@varde-flyt/vfac 0.16.0 → 0.17.0

package/README.md

@@ -228,13 +228,38 @@ holding on to:
 | `valueFrom.resourceOutput` | read a value another resource publishes |
 | `dependencyBindings` | use that resource as the PROVIDER for a declared dependency |
 
-A connection is established once. **A manifest can make one and cannot move
-one**: pointing an existing connection at a different resource is refused rather
-than performed, because a file you re-apply on every push must not be able to
-silently move a running service onto a different identity provider. The
-credential the connection delivers never appears in your manifest, in a plan, or
-in any `vfac` output — the providing service issues it and the platform stores
-it.
+An entry means one of three things, and only one of them releases anything:
+
+| The manifest says | What `vfac apply` does |
+| --- | --- |
+| nothing for the key | leaves that connection exactly as it is |
+| `resourceKey: …` | connects to that resource, or keeps the connection it has |
+| `state: disconnected` | releases the connection, in the same apply as your settings |
+
+```yaml
+spec:
+  configuration:
+    signIn: Disabled            # whatever setting made the connection necessary
+  dependencyBindings:
+    <dependency-key>:
+      state: disconnected
+```
+
+Leaving a key out never releases anything, so a manifest written before this
+field existed re-applies unchanged. `vfac plan` lists a release under
+`connections to disconnect` before you approve it. A dependency the Product
+requires cannot be disconnected; one a setting makes required can be, in the same
+file that turns the setting off. A released connection is torn down by its
+provider afterwards, and the providing resource can only be deleted once that
+teardown is done.
+
+**A manifest never moves a connection in one apply**: pointing an existing
+connection at a different resource is refused rather than performed, because a
+file you re-apply on every push must not be able to silently move a running
+service onto a different identity provider. Disconnect it and apply, then name
+the new resource and apply again. The credential the connection delivers never
+appears in your manifest, in a plan, or in any `vfac` output — the providing
+service issues it and the platform stores it.
 
 ## For an agent or a pipeline
 

package/dist/vfac.mjs

@@ -16473,7 +16473,7 @@ function looksLikeReference(value) {
 }
 
 // ../product-contracts/dist/dependency-binding.js
-var DependencyBindingSelectorSchema = external_exports.object({
+var DependencyBindingConnectSchema = external_exports.object({
   /** The providing Resource's `metadata.key`. */
   resourceKey: ResourceKeySchema,
   /**
@@ -16492,6 +16492,11 @@ var DependencyBindingSelectorSchema = external_exports.object({
    */
   projectId: external_exports.string().min(1).max(64).optional()
 }).strict();
+var DependencyBindingDisconnectSchema = external_exports.object({ state: external_exports.literal("disconnected") }).strict();
+var DependencyBindingSelectorSchema = external_exports.union([
+  DependencyBindingConnectSchema,
+  DependencyBindingDisconnectSchema
+]);
 var DependencyBindingsSchema = external_exports.record(ServiceBindingKeySchema, DependencyBindingSelectorSchema);
 
 // ../product-contracts/dist/product-instance-template.schema.js
@@ -16593,10 +16598,17 @@ var ProductInstanceTemplateSchema = external_exports.object({
      * schema; this names another Resource, and the create envelope made the
      * identical split for the identical reason.
      *
+     * THREE MEANINGS, AND ONLY ONE OF THEM RELEASES ANYTHING:
+     *
+     *   key omitted               leave that connection alone
+     *   { resourceKey, … }        connect to (or keep) this provider
+     *   { state: disconnected }   release the connection it holds
+     *
      * OPTIONAL, PERMANENTLY. Every manifest written before this field
      * existed omits it, and absence has to keep meaning "leave the
      * connections alone" — otherwise re-applying an unchanged file would
-     * release a binding somebody made in the portal.
+     * release a binding somebody made in the portal. A release is
+     * therefore never inferred from a missing key; it is stated.
      *
      * The keys the platform will ACCEPT here are narrower than the shape:
      * only a dependency whose interface the registry calls
@@ -19227,6 +19239,18 @@ function printPlan(plan, json) {
       }
     }
   }
+  const disconnects = plan.dependencyDisconnects ?? [];
+  if (disconnects.length > 0) {
+    lines.push("  connections to disconnect:");
+    for (const disconnect of disconnects) {
+      lines.push(`    ${disconnect.dependencyKey}`);
+      if (disconnect.interfaceId !== void 0) {
+        lines.push(
+          `      interface: ${disconnect.interfaceId}${disconnect.interfaceVersion ? `/${disconnect.interfaceVersion}` : ""}`
+        );
+      }
+    }
+  }
   if ((plan.secretsToWrite ?? []).length > 0) {
     lines.push(`  secrets to set: ${plan.secretsToWrite.join(", ")}`);
     for (const line of secretWriteConsequence(plan)) lines.push(`      ${line}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",