@varde-flyt/vfac 0.15.2 → 0.15.3

package/README.md

@@ -91,8 +91,10 @@ operations of a resource are listed newest first, one page at a time; the
 vfac get operations --resource <productInstanceId>
 ```
 
-Secrets are supplied per apply and never belong in the manifest — a manifest is a
-file you commit. A value for a setting the Product declares secret is refused
+Secrets are passed as `--secret` inputs, beside the manifest and never in it — a manifest is a
+file you commit. Pass one when a resource is created, and afterwards only on a run that sets or
+changes one: a secret sent is a secret written, so a run that repeats one plans `UPDATE` rather
+than `NO_CHANGE`. A value for a setting the Product declares secret is refused
 at every door by the platform, and by `vfac` before the file is sent when the
 file pins the release the catalog currently offers. **Plan the run that sets one with the same `--secret` inputs the
 apply will carry**: `plan` takes the flag exactly as `apply` does, and without it

package/dist/vfac.mjs

@@ -14328,6 +14328,52 @@ function manifestYaml(document) {
   return (0, import_yaml.stringify)(document, { compat: "yaml-1.1" });
 }
 
+// ../platform-schemas/dist/governance-feed.js
+var GOVERNANCE_FEED_CATEGORIES = ["connections", "resources"];
+var OPAQUE_ID = /^[a-z]{2,4}_[0-9a-z]{10,40}$/;
+var opaqueId = external_exports.string().regex(OPAQUE_ID);
+var GovernanceFeedActorSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("person"), ref: external_exports.string().min(1).max(128) }),
+  external_exports.object({ type: external_exports.literal("platform") }),
+  external_exports.object({ type: external_exports.literal("resource"), id: opaqueId }),
+  external_exports.object({ type: external_exports.literal("system") })
+]);
+var GovernanceFeedEventSchema = external_exports.object({
+  /** The audit row's id. Stable, so a workspace can recognise a re-delivery. */
+  id: opaqueId,
+  /** The Control Plane's own event name, from its allowlist. */
+  event: external_exports.string().regex(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*){1,4}$/).max(80),
+  category: external_exports.enum(GOVERNANCE_FEED_CATEGORIES),
+  /** RFC 3339: when it happened. */
+  occurredAt: external_exports.string().datetime({ offset: true }),
+  actor: GovernanceFeedActorSchema,
+  action: external_exports.string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+  outcome: external_exports.enum(["success", "failure"]),
+  projectId: opaqueId.optional(),
+  /** The Resource the event is about — for a connection, the PROVIDER. */
+  resourceId: opaqueId.optional(),
+  /** For a connection between two Resources, the one that consumes it. */
+  consumerResourceId: opaqueId.optional(),
+  operationId: opaqueId.optional(),
+  target: external_exports.object({
+    type: external_exports.enum(["service_binding", "resource"]),
+    id: opaqueId.optional()
+  })
+});
+var GovernanceFeedPositionSchema = external_exports.object({
+  at: external_exports.string().datetime({ offset: true }),
+  id: external_exports.union([external_exports.literal(""), opaqueId])
+});
+var GOVERNANCE_FEED_MAX_LIMIT = 100;
+var GovernanceFeedRequestSchema = external_exports.object({
+  after: GovernanceFeedPositionSchema,
+  limit: external_exports.number().int().min(1).max(GOVERNANCE_FEED_MAX_LIMIT).optional()
+}).strict();
+var GovernanceFeedResponseSchema = external_exports.object({
+  events: external_exports.array(GovernanceFeedEventSchema).max(GOVERNANCE_FEED_MAX_LIMIT),
+  position: GovernanceFeedPositionSchema
+});
+
 // ../platform-schemas/dist/index.js
 var TENANT_KEY_REGEX = /^[a-z][a-z0-9-]{2,23}[a-z0-9]$/;
 var RESERVED_TENANT_KEYS = /* @__PURE__ */ new Set([
@@ -14453,7 +14499,7 @@ var kindSchema = (kind) => external_exports.literal(kind, {
   errorMap: () => ({ message: `kind must be "${kind}".` })
 });
 
-// ../product-contracts/dist/blocked-hosts.js
+// ../public-fetch/dist/index.js
 var BLOCKED_HOSTS = [
   /^localhost$/i,
   /^169\.254\./,
@@ -14686,6 +14732,7 @@ var IDENTITY_OIDC_CLIENT_V1 = {
   }
 };
 var DIRECTORY_SCOPES = [
+  "directory.group-members.list",
   "directory.groups.search",
   "directory.membership.check",
   "directory.principals.resolve",
@@ -14737,9 +14784,58 @@ var IDENTITY_DIRECTORY_V1 = {
     }
   }
 };
+var OBSERVABILITY_LOGS_SCOPES = ["logs.read", "logs.write"];
+var OBSERVABILITY_LOGS_V1 = {
+  kind: "service-api",
+  id: "observability.logs",
+  version: "v1",
+  // TENANT-MULTIPLE, for the reason the two identity interfaces are: an
+  // organization may run more than one log workspace — one per environment, one
+  // per department — and which one a Product emits to is the customer's answer
+  // rather than the platform's. There is deliberately no fallback to "the only
+  // one" when a Tenant happens to have exactly one, because that rule would
+  // change the day a second workspace is deployed and bind existing consumers
+  // by accident.
+  cardinality: "tenant-multiple",
+  summary: "Send operational log records to a log workspace in this organization, and optionally query them back. The provider returns an ingest address and a credential; the consumer calls it directly.",
+  maxRequestedScopes: OBSERVABILITY_LOGS_SCOPES.length,
+  scopes: OBSERVABILITY_LOGS_SCOPES,
+  // `logs.write` IS REQUIRED, and it is the only required scope on any
+  // interface in this file. The reason is that the alternative is incoherent
+  // rather than merely narrow: a binding to a log workspace that may not write
+  // to it has asked for a connection it cannot use for the thing the connection
+  // is for. A consumer that only wants to READ somebody else's records is not
+  // this interface's case — it is a query surface the providing Product
+  // exposes in its own right.
+  requiredScopes: ["logs.write"],
+  protocol: {
+    authScheme: "bearer",
+    credentialTransport: "authorization-header"
+  },
+  fields: {
+    ingestUrl: {
+      kind: "attribute",
+      always: true,
+      format: "https-url",
+      description: 'The base address records are sent to: `POST {ingestUrl}/records` with `{"records": [...]}`, each record `{message, severity, observedAt?, fields?}`. Operations are relative to it, so the provider can move them without a new binding.'
+    },
+    grantedScopes: {
+      kind: "attribute",
+      always: true,
+      format: "space-separated-tokens",
+      description: "Space-separated scopes actually granted, which may be narrower than those requested. Read this rather than assuming the request was honoured."
+    },
+    apiToken: {
+      kind: "secret",
+      always: true,
+      description: "The credential for the address above, presented as a bearer token. Delivered as a secret reference, never as an environment value, and rotatable without a new binding."
+    }
+  }
+};
 var SERVICE_INTERFACE_CONTRACTS = {
   "identity.oidc-client/v1": IDENTITY_OIDC_CLIENT_V1,
-  "identity.directory/v1": IDENTITY_DIRECTORY_V1
+  "identity.directory/v1": IDENTITY_DIRECTORY_V1,
+  "observability.logs/v1": OBSERVABILITY_LOGS_V1
 };
 var SERVICE_INTERFACE_KEYS = Object.keys(SERVICE_INTERFACE_CONTRACTS).sort();
 var SERVICE_INTERFACE_IDS = [
@@ -14998,11 +15094,35 @@ var ProductDependencySchema = external_exports.object({
 var ProductDependencyV2Schema = ProductDependencySchema.extend({
   requiredWhen: RequiredWhenV2Schema.optional()
 });
+function hasControlCharacter(value) {
+  for (let i = 0; i < value.length; i += 1) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127)
+      return true;
+  }
+  return false;
+}
+var GuidanceTextSchema = (min, max) => external_exports.string().min(min).max(max).refine((value) => !hasControlCharacter(value), {
+  message: "Guidance is one line, with no control characters."
+});
+var ConsumerGuidanceSchema = external_exports.object({
+  /** One paragraph: what this provider does with what a consumer sends or asks. */
+  summary: GuidanceTextSchema(20, 600),
+  /** Concrete, provider-specific practices, one per entry. */
+  notes: external_exports.array(GuidanceTextSchema(10, 400)).min(1).max(12).optional()
+}).strict();
 var ServiceInterfaceProvideSchema = external_exports.object({
   key: ServiceBindingKeySchema,
   interfaceId: ServiceInterfaceIdSchema,
   interfaceVersion: ServiceInterfaceVersionSchema,
-  cardinality: ServiceInterfaceCardinalitySchema
+  cardinality: ServiceInterfaceCardinalitySchema,
+  /**
+   * `.optional()`, NEVER `.default()`. A default materialises the key,
+   * `contractDigest` digests the parsed object, and every release published
+   * before this field existed would be refused on republish as
+   * `RELEASED_CONTRACT_MUTATED`.
+   */
+  consumerGuidance: ConsumerGuidanceSchema.optional()
 }).strict();
 var LifecycleCapabilitiesSchema = external_exports.object({
   upgrade: external_exports.boolean(),
@@ -16062,10 +16182,38 @@ var ComponentHealthSchema = external_exports.object({
   readiness: ProbeSchema,
   liveness: ProbeSchema
 }).strict();
+var PUBLIC_INGRESS_AUTHENTICATION = external_exports.enum([
+  "api-key",
+  "oauth2",
+  "mtls",
+  "signed-request",
+  "tenant-human-session"
+]);
+var HUMAN_SESSION_MECHANISMS = external_exports.array(external_exports.enum(["federated-oidc", "email-one-time-link", "local-password"])).min(1).max(3);
+var INGRESS_PATH_PREFIX = external_exports.string().regex(/^\/[a-z0-9\-/]*$/).max(64);
+var IngressSurfaceSchema = external_exports.object({
+  pathPrefix: INGRESS_PATH_PREFIX,
+  authentication: PUBLIC_INGRESS_AUTHENTICATION,
+  /** Required and refused exactly as the component-level field is. */
+  humanSessionMechanisms: HUMAN_SESSION_MECHANISMS.optional(),
+  /** Who calls this part of the component, for the reviewer. */
+  purpose: external_exports.string().min(20).max(300)
+}).strict();
+var MAX_INGRESS_SURFACES = 8;
 var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
   external_exports.object({
     exposure: external_exports.literal("public"),
     /**
+     * `oauth2`: the routes it names accept OAuth access tokens. The
+     * Authorization Server that issues them may be an external authority, or
+     * the Product may implement it itself — an MCP server that runs its own
+     * OAuth 2.1 discovery, authorization, consent, PKCE and token issuance
+     * declares `oauth2` for the endpoint those tokens reach. Either way
+     * the Product must truthfully implement and expose the flow it declares.
+     * The platform provides none of it implicitly: it runs no Authorization
+     * Server, registers no client, issues no token and validates none in
+     * front of the container.
+     *
      * `tenant-human-session` is the one that needs explaining: a console the
      * Product itself signs humans into, rather than delegating to a caller's
      * credential.
@@ -16086,16 +16234,18 @@ var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
      * defaulted to, it runs with mail disabled entirely, and the temporary
      * credential it bootstraps has its own list of properties in that section.
      *
-     * `oauth2` remains correct for a component that accepts a token somebody
-     * else minted. Declare this one when the Product owns the session.
+     * WHERE THE TWO MEET: a Product that is its own Authorization Server. The
+     * person approving a client must first be signed in through the Product's
+     * ordinary `tenant-human-session` — approving is something a signed-in
+     * person does, never a sign-in of its own — so the routes serving that
+     * sign-in and the approval declare `tenant-human-session` and its
+     * mechanisms, as the component's own `authentication` or as a surface,
+     * and the routes accepting the resulting tokens declare `oauth2`. `oauth2`
+     * describes how a token is PRESENTED, never how a person signs in:
+     * whoever issued the token, a sign-in the Product runs carries the
+     * obligation above.
      */
-    authentication: external_exports.enum([
-      "api-key",
-      "oauth2",
-      "mtls",
-      "signed-request",
-      "tenant-human-session"
-    ]),
+    authentication: PUBLIC_INGRESS_AUTHENTICATION,
     /**
      * WHICH of those three mechanisms this Product actually offers.
      *
@@ -16118,8 +16268,16 @@ var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
      * which — never a failure of another. Listing all three means all three
      * are implemented, not that the Product will fall back through them.
      */
-    humanSessionMechanisms: external_exports.array(external_exports.enum(["federated-oidc", "email-one-time-link", "local-password"])).min(1).max(3).optional(),
-    pathPrefix: external_exports.string().regex(/^\/[a-z0-9\-/]*$/).max(64),
+    humanSessionMechanisms: HUMAN_SESSION_MECHANISMS.optional(),
+    pathPrefix: INGRESS_PATH_PREFIX,
+    /**
+     * Parts of this component's routes that authenticate differently from
+     * `authentication` above. Optional, and `.optional()` rather than a
+     * default: a released Blueprint is re-parsed on the read path and its
+     * digest is taken over the parsed object, so a materialised empty list
+     * would refuse a republish of unchanged bytes.
+     */
+    surfaces: external_exports.array(IngressSurfaceSchema).min(1).max(MAX_INGRESS_SURFACES).optional(),
     /**
      * Why this component is public at all. docs/SECURITY.md §8 makes adding
      * public ingress a security-approval trigger; requiring the author to
@@ -16678,6 +16836,20 @@ var DataStoreSchema = external_exports.object({
    * or push it outside the contract — where nothing governs its retention,
    * its data categories or its deletion.
    *
+   * `log-store` was added for the same reason one level along: a Product that
+   * emits structured operational records about its own running — requests
+   * served, durations, outcomes — had nowhere in this contract to say so, and
+   * a store it cannot name is a store whose retention, data categories and
+   * deletion nothing governs. It is LOGS, deliberately and only. Metrics and
+   * traces are different capabilities with different shapes, and naming this
+   * one after the signal it carries is what keeps a later `metric-store` from
+   * being a silent widening of this one.
+   *
+   * PROVIDER-NEUTRAL, like every other name here. Nothing in this enum names
+   * an engine, a vendor or a wire format, and `log-store` must not become the
+   * exception — which implementation backs it is a platform promise published
+   * in `DATA_STORE_INTERFACES`, not a choice a publisher makes.
+   *
    * Naming a kind is a CONTRACT question. Whether this Control Plane can
    * provision it is a DEPLOYABILITY question, answered separately by
    * `validateDeployability` — see deployability.ts.
@@ -16689,7 +16861,8 @@ var DataStoreSchema = external_exports.object({
     "vector-index",
     "queue",
     "document-database",
-    "search-index"
+    "search-index",
+    "log-store"
   ]),
   purpose: external_exports.string().min(10).max(300),
   /**
@@ -16711,7 +16884,7 @@ var DataStoreSchema = external_exports.object({
   }).strict(),
   deleteBehavior: external_exports.enum(["purge-with-instance", "purge-after-retention"]),
   /**
-   * Ask for RUNTIME access to the store's own objects.
+   * Ask for RUNTIME access to the store's own contents.
    *
    * OPT-IN, AND PRESENT-OR-ABSENT RATHER THAN AN ENUM. A `mode` field would
    * have to be optional with a default to keep published documents parseable,
@@ -16720,17 +16893,31 @@ var DataStoreSchema = external_exports.object({
    * and a legitimate republish would be refused as an immutability conflict.
    * Presence is a cleaner discriminator and reads better in a diff.
    *
-   * WHAT IT DOES NOT GRANT: S3 credentials. The component receives an address,
-   * its own key prefix and a signing key for the platform's storage broker,
-   * which checks every key against the INSTANCE the signature proved. A
-   * Scaleway key cannot be scoped to a prefix, and the provider's quota is 50
-   * API keys per Organization, so one per Product Instance would cap the
-   * platform at roughly 45 of them.
+   * WHAT IT DOES NOT GRANT: a provider credential, on either kind that
+   * accepts it. The component receives an address, what identifies it, and a
+   * signing key for the platform service that brokers the access — and that
+   * service checks every request against the INSTANCE the signature proved.
+   *
+   * For `object-storage` the reason is that a Scaleway key cannot be scoped
+   * to a prefix or a bucket, and the provider's quota is 50 API keys per
+   * Organization, so one per Product Instance would cap the platform at
+   * roughly 45 of them. For `log-store` the reason is sharper: a Cockpit
+   * token carries a Project and a scope and has NO data-source field, and the
+   * whole platform lives in one Scaleway Project — so a token delivered to
+   * one Tenant's component would read and write every other Tenant's logs.
+   * Neither is a limit to work around; both are why the brokering service
+   * exists.
+   *
+   * WHICH KINDS MAY DECLARE IT is `RUNTIME_ACCESS_KINDS`, and the variables
+   * each one then receives are `RUNTIME_ACCESS_SUFFIXES`. The cross-field
+   * check below reads both.
    */
   runtimeAccess: external_exports.object({
     /**
-     * Names the variables the platform injects — `{PREFIX}_ENDPOINT_URL`,
-     * `_TENANT_ID`, `_PREFIX` and `_SIGNING_KEY`.
+     * Names the variables the platform injects: `{PREFIX}_ENDPOINT_URL`,
+     * `_TENANT_ID` and `_SIGNING_KEY` on every kind that accepts runtime
+     * access, plus `_PREFIX` on `object-storage`, which is the only one
+     * addressed by a key prefix.
      *
      * Bounded at 32 so every derived name fits `EnvVarNameSchema`'s 64, and
      * REFUSED at authoring time rather than silently truncated at deploy —
@@ -16749,6 +16936,17 @@ var DataStoreSchema = external_exports.object({
     access: external_exports.enum(["read-write", "read-only"])
   }).strict()).min(1).max(12)
 }).strict();
+var RUNTIME_ACCESS_SUFFIXES = {
+  "object-storage": ["_ENDPOINT_URL", "_TENANT_ID", "_PREFIX", "_SIGNING_KEY"],
+  "log-store": ["_ENDPOINT_URL", "_TENANT_ID", "_SIGNING_KEY"]
+};
+var RUNTIME_ACCESS_KINDS = new Set(Object.keys(RUNTIME_ACCESS_SUFFIXES));
+function runtimeAccessEnvNames(kind, envPrefix) {
+  const suffixes = RUNTIME_ACCESS_SUFFIXES[kind];
+  if (suffixes === void 0)
+    return [];
+  return suffixes.map((suffix) => `${envPrefix}${suffix}`);
+}
 var EgressRuleSchema = external_exports.object({
   componentId: ComponentIdSchema,
   destination: external_exports.discriminatedUnion("kind", [
@@ -17244,29 +17442,34 @@ function checkDeploymentBlueprint(blueprint, ctx) {
   });
   blueprint.components.forEach((component, index) => {
     if (component.ingress.exposure === "public") {
-      const mechanismPath = ["components", index, "ingress", "humanSessionMechanisms"];
-      const declared = component.ingress.humanSessionMechanisms;
-      if (component.ingress.authentication === "tenant-human-session") {
-        if (declared === void 0) {
+      const ingress = component.ingress;
+      checkHumanSessionMechanisms(ctx, ["components", index, "ingress"], ingress.authentication, ingress.humanSessionMechanisms);
+      const surfaces = ingress.surfaces ?? [];
+      const base = ingress.pathPrefix.replace(/\/+$/, "");
+      surfaces.forEach((surface, surfaceIndex) => {
+        const surfacePath = ["components", index, "ingress", "surfaces", surfaceIndex];
+        checkHumanSessionMechanisms(ctx, surfacePath, surface.authentication, surface.humanSessionMechanisms);
+        const prefix = surface.pathPrefix.replace(/\/+$/, "");
+        if (!(prefix.startsWith(`${base}/`) && prefix.length > base.length + 1)) {
           ctx.addIssue({
             code: external_exports.ZodIssueCode.custom,
-            path: mechanismPath,
-            message: "A component declaring `tenant-human-session` must name which approved mechanisms it implements, so a customer can tell whether it fits their organization before they deploy it."
-          });
-        } else if (new Set(declared).size !== declared.length) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: mechanismPath,
-            message: "Each mechanism may be named once."
+            path: [...surfacePath, "pathPrefix"],
+            message: `A surface covers part of the component's routes, so its prefix must lie under "${ingress.pathPrefix}" and differ from it.`
           });
         }
-      } else if (declared !== void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: mechanismPath,
-          message: "Only a component whose ingress authentication is `tenant-human-session` signs people in itself; remove this, or declare that authentication."
+        surfaces.forEach((other, otherIndex) => {
+          if (otherIndex <= surfaceIndex)
+            return;
+          const otherPrefix = other.pathPrefix.replace(/\/+$/, "");
+          if (otherPrefix === prefix || otherPrefix.startsWith(`${prefix}/`) || prefix.startsWith(`${otherPrefix}/`)) {
+            ctx.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["components", index, "ingress", "surfaces", otherIndex, "pathPrefix"],
+              message: `Surfaces "${surface.pathPrefix}" and "${other.pathPrefix}" overlap; a path may be claimed by one surface only.`
+            });
+          }
         });
-      }
+      });
     }
     const envNames = component.env.map((binding) => binding.name);
     const duplicateEnv = envNames.filter((name, i) => envNames.indexOf(name) !== i);
@@ -17596,11 +17799,11 @@ function checkDeploymentBlueprint(blueprint, ctx) {
     if (!access)
       return;
     const path = ["dataStores", index, "runtimeAccess"];
-    if (store.kind !== "object-storage") {
+    if (!RUNTIME_ACCESS_KINDS.has(store.kind)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path,
-        message: `Runtime access is only available for an object-storage store; "${store.id}" is a ${store.kind}.`
+        message: `Runtime access is only available for a ${[...RUNTIME_ACCESS_KINDS].sort().join(" or ")} store; "${store.id}" is a ${store.kind}.`
       });
     }
     const first = usedPrefixes.get(access.envPrefix);
@@ -17612,7 +17815,7 @@ function checkDeploymentBlueprint(blueprint, ctx) {
       });
     }
     usedPrefixes.set(access.envPrefix, index);
-    const derived = new Set(["_ENDPOINT_URL", "_TENANT_ID", "_PREFIX", "_SIGNING_KEY"].map((suffix) => `${access.envPrefix}${suffix}`));
+    const derived = new Set(runtimeAccessEnvNames(store.kind, access.envPrefix));
     const binders = new Set(store.bindings.map((binding) => binding.componentId));
     for (const component of blueprint.components) {
       if (!binders.has(component.id))
@@ -17813,6 +18016,30 @@ function checkDeploymentBlueprint(blueprint, ctx) {
     }
   }
 }
+function checkHumanSessionMechanisms(ctx, at, authentication, declared) {
+  const mechanismPath = [...at, "humanSessionMechanisms"];
+  if (authentication === "tenant-human-session") {
+    if (declared === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: mechanismPath,
+        message: "A component declaring `tenant-human-session` must name which approved mechanisms it implements, so a customer can tell whether it fits their organization before they deploy it."
+      });
+    } else if (new Set(declared).size !== declared.length) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: mechanismPath,
+        message: "Each mechanism may be named once."
+      });
+    }
+  } else if (declared !== void 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: mechanismPath,
+      message: "Only a component whose ingress authentication is `tenant-human-session` signs people in itself; remove this, or declare that authentication."
+    });
+  }
+}
 
 // ../product-contracts/dist/deployability.js
 var VIRTUAL_MACHINE_PROFILE_INTERFACE = {
@@ -18380,7 +18607,6 @@ function printPlan(plan, json) {
       }
     }
   }
-  lines.push(...requiredSecretLines(plan.requiredSecrets ?? []));
   if ((plan.secretsToWrite ?? []).length > 0) {
     lines.push(`  secrets to set: ${plan.secretsToWrite.join(", ")}`);
     for (const line of secretWriteConsequence(plan)) lines.push(`      ${line}`);
@@ -19548,7 +19774,7 @@ function renderProduct(product) {
   }
   const conditions = product.conditions ?? [];
   if (conditions.length > 0) {
-    lines.push("", "  Needs setting up outside the platform");
+    lines.push("", "  Conditions");
     for (const condition of conditions) {
       lines.push(`    ${condition.key ?? ""}  ${condition.displayName ?? ""}`.trimEnd());
     }
@@ -19559,7 +19785,10 @@ function renderProduct(product) {
     "  descriptions and value constraints are in the JSON form."
   );
   if (settings.some((setting) => setting.secret)) {
-    lines.push("  A credential is supplied per apply and never written into a manifest.");
+    lines.push(
+      "  A credential is passed with --secret when a resource is created, and afterwards only",
+      "  when you set or change one \u2014 never written into a manifest."
+    );
   }
   return lines.join("\n");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",