@varde-flyt/vfac 0.15.3 → 0.17.0

package/README.md

@@ -228,13 +228,38 @@ holding on to:
 | `valueFrom.resourceOutput` | read a value another resource publishes |
 | `dependencyBindings` | use that resource as the PROVIDER for a declared dependency |
 
-A connection is established once. **A manifest can make one and cannot move
-one**: pointing an existing connection at a different resource is refused rather
-than performed, because a file you re-apply on every push must not be able to
-silently move a running service onto a different identity provider. The
-credential the connection delivers never appears in your manifest, in a plan, or
-in any `vfac` output — the providing service issues it and the platform stores
-it.
+An entry means one of three things, and only one of them releases anything:
+
+| The manifest says | What `vfac apply` does |
+| --- | --- |
+| nothing for the key | leaves that connection exactly as it is |
+| `resourceKey: …` | connects to that resource, or keeps the connection it has |
+| `state: disconnected` | releases the connection, in the same apply as your settings |
+
+```yaml
+spec:
+  configuration:
+    signIn: Disabled            # whatever setting made the connection necessary
+  dependencyBindings:
+    <dependency-key>:
+      state: disconnected
+```
+
+Leaving a key out never releases anything, so a manifest written before this
+field existed re-applies unchanged. `vfac plan` lists a release under
+`connections to disconnect` before you approve it. A dependency the Product
+requires cannot be disconnected; one a setting makes required can be, in the same
+file that turns the setting off. A released connection is torn down by its
+provider afterwards, and the providing resource can only be deleted once that
+teardown is done.
+
+**A manifest never moves a connection in one apply**: pointing an existing
+connection at a different resource is refused rather than performed, because a
+file you re-apply on every push must not be able to silently move a running
+service onto a different identity provider. Disconnect it and apply, then name
+the new resource and apply again. The credential the connection delivers never
+appears in your manifest, in a plan, or in any `vfac` output — the providing
+service issues it and the platform stores it.
 
 ## For an agent or a pipeline
 

package/dist/vfac.mjs

@@ -12337,12 +12337,12 @@ var CustomerConfigurationSchema = CustomerConfigurationObjectSchema.superRefine(
       });
     }
   }
-  const duplicates = (config.required ?? []).filter((name, index, all) => all.indexOf(name) !== index);
-  if (duplicates.length > 0) {
+  const duplicates2 = (config.required ?? []).filter((name, index, all) => all.indexOf(name) !== index);
+  if (duplicates2.length > 0) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
       path: ["required"],
-      message: `Duplicate required entries: ${[...new Set(duplicates)].join(", ")}.`
+      message: `Duplicate required entries: ${[...new Set(duplicates2)].join(", ")}.`
     });
   }
   checkDependentRequired(config, ctx);
@@ -14322,6 +14322,517 @@ function settingContainer(container, requiredByParent) {
   };
 }
 
+// ../log-access-contract/dist/operations.js
+var ALL_LOG_ACCESS_OPS = Object.freeze([
+  "append",
+  "query",
+  "aggregate",
+  "analyze"
+]);
+
+// ../log-access-contract/dist/limits.js
+var MAX_RECORDS_PER_APPEND = 500;
+var MAX_RECORD_BYTES = 16384;
+var MAX_APPEND_BYTES = 1048576;
+var MAX_APPEND_BODY_BYTES = 2 * MAX_APPEND_BYTES;
+var MAX_ATTRIBUTION_LENGTH = 128;
+var MAX_RECORD_FIELDS = 32;
+var MAX_FIELD_NAME_LENGTH = 64;
+var MAX_FIELD_VALUE_LENGTH = 2048;
+var MAX_QUERY_LIMIT = 1e3;
+var MAX_QUERY_WINDOW_SECONDS = 86400;
+var MAX_QUERY_FILTERS = 8;
+var MAX_AGGREGATE_WINDOW_SECONDS = 604800;
+var MIN_AGGREGATE_BUCKET_SECONDS = 60;
+var MAX_AGGREGATE_BUCKETS = 1440;
+var MAX_AGGREGATE_GROUPS = 100;
+var MAX_RECORDS_PER_TIMESTAMP = 5e3;
+var MAX_ANALYSIS_WINDOW_SECONDS = 604800;
+var MAX_ANALYSIS_PREDICATES = 8;
+var MAX_ANALYSIS_PREDICATE_VALUES = 16;
+var MAX_ANALYSIS_VALUE_BYTES = 16384;
+var MAX_ANALYSIS_GROUP_BY_FIELDS = 2;
+var MAX_ANALYSIS_GROUPS = 100;
+var MIN_ANALYSIS_BUCKET_SECONDS = MIN_AGGREGATE_BUCKET_SECONDS;
+var MAX_ANALYSIS_BUCKETS = MAX_AGGREGATE_BUCKETS;
+var MAX_ANALYSIS_CELLS = 1e4;
+
+// ../log-access-contract/dist/wire.js
+var LOG_ACCESS_REQUEST_HEADERS = Object.freeze({
+  signature: "x-vfac-signature",
+  operationId: "x-vfac-operation-id",
+  requestedAt: "x-vfac-requested-at",
+  productInstanceId: "x-vfac-product-instance-id"
+});
+var SIGNING_CANONICAL_FIELDS = Object.freeze([
+  "method",
+  "path",
+  "operationId",
+  "requestedAt",
+  "sha256(body)"
+]);
+var LOG_SEVERITIES = Object.freeze(["debug", "info", "warn", "error", "fatal"]);
+var RESERVED_RECORD_FIELDS = Object.freeze([
+  "message",
+  "severity",
+  "observedAt",
+  "receivedAt",
+  "attributedTo"
+]);
+var LOG_FIELD_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_.-]*$/;
+var UNGROUPABLE_RECORD_FIELDS = Object.freeze([
+  "message",
+  "observedAt",
+  "receivedAt"
+]);
+var ANALYSIS_TEXT_OPERATORS = Object.freeze([
+  "eq",
+  "neq",
+  "contains",
+  "notContains"
+]);
+var ANALYSIS_LIST_OPERATORS = Object.freeze(["in", "notIn"]);
+var ANALYSIS_PRESENCE_OPERATORS = Object.freeze(["exists", "notExists"]);
+var ANALYSIS_NUMERIC_OPERATORS = Object.freeze(["gt", "gte", "lt", "lte"]);
+var ANALYSIS_PREDICATE_OPERATORS = Object.freeze([
+  ...ANALYSIS_TEXT_OPERATORS,
+  ...ANALYSIS_LIST_OPERATORS,
+  ...ANALYSIS_PRESENCE_OPERATORS,
+  ...ANALYSIS_NUMERIC_OPERATORS
+]);
+var ANALYSIS_COUNTING_MEASURES = Object.freeze(["count", "rate"]);
+var ANALYSIS_FIELD_MEASURES = Object.freeze([
+  "sum",
+  "avg",
+  "min",
+  "max",
+  "percentile"
+]);
+var ANALYSIS_MEASURES = Object.freeze([
+  ...ANALYSIS_COUNTING_MEASURES,
+  ...ANALYSIS_FIELD_MEASURES
+]);
+var ANALYSIS_PERCENTILES = Object.freeze(["p50", "p90", "p95", "p99"]);
+var ANALYSIS_ORDERS = Object.freeze(["desc", "asc"]);
+var ANALYSIS_RESULT_KINDS = Object.freeze(["scalar", "groups", "timeseries"]);
+
+// ../log-access-contract/dist/refusals.js
+function listed(names, conjunction = "or") {
+  const quoted = names.map((name) => `\`${name}\``);
+  return quoted.length < 2 ? quoted.join("") : `${quoted.slice(0, -1).join(", ")} ${conjunction} ${quoted[quoted.length - 1]}`;
+}
+var ROUTES = ALL_LOG_ACCESS_OPS.map((op) => `/${op}`);
+var LOG_ACCESS_REFUSALS = Object.freeze({
+  missing_records: {
+    status: 400,
+    meaning: "no `records`, or one that is not a non-empty list"
+  },
+  too_many_records: {
+    status: 400,
+    meaning: `more than ${MAX_RECORDS_PER_APPEND} records in one append`
+  },
+  append_too_large: {
+    status: 400,
+    meaning: `the records exceed ${MAX_APPEND_BYTES} bytes as compact JSON, or the request body exceeds ${MAX_APPEND_BODY_BYTES} bytes`
+  },
+  record_too_large: {
+    status: 400,
+    meaning: `one record exceeds ${MAX_RECORD_BYTES} bytes. A log line, not a document`
+  },
+  too_many_fields: {
+    status: 400,
+    meaning: `one record carries more than ${MAX_RECORD_FIELDS} fields`
+  },
+  invalid_field: {
+    status: 400,
+    meaning: "a field name or value is empty, over-long, or carries a control character. Field names are structured keys and never stream labels, so none of them changes what your records are filed under"
+  },
+  reserved_field: {
+    status: 400,
+    meaning: `a field is named ${listed(RESERVED_RECORD_FIELDS)}. Those are the record\u2019s own keys and are stored beside your fields, so a field of the same name would overwrite one or be overwritten by it \u2014 rename the field`
+  },
+  invalid_attribution: {
+    status: 400,
+    meaning: `\`attributedTo\` is not one identifier of at most ${MAX_ATTRIBUTION_LENGTH} letters, digits, \`.\`, \`_\`, \`:\` or \`-\` starting with a letter or digit`
+  },
+  invalid_timestamp: {
+    status: 400,
+    meaning: "`observedAt` is not an RFC 3339 instant. The service stamps its own receipt time as well, and that one is what ordering uses"
+  },
+  invalid_severity: {
+    status: 400,
+    meaning: "`severity` is not one of the levels this contract defines"
+  },
+  invalid_window: {
+    status: 400,
+    meaning: `\`from\` and \`to\` are not an RFC 3339 range, are inverted, or span more than ${MAX_QUERY_WINDOW_SECONDS} seconds. Not the retention window \u2014 how much ONE query scans`
+  },
+  invalid_limit: {
+    status: 400,
+    meaning: `\`limit\` is not a whole number in 1\u2026${MAX_QUERY_LIMIT}`
+  },
+  invalid_filters: {
+    status: 400,
+    meaning: `\`filters\` is not a list of \`{field, equals}\`, or carries more than ${MAX_QUERY_FILTERS} entries`
+  },
+  invalid_cursor: {
+    status: 400,
+    meaning: "the `cursor` did not come from this service, or is not for this query. A page is resumed with the cursor the previous page returned, verbatim, and never composed"
+  },
+  invalid_aggregate: {
+    status: 400,
+    meaning: `the aggregate is not one this service answers: a window over ${MAX_AGGREGATE_WINDOW_SECONDS} seconds, a \`bucketSeconds\` under ${MIN_AGGREGATE_BUCKET_SECONDS} or not dividing the window into at most ${MAX_AGGREGATE_BUCKETS} whole buckets, a \`groupBy\` that is not a field identifier or names \`message\`, \`observedAt\` or \`receivedAt\`, a \`limit\` outside 1\u2026${MAX_AGGREGATE_GROUPS} or without \`groupBy\`, or both \`bucketSeconds\` and \`groupBy\``
+  },
+  invalid_analysis: {
+    status: 400,
+    meaning: `the analysis is not one this service answers: a member it does not define, at any level, or one missing that it needs; a window over ${MAX_ANALYSIS_WINDOW_SECONDS} seconds; an empty \`where\` or an empty list in it; more than ${MAX_ANALYSIS_PREDICATES} predicates counted everywhere, a group inside a group, an empty group, or an \`in\`/\`notIn\` list that is not 1\u2026${MAX_ANALYSIS_PREDICATE_VALUES} distinct values; a field that is not an identifier; a value that is empty, longer than ${MAX_FIELD_VALUE_LENGTH} characters, not well-formed Unicode or carrying a control character, or values together over ${MAX_ANALYSIS_VALUE_BYTES} bytes; a number that is not finite; a measure or a numeric predicate on ${listed(RESERVED_RECORD_FIELDS)}; more than ${MAX_ANALYSIS_GROUP_BY_FIELDS} or repeated \`groupBy\` fields, or one naming ${listed(UNGROUPABLE_RECORD_FIELDS)}; a \`limit\` missing with \`groupBy\`, present without it or outside 1\u2026${MAX_ANALYSIS_GROUPS}; an \`order\` without \`groupBy\`; a \`bucketSeconds\` under ${MIN_ANALYSIS_BUCKET_SECONDS}, a \`from\` or \`to\` that is not a whole multiple of it since 1970-01-01T00:00:00Z, or more than ${MAX_ANALYSIS_BUCKETS} buckets; or buckets times \`limit\` over ${MAX_ANALYSIS_CELLS}`
+  },
+  analysis_timed_out: {
+    status: 504,
+    meaning: "the provider did not answer within the time one analysis gets. The same analysis is likely to time out again, so narrow the window, the selection or the grouping rather than repeating it \u2014 unlike `log_store_error`, this says the question was too expensive rather than that the provider faltered"
+  },
+  analysis_too_broad: {
+    status: 400,
+    meaning: "ranking the groups met more distinct values than can be ranked in one answer. Not transient \u2014 narrow the window or the selection, or group by a field with fewer values"
+  },
+  ingest_suspended: {
+    status: 403,
+    meaning: "this Product Instance may read its records and may not add one. Its Tenant is being drained or is not active \u2014 see `writable` on the authorization record"
+  },
+  query_not_granted: {
+    status: 403,
+    meaning: "this Product Instance may add records and may not read them back"
+  },
+  log_store_error: {
+    status: 502,
+    meaning: "the provider refused or did not answer. Not yours to fix, and the one refusal here worth retrying"
+  },
+  timestamp_group_too_large: {
+    status: 502,
+    meaning: `more than ${MAX_RECORDS_PER_TIMESTAMP} records share one timestamp, so this page cannot be answered without skipping some. Refused rather than answered incompletely; not yours to fix`
+  },
+  log_store_capacity: {
+    status: 503,
+    meaning: "the provider is rate-limiting or over quota. Retry with backoff; records already accepted are kept"
+  }
+});
+var HANDLER_REFUSALS = Object.freeze({
+  invalid_body: { status: 400, meaning: "the request body is not JSON" },
+  invalid_op: {
+    status: 400,
+    meaning: `no \`op\`, or one this route does not serve \u2014 ${listed(ROUTES, "and")} each serve the operation they are named after`
+  },
+  forbidden: {
+    status: 403,
+    meaning: "the credential verified and does not hold this operation\u2019s permission. Not an authentication failure \u2014 see 401 for those"
+  },
+  log_access_unconfigured: {
+    status: 503,
+    meaning: "this deployment cannot present a working provider credential \u2014 it has none, or the provider refused the one it has \u2014 so it can broker nothing. An operator problem, not a caller one, and not worth retrying at a caller\u2019s pace: it clears when an operator or the platform replaces the credential"
+  }
+});
+var AUTHENTICATION_REFUSALS = Object.freeze({
+  unauthorized: {
+    status: 401,
+    meaning: "the signature, the headers, the clock, or an instance that does not exist. Which one is never said"
+  },
+  operation_replay: {
+    status: 409,
+    meaning: "that operation id has been used inside the replay window. Sign a retry with a NEW one"
+  },
+  unavailable: {
+    status: 503,
+    meaning: "the platform could not read this instance\u2019s credential. Transient; retry"
+  },
+  replay_store_unavailable: {
+    status: 503,
+    meaning: "the replay store did not answer, so this request cannot be proved to be a first use. Refused rather than accepted; retry with a fresh operation id"
+  }
+});
+var ALL_REFUSALS = Object.freeze({
+  ...LOG_ACCESS_REFUSALS,
+  ...HANDLER_REFUSALS
+});
+
+// ../log-access-contract/dist/log-semantics.js
+var LOG_EVENT_FIELD = "event";
+var LOG_SCHEMA_REF_FIELD = "vfac_log_schema";
+var LOG_SEMANTICS_FORMAT_V1 = "log-semantics.vardeflyt.no/v1";
+
+// ../log-access-contract/dist/analysis-examples.js
+var ANALYZE_REQUEST_EXAMPLES = Object.freeze([
+  {
+    id: "p95-per-operation-over-time",
+    asks: "The 95th percentile of `duration_ms` per operation, in five-minute buckets, over the production records that are errors or failed",
+    request: {
+      op: "analyze",
+      from: "2026-09-21T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      where: {
+        all: [{ field: "environment", op: "eq", value: "prod" }],
+        any: [
+          { field: "severity", op: "eq", value: "error" },
+          { field: "outcome", op: "eq", value: "failed" }
+        ]
+      },
+      measure: { op: "percentile", field: "duration_ms", percentile: "p95" },
+      groupBy: ["operation"],
+      bucketSeconds: 300,
+      limit: 20
+    }
+  },
+  {
+    id: "error-count",
+    asks: "How many records in a day were errors or worse",
+    request: {
+      op: "analyze",
+      from: "2026-09-21T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      where: { all: [{ field: "severity", op: "in", values: ["error", "fatal"] }] },
+      measure: { op: "count" }
+    }
+  },
+  {
+    id: "slowest-routes",
+    asks: "The ten slowest checkout routes of the week per environment, counting only requests that took a second or more",
+    request: {
+      op: "analyze",
+      from: "2026-09-15T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      where: {
+        all: [
+          { field: "duration_ms", op: "gte", value: 1e3 },
+          { field: "route", op: "contains", value: "/checkout" }
+        ]
+      },
+      measure: { op: "max", field: "duration_ms" },
+      groupBy: ["route", "environment"],
+      limit: 10,
+      order: "desc"
+    }
+  },
+  {
+    id: "grouped-alternatives",
+    asks: "How many records in each environment either failed or took a second or more, counting only the two checkout routes",
+    request: {
+      op: "analyze",
+      from: "2026-09-21T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      where: {
+        all: [
+          {
+            any: [
+              { field: "route", op: "eq", value: "/checkout" },
+              { field: "route", op: "eq", value: "/checkout/pay" }
+            ]
+          },
+          {
+            any: [
+              { field: "outcome", op: "eq", value: "failed" },
+              { field: "duration_ms", op: "gte", value: 1e3 }
+            ]
+          }
+        ]
+      },
+      measure: { op: "count" },
+      groupBy: ["environment"],
+      limit: 5
+    }
+  },
+  {
+    id: "hourly-rate",
+    asks: "Records per second, hour by hour, over a day",
+    request: {
+      op: "analyze",
+      from: "2026-09-21T00:00:00Z",
+      to: "2026-09-22T00:00:00Z",
+      measure: { op: "rate" },
+      bucketSeconds: 3600
+    }
+  }
+]);
+var ANALYZE_RESPONSE_EXAMPLES = Object.freeze({
+  scalar: { ok: true, kind: "scalar", value: 124 },
+  groups: {
+    ok: true,
+    kind: "groups",
+    groups: [
+      { dimensions: { route: "/checkout/pay", environment: "prod" }, value: 4210 },
+      { dimensions: { route: "/checkout", environment: null }, value: 1830 }
+    ],
+    truncated: true
+  },
+  timeseries: {
+    ok: true,
+    kind: "timeseries",
+    bucketSeconds: 300,
+    series: [
+      {
+        dimensions: { operation: "deploy" },
+        points: [
+          { start: "2026-09-21T00:00:00.000Z", value: 431 },
+          { start: "2026-09-21T00:05:00.000Z", value: null }
+        ]
+      }
+    ],
+    truncated: false
+  }
+});
+
+// ../log-access-contract/dist/workspace-ingest.js
+var WORKSPACE_INGEST_STATUSES = Object.freeze({
+  202: "accepted in full \u2014 the body is `{accepted}` and it equals the number of records sent. Anything short of that is not an acknowledgement",
+  400: "the batch is malformed; `error` is a record refusal code. Do not retry it unchanged",
+  401: "the credential is not valid for this address. Stop sending until the binding changes",
+  403: "the credential does not hold `logs.write`. Stop sending until the binding changes",
+  429: "the workspace is over its rate. Back off, honouring `Retry-After` when present",
+  503: "the workspace cannot take records now. Retry with backoff"
+});
+
+// ../product-configuration/dist/log-semantics.js
+var MAX_LOG_SEMANTICS_EVENTS = 128;
+var MAX_LOG_SEMANTICS_FIELDS = 64;
+var MAX_LOG_EVENT_FIELDS = MAX_RECORD_FIELDS - 2;
+var MAX_LOG_FIELD_VALUES = 32;
+var MAX_LOG_CORRELATION_FIELDS = 8;
+var MAX_LOG_INTERPRETATION_NOTES = 12;
+var MAX_LOG_EVENT_NAME_LENGTH = 128;
+var MAX_LOG_SEMANTICS_BYTES = 131072;
+var LOG_FIELD_TYPES = Object.freeze(["string", "number", "boolean"]);
+var LOG_EVENT_DELIVERY = Object.freeze(["at-least-once", "best-effort"]);
+var LOG_EVENT_NAME_PATTERN = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)*$/;
+function hasControlCharacter(value) {
+  for (let i = 0; i < value.length; i += 1) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127)
+      return true;
+  }
+  return false;
+}
+var TextSchema = (min, max) => external_exports.string().min(min).max(max).refine((value) => !hasControlCharacter(value), {
+  message: "Descriptor text is one line, with no control characters."
+});
+var FieldNameSchema = external_exports.string().min(1).max(MAX_FIELD_NAME_LENGTH).regex(LOG_FIELD_NAME_PATTERN, "A field name follows the ingest wire rule.");
+var LogFieldValueSchema = external_exports.object({
+  /** One value the field can hold, exactly as a record carries it. */
+  value: TextSchema(1, 128),
+  /** What that value means. */
+  meaning: TextSchema(3, 300)
+}).strict();
+var LogFieldSchema = external_exports.object({
+  name: FieldNameSchema,
+  type: external_exports.enum(LOG_FIELD_TYPES),
+  meaning: TextSchema(10, 400),
+  /** The unit a number is measured in: `ms`, `bytes`, `EUR`. Numbers only. */
+  unit: TextSchema(1, 32).optional(),
+  /** Values a string field holds, each explained. Strings only. */
+  values: external_exports.array(LogFieldValueSchema).min(1).max(MAX_LOG_FIELD_VALUES).optional(),
+  /**
+   * `true`: `values` is every value the field can hold, so a record carrying
+   * another is out of contract. Absent: `values` explains the known ones.
+   */
+  closed: external_exports.literal(true).optional()
+}).strict();
+var LogEventFieldSchema = external_exports.object({
+  /** A declared field this event's records carry. */
+  field: FieldNameSchema,
+  /** Whether every record of this event carries it. */
+  required: external_exports.boolean()
+}).strict();
+var LogEventSchema = external_exports.object({
+  name: external_exports.string().min(1).max(MAX_LOG_EVENT_NAME_LENGTH).regex(LOG_EVENT_NAME_PATTERN, "An event name is dotted lowercase segments."),
+  meaning: TextSchema(10, 400),
+  /** When the producer actually emits it — the condition, not the intent. */
+  whenProduced: TextSchema(10, 400),
+  delivery: external_exports.enum(LOG_EVENT_DELIVERY).optional(),
+  /** The declared fields its records carry, beyond `event` and `vfac_log_schema`. */
+  fields: external_exports.array(LogEventFieldSchema).max(MAX_LOG_EVENT_FIELDS)
+}).strict();
+var LogCorrelationSchema = external_exports.object({
+  /** A declared field records can be joined on. */
+  field: FieldNameSchema,
+  meaning: TextSchema(10, 300)
+}).strict();
+var LogInterpretationSchema = external_exports.object({
+  /** What it means when a field an event may carry is absent. */
+  absentField: TextSchema(10, 600),
+  /** Whether a record can arrive more than once, and how to tell. */
+  duplicates: TextSchema(10, 600),
+  correlation: external_exports.array(LogCorrelationSchema).min(1).max(MAX_LOG_CORRELATION_FIELDS).optional(),
+  notes: external_exports.array(TextSchema(10, 400)).min(1).max(MAX_LOG_INTERPRETATION_NOTES).optional()
+}).strict();
+var LogSemanticsDescriptorObjectSchema = external_exports.object({
+  format: external_exports.literal(LOG_SEMANTICS_FORMAT_V1),
+  fields: external_exports.array(LogFieldSchema).min(1).max(MAX_LOG_SEMANTICS_FIELDS),
+  events: external_exports.array(LogEventSchema).min(1).max(MAX_LOG_SEMANTICS_EVENTS),
+  interpretation: LogInterpretationSchema
+}).strict();
+var UNDECLARABLE = /* @__PURE__ */ new Set([
+  ...RESERVED_RECORD_FIELDS,
+  LOG_EVENT_FIELD,
+  LOG_SCHEMA_REF_FIELD
+]);
+function duplicates(values) {
+  const seen = /* @__PURE__ */ new Set();
+  const repeated = /* @__PURE__ */ new Set();
+  for (const value of values)
+    (seen.has(value) ? repeated : seen).add(value);
+  return [...repeated];
+}
+var LogSemanticsDescriptorSchema = LogSemanticsDescriptorObjectSchema.superRefine((descriptor, ctx) => {
+  const issue = (path, message) => ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path, message });
+  const declared = new Set(descriptor.fields.map((field) => field.name));
+  for (const name of duplicates(descriptor.fields.map((field) => field.name))) {
+    issue(["fields"], `Field "${name}" is declared more than once.`);
+  }
+  for (const name of duplicates(descriptor.events.map((event) => event.name))) {
+    issue(["events"], `Event "${name}" is declared more than once.`);
+  }
+  descriptor.fields.forEach((field, i) => {
+    if (UNDECLARABLE.has(field.name)) {
+      issue(["fields", i, "name"], `"${field.name}" is the record's own key or a convention field, and is not declared.`);
+    }
+    if (field.unit !== void 0 && field.type !== "number") {
+      issue(["fields", i, "unit"], "Only a number field has a unit.");
+    }
+    if (field.values !== void 0 && field.type !== "string") {
+      issue(["fields", i, "values"], "Only a string field lists values.");
+    }
+    if (field.closed !== void 0 && field.values === void 0) {
+      issue(["fields", i, "closed"], "A closed field lists its values.");
+    }
+    for (const value of duplicates((field.values ?? []).map((entry) => entry.value))) {
+      issue(["fields", i, "values"], `Value "${value}" is explained more than once.`);
+    }
+  });
+  descriptor.events.forEach((event, i) => {
+    for (const name of duplicates(event.fields.map((entry) => entry.field))) {
+      issue(["events", i, "fields"], `Event "${event.name}" lists "${name}" more than once.`);
+    }
+    event.fields.forEach((entry, j) => {
+      if (!declared.has(entry.field)) {
+        issue(["events", i, "fields", j, "field"], `Event "${event.name}" names "${entry.field}", which is not a declared field.`);
+      }
+    });
+  });
+  const correlation = descriptor.interpretation.correlation ?? [];
+  for (const name of duplicates(correlation.map((entry) => entry.field))) {
+    issue(["interpretation", "correlation"], `Correlation field "${name}" is listed twice.`);
+  }
+  correlation.forEach((entry, i) => {
+    if (!declared.has(entry.field)) {
+      issue(["interpretation", "correlation", i, "field"], `"${entry.field}" is not a declared field.`);
+    }
+  });
+  const bytes = logSemanticsByteLength(descriptor);
+  if (bytes > MAX_LOG_SEMANTICS_BYTES) {
+    issue([], `The descriptor is ${bytes} bytes as canonical JSON, over the ${MAX_LOG_SEMANTICS_BYTES}-byte bound.`);
+  }
+});
+function logSemanticsByteLength(descriptor) {
+  return new TextEncoder().encode(canonicalJson(descriptor)).length;
+}
+
 // ../product-configuration/dist/manifest-yaml.js
 var import_yaml = __toESM(require_dist(), 1);
 function manifestYaml(document) {
@@ -14338,6 +14849,56 @@ var GovernanceFeedActorSchema = external_exports.discriminatedUnion("type", [
   external_exports.object({ type: external_exports.literal("resource"), id: opaqueId }),
   external_exports.object({ type: external_exports.literal("system") })
 ]);
+var connection = (action, description, outcome = "success") => ({
+  category: "connections",
+  action,
+  outcome,
+  target: "service_binding",
+  description
+});
+var resource = (action, description, outcome = "success") => ({
+  category: "resources",
+  action,
+  outcome,
+  target: "resource",
+  description
+});
+var GOVERNANCE_FEED_RULES = Object.freeze({
+  // The portal's own connection.
+  "service_binding.platform.connected": connection("connect", "The organization portal was connected to its log workspace."),
+  "service_binding.platform.disconnected": connection("disconnect", "The organization portal was disconnected from its log workspace."),
+  "service_binding.platform.rotation_requested": connection("rotate", "A new credential was requested for the portal\u2019s connection to its log workspace."),
+  "service_binding.platform.ready": connection("complete", "The log workspace completed the portal\u2019s connection; records can be delivered."),
+  "service_binding.platform.rotated": connection("rotate_complete", "The log workspace issued the portal\u2019s connection a new credential."),
+  "service_binding.platform.failed": connection("complete", "The log workspace could not complete the portal\u2019s connection.", "failure"),
+  "service_binding.platform.rotation_failed": connection("rotate_complete", "The log workspace could not issue the portal\u2019s connection a new credential.", "failure"),
+  "service_binding.platform.released": connection("release", "The log workspace finished removing the portal\u2019s connection."),
+  // Connections between Resources.
+  "service_binding.disconnected": connection("disconnect", "A connection between two Resources was disconnected."),
+  "service_binding.rotation_requested": connection("rotate", "A new credential was requested for a connection between two Resources."),
+  "service_binding.ready": connection("complete", "The providing Resource completed a connection; the consuming Resource can use it."),
+  "service_binding.rotated": connection("rotate_complete", "The providing Resource issued a connection a new credential."),
+  "service_binding.failed": connection("complete", "The providing Resource could not complete a connection.", "failure"),
+  "service_binding.rotation_failed": connection("rotate_complete", "The providing Resource could not issue a connection a new credential.", "failure"),
+  "service_binding.released": connection("release", "The providing Resource finished removing a connection."),
+  // How an operation on a Resource ended.
+  "product.instance.active": resource("from-operation-type", "An operation on a Resource completed and the Resource is running; action names the operation."),
+  "product.instance.suspended": resource("suspend", "A Resource was suspended."),
+  "product.instance.deleted": resource("delete", "A Resource was deleted."),
+  "product.instance.reconcile.failed": resource("reconcile", "An operation on a Resource failed and the platform stopped retrying it.", "failure"),
+  "product.instance.upgrade.hop_committed": resource("upgrade", "A Resource finished moving to a new version."),
+  "product.instance.upgrade.abandoned": resource("upgrade", "A Resource\u2019s move to a new version was abandoned; it stays on the version it had.", "failure")
+});
+var GOVERNANCE_FEED_EVENT_TYPES = Object.freeze(Object.keys(GOVERNANCE_FEED_RULES).sort());
+var GOVERNANCE_FEED_OPERATION_ACTIONS = Object.freeze({
+  PRODUCT_INSTANCE_CREATE: "create",
+  PRODUCT_INSTANCE_UPDATE: "configure",
+  PRODUCT_INSTANCE_UPGRADE: "upgrade",
+  PRODUCT_INSTANCE_SUSPEND: "suspend",
+  PRODUCT_INSTANCE_RESUME: "resume",
+  PRODUCT_INSTANCE_DELETE: "delete",
+  PRODUCT_INSTANCE_RECONCILE: "reconcile"
+});
 var GovernanceFeedEventSchema = external_exports.object({
   /** The audit row's id. Stable, so a workspace can recognise a re-delivery. */
   id: opaqueId,
@@ -15094,7 +15655,7 @@ var ProductDependencySchema = external_exports.object({
 var ProductDependencyV2Schema = ProductDependencySchema.extend({
   requiredWhen: RequiredWhenV2Schema.optional()
 });
-function hasControlCharacter(value) {
+function hasControlCharacter2(value) {
   for (let i = 0; i < value.length; i += 1) {
     const code = value.charCodeAt(i);
     if (code < 32 || code === 127)
@@ -15102,7 +15663,7 @@ function hasControlCharacter(value) {
   }
   return false;
 }
-var GuidanceTextSchema = (min, max) => external_exports.string().min(min).max(max).refine((value) => !hasControlCharacter(value), {
+var GuidanceTextSchema = (min, max) => external_exports.string().min(min).max(max).refine((value) => !hasControlCharacter2(value), {
   message: "Guidance is one line, with no control characters."
 });
 var ConsumerGuidanceSchema = external_exports.object({
@@ -15253,6 +15814,17 @@ var ProductDefinitionObjectSchema = external_exports.object({
    * Read absence through the empty array at the use site instead.
    */
   serviceInterfaces: external_exports.object({ provides: external_exports.array(ServiceInterfaceProvideSchema).min(1).max(4) }).strict().optional(),
+  /**
+   * What this Product's own log records mean — see `log-semantics.ts` in `product-configuration`.
+   *
+   * `.optional()`, NEVER `.default()`. A default materialises the key,
+   * `contractDigest` digests the parsed object, and every release published
+   * before this field existed would be refused on republish as
+   * `RELEASED_CONTRACT_MUTATED`. A NEW release that sends records to
+   * `observability.logs/v1` must declare it (`validatePublishableDefinition`);
+   * a record never needs it to be accepted.
+   */
+  observability: external_exports.object({ logs: LogSemanticsDescriptorSchema }).strict().optional(),
   lifecycle: LifecycleCapabilitiesSchema,
   policies: PolicyReferencesSchema,
   /**
@@ -15901,7 +16473,7 @@ function looksLikeReference(value) {
 }
 
 // ../product-contracts/dist/dependency-binding.js
-var DependencyBindingSelectorSchema = external_exports.object({
+var DependencyBindingConnectSchema = external_exports.object({
   /** The providing Resource's `metadata.key`. */
   resourceKey: ResourceKeySchema,
   /**
@@ -15920,6 +16492,11 @@ var DependencyBindingSelectorSchema = external_exports.object({
    */
   projectId: external_exports.string().min(1).max(64).optional()
 }).strict();
+var DependencyBindingDisconnectSchema = external_exports.object({ state: external_exports.literal("disconnected") }).strict();
+var DependencyBindingSelectorSchema = external_exports.union([
+  DependencyBindingConnectSchema,
+  DependencyBindingDisconnectSchema
+]);
 var DependencyBindingsSchema = external_exports.record(ServiceBindingKeySchema, DependencyBindingSelectorSchema);
 
 // ../product-contracts/dist/product-instance-template.schema.js
@@ -16021,10 +16598,17 @@ var ProductInstanceTemplateSchema = external_exports.object({
      * schema; this names another Resource, and the create envelope made the
      * identical split for the identical reason.
      *
+     * THREE MEANINGS, AND ONLY ONE OF THEM RELEASES ANYTHING:
+     *
+     *   key omitted               leave that connection alone
+     *   { resourceKey, … }        connect to (or keep) this provider
+     *   { state: disconnected }   release the connection it holds
+     *
      * OPTIONAL, PERMANENTLY. Every manifest written before this field
      * existed omits it, and absence has to keep meaning "leave the
      * connections alone" — otherwise re-applying an unchanged file would
-     * release a binding somebody made in the portal.
+     * release a binding somebody made in the portal. A release is
+     * therefore never inferred from a missing key; it is stated.
      *
      * The keys the platform will ACCEPT here are narrower than the shape:
      * only a dependency whose interface the registry calls
@@ -16311,7 +16895,15 @@ var InstanceEnvBindingSchema = external_exports.object({
     "productVersion",
     "profile",
     "region",
-    "environment"
+    "environment",
+    /**
+     * The reference of the log-semantics descriptor this release's
+     * Definition declares — the value a record carries in
+     * `vfac_log_schema`. Resolved from the release the component is
+     * deployed from, so during an upgrade each container carries its own
+     * release's. A Definition declaring no descriptor cannot bind it.
+     */
+    "logSemanticsRef"
   ])
 }).strict();
 var PlatformEnvBindingSchema = external_exports.object({
@@ -17353,7 +17945,7 @@ function checkDeploymentBlueprint(blueprint, ctx) {
       message: `Artifact source "${id}" is declared more than once.`
     });
   });
-  const duplicateTypes = (blueprint.dynamicResources ?? []).map((resource) => resource.type).filter((type, index, all) => all.indexOf(type) !== index);
+  const duplicateTypes = (blueprint.dynamicResources ?? []).map((resource2) => resource2.type).filter((type, index, all) => all.indexOf(type) !== index);
   [...new Set(duplicateTypes)].forEach((type) => {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -17361,15 +17953,15 @@ function checkDeploymentBlueprint(blueprint, ctx) {
       message: `"${type}" is declared more than once. A resource type may appear at most once: everything that reads this list resolves a capability by its type.`
     });
   });
-  (blueprint.dynamicResources ?? []).forEach((resource, index) => {
-    if (!sourceIds.has(resource.bootstrap.artifactSource)) {
+  (blueprint.dynamicResources ?? []).forEach((resource2, index) => {
+    if (!sourceIds.has(resource2.bootstrap.artifactSource)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["dynamicResources", index, "bootstrap", "artifactSource"],
-        message: `No artifact source "${resource.bootstrap.artifactSource}" is declared. Declare it in "artifactSources" first.`
+        message: `No artifact source "${resource2.bootstrap.artifactSource}" is declared. Declare it in "artifactSources" first.`
       });
     }
-    resource.consumers.forEach((consumerId, position) => {
+    resource2.consumers.forEach((consumerId, position) => {
       if (!knownComponents.has(consumerId)) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
@@ -17387,7 +17979,7 @@ function checkDeploymentBlueprint(blueprint, ctx) {
         });
       }
     });
-    const handoff = resource.bootstrap.productHandoff;
+    const handoff = resource2.bootstrap.productHandoff;
     if (handoff !== void 0) {
       const handoffPath = ["dynamicResources", index, "bootstrap", "productHandoff", "componentId"];
       const target = blueprint.components.find((component) => component.id === handoff.componentId);
@@ -17411,7 +18003,7 @@ function checkDeploymentBlueprint(blueprint, ctx) {
             message: `Component "${handoff.componentId}" declares "${target.ingress.exposure}" ingress. A Product handoff target must declare public ingress: the machine reaches it from outside the platform's network, which is the whole point of an outbound handoff.`
           });
         }
-        if (!resource.consumers.includes(handoff.componentId)) {
+        if (!resource2.consumers.includes(handoff.componentId)) {
           ctx.addIssue({
             code: external_exports.ZodIssueCode.custom,
             path: handoffPath,
@@ -17998,12 +18590,12 @@ function checkDeploymentBlueprint(blueprint, ctx) {
         message: `\`${edges.field}\` declares versions this Product ${edges.role}, but \`lifecycle.${edges.operation}.supported\` is false.`
       });
     }
-    const duplicates = versions.filter((version, i) => versions.indexOf(version) !== i);
-    if (duplicates.length > 0) {
+    const duplicates2 = versions.filter((version, i) => versions.indexOf(version) !== i);
+    if (duplicates2.length > 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: [...edges.path],
-        message: `Duplicate versions: ${[...new Set(duplicates)].join(", ")}.`
+        message: `Duplicate versions: ${[...new Set(duplicates2)].join(", ")}.`
       });
     }
     const notOlder = versions.filter((version) => compareSemver(version, blueprint.productVersion) >= 0);
@@ -18206,6 +18798,46 @@ var PUBLISH_RULE_ANNEX = {
           }
         }
       }
+    },
+    {
+      // THE SAME ASYMMETRY, for what a producer's log records mean — and only
+      // for a producer: the rule is conditional on a dependency on
+      // `observability.logs/v1`, the one declaration that means "sends log
+      // records". Presence is all JSON Schema says; the descriptor's own rules
+      // are in its schema.
+      $comment: "A new release that sends records to observability.logs/v1 (a dependency on that interface) must declare definition.observability.logs: the events it produces and the fields they carry. A log record is never refused for lacking one.",
+      if: {
+        required: ["definition"],
+        properties: {
+          definition: {
+            required: ["dependencies"],
+            properties: {
+              dependencies: {
+                contains: {
+                  required: ["interface"],
+                  properties: {
+                    interface: {
+                      required: ["id", "version"],
+                      properties: {
+                        id: { const: "observability.logs" },
+                        version: { const: "v1" }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      then: {
+        properties: {
+          definition: {
+            required: ["observability"],
+            properties: { observability: { required: ["logs"] } }
+          }
+        }
+      }
     }
   ]
 };
@@ -18607,6 +19239,18 @@ function printPlan(plan, json) {
       }
     }
   }
+  const disconnects = plan.dependencyDisconnects ?? [];
+  if (disconnects.length > 0) {
+    lines.push("  connections to disconnect:");
+    for (const disconnect of disconnects) {
+      lines.push(`    ${disconnect.dependencyKey}`);
+      if (disconnect.interfaceId !== void 0) {
+        lines.push(
+          `      interface: ${disconnect.interfaceId}${disconnect.interfaceVersion ? `/${disconnect.interfaceVersion}` : ""}`
+        );
+      }
+    }
+  }
   if ((plan.secretsToWrite ?? []).length > 0) {
     lines.push(`  secrets to set: ${plan.secretsToWrite.join(", ")}`);
     for (const line of secretWriteConsequence(plan)) lines.push(`      ${line}`);
@@ -19390,21 +20034,21 @@ async function runGet(parsed, deps = {}) {
 `);
       return 0;
     }
-    const resource = result.data["resource"] ?? {};
+    const resource2 = result.data["resource"] ?? {};
     const lines = [
-      `${String(resource["productInstanceId"] ?? instanceId)}  ${String(resource["status"] ?? "")}  ${String(resource["displayName"] ?? "")}`,
-      `  product   ${String(resource["productId"] ?? "")} ${String(resource["productVersion"] ?? "")}`,
-      `  region    ${String(resource["region"] ?? "")}`,
-      `  profile   ${String(resource["profile"] ?? "")}`
+      `${String(resource2["productInstanceId"] ?? instanceId)}  ${String(resource2["status"] ?? "")}  ${String(resource2["displayName"] ?? "")}`,
+      `  product   ${String(resource2["productId"] ?? "")} ${String(resource2["productVersion"] ?? "")}`,
+      `  region    ${String(resource2["region"] ?? "")}`,
+      `  profile   ${String(resource2["profile"] ?? "")}`
     ];
-    const key = resource["manifestKey"];
+    const key = resource2["manifestKey"];
     if (typeof key === "string") lines.push(`  key       ${key}`);
-    const outputs = resource["outputs"] ?? {};
-    const declared = Array.isArray(resource["outputDeclarations"]) ? resource["outputDeclarations"] : [];
+    const outputs = resource2["outputs"] ?? {};
+    const declared = Array.isArray(resource2["outputDeclarations"]) ? resource2["outputDeclarations"] : [];
     const declaredNames = declared.map((entry) => entry["key"]).filter((key2) => typeof key2 === "string");
     const names = [.../* @__PURE__ */ new Set([...Object.keys(outputs), ...declaredNames])].sort();
     const isSecret2 = (name) => declared.find((entry) => entry["key"] === name)?.["secret"] === true;
-    const conditions = Array.isArray(resource["conditions"]) ? resource["conditions"] : [];
+    const conditions = Array.isArray(resource2["conditions"]) ? resource2["conditions"] : [];
     if (conditions.length > 0) {
       lines.push("", "  Operational");
       const width = Math.max(
@@ -19443,7 +20087,7 @@ async function runGet(parsed, deps = {}) {
         }
       }
     } else {
-      const status = String(resource["status"] ?? "");
+      const status = String(resource2["status"] ?? "");
       lines.push(
         "",
         status === "DELETED" ? "  No outputs. This resource was deleted." : status === "FAILED" ? "  No outputs. Its deployment failed \u2014 `vfac get operation` says why." : "  No outputs yet. A resource publishes them when provisioning resolves them."
@@ -19510,7 +20154,7 @@ This is one page. Continue with --cursor ${result.nextCursor ?? ""}
       process.stderr.write("No Project. Use --project prj_\u2026 or set one in your context.\n");
       return 2;
     }
-    const resource = parsed.flags["resource"];
+    const resource2 = parsed.flags["resource"];
     const result = await readAllPages({
       endpoint: session.ready.endpoint,
       token: session.ready.token,
@@ -19519,7 +20163,7 @@ This is one page. Continue with --cursor ${result.nextCursor ?? ""}
       cursor: parsed.flags["cursor"],
       pageSize: parsed.flags["page-size"],
       onePage: true,
-      ...resource === void 0 ? {} : { query: { productInstanceId: resource } }
+      ...resource2 === void 0 ? {} : { query: { productInstanceId: resource2 } }
     });
     if (!result.ok) {
       if (result.error.status === 404 && result.error.code === "NOT_FOUND") {
@@ -19539,7 +20183,7 @@ This is one page. Continue with --cursor ${result.nextCursor ?? ""}
     }
     if (result.items.length === 0) {
       process.stdout.write(
-        resource === void 0 ? "No operations in this project.\n" : "No operations for this resource in this project.\n"
+        resource2 === void 0 ? "No operations in this project.\n" : "No operations for this resource in this project.\n"
       );
       return 0;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.15.3",
+  "version": "0.17.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",