@varde-flyt/vfac 0.18.1 → 0.18.2

package/README.md

@@ -170,7 +170,7 @@ shows one as `[secret]`. `vfac guide` is authoritative.
 ## Settings that go together
 
 A Product may declare that a group of settings is all-or-nothing: leave every one
-of them alone, or supply all of them. A provider connection is the usual shape —
+of them out, or supply all of them. A provider connection is the usual shape —
 an address without its credential is worse than neither, because the service
 starts and then fails on its first call.
 
@@ -192,9 +192,11 @@ that fails `vfac validate`.
 
 **`validate` and `plan` answer different questions here, and the difference is
 not a bug.** A manifest may never carry a secret, so `vfac validate` — which
-reads a file with no Project and no credential — cannot tell whether the
-credential in a group is configured, and does not refuse a document over it.
-`vfac plan` knows what the apply would carry and what the resource already holds,
+judges the file with no secrets beside it — cannot tell whether the credential
+in a group is configured, and does not refuse a document over it. The one
+exception is in the file: a credential the file answers with
+`valueFrom.resourceOutput` IS configured, so `validate` judges its group and
+names a missing partner. `vfac plan` knows what the apply would carry and what the resource already holds,
 so it is where a missing member is reported. A credential the resource already
 holds does not have to be sent again to change one of its siblings.
 

package/dist/vfac.mjs

@@ -13435,7 +13435,8 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
     referenced: new Set(presence.referenced ?? []),
     present: new Set(presence.present ?? []),
     unknown: new Set(presence.unknown ?? []),
-    reported: /* @__PURE__ */ new Set()
+    reported: /* @__PURE__ */ new Set(),
+    sent: /* @__PURE__ */ new Set()
   };
   const supplied = /* @__PURE__ */ new Set();
   if (submitted !== void 0 && submitted !== null && !isPlainObject2(submitted)) {
@@ -13448,7 +13449,7 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
   const input = isPlainObject2(submitted) ? submitted : {};
   const secrets = {};
   const configuration = validateObject({ properties: schema.properties, required: schema.required }, input, null, walk, { secrets, supplied });
-  drain(walk, crossFieldIssues(schema, supplied, presence, configuration, walk.reported));
+  drain(walk, crossFieldIssues(schema, supplied, walk.sent, presence, configuration, walk.reported));
   drain(walk, rowAndReferenceIssues(schema, presence, configuration));
   if (walk.suppressed > 0) {
     walk.issues.push({
@@ -13515,6 +13516,8 @@ function validateObject(declaration, input, container, walk, sink) {
     if (children !== null) {
       const value = Object.hasOwn(input, name) ? input[name] : void 0;
       const filled = validateContainer(name, property, children, value, field, walk, sink);
+      if (field !== "" && containerSent(children, value, field, walk))
+        walk.sent.add(field);
       if (value === void 0)
         absentGroupRuleIssues(children, field, walk, sink, required.has(name));
       if (filled !== void 0)
@@ -13541,6 +13544,8 @@ function validateObject(declaration, input, container, walk, sink) {
     }
     if (present && sink !== null && field !== "")
       sink.supplied.add(field);
+    if (present && field !== "")
+      walk.sent.add(field);
     if (!present) {
       const fallback = secret ? void 0 : defaultOf(leaf);
       if (fallback !== void 0) {
@@ -13576,13 +13581,22 @@ function groupRuleIssues(declaration, suppliedHere, container, walk, sink) {
   const fieldFor = (name) => (container === null ? configurationPath(name) : configurationPath(...pathSegments(container), name)) ?? "";
   const answered = (name) => {
     const path = fieldFor(name);
-    return suppliedHere.has(name) || // A MEMBER, NOT A CONTAINER: a referenced leaf is recorded at this very
+    return suppliedHere.has(name) || // SENT IS ANSWERED, VALID OR NOT. A member whose value failed its own
+    // check was never stored, so `suppliedHere` alone reported it missing as
+    // well — two refusals for one mistake, and the second one false.
+    walk.sent.has(path) || // A MEMBER, NOT A CONTAINER: a referenced leaf is recorded at this very
     // path, and a member group is answered by a reference inside it. Asking
     // only "inside" never counted a referenced leaf, so a referenced trigger
     // turned nothing on and a referenced dependent was reported missing.
-    referencedAtOrInside(walk, path) || walk.present.has(path) || sink !== null && Object.hasOwn(sink.secrets, path);
+    referencedAtOrInside(walk, path) || walk.present.has(path) || // A GROUP MEMBER IS ANSWERED BY WHAT IS CONFIGURED INSIDE IT, as a
+    // reference inside it already answers it: a held credential is the group,
+    // on every apply that does not resend it.
+    containsAny(walk.present, path) || sink !== null && Object.hasOwn(sink.secrets, path);
+  };
+  const unseen = (name) => {
+    const path = fieldFor(name);
+    return walk.unknown.has(path) && !referencedAtOrInside(walk, path);
   };
-  const unseen = (name) => walk.unknown.has(fieldFor(name));
   const reported = /* @__PURE__ */ new Set();
   for (const [trigger, dependents] of Object.entries(declaration.dependentRequired)) {
     if (unseen(trigger) || !answered(trigger))
@@ -13678,6 +13692,13 @@ function containerDeclaration(property) {
   }
   return null;
 }
+function containerSent(children, value, field, walk) {
+  if (value === void 0)
+    return false;
+  if (children.kind !== "object" || !isPlainObject2(value))
+    return true;
+  return containsAny(walk.sent, field);
+}
 function validateContainer(name, property, children, value, field, walk, sink) {
   const path = parseConfigurationPath(field);
   if (children.kind === "object") {
@@ -13726,22 +13747,24 @@ function validateContainer(name, property, children, value, field, walk, sink) {
   }
   return out;
 }
-function crossFieldIssues(schema, supplied, presence, configuration, reportedByWalk) {
+function crossFieldIssues(schema, supplied, sent, presence, configuration, reportedByWalk) {
   const clauses = Object.entries(schema.dependentRequired ?? {});
   const carriers = conditionCarriers(schema);
   if (clauses.length === 0 && carriers.length === 0)
     return [];
   const alsoPresent = /* @__PURE__ */ new Set([...presence.present ?? [], ...presence.referenced ?? []]);
   const unknown = new Set(presence.unknown ?? []);
-  const known = (name) => !unknown.has(name);
+  const referenced = new Set(presence.referenced ?? []);
+  const known = (name) => !unknown.has(name) || referenced.has(name);
   const held = (name) => supplied.has(name) || alsoPresent.has(name);
+  const answered = (name) => held(name) || sent.has(name) || containsAny(alsoPresent, name);
   const issues = [];
   const reported = /* @__PURE__ */ new Set();
   for (const [trigger, dependents] of clauses) {
-    if (!known(trigger) || !held(trigger))
+    if (!known(trigger) || !answered(trigger))
       continue;
     for (const dependent of dependents) {
-      if (!known(dependent) || held(dependent))
+      if (!known(dependent) || answered(dependent))
         continue;
       if (reported.has(dependent))
         continue;
@@ -14401,6 +14424,7 @@ var ANALYSIS_PREDICATE_OPERATORS = Object.freeze([
   ...ANALYSIS_NUMERIC_OPERATORS
 ]);
 var ANALYSIS_COUNTING_MEASURES = Object.freeze(["count", "rate"]);
+var ANALYSIS_DISTINCT_MEASURES = Object.freeze(["distinctCount"]);
 var ANALYSIS_FIELD_MEASURES = Object.freeze([
   "sum",
   "avg",
@@ -14410,6 +14434,7 @@ var ANALYSIS_FIELD_MEASURES = Object.freeze([
 ]);
 var ANALYSIS_MEASURES = Object.freeze([
   ...ANALYSIS_COUNTING_MEASURES,
+  ...ANALYSIS_DISTINCT_MEASURES,
   ...ANALYSIS_FIELD_MEASURES
 ]);
 var ANALYSIS_PERCENTILES = Object.freeze(["p50", "p90", "p95", "p99"]);
@@ -14485,7 +14510,7 @@ var LOG_ACCESS_REFUSALS = Object.freeze({
   },
   invalid_analysis: {
     status: 400,
-    meaning: `the analysis is not one this service answers: a member it does not define, at any level, or one missing that it needs; a window over ${MAX_ANALYSIS_WINDOW_SECONDS} seconds; an empty \`where\` or an empty list in it; more than ${MAX_ANALYSIS_PREDICATES} predicates counted everywhere, a group inside a group, an empty group, or an \`in\`/\`notIn\` list that is not 1\u2026${MAX_ANALYSIS_PREDICATE_VALUES} distinct values; a field that is not an identifier; a value that is empty, longer than ${MAX_FIELD_VALUE_LENGTH} characters, not well-formed Unicode or carrying a control character, or values together over ${MAX_ANALYSIS_VALUE_BYTES} bytes; a number that is not finite; a measure or a numeric predicate on ${listed(RESERVED_RECORD_FIELDS)}; more than ${MAX_ANALYSIS_GROUP_BY_FIELDS} or repeated \`groupBy\` fields, or one naming ${listed(UNGROUPABLE_RECORD_FIELDS)}; a \`limit\` missing with \`groupBy\`, present without it or outside 1\u2026${MAX_ANALYSIS_GROUPS}; an \`order\` without \`groupBy\`; a \`bucketSeconds\` under ${MIN_ANALYSIS_BUCKET_SECONDS}, a \`from\` or \`to\` that is not a whole multiple of it since 1970-01-01T00:00:00Z, or more than ${MAX_ANALYSIS_BUCKETS} buckets; or buckets times \`limit\` over ${MAX_ANALYSIS_CELLS}`
+    meaning: `the analysis is not one this service answers: a member it does not define, at any level, or one missing that it needs; a window over ${MAX_ANALYSIS_WINDOW_SECONDS} seconds; an empty \`where\` or an empty list in it; more than ${MAX_ANALYSIS_PREDICATES} predicates counted everywhere, a group inside a group, an empty group, or an \`in\`/\`notIn\` list that is not 1\u2026${MAX_ANALYSIS_PREDICATE_VALUES} distinct values; a field that is not an identifier; a value that is empty, longer than ${MAX_FIELD_VALUE_LENGTH} characters, not well-formed Unicode or carrying a control character, or values together over ${MAX_ANALYSIS_VALUE_BYTES} bytes; a number that is not finite; a numeric measure or a numeric predicate on ${listed(RESERVED_RECORD_FIELDS)}; a \`distinctCount\` field naming ${listed(UNGROUPABLE_RECORD_FIELDS)}; more than ${MAX_ANALYSIS_GROUP_BY_FIELDS} or repeated \`groupBy\` fields, or one naming ${listed(UNGROUPABLE_RECORD_FIELDS)}; a \`limit\` missing with \`groupBy\`, present without it or outside 1\u2026${MAX_ANALYSIS_GROUPS}; an \`order\` without \`groupBy\`; a \`bucketSeconds\` under ${MIN_ANALYSIS_BUCKET_SECONDS}, a \`from\` or \`to\` that is not a whole multiple of it since 1970-01-01T00:00:00Z, or more than ${MAX_ANALYSIS_BUCKETS} buckets; or buckets times \`limit\` over ${MAX_ANALYSIS_CELLS}`
   },
   analysis_timed_out: {
     status: 504,
@@ -14493,7 +14518,7 @@ var LOG_ACCESS_REFUSALS = Object.freeze({
   },
   analysis_too_broad: {
     status: 400,
-    meaning: "ranking the groups met more distinct values than can be ranked in one answer. Not transient \u2014 narrow the window or the selection, or group by a field with fewer values"
+    meaning: "ranking the groups, or counting the distinct values of a field, met more distinct values than one answer can hold. Not transient \u2014 narrow the window or the selection, or group by / count a field with fewer values"
   },
   ingest_suspended: {
     status: 403,
@@ -14649,6 +14674,19 @@ var ANALYZE_REQUEST_EXAMPLES = Object.freeze([
       measure: { op: "rate" },
       bucketSeconds: 3600
     }
+  },
+  {
+    id: "distinct-requests-per-route",
+    asks: "How many distinct requests reached each route in an hour, among the records that were errors or worse",
+    request: {
+      op: "analyze",
+      from: "2026-09-21T12:00:00Z",
+      to: "2026-09-21T13:00:00Z",
+      where: { all: [{ field: "severity", op: "in", values: ["error", "fatal"] }] },
+      measure: { op: "distinctCount", field: "request_id" },
+      groupBy: ["route"],
+      limit: 10
+    }
   }
 ]);
 var ANALYZE_RESPONSE_EXAMPLES = Object.freeze({
@@ -15720,9 +15758,11 @@ var PolicyReferencesSchema = external_exports.object({
   securityPolicyRef: external_exports.string().regex(/^(?:https:\/\/\S+|[A-Za-z0-9._\-/]+\.md(?:#[A-Za-z0-9-]+)?)$/, "Policy references are an https URL or a repository-relative Markdown path."),
   dataPolicyRef: external_exports.string().regex(/^(?:https:\/\/\S+|[A-Za-z0-9._\-/]+\.md(?:#[A-Za-z0-9-]+)?)$/, "Policy references are an https URL or a repository-relative Markdown path."),
   /**
-   * Where tenant data is processed. `tenant-region` means it never leaves the
-   * region the customer selected; the other values are a data-residency
-   * decision the customer must see before deploying.
+   * Where the Product processes and stores tenant data. `tenant-region`
+   * means the Product keeps and processes it in the region the customer
+   * selected — it says nothing about where a client the customer authorizes
+   * runs. The other values are a data-residency decision the customer must
+   * see before deploying.
    */
   dataResidency: external_exports.enum(["tenant-region", "eu", "global"]),
   /** Categories of tenant data the Product handles at all. */
@@ -15759,10 +15799,19 @@ var PolicyReferencesSchema = external_exports.object({
    */
   defaultRetentionDays: external_exports.number().int().min(0).max(3650),
   /**
-   * Whether any tenant content can leave the tenant boundary at all (an
-   * external model provider, a SaaS tool). The Blueprint's egress rules are
-   * the authoritative detail; this is the one-bit fact the review screen
-   * needs.
+   * Whether the Product ITSELF sends tenant data out of the tenant boundary
+   * — a call it makes, whoever chose where it goes (an external model
+   * provider, a SaaS tool, an endpoint the customer configures). The Blueprint's egress rules are the authoritative detail and
+   * the only input: the pair check requires this to be true exactly when an
+   * egress rule carries a category other than `operational-metadata`. This
+   * is the one-bit fact the review screen needs.
+   *
+   * What the Product returns over its OWN ingress to a caller the customer
+   * authorized — a browser, an API client, an MCP client — is delivery, not
+   * external processing, wherever that caller runs. No ingress kind,
+   * authentication method, component kind or public endpoint moves this bit,
+   * and neither does a service binding or a data store: neither is egress
+   * (docs/SECURITY.md §6 names the one delivered address that is).
    */
   externalProcessing: external_exports.boolean()
 }).strict();
@@ -16240,7 +16289,7 @@ function checkProductDefinition(definition, ctx) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
       path: ["policies"],
-      message: 'dataResidency "global" contradicts externalProcessing false \u2014 data cannot be global without leaving the tenant boundary.'
+      message: 'dataResidency "global" contradicts externalProcessing false \u2014 a Product that sends no tenant data out of the tenant boundary cannot process it globally.'
     });
   }
 }
@@ -16919,6 +16968,17 @@ var InstanceEnvBindingSchema = external_exports.object({
     "profile",
     "region",
     "environment",
+    /**
+     * The Product Instance's customer-facing name — `metadata.name` in a
+     * manifest, `ProductInstance.displayName` in the platform — exactly as
+     * stored.
+     *
+     * MUTABLE DISPLAY DATA, NEVER IDENTITY. A rename changes it and redeploys
+     * the containers that bind it; nothing may name, key, scope, sign or
+     * authorize on it — `productInstanceId` is the identity. Not the
+     * Definition's `displayName`, which names the Product.
+     */
+    "displayName",
     /**
      * The reference of the log-semantics descriptor this release's
      * Definition declares — the value a record carries in
@@ -17269,7 +17329,33 @@ var VirtualMachineDynamicResourceSchema = external_exports.object({
   maxCount: external_exports.number().int().min(1).max(MAX_DYNAMIC_RESOURCES_PER_INSTANCE),
   operatingSystem: MachineOperatingSystemSchema,
   storage: MachineStorageSchema,
-  bootstrap: DynamicResourceBootstrapSchema
+  bootstrap: DynamicResourceBootstrapSchema,
+  /**
+   * What may be done to ONE machine after it exists, beyond releasing it.
+   *
+   * THE SAME SHAPE AS THE BLUEPRINT'S OWN `lifecycle`: an operation is an
+   * object carrying `supported`, so a reader who knows one knows the other.
+   * It is not a third way of saying "supported".
+   *
+   * OPTIONAL, AND ABSENT MEANS WHAT IT ALWAYS MEANT: create, read and release,
+   * and nothing else. `.optional()` and never `.default()` — a default would
+   * materialise the key in every released Blueprint the read path re-parses,
+   * and `contractDigest` digests the parsed object.
+   *
+   * A RESOURCE'S LIFECYCLE, NOT THE INSTANCE'S. Suspending a machine powers
+   * it off and keeps it — its disk, its identity and its place in `maxCount`.
+   * Releasing it is still the only way to give the place back, and is never
+   * gated on this declaration. Whether the Product Instance as a whole may be
+   * suspended is the top-level `lifecycle`, which a Product declaring dynamic
+   * resources still may not promise.
+   *
+   * PAIRED. Suspend without resume strands a machine; resume without suspend
+   * describes nothing. The cross-field rules refuse both halves.
+   */
+  lifecycle: external_exports.object({
+    suspend: external_exports.object({ supported: external_exports.boolean() }).strict(),
+    resume: external_exports.object({ supported: external_exports.boolean() }).strict()
+  }).strict().optional()
 }).strict();
 var DynamicResourceSchema = external_exports.discriminatedUnion("type", [VirtualMachineDynamicResourceSchema]);
 var ComponentDependencySchema = external_exports.object({
@@ -18035,6 +18121,23 @@ function checkDeploymentBlueprint(blueprint, ctx) {
         }
       }
     }
+    const power = resource2.lifecycle;
+    if (power !== void 0) {
+      if (power.suspend.supported && !power.resume.supported) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["dynamicResources", index, "lifecycle", "resume", "supported"],
+          message: "A resource that supports suspend must also support resume: a machine that can be powered off and never on again has been released without giving its place back."
+        });
+      }
+      if (power.resume.supported && !power.suspend.supported) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["dynamicResources", index, "lifecycle", "suspend", "supported"],
+          message: "resume is only meaningful for a resource that supports suspend: there is no suspended machine to resume."
+        });
+      }
+    }
   });
   containers.forEach(({ component, index }) => {
     const expectedRepository = imageRepository(blueprint.productId, component.id);
@@ -18658,7 +18761,7 @@ function checkHumanSessionMechanisms(ctx, at, authentication, declared) {
 
 // ../product-contracts/dist/deployability.js
 var VIRTUAL_MACHINE_PROFILE_INTERFACE = {
-  developer: "Ubuntu 24.04 LTS, at least 3 vCPU and 4 GiB memory, with local instance storage"
+  developer: "Ubuntu 24.04 LTS, at least 4 vCPU and 8 GiB memory, with local instance storage"
 };
 var VIRTUAL_MACHINE_PROFILES = new Set(Object.keys(VIRTUAL_MACHINE_PROFILE_INTERFACE));
 
@@ -18676,9 +18779,13 @@ var MANIFEST_ACTIONS = [
    *  differs and no secret would be written.
    *
    *  NOT "the document matches it", which is how it read and is a stronger claim
-   *  than the planner makes. What a document OMITS is left alone rather than
-   *  compared — a manifest naming no connections answers this beside a resource
-   *  that holds several — so this never means the file mirrors stored state.
+   *  than the planner makes — and not "what a document omits is left alone"
+   *  either, which this comment said next and which is true of two things only.
+   *  Secrets the request does not carry and connections it does not name are
+   *  kept rather than compared, so a manifest naming no connections answers this
+   *  beside a resource that holds several. `spec.configuration` is compared as
+   *  the WHOLE configuration: a setting it leaves out takes its default, and that
+   *  plans as `UPDATE`.
    *
    *  A pipeline that runs on every push and changes nothing reports it, and it
    *  is SUCCESS. */
@@ -19799,7 +19906,7 @@ async function runDoctor(parsed) {
       // line — which is the worst outcome for a diagnostic.
       // AND WHAT IT MAY DO THERE, which this also got wrong. "You can
       // deploy in those Projects" is false for a gate granted *Project
-      // Read* — `project.read` and `resource.read`, no writes at all —
+      // Read* — every permission a read, no writes at all —
       // and `doctor` is the FIRST command an agent is told to run, so it
       // was the first sentence an observing agent read. An agent that
       // believes it can deploy and is then refused reports a platform

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",