@varde-flyt/vfac 0.2.0 → 0.3.0

package/README.md

@@ -61,14 +61,42 @@ vfac get product-instance <productInstanceId>
 ```
 
 Secrets are supplied per apply and never belong in the manifest — a manifest is a
-file you commit.
+file you commit. `vfac plan` lists the ones an apply will still need.
+
+## Reading a setting from another resource
+
+A setting may take its value from an output another resource publishes, instead
+of a value you write:
+
+```yaml
+configuration:
+  someSetting:
+    valueFrom:
+      resourceOutput:
+        resourceKey: the-other-resource
+        output: <one the other Product publishes>
+```
+
+`resourceKey` is that resource's `metadata.key`, in the same Project, and it has
+to be running and publishing the output before a manifest naming it is accepted —
+the value is checked against the setting it fills at that moment. Reference
+the value; never copy it — a copy is one the platform cannot see the origin of,
+so nothing redeploys this resource when the other one changes and nothing stops
+the other one being deleted out from under it.
+
+An output the Product declares as a credential may only fill a credential
+setting, and is never COPIED: the platform points the consuming service at the
+producer's own stored secret and resolves that reference when it deploys the
+service, exactly as it resolves the service's own credentials. So there is no
+second copy to rotate, and no value for you to read — `vfac get product-instance`
+shows one as `[secret]`. `vfac guide` is authoritative.
 
 ## Running it again
 
 **Send no secret.** A pipeline re-applies the same manifest on every push:
 
 ```sh
-vfac apply -f resource.yaml
+vfac apply -f resource.yaml --wait
 ```
 
 With no secret to write, an apply that finds nothing changed answers `NO_CHANGE`.
@@ -76,6 +104,17 @@ That is the ordinary outcome for a pipeline, not a failure. It is not a health
 check either: `vfac` exits non-zero when a resource matches your manifest and is
 not actually serving.
 
+**`--wait` is what makes a pipeline honest.** Deploys are asynchronous: without
+it, `apply` exits 0 as soon as the platform has ACCEPTED the change, and the
+deploy that fails a minute later fails behind a build that already went green.
+With it, `apply` follows the operation and exits non-zero if it does not succeed.
+It waits up to an hour; giving up is not a cancellation, and the operation keeps
+running in the platform.
+
+`vfac get operation` answers a different question and keeps its own contract: it
+exits 0 whenever the read worked, even for an operation that failed, so a loop
+can tell "the deploy failed" from "the read failed".
+
 Sending a secret is itself a change. The platform stores secrets write-only, so
 it has nothing to compare against and treats one it was handed as one to write —
 so this answers `UPDATE` and redeploys, even when the value is the value already

package/dist/vfac.mjs

@@ -12729,6 +12729,10 @@ function reservedTenantSecretKeyViolation(secretKey) {
   }
   return null;
 }
+var SECRET_BINDING_SEPARATOR = "-b-";
+function secretKeyClaimsBinding(secretKey) {
+  return new RegExp(`${SECRET_BINDING_SEPARATOR}[0-9a-z]{8}$`).test(secretKey);
+}
 var PLATFORM_REGISTRY_REF = "varde-product-registry";
 var MAX_IMAGE_REPOSITORY_LENGTH = 64;
 function imageRepository(productId, componentId) {
@@ -13117,11 +13121,22 @@ var ServiceProfileSchema = external_exports.object({
   /** Exactly one profile is the create-wizard default. */
   default: external_exports.boolean().optional()
 }).strict();
+var MAX_PRODUCT_OUTPUTS = 12;
 var ProductOutputSchema = external_exports.object({
   key: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/, "Output keys are camelCase.").describe("Stable key. The Blueprint declares how this value is produced."),
   displayName: external_exports.string().min(2).max(60),
   description: external_exports.string().min(10).max(300),
-  type: external_exports.enum(["url", "identifier", "text"])
+  type: external_exports.enum(["url", "identifier", "text"]),
+  /**
+   * Is this output a credential?
+   *
+   * `.optional()`, NEVER `.default()`. A default materialises the key,
+   * `contractDigest` digests the PARSED object, and a republish of unchanged
+   * bytes would then be refused as RELEASED_CONTRACT_MUTATED. Absent means
+   * ordinary — the meaning every Definition published before this field
+   * already has.
+   */
+  secret: external_exports.boolean().optional()
 }).strict();
 var ProductDependencySchema = external_exports.object({
   /**
@@ -13349,7 +13364,7 @@ var ProductDefinitionObjectSchema = external_exports.object({
   profiles: external_exports.array(ServiceProfileSchema).min(1).max(SERVICE_PROFILE_IDS.length),
   configuration: CustomerConfigurationSchema,
   // --- Results, relationships, operations -------------------------------
-  outputs: external_exports.array(ProductOutputSchema).min(1).max(12),
+  outputs: external_exports.array(ProductOutputSchema).min(1).max(MAX_PRODUCT_OUTPUTS),
   dependencies: external_exports.array(ProductDependencySchema).max(8),
   /**
    * The service interfaces this Product provides to other Products.
@@ -14389,7 +14404,18 @@ var BlueprintOutputSchema = external_exports.object({
       pathSuffix: external_exports.string().regex(/^\/[A-Za-z0-9\-._~/]*$/).max(120).optional()
     }).strict(),
     external_exports.object({ kind: external_exports.literal("instance-identifier") }).strict(),
-    external_exports.object({ kind: external_exports.literal("literal"), value: external_exports.string().max(300) }).strict()
+    external_exports.object({ kind: external_exports.literal("literal"), value: external_exports.string().max(300) }).strict(),
+    external_exports.object({
+      kind: external_exports.literal("secret"),
+      /**
+       * A key this Blueprint's own `secrets[]` declares. NOT a free-text
+       * Secret Manager path: an output that could name any location would
+       * be a way to read a secret the Product does not own, and the whole
+       * point of resolving through the declaration is that the platform
+       * composes the path from the instance's own identity.
+       */
+      secretKey: external_exports.string().regex(/^[a-z][a-z0-9-]{1,46}[a-z0-9]$/)
+    }).strict()
   ])
 }).strict();
 var BlueprintLifecycleSchema = external_exports.object({
@@ -15177,6 +15203,15 @@ var DeploymentBlueprintSchema = DeploymentBlueprintObjectSchema.superRefine((blu
       });
     }
   });
+  blueprint.secrets.forEach((secret, index) => {
+    if (!secretKeyClaimsBinding(secret.key))
+      return;
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["secrets", index, "key"],
+      message: `Secret key "${secret.key}" ends the way the platform marks a rotated secret. Choose a key that does not end in "-b-" followed by eight lowercase letters or digits.`
+    });
+  });
   const outputKeys = blueprint.outputs.map((output) => output.key);
   const duplicateOutputs = outputKeys.filter((key, i) => outputKeys.indexOf(key) !== i);
   if (duplicateOutputs.length > 0) {
@@ -15186,6 +15221,27 @@ var DeploymentBlueprintSchema = DeploymentBlueprintObjectSchema.superRefine((blu
       message: `Duplicate output keys: ${[...new Set(duplicateOutputs)].join(", ")}.`
     });
   }
+  blueprint.outputs.forEach((output, index) => {
+    const { source } = output;
+    if (source.kind !== "secret")
+      return;
+    const wiring = blueprint.secrets.find((secret) => secret.key === source.secretKey);
+    if (wiring === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["outputs", index, "source", "secretKey"],
+        message: `Output "${output.key}" names secret "${source.secretKey}", which this Blueprint does not declare.`
+      });
+      return;
+    }
+    if (wiring.scope !== "product-instance") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["outputs", index, "source", "secretKey"],
+        message: `Output "${output.key}" publishes secret "${wiring.key}", which is ${wiring.scope}-scoped. A published secret must belong to the instance that publishes it, so its scope must be product-instance.`
+      });
+    }
+  });
   blueprint.outputs.forEach((output, index) => {
     if (output.source.kind !== "component-public-endpoint")
       return;
@@ -15324,6 +15380,18 @@ function isTerminalAction(action) {
 }
 var ManifestActionSchema = external_exports.enum(MANIFEST_ACTIONS);
 
+// ../product-contracts/dist/resource-output-reference.js
+var ResourceOutputReferenceSchema = external_exports.object({
+  valueFrom: external_exports.object({
+    resourceOutput: external_exports.object({
+      /** The producing Resource's `metadata.key`, in the same Project. */
+      resourceKey: external_exports.string().regex(/^[a-z][a-z0-9-]{1,61}[a-z0-9]$/, "A resource key is 3\u201363 characters of lowercase letters, digits and hyphens, starting with a letter and ending with a letter or digit."),
+      /** The key of an output that Resource's Product declares. */
+      output: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/, "Output keys are camelCase.")
+    }).strict()
+  }).strict()
+}).strict();
+
 // ../product-contracts/dist/product-instance-template.schema.js
 var ProductInstanceTemplateSchema = external_exports.object({
   apiVersion: ResourceApiVersionSchema,
@@ -15513,6 +15581,17 @@ function printPlan(plan, json) {
     lines.push(`  ~ ${change.field}`);
     lines.push(`      ${change.from} \u2192 ${change.to}`);
   }
+  for (const reference of plan.references ?? []) {
+    lines.push(`  ${reference.property}`);
+    lines.push(
+      `      from ${reference.resourceKey}.${reference.output}${reference.secret ? " [secret]" : ""}`
+    );
+  }
+  const required = plan.requiredSecrets ?? [];
+  if (required.length > 0) {
+    lines.push("  required secrets:");
+    for (const name of required) lines.push(`    ${name}`);
+  }
   if ((plan.secretsToWrite ?? []).length > 0) {
     lines.push(`  secrets to set: ${plan.secretsToWrite.join(", ")}`);
     for (const line of secretWriteConsequence(plan)) lines.push(`      ${line}`);
@@ -16078,12 +16157,16 @@ async function runGet(parsed) {
     if (typeof key === "string") lines.push(`  key       ${key}`);
     const outputs = resource["outputs"] ?? {};
     const declared = Array.isArray(resource["outputDeclarations"]) ? resource["outputDeclarations"] : [];
-    const names = Object.keys(outputs).sort();
+    const declaredNames = declared.map((entry) => entry["key"]).filter((key2) => typeof key2 === "string");
+    const names = [.../* @__PURE__ */ new Set([...Object.keys(outputs), ...declaredNames])].sort();
+    const isSecret = (name) => declared.find((entry) => entry["key"] === name)?.["secret"] === true;
     if (names.length > 0) {
       lines.push("", "  Outputs");
       const width = Math.max(...names.map((name) => name.length));
       for (const name of names) {
-        lines.push(`    ${name.padEnd(width)}  ${String(outputs[name] ?? "")}`);
+        lines.push(
+          `    ${name.padEnd(width)}  ${isSecret(name) ? "[secret]" : String(outputs[name] ?? "")}`
+        );
         const meaning = declared.find((entry) => entry["key"] === name);
         const description = meaning?.["description"];
         if (typeof description === "string") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",