@varde-flyt/vfac 0.9.0 → 0.10.0

package/README.md

@@ -27,9 +27,11 @@ vfac whoami
 ```
 
 `doctor` checks the endpoint, which Project this terminal has selected, the API,
-whether this client is new enough for the platform it is pointed at, your
-credential and what that credential reaches, in that order, and reports the first
-thing that is actually wrong. A platform declares the oldest client it supports;
+whether this client is new enough for the platform it is pointed at, how this
+terminal is signed in and what that credential reaches, in that order, and reports
+the first thing that is actually wrong. Both ways of signing in count: a Context
+Gate exchanged from `VFAC_CREDENTIAL_ID` and `VFAC_CREDENTIAL_SECRET`, or a
+sign-in from `vfac login` that is still valid. A platform declares the oldest client it supports;
 below that, `doctor` fails and says so before sending your credential anywhere.
 
 The selected Project and the Projects your credential reaches are two different

package/dist/vfac.mjs

@@ -7793,7 +7793,7 @@ async function ensureSession(args) {
   const endpoint = checked.endpoint;
   const credential = credentialFromEnvironment();
   if (args.forceExchange !== true && sessionUsable(stored.session, endpoint, args.now ?? /* @__PURE__ */ new Date(), credential?.keyId)) {
-    return { ok: true, ready: { endpoint, token: stored.session.token, stored } };
+    return { ok: true, ready: { endpoint, token: stored.session.token, stored, via: "stored" } };
   }
   const signedIn = await signIn({
     endpoint,
@@ -7802,7 +7802,16 @@ async function ensureSession(args) {
   if (!signedIn.ok) return { ok: false, message: signedIn.message };
   const next = { ...stored, session: signedIn.session };
   writeStored(next);
-  return { ok: true, ready: { endpoint, token: signedIn.session.token, stored: next } };
+  return {
+    ok: true,
+    ready: {
+      endpoint,
+      token: signedIn.session.token,
+      stored: next,
+      via: "exchanged",
+      ...signedIn.gate ? { gate: signedIn.gate } : {}
+    }
+  };
 }
 function resolveProject(flag, stored) {
   return flag ?? stored.context?.projectId ?? null;
@@ -7922,8 +7931,9 @@ function renderOperation(operationId, data) {
     const retryable = failure["retryable"];
     if (typeof retryable === "boolean") {
       const again = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "`vfac lifecycle upgrade <pri_\u2026>`" : "`vfac lifecycle reconcile <pri_\u2026>`";
+      const changeIt = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "" : ", or `vfac apply` a corrected manifest";
       lines.push(
-        retryable ? `    Another attempt can succeed: ${again}.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}.`
+        retryable ? `    Another attempt can succeed: ${again}.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
       );
     }
   }
@@ -12224,6 +12234,16 @@ var ConfigurationGroupSchema = external_exports.enum([
 ]);
 var CONFIGURATION_PROPERTY_NAME_REGEX = /^[a-z][a-zA-Z0-9]{1,47}$/;
 var PropertyNameSchema = external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX, "Configuration property names must be camelCase, start with a lowercase letter, and be 2\u201348 characters.");
+var ValueConditionSchema = external_exports.object({
+  /**
+   * The setting, as a canonical path — or a bare root key, which is the same
+   * string at depth 1. With `anyRow`, a DECLARATION path: `/servers/kind`
+   * names the setting each row answers, never one row's answer.
+   */
+  path: external_exports.string().min(1).max(400),
+  anyOf: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20),
+  anyRow: external_exports.boolean().optional()
+}).strict();
 var TitleSchema = external_exports.string().min(2).max(80).describe("Customer-facing field label.");
 var V1_LEAF_BOUNDS = {
   help: 400,
@@ -12280,7 +12300,24 @@ function leafShapes(bounds) {
      * without the other a validation error.
      */
     writeOnly: external_exports.boolean().optional(),
-    "x-secret": external_exports.boolean().optional()
+    "x-secret": external_exports.boolean().optional(),
+    /**
+     * The setting VALUE that makes this credential necessary.
+     *
+     * WHY IT CANNOT BE `dependentRequired`. That mechanism is keyed on
+     * PRESENCE — "if the author answered X, they must also answer Y" — and
+     * says so in as many words: "PRESENCE, NEVER A VALUE. A caller passes
+     * NAMES." A Product whose credential is needed only when a setting has one
+     * particular value could not say so, so `vfac plan`'s `requiredSecrets`
+     * could not warn before a deploy, and the refusal arrived at apply.
+     *
+     * ON A SECRET ONLY, and that is narrower than the mechanism could be. A
+     * value-conditioned requirement for an ORDINARY setting is a real gap too,
+     * but it changes what every door accepts for every property; this changes
+     * what `requiredSecrets` reports, which is one answer with one reader.
+     * Opening it wider is a separate decision with its own blast radius.
+     */
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   withJsonSchemaAnnex(string, SECRET_COUPLING_ANNEX);
   const number = external_exports.object({
@@ -12332,7 +12369,7 @@ var ConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
   BooleanPropertySchema,
   ArrayPropertySchema
 ]);
-var NestedStringPropertySchema = V2_LEAVES.string.omit({ "x-secret": true, writeOnly: true }).extend({ group: ConfigurationGroupSchema.optional() });
+var NestedStringPropertySchema = V2_LEAVES.string.omit({ "x-secret": true, writeOnly: true, "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() });
 var V2_NESTED_LEAVES = {
   string: NestedStringPropertySchema,
   number: V2_LEAVES.number.extend({ group: ConfigurationGroupSchema.optional() }),
@@ -13038,6 +13075,9 @@ function pathSegments(path) {
   const raw = path.startsWith("/") ? path.slice(1).split("/") : [path];
   return raw.map((segment) => isIndexSegment(segment) ? Number(segment) : segment);
 }
+function rootSegment(path) {
+  return String(pathSegments(path)[0]);
+}
 function declarationPathOf(path) {
   const segments = pathSegments(path).filter((segment) => typeof segment !== "number");
   return configurationPath(...segments) ?? path;
@@ -13151,11 +13191,71 @@ function declaresPath(schema, path) {
     return true;
   return configurationContainers(schema).some((container) => container.path === declarationPathOf(path));
 }
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function valueAt(configuration, path) {
+  let cursor = configuration;
+  for (const segment of segmentsOf(path)) {
+    if (typeof segment === "number") {
+      if (!Array.isArray(cursor))
+        return void 0;
+      cursor = cursor[segment];
+      continue;
+    }
+    if (!isPlainObject(cursor))
+      return void 0;
+    cursor = cursor[segment];
+  }
+  return cursor;
+}
+function valuesAt(configuration, path) {
+  let cursors = [configuration];
+  for (const segment of segmentsOf(path)) {
+    const next = [];
+    for (const cursor of cursors) {
+      if (typeof segment === "number") {
+        if (Array.isArray(cursor))
+          next.push(cursor[segment]);
+        continue;
+      }
+      if (!isPlainObject(cursor))
+        continue;
+      const value = cursor[segment];
+      if (Array.isArray(value))
+        next.push(...value);
+      else
+        next.push(value);
+    }
+    cursors = next;
+  }
+  return cursors.filter((value) => value !== void 0);
+}
+function segmentsOf(path) {
+  const raw = path.startsWith("/") ? path.slice(1).split("/") : [path];
+  return raw.map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
+}
+
+// ../product-configuration/dist/value-condition.js
+function conditionSetting(condition) {
+  return "path" in condition ? condition.path : condition.property;
+}
+function conditionRoot(condition) {
+  const path = parseConfigurationPath(conditionSetting(condition));
+  return path === null ? conditionSetting(condition) : rootSegment(path);
+}
+function conditionHolds(condition, configuration) {
+  const path = parseConfigurationPath(conditionSetting(condition));
+  if (path === null)
+    return false;
+  const matches2 = (held) => typeof held === "string" && condition.anyOf.includes(held);
+  return "anyRow" in condition && condition.anyRow === true ? valuesAt(configuration, path).some(matches2) : matches2(valueAt(configuration, path));
+}
 
 // ../product-configuration/dist/customer-configuration-input.js
 var ABSOLUTE_MAX_STRING = MAX_DECLARABLE_STRING_LENGTH;
 var MAX_REPORTED_UNDECLARED_KEYS = 10;
-function isPlainObject(value) {
+function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function report(walk, field, message) {
@@ -13177,17 +13277,17 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
     referenced: new Set(presence.referenced ?? [])
   };
   const supplied = /* @__PURE__ */ new Set();
-  if (submitted !== void 0 && submitted !== null && !isPlainObject(submitted)) {
+  if (submitted !== void 0 && submitted !== null && !isPlainObject2(submitted)) {
     return {
       ok: false,
       issues: [{ field: "", message: "Configuration must be an object." }],
       partial: {}
     };
   }
-  const input = isPlainObject(submitted) ? submitted : {};
+  const input = isPlainObject2(submitted) ? submitted : {};
   const secrets = {};
   const configuration = validateObject({ properties: schema.properties, required: schema.required }, input, null, walk, { secrets, supplied });
-  drain(walk, crossFieldIssues(schema, supplied, presence));
+  drain(walk, crossFieldIssues(schema, supplied, presence, configuration));
   if (walk.suppressed > 0) {
     walk.issues.push({
       field: "",
@@ -13342,7 +13442,7 @@ function validateContainer(name, property, children, value, field, walk) {
   if (children.kind === "object") {
     if (value === void 0)
       return void 0;
-    if (!isPlainObject(value)) {
+    if (!isPlainObject2(value)) {
       report(walk, field, "Expected a group of settings.");
       return void 0;
     }
@@ -13369,7 +13469,7 @@ function validateContainer(name, property, children, value, field, walk) {
       report(walk, field, "This configuration has too many values.");
       break;
     }
-    if (!isPlainObject(element)) {
+    if (!isPlainObject2(element)) {
       report(walk, `${field}`, `Item ${index + 1} is not a group of settings.`);
       continue;
     }
@@ -13385,9 +13485,10 @@ function validateContainer(name, property, children, value, field, walk) {
   }
   return out;
 }
-function crossFieldIssues(schema, supplied, presence) {
+function crossFieldIssues(schema, supplied, presence, configuration = {}) {
   const clauses = Object.entries(schema.dependentRequired ?? {});
-  if (clauses.length === 0)
+  const conditional = Object.entries(schema.properties).filter(([, property]) => conditionOf(property) !== void 0);
+  if (clauses.length === 0 && conditional.length === 0)
     return [];
   const alsoPresent = /* @__PURE__ */ new Set([...presence.present ?? [], ...presence.referenced ?? []]);
   const unknown = new Set(presence.unknown ?? []);
@@ -13410,13 +13511,42 @@ function crossFieldIssues(schema, supplied, presence) {
       });
     }
   }
+  for (const [name, property] of conditional) {
+    const condition = conditionOf(property);
+    if (condition === void 0 || !known(name) || held(name))
+      continue;
+    if (!conditionHolds(condition, configuration))
+      continue;
+    if (reported.has(name))
+      continue;
+    reported.add(name);
+    issues.push({
+      field: name,
+      // THE SETTING THAT MADE IT NECESSARY, never the value it holds. A message
+      // naming the value would be fine here and wrong one refactor later, when
+      // somebody conditions a secret on another secret — which the publish rules
+      // refuse precisely because nothing may read one.
+      message: `This setting is required because of what ${labelOf(schema, conditionRoot(condition))} is set to.`
+    });
+  }
   return issues;
 }
+function conditionOf(property) {
+  return property?.["x-required-when"];
+}
 function labelOf(schema, name) {
   const property = schema.properties[name];
   return property?.title === void 0 ? `"${name}"` : `"${property.title}"`;
 }
 function withoutCrossFieldRules(schema) {
+  const conditioned = Object.entries(schema.properties).some(([, property]) => property["x-required-when"] !== void 0);
+  if (conditioned) {
+    const properties = Object.fromEntries(Object.entries(schema.properties).map(([name, property]) => {
+      const { "x-required-when": _dropped, ...bare } = property;
+      return [name, bare];
+    }));
+    return withoutCrossFieldRules({ ...schema, properties });
+  }
   if (schema.dependentRequired === void 0)
     return schema;
   const { dependentRequired: _removed, ...rest } = schema;
@@ -14619,6 +14749,91 @@ function checkProductDefinition(definition, ctx) {
       });
     }
   });
+  for (const [name, property] of Object.entries(definition.configuration.properties ?? {})) {
+    const condition = property["x-required-when"];
+    if (condition === void 0)
+      continue;
+    const at = ["configuration", "properties", name, "x-required-when"];
+    if (!isSecretProperty(property)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at],
+        message: `"${name}" is not a secret, so "x-required-when" has nothing to report through. Declare it "x-secret": true with "writeOnly": true, or use "dependentRequired" to require one ordinary setting alongside another.`
+      });
+      continue;
+    }
+    if (new Set(condition.anyOf).size !== condition.anyOf.length) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "anyOf"],
+        message: "Repeated values in `anyOf`."
+      });
+    }
+    if (condition.path === name) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${name}" cannot be conditioned on its own value.`
+      });
+      continue;
+    }
+    const parsed = parseConfigurationPath(condition.path);
+    const leaf = parsed === null ? null : leafAt(definition.configuration, parsed);
+    if (leaf === null) {
+      const isGroup = parsed !== null && declaresPath(definition.configuration, parsed);
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: isGroup ? `"${condition.path}" is a group of settings, which holds no single value to compare. Name one setting inside it.` : `"${condition.path}" is not a declared customer configuration property.`
+      });
+      continue;
+    }
+    if (underList(leaf) && condition.anyRow !== true) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${condition.path}" is inside a list, so it names one value per item rather than one value. Add "anyRow": true to require the secret when ANY row chose one of these values, or name a setting the instance holds exactly once.`
+      });
+      continue;
+    }
+    if (!underList(leaf) && condition.anyRow === true) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "anyRow"],
+        message: `"${condition.path}" is not inside a list, so there are no rows to quantify over.`
+      });
+    }
+    const target = leaf.property;
+    if (target.type !== "string") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${condition.path}" is a ${target.type} setting; a condition compares string values.`
+      });
+      continue;
+    }
+    if (isSecretProperty(target)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${condition.path}" is a secret. The platform never reads a secret's value, so a condition on one could never be evaluated.`
+      });
+      continue;
+    }
+    const single = withoutCrossFieldRules({
+      ...definition.configuration,
+      properties: { [leaf.name]: target },
+      required: [leaf.name]
+    });
+    const outside = condition.anyOf.filter((value) => !validateSubmittedConfiguration(single, { [leaf.name]: value }).ok);
+    if (outside.length > 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "anyOf"],
+        message: `"${condition.path}" never accepts ${outside.map((v) => `"${v}"`).join(", ")}, so this condition could never make the secret required.`
+      });
+    }
+  }
   const provides = definition.serviceInterfaces?.provides ?? [];
   const provideKeys = provides.map((provide) => provide.key);
   const duplicateProvideKeys = provideKeys.filter((key, i) => provideKeys.indexOf(key) !== i);
@@ -17002,7 +17217,7 @@ async function runApply(verb, parsed, deps = {}) {
   if (!planned.ok) return printError(planned.error, json);
   if (verb === "plan") {
     printPlan(planned.data, json);
-    if (isUnconverged(planned.data)) {
+    if (isUnconverged(planned.data) && planned.data.action === "NO_CHANGE") {
       if (!json) {
         process.stderr.write(
           `${planned.data.manifestKey ?? "This resource"} is ${planned.data.health?.status ?? "not serving"}. Its desired state is applied; it is not running. \`vfac get operation <id>\` says why.
@@ -17011,6 +17226,12 @@ async function runApply(verb, parsed, deps = {}) {
       }
       return 1;
     }
+    if (isUnconverged(planned.data) && !json) {
+      process.stderr.write(
+        `${planned.data.manifestKey ?? "This resource"} is ${planned.data.health?.status ?? "not serving"}. This plan changes it.
+`
+      );
+    }
     return 0;
   }
   const parsedAction = ManifestActionSchema.safeParse(planned.data.action);
@@ -17310,23 +17531,20 @@ async function runDoctor(parsed) {
   const compatible = compatibility(cliVersion(), probe.minimumCliVersion);
   checks.push(compatible);
   if (!compatible.ok) return report2(checks, json);
-  const signedIn = await signIn({ endpoint });
-  if (!signedIn.ok) {
-    checks.push({ name: "Context Gate", ok: false, detail: signedIn.message });
+  const session = await ensureSession({ endpointFlag: parsed.flags["endpoint"] });
+  if (!session.ok) {
+    checks.push({ name: "Sign-in", ok: false, detail: session.message });
     return report2(checks, json);
   }
   checks.push({
-    name: "Context Gate",
+    name: "Sign-in",
     ok: true,
-    detail: signedIn.gate ? `authenticated as "${signedIn.gate.name}" (${signedIn.gate.id})` : "authenticated"
+    detail: session.ready.via === "stored" ? "a stored sign-in is still valid, so no credential was spent" : session.ready.gate ? `authenticated as "${session.ready.gate.name}" (${session.ready.gate.id})` : "authenticated"
   });
-  if (!sessionUsable(stored.session, endpoint, /* @__PURE__ */ new Date())) {
-    writeStored({ ...stored, session: signedIn.session });
-  }
   const who = await call({
     endpoint,
     path: "/api/v1/whoami",
-    token: signedIn.session.token
+    token: session.ready.token
   });
   if (!who.ok) {
     checks.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",