@varde-flyt/vfac 0.15.0 → 0.15.3

package/README.md

@@ -26,10 +26,10 @@ vfac guide
 vfac whoami
 ```
 
-`doctor` checks the endpoint, which Project this terminal has selected, the API,
-whether this client is new enough for the platform it is pointed at, how this
-terminal is signed in and what that credential reaches, in that order, and reports
-the first thing that is actually wrong. Both ways of signing in count: a Context
+`doctor` checks the endpoint, which Project this terminal has selected and which
+one this command will act in, the API, whether this client is new enough for the
+platform it is pointed at, how this terminal is signed in and what that credential
+reaches, in that order, and reports the first thing that is actually wrong. Both ways of signing in count: a Context
 Gate exchanged from `VFAC_CREDENTIAL_ID` and `VFAC_CREDENTIAL_SECRET`, or a
 sign-in from `vfac login` that is still valid. A platform declares the oldest client it supports;
 below that, `doctor` fails and says so before sending your credential anywhere.
@@ -37,7 +37,10 @@ below that, `doctor` fails and says so before sending your credential anywhere.
 The selected Project and the Projects your credential reaches are two different
 lines, and reading the second as the first is the mistake worth naming: a command
 with no `--project` uses the SELECTED one, and having access to a Project is not
-the same as being in it. `doctor` also says so when it has just started a fresh
+the same as being in it. `--project` overrides the selection for one command and
+writes nothing, so `vfac doctor --project prj_…` reports the Project it would act
+in, says the flag is where that came from, and still names what your context has
+selected. `doctor` also says so when it has just started a fresh
 config because the old one could not be read — the endpoint and Project you had
 set are gone in that case, and the unreadable file is kept beside it rather than
 discarded.
@@ -68,7 +71,7 @@ vfac context set --project <projectId>
 
 ```sh
 vfac product list
-vfac product show <productId>
+vfac product show <productId>          # every setting, and when you must answer it
 vfac manifest init --product <productId> --name "My resource" > resource.yaml
 ```
 
@@ -88,8 +91,10 @@ operations of a resource are listed newest first, one page at a time; the
 vfac get operations --resource <productInstanceId>
 ```
 
-Secrets are supplied per apply and never belong in the manifest — a manifest is a
-file you commit. A value for a setting the Product declares secret is refused
+Secrets are passed as `--secret` inputs, beside the manifest and never in it — a manifest is a
+file you commit. Pass one when a resource is created, and afterwards only on a run that sets or
+changes one: a secret sent is a secret written, so a run that repeats one plans `UPDATE` rather
+than `NO_CHANGE`. A value for a setting the Product declares secret is refused
 at every door by the platform, and by `vfac` before the file is sent when the
 file pins the release the catalog currently offers. **Plan the run that sets one with the same `--secret` inputs the
 apply will carry**: `plan` takes the flag exactly as `apply` does, and without it
@@ -97,9 +102,12 @@ the plan describes a different request.
 
 `--secret` names a root setting by its name, and a setting inside a group by its
 path — `--secret /upstreamAuth/clientSecret=env:UPSTREAM_CLIENT_SECRET` for the
-`clientSecret` under `upstreamAuth`. `vfac product show` and `vfac manifest init`
-print each required secret in that form. A path never names an item of a list:
-no secret is declared there.
+`clientSecret` under `upstreamAuth`. `vfac product show` prints that form beside
+EVERY credential the Product declares, with a line saying whether it is required
+of everyone, required when another setting holds a particular value, or required
+because another setting was answered — `dependentRequired` is directional, and
+the line says which way it runs; `vfac manifest init` names the ones required
+outright. A path never names an item of a list: no secret is declared there.
 
 `requiredSecrets` in a plan is what the Product requires for the configuration in
 your document — not a list of what the platform is missing. It names a credential
@@ -109,7 +117,9 @@ act on. `secretsToWrite` is the field that says what this apply would write.
 A credential the Product requires for your document — outright, or because of
 what a setting is set to — that the run neither supplies nor the resource already
 holds is refused by `plan` and `apply` alike, before anything is written: the
-error names every one, by the path `--secret` takes, and the command exits 1.
+error names every one, by the path `--secret` takes, and the command exits 1. So
+is a credential the run DOES supply whose value the Product's own declaration
+refuses: the error names the setting and the bound it missed, never the value.
 `vfac validate` carries no secrets and refuses none; it lists them.
 
 ### `metadata.key` is the name you choose
@@ -229,9 +239,11 @@ it.
 ## For an agent or a pipeline
 
 Every command takes `--output json`, and it is the same data rather than a
-prettier subset — the human format of `vfac product show` prints a readable
-selection on purpose and says so at the foot of its output, and the JSON carries
-the whole Product contract.
+prettier subset. The human format of `vfac product show` lists every setting the
+Product declares and says when each must be answered; what it leaves to the JSON
+form is the prose and the value constraints — descriptions, patterns, bounds —
+and it says so at the foot of its output. The JSON carries the whole Product
+contract.
 
 ```sh
 vfac product show <productId> --output json

package/dist/vfac.mjs

@@ -13207,6 +13207,14 @@ function canonicalJson(value) {
 function immediateContainer(node) {
   return node.containers[node.containers.length - 1] ?? null;
 }
+function resolvedGroup(node) {
+  for (const container of node.containers) {
+    const declared = container.property.group;
+    if (declared !== void 0)
+      return declared;
+  }
+  return node.property.group;
+}
 function underList(node) {
   return node.containers.some((container) => container.kind === "array");
 }
@@ -14210,6 +14218,162 @@ function exampleResourceKey(name) {
 }
 var DEPLOYMENT_EXAMPLE_GUARANTEE = "Product-owned configuration is complete and E2E-proven; tenant-specific secrets and Resource/provider selections are supplied by the tenant.";
 
+// ../product-configuration/dist/configuration-requirements.js
+function configurationRequirements(configuration) {
+  if (configuration === void 0 || configuration === null)
+    return [];
+  const schema = configuration;
+  const rootRequired = new Set(schema.required ?? []);
+  const carriers = new Map(conditionCarriers(schema).map((carrier) => [carrier.path, carrier]));
+  const secretPaths = new Set(configurationLeaves(schema).filter((leaf) => isSecretProperty(leaf.property)).map((leaf) => String(leaf.path)));
+  return configurationLeaves(schema).map((leaf) => {
+    const parent = immediateContainer(leaf);
+    const immediatelyRequired = parent === null ? rootRequired.has(leaf.name) : parent.required.includes(leaf.name);
+    const chainRequired = containersRequiredToRoot(schema, leaf);
+    const always = requiredToRoot(schema, leaf);
+    const secret = isSecretProperty(leaf.property);
+    const condition = conditionFor(schema, leaf.path, leaf.containers, carriers);
+    const clause = clauseEdges(schema, leaf, secretPaths);
+    const requiredness = always ? "always" : condition !== null && condition.carrier === "setting" ? "when-value" : immediatelyRequired && !chainRequired ? "when-group" : clause.requiredBy.length > 0 ? "with-siblings" : "optional";
+    const containers = leaf.containers.map((container, index) => settingContainer(container, index === 0 ? rootRequired : new Set(leaf.containers[index - 1]?.required ?? [])));
+    const list = [...containers].reverse().find((container) => container.kind === "array") ?? null;
+    return {
+      path: leaf.path,
+      printablePath: printableConfigurationPath(leaf.path),
+      title: leaf.property.title,
+      description: leaf.property.description,
+      type: leaf.property.type,
+      secret,
+      requiredness,
+      // NEVER A SECRET'S, even though the declaration rules already refuse one.
+      // Being wrong in that direction prints a credential, which is the same
+      // paranoia `product-instance-example.ts` documents for its own reader.
+      defaultValue: secret ? void 0 : declaredDefault(leaf.property),
+      allowed: secret ? [] : allowedValues(leaf.property),
+      condition,
+      requires: clause.requires,
+      requiredBy: clause.requiredBy,
+      containers,
+      perRow: underList(leaf),
+      list,
+      group: resolvedGroup(leaf)
+    };
+  });
+}
+function allowedValues(property) {
+  const leaf = property;
+  return [...leaf.enum ?? leaf.items?.enum ?? []];
+}
+function conditionFor(schema, path, containers, carriers) {
+  const own = carriers.get(path);
+  const ancestor = [...containers].reverse().map((container) => carriers.get(container.path)).find((carrier2) => carrier2 !== void 0 && carrier2.kind === "container");
+  const carrier = own?.kind === "leaf" ? own : ancestor;
+  if (carrier === void 0)
+    return null;
+  const setting = parseConfigurationPath(conditionSetting(carrier.condition));
+  if (setting === null)
+    return null;
+  return {
+    carrier: carrier.kind === "leaf" ? "setting" : "container",
+    carrierPath: carrier.path,
+    setting,
+    printableSetting: printableConfigurationPath(setting),
+    settingLabel: labelOfPath(schema, setting),
+    anyOf: [...carrier.condition.anyOf],
+    anyRow: "path" in carrier.condition && carrier.condition.anyRow === true
+  };
+}
+function clauseEdges(schema, leaf, secretPaths) {
+  const parent = immediateContainer(leaf);
+  const scope = parent === null ? schema : parent.kind === "array" ? parent.property.items ?? parent.property : parent.property;
+  const requires = /* @__PURE__ */ new Set();
+  const requiredBy = /* @__PURE__ */ new Set();
+  for (const [trigger, dependents] of Object.entries(scope.dependentRequired ?? {})) {
+    if (trigger === leaf.name)
+      for (const dependent of dependents)
+        requires.add(dependent);
+    else if (dependents.includes(leaf.name))
+      requiredBy.add(trigger);
+  }
+  const order = Object.keys(scope.properties ?? {});
+  const members = (names) => [...names].sort((a, b) => order.indexOf(a) - order.indexOf(b)).flatMap((name) => {
+    const path = memberPath(leaf, name);
+    return path === null ? [] : [
+      {
+        path,
+        printablePath: printableConfigurationPath(path),
+        secret: secretPaths.has(String(path))
+      }
+    ];
+  });
+  return { requires: members(requires), requiredBy: members(requiredBy) };
+}
+function memberPath(leaf, name) {
+  const parent = immediateContainer(leaf);
+  return parent === null ? configurationPath(name) : configurationPath(...pathSegments(parent.path), name);
+}
+function settingContainer(container, requiredByParent) {
+  return {
+    path: container.path,
+    printablePath: printableConfigurationPath(container.path),
+    title: container.property.title,
+    kind: container.kind,
+    required: requiredByParent.has(container.name)
+  };
+}
+
+// ../product-configuration/dist/manifest-yaml.js
+var import_yaml = __toESM(require_dist(), 1);
+function manifestYaml(document) {
+  return (0, import_yaml.stringify)(document, { compat: "yaml-1.1" });
+}
+
+// ../platform-schemas/dist/governance-feed.js
+var GOVERNANCE_FEED_CATEGORIES = ["connections", "resources"];
+var OPAQUE_ID = /^[a-z]{2,4}_[0-9a-z]{10,40}$/;
+var opaqueId = external_exports.string().regex(OPAQUE_ID);
+var GovernanceFeedActorSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("person"), ref: external_exports.string().min(1).max(128) }),
+  external_exports.object({ type: external_exports.literal("platform") }),
+  external_exports.object({ type: external_exports.literal("resource"), id: opaqueId }),
+  external_exports.object({ type: external_exports.literal("system") })
+]);
+var GovernanceFeedEventSchema = external_exports.object({
+  /** The audit row's id. Stable, so a workspace can recognise a re-delivery. */
+  id: opaqueId,
+  /** The Control Plane's own event name, from its allowlist. */
+  event: external_exports.string().regex(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*){1,4}$/).max(80),
+  category: external_exports.enum(GOVERNANCE_FEED_CATEGORIES),
+  /** RFC 3339: when it happened. */
+  occurredAt: external_exports.string().datetime({ offset: true }),
+  actor: GovernanceFeedActorSchema,
+  action: external_exports.string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+  outcome: external_exports.enum(["success", "failure"]),
+  projectId: opaqueId.optional(),
+  /** The Resource the event is about — for a connection, the PROVIDER. */
+  resourceId: opaqueId.optional(),
+  /** For a connection between two Resources, the one that consumes it. */
+  consumerResourceId: opaqueId.optional(),
+  operationId: opaqueId.optional(),
+  target: external_exports.object({
+    type: external_exports.enum(["service_binding", "resource"]),
+    id: opaqueId.optional()
+  })
+});
+var GovernanceFeedPositionSchema = external_exports.object({
+  at: external_exports.string().datetime({ offset: true }),
+  id: external_exports.union([external_exports.literal(""), opaqueId])
+});
+var GOVERNANCE_FEED_MAX_LIMIT = 100;
+var GovernanceFeedRequestSchema = external_exports.object({
+  after: GovernanceFeedPositionSchema,
+  limit: external_exports.number().int().min(1).max(GOVERNANCE_FEED_MAX_LIMIT).optional()
+}).strict();
+var GovernanceFeedResponseSchema = external_exports.object({
+  events: external_exports.array(GovernanceFeedEventSchema).max(GOVERNANCE_FEED_MAX_LIMIT),
+  position: GovernanceFeedPositionSchema
+});
+
 // ../platform-schemas/dist/index.js
 var TENANT_KEY_REGEX = /^[a-z][a-z0-9-]{2,23}[a-z0-9]$/;
 var RESERVED_TENANT_KEYS = /* @__PURE__ */ new Set([
@@ -14335,7 +14499,7 @@ var kindSchema = (kind) => external_exports.literal(kind, {
   errorMap: () => ({ message: `kind must be "${kind}".` })
 });
 
-// ../product-contracts/dist/blocked-hosts.js
+// ../public-fetch/dist/index.js
 var BLOCKED_HOSTS = [
   /^localhost$/i,
   /^169\.254\./,
@@ -14568,6 +14732,7 @@ var IDENTITY_OIDC_CLIENT_V1 = {
   }
 };
 var DIRECTORY_SCOPES = [
+  "directory.group-members.list",
   "directory.groups.search",
   "directory.membership.check",
   "directory.principals.resolve",
@@ -14619,9 +14784,58 @@ var IDENTITY_DIRECTORY_V1 = {
     }
   }
 };
+var OBSERVABILITY_LOGS_SCOPES = ["logs.read", "logs.write"];
+var OBSERVABILITY_LOGS_V1 = {
+  kind: "service-api",
+  id: "observability.logs",
+  version: "v1",
+  // TENANT-MULTIPLE, for the reason the two identity interfaces are: an
+  // organization may run more than one log workspace — one per environment, one
+  // per department — and which one a Product emits to is the customer's answer
+  // rather than the platform's. There is deliberately no fallback to "the only
+  // one" when a Tenant happens to have exactly one, because that rule would
+  // change the day a second workspace is deployed and bind existing consumers
+  // by accident.
+  cardinality: "tenant-multiple",
+  summary: "Send operational log records to a log workspace in this organization, and optionally query them back. The provider returns an ingest address and a credential; the consumer calls it directly.",
+  maxRequestedScopes: OBSERVABILITY_LOGS_SCOPES.length,
+  scopes: OBSERVABILITY_LOGS_SCOPES,
+  // `logs.write` IS REQUIRED, and it is the only required scope on any
+  // interface in this file. The reason is that the alternative is incoherent
+  // rather than merely narrow: a binding to a log workspace that may not write
+  // to it has asked for a connection it cannot use for the thing the connection
+  // is for. A consumer that only wants to READ somebody else's records is not
+  // this interface's case — it is a query surface the providing Product
+  // exposes in its own right.
+  requiredScopes: ["logs.write"],
+  protocol: {
+    authScheme: "bearer",
+    credentialTransport: "authorization-header"
+  },
+  fields: {
+    ingestUrl: {
+      kind: "attribute",
+      always: true,
+      format: "https-url",
+      description: 'The base address records are sent to: `POST {ingestUrl}/records` with `{"records": [...]}`, each record `{message, severity, observedAt?, fields?}`. Operations are relative to it, so the provider can move them without a new binding.'
+    },
+    grantedScopes: {
+      kind: "attribute",
+      always: true,
+      format: "space-separated-tokens",
+      description: "Space-separated scopes actually granted, which may be narrower than those requested. Read this rather than assuming the request was honoured."
+    },
+    apiToken: {
+      kind: "secret",
+      always: true,
+      description: "The credential for the address above, presented as a bearer token. Delivered as a secret reference, never as an environment value, and rotatable without a new binding."
+    }
+  }
+};
 var SERVICE_INTERFACE_CONTRACTS = {
   "identity.oidc-client/v1": IDENTITY_OIDC_CLIENT_V1,
-  "identity.directory/v1": IDENTITY_DIRECTORY_V1
+  "identity.directory/v1": IDENTITY_DIRECTORY_V1,
+  "observability.logs/v1": OBSERVABILITY_LOGS_V1
 };
 var SERVICE_INTERFACE_KEYS = Object.keys(SERVICE_INTERFACE_CONTRACTS).sort();
 var SERVICE_INTERFACE_IDS = [
@@ -14880,11 +15094,35 @@ var ProductDependencySchema = external_exports.object({
 var ProductDependencyV2Schema = ProductDependencySchema.extend({
   requiredWhen: RequiredWhenV2Schema.optional()
 });
+function hasControlCharacter(value) {
+  for (let i = 0; i < value.length; i += 1) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127)
+      return true;
+  }
+  return false;
+}
+var GuidanceTextSchema = (min, max) => external_exports.string().min(min).max(max).refine((value) => !hasControlCharacter(value), {
+  message: "Guidance is one line, with no control characters."
+});
+var ConsumerGuidanceSchema = external_exports.object({
+  /** One paragraph: what this provider does with what a consumer sends or asks. */
+  summary: GuidanceTextSchema(20, 600),
+  /** Concrete, provider-specific practices, one per entry. */
+  notes: external_exports.array(GuidanceTextSchema(10, 400)).min(1).max(12).optional()
+}).strict();
 var ServiceInterfaceProvideSchema = external_exports.object({
   key: ServiceBindingKeySchema,
   interfaceId: ServiceInterfaceIdSchema,
   interfaceVersion: ServiceInterfaceVersionSchema,
-  cardinality: ServiceInterfaceCardinalitySchema
+  cardinality: ServiceInterfaceCardinalitySchema,
+  /**
+   * `.optional()`, NEVER `.default()`. A default materialises the key,
+   * `contractDigest` digests the parsed object, and every release published
+   * before this field existed would be refused on republish as
+   * `RELEASED_CONTRACT_MUTATED`.
+   */
+  consumerGuidance: ConsumerGuidanceSchema.optional()
 }).strict();
 var LifecycleCapabilitiesSchema = external_exports.object({
   upgrade: external_exports.boolean(),
@@ -15944,10 +16182,38 @@ var ComponentHealthSchema = external_exports.object({
   readiness: ProbeSchema,
   liveness: ProbeSchema
 }).strict();
+var PUBLIC_INGRESS_AUTHENTICATION = external_exports.enum([
+  "api-key",
+  "oauth2",
+  "mtls",
+  "signed-request",
+  "tenant-human-session"
+]);
+var HUMAN_SESSION_MECHANISMS = external_exports.array(external_exports.enum(["federated-oidc", "email-one-time-link", "local-password"])).min(1).max(3);
+var INGRESS_PATH_PREFIX = external_exports.string().regex(/^\/[a-z0-9\-/]*$/).max(64);
+var IngressSurfaceSchema = external_exports.object({
+  pathPrefix: INGRESS_PATH_PREFIX,
+  authentication: PUBLIC_INGRESS_AUTHENTICATION,
+  /** Required and refused exactly as the component-level field is. */
+  humanSessionMechanisms: HUMAN_SESSION_MECHANISMS.optional(),
+  /** Who calls this part of the component, for the reviewer. */
+  purpose: external_exports.string().min(20).max(300)
+}).strict();
+var MAX_INGRESS_SURFACES = 8;
 var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
   external_exports.object({
     exposure: external_exports.literal("public"),
     /**
+     * `oauth2`: the routes it names accept OAuth access tokens. The
+     * Authorization Server that issues them may be an external authority, or
+     * the Product may implement it itself — an MCP server that runs its own
+     * OAuth 2.1 discovery, authorization, consent, PKCE and token issuance
+     * declares `oauth2` for the endpoint those tokens reach. Either way
+     * the Product must truthfully implement and expose the flow it declares.
+     * The platform provides none of it implicitly: it runs no Authorization
+     * Server, registers no client, issues no token and validates none in
+     * front of the container.
+     *
      * `tenant-human-session` is the one that needs explaining: a console the
      * Product itself signs humans into, rather than delegating to a caller's
      * credential.
@@ -15968,16 +16234,18 @@ var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
      * defaulted to, it runs with mail disabled entirely, and the temporary
      * credential it bootstraps has its own list of properties in that section.
      *
-     * `oauth2` remains correct for a component that accepts a token somebody
-     * else minted. Declare this one when the Product owns the session.
+     * WHERE THE TWO MEET: a Product that is its own Authorization Server. The
+     * person approving a client must first be signed in through the Product's
+     * ordinary `tenant-human-session` — approving is something a signed-in
+     * person does, never a sign-in of its own — so the routes serving that
+     * sign-in and the approval declare `tenant-human-session` and its
+     * mechanisms, as the component's own `authentication` or as a surface,
+     * and the routes accepting the resulting tokens declare `oauth2`. `oauth2`
+     * describes how a token is PRESENTED, never how a person signs in:
+     * whoever issued the token, a sign-in the Product runs carries the
+     * obligation above.
      */
-    authentication: external_exports.enum([
-      "api-key",
-      "oauth2",
-      "mtls",
-      "signed-request",
-      "tenant-human-session"
-    ]),
+    authentication: PUBLIC_INGRESS_AUTHENTICATION,
     /**
      * WHICH of those three mechanisms this Product actually offers.
      *
@@ -16000,8 +16268,16 @@ var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
      * which — never a failure of another. Listing all three means all three
      * are implemented, not that the Product will fall back through them.
      */
-    humanSessionMechanisms: external_exports.array(external_exports.enum(["federated-oidc", "email-one-time-link", "local-password"])).min(1).max(3).optional(),
-    pathPrefix: external_exports.string().regex(/^\/[a-z0-9\-/]*$/).max(64),
+    humanSessionMechanisms: HUMAN_SESSION_MECHANISMS.optional(),
+    pathPrefix: INGRESS_PATH_PREFIX,
+    /**
+     * Parts of this component's routes that authenticate differently from
+     * `authentication` above. Optional, and `.optional()` rather than a
+     * default: a released Blueprint is re-parsed on the read path and its
+     * digest is taken over the parsed object, so a materialised empty list
+     * would refuse a republish of unchanged bytes.
+     */
+    surfaces: external_exports.array(IngressSurfaceSchema).min(1).max(MAX_INGRESS_SURFACES).optional(),
     /**
      * Why this component is public at all. docs/SECURITY.md §8 makes adding
      * public ingress a security-approval trigger; requiring the author to
@@ -16560,6 +16836,20 @@ var DataStoreSchema = external_exports.object({
    * or push it outside the contract — where nothing governs its retention,
    * its data categories or its deletion.
    *
+   * `log-store` was added for the same reason one level along: a Product that
+   * emits structured operational records about its own running — requests
+   * served, durations, outcomes — had nowhere in this contract to say so, and
+   * a store it cannot name is a store whose retention, data categories and
+   * deletion nothing governs. It is LOGS, deliberately and only. Metrics and
+   * traces are different capabilities with different shapes, and naming this
+   * one after the signal it carries is what keeps a later `metric-store` from
+   * being a silent widening of this one.
+   *
+   * PROVIDER-NEUTRAL, like every other name here. Nothing in this enum names
+   * an engine, a vendor or a wire format, and `log-store` must not become the
+   * exception — which implementation backs it is a platform promise published
+   * in `DATA_STORE_INTERFACES`, not a choice a publisher makes.
+   *
    * Naming a kind is a CONTRACT question. Whether this Control Plane can
    * provision it is a DEPLOYABILITY question, answered separately by
    * `validateDeployability` — see deployability.ts.
@@ -16571,7 +16861,8 @@ var DataStoreSchema = external_exports.object({
     "vector-index",
     "queue",
     "document-database",
-    "search-index"
+    "search-index",
+    "log-store"
   ]),
   purpose: external_exports.string().min(10).max(300),
   /**
@@ -16593,7 +16884,7 @@ var DataStoreSchema = external_exports.object({
   }).strict(),
   deleteBehavior: external_exports.enum(["purge-with-instance", "purge-after-retention"]),
   /**
-   * Ask for RUNTIME access to the store's own objects.
+   * Ask for RUNTIME access to the store's own contents.
    *
    * OPT-IN, AND PRESENT-OR-ABSENT RATHER THAN AN ENUM. A `mode` field would
    * have to be optional with a default to keep published documents parseable,
@@ -16602,17 +16893,31 @@ var DataStoreSchema = external_exports.object({
    * and a legitimate republish would be refused as an immutability conflict.
    * Presence is a cleaner discriminator and reads better in a diff.
    *
-   * WHAT IT DOES NOT GRANT: S3 credentials. The component receives an address,
-   * its own key prefix and a signing key for the platform's storage broker,
-   * which checks every key against the INSTANCE the signature proved. A
-   * Scaleway key cannot be scoped to a prefix, and the provider's quota is 50
-   * API keys per Organization, so one per Product Instance would cap the
-   * platform at roughly 45 of them.
+   * WHAT IT DOES NOT GRANT: a provider credential, on either kind that
+   * accepts it. The component receives an address, what identifies it, and a
+   * signing key for the platform service that brokers the access — and that
+   * service checks every request against the INSTANCE the signature proved.
+   *
+   * For `object-storage` the reason is that a Scaleway key cannot be scoped
+   * to a prefix or a bucket, and the provider's quota is 50 API keys per
+   * Organization, so one per Product Instance would cap the platform at
+   * roughly 45 of them. For `log-store` the reason is sharper: a Cockpit
+   * token carries a Project and a scope and has NO data-source field, and the
+   * whole platform lives in one Scaleway Project — so a token delivered to
+   * one Tenant's component would read and write every other Tenant's logs.
+   * Neither is a limit to work around; both are why the brokering service
+   * exists.
+   *
+   * WHICH KINDS MAY DECLARE IT is `RUNTIME_ACCESS_KINDS`, and the variables
+   * each one then receives are `RUNTIME_ACCESS_SUFFIXES`. The cross-field
+   * check below reads both.
    */
   runtimeAccess: external_exports.object({
     /**
-     * Names the variables the platform injects — `{PREFIX}_ENDPOINT_URL`,
-     * `_TENANT_ID`, `_PREFIX` and `_SIGNING_KEY`.
+     * Names the variables the platform injects: `{PREFIX}_ENDPOINT_URL`,
+     * `_TENANT_ID` and `_SIGNING_KEY` on every kind that accepts runtime
+     * access, plus `_PREFIX` on `object-storage`, which is the only one
+     * addressed by a key prefix.
      *
      * Bounded at 32 so every derived name fits `EnvVarNameSchema`'s 64, and
      * REFUSED at authoring time rather than silently truncated at deploy —
@@ -16631,6 +16936,17 @@ var DataStoreSchema = external_exports.object({
     access: external_exports.enum(["read-write", "read-only"])
   }).strict()).min(1).max(12)
 }).strict();
+var RUNTIME_ACCESS_SUFFIXES = {
+  "object-storage": ["_ENDPOINT_URL", "_TENANT_ID", "_PREFIX", "_SIGNING_KEY"],
+  "log-store": ["_ENDPOINT_URL", "_TENANT_ID", "_SIGNING_KEY"]
+};
+var RUNTIME_ACCESS_KINDS = new Set(Object.keys(RUNTIME_ACCESS_SUFFIXES));
+function runtimeAccessEnvNames(kind, envPrefix) {
+  const suffixes = RUNTIME_ACCESS_SUFFIXES[kind];
+  if (suffixes === void 0)
+    return [];
+  return suffixes.map((suffix) => `${envPrefix}${suffix}`);
+}
 var EgressRuleSchema = external_exports.object({
   componentId: ComponentIdSchema,
   destination: external_exports.discriminatedUnion("kind", [
@@ -17126,29 +17442,34 @@ function checkDeploymentBlueprint(blueprint, ctx) {
   });
   blueprint.components.forEach((component, index) => {
     if (component.ingress.exposure === "public") {
-      const mechanismPath = ["components", index, "ingress", "humanSessionMechanisms"];
-      const declared = component.ingress.humanSessionMechanisms;
-      if (component.ingress.authentication === "tenant-human-session") {
-        if (declared === void 0) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: mechanismPath,
-            message: "A component declaring `tenant-human-session` must name which approved mechanisms it implements, so a customer can tell whether it fits their organization before they deploy it."
-          });
-        } else if (new Set(declared).size !== declared.length) {
+      const ingress = component.ingress;
+      checkHumanSessionMechanisms(ctx, ["components", index, "ingress"], ingress.authentication, ingress.humanSessionMechanisms);
+      const surfaces = ingress.surfaces ?? [];
+      const base = ingress.pathPrefix.replace(/\/+$/, "");
+      surfaces.forEach((surface, surfaceIndex) => {
+        const surfacePath = ["components", index, "ingress", "surfaces", surfaceIndex];
+        checkHumanSessionMechanisms(ctx, surfacePath, surface.authentication, surface.humanSessionMechanisms);
+        const prefix = surface.pathPrefix.replace(/\/+$/, "");
+        if (!(prefix.startsWith(`${base}/`) && prefix.length > base.length + 1)) {
           ctx.addIssue({
             code: external_exports.ZodIssueCode.custom,
-            path: mechanismPath,
-            message: "Each mechanism may be named once."
+            path: [...surfacePath, "pathPrefix"],
+            message: `A surface covers part of the component's routes, so its prefix must lie under "${ingress.pathPrefix}" and differ from it.`
           });
         }
-      } else if (declared !== void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: mechanismPath,
-          message: "Only a component whose ingress authentication is `tenant-human-session` signs people in itself; remove this, or declare that authentication."
+        surfaces.forEach((other, otherIndex) => {
+          if (otherIndex <= surfaceIndex)
+            return;
+          const otherPrefix = other.pathPrefix.replace(/\/+$/, "");
+          if (otherPrefix === prefix || otherPrefix.startsWith(`${prefix}/`) || prefix.startsWith(`${otherPrefix}/`)) {
+            ctx.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["components", index, "ingress", "surfaces", otherIndex, "pathPrefix"],
+              message: `Surfaces "${surface.pathPrefix}" and "${other.pathPrefix}" overlap; a path may be claimed by one surface only.`
+            });
+          }
         });
-      }
+      });
     }
     const envNames = component.env.map((binding) => binding.name);
     const duplicateEnv = envNames.filter((name, i) => envNames.indexOf(name) !== i);
@@ -17478,11 +17799,11 @@ function checkDeploymentBlueprint(blueprint, ctx) {
     if (!access)
       return;
     const path = ["dataStores", index, "runtimeAccess"];
-    if (store.kind !== "object-storage") {
+    if (!RUNTIME_ACCESS_KINDS.has(store.kind)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path,
-        message: `Runtime access is only available for an object-storage store; "${store.id}" is a ${store.kind}.`
+        message: `Runtime access is only available for a ${[...RUNTIME_ACCESS_KINDS].sort().join(" or ")} store; "${store.id}" is a ${store.kind}.`
       });
     }
     const first = usedPrefixes.get(access.envPrefix);
@@ -17494,7 +17815,7 @@ function checkDeploymentBlueprint(blueprint, ctx) {
       });
     }
     usedPrefixes.set(access.envPrefix, index);
-    const derived = new Set(["_ENDPOINT_URL", "_TENANT_ID", "_PREFIX", "_SIGNING_KEY"].map((suffix) => `${access.envPrefix}${suffix}`));
+    const derived = new Set(runtimeAccessEnvNames(store.kind, access.envPrefix));
     const binders = new Set(store.bindings.map((binding) => binding.componentId));
     for (const component of blueprint.components) {
       if (!binders.has(component.id))
@@ -17695,6 +18016,30 @@ function checkDeploymentBlueprint(blueprint, ctx) {
     }
   }
 }
+function checkHumanSessionMechanisms(ctx, at, authentication, declared) {
+  const mechanismPath = [...at, "humanSessionMechanisms"];
+  if (authentication === "tenant-human-session") {
+    if (declared === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: mechanismPath,
+        message: "A component declaring `tenant-human-session` must name which approved mechanisms it implements, so a customer can tell whether it fits their organization before they deploy it."
+      });
+    } else if (new Set(declared).size !== declared.length) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: mechanismPath,
+        message: "Each mechanism may be named once."
+      });
+    }
+  } else if (declared !== void 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: mechanismPath,
+      message: "Only a component whose ingress authentication is `tenant-human-session` signs people in itself; remove this, or declare that authentication."
+    });
+  }
+}
 
 // ../product-contracts/dist/deployability.js
 var VIRTUAL_MACHINE_PROFILE_INTERFACE = {
@@ -17868,7 +18213,7 @@ withJsonSchemaAnnex(ProductSubmissionSchema, PUBLISH_RULE_ANNEX);
 withJsonSchemaAnnex(ProductSubmissionV2Schema, PUBLISH_RULE_ANNEX);
 
 // src/manifest.ts
-var import_yaml = __toESM(require_dist(), 1);
+var import_yaml2 = __toESM(require_dist(), 1);
 function readManifest(path) {
   let text;
   try {
@@ -17878,7 +18223,7 @@ function readManifest(path) {
   }
   let parsed;
   try {
-    parsed = (0, import_yaml.parse)(text, { prettyErrors: false });
+    parsed = (0, import_yaml2.parse)(text, { prettyErrors: false });
   } catch (error) {
     return {
       ok: false,
@@ -18041,8 +18386,14 @@ async function ensureSession(args) {
     }
   };
 }
+function resolveProjectWithSource(flag, stored) {
+  if (flag !== void 0) return { value: flag, source: "--project" };
+  const selected = stored.context?.projectId;
+  if (selected !== void 0) return { value: selected, source: "the stored context" };
+  return null;
+}
 function resolveProject(flag, stored) {
-  return flag ?? stored.context?.projectId ?? null;
+  return resolveProjectWithSource(flag, stored)?.value ?? null;
 }
 
 // src/operations.ts
@@ -18256,7 +18607,6 @@ function printPlan(plan, json) {
       }
     }
   }
-  lines.push(...requiredSecretLines(plan.requiredSecrets ?? []));
   if ((plan.secretsToWrite ?? []).length > 0) {
     lines.push(`  secrets to set: ${plan.secretsToWrite.join(", ")}`);
     for (const line of secretWriteConsequence(plan)) lines.push(`      ${line}`);
@@ -18692,13 +19042,18 @@ async function runDoctor(parsed) {
     detail: `${endpoint}   (from ${resolved.source})`,
     facts: { endpoint, source: resolved.source }
   });
-  const selected = stored.context?.projectId ?? null;
+  const project = resolveProjectWithSource(parsed.flags["project"], stored);
+  const storedProjectId = stored.context?.projectId ?? null;
   checks.push({
     name: "Project",
     ok: true,
-    note: selected === null,
-    detail: selected === null ? "none selected. Commands need `--project prj_\u2026`, or run `vfac context set --project prj_\u2026` once. This is not a fault \u2014 it is what a pipeline that names the Project per command looks like \u2014 but it is NOT the same thing as which Projects your credential reaches." : `${selected}   (selected in this context; which Projects the credential reaches is a separate question)`,
-    facts: { selectedProjectId: selected }
+    note: storedProjectId === null,
+    detail: project === null ? "none selected. Commands need `--project prj_\u2026`, or run `vfac context set --project prj_\u2026` once. This is not a fault \u2014 it is what a pipeline that names the Project per command looks like \u2014 but it is NOT the same thing as which Projects your credential reaches." : project.source === "--project" ? `${project.value}   (from --project, for this command only). ` + (storedProjectId === null ? "Nothing is selected in this context, so every other command needs the flag too. " : `The stored context still selects ${storedProjectId}, which is what a command with no --project uses. `) + "Which Projects the credential reaches is a separate question." : `${project.value}   (from the stored context; a command with no --project uses it, and which Projects the credential reaches is a separate question)`,
+    facts: {
+      selectedProjectId: project?.value ?? null,
+      source: project?.source ?? null,
+      storedProjectId
+    }
   });
   const probe = await probeMachineApi({ endpoint });
   if (!probe.ok) {
@@ -18733,13 +19088,13 @@ async function runDoctor(parsed) {
     return report2(checks, json);
   }
   const access = who.data.access;
-  const projects = access.projects.map((project) => project.projectId);
+  const projects = access.projects.map((project2) => project2.projectId);
   const mutating = access.projects.filter(
-    (project) => project.permissions.some((permission) => !permission.endsWith(".read"))
+    (project2) => project2.permissions.some((permission) => !permission.endsWith(".read"))
   );
   const organizationWide = access.tenantPermissions.includes("project.read");
   const alsoOrganizationWide = access.tenantPermissions.length > 0 ? `Organization-wide it holds ${access.tenantPermissions.join(", ")}, which reaches no Project. ` : "";
-  const perProject = projects.length === 0 ? "" : `. Granted per Project: ${projects.join(", ")}` + (mutating.length > 0 ? ` \u2014 you can deploy in ${mutating.map((project) => project.projectId).join(", ")}` : " \u2014 read-only there");
+  const perProject = projects.length === 0 ? "" : `. Granted per Project: ${projects.join(", ")}` + (mutating.length > 0 ? ` \u2014 you can deploy in ${mutating.map((project2) => project2.projectId).join(", ")}` : " \u2014 read-only there");
   checks.push(
     organizationWide ? {
       name: "Access",
@@ -18898,7 +19253,6 @@ function report2(checks, json) {
 }
 
 // src/commands/export.ts
-var import_yaml2 = __toESM(require_dist(), 1);
 async function runExport(parsed) {
   if (parsed.command[1] !== "product-instance" && parsed.command[1] !== "resource") {
     process.stderr.write("Usage: vfac export product-instance pri_\u2026\n");
@@ -18926,7 +19280,7 @@ async function runExport(parsed) {
   if (!result.ok) return printError(result.error, parsed.flags["output"] === "json");
   process.stdout.write(
     parsed.flags["output"] === "json" ? `${JSON.stringify(result.data, null, 2)}
-` : (0, import_yaml2.stringify)(result.data)
+` : manifestYaml(result.data)
   );
   const metadata = result.data["metadata"];
   const hasKey = typeof metadata === "object" && metadata !== null && "key" in metadata;
@@ -19338,16 +19692,44 @@ function renderProduct(product) {
     (profile) => `${profile.id}${profile.default ? " (default)" : ""}`
   );
   lines.push(`  profile         ${profiles.join(", ") || "(none declared)"}`);
-  const seed = seedConfiguration(product.configuration);
-  if (seed.open.length > 0 || seed.requiredSecrets.length > 0) {
-    lines.push("", "  Required configuration");
-    for (const name of seed.requiredSecrets) {
-      lines.push(`    ${name}  (secret \u2014 pass --secret ${name}=env:VAR)`);
-    }
-    for (const setting of seed.open) {
-      lines.push(`    ${setting.label}  ${setting.type ?? ""}`.trimEnd());
+  const settings = configurationRequirements(product.configuration);
+  if (settings.length > 0) {
+    lines.push("", `  Settings (${settings.length})`);
+    for (const setting of settings) {
+      lines.push(
+        `    ${identityOf(setting)}  ${setting.secret ? "secret" : setting.type}  ${TOKEN[setting.requiredness]}`
+      );
+      const requirement = requirementOf(setting);
+      if (requirement !== null) lines.push(...continuation(requirement));
+      if (setting.requires.length > 0 && !mutualClause(setting)) {
+        lines.push(
+          ...continuation(
+            `answering it also requires ${listOf(
+              setting.requires.map((member) => identityOf(member)),
+              "and"
+            )}`
+          )
+        );
+      }
+      if (setting.condition?.carrier === "container") {
+        lines.push(
+          ...continuation(
+            `${printableConfigurationPath(setting.condition.carrierPath)} is required when ${setting.condition.printableSetting} is ${valueList(setting.condition.anyOf)}`
+          )
+        );
+      }
+      if (setting.secret) {
+        lines.push(...continuation(`--secret ${String(setting.path)}=env:VAR`));
+      }
+      if (setting.allowed.length > 0) {
+        lines.push(...continuation(`one of ${valueList(setting.allowed)}`));
+      }
+      if (setting.defaultValue !== void 0) {
+        lines.push(...continuation(`default ${JSON.stringify(setting.defaultValue)}`));
+      }
     }
   }
+  const seed = seedConfiguration(product.configuration);
   const together = seed.groups.filter((group) => group.within !== null);
   if (together.length > 0) {
     lines.push("", "  Settings that go together");
@@ -19392,14 +19774,74 @@ function renderProduct(product) {
   }
   const conditions = product.conditions ?? [];
   if (conditions.length > 0) {
-    lines.push("", "  Needs setting up outside the platform");
+    lines.push("", "  Conditions");
     for (const condition of conditions) {
       lines.push(`    ${condition.key ?? ""}  ${condition.displayName ?? ""}`.trimEnd());
     }
   }
-  lines.push("", "  `--output json` carries the whole declaration, this is a readable subset.");
+  lines.push(
+    "",
+    "  `--output json` carries the whole declaration. Every setting is listed above;",
+    "  descriptions and value constraints are in the JSON form."
+  );
+  if (settings.some((setting) => setting.secret)) {
+    lines.push(
+      "  A credential is passed with --secret when a resource is created, and afterwards only",
+      "  when you set or change one \u2014 never written into a manifest."
+    );
+  }
   return lines.join("\n");
 }
+var TOKEN = {
+  always: "required",
+  "when-value": "required-when",
+  "when-group": "required-if",
+  "with-siblings": "required-with",
+  optional: "optional"
+};
+var MAX_LISTED_VALUES = 8;
+var identityOf = (setting) => setting.secret ? String(setting.path) : setting.printablePath;
+function valueList(values) {
+  const shown = values.slice(0, MAX_LISTED_VALUES).map((value) => JSON.stringify(value));
+  const rest = values.length - shown.length;
+  const joined = shown.length === 2 ? shown.join(" or ") : shown.join(", ");
+  return rest > 0 ? `${joined} and ${rest} more` : joined;
+}
+function requirementOf(setting) {
+  const list = setting.list === null ? "" : ` ${setting.list.printablePath}`;
+  switch (setting.requiredness) {
+    case "always":
+      return setting.perRow ? `in every${list} entry` : null;
+    case "when-value": {
+      const condition = setting.condition;
+      if (condition === null) return null;
+      const rows = condition.anyRow ? " in any entry" : "";
+      return `when ${condition.printableSetting} is ${valueList(condition.anyOf)}${rows}`;
+    }
+    case "when-group": {
+      const owner = setting.containers[setting.containers.length - 1];
+      const base = `once ${owner?.printablePath ?? ""} is configured`;
+      return setting.perRow ? `${base}, in every${list} entry` : base;
+    }
+    case "with-siblings": {
+      const names = (members) => members.map((member) => identityOf(member));
+      const triggers = names(setting.requiredBy);
+      return mutualClause(setting) ? `with ${names(setting.requires).join(", ")}` : `once ${listOf(triggers, "or")} is set`;
+    }
+    case "optional":
+      return setting.perRow ? `one per${list} entry` : null;
+  }
+}
+function mutualClause(setting) {
+  const requires = setting.requires.map((member) => String(member.path)).sort();
+  const requiredBy = setting.requiredBy.map((member) => String(member.path)).sort();
+  return requires.length > 0 && requires.join("\0") === requiredBy.join("\0");
+}
+function listOf(items, conjunction) {
+  if (items.length <= 1) return items[0] ?? "";
+  return `${items.slice(0, -1).join(", ")} ${conjunction} ${items[items.length - 1]}`;
+}
+var continuation = (sentence) => wrap(sentence, 72).map((line) => `      ${line}`);
 function wrap(text, width) {
   const lines = [];
   for (const paragraph of text.split(/\n\s*\n/)) {
@@ -19582,7 +20024,6 @@ Only approve a code you are looking at right now. Waiting\u2026
 }
 
 // src/commands/manifest-init.ts
-var import_yaml3 = __toESM(require_dist(), 1);
 async function runManifestInit(parsed) {
   const verb = parsed.command[1];
   if (verb !== "init") {
@@ -19687,7 +20128,7 @@ ${where}`);
   }
   process.stdout.write(
     parsed.flags["output"] === "json" ? `${JSON.stringify(document, null, 2)}
-` : (0, import_yaml3.stringify)(document)
+` : manifestYaml(document)
   );
   if (notes.length > 0) {
     process.stderr.write("\nStill yours to fill in:\n");
@@ -19901,12 +20342,16 @@ Options
       --output    json, for a pipeline that reads the answer
 
 Diagnosing
-  vfac doctor   checks the endpoint, the machine API, whether this client is new
-                enough for that platform, the credential and what that credential
-                can reach \u2014 in that order, so the first thing that is actually
-                wrong is the thing it reports. It ends by asking npm whether a
-                newer vfac has been published, which is a note and never a
-                failure. Set VFAC_NO_UPDATE_CHECK to skip that one request
+  vfac doctor   checks the config it could read, the endpoint, which Project this
+                terminal has selected and which one the command will act in, the
+                machine API, whether this client is new enough for that platform,
+                how this terminal is signed in and what that credential can reach
+                \u2014 in that order, so the first thing that is actually wrong is the
+                thing it reports. Pass --project to ask about the Project a
+                command would name, which changes nothing on disk. It ends by
+                asking npm whether a newer vfac has been published, which is a
+                note and never a failure. Set VFAC_NO_UPDATE_CHECK to skip that
+                one request
   vfac whoami   what this credential is, and which Project scopes it has been
                 GRANTED. A credential scoped to one Project deploys fine and
                 cannot make organization-wide reads \u2014 this is where that is said.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.15.0",
+  "version": "0.15.3",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",