@varde-flyt/vfac 0.14.1 → 0.15.0

package/README.md

@@ -95,11 +95,23 @@ file pins the release the catalog currently offers. **Plan the run that sets one
 apply will carry**: `plan` takes the flag exactly as `apply` does, and without it
 the plan describes a different request.
 
+`--secret` names a root setting by its name, and a setting inside a group by its
+path — `--secret /upstreamAuth/clientSecret=env:UPSTREAM_CLIENT_SECRET` for the
+`clientSecret` under `upstreamAuth`. `vfac product show` and `vfac manifest init`
+print each required secret in that form. A path never names an item of a list:
+no secret is declared there.
+
 `requiredSecrets` in a plan is what the Product requires for the configuration in
 your document — not a list of what the platform is missing. It names a credential
 whether or not this resource already holds one, so it is not a shopping list to
 act on. `secretsToWrite` is the field that says what this apply would write.
 
+A credential the Product requires for your document — outright, or because of
+what a setting is set to — that the run neither supplies nor the resource already
+holds is refused by `plan` and `apply` alike, before anything is written: the
+error names every one, by the path `--secret` takes, and the command exits 1.
+`vfac validate` carries no secrets and refuses none; it lists them.
+
 ### `metadata.key` is the name you choose
 
 `manifest init` writes one into the file, derived from `--name`. It is what the