag ?? stored.context?.projectId ?? null;
+}
+
+// src/operations.ts
+var OPERATION_STATUSES = [
+  "PENDING",
+  "RUNNING",
+  "SUCCEEDED",
+  "FAILED",
+  "CANCELLED"
+];
+var TERMINAL_STATUSES = ["SUCCEEDED", "FAILED", "CANCELLED"];
+var POLL_INTERVAL_MS = 5e3;
+var MAX_WAIT_MS = 60 * 60 * 1e3;
+function withProject(path, projectId) {
+  return projectId === null ? path : `${path}?project=${encodeURIComponent(projectId)}`;
+}
+function operationPath(operationId, projectId) {
+  return withProject(`/api/v1/operations/${encodeURIComponent(operationId)}`, projectId);
+}
+function classify(data) {
+  const status = data["status"];
+  if (typeof status !== "string") return "unknown";
+  if (TERMINAL_STATUSES.includes(status)) return "terminal";
+  if (OPERATION_STATUSES.includes(status)) return "working";
+  return "unknown";
+}
+async function readOperation(args) {
+  const result = await call({
+    endpoint: args.endpoint,
+    path: operationPath(args.operationId, args.projectId),
+    token: args.token,
+    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
+  });
+  return result.ok ? { ok: true, data: result.data } : { ok: false, error: result.error };
+}
+async function waitForOperation(args) {
+  const deps = args.deps ?? {};
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const deadline = now() + MAX_WAIT_MS;
+  let token = args.token;
+  let refreshed = false;
+  let last = null;
+  for (; ; ) {
+    const read = await readOperation({
+      endpoint: args.endpoint,
+      token,
+      operationId: args.operationId,
+      projectId: args.projectId,
+      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
+    });
+    if (!read.ok) {
+      if (read.error.status === 401 && !refreshed && deps.refreshToken) {
+        refreshed = true;
+        const next = await deps.refreshToken();
+        if (next !== null) {
+          token = next;
+          continue;
+        }
+      }
+      return { kind: "read-failed", error: read.error };
+    }
+    last = read.data;
+    const verdict = classify(read.data);
+    if (verdict === "terminal") {
+      return { kind: "settled", status: String(read.data["status"]), data: read.data };
+    }
+    if (verdict === "unknown") {
+      return { kind: "unknown-status", status: String(read.data["status"]), data: read.data };
+    }
+    args.onProgress?.(read.data);
+    if (now() + POLL_INTERVAL_MS >= deadline) return { kind: "timed-out", data: last };
+    await sleep(POLL_INTERVAL_MS);
+  }
+}
+function renderOperation(operationId, data) {
+  const status = String(data["status"] ?? "UNKNOWN");
+  const phase = data["phase"];
+  const lines = [
+    typeof phase === "string" && phase !== "" ? `${operationId}  ${status}  (${phase})` : `${operationId}  ${status}`
+  ];
+  const type = data["type"];
+  if (typeof type === "string") lines[0] += `  ${type}`;
+  const steps = Array.isArray(data["steps"]) ? data["steps"] : [];
+  if (steps.length > 0) {
+    lines.push("");
+    for (const step of steps) {
+      const state = String(step["state"] ?? "");
+      lines.push(`  ${markerFor(state)} ${String(step["label"] ?? step["key"] ?? "")}`);
+    }
+  }
+  const failure = asRecord(data["failure"]);
+  if (failure) {
+    lines.push("");
+    const stage = failure["stage"];
+    lines.push(`  Failed${typeof stage === "string" ? ` at ${stage}` : ""}`);
+    const summary = failure["summary"];
+    if (typeof summary === "string") lines.push(`    ${summary}`);
+    const cause = failure["cause"];
+    if (typeof cause === "string") lines.push(`    cause: ${cause}`);
+    const services = failure["services"];
+    if (Array.isArray(services)) {
+      for (const entry of services) {
+        const one = asRecord(entry);
+        if (one === null) continue;
+        const dependency = one["dependency"];
+        if (typeof dependency !== "string" || dependency === "") continue;
+        const code = one["code"];
+        lines.push(
+          typeof code === "string" && code !== "" ? `    ${dependency} \u2014 the service reported: ${code}` : `    ${dependency} \u2014 the service reported nothing usable`
+        );
       }
-    },
-    {
-      // THE SAME ASYMMETRY, one field along. `portfolio` is optional on a
-      // Definition because frozen releases carry none; a Submission is by
-      // construction a new release, so it must say where the Product belongs.
-      // The `enum` is the LIVE list — narrower than the Definition's, which
-      // still admits the retired ids a stored document may name.
-      $comment: "A new release must declare portfolio.category, the catalog section a customer finds this Product under. Retired section ids still parse in a published Definition but may not be published again.",
-      properties: {
-        definition: {
-          required: ["portfolio"],
-          properties: {
-            portfolio: {
-              required: ["category"],
-              properties: { category: { enum: [...PORTFOLIO_CATEGORY_IDS] } }
-            }
-          }
+    }
+    const product = failure["product"];
+    const reportedSettings = [];
+    if (Array.isArray(product)) {
+      for (const entry of product) {
+        const one = asRecord(entry);
+        if (one === null) continue;
+        const component = one["component"];
+        const code = one["code"];
+        if (typeof component !== "string" || typeof code !== "string") continue;
+        if (component === "" || code === "") continue;
+        const setting = one["setting"];
+        if (typeof setting === "string" && setting !== "") {
+          reportedSettings.push(setting);
+          lines.push(`    ${component} refused to start: ${code} (setting: ${setting})`);
+        } else {
+          lines.push(`    ${component} refused to start: ${code}`);
         }
       }
     }
-  ]
-};
-withJsonSchemaAnnex(ProductSubmissionSchema, PUBLISH_RULE_ANNEX);
+    const retryable = failure["retryable"];
+    if (typeof retryable === "boolean") {
+      const again = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "`vfac lifecycle upgrade <pri_\u2026>`" : "`vfac lifecycle reconcile <pri_\u2026>`";
+      const changeIt = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "" : ", or `vfac apply` a corrected manifest";
+      const cause2 = failure["cause"];
+      const named = reportedSettings[0];
+      lines.push(
+        retryable ? `    Another attempt can succeed: ${again}.` : named !== void 0 ? `    Correct \`${named}\` in your manifest, then \`vfac apply\` it${data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? ` and ${again}` : ""}. Repeating it unchanged fails the same way.` : cause2 === "unknown" ? `    The platform could not classify this, so there is nothing here to correct. Read the whole record with \`vfac get operation ${operationId} --output json\`, and quote that id if you ask for help. Repeating it unchanged fails the same way.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function markerFor(state) {
+  switch (state) {
+    case "completed":
+      return "\u2713";
+    case "failed":
+      return "\u2717";
+    case "active":
+      return "\u203A";
+    case "pending":
+      return "\xB7";
+    default:
+      return "-";
+  }
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
 
 // src/render.ts
 function isUnconverged(plan) {
@@ -17649,6 +17747,12 @@ async function runApply(verb, parsed, deps = {}) {
     return 1;
   }
   const json = parsed.flags["output"] === "json";
+  const pasted = await pastedSecretsIn(manifest2.document, {
+    endpoint: session.ready.endpoint,
+    token: session.ready.token,
+    projectId
+  });
+  if (pasted.length > 0) return refusePastedSecrets(file, pasted, json);
   const path = `/api/v1/projects/${encodeURIComponent(projectId)}/manifest`;
   const envelope = {
     template: manifest2.document,
@@ -17842,6 +17946,39 @@ Read the operation that failed: \`vfac get operation <id>\`, or \`vfac get produ
     }
   }
 }
+async function pastedSecretsIn(document, target) {
+  const pinned = pinnedRelease(document);
+  if (!pinned || !carriesLiteralSettings(document)) return [];
+  const view = await call({
+    endpoint: target.endpoint,
+    path: `/api/v1/projects/${encodeURIComponent(target.projectId)}/products/${encodeURIComponent(pinned.productId)}`,
+    token: target.token
+  });
+  return view.ok ? pastedSecretSettings(document, view.data) : [];
+}
+function refusePastedSecrets(file, names, json) {
+  const fields = names.map(secretValueIssue);
+  if (json) {
+    return printError(
+      {
+        status: 400,
+        code: "REQUEST_INVALID",
+        message: `${file} contains a secret value, so it was not sent. Nothing was changed.`,
+        fields
+      },
+      true
+    );
+  }
+  for (const field of fields) {
+    process.stderr.write(`${field.field} contains a secret value.
+`);
+  }
+  process.stderr.write(
+    "\nSecrets must not be stored in a manifest, so this file was not sent and nothing was changed.\nRemove the value and supply it with:\n" + names.map((name) => `  --secret ${name}=env:VARIABLE
+`).join("") + "\nIf the value was a real credential and this file has been committed or shared,\nrotate it.\n"
+  );
+  return 1;
+}
 
 // src/commands/context.ts
 function runContext(parsed) {
@@ -18025,21 +18162,32 @@ async function runDoctor(parsed) {
   const mutating = access.projects.filter(
     (project) => project.permissions.some((permission) => !permission.endsWith(".read"))
   );
+  const organizationWide = access.tenantPermissions.includes("project.read");
+  const alsoOrganizationWide = access.tenantPermissions.length > 0 ? `Organization-wide it holds ${access.tenantPermissions.join(", ")}, which reaches no Project. ` : "";
+  const perProject = projects.length === 0 ? "" : `. Granted per Project: ${projects.join(", ")}` + (mutating.length > 0 ? ` \u2014 you can deploy in ${mutating.map((project) => project.projectId).join(", ")}` : " \u2014 read-only there");
   checks.push(
-    access.tenantWide ? {
+    organizationWide ? {
       name: "Access",
       ok: true,
-      detail: `the whole organization \u2014 ${access.tenantPermissions.join(", ")}`,
-      facts: { scope: "organization", grantedProjectIds: null }
+      detail: `the whole organization \u2014 ${access.tenantPermissions.join(", ")}${perProject}`,
+      facts: {
+        scope: "organization",
+        grantedProjectIds: projects.length > 0 ? projects.join(",") : null
+      }
     } : projects.length === 0 ? {
       // A FAILURE, NOT A NOTE. This credential authenticates and can do
       // nothing at all — and the check said so in words while `report`
       // computed the exit code from `ok` alone, so `doctor` printed
       // "nothing else will work" and exited 0. A pipeline reads the code,
       // not the sentence.
+      //
+      // STILL A FAILURE WITH KNOWLEDGE READ AND NO PROJECT. That gate is a
+      // legitimate one — it serves an MCP client — but every `vfac`
+      // command that reads a Project is refused under it, and a pipeline
+      // pointed at it has the wrong credential.
       name: "Access",
       ok: false,
-      detail: "none. This credential holds no Project and nothing organization-wide, so every command below it will be refused. Ask an organization administrator for access."
+      detail: access.tenantPermissions.length > 0 ? `no Project. ${alsoOrganizationWide}Every command below that reads a Project will be refused. A gate holding only that serves an MCP client, not vfac; ask an organization administrator for a Project role on the gate vfac uses.` : "none. This credential holds no Project and nothing organization-wide, so every command below it will be refused. Ask an organization administrator for access."
     } : {
       name: "Access",
       ok: true,
@@ -18068,7 +18216,7 @@ async function runDoctor(parsed) {
         // names are the difference.
         grantedProjectIds: projects.join(",")
       },
-      detail: `${projects.join(", ")} \u2014 and nothing organization-wide. ` + (mutating.length > 0 ? "You can deploy in those Projects, read their catalogue, and list them. " : "Read-only there: catalogue, manifests, resources and operations. An apply or a lifecycle command is refused, and that is what was granted rather than a fault. ") + "Anything ACROSS the organization \u2014 a Project you hold nothing in, or its members \u2014 is refused."
+      detail: `${projects.join(", ")}` + (access.tenantPermissions.length > 0 ? ". " : " \u2014 and nothing organization-wide. ") + alsoOrganizationWide + (mutating.length > 0 ? "You can deploy in those Projects, read their catalogue, and list them. " : "Read-only there: catalogue, manifests, resources and operations. An apply or a lifecycle command is refused, and that is what was granted rather than a fault. ") + "Anything ACROSS the organization \u2014 a Project you hold nothing in, or its members \u2014 is refused."
     }
   );
   checks.push({
@@ -18223,9 +18371,9 @@ var MAX_PAGES = 50;
 async function readAllPages(args) {
   const items = [];
   let cursor = args.cursor;
-  const onePage = args.cursor !== void 0 || args.pageSize !== void 0;
+  const onePage = args.onePage === true || args.cursor !== void 0 || args.pageSize !== void 0;
   for (let page = 0; page < MAX_PAGES; page += 1) {
-    const query = new URLSearchParams();
+    const query = new URLSearchParams(args.query ?? {});
     if (cursor !== void 0) query.set("cursor", cursor);
     if (args.pageSize !== void 0) query.set("pageSize", args.pageSize);
     const suffix = query.toString();
@@ -18260,7 +18408,7 @@ async function readAllPages(args) {
 }
 
 // src/commands/get.ts
-async function runGet(parsed) {
+async function runGet(parsed, deps = {}) {
   const noun = parsed.command[1];
   const json = parsed.flags["output"] === "json";
   const session = await ensureSession({ endpointFlag: parsed.flags["endpoint"] });
@@ -18337,8 +18485,10 @@ async function runGet(parsed) {
         const label = String(one["displayName"] ?? one["key"] ?? "");
         const state = String(one["state"] ?? "UNKNOWN");
         const reason = one["reason"];
+        const observedAt = one["observedAt"];
+        const stale = one["freshness"] === "STALE" && typeof observedAt === "string" ? `  [stale \u2014 last observed ${ageOf(observedAt, (deps.now ?? (() => /* @__PURE__ */ new Date()))())} ago]` : "";
         lines.push(
-          `    ${label.padEnd(width)}  ${state}${typeof reason === "string" && reason !== "" ? `  (${reason})` : ""}`
+          `    ${label.padEnd(width)}  ${state}${typeof reason === "string" && reason !== "" ? `  (${reason})` : ""}${stale}`
         );
         const description = one["description"];
         if (typeof description === "string") {
@@ -18375,6 +18525,10 @@ async function runGet(parsed) {
     if (allowed.length > 0) {
       lines.push("", `  You may: ${allowed.join(", ")}  (vfac lifecycle <command> ${instanceId})`);
     }
+    const notNow = (lifecycle["refused"] ?? []).filter(
+      (entry) => typeof entry["command"] === "string" && typeof entry["reason"] === "string" && entry["reason"] !== "permission_required"
+    ).map((entry) => `${String(entry["command"])} (${String(entry["reason"])})`);
+    if (notNow.length > 0) lines.push(`  Not now: ${notNow.join(", ")}`);
     process.stdout.write(`${lines.join("\n")}
 `);
     return 0;
@@ -18421,7 +18575,75 @@ This is one page. Continue with --cursor ${result.nextCursor ?? ""}
     }
     return 0;
   }
-  process.stderr.write("Usage: vfac get product-instances | vfac get operation op_\u2026\n");
+  if (noun === "operations") {
+    const projectId = resolveProject(parsed.flags["project"], session.ready.stored);
+    if (!projectId) {
+      process.stderr.write("No Project. Use --project prj_\u2026 or set one in your context.\n");
+      return 2;
+    }
+    const resource = parsed.flags["resource"];
+    const result = await readAllPages({
+      endpoint: session.ready.endpoint,
+      token: session.ready.token,
+      path: `/api/v1/projects/${encodeURIComponent(projectId)}/operations`,
+      key: "operations",
+      cursor: parsed.flags["cursor"],
+      pageSize: parsed.flags["page-size"],
+      onePage: true,
+      ...resource === void 0 ? {} : { query: { productInstanceId: resource } }
+    });
+    if (!result.ok) {
+      if (result.error.status === 404 && result.error.code === "NOT_FOUND") {
+        process.stderr.write(
+          "This Tenant Portal does not list operations yet \u2014 it is running an older build.\n"
+        );
+        return 1;
+      }
+      return printError(result.error, json);
+    }
+    if (json) {
+      process.stdout.write(
+        `${JSON.stringify({ operations: result.items, nextCursor: result.nextCursor })}
+`
+      );
+      return 0;
+    }
+    if (result.items.length === 0) {
+      process.stdout.write(
+        resource === void 0 ? "No operations in this project.\n" : "No operations for this resource in this project.\n"
+      );
+      return 0;
+    }
+    const rows = result.items.map((operation) => [
+      operation.operationId ?? "(no id)",
+      // `PRODUCT_INSTANCE_UPDATE` is every line's prefix and says nothing a
+      // reader scanning the column needs. JSON keeps the platform's word.
+      (operation.type ?? "").replace(/^PRODUCT_INSTANCE_/, ""),
+      operation.status ?? "",
+      operation.productInstanceId ?? "-",
+      operation.createdAt ?? ""
+    ]);
+    const widths = rows[0].map(
+      (_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length))
+    );
+    for (const row of rows) {
+      process.stdout.write(
+        `${row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column])).join("   ")}
+`
+      );
+    }
+    if (!result.complete) {
+      process.stderr.write(
+        `
+This is one page. Continue with --cursor ${result.nextCursor ?? ""}
+`
+      );
+    }
+    return 0;
+  }
+  process.stderr.write(
+    "Usage: vfac get product-instances | vfac get operation op_\u2026 | vfac get operations [--resource pri_\u2026]\n"
+  );
   return 2;
 }
 function wrapOutput(text, width) {
@@ -18438,6 +18660,13 @@ function wrapOutput(text, width) {
   if (current !== "") out.push(current);
   return out;
 }
+function ageOf(iso, now) {
+  const seconds = Math.max(0, Math.floor((now.getTime() - Date.parse(iso)) / 1e3));
+  if (Number.isNaN(seconds)) return "an unknown time";
+  if (seconds < 3600) return `${Math.max(1, Math.floor(seconds / 60))}m`;
+  if (seconds < 72 * 3600) return `${Math.floor(seconds / 3600)}h`;
+  return `${Math.floor(seconds / 86400)}d`;
+}
 
 // src/commands/product.ts
 async function runProduct(parsed) {
@@ -18998,10 +19227,13 @@ async function runWhoami(parsed) {
   }
   const { principal, access } = result.data;
   const lines = [`${principal.name}  ${principal.id}  (${principal.type})`];
-  if (access.tenantWide) {
+  if (access.tenantPermissions.length > 0) {
     lines.push("", "Granted  across the whole organization");
     lines.push(`  ${access.tenantPermissions.join(", ")}`);
-  } else {
+  }
+  if (access.projects.length > 0 && access.tenantPermissions.length > 0) {
+    lines.push("", "Granted  in these Projects");
+  } else if (!access.tenantWide) {
     lines.push("", "Granted  in these Projects only \u2014 nothing organization-wide.");
     lines.push("         Listing these works. Reading ACROSS the organization does not.");
   }
@@ -19009,7 +19241,7 @@ async function runWhoami(parsed) {
     lines.push("", `  ${project.projectId}`);
     lines.push(`    ${project.permissions.join(", ")}`);
   }
-  if (!access.tenantWide && access.projects.length === 0) {
+  if (access.projects.length === 0 && !access.tenantPermissions.includes("project.read")) {
     lines.push("", "  No Projects. Ask an organization administrator for access.");
   }
   lines.push(
@@ -19044,6 +19276,7 @@ var USAGE = `vfac \u2014 deploy Varde Flyt resources from a manifest
   vfac get product-instances
   vfac get product-instance pri_\u2026        what it is, and its outputs
   vfac get operation op_\u2026
+  vfac get operations [--resource pri_\u2026]  newest first \u2014 find an operation id again
   vfac lifecycle <suspend|resume|upgrade|reconcile|delete> pri_\u2026
                      delete is irreversible and needs --yes
   vfac export product-instance pri_\u2026
@@ -19061,7 +19294,10 @@ Options
                   --secret inputs the apply will carry; without them the plan
                   answers about a different request. A value on the command line
                   is in your shell history and in the process table, so it is
-                  refused
+                  refused. A value for a secret setting written into the
+                  manifest itself is refused too: before the file is sent when it
+                  pins the release the catalog offers, by the platform otherwise
+      --resource  get operations: only that resource's history
       --product   which Product to write a starting manifest for
       --name      what a person will call the resource
       --key       its stable identity. Derived from --name when omitted
@@ -19089,8 +19325,10 @@ Reading the catalogue
   Products are read UNDER a Project, because that is the scope a credential is
   granted in. Pass --project, or store one with: vfac context set --project prj_\u2026
 
-  project list and product list read the WHOLE list, following the server's
-  cursor. Pass --cursor or --page-size only when you want a single page.
+  project list, product list and get product-instances read the WHOLE list,
+  following the server's cursor. Pass --cursor or --page-size only when you want
+  a single page. get operations reads ONE page, newest first \u2014 a history only
+  grows \u2014 and prints the --cursor that continues into older operations.
 
 Authentication
   As yourself:  vfac login \u2014 approve the code in your browser. The terminal then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",