@varde-flyt/vfac 0.16.0 → 0.18.0

package/README.md

@@ -228,13 +228,38 @@ holding on to:
 | `valueFrom.resourceOutput` | read a value another resource publishes |
 | `dependencyBindings` | use that resource as the PROVIDER for a declared dependency |
 
-A connection is established once. **A manifest can make one and cannot move
-one**: pointing an existing connection at a different resource is refused rather
-than performed, because a file you re-apply on every push must not be able to
-silently move a running service onto a different identity provider. The
-credential the connection delivers never appears in your manifest, in a plan, or
-in any `vfac` output — the providing service issues it and the platform stores
-it.
+An entry means one of three things, and only one of them releases anything:
+
+| The manifest says | What `vfac apply` does |
+| --- | --- |
+| nothing for the key | leaves that connection exactly as it is |
+| `resourceKey: …` | connects to that resource, or keeps the connection it has |
+| `state: disconnected` | releases the connection, in the same apply as your settings |
+
+```yaml
+spec:
+  configuration:
+    signIn: Disabled            # whatever setting made the connection necessary
+  dependencyBindings:
+    <dependency-key>:
+      state: disconnected
+```
+
+Leaving a key out never releases anything, so a manifest written before this
+field existed re-applies unchanged. `vfac plan` lists a release under
+`connections to disconnect` before you approve it. A dependency the Product
+requires cannot be disconnected; one a setting makes required can be, in the same
+file that turns the setting off. A released connection is torn down by its
+provider afterwards, and the providing resource can only be deleted once that
+teardown is done.
+
+**A manifest never moves a connection in one apply**: pointing an existing
+connection at a different resource is refused rather than performed, because a
+file you re-apply on every push must not be able to silently move a running
+service onto a different identity provider. Disconnect it and apply, then name
+the new resource and apply again. The credential the connection delivers never
+appears in your manifest, in a plan, or in any `vfac` output — the providing
+service issues it and the platform stores it.
 
 ## For an agent or a pipeline
 

package/dist/vfac.mjs

@@ -14216,7 +14216,7 @@ function exampleResourceKey(name) {
   const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^[^a-z]+/, "").replace(/-+$/, "").slice(0, 63);
   return RESOURCE_KEY_PATTERN.test(slug) ? slug : "";
 }
-var DEPLOYMENT_EXAMPLE_GUARANTEE = "Product-owned configuration is complete and E2E-proven; tenant-specific secrets and Resource/provider selections are supplied by the tenant.";
+var DEPLOYMENT_EXAMPLE_GUARANTEE = "Product-owned configuration is complete and E2E-proven; tenant-specific secrets, tenant-specific values and Resource/provider selections are supplied by the tenant.";
 
 // ../product-configuration/dist/configuration-requirements.js
 function configurationRequirements(configuration) {
@@ -15077,6 +15077,7 @@ function isBlockedHost(hostname) {
 }
 
 // ../product-contracts/dist/deployment-example.schema.js
+var MAX_TENANT_INPUTS = 8;
 var DeploymentExampleSchema = external_exports.object({
   /** The heading a customer reads above the example. */
   title: external_exports.string().min(3).max(80),
@@ -15105,12 +15106,29 @@ var DeploymentExampleSchema = external_exports.object({
    * created and again only to set a new one — and never written into a
    * manifest. A secret resent on an unchanged re-apply is written again.
    */
-  secretInputs: external_exports.array(external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX)).max(MAX_CONFIGURATION_CHILDREN).optional()
-}).strict().describe("The recommended deployment for this release. Required for a NEW release; optional in the schema because releases published before the field existed are immutable. " + DEPLOYMENT_EXAMPLE_GUARANTEE + " Secret settings are named in secretInputs and never given a value here.");
+  secretInputs: external_exports.array(external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX)).max(MAX_CONFIGURATION_CHILDREN).optional(),
+  /**
+   * The ordinary — NOT secret — settings the tenant answers, BY NAME.
+   *
+   * A value only the tenant can know and nothing may default: the address of
+   * the person who administers the Resource first. The example carries NO
+   * value for one — the document a reader copies carries it present and
+   * empty, and the tenant types it — so an example applied unchanged is
+   * refused for that setting by name rather than deployed with a placeholder.
+   * Unlike a secret, the value belongs in the manifest.
+   *
+   * Each must be a setting every deployment must answer, with no default, that
+   * no other rule reads: whether the example is complete cannot depend on a
+   * value the publisher never gave.
+   */
+  tenantInputs: external_exports.array(external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX)).max(MAX_TENANT_INPUTS).optional()
+}).strict().describe("The recommended deployment for this release. Required for a NEW release; optional in the schema because releases published before the field existed are immutable. " + DEPLOYMENT_EXAMPLE_GUARANTEE + " Secret settings are named in secretInputs and never given a value here; so are the ordinary settings the tenant answers, named in tenantInputs.");
 var SECRET_INPUT_SEGMENT = CONFIGURATION_PROPERTY_NAME_REGEX.source.slice(1, -1);
-var SecretInputV2Schema = external_exports.string().regex(new RegExp(`^(?:${SECRET_INPUT_SEGMENT}|(?:/${SECRET_INPUT_SEGMENT}){2,${MAX_CONFIGURATION_DEPTH}})$`)).refine((raw) => secretPathOf(raw) !== null, {
-  message: 'A secret input is a root setting name, or a configuration path such as "/group/setting" with no list index.'
+var settingInputV2Schema = (what) => external_exports.string().regex(new RegExp(`^(?:${SECRET_INPUT_SEGMENT}|(?:/${SECRET_INPUT_SEGMENT}){2,${MAX_CONFIGURATION_DEPTH}})$`)).refine((raw) => secretPathOf(raw) !== null, {
+  message: `A ${what} is a root setting name, or a configuration path such as "/group/setting" with no list index.`
 });
+var SecretInputV2Schema = settingInputV2Schema("secret input");
+var TenantInputV2Schema = settingInputV2Schema("tenant input");
 var DeploymentExampleV2Schema = DeploymentExampleSchema.extend({
   /**
    * The secret settings a deployment of this example supplies, BY CANONICAL
@@ -15120,7 +15138,12 @@ var DeploymentExampleV2Schema = DeploymentExampleSchema.extend({
    * here, so a reader knows every `--secret` flag the create needs before
    * running it. The values are the tenant's and never written into a manifest.
    */
-  secretInputs: external_exports.array(SecretInputV2Schema).max(MAX_CONFIGURATION_CHILDREN).optional()
+  secretInputs: external_exports.array(SecretInputV2Schema).max(MAX_CONFIGURATION_CHILDREN).optional(),
+  /**
+   * The ordinary settings the tenant answers, BY CANONICAL PATH —
+   * `/administrator/email`. See the v1 field; only the spelling differs.
+   */
+  tenantInputs: external_exports.array(TenantInputV2Schema).max(MAX_TENANT_INPUTS).optional()
 });
 
 // ../product-contracts/dist/portfolio.js
@@ -16473,7 +16496,7 @@ function looksLikeReference(value) {
 }
 
 // ../product-contracts/dist/dependency-binding.js
-var DependencyBindingSelectorSchema = external_exports.object({
+var DependencyBindingConnectSchema = external_exports.object({
   /** The providing Resource's `metadata.key`. */
   resourceKey: ResourceKeySchema,
   /**
@@ -16492,6 +16515,11 @@ var DependencyBindingSelectorSchema = external_exports.object({
    */
   projectId: external_exports.string().min(1).max(64).optional()
 }).strict();
+var DependencyBindingDisconnectSchema = external_exports.object({ state: external_exports.literal("disconnected") }).strict();
+var DependencyBindingSelectorSchema = external_exports.union([
+  DependencyBindingConnectSchema,
+  DependencyBindingDisconnectSchema
+]);
 var DependencyBindingsSchema = external_exports.record(ServiceBindingKeySchema, DependencyBindingSelectorSchema);
 
 // ../product-contracts/dist/product-instance-template.schema.js
@@ -16593,10 +16621,17 @@ var ProductInstanceTemplateSchema = external_exports.object({
      * schema; this names another Resource, and the create envelope made the
      * identical split for the identical reason.
      *
+     * THREE MEANINGS, AND ONLY ONE OF THEM RELEASES ANYTHING:
+     *
+     *   key omitted               leave that connection alone
+     *   { resourceKey, … }        connect to (or keep) this provider
+     *   { state: disconnected }   release the connection it holds
+     *
      * OPTIONAL, PERMANENTLY. Every manifest written before this field
      * existed omits it, and absence has to keep meaning "leave the
      * connections alone" — otherwise re-applying an unchanged file would
-     * release a binding somebody made in the portal.
+     * release a binding somebody made in the portal. A release is
+     * therefore never inferred from a missing key; it is stated.
      *
      * The keys the platform will ACCEPT here are narrower than the shape:
      * only a dependency whose interface the registry calls
@@ -19227,6 +19262,18 @@ function printPlan(plan, json) {
       }
     }
   }
+  const disconnects = plan.dependencyDisconnects ?? [];
+  if (disconnects.length > 0) {
+    lines.push("  connections to disconnect:");
+    for (const disconnect of disconnects) {
+      lines.push(`    ${disconnect.dependencyKey}`);
+      if (disconnect.interfaceId !== void 0) {
+        lines.push(
+          `      interface: ${disconnect.interfaceId}${disconnect.interfaceVersion ? `/${disconnect.interfaceVersion}` : ""}`
+        );
+      }
+    }
+  }
   if ((plan.secretsToWrite ?? []).length > 0) {
     lines.push(`  secrets to set: ${plan.secretsToWrite.join(", ")}`);
     for (const line of secretWriteConsequence(plan)) lines.push(`      ${line}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",