@varde-flyt/vfac 0.9.0 → 0.11.0

package/README.md

@@ -27,9 +27,11 @@ vfac whoami
 ```
 
 `doctor` checks the endpoint, which Project this terminal has selected, the API,
-whether this client is new enough for the platform it is pointed at, your
-credential and what that credential reaches, in that order, and reports the first
-thing that is actually wrong. A platform declares the oldest client it supports;
+whether this client is new enough for the platform it is pointed at, how this
+terminal is signed in and what that credential reaches, in that order, and reports
+the first thing that is actually wrong. Both ways of signing in count: a Context
+Gate exchanged from `VFAC_CREDENTIAL_ID` and `VFAC_CREDENTIAL_SECRET`, or a
+sign-in from `vfac login` that is still valid. A platform declares the oldest client it supports;
 below that, `doctor` fails and says so before sending your credential anywhere.
 
 The selected Project and the Projects your credential reaches are two different
@@ -89,13 +91,14 @@ identifier in a manifest that is yours: a resource key is 3–63 characters of
 lowercase letters, digits and hyphens, starting with a letter and ending with a
 letter or digit.
 
-**A key is claimed for good, and a delete does not release it.** The record of a
-deleted resource keeps its key, so a manifest that named it can never apply again
-— `vfac plan` answers `GONE` — and a replacement needs a different key. That is
-worth knowing before the delete rather than after it, because after it there is
-nothing to undo; `vfac lifecycle delete` says the same thing at the prompt. If
-what you want is to stop the service and keep the option of bringing it back,
-`vfac lifecycle suspend` is the reversible one.
+**A live resource holds its key, and a finished delete releases it.** The key
+stays claimed while the teardown runs, so nothing can take the name before the
+original is gone. Once the delete completes the name is free and the same
+manifest applies again — as a `CREATE`, building a NEW resource with nothing in
+it. Reuse is not a restore, which is worth knowing before the delete rather than
+after it: the apply succeeds, so nothing will stop you. `vfac lifecycle delete`
+says the same thing at the prompt. If what you want is to stop the service and
+keep its data, `vfac lifecycle suspend` is the reversible one.
 
 ## Reading a setting from another resource
 
@@ -191,6 +194,43 @@ credential the connection delivers never appears in your manifest, in a plan, or
 in any `vfac` output — the providing service issues it and the platform stores
 it.
 
+## For an agent or a pipeline
+
+Every command takes `--output json`, and it is the same data rather than a
+prettier subset — the human format of `vfac product show` prints a readable
+selection on purpose, and the JSON carries the whole Product contract.
+
+```sh
+vfac product show <productId> --output json
+vfac plan -f resource.yaml --output json
+vfac get product-instance <productInstanceId> --output json
+vfac get product-instances --output json
+```
+
+**Decide from the action, not from the exit code.** A plan that REFUSES still
+exits 0: a plan reporting `UPGRADE_REQUIRED` did what it was asked, and the
+answer is "not like this". A job that reads only the exit code treats that as
+success and applies nothing.
+
+```sh
+ACTION="$(vfac plan -f resource.yaml --output json | jq -r .action)"
+```
+
+**And a non-zero exit is a real failure.** The code is not decoration: a
+`NO_CHANGE` against a resource that is not actually serving exits 1, with
+`--output json` as without it, because "nothing needed applying" and "it works"
+are different answers. Read the action for what the plan MEANS and the exit code
+for whether anything is WRONG — neither substitutes for the other.
+
+The envelopes are stable at the top level:
+
+| Command | Answers with |
+| --- | --- |
+| `vfac get product-instance <id> --output json` | `resource` and `lifecycle` — `status`, `outputs` and `conditions` are under `resource` |
+| `vfac get product-instances --output json` | `productInstances` and `nextCursor` |
+
+`vfac guide` is authoritative for what is inside them.
+
 ## Running it again
 
 **Send no secret.** A pipeline re-applies the same manifest on every push:

package/dist/vfac.mjs

@@ -7793,7 +7793,7 @@ async function ensureSession(args) {
   const endpoint = checked.endpoint;
   const credential = credentialFromEnvironment();
   if (args.forceExchange !== true && sessionUsable(stored.session, endpoint, args.now ?? /* @__PURE__ */ new Date(), credential?.keyId)) {
-    return { ok: true, ready: { endpoint, token: stored.session.token, stored } };
+    return { ok: true, ready: { endpoint, token: stored.session.token, stored, via: "stored" } };
   }
   const signedIn = await signIn({
     endpoint,
@@ -7802,7 +7802,16 @@ async function ensureSession(args) {
   if (!signedIn.ok) return { ok: false, message: signedIn.message };
   const next = { ...stored, session: signedIn.session };
   writeStored(next);
-  return { ok: true, ready: { endpoint, token: signedIn.session.token, stored: next } };
+  return {
+    ok: true,
+    ready: {
+      endpoint,
+      token: signedIn.session.token,
+      stored: next,
+      via: "exchanged",
+      ...signedIn.gate ? { gate: signedIn.gate } : {}
+    }
+  };
 }
 function resolveProject(flag, stored) {
   return flag ?? stored.context?.projectId ?? null;
@@ -7922,8 +7931,9 @@ function renderOperation(operationId, data) {
     const retryable = failure["retryable"];
     if (typeof retryable === "boolean") {
       const again = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "`vfac lifecycle upgrade <pri_\u2026>`" : "`vfac lifecycle reconcile <pri_\u2026>`";
+      const changeIt = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "" : ", or `vfac apply` a corrected manifest";
       lines.push(
-        retryable ? `    Another attempt can succeed: ${again}.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}.`
+        retryable ? `    Another attempt can succeed: ${again}.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
       );
     }
   }
@@ -12224,6 +12234,16 @@ var ConfigurationGroupSchema = external_exports.enum([
 ]);
 var CONFIGURATION_PROPERTY_NAME_REGEX = /^[a-z][a-zA-Z0-9]{1,47}$/;
 var PropertyNameSchema = external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX, "Configuration property names must be camelCase, start with a lowercase letter, and be 2\u201348 characters.");
+var ValueConditionSchema = external_exports.object({
+  /**
+   * The setting, as a canonical path — or a bare root key, which is the same
+   * string at depth 1. With `anyRow`, a DECLARATION path: `/servers/kind`
+   * names the setting each row answers, never one row's answer.
+   */
+  path: external_exports.string().min(1).max(400),
+  anyOf: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20),
+  anyRow: external_exports.boolean().optional()
+}).strict();
 var TitleSchema = external_exports.string().min(2).max(80).describe("Customer-facing field label.");
 var V1_LEAF_BOUNDS = {
   help: 400,
@@ -12280,7 +12300,24 @@ function leafShapes(bounds) {
      * without the other a validation error.
      */
     writeOnly: external_exports.boolean().optional(),
-    "x-secret": external_exports.boolean().optional()
+    "x-secret": external_exports.boolean().optional(),
+    /**
+     * The setting VALUE that makes this credential necessary.
+     *
+     * WHY IT CANNOT BE `dependentRequired`. That mechanism is keyed on
+     * PRESENCE — "if the author answered X, they must also answer Y" — and
+     * says so in as many words: "PRESENCE, NEVER A VALUE. A caller passes
+     * NAMES." A Product whose credential is needed only when a setting has one
+     * particular value could not say so, so `vfac plan`'s `requiredSecrets`
+     * could not warn before a deploy, and the refusal arrived at apply.
+     *
+     * ON A SECRET ONLY, and that is narrower than the mechanism could be. A
+     * value-conditioned requirement for an ORDINARY setting is a real gap too,
+     * but it changes what every door accepts for every property; this changes
+     * what `requiredSecrets` reports, which is one answer with one reader.
+     * Opening it wider is a separate decision with its own blast radius.
+     */
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   withJsonSchemaAnnex(string, SECRET_COUPLING_ANNEX);
   const number = external_exports.object({
@@ -12332,7 +12369,7 @@ var ConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
   BooleanPropertySchema,
   ArrayPropertySchema
 ]);
-var NestedStringPropertySchema = V2_LEAVES.string.omit({ "x-secret": true, writeOnly: true }).extend({ group: ConfigurationGroupSchema.optional() });
+var NestedStringPropertySchema = V2_LEAVES.string.omit({ "x-secret": true, writeOnly: true, "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() });
 var V2_NESTED_LEAVES = {
   string: NestedStringPropertySchema,
   number: V2_LEAVES.number.extend({ group: ConfigurationGroupSchema.optional() }),
@@ -13038,6 +13075,9 @@ function pathSegments(path) {
   const raw = path.startsWith("/") ? path.slice(1).split("/") : [path];
   return raw.map((segment) => isIndexSegment(segment) ? Number(segment) : segment);
 }
+function rootSegment(path) {
+  return String(pathSegments(path)[0]);
+}
 function declarationPathOf(path) {
   const segments = pathSegments(path).filter((segment) => typeof segment !== "number");
   return configurationPath(...segments) ?? path;
@@ -13151,11 +13191,71 @@ function declaresPath(schema, path) {
     return true;
   return configurationContainers(schema).some((container) => container.path === declarationPathOf(path));
 }
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function valueAt(configuration, path) {
+  let cursor = configuration;
+  for (const segment of segmentsOf(path)) {
+    if (typeof segment === "number") {
+      if (!Array.isArray(cursor))
+        return void 0;
+      cursor = cursor[segment];
+      continue;
+    }
+    if (!isPlainObject(cursor))
+      return void 0;
+    cursor = cursor[segment];
+  }
+  return cursor;
+}
+function valuesAt(configuration, path) {
+  let cursors = [configuration];
+  for (const segment of segmentsOf(path)) {
+    const next = [];
+    for (const cursor of cursors) {
+      if (typeof segment === "number") {
+        if (Array.isArray(cursor))
+          next.push(cursor[segment]);
+        continue;
+      }
+      if (!isPlainObject(cursor))
+        continue;
+      const value = cursor[segment];
+      if (Array.isArray(value))
+        next.push(...value);
+      else
+        next.push(value);
+    }
+    cursors = next;
+  }
+  return cursors.filter((value) => value !== void 0);
+}
+function segmentsOf(path) {
+  const raw = path.startsWith("/") ? path.slice(1).split("/") : [path];
+  return raw.map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
+}
+
+// ../product-configuration/dist/value-condition.js
+function conditionSetting(condition) {
+  return "path" in condition ? condition.path : condition.property;
+}
+function conditionRoot(condition) {
+  const path = parseConfigurationPath(conditionSetting(condition));
+  return path === null ? conditionSetting(condition) : rootSegment(path);
+}
+function conditionHolds(condition, configuration) {
+  const path = parseConfigurationPath(conditionSetting(condition));
+  if (path === null)
+    return false;
+  const matches2 = (held) => typeof held === "string" && condition.anyOf.includes(held);
+  return "anyRow" in condition && condition.anyRow === true ? valuesAt(configuration, path).some(matches2) : matches2(valueAt(configuration, path));
+}
 
 // ../product-configuration/dist/customer-configuration-input.js
 var ABSOLUTE_MAX_STRING = MAX_DECLARABLE_STRING_LENGTH;
 var MAX_REPORTED_UNDECLARED_KEYS = 10;
-function isPlainObject(value) {
+function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function report(walk, field, message) {
@@ -13177,17 +13277,17 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
     referenced: new Set(presence.referenced ?? [])
   };
   const supplied = /* @__PURE__ */ new Set();
-  if (submitted !== void 0 && submitted !== null && !isPlainObject(submitted)) {
+  if (submitted !== void 0 && submitted !== null && !isPlainObject2(submitted)) {
     return {
       ok: false,
       issues: [{ field: "", message: "Configuration must be an object." }],
       partial: {}
     };
   }
-  const input = isPlainObject(submitted) ? submitted : {};
+  const input = isPlainObject2(submitted) ? submitted : {};
   const secrets = {};
   const configuration = validateObject({ properties: schema.properties, required: schema.required }, input, null, walk, { secrets, supplied });
-  drain(walk, crossFieldIssues(schema, supplied, presence));
+  drain(walk, crossFieldIssues(schema, supplied, presence, configuration));
   if (walk.suppressed > 0) {
     walk.issues.push({
       field: "",
@@ -13342,7 +13442,7 @@ function validateContainer(name, property, children, value, field, walk) {
   if (children.kind === "object") {
     if (value === void 0)
       return void 0;
-    if (!isPlainObject(value)) {
+    if (!isPlainObject2(value)) {
       report(walk, field, "Expected a group of settings.");
       return void 0;
     }
@@ -13369,7 +13469,7 @@ function validateContainer(name, property, children, value, field, walk) {
       report(walk, field, "This configuration has too many values.");
       break;
     }
-    if (!isPlainObject(element)) {
+    if (!isPlainObject2(element)) {
       report(walk, `${field}`, `Item ${index + 1} is not a group of settings.`);
       continue;
     }
@@ -13385,9 +13485,10 @@ function validateContainer(name, property, children, value, field, walk) {
   }
   return out;
 }
-function crossFieldIssues(schema, supplied, presence) {
+function crossFieldIssues(schema, supplied, presence, configuration = {}) {
   const clauses = Object.entries(schema.dependentRequired ?? {});
-  if (clauses.length === 0)
+  const conditional = Object.entries(schema.properties).filter(([, property]) => conditionOf(property) !== void 0);
+  if (clauses.length === 0 && conditional.length === 0)
     return [];
   const alsoPresent = /* @__PURE__ */ new Set([...presence.present ?? [], ...presence.referenced ?? []]);
   const unknown = new Set(presence.unknown ?? []);
@@ -13410,13 +13511,42 @@ function crossFieldIssues(schema, supplied, presence) {
       });
     }
   }
+  for (const [name, property] of conditional) {
+    const condition = conditionOf(property);
+    if (condition === void 0 || !known(name) || held(name))
+      continue;
+    if (!conditionHolds(condition, configuration))
+      continue;
+    if (reported.has(name))
+      continue;
+    reported.add(name);
+    issues.push({
+      field: name,
+      // THE SETTING THAT MADE IT NECESSARY, never the value it holds. A message
+      // naming the value would be fine here and wrong one refactor later, when
+      // somebody conditions a secret on another secret — which the publish rules
+      // refuse precisely because nothing may read one.
+      message: `This setting is required because of what ${labelOf(schema, conditionRoot(condition))} is set to.`
+    });
+  }
   return issues;
 }
+function conditionOf(property) {
+  return property?.["x-required-when"];
+}
 function labelOf(schema, name) {
   const property = schema.properties[name];
   return property?.title === void 0 ? `"${name}"` : `"${property.title}"`;
 }
 function withoutCrossFieldRules(schema) {
+  const conditioned = Object.entries(schema.properties).some(([, property]) => property["x-required-when"] !== void 0);
+  if (conditioned) {
+    const properties = Object.fromEntries(Object.entries(schema.properties).map(([name, property]) => {
+      const { "x-required-when": _dropped, ...bare } = property;
+      return [name, bare];
+    }));
+    return withoutCrossFieldRules({ ...schema, properties });
+  }
   if (schema.dependentRequired === void 0)
     return schema;
   const { dependentRequired: _removed, ...rest } = schema;
@@ -14619,6 +14749,91 @@ function checkProductDefinition(definition, ctx) {
       });
     }
   });
+  for (const [name, property] of Object.entries(definition.configuration.properties ?? {})) {
+    const condition = property["x-required-when"];
+    if (condition === void 0)
+      continue;
+    const at = ["configuration", "properties", name, "x-required-when"];
+    if (!isSecretProperty(property)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at],
+        message: `"${name}" is not a secret, so "x-required-when" has nothing to report through. Declare it "x-secret": true with "writeOnly": true, or use "dependentRequired" to require one ordinary setting alongside another.`
+      });
+      continue;
+    }
+    if (new Set(condition.anyOf).size !== condition.anyOf.length) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "anyOf"],
+        message: "Repeated values in `anyOf`."
+      });
+    }
+    if (condition.path === name) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${name}" cannot be conditioned on its own value.`
+      });
+      continue;
+    }
+    const parsed = parseConfigurationPath(condition.path);
+    const leaf = parsed === null ? null : leafAt(definition.configuration, parsed);
+    if (leaf === null) {
+      const isGroup = parsed !== null && declaresPath(definition.configuration, parsed);
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: isGroup ? `"${condition.path}" is a group of settings, which holds no single value to compare. Name one setting inside it.` : `"${condition.path}" is not a declared customer configuration property.`
+      });
+      continue;
+    }
+    if (underList(leaf) && condition.anyRow !== true) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${condition.path}" is inside a list, so it names one value per item rather than one value. Add "anyRow": true to require the secret when ANY row chose one of these values, or name a setting the instance holds exactly once.`
+      });
+      continue;
+    }
+    if (!underList(leaf) && condition.anyRow === true) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "anyRow"],
+        message: `"${condition.path}" is not inside a list, so there are no rows to quantify over.`
+      });
+    }
+    const target = leaf.property;
+    if (target.type !== "string") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${condition.path}" is a ${target.type} setting; a condition compares string values.`
+      });
+      continue;
+    }
+    if (isSecretProperty(target)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${condition.path}" is a secret. The platform never reads a secret's value, so a condition on one could never be evaluated.`
+      });
+      continue;
+    }
+    const single = withoutCrossFieldRules({
+      ...definition.configuration,
+      properties: { [leaf.name]: target },
+      required: [leaf.name]
+    });
+    const outside = condition.anyOf.filter((value) => !validateSubmittedConfiguration(single, { [leaf.name]: value }).ok);
+    if (outside.length > 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "anyOf"],
+        message: `"${condition.path}" never accepts ${outside.map((v) => `"${v}"`).join(", ")}, so this condition could never make the secret required.`
+      });
+    }
+  }
   const provides = definition.serviceInterfaces?.provides ?? [];
   const provideKeys = provides.map((provide) => provide.key);
   const duplicateProvideKeys = provideKeys.filter((key, i) => provideKeys.indexOf(key) !== i);
@@ -16589,9 +16804,16 @@ var MANIFEST_ACTIONS = [
   /** The key names a resource and the document matches it. A pipeline that runs
    *  on every push and changes nothing reports this, and it is SUCCESS. */
   "NO_CHANGE",
-  /** The key names a resource that was DELETED. Its own verb, because both
+  /** `adopt` points at a resource that was DELETED. Its own verb, because both
    *  alternatives are wrong: `NO_CHANGE` would call a missing resource fine, and
-   *  `CREATE` cannot be honoured while the tombstone holds the key. */
+   *  `CREATE` would silently ignore the `adopt` the caller asked for.
+   *
+   *  IT USED TO COVER A SECOND, COMMONER CASE: a manifest whose `metadata.key`
+   *  named a deleted resource, back when a key was claimed for ever. A completed
+   *  delete now releases the key, so that manifest is planned as a `CREATE` and
+   *  the verb narrowed to the one case a caller reaches by naming a `pri_…` by
+   *  hand. Kept in the vocabulary rather than removed: it is still produced, and
+   *  a Control Plane that still answers it must still be understood. */
   "GONE",
   /** The document pins a different release. Done through `:upgrade`, which has
    *  the Definition's own capability check, its own version resolution and its
@@ -17002,7 +17224,7 @@ async function runApply(verb, parsed, deps = {}) {
   if (!planned.ok) return printError(planned.error, json);
   if (verb === "plan") {
     printPlan(planned.data, json);
-    if (isUnconverged(planned.data)) {
+    if (isUnconverged(planned.data) && planned.data.action === "NO_CHANGE") {
       if (!json) {
         process.stderr.write(
           `${planned.data.manifestKey ?? "This resource"} is ${planned.data.health?.status ?? "not serving"}. Its desired state is applied; it is not running. \`vfac get operation <id>\` says why.
@@ -17011,6 +17233,12 @@ async function runApply(verb, parsed, deps = {}) {
       }
       return 1;
     }
+    if (isUnconverged(planned.data) && !json) {
+      process.stderr.write(
+        `${planned.data.manifestKey ?? "This resource"} is ${planned.data.health?.status ?? "not serving"}. This plan changes it.
+`
+      );
+    }
     return 0;
   }
   const parsedAction = ManifestActionSchema.safeParse(planned.data.action);
@@ -17310,23 +17538,20 @@ async function runDoctor(parsed) {
   const compatible = compatibility(cliVersion(), probe.minimumCliVersion);
   checks.push(compatible);
   if (!compatible.ok) return report2(checks, json);
-  const signedIn = await signIn({ endpoint });
-  if (!signedIn.ok) {
-    checks.push({ name: "Context Gate", ok: false, detail: signedIn.message });
+  const session = await ensureSession({ endpointFlag: parsed.flags["endpoint"] });
+  if (!session.ok) {
+    checks.push({ name: "Sign-in", ok: false, detail: session.message });
     return report2(checks, json);
   }
   checks.push({
-    name: "Context Gate",
+    name: "Sign-in",
     ok: true,
-    detail: signedIn.gate ? `authenticated as "${signedIn.gate.name}" (${signedIn.gate.id})` : "authenticated"
+    detail: session.ready.via === "stored" ? "a stored sign-in is still valid, so no credential was spent" : session.ready.gate ? `authenticated as "${session.ready.gate.name}" (${session.ready.gate.id})` : "authenticated"
   });
-  if (!sessionUsable(stored.session, endpoint, /* @__PURE__ */ new Date())) {
-    writeStored({ ...stored, session: signedIn.session });
-  }
   const who = await call({
     endpoint,
     path: "/api/v1/whoami",
-    token: signedIn.session.token
+    token: session.ready.token
   });
   if (!who.ok) {
     checks.push({
@@ -18219,8 +18444,9 @@ Run \`vfac get product-instance pri_\u2026\` to see which ones this credential m
   if (command === "delete" && !parsed.booleans.has("yes")) {
     process.stderr.write(
       `delete removes ${instanceId} and everything it is serving. This cannot be undone.
-If it was deployed from a manifest, its \`metadata.key\` stays claimed: a replacement
-needs a different key, and re-applying the same file will answer GONE.
+If it was deployed from a manifest, its \`metadata.key\` is held until this delete
+FINISHES, then released. Applying the same file afterwards creates a new, empty
+resource under that key. It does not bring this one back.
 Re-run with --yes to confirm:  vfac lifecycle delete ${instanceId} --yes
 Or suspend it instead, which stops it and keeps it: \`vfac lifecycle suspend\`.
 `
@@ -18379,7 +18605,10 @@ Authentication
 
 Exit codes
   0  done \u2014 including "no change", which is what a pipeline that changes nothing
-     should report
+     should report, AND including a plan that refuses. plan answers what would
+     happen; "it would be refused" is an answer, so it exits 0. Read the action,
+     not the code: vfac plan -f resource.yaml --output json, then branch on
+     .action
   1  refused, the request was wrong, or the resource matches your manifest and is
      NOT serving. "Nothing needed applying" is not the same as "it works", and a
      NO_CHANGE that could be a false green is the case this one exists for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",