@varde-flyt/vfac 0.15.2 → 0.16.0

package/README.md

@@ -91,8 +91,10 @@ operations of a resource are listed newest first, one page at a time; the
 vfac get operations --resource <productInstanceId>
 ```
 
-Secrets are supplied per apply and never belong in the manifest — a manifest is a
-file you commit. A value for a setting the Product declares secret is refused
+Secrets are passed as `--secret` inputs, beside the manifest and never in it — a manifest is a
+file you commit. Pass one when a resource is created, and afterwards only on a run that sets or
+changes one: a secret sent is a secret written, so a run that repeats one plans `UPDATE` rather
+than `NO_CHANGE`. A value for a setting the Product declares secret is refused
 at every door by the platform, and by `vfac` before the file is sent when the
 file pins the release the catalog currently offers. **Plan the run that sets one with the same `--secret` inputs the
 apply will carry**: `plan` takes the flag exactly as `apply` does, and without it

package/dist/vfac.mjs

@@ -12337,12 +12337,12 @@ var CustomerConfigurationSchema = CustomerConfigurationObjectSchema.superRefine(
       });
     }
   }
-  const duplicates = (config.required ?? []).filter((name, index, all) => all.indexOf(name) !== index);
-  if (duplicates.length > 0) {
+  const duplicates2 = (config.required ?? []).filter((name, index, all) => all.indexOf(name) !== index);
+  if (duplicates2.length > 0) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
       path: ["required"],
-      message: `Duplicate required entries: ${[...new Set(duplicates)].join(", ")}.`
+      message: `Duplicate required entries: ${[...new Set(duplicates2)].join(", ")}.`
     });
   }
   checkDependentRequired(config, ctx);
@@ -14322,12 +14322,619 @@ function settingContainer(container, requiredByParent) {
   };
 }
 
+// ../log-access-contract/dist/operations.js
+var ALL_LOG_ACCESS_OPS = Object.freeze([
+  "append",
+  "query",
+  "aggregate",
+  "analyze"
+]);
+
+// ../log-access-contract/dist/limits.js
+var MAX_RECORDS_PER_APPEND = 500;
+var MAX_RECORD_BYTES = 16384;
+var MAX_APPEND_BYTES = 1048576;
+var MAX_APPEND_BODY_BYTES = 2 * MAX_APPEND_BYTES;
+var MAX_ATTRIBUTION_LENGTH = 128;
+var MAX_RECORD_FIELDS = 32;
+var MAX_FIELD_NAME_LENGTH = 64;
+var MAX_FIELD_VALUE_LENGTH = 2048;
+var MAX_QUERY_LIMIT = 1e3;
+var MAX_QUERY_WINDOW_SECONDS = 86400;
+var MAX_QUERY_FILTERS = 8;
+var MAX_AGGREGATE_WINDOW_SECONDS = 604800;
+var MIN_AGGREGATE_BUCKET_SECONDS = 60;
+var MAX_AGGREGATE_BUCKETS = 1440;
+var MAX_AGGREGATE_GROUPS = 100;
+var MAX_RECORDS_PER_TIMESTAMP = 5e3;
+var MAX_ANALYSIS_WINDOW_SECONDS = 604800;
+var MAX_ANALYSIS_PREDICATES = 8;
+var MAX_ANALYSIS_PREDICATE_VALUES = 16;
+var MAX_ANALYSIS_VALUE_BYTES = 16384;
+var MAX_ANALYSIS_GROUP_BY_FIELDS = 2;
+var MAX_ANALYSIS_GROUPS = 100;
+var MIN_ANALYSIS_BUCKET_SECONDS = MIN_AGGREGATE_BUCKET_SECONDS;
+var MAX_ANALYSIS_BUCKETS = MAX_AGGREGATE_BUCKETS;
+var MAX_ANALYSIS_CELLS = 1e4;
+
+// ../log-access-contract/dist/wire.js
+var LOG_ACCESS_REQUEST_HEADERS = Object.freeze({
+  signature: "x-vfac-signature",
+  operationId: "x-vfac-operation-id",
+  requestedAt: "x-vfac-requested-at",
+  productInstanceId: "x-vfac-product-instance-id"
+});
+var SIGNING_CANONICAL_FIELDS = Object.freeze([
+  "method",
+  "path",
+  "operationId",
+  "requestedAt",
+  "sha256(body)"
+]);
+var LOG_SEVERITIES = Object.freeze(["debug", "info", "warn", "error", "fatal"]);
+var RESERVED_RECORD_FIELDS = Object.freeze([
+  "message",
+  "severity",
+  "observedAt",
+  "receivedAt",
+  "attributedTo"
+]);
+var LOG_FIELD_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_.-]*$/;
+var UNGROUPABLE_RECORD_FIELDS = Object.freeze([
+  "message",
+  "observedAt",
+  "receivedAt"
+]);
+var ANALYSIS_TEXT_OPERATORS = Object.freeze([
+  "eq",
+  "neq",
+  "contains",
+  "notContains"
+]);
+var ANALYSIS_LIST_OPERATORS = Object.freeze(["in", "notIn"]);
+var ANALYSIS_PRESENCE_OPERATORS = Object.freeze(["exists", "notExists"]);
+var ANALYSIS_NUMERIC_OPERATORS = Object.freeze(["gt", "gte", "lt", "lte"]);
+var ANALYSIS_PREDICATE_OPERATORS = Object.freeze([
+  ...ANALYSIS_TEXT_OPERATORS,
+  ...ANALYSIS_LIST_OPERATORS,
+  ...ANALYSIS_PRESENCE_OPERATORS,
+  ...ANALYSIS_NUMERIC_OPERATORS
+]);
+var ANALYSIS_COUNTING_MEASURES = Object.freeze(["count", "rate"]);
+var ANALYSIS_FIELD_MEASURES = Object.freeze([
+  "sum",
+  "avg",
+  "min",
+  "max",
+  "percentile"
+]);
+var ANALYSIS_MEASURES = Object.freeze([
+  ...ANALYSIS_COUNTING_MEASURES,
+  ...ANALYSIS_FIELD_MEASURES
+]);
+var ANALYSIS_PERCENTILES = Object.freeze(["p50", "p90", "p95", "p99"]);
+var ANALYSIS_ORDERS = Object.freeze(["desc", "asc"]);
+var ANALYSIS_RESULT_KINDS = Object.freeze(["scalar", "groups", "timeseries"]);
+
+// ../log-access-contract/dist/refusals.js
+function listed(names, conjunction = "or") {
+  const quoted = names.map((name) => `\`${name}\``);
+  return quoted.length < 2 ? quoted.join("") : `${quoted.slice(0, -1).join(", ")} ${conjunction} ${quoted[quoted.length - 1]}`;
+}
+var ROUTES = ALL_LOG_ACCESS_OPS.map((op) => `/${op}`);
+var LOG_ACCESS_REFUSALS = Object.freeze({
+  missing_records: {
+    status: 400,
+    meaning: "no `records`, or one that is not a non-empty list"
+  },
+  too_many_records: {
+    status: 400,
+    meaning: `more than ${MAX_RECORDS_PER_APPEND} records in one append`
+  },
+  append_too_large: {
+    status: 400,
+    meaning: `the records exceed ${MAX_APPEND_BYTES} bytes as compact JSON, or the request body exceeds ${MAX_APPEND_BODY_BYTES} bytes`
+  },
+  record_too_large: {
+    status: 400,
+    meaning: `one record exceeds ${MAX_RECORD_BYTES} bytes. A log line, not a document`
+  },
+  too_many_fields: {
+    status: 400,
+    meaning: `one record carries more than ${MAX_RECORD_FIELDS} fields`
+  },
+  invalid_field: {
+    status: 400,
+    meaning: "a field name or value is empty, over-long, or carries a control character. Field names are structured keys and never stream labels, so none of them changes what your records are filed under"
+  },
+  reserved_field: {
+    status: 400,
+    meaning: `a field is named ${listed(RESERVED_RECORD_FIELDS)}. Those are the record\u2019s own keys and are stored beside your fields, so a field of the same name would overwrite one or be overwritten by it \u2014 rename the field`
+  },
+  invalid_attribution: {
+    status: 400,
+    meaning: `\`attributedTo\` is not one identifier of at most ${MAX_ATTRIBUTION_LENGTH} letters, digits, \`.\`, \`_\`, \`:\` or \`-\` starting with a letter or digit`
+  },
+  invalid_timestamp: {
+    status: 400,
+    meaning: "`observedAt` is not an RFC 3339 instant. The service stamps its own receipt time as well, and that one is what ordering uses"
+  },
+  invalid_severity: {
+    status: 400,
+    meaning: "`severity` is not one of the levels this contract defines"
+  },
+  invalid_window: {
+    status: 400,
+    meaning: `\`from\` and \`to\` are not an RFC 3339 range, are inverted, or span more than ${MAX_QUERY_WINDOW_SECONDS} seconds. Not the retention window \u2014 how much ONE query scans`
+  },
+  invalid_limit: {
+    status: 400,
+    meaning: `\`limit\` is not a whole number in 1\u2026${MAX_QUERY_LIMIT}`
+  },
+  invalid_filters: {
+    status: 400,
+    meaning: `\`filters\` is not a list of \`{field, equals}\`, or carries more than ${MAX_QUERY_FILTERS} entries`
+  },
+  invalid_cursor: {
+    status: 400,
+    meaning: "the `cursor` did not come from this service, or is not for this query. A page is resumed with the cursor the previous page returned, verbatim, and never composed"
+  },
+  invalid_aggregate: {
+    status: 400,
+    meaning: `the aggregate is not one this service answers: a window over ${MAX_AGGREGATE_WINDOW_SECONDS} seconds, a \`bucketSeconds\` under ${MIN_AGGREGATE_BUCKET_SECONDS} or not dividing the window into at most ${MAX_AGGREGATE_BUCKETS} whole buckets, a \`groupBy\` that is not a field identifier or names \`message\`, \`observedAt\` or \`receivedAt\`, a \`limit\` outside 1\u2026${MAX_AGGREGATE_GROUPS} or without \`groupBy\`, or both \`bucketSeconds\` and \`groupBy\``
+  },
+  invalid_analysis: {
+    status: 400,
+    meaning: `the analysis is not one this service answers: a member it does not define, at any level, or one missing that it needs; a window over ${MAX_ANALYSIS_WINDOW_SECONDS} seconds; an empty \`where\` or an empty list in it; more than ${MAX_ANALYSIS_PREDICATES} predicates counted everywhere, a group inside a group, an empty group, or an \`in\`/\`notIn\` list that is not 1\u2026${MAX_ANALYSIS_PREDICATE_VALUES} distinct values; a field that is not an identifier; a value that is empty, longer than ${MAX_FIELD_VALUE_LENGTH} characters, not well-formed Unicode or carrying a control character, or values together over ${MAX_ANALYSIS_VALUE_BYTES} bytes; a number that is not finite; a measure or a numeric predicate on ${listed(RESERVED_RECORD_FIELDS)}; more than ${MAX_ANALYSIS_GROUP_BY_FIELDS} or repeated \`groupBy\` fields, or one naming ${listed(UNGROUPABLE_RECORD_FIELDS)}; a \`limit\` missing with \`groupBy\`, present without it or outside 1\u2026${MAX_ANALYSIS_GROUPS}; an \`order\` without \`groupBy\`; a \`bucketSeconds\` under ${MIN_ANALYSIS_BUCKET_SECONDS}, a \`from\` or \`to\` that is not a whole multiple of it since 1970-01-01T00:00:00Z, or more than ${MAX_ANALYSIS_BUCKETS} buckets; or buckets times \`limit\` over ${MAX_ANALYSIS_CELLS}`
+  },
+  analysis_timed_out: {
+    status: 504,
+    meaning: "the provider did not answer within the time one analysis gets. The same analysis is likely to time out again, so narrow the window, the selection or the grouping rather than repeating it \u2014 unlike `log_store_error`, this says the question was too expensive rather than that the provider faltered"
+  },
+  analysis_too_broad: {
+    status: 400,
+    meaning: "ranking the groups met more distinct values than can be ranked in one answer. Not transient \u2014 narrow the window or the selection, or group by a field with fewer values"
+  },
+  ingest_suspended: {
+    status: 403,
+    meaning: "this Product Instance may read its records and may not add one. Its Tenant is being drained or is not active \u2014 see `writable` on the authorization record"
+  },
+  query_not_granted: {
+    status: 403,
+    meaning: "this Product Instance may add records and may not read them back"
+  },
+  log_store_error: {
+    status: 502,
+    meaning: "the provider refused or did not answer. Not yours to fix, and the one refusal here worth retrying"
+  },
+  timestamp_group_too_large: {
+    status: 502,
+    meaning: `more than ${MAX_RECORDS_PER_TIMESTAMP} records share one timestamp, so this page cannot be answered without skipping some. Refused rather than answered incompletely; not yours to fix`
+  },
+  log_store_capacity: {
+    status: 503,
+    meaning: "the provider is rate-limiting or over quota. Retry with backoff; records already accepted are kept"
+  }
+});
+var HANDLER_REFUSALS = Object.freeze({
+  invalid_body: { status: 400, meaning: "the request body is not JSON" },
+  invalid_op: {
+    status: 400,
+    meaning: `no \`op\`, or one this route does not serve \u2014 ${listed(ROUTES, "and")} each serve the operation they are named after`
+  },
+  forbidden: {
+    status: 403,
+    meaning: "the credential verified and does not hold this operation\u2019s permission. Not an authentication failure \u2014 see 401 for those"
+  },
+  log_access_unconfigured: {
+    status: 503,
+    meaning: "this deployment cannot present a working provider credential \u2014 it has none, or the provider refused the one it has \u2014 so it can broker nothing. An operator problem, not a caller one, and not worth retrying at a caller\u2019s pace: it clears when an operator or the platform replaces the credential"
+  }
+});
+var AUTHENTICATION_REFUSALS = Object.freeze({
+  unauthorized: {
+    status: 401,
+    meaning: "the signature, the headers, the clock, or an instance that does not exist. Which one is never said"
+  },
+  operation_replay: {
+    status: 409,
+    meaning: "that operation id has been used inside the replay window. Sign a retry with a NEW one"
+  },
+  unavailable: {
+    status: 503,
+    meaning: "the platform could not read this instance\u2019s credential. Transient; retry"
+  },
+  replay_store_unavailable: {
+    status: 503,
+    meaning: "the replay store did not answer, so this request cannot be proved to be a first use. Refused rather than accepted; retry with a fresh operation id"
+  }
+});
+var ALL_REFUSALS = Object.freeze({
+  ...LOG_ACCESS_REFUSALS,
+  ...HANDLER_REFUSALS
+});
+
+// ../log-access-contract/dist/log-semantics.js
+var LOG_EVENT_FIELD = "event";
+var LOG_SCHEMA_REF_FIELD = "vfac_log_schema";
+var LOG_SEMANTICS_FORMAT_V1 = "log-semantics.vardeflyt.no/v1";
+
+// ../log-access-contract/dist/analysis-examples.js
+var ANALYZE_REQUEST_EXAMPLES = Object.freeze([
+  {
+    id: "p95-per-operation-over-time",
+    asks: "The 95th percentile of `duration_ms` per operation, in five-minute buckets, over the production records that are errors or failed",
+    request: {
+      op: "analyze",
+      from: "2026-09-21T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      where: {
+        all: [{ field: "environment", op: "eq", value: "prod" }],
+        any: [
+          { field: "severity", op: "eq", value: "error" },
+          { field: "outcome", op: "eq", value: "failed" }
+        ]
+      },
+      measure: { op: "percentile", field: "duration_ms", percentile: "p95" },
+      groupBy: ["operation"],
+      bucketSeconds: 300,
+      limit: 20
+    }
+  },
+  {
+    id: "error-count",
+    asks: "How many records in a day were errors or worse",
+    request: {
+      op: "analyze",
+      from: "2026-09-21T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      where: { all: [{ field: "severity", op: "in", values: ["error", "fatal"] }] },
+      measure: { op: "count" }
+    }
+  },
+  {
+    id: "slowest-routes",
+    asks: "The ten slowest checkout routes of the week per environment, counting only requests that took a second or more",
+    request: {
+      op: "analyze",
+      from: "2026-09-15T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      where: {
+        all: [
+          { field: "duration_ms", op: "gte", value: 1e3 },
+          { field: "route", op: "contains", value: "/checkout" }
+        ]
+      },
+      measure: { op: "max", field: "duration_ms" },
+      groupBy: ["route", "environment"],
+      limit: 10,
+      order: "desc"
+    }
+  },
+  {
+    id: "grouped-alternatives",
+    asks: "How many records in each environment either failed or took a second or more, counting only the two checkout routes",
+    request: {
+      op: "analyze",
+      from: "2026-09-21T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      where: {
+        all: [
+          {
+            any: [
+              { field: "route", op: "eq", value: "/checkout" },
+              { field: "route", op: "eq", value: "/checkout/pay" }
+            ]
+          },
+          {
+            any: [
+              { field: "outcome", op: "eq", value: "failed" },
+              { field: "duration_ms", op: "gte", value: 1e3 }
+            ]
+          }
+        ]
+      },
+      measure: { op: "count" },
+      groupBy: ["environment"],
+      limit: 5
+    }
+  },
+  {
+    id: "hourly-rate",
+    asks: "Records per second, hour by hour, over a day",
+    request: {
+      op: "analyze",
+      from: "2026-09-21T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      measure: { op: "rate" },
+      bucketSeconds: 3600
+    }
+  }
+]);
+var ANALYZE_RESPONSE_EXAMPLES = Object.freeze({
+  scalar: { ok: true, kind: "scalar", value: 124 },
+  groups: {
+    ok: true,
+    kind: "groups",
+    groups: [
+      { dimensions: { route: "/checkout/pay", environment: "prod" }, value: 4210 },
+      { dimensions: { route: "/checkout", environment: null }, value: 1830 }
+    ],
+    truncated: true
+  },
+  timeseries: {
+    ok: true,
+    kind: "timeseries",
+    bucketSeconds: 300,
+    series: [
+      {
+        dimensions: { operation: "deploy" },
+        points: [
+          { start: "2026-09-21T00:00:00.000Z", value: 431 },
+          { start: "2026-09-21T00:05:00.000Z", value: null }
+        ]
+      }
+    ],
+    truncated: false
+  }
+});
+
+// ../log-access-contract/dist/workspace-ingest.js
+var WORKSPACE_INGEST_STATUSES = Object.freeze({
+  202: "accepted in full \u2014 the body is `{accepted}` and it equals the number of records sent. Anything short of that is not an acknowledgement",
+  400: "the batch is malformed; `error` is a record refusal code. Do not retry it unchanged",
+  401: "the credential is not valid for this address. Stop sending until the binding changes",
+  403: "the credential does not hold `logs.write`. Stop sending until the binding changes",
+  429: "the workspace is over its rate. Back off, honouring `Retry-After` when present",
+  503: "the workspace cannot take records now. Retry with backoff"
+});
+
+// ../product-configuration/dist/log-semantics.js
+var MAX_LOG_SEMANTICS_EVENTS = 128;
+var MAX_LOG_SEMANTICS_FIELDS = 64;
+var MAX_LOG_EVENT_FIELDS = MAX_RECORD_FIELDS - 2;
+var MAX_LOG_FIELD_VALUES = 32;
+var MAX_LOG_CORRELATION_FIELDS = 8;
+var MAX_LOG_INTERPRETATION_NOTES = 12;
+var MAX_LOG_EVENT_NAME_LENGTH = 128;
+var MAX_LOG_SEMANTICS_BYTES = 131072;
+var LOG_FIELD_TYPES = Object.freeze(["string", "number", "boolean"]);
+var LOG_EVENT_DELIVERY = Object.freeze(["at-least-once", "best-effort"]);
+var LOG_EVENT_NAME_PATTERN = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)*$/;
+function hasControlCharacter(value) {
+  for (let i = 0; i < value.length; i += 1) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127)
+      return true;
+  }
+  return false;
+}
+var TextSchema = (min, max) => external_exports.string().min(min).max(max).refine((value) => !hasControlCharacter(value), {
+  message: "Descriptor text is one line, with no control characters."
+});
+var FieldNameSchema = external_exports.string().min(1).max(MAX_FIELD_NAME_LENGTH).regex(LOG_FIELD_NAME_PATTERN, "A field name follows the ingest wire rule.");
+var LogFieldValueSchema = external_exports.object({
+  /** One value the field can hold, exactly as a record carries it. */
+  value: TextSchema(1, 128),
+  /** What that value means. */
+  meaning: TextSchema(3, 300)
+}).strict();
+var LogFieldSchema = external_exports.object({
+  name: FieldNameSchema,
+  type: external_exports.enum(LOG_FIELD_TYPES),
+  meaning: TextSchema(10, 400),
+  /** The unit a number is measured in: `ms`, `bytes`, `EUR`. Numbers only. */
+  unit: TextSchema(1, 32).optional(),
+  /** Values a string field holds, each explained. Strings only. */
+  values: external_exports.array(LogFieldValueSchema).min(1).max(MAX_LOG_FIELD_VALUES).optional(),
+  /**
+   * `true`: `values` is every value the field can hold, so a record carrying
+   * another is out of contract. Absent: `values` explains the known ones.
+   */
+  closed: external_exports.literal(true).optional()
+}).strict();
+var LogEventFieldSchema = external_exports.object({
+  /** A declared field this event's records carry. */
+  field: FieldNameSchema,
+  /** Whether every record of this event carries it. */
+  required: external_exports.boolean()
+}).strict();
+var LogEventSchema = external_exports.object({
+  name: external_exports.string().min(1).max(MAX_LOG_EVENT_NAME_LENGTH).regex(LOG_EVENT_NAME_PATTERN, "An event name is dotted lowercase segments."),
+  meaning: TextSchema(10, 400),
+  /** When the producer actually emits it — the condition, not the intent. */
+  whenProduced: TextSchema(10, 400),
+  delivery: external_exports.enum(LOG_EVENT_DELIVERY).optional(),
+  /** The declared fields its records carry, beyond `event` and `vfac_log_schema`. */
+  fields: external_exports.array(LogEventFieldSchema).max(MAX_LOG_EVENT_FIELDS)
+}).strict();
+var LogCorrelationSchema = external_exports.object({
+  /** A declared field records can be joined on. */
+  field: FieldNameSchema,
+  meaning: TextSchema(10, 300)
+}).strict();
+var LogInterpretationSchema = external_exports.object({
+  /** What it means when a field an event may carry is absent. */
+  absentField: TextSchema(10, 600),
+  /** Whether a record can arrive more than once, and how to tell. */
+  duplicates: TextSchema(10, 600),
+  correlation: external_exports.array(LogCorrelationSchema).min(1).max(MAX_LOG_CORRELATION_FIELDS).optional(),
+  notes: external_exports.array(TextSchema(10, 400)).min(1).max(MAX_LOG_INTERPRETATION_NOTES).optional()
+}).strict();
+var LogSemanticsDescriptorObjectSchema = external_exports.object({
+  format: external_exports.literal(LOG_SEMANTICS_FORMAT_V1),
+  fields: external_exports.array(LogFieldSchema).min(1).max(MAX_LOG_SEMANTICS_FIELDS),
+  events: external_exports.array(LogEventSchema).min(1).max(MAX_LOG_SEMANTICS_EVENTS),
+  interpretation: LogInterpretationSchema
+}).strict();
+var UNDECLARABLE = /* @__PURE__ */ new Set([
+  ...RESERVED_RECORD_FIELDS,
+  LOG_EVENT_FIELD,
+  LOG_SCHEMA_REF_FIELD
+]);
+function duplicates(values) {
+  const seen = /* @__PURE__ */ new Set();
+  const repeated = /* @__PURE__ */ new Set();
+  for (const value of values)
+    (seen.has(value) ? repeated : seen).add(value);
+  return [...repeated];
+}
+var LogSemanticsDescriptorSchema = LogSemanticsDescriptorObjectSchema.superRefine((descriptor, ctx) => {
+  const issue = (path, message) => ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path, message });
+  const declared = new Set(descriptor.fields.map((field) => field.name));
+  for (const name of duplicates(descriptor.fields.map((field) => field.name))) {
+    issue(["fields"], `Field "${name}" is declared more than once.`);
+  }
+  for (const name of duplicates(descriptor.events.map((event) => event.name))) {
+    issue(["events"], `Event "${name}" is declared more than once.`);
+  }
+  descriptor.fields.forEach((field, i) => {
+    if (UNDECLARABLE.has(field.name)) {
+      issue(["fields", i, "name"], `"${field.name}" is the record's own key or a convention field, and is not declared.`);
+    }
+    if (field.unit !== void 0 && field.type !== "number") {
+      issue(["fields", i, "unit"], "Only a number field has a unit.");
+    }
+    if (field.values !== void 0 && field.type !== "string") {
+      issue(["fields", i, "values"], "Only a string field lists values.");
+    }
+    if (field.closed !== void 0 && field.values === void 0) {
+      issue(["fields", i, "closed"], "A closed field lists its values.");
+    }
+    for (const value of duplicates((field.values ?? []).map((entry) => entry.value))) {
+      issue(["fields", i, "values"], `Value "${value}" is explained more than once.`);
+    }
+  });
+  descriptor.events.forEach((event, i) => {
+    for (const name of duplicates(event.fields.map((entry) => entry.field))) {
+      issue(["events", i, "fields"], `Event "${event.name}" lists "${name}" more than once.`);
+    }
+    event.fields.forEach((entry, j) => {
+      if (!declared.has(entry.field)) {
+        issue(["events", i, "fields", j, "field"], `Event "${event.name}" names "${entry.field}", which is not a declared field.`);
+      }
+    });
+  });
+  const correlation = descriptor.interpretation.correlation ?? [];
+  for (const name of duplicates(correlation.map((entry) => entry.field))) {
+    issue(["interpretation", "correlation"], `Correlation field "${name}" is listed twice.`);
+  }
+  correlation.forEach((entry, i) => {
+    if (!declared.has(entry.field)) {
+      issue(["interpretation", "correlation", i, "field"], `"${entry.field}" is not a declared field.`);
+    }
+  });
+  const bytes = logSemanticsByteLength(descriptor);
+  if (bytes > MAX_LOG_SEMANTICS_BYTES) {
+    issue([], `The descriptor is ${bytes} bytes as canonical JSON, over the ${MAX_LOG_SEMANTICS_BYTES}-byte bound.`);
+  }
+});
+function logSemanticsByteLength(descriptor) {
+  return new TextEncoder().encode(canonicalJson(descriptor)).length;
+}
+
 // ../product-configuration/dist/manifest-yaml.js
 var import_yaml = __toESM(require_dist(), 1);
 function manifestYaml(document) {
   return (0, import_yaml.stringify)(document, { compat: "yaml-1.1" });
 }
 
+// ../platform-schemas/dist/governance-feed.js
+var GOVERNANCE_FEED_CATEGORIES = ["connections", "resources"];
+var OPAQUE_ID = /^[a-z]{2,4}_[0-9a-z]{10,40}$/;
+var opaqueId = external_exports.string().regex(OPAQUE_ID);
+var GovernanceFeedActorSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("person"), ref: external_exports.string().min(1).max(128) }),
+  external_exports.object({ type: external_exports.literal("platform") }),
+  external_exports.object({ type: external_exports.literal("resource"), id: opaqueId }),
+  external_exports.object({ type: external_exports.literal("system") })
+]);
+var connection = (action, description, outcome = "success") => ({
+  category: "connections",
+  action,
+  outcome,
+  target: "service_binding",
+  description
+});
+var resource = (action, description, outcome = "success") => ({
+  category: "resources",
+  action,
+  outcome,
+  target: "resource",
+  description
+});
+var GOVERNANCE_FEED_RULES = Object.freeze({
+  // The portal's own connection.
+  "service_binding.platform.connected": connection("connect", "The organization portal was connected to its log workspace."),
+  "service_binding.platform.disconnected": connection("disconnect", "The organization portal was disconnected from its log workspace."),
+  "service_binding.platform.rotation_requested": connection("rotate", "A new credential was requested for the portal\u2019s connection to its log workspace."),
+  "service_binding.platform.ready": connection("complete", "The log workspace completed the portal\u2019s connection; records can be delivered."),
+  "service_binding.platform.rotated": connection("rotate_complete", "The log workspace issued the portal\u2019s connection a new credential."),
+  "service_binding.platform.failed": connection("complete", "The log workspace could not complete the portal\u2019s connection.", "failure"),
+  "service_binding.platform.rotation_failed": connection("rotate_complete", "The log workspace could not issue the portal\u2019s connection a new credential.", "failure"),
+  "service_binding.platform.released": connection("release", "The log workspace finished removing the portal\u2019s connection."),
+  // Connections between Resources.
+  "service_binding.disconnected": connection("disconnect", "A connection between two Resources was disconnected."),
+  "service_binding.rotation_requested": connection("rotate", "A new credential was requested for a connection between two Resources."),
+  "service_binding.ready": connection("complete", "The providing Resource completed a connection; the consuming Resource can use it."),
+  "service_binding.rotated": connection("rotate_complete", "The providing Resource issued a connection a new credential."),
+  "service_binding.failed": connection("complete", "The providing Resource could not complete a connection.", "failure"),
+  "service_binding.rotation_failed": connection("rotate_complete", "The providing Resource could not issue a connection a new credential.", "failure"),
+  "service_binding.released": connection("release", "The providing Resource finished removing a connection."),
+  // How an operation on a Resource ended.
+  "product.instance.active": resource("from-operation-type", "An operation on a Resource completed and the Resource is running; action names the operation."),
+  "product.instance.suspended": resource("suspend", "A Resource was suspended."),
+  "product.instance.deleted": resource("delete", "A Resource was deleted."),
+  "product.instance.reconcile.failed": resource("reconcile", "An operation on a Resource failed and the platform stopped retrying it.", "failure"),
+  "product.instance.upgrade.hop_committed": resource("upgrade", "A Resource finished moving to a new version."),
+  "product.instance.upgrade.abandoned": resource("upgrade", "A Resource\u2019s move to a new version was abandoned; it stays on the version it had.", "failure")
+});
+var GOVERNANCE_FEED_EVENT_TYPES = Object.freeze(Object.keys(GOVERNANCE_FEED_RULES).sort());
+var GOVERNANCE_FEED_OPERATION_ACTIONS = Object.freeze({
+  PRODUCT_INSTANCE_CREATE: "create",
+  PRODUCT_INSTANCE_UPDATE: "configure",
+  PRODUCT_INSTANCE_UPGRADE: "upgrade",
+  PRODUCT_INSTANCE_SUSPEND: "suspend",
+  PRODUCT_INSTANCE_RESUME: "resume",
+  PRODUCT_INSTANCE_DELETE: "delete",
+  PRODUCT_INSTANCE_RECONCILE: "reconcile"
+});
+var GovernanceFeedEventSchema = external_exports.object({
+  /** The audit row's id. Stable, so a workspace can recognise a re-delivery. */
+  id: opaqueId,
+  /** The Control Plane's own event name, from its allowlist. */
+  event: external_exports.string().regex(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*){1,4}$/).max(80),
+  category: external_exports.enum(GOVERNANCE_FEED_CATEGORIES),
+  /** RFC 3339: when it happened. */
+  occurredAt: external_exports.string().datetime({ offset: true }),
+  actor: GovernanceFeedActorSchema,
+  action: external_exports.string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+  outcome: external_exports.enum(["success", "failure"]),
+  projectId: opaqueId.optional(),
+  /** The Resource the event is about — for a connection, the PROVIDER. */
+  resourceId: opaqueId.optional(),
+  /** For a connection between two Resources, the one that consumes it. */
+  consumerResourceId: opaqueId.optional(),
+  operationId: opaqueId.optional(),
+  target: external_exports.object({
+    type: external_exports.enum(["service_binding", "resource"]),
+    id: opaqueId.optional()
+  })
+});
+var GovernanceFeedPositionSchema = external_exports.object({
+  at: external_exports.string().datetime({ offset: true }),
+  id: external_exports.union([external_exports.literal(""), opaqueId])
+});
+var GOVERNANCE_FEED_MAX_LIMIT = 100;
+var GovernanceFeedRequestSchema = external_exports.object({
+  after: GovernanceFeedPositionSchema,
+  limit: external_exports.number().int().min(1).max(GOVERNANCE_FEED_MAX_LIMIT).optional()
+}).strict();
+var GovernanceFeedResponseSchema = external_exports.object({
+  events: external_exports.array(GovernanceFeedEventSchema).max(GOVERNANCE_FEED_MAX_LIMIT),
+  position: GovernanceFeedPositionSchema
+});
+
 // ../platform-schemas/dist/index.js
 var TENANT_KEY_REGEX = /^[a-z][a-z0-9-]{2,23}[a-z0-9]$/;
 var RESERVED_TENANT_KEYS = /* @__PURE__ */ new Set([
@@ -14453,7 +15060,7 @@ var kindSchema = (kind) => external_exports.literal(kind, {
   errorMap: () => ({ message: `kind must be "${kind}".` })
 });
 
-// ../product-contracts/dist/blocked-hosts.js
+// ../public-fetch/dist/index.js
 var BLOCKED_HOSTS = [
   /^localhost$/i,
   /^169\.254\./,
@@ -14686,6 +15293,7 @@ var IDENTITY_OIDC_CLIENT_V1 = {
   }
 };
 var DIRECTORY_SCOPES = [
+  "directory.group-members.list",
   "directory.groups.search",
   "directory.membership.check",
   "directory.principals.resolve",
@@ -14737,9 +15345,58 @@ var IDENTITY_DIRECTORY_V1 = {
     }
   }
 };
+var OBSERVABILITY_LOGS_SCOPES = ["logs.read", "logs.write"];
+var OBSERVABILITY_LOGS_V1 = {
+  kind: "service-api",
+  id: "observability.logs",
+  version: "v1",
+  // TENANT-MULTIPLE, for the reason the two identity interfaces are: an
+  // organization may run more than one log workspace — one per environment, one
+  // per department — and which one a Product emits to is the customer's answer
+  // rather than the platform's. There is deliberately no fallback to "the only
+  // one" when a Tenant happens to have exactly one, because that rule would
+  // change the day a second workspace is deployed and bind existing consumers
+  // by accident.
+  cardinality: "tenant-multiple",
+  summary: "Send operational log records to a log workspace in this organization, and optionally query them back. The provider returns an ingest address and a credential; the consumer calls it directly.",
+  maxRequestedScopes: OBSERVABILITY_LOGS_SCOPES.length,
+  scopes: OBSERVABILITY_LOGS_SCOPES,
+  // `logs.write` IS REQUIRED, and it is the only required scope on any
+  // interface in this file. The reason is that the alternative is incoherent
+  // rather than merely narrow: a binding to a log workspace that may not write
+  // to it has asked for a connection it cannot use for the thing the connection
+  // is for. A consumer that only wants to READ somebody else's records is not
+  // this interface's case — it is a query surface the providing Product
+  // exposes in its own right.
+  requiredScopes: ["logs.write"],
+  protocol: {
+    authScheme: "bearer",
+    credentialTransport: "authorization-header"
+  },
+  fields: {
+    ingestUrl: {
+      kind: "attribute",
+      always: true,
+      format: "https-url",
+      description: 'The base address records are sent to: `POST {ingestUrl}/records` with `{"records": [...]}`, each record `{message, severity, observedAt?, fields?}`. Operations are relative to it, so the provider can move them without a new binding.'
+    },
+    grantedScopes: {
+      kind: "attribute",
+      always: true,
+      format: "space-separated-tokens",
+      description: "Space-separated scopes actually granted, which may be narrower than those requested. Read this rather than assuming the request was honoured."
+    },
+    apiToken: {
+      kind: "secret",
+      always: true,
+      description: "The credential for the address above, presented as a bearer token. Delivered as a secret reference, never as an environment value, and rotatable without a new binding."
+    }
+  }
+};
 var SERVICE_INTERFACE_CONTRACTS = {
   "identity.oidc-client/v1": IDENTITY_OIDC_CLIENT_V1,
-  "identity.directory/v1": IDENTITY_DIRECTORY_V1
+  "identity.directory/v1": IDENTITY_DIRECTORY_V1,
+  "observability.logs/v1": OBSERVABILITY_LOGS_V1
 };
 var SERVICE_INTERFACE_KEYS = Object.keys(SERVICE_INTERFACE_CONTRACTS).sort();
 var SERVICE_INTERFACE_IDS = [
@@ -14998,11 +15655,35 @@ var ProductDependencySchema = external_exports.object({
 var ProductDependencyV2Schema = ProductDependencySchema.extend({
   requiredWhen: RequiredWhenV2Schema.optional()
 });
+function hasControlCharacter2(value) {
+  for (let i = 0; i < value.length; i += 1) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127)
+      return true;
+  }
+  return false;
+}
+var GuidanceTextSchema = (min, max) => external_exports.string().min(min).max(max).refine((value) => !hasControlCharacter2(value), {
+  message: "Guidance is one line, with no control characters."
+});
+var ConsumerGuidanceSchema = external_exports.object({
+  /** One paragraph: what this provider does with what a consumer sends or asks. */
+  summary: GuidanceTextSchema(20, 600),
+  /** Concrete, provider-specific practices, one per entry. */
+  notes: external_exports.array(GuidanceTextSchema(10, 400)).min(1).max(12).optional()
+}).strict();
 var ServiceInterfaceProvideSchema = external_exports.object({
   key: ServiceBindingKeySchema,
   interfaceId: ServiceInterfaceIdSchema,
   interfaceVersion: ServiceInterfaceVersionSchema,
-  cardinality: ServiceInterfaceCardinalitySchema
+  cardinality: ServiceInterfaceCardinalitySchema,
+  /**
+   * `.optional()`, NEVER `.default()`. A default materialises the key,
+   * `contractDigest` digests the parsed object, and every release published
+   * before this field existed would be refused on republish as
+   * `RELEASED_CONTRACT_MUTATED`.
+   */
+  consumerGuidance: ConsumerGuidanceSchema.optional()
 }).strict();
 var LifecycleCapabilitiesSchema = external_exports.object({
   upgrade: external_exports.boolean(),
@@ -15133,6 +15814,17 @@ var ProductDefinitionObjectSchema = external_exports.object({
    * Read absence through the empty array at the use site instead.
    */
   serviceInterfaces: external_exports.object({ provides: external_exports.array(ServiceInterfaceProvideSchema).min(1).max(4) }).strict().optional(),
+  /**
+   * What this Product's own log records mean — see `log-semantics.ts` in `product-configuration`.
+   *
+   * `.optional()`, NEVER `.default()`. A default materialises the key,
+   * `contractDigest` digests the parsed object, and every release published
+   * before this field existed would be refused on republish as
+   * `RELEASED_CONTRACT_MUTATED`. A NEW release that sends records to
+   * `observability.logs/v1` must declare it (`validatePublishableDefinition`);
+   * a record never needs it to be accepted.
+   */
+  observability: external_exports.object({ logs: LogSemanticsDescriptorSchema }).strict().optional(),
   lifecycle: LifecycleCapabilitiesSchema,
   policies: PolicyReferencesSchema,
   /**
@@ -16062,10 +16754,38 @@ var ComponentHealthSchema = external_exports.object({
   readiness: ProbeSchema,
   liveness: ProbeSchema
 }).strict();
+var PUBLIC_INGRESS_AUTHENTICATION = external_exports.enum([
+  "api-key",
+  "oauth2",
+  "mtls",
+  "signed-request",
+  "tenant-human-session"
+]);
+var HUMAN_SESSION_MECHANISMS = external_exports.array(external_exports.enum(["federated-oidc", "email-one-time-link", "local-password"])).min(1).max(3);
+var INGRESS_PATH_PREFIX = external_exports.string().regex(/^\/[a-z0-9\-/]*$/).max(64);
+var IngressSurfaceSchema = external_exports.object({
+  pathPrefix: INGRESS_PATH_PREFIX,
+  authentication: PUBLIC_INGRESS_AUTHENTICATION,
+  /** Required and refused exactly as the component-level field is. */
+  humanSessionMechanisms: HUMAN_SESSION_MECHANISMS.optional(),
+  /** Who calls this part of the component, for the reviewer. */
+  purpose: external_exports.string().min(20).max(300)
+}).strict();
+var MAX_INGRESS_SURFACES = 8;
 var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
   external_exports.object({
     exposure: external_exports.literal("public"),
     /**
+     * `oauth2`: the routes it names accept OAuth access tokens. The
+     * Authorization Server that issues them may be an external authority, or
+     * the Product may implement it itself — an MCP server that runs its own
+     * OAuth 2.1 discovery, authorization, consent, PKCE and token issuance
+     * declares `oauth2` for the endpoint those tokens reach. Either way
+     * the Product must truthfully implement and expose the flow it declares.
+     * The platform provides none of it implicitly: it runs no Authorization
+     * Server, registers no client, issues no token and validates none in
+     * front of the container.
+     *
      * `tenant-human-session` is the one that needs explaining: a console the
      * Product itself signs humans into, rather than delegating to a caller's
      * credential.
@@ -16086,16 +16806,18 @@ var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
      * defaulted to, it runs with mail disabled entirely, and the temporary
      * credential it bootstraps has its own list of properties in that section.
      *
-     * `oauth2` remains correct for a component that accepts a token somebody
-     * else minted. Declare this one when the Product owns the session.
+     * WHERE THE TWO MEET: a Product that is its own Authorization Server. The
+     * person approving a client must first be signed in through the Product's
+     * ordinary `tenant-human-session` — approving is something a signed-in
+     * person does, never a sign-in of its own — so the routes serving that
+     * sign-in and the approval declare `tenant-human-session` and its
+     * mechanisms, as the component's own `authentication` or as a surface,
+     * and the routes accepting the resulting tokens declare `oauth2`. `oauth2`
+     * describes how a token is PRESENTED, never how a person signs in:
+     * whoever issued the token, a sign-in the Product runs carries the
+     * obligation above.
      */
-    authentication: external_exports.enum([
-      "api-key",
-      "oauth2",
-      "mtls",
-      "signed-request",
-      "tenant-human-session"
-    ]),
+    authentication: PUBLIC_INGRESS_AUTHENTICATION,
     /**
      * WHICH of those three mechanisms this Product actually offers.
      *
@@ -16118,8 +16840,16 @@ var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
      * which — never a failure of another. Listing all three means all three
      * are implemented, not that the Product will fall back through them.
      */
-    humanSessionMechanisms: external_exports.array(external_exports.enum(["federated-oidc", "email-one-time-link", "local-password"])).min(1).max(3).optional(),
-    pathPrefix: external_exports.string().regex(/^\/[a-z0-9\-/]*$/).max(64),
+    humanSessionMechanisms: HUMAN_SESSION_MECHANISMS.optional(),
+    pathPrefix: INGRESS_PATH_PREFIX,
+    /**
+     * Parts of this component's routes that authenticate differently from
+     * `authentication` above. Optional, and `.optional()` rather than a
+     * default: a released Blueprint is re-parsed on the read path and its
+     * digest is taken over the parsed object, so a materialised empty list
+     * would refuse a republish of unchanged bytes.
+     */
+    surfaces: external_exports.array(IngressSurfaceSchema).min(1).max(MAX_INGRESS_SURFACES).optional(),
     /**
      * Why this component is public at all. docs/SECURITY.md §8 makes adding
      * public ingress a security-approval trigger; requiring the author to
@@ -16153,7 +16883,15 @@ var InstanceEnvBindingSchema = external_exports.object({
     "productVersion",
     "profile",
     "region",
-    "environment"
+    "environment",
+    /**
+     * The reference of the log-semantics descriptor this release's
+     * Definition declares — the value a record carries in
+     * `vfac_log_schema`. Resolved from the release the component is
+     * deployed from, so during an upgrade each container carries its own
+     * release's. A Definition declaring no descriptor cannot bind it.
+     */
+    "logSemanticsRef"
   ])
 }).strict();
 var PlatformEnvBindingSchema = external_exports.object({
@@ -16678,6 +17416,20 @@ var DataStoreSchema = external_exports.object({
    * or push it outside the contract — where nothing governs its retention,
    * its data categories or its deletion.
    *
+   * `log-store` was added for the same reason one level along: a Product that
+   * emits structured operational records about its own running — requests
+   * served, durations, outcomes — had nowhere in this contract to say so, and
+   * a store it cannot name is a store whose retention, data categories and
+   * deletion nothing governs. It is LOGS, deliberately and only. Metrics and
+   * traces are different capabilities with different shapes, and naming this
+   * one after the signal it carries is what keeps a later `metric-store` from
+   * being a silent widening of this one.
+   *
+   * PROVIDER-NEUTRAL, like every other name here. Nothing in this enum names
+   * an engine, a vendor or a wire format, and `log-store` must not become the
+   * exception — which implementation backs it is a platform promise published
+   * in `DATA_STORE_INTERFACES`, not a choice a publisher makes.
+   *
    * Naming a kind is a CONTRACT question. Whether this Control Plane can
    * provision it is a DEPLOYABILITY question, answered separately by
    * `validateDeployability` — see deployability.ts.
@@ -16689,7 +17441,8 @@ var DataStoreSchema = external_exports.object({
     "vector-index",
     "queue",
     "document-database",
-    "search-index"
+    "search-index",
+    "log-store"
   ]),
   purpose: external_exports.string().min(10).max(300),
   /**
@@ -16711,7 +17464,7 @@ var DataStoreSchema = external_exports.object({
   }).strict(),
   deleteBehavior: external_exports.enum(["purge-with-instance", "purge-after-retention"]),
   /**
-   * Ask for RUNTIME access to the store's own objects.
+   * Ask for RUNTIME access to the store's own contents.
    *
    * OPT-IN, AND PRESENT-OR-ABSENT RATHER THAN AN ENUM. A `mode` field would
    * have to be optional with a default to keep published documents parseable,
@@ -16720,17 +17473,31 @@ var DataStoreSchema = external_exports.object({
    * and a legitimate republish would be refused as an immutability conflict.
    * Presence is a cleaner discriminator and reads better in a diff.
    *
-   * WHAT IT DOES NOT GRANT: S3 credentials. The component receives an address,
-   * its own key prefix and a signing key for the platform's storage broker,
-   * which checks every key against the INSTANCE the signature proved. A
-   * Scaleway key cannot be scoped to a prefix, and the provider's quota is 50
-   * API keys per Organization, so one per Product Instance would cap the
-   * platform at roughly 45 of them.
+   * WHAT IT DOES NOT GRANT: a provider credential, on either kind that
+   * accepts it. The component receives an address, what identifies it, and a
+   * signing key for the platform service that brokers the access — and that
+   * service checks every request against the INSTANCE the signature proved.
+   *
+   * For `object-storage` the reason is that a Scaleway key cannot be scoped
+   * to a prefix or a bucket, and the provider's quota is 50 API keys per
+   * Organization, so one per Product Instance would cap the platform at
+   * roughly 45 of them. For `log-store` the reason is sharper: a Cockpit
+   * token carries a Project and a scope and has NO data-source field, and the
+   * whole platform lives in one Scaleway Project — so a token delivered to
+   * one Tenant's component would read and write every other Tenant's logs.
+   * Neither is a limit to work around; both are why the brokering service
+   * exists.
+   *
+   * WHICH KINDS MAY DECLARE IT is `RUNTIME_ACCESS_KINDS`, and the variables
+   * each one then receives are `RUNTIME_ACCESS_SUFFIXES`. The cross-field
+   * check below reads both.
    */
   runtimeAccess: external_exports.object({
     /**
-     * Names the variables the platform injects — `{PREFIX}_ENDPOINT_URL`,
-     * `_TENANT_ID`, `_PREFIX` and `_SIGNING_KEY`.
+     * Names the variables the platform injects: `{PREFIX}_ENDPOINT_URL`,
+     * `_TENANT_ID` and `_SIGNING_KEY` on every kind that accepts runtime
+     * access, plus `_PREFIX` on `object-storage`, which is the only one
+     * addressed by a key prefix.
      *
      * Bounded at 32 so every derived name fits `EnvVarNameSchema`'s 64, and
      * REFUSED at authoring time rather than silently truncated at deploy —
@@ -16749,6 +17516,17 @@ var DataStoreSchema = external_exports.object({
     access: external_exports.enum(["read-write", "read-only"])
   }).strict()).min(1).max(12)
 }).strict();
+var RUNTIME_ACCESS_SUFFIXES = {
+  "object-storage": ["_ENDPOINT_URL", "_TENANT_ID", "_PREFIX", "_SIGNING_KEY"],
+  "log-store": ["_ENDPOINT_URL", "_TENANT_ID", "_SIGNING_KEY"]
+};
+var RUNTIME_ACCESS_KINDS = new Set(Object.keys(RUNTIME_ACCESS_SUFFIXES));
+function runtimeAccessEnvNames(kind, envPrefix) {
+  const suffixes = RUNTIME_ACCESS_SUFFIXES[kind];
+  if (suffixes === void 0)
+    return [];
+  return suffixes.map((suffix) => `${envPrefix}${suffix}`);
+}
 var EgressRuleSchema = external_exports.object({
   componentId: ComponentIdSchema,
   destination: external_exports.discriminatedUnion("kind", [
@@ -17155,7 +17933,7 @@ function checkDeploymentBlueprint(blueprint, ctx) {
       message: `Artifact source "${id}" is declared more than once.`
     });
   });
-  const duplicateTypes = (blueprint.dynamicResources ?? []).map((resource) => resource.type).filter((type, index, all) => all.indexOf(type) !== index);
+  const duplicateTypes = (blueprint.dynamicResources ?? []).map((resource2) => resource2.type).filter((type, index, all) => all.indexOf(type) !== index);
   [...new Set(duplicateTypes)].forEach((type) => {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -17163,15 +17941,15 @@ function checkDeploymentBlueprint(blueprint, ctx) {
       message: `"${type}" is declared more than once. A resource type may appear at most once: everything that reads this list resolves a capability by its type.`
     });
   });
-  (blueprint.dynamicResources ?? []).forEach((resource, index) => {
-    if (!sourceIds.has(resource.bootstrap.artifactSource)) {
+  (blueprint.dynamicResources ?? []).forEach((resource2, index) => {
+    if (!sourceIds.has(resource2.bootstrap.artifactSource)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["dynamicResources", index, "bootstrap", "artifactSource"],
-        message: `No artifact source "${resource.bootstrap.artifactSource}" is declared. Declare it in "artifactSources" first.`
+        message: `No artifact source "${resource2.bootstrap.artifactSource}" is declared. Declare it in "artifactSources" first.`
       });
     }
-    resource.consumers.forEach((consumerId, position) => {
+    resource2.consumers.forEach((consumerId, position) => {
       if (!knownComponents.has(consumerId)) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
@@ -17189,7 +17967,7 @@ function checkDeploymentBlueprint(blueprint, ctx) {
         });
       }
     });
-    const handoff = resource.bootstrap.productHandoff;
+    const handoff = resource2.bootstrap.productHandoff;
     if (handoff !== void 0) {
       const handoffPath = ["dynamicResources", index, "bootstrap", "productHandoff", "componentId"];
       const target = blueprint.components.find((component) => component.id === handoff.componentId);
@@ -17213,7 +17991,7 @@ function checkDeploymentBlueprint(blueprint, ctx) {
             message: `Component "${handoff.componentId}" declares "${target.ingress.exposure}" ingress. A Product handoff target must declare public ingress: the machine reaches it from outside the platform's network, which is the whole point of an outbound handoff.`
           });
         }
-        if (!resource.consumers.includes(handoff.componentId)) {
+        if (!resource2.consumers.includes(handoff.componentId)) {
           ctx.addIssue({
             code: external_exports.ZodIssueCode.custom,
             path: handoffPath,
@@ -17244,29 +18022,34 @@ function checkDeploymentBlueprint(blueprint, ctx) {
   });
   blueprint.components.forEach((component, index) => {
     if (component.ingress.exposure === "public") {
-      const mechanismPath = ["components", index, "ingress", "humanSessionMechanisms"];
-      const declared = component.ingress.humanSessionMechanisms;
-      if (component.ingress.authentication === "tenant-human-session") {
-        if (declared === void 0) {
+      const ingress = component.ingress;
+      checkHumanSessionMechanisms(ctx, ["components", index, "ingress"], ingress.authentication, ingress.humanSessionMechanisms);
+      const surfaces = ingress.surfaces ?? [];
+      const base = ingress.pathPrefix.replace(/\/+$/, "");
+      surfaces.forEach((surface, surfaceIndex) => {
+        const surfacePath = ["components", index, "ingress", "surfaces", surfaceIndex];
+        checkHumanSessionMechanisms(ctx, surfacePath, surface.authentication, surface.humanSessionMechanisms);
+        const prefix = surface.pathPrefix.replace(/\/+$/, "");
+        if (!(prefix.startsWith(`${base}/`) && prefix.length > base.length + 1)) {
           ctx.addIssue({
             code: external_exports.ZodIssueCode.custom,
-            path: mechanismPath,
-            message: "A component declaring `tenant-human-session` must name which approved mechanisms it implements, so a customer can tell whether it fits their organization before they deploy it."
-          });
-        } else if (new Set(declared).size !== declared.length) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: mechanismPath,
-            message: "Each mechanism may be named once."
+            path: [...surfacePath, "pathPrefix"],
+            message: `A surface covers part of the component's routes, so its prefix must lie under "${ingress.pathPrefix}" and differ from it.`
           });
         }
-      } else if (declared !== void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: mechanismPath,
-          message: "Only a component whose ingress authentication is `tenant-human-session` signs people in itself; remove this, or declare that authentication."
+        surfaces.forEach((other, otherIndex) => {
+          if (otherIndex <= surfaceIndex)
+            return;
+          const otherPrefix = other.pathPrefix.replace(/\/+$/, "");
+          if (otherPrefix === prefix || otherPrefix.startsWith(`${prefix}/`) || prefix.startsWith(`${otherPrefix}/`)) {
+            ctx.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["components", index, "ingress", "surfaces", otherIndex, "pathPrefix"],
+              message: `Surfaces "${surface.pathPrefix}" and "${other.pathPrefix}" overlap; a path may be claimed by one surface only.`
+            });
+          }
         });
-      }
+      });
     }
     const envNames = component.env.map((binding) => binding.name);
     const duplicateEnv = envNames.filter((name, i) => envNames.indexOf(name) !== i);
@@ -17596,11 +18379,11 @@ function checkDeploymentBlueprint(blueprint, ctx) {
     if (!access)
       return;
     const path = ["dataStores", index, "runtimeAccess"];
-    if (store.kind !== "object-storage") {
+    if (!RUNTIME_ACCESS_KINDS.has(store.kind)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path,
-        message: `Runtime access is only available for an object-storage store; "${store.id}" is a ${store.kind}.`
+        message: `Runtime access is only available for a ${[...RUNTIME_ACCESS_KINDS].sort().join(" or ")} store; "${store.id}" is a ${store.kind}.`
       });
     }
     const first = usedPrefixes.get(access.envPrefix);
@@ -17612,7 +18395,7 @@ function checkDeploymentBlueprint(blueprint, ctx) {
       });
     }
     usedPrefixes.set(access.envPrefix, index);
-    const derived = new Set(["_ENDPOINT_URL", "_TENANT_ID", "_PREFIX", "_SIGNING_KEY"].map((suffix) => `${access.envPrefix}${suffix}`));
+    const derived = new Set(runtimeAccessEnvNames(store.kind, access.envPrefix));
     const binders = new Set(store.bindings.map((binding) => binding.componentId));
     for (const component of blueprint.components) {
       if (!binders.has(component.id))
@@ -17795,12 +18578,12 @@ function checkDeploymentBlueprint(blueprint, ctx) {
         message: `\`${edges.field}\` declares versions this Product ${edges.role}, but \`lifecycle.${edges.operation}.supported\` is false.`
       });
     }
-    const duplicates = versions.filter((version, i) => versions.indexOf(version) !== i);
-    if (duplicates.length > 0) {
+    const duplicates2 = versions.filter((version, i) => versions.indexOf(version) !== i);
+    if (duplicates2.length > 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: [...edges.path],
-        message: `Duplicate versions: ${[...new Set(duplicates)].join(", ")}.`
+        message: `Duplicate versions: ${[...new Set(duplicates2)].join(", ")}.`
       });
     }
     const notOlder = versions.filter((version) => compareSemver(version, blueprint.productVersion) >= 0);
@@ -17813,6 +18596,30 @@ function checkDeploymentBlueprint(blueprint, ctx) {
     }
   }
 }
+function checkHumanSessionMechanisms(ctx, at, authentication, declared) {
+  const mechanismPath = [...at, "humanSessionMechanisms"];
+  if (authentication === "tenant-human-session") {
+    if (declared === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: mechanismPath,
+        message: "A component declaring `tenant-human-session` must name which approved mechanisms it implements, so a customer can tell whether it fits their organization before they deploy it."
+      });
+    } else if (new Set(declared).size !== declared.length) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: mechanismPath,
+        message: "Each mechanism may be named once."
+      });
+    }
+  } else if (declared !== void 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: mechanismPath,
+      message: "Only a component whose ingress authentication is `tenant-human-session` signs people in itself; remove this, or declare that authentication."
+    });
+  }
+}
 
 // ../product-contracts/dist/deployability.js
 var VIRTUAL_MACHINE_PROFILE_INTERFACE = {
@@ -17979,6 +18786,46 @@ var PUBLISH_RULE_ANNEX = {
           }
         }
       }
+    },
+    {
+      // THE SAME ASYMMETRY, for what a producer's log records mean — and only
+      // for a producer: the rule is conditional on a dependency on
+      // `observability.logs/v1`, the one declaration that means "sends log
+      // records". Presence is all JSON Schema says; the descriptor's own rules
+      // are in its schema.
+      $comment: "A new release that sends records to observability.logs/v1 (a dependency on that interface) must declare definition.observability.logs: the events it produces and the fields they carry. A log record is never refused for lacking one.",
+      if: {
+        required: ["definition"],
+        properties: {
+          definition: {
+            required: ["dependencies"],
+            properties: {
+              dependencies: {
+                contains: {
+                  required: ["interface"],
+                  properties: {
+                    interface: {
+                      required: ["id", "version"],
+                      properties: {
+                        id: { const: "observability.logs" },
+                        version: { const: "v1" }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      then: {
+        properties: {
+          definition: {
+            required: ["observability"],
+            properties: { observability: { required: ["logs"] } }
+          }
+        }
+      }
     }
   ]
 };
@@ -18380,7 +19227,6 @@ function printPlan(plan, json) {
       }
     }
   }
-  lines.push(...requiredSecretLines(plan.requiredSecrets ?? []));
   if ((plan.secretsToWrite ?? []).length > 0) {
     lines.push(`  secrets to set: ${plan.secretsToWrite.join(", ")}`);
     for (const line of secretWriteConsequence(plan)) lines.push(`      ${line}`);
@@ -19164,21 +20010,21 @@ async function runGet(parsed, deps = {}) {
 `);
       return 0;
     }
-    const resource = result.data["resource"] ?? {};
+    const resource2 = result.data["resource"] ?? {};
     const lines = [
-      `${String(resource["productInstanceId"] ?? instanceId)}  ${String(resource["status"] ?? "")}  ${String(resource["displayName"] ?? "")}`,
-      `  product   ${String(resource["productId"] ?? "")} ${String(resource["productVersion"] ?? "")}`,
-      `  region    ${String(resource["region"] ?? "")}`,
-      `  profile   ${String(resource["profile"] ?? "")}`
+      `${String(resource2["productInstanceId"] ?? instanceId)}  ${String(resource2["status"] ?? "")}  ${String(resource2["displayName"] ?? "")}`,
+      `  product   ${String(resource2["productId"] ?? "")} ${String(resource2["productVersion"] ?? "")}`,
+      `  region    ${String(resource2["region"] ?? "")}`,
+      `  profile   ${String(resource2["profile"] ?? "")}`
     ];
-    const key = resource["manifestKey"];
+    const key = resource2["manifestKey"];
     if (typeof key === "string") lines.push(`  key       ${key}`);
-    const outputs = resource["outputs"] ?? {};
-    const declared = Array.isArray(resource["outputDeclarations"]) ? resource["outputDeclarations"] : [];
+    const outputs = resource2["outputs"] ?? {};
+    const declared = Array.isArray(resource2["outputDeclarations"]) ? resource2["outputDeclarations"] : [];
     const declaredNames = declared.map((entry) => entry["key"]).filter((key2) => typeof key2 === "string");
     const names = [.../* @__PURE__ */ new Set([...Object.keys(outputs), ...declaredNames])].sort();
     const isSecret2 = (name) => declared.find((entry) => entry["key"] === name)?.["secret"] === true;
-    const conditions = Array.isArray(resource["conditions"]) ? resource["conditions"] : [];
+    const conditions = Array.isArray(resource2["conditions"]) ? resource2["conditions"] : [];
     if (conditions.length > 0) {
       lines.push("", "  Operational");
       const width = Math.max(
@@ -19217,7 +20063,7 @@ async function runGet(parsed, deps = {}) {
         }
       }
     } else {
-      const status = String(resource["status"] ?? "");
+      const status = String(resource2["status"] ?? "");
       lines.push(
         "",
         status === "DELETED" ? "  No outputs. This resource was deleted." : status === "FAILED" ? "  No outputs. Its deployment failed \u2014 `vfac get operation` says why." : "  No outputs yet. A resource publishes them when provisioning resolves them."
@@ -19284,7 +20130,7 @@ This is one page. Continue with --cursor ${result.nextCursor ?? ""}
       process.stderr.write("No Project. Use --project prj_\u2026 or set one in your context.\n");
       return 2;
     }
-    const resource = parsed.flags["resource"];
+    const resource2 = parsed.flags["resource"];
     const result = await readAllPages({
       endpoint: session.ready.endpoint,
       token: session.ready.token,
@@ -19293,7 +20139,7 @@ This is one page. Continue with --cursor ${result.nextCursor ?? ""}
       cursor: parsed.flags["cursor"],
       pageSize: parsed.flags["page-size"],
       onePage: true,
-      ...resource === void 0 ? {} : { query: { productInstanceId: resource } }
+      ...resource2 === void 0 ? {} : { query: { productInstanceId: resource2 } }
     });
     if (!result.ok) {
       if (result.error.status === 404 && result.error.code === "NOT_FOUND") {
@@ -19313,7 +20159,7 @@ This is one page. Continue with --cursor ${result.nextCursor ?? ""}
     }
     if (result.items.length === 0) {
       process.stdout.write(
-        resource === void 0 ? "No operations in this project.\n" : "No operations for this resource in this project.\n"
+        resource2 === void 0 ? "No operations in this project.\n" : "No operations for this resource in this project.\n"
       );
       return 0;
     }
@@ -19548,7 +20394,7 @@ function renderProduct(product) {
   }
   const conditions = product.conditions ?? [];
   if (conditions.length > 0) {
-    lines.push("", "  Needs setting up outside the platform");
+    lines.push("", "  Conditions");
     for (const condition of conditions) {
       lines.push(`    ${condition.key ?? ""}  ${condition.displayName ?? ""}`.trimEnd());
     }
@@ -19559,7 +20405,10 @@ function renderProduct(product) {
     "  descriptions and value constraints are in the JSON form."
   );
   if (settings.some((setting) => setting.secret)) {
-    lines.push("  A credential is supplied per apply and never written into a manifest.");
+    lines.push(
+      "  A credential is passed with --secret when a resource is created, and afterwards only",
+      "  when you set or change one \u2014 never written into a manifest."
+    );
   }
   return lines.join("\n");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.15.2",
+  "version": "0.16.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",