@varde-flyt/vfac 0.3.0 → 0.3.2

package/dist/vfac.mjs

@@ -12673,6 +12673,58 @@ function matches(pattern, value) {
   }
 }
 
+// ../product-configuration/dist/resource-api-version.js
+var RESOURCE_API_VERSION = "resources.vardeflyt.no/v1";
+var PRODUCT_INSTANCE_KIND = "ProductInstance";
+
+// ../product-configuration/dist/product-instance-example.js
+function isSecret(declaration) {
+  return declaration.writeOnly === true || declaration["x-secret"] === true;
+}
+function seedConfiguration(configuration) {
+  const properties = configuration?.properties ?? {};
+  const required = new Set(configuration?.required ?? []);
+  const values = {};
+  const open = [];
+  const requiredSecrets = [];
+  for (const [name, declaration] of Object.entries(properties)) {
+    if (isSecret(declaration)) {
+      if (required.has(name))
+        requiredSecrets.push(name);
+      continue;
+    }
+    if (declaration.default !== void 0) {
+      values[name] = declaration.default;
+      continue;
+    }
+    if (required.has(name)) {
+      values[name] = "";
+      open.push({ name, type: declaration.type ?? null });
+    }
+  }
+  return { values, open, requiredSecrets };
+}
+function productInstanceExample(input) {
+  return {
+    apiVersion: RESOURCE_API_VERSION,
+    kind: PRODUCT_INSTANCE_KIND,
+    // The key is spread rather than set, so an underivable one is ABSENT from
+    // the document instead of present and empty.
+    metadata: { name: input.name, ...input.key ? { key: input.key } : {} },
+    spec: {
+      productId: input.productId,
+      productVersion: input.productVersion,
+      region: input.region,
+      profile: input.profile,
+      configuration: input.configuration
+    }
+  };
+}
+function exampleResourceKey(name) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^[^a-z]+/, "").replace(/-+$/, "").slice(0, 63);
+  return /^[a-z][a-z0-9-]{1,61}[a-z0-9]$/.test(slug) ? slug : "";
+}
+
 // ../platform-schemas/dist/index.js
 var TENANT_KEY_REGEX = /^[a-z][a-z0-9-]{2,23}[a-z0-9]$/;
 var RESERVED_TENANT_KEYS = /* @__PURE__ */ new Set([
@@ -12763,10 +12815,8 @@ var OperationStatusSchema = external_exports.enum([
 
 // ../product-contracts/dist/api-version.js
 var PRODUCT_API_VERSION = "products.vardeflyt.no/v1";
-var RESOURCE_API_VERSION = "resources.vardeflyt.no/v1";
 var PRODUCT_DEFINITION_KIND = "ProductDefinition";
 var DEPLOYMENT_BLUEPRINT_KIND = "DeploymentBlueprint";
-var PRODUCT_INSTANCE_KIND = "ProductInstance";
 var ProductApiVersionSchema = external_exports.literal(PRODUCT_API_VERSION, {
   errorMap: () => ({
     message: `apiVersion must be "${PRODUCT_API_VERSION}". An unrecognized contract format is refused rather than ignored.`
@@ -15954,6 +16004,9 @@ async function runDoctor(parsed) {
   }
   const access = who.data.access;
   const projects = access.projects.map((project) => project.projectId);
+  const mutating = access.projects.filter(
+    (project) => project.permissions.some((permission) => !permission.endsWith(".read"))
+  );
   checks.push(
     access.tenantWide ? {
       name: "Access",
@@ -15980,7 +16033,15 @@ async function runDoctor(parsed) {
       // members, other Tenants' resources. An agent read the warning,
       // ran the listing, watched it succeed, and learned to distrust the
       // line — which is the worst outcome for a diagnostic.
-      detail: `${projects.join(", ")} \u2014 and nothing organization-wide. You can deploy in those Projects, read their catalogue, and list them. Anything ACROSS the organization \u2014 a Project you hold nothing in, or its members \u2014 is refused.`
+      // AND WHAT IT MAY DO THERE, which this also got wrong. "You can
+      // deploy in those Projects" is false for a gate granted *Project
+      // Read* — `project.read` and `resource.read`, no writes at all —
+      // and `doctor` is the FIRST command an agent is told to run, so it
+      // was the first sentence an observing agent read. An agent that
+      // believes it can deploy and is then refused reports a platform
+      // defect, which is precisely the outcome the guide now tells it not
+      // to reach for. Scope and role are two questions; this answers both.
+      detail: `${projects.join(", ")} \u2014 and nothing organization-wide. ` + (mutating.length > 0 ? "You can deploy in those Projects, read their catalogue, and list them. " : "Read-only there: catalogue, manifests, resources and operations. An apply or a lifecycle command is refused, and that is what was granted rather than a fault. ") + "Anything ACROSS the organization \u2014 a Project you hold nothing in, or its members \u2014 is refused."
     }
   );
   checks.push({
@@ -16159,13 +16220,13 @@ async function runGet(parsed) {
     const declared = Array.isArray(resource["outputDeclarations"]) ? resource["outputDeclarations"] : [];
     const declaredNames = declared.map((entry) => entry["key"]).filter((key2) => typeof key2 === "string");
     const names = [.../* @__PURE__ */ new Set([...Object.keys(outputs), ...declaredNames])].sort();
-    const isSecret = (name) => declared.find((entry) => entry["key"] === name)?.["secret"] === true;
+    const isSecret2 = (name) => declared.find((entry) => entry["key"] === name)?.["secret"] === true;
     if (names.length > 0) {
       lines.push("", "  Outputs");
       const width = Math.max(...names.map((name) => name.length));
       for (const name of names) {
         lines.push(
-          `    ${name.padEnd(width)}  ${isSecret(name) ? "[secret]" : String(outputs[name] ?? "")}`
+          `    ${name.padEnd(width)}  ${isSecret2(name) ? "[secret]" : String(outputs[name] ?? "")}`
         );
         const meaning = declared.find((entry) => entry["key"] === name);
         const description = meaning?.["description"];
@@ -16586,7 +16647,7 @@ async function runManifestInit(parsed) {
   if (!result.ok) return printError(result.error, parsed.flags["output"] === "json");
   const product = result.data;
   const notes = [];
-  const key = parsed.flags["key"] ?? keyFrom(name);
+  const key = parsed.flags["key"] ?? exampleResourceKey(name);
   if (!key) {
     notes.push(
       "metadata.key     \u2014 a stable identity, 3 to 63 characters, lower case. Required before apply"
@@ -16652,43 +16713,24 @@ Product Deployment as Code v1 cannot express yet. Deploy it from the portal.
       offered.length === 0 ? `${product.productId} ${product.version} declares no service profile. Ask the publisher.` : `This Product offers several service profiles. Pass --profile <${offered.join("|")}>.`
     );
   }
-  const properties = product.configuration?.properties ?? {};
-  const required = product.configuration?.required ?? [];
-  const configuration = {};
-  for (const [property, declaration] of Object.entries(properties)) {
-    const secret = declaration.writeOnly === true || declaration["x-secret"] === true;
-    if (secret) {
-      if (required.includes(property)) {
-        notes.push(`--secret ${property}=env:VAR  \u2014 required, and never written to this file`);
-      }
-      continue;
-    }
-    if (declaration.default !== void 0) {
-      configuration[property] = declaration.default;
-      continue;
-    }
-    if (required.includes(property)) {
-      configuration[property] = "";
-      notes.push(`spec.configuration.${property}  \u2014 required${typeOf(declaration)}`);
-    }
+  const seed = seedConfiguration(product.configuration);
+  for (const property of seed.requiredSecrets) {
+    notes.push(`--secret ${property}=env:VAR  \u2014 required, and never written to this file`);
   }
-  const document = {
-    apiVersion: "resources.vardeflyt.no/v1",
-    kind: "ProductInstance",
-    // The key is spread rather than set, so an underivable one is ABSENT from
-    // the document instead of present and empty.
-    metadata: { name, ...key ? { key } : {} },
-    spec: {
-      productId: product.productId,
-      // PINNED, ALWAYS. The contract requires a version, and a document that
-      // tracked "newest" would redeploy a customer's resource because somebody
-      // else published.
-      productVersion: product.version,
-      region,
-      profile,
-      configuration
-    }
-  };
+  for (const setting of seed.open) {
+    notes.push(
+      `spec.configuration.${setting.name}  \u2014 required${setting.type ? ` (${setting.type})` : ""}`
+    );
+  }
+  const document = productInstanceExample({
+    name,
+    ...key ? { key } : {},
+    productId: product.productId,
+    productVersion: product.version,
+    region,
+    profile,
+    configuration: seed.values
+  });
   const checked = ProductInstanceTemplateSchema.safeParse(document);
   if (!checked.success) {
     const where = checked.error.issues.map((issue) => `  ${issue.path.join(".") || "(document)"}: ${issue.message}`).join("\n");
@@ -16712,13 +16754,6 @@ function refuse(message) {
 `);
   return 1;
 }
-function typeOf(declaration) {
-  return declaration.type ? ` (${declaration.type})` : "";
-}
-function keyFrom(name) {
-  const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^[^a-z]+/, "").replace(/-+$/, "").slice(0, 63);
-  return /^[a-z][a-z0-9-]{1,61}[a-z0-9]$/.test(slug) ? slug : "";
-}
 
 // src/commands/guide.ts
 async function runGuide(parsed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",