@varde-flyt/vfac 0.12.0 → 0.13.0

package/dist/vfac.mjs

@@ -7928,13 +7928,33 @@ function renderOperation(operationId, data) {
         );
       }
     }
+    const product = failure["product"];
+    const reportedSettings = [];
+    if (Array.isArray(product)) {
+      for (const entry of product) {
+        const one = asRecord(entry);
+        if (one === null) continue;
+        const component = one["component"];
+        const code = one["code"];
+        if (typeof component !== "string" || typeof code !== "string") continue;
+        if (component === "" || code === "") continue;
+        const setting = one["setting"];
+        if (typeof setting === "string" && setting !== "") {
+          reportedSettings.push(setting);
+          lines.push(`    ${component} refused to start: ${code} (setting: ${setting})`);
+        } else {
+          lines.push(`    ${component} refused to start: ${code}`);
+        }
+      }
+    }
     const retryable = failure["retryable"];
     if (typeof retryable === "boolean") {
       const again = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "`vfac lifecycle upgrade <pri_\u2026>`" : "`vfac lifecycle reconcile <pri_\u2026>`";
       const changeIt = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "" : ", or `vfac apply` a corrected manifest";
       const cause2 = failure["cause"];
+      const named = reportedSettings[0];
       lines.push(
-        retryable ? `    Another attempt can succeed: ${again}.` : cause2 === "unknown" ? `    The platform could not classify this, so there is nothing here to correct. Read the whole record with \`vfac get operation ${operationId} --output json\`, and quote that id if you ask for help. Repeating it unchanged fails the same way.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
+        retryable ? `    Another attempt can succeed: ${again}.` : named !== void 0 ? `    Correct \`${named}\` in your manifest, then \`vfac apply\` it${data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? ` and ${again}` : ""}. Repeating it unchanged fails the same way.` : cause2 === "unknown" ? `    The platform could not classify this, so there is nothing here to correct. Read the whole record with \`vfac get operation ${operationId} --output json\`, and quote that id if you ask for help. Repeating it unchanged fails the same way.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
       );
     }
   }
@@ -12245,6 +12265,29 @@ var ValueConditionSchema = external_exports.object({
   anyOf: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20),
   anyRow: external_exports.boolean().optional()
 }).strict();
+var ValueReferenceSchema = external_exports.object({
+  /**
+   * The setting whose VALUES form the allowed set — a canonical declaration
+   * path, or a bare root key, which is the same string at depth 1.
+   */
+  path: external_exports.string().min(1).max(400)
+}).strict();
+var RowCardinalitySchema = external_exports.object({
+  /** A setting declared DIRECTLY on the row. */
+  property: PropertyNameSchema,
+  /** The answers that count toward the limit. Non-empty. */
+  anyOf: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20),
+  /**
+   * How many rows may answer that way. Zero is meaningful and allowed — "no
+   * row may, under this release" is a thing an upgrade needs to be able to
+   * say.
+   */
+  max: external_exports.number().int().min(0).max(99)
+}).strict();
+var RowRulesSchema = external_exports.object({
+  unique: external_exports.array(PropertyNameSchema).min(1).max(MAX_CONFIGURATION_CHILDREN).optional(),
+  atMost: external_exports.array(RowCardinalitySchema).min(1).max(10).optional()
+}).strict();
 var TitleSchema = external_exports.string().min(2).max(80).describe("Customer-facing field label.");
 var V1_LEAF_BOUNDS = {
   help: 400,
@@ -12318,7 +12361,16 @@ function leafShapes(bounds) {
      * what `requiredSecrets` reports, which is one answer with one reader.
      * Opening it wider is a separate decision with its own blast radius.
      */
-    "x-required-when": ValueConditionSchema.optional()
+    "x-required-when": ValueConditionSchema.optional(),
+    /**
+     * The values this one must be chosen from — see {@link ValueReferenceSchema}.
+     *
+     * ON A STRING ONLY, and not on a secret: the platform never reads a
+     * secret's value, so a membership test on one could never be evaluated.
+     * The publish rules say so rather than leaving it to be discovered, the
+     * same way they already do for a condition pointed at a secret.
+     */
+    "x-value-in": ValueReferenceSchema.optional()
   }).strict();
   withJsonSchemaAnnex(string, SECRET_COUPLING_ANNEX);
   const number = external_exports.object({
@@ -12329,14 +12381,23 @@ function leafShapes(bounds) {
     /** Both bounds required — "numeric limits" in the guide is not optional. */
     minimum: external_exports.number(),
     maximum: external_exports.number(),
-    default: external_exports.number().optional()
+    default: external_exports.number().optional(),
+    /**
+     * WIDENED FROM SECRETS TO EVERY ROOT SETTING, which this shape's own
+     * comment on the string leaf used to record as a known gap: "a
+     * value-conditioned requirement for an ORDINARY setting is a real gap
+     * too". It is the same keyword, the same evaluator and the same publish
+     * rules; what changes is which settings may carry it.
+     */
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   const boolean = external_exports.object({
     type: external_exports.literal("boolean"),
     title: TitleSchema,
     description: help.optional(),
     group: ConfigurationGroupSchema,
-    default: external_exports.boolean().optional()
+    default: external_exports.boolean().optional(),
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   const items = external_exports.object({
     type: external_exports.literal("string"),
@@ -12353,7 +12414,8 @@ function leafShapes(bounds) {
     /** Required: an unbounded list is an unbounded write. */
     maxItems: external_exports.number().int().min(1).max(100),
     uniqueItems: external_exports.boolean().optional(),
-    default: external_exports.array(external_exports.string().max(200)).max(100).optional()
+    default: external_exports.array(external_exports.string().max(200)).max(100).optional(),
+    "x-required-when": ValueConditionSchema.optional()
   }).strict();
   return { string, number, boolean, items, array };
 }
@@ -12373,9 +12435,9 @@ var ConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
 var NestedStringPropertySchema = V2_LEAVES.string.omit({ "x-secret": true, writeOnly: true, "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() });
 var V2_NESTED_LEAVES = {
   string: NestedStringPropertySchema,
-  number: V2_LEAVES.number.extend({ group: ConfigurationGroupSchema.optional() }),
-  boolean: V2_LEAVES.boolean.extend({ group: ConfigurationGroupSchema.optional() }),
-  array: V2_LEAVES.array.extend({ group: ConfigurationGroupSchema.optional() }),
+  number: V2_LEAVES.number.omit({ "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() }),
+  boolean: V2_LEAVES.boolean.omit({ "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() }),
+  array: V2_LEAVES.array.omit({ "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() }),
   items: V2_LEAVES.items
 };
 function childBagShape(child) {
@@ -12419,7 +12481,23 @@ function propertyUnion(levelsBelow, leafSet) {
     // discriminator, which is also what keeps a v1 document's
     // `items: {type: 'string'}` reading exactly as it always did.
     leafSet.array.extend({
-      items: external_exports.discriminatedUnion("type", [V2_LEAVES.items, groupItems])
+      items: external_exports.discriminatedUnion("type", [V2_LEAVES.items, groupItems]),
+      /**
+       * Rules over the ROWS of this list — see {@link RowRulesSchema}.
+       *
+       * HERE RATHER THAN ON THE LEAF SHAPE, and that placement is the whole
+       * enforcement. `leafShapes().array` is also a v1 list and a last-level
+       * list, both of which hold STRINGS: a rule naming a field of a row would
+       * name nothing there, and `uniqueItems` is already the right keyword for
+       * comparing whole scalar entries. This branch is the only one in the chain
+       * where a list can hold groups, so declaring the keyword here makes "rows
+       * have fields" a property of the shape rather than a rule to remember.
+       *
+       * The refinement still has to refuse a rule on a list of STRINGS, because
+       * `items` is a discriminated union INSIDE this branch — the shape narrows
+       * where a row can exist, not whether this particular list has one.
+       */
+      "x-row-rules": RowRulesSchema.optional()
     }),
     /**
      * A group of related settings.
@@ -13122,6 +13200,9 @@ function canonicalJson(value) {
 }
 
 // ../product-configuration/dist/configuration-tree.js
+function immediateContainer(node) {
+  return node.containers[node.containers.length - 1] ?? null;
+}
 function underList(node) {
   return node.containers.some((container) => container.kind === "array");
 }
@@ -13183,6 +13264,11 @@ function walkDeclarations(properties, ancestors, base, onLeaf, onContainer = ()
     walkDeclarations(children.properties, [...ancestors, container], segments, onLeaf, onContainer);
   }
 }
+function declaredDefault(property) {
+  if (property.type === "object")
+    return void 0;
+  return property.default;
+}
 function leafAt(schema, path) {
   const declaration = declarationPathOf(path);
   return configurationLeaves(schema).find((leaf) => leaf.path === declaration) ?? null;
@@ -13195,6 +13281,29 @@ function declaresPath(schema, path) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function expandDeclarationPath(configuration, declaration) {
+  const out = [];
+  const walk = (cursor, remaining, soFar) => {
+    if (remaining.length === 0) {
+      const path = configurationPath(...soFar);
+      if (path !== null)
+        out.push(path);
+      return;
+    }
+    if (Array.isArray(cursor)) {
+      cursor.forEach((element, index) => walk(element, remaining, [...soFar, index]));
+      return;
+    }
+    if (!isPlainObject(cursor))
+      return;
+    const [head, ...rest] = remaining;
+    if (head === void 0)
+      return;
+    walk(cursor[String(head)], rest, [...soFar, head]);
+  };
+  walk(configuration, segmentsOf(declaration), []);
+  return out;
+}
 function valueAt(configuration, path) {
   let cursor = configuration;
   for (const segment of segmentsOf(path)) {
@@ -13290,6 +13399,7 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
   const secrets = {};
   const configuration = validateObject({ properties: schema.properties, required: schema.required }, input, null, walk, { secrets, supplied });
   drain(walk, crossFieldIssues(schema, supplied, presence, configuration));
+  drain(walk, rowAndReferenceIssues(schema, presence, configuration));
   if (walk.suppressed > 0) {
     walk.issues.push({
       field: "",
@@ -13533,6 +13643,106 @@ function crossFieldIssues(schema, supplied, presence, configuration = {}) {
   }
   return issues;
 }
+function referenceOf(property) {
+  return property?.["x-value-in"];
+}
+function rowRulesOf(property) {
+  return property?.["x-row-rules"];
+}
+function comparableValue(value) {
+  if (value === void 0 || value === null)
+    return null;
+  if (typeof value === "string")
+    return value === "" ? null : JSON.stringify(value);
+  if (typeof value === "number" || typeof value === "boolean")
+    return JSON.stringify(value);
+  return null;
+}
+function rowAndReferenceIssues(schema, presence, configuration) {
+  const issues = [];
+  const referenced = new Set(presence.referenced ?? []);
+  for (const leaf of configurationLeaves(schema)) {
+    const reference = referenceOf(leaf.property);
+    if (reference === void 0)
+      continue;
+    const targetPath = parseConfigurationPath(reference.path);
+    if (targetPath === null)
+      continue;
+    const allowed = new Set(valuesAt(configuration, targetPath).filter((value) => typeof value === "string"));
+    for (const valuePath of expandDeclarationPath(configuration, leaf.path)) {
+      if (referenced.has(valuePath))
+        continue;
+      const held = valueAt(configuration, valuePath);
+      if (typeof held !== "string" || held === "")
+        continue;
+      if (allowed.has(held))
+        continue;
+      issues.push({
+        field: valuePath,
+        message: `This must be one of the values configured under ${labelOfPath(schema, targetPath)}. ` + (allowed.size === 0 ? "Nothing is configured there yet." : "No entry there currently holds this one.")
+      });
+    }
+  }
+  for (const container of configurationContainers(schema)) {
+    if (container.kind !== "array")
+      continue;
+    const rules = rowRulesOf(container.property);
+    if (rules === void 0)
+      continue;
+    for (const listPath of expandDeclarationPath(configuration, container.path)) {
+      const rows = valueAt(configuration, listPath);
+      if (!Array.isArray(rows))
+        continue;
+      const fieldOf = (index, name) => configurationPath(...pathSegments(listPath), index, name) ?? listPath;
+      for (const name of rules.unique ?? []) {
+        const firstAt = /* @__PURE__ */ new Map();
+        rows.forEach((row, index) => {
+          const held = comparableValue(isPlainObject2(row) ? row[name] : void 0);
+          if (held === null)
+            return;
+          const earlier = firstAt.get(held);
+          if (earlier === void 0) {
+            firstAt.set(held, index);
+            return;
+          }
+          issues.push({
+            field: fieldOf(index, name),
+            message: `${labelOfChild(container, name)} must be different in every entry; entry ${earlier + 1} already uses this one.`
+          });
+        });
+      }
+      for (const rule of rules.atMost ?? []) {
+        let counted = 0;
+        rows.forEach((row, index) => {
+          const held = isPlainObject2(row) ? row[rule.property] : void 0;
+          if (typeof held !== "string" || !rule.anyOf.includes(held))
+            return;
+          counted += 1;
+          if (counted <= rule.max)
+            return;
+          issues.push({
+            field: fieldOf(index, rule.property),
+            message: rule.max === 0 ? `No entry may be set to this.` : `At most ${rule.max} ${rule.max === 1 ? "entry" : "entries"} may be set to this, and ${counted - 1} already ${counted - 1 === 1 ? "is" : "are"}.`
+          });
+        });
+      }
+    }
+  }
+  return issues;
+}
+function labelOfPath(schema, path) {
+  const leaf = leafAt(schema, path);
+  const titleOf = (node) => node?.property.title;
+  const field = titleOf(leaf) ?? printableConfigurationPath(path);
+  const container = leaf?.containers[0];
+  const outer = container === void 0 ? void 0 : titleOf(container);
+  return outer === void 0 ? `"${field}"` : `"${field}" in "${outer}"`;
+}
+function labelOfChild(container, name) {
+  const items = container.property.items;
+  const title = items?.properties?.[name]?.title;
+  return title === void 0 ? `"${name}"` : `"${title}"`;
+}
 function conditionOf(property) {
   return property?.["x-required-when"];
 }
@@ -13541,19 +13751,45 @@ function labelOf(schema, name) {
   return property?.title === void 0 ? `"${name}"` : `"${property.title}"`;
 }
 function withoutCrossFieldRules(schema) {
-  const conditioned = Object.entries(schema.properties).some(([, property]) => property["x-required-when"] !== void 0);
-  if (conditioned) {
-    const properties = Object.fromEntries(Object.entries(schema.properties).map(([name, property]) => {
-      const { "x-required-when": _dropped, ...bare } = property;
-      return [name, bare];
-    }));
-    return withoutCrossFieldRules({ ...schema, properties });
-  }
-  if (schema.dependentRequired === void 0)
-    return schema;
-  const { dependentRequired: _removed, ...rest } = schema;
+  const properties = withoutPropertyRules(schema.properties);
+  const stripped = properties === null ? schema : { ...schema, properties };
+  if (stripped.dependentRequired === void 0)
+    return stripped;
+  const { dependentRequired: _removed, ...rest } = stripped;
   return rest;
 }
+var PROPERTY_RULE_KEYWORDS = ["x-required-when", "x-value-in", "x-row-rules"];
+function withoutPropertyRules(properties) {
+  let out = null;
+  const edit = (name) => {
+    out ??= { ...properties };
+    const copy = { ...out[name] };
+    out[name] = copy;
+    return copy;
+  };
+  for (const [name, property] of Object.entries(properties)) {
+    if (!isPlainObject2(property))
+      continue;
+    for (const keyword of PROPERTY_RULE_KEYWORDS) {
+      if (property[keyword] === void 0)
+        continue;
+      delete edit(name)[keyword];
+    }
+    const children = out?.[name] ?? property;
+    if (isPlainObject2(children["properties"])) {
+      const bare = withoutPropertyRules(children["properties"]);
+      if (bare !== null)
+        edit(name)["properties"] = bare;
+    }
+    const items = children["items"];
+    if (isPlainObject2(items) && isPlainObject2(items["properties"])) {
+      const bare = withoutPropertyRules(items["properties"]);
+      if (bare !== null)
+        edit(name)["items"] = { ...items, properties: bare };
+    }
+  }
+  return out;
+}
 function defaultOf(property) {
   switch (property.type) {
     case "string":
@@ -14760,11 +14996,19 @@ function checkProductDefinition(definition, ctx) {
     if (condition === void 0)
       continue;
     const at = ["configuration", "properties", name, "x-required-when"];
-    if (!isSecretProperty(property)) {
+    if ((definition.configuration.required ?? []).includes(name)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at],
+        message: `"${name}" is already required, so "x-required-when" can only narrow a rule that is already unconditional. Drop one: \`required\` is always, \`x-required-when\` is the condition.`
+      });
+      continue;
+    }
+    if (declaredDefault(property) !== void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: [...at],
-        message: `"${name}" is not a secret, so "x-required-when" has nothing to report through. Declare it "x-secret": true with "writeOnly": true, or use "dependentRequired" to require one ordinary setting alongside another.`
+        message: `"${name}" declares a default, so it is never absent and this condition could never make it required. Remove the default, or the condition.`
       });
       continue;
     }
@@ -14840,6 +15084,8 @@ function checkProductDefinition(definition, ctx) {
       });
     }
   }
+  checkValueReferences(definition.configuration, ctx);
+  checkRowRules(definition.configuration, ctx);
   const provides = definition.serviceInterfaces?.provides ?? [];
   const provideKeys = provides.map((provide) => provide.key);
   const duplicateProvideKeys = provideKeys.filter((key, i) => provideKeys.indexOf(key) !== i);
@@ -14951,6 +15197,203 @@ function checkProductDefinition(definition, ctx) {
     });
   }
 }
+function declarationIssuePath(node) {
+  const out = ["configuration"];
+  for (const container of node.containers) {
+    out.push("properties", container.name);
+    if (container.kind === "array")
+      out.push("items");
+  }
+  out.push("properties", node.name);
+  return out;
+}
+function directChildren(leaves, container) {
+  return leaves.filter((leaf) => immediateContainer(leaf)?.path === container.path);
+}
+function valuesOutsideSpace(configuration, leaf, values) {
+  const single = withoutCrossFieldRules({
+    ...configuration,
+    properties: { [leaf.name]: leaf.property },
+    required: [leaf.name]
+  });
+  return values.filter((value) => !validateSubmittedConfiguration(single, { [leaf.name]: value }).ok);
+}
+function checkValueReferences(configuration, ctx) {
+  const leaves = configurationLeaves(configuration);
+  for (const leaf of leaves) {
+    const reference = leaf.property["x-value-in"];
+    if (reference === void 0)
+      continue;
+    const at = [...declarationIssuePath(leaf), "x-value-in"];
+    const here = printableConfigurationPath(leaf.path);
+    if (isSecretProperty(leaf.property)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" is a secret. The platform never reads a secret's value, so it could never check one against a set of values.`
+      });
+      continue;
+    }
+    if (leaf.property.enum !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" already fixes its values with "enum". A setting takes its values from the contract or from another setting, not from both.`
+      });
+      continue;
+    }
+    if (declaredDefault(leaf.property) !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" declares a default, which would be written into every row and then refused until the setting it points at happens to hold the same value. Remove the default.`
+      });
+      continue;
+    }
+    const parsed = parseConfigurationPath(reference.path);
+    const target = parsed === null ? null : leafAt(configuration, parsed);
+    if (target === null) {
+      const isGroup = parsed !== null && declaresPath(configuration, parsed);
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: isGroup ? `"${reference.path}" is a group of settings, which holds no value to choose from. Name one setting inside it.` : `"${reference.path}" is not a declared customer configuration property.`
+      });
+      continue;
+    }
+    if (target.path === leaf.path) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${here}" cannot take its values from itself.`
+      });
+      continue;
+    }
+    if (target.property.type !== "string") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${reference.path}" is a ${target.property.type} setting; a reference compares string values.`
+      });
+      continue;
+    }
+    if (isSecretProperty(target.property)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${reference.path}" is a secret. The platform never reads a secret's value, so it could never be the set a reference is checked against.`
+      });
+      continue;
+    }
+  }
+}
+function checkRowRules(configuration, ctx) {
+  const leaves = configurationLeaves(configuration);
+  for (const leaf of leaves) {
+    if (leaf.property["x-row-rules"] === void 0)
+      continue;
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [...declarationIssuePath(leaf), "x-row-rules"],
+      message: `"${printableConfigurationPath(leaf.path)}" is a list of text entries, whose rows have no fields to name. Use "uniqueItems" to compare whole entries, or declare "items" as a group.`
+    });
+  }
+  for (const container of configurationContainers(configuration)) {
+    const rules = container.property["x-row-rules"];
+    if (rules === void 0)
+      continue;
+    const at = [...declarationIssuePath(container), "x-row-rules"];
+    const here = printableConfigurationPath(container.path);
+    if (rules.unique === void 0 && rules.atMost === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: at,
+        message: `"${here}" declares "x-row-rules" with no rule in it. Declare "unique", "atMost", or both.`
+      });
+      continue;
+    }
+    const children = directChildren(leaves, container);
+    const childAt = (name) => children.find((child) => child.name === name);
+    const maxItems = container.property.maxItems;
+    const seen = /* @__PURE__ */ new Set();
+    (rules.unique ?? []).forEach((name, index) => {
+      if (seen.has(name)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is named twice.`
+        });
+        return;
+      }
+      seen.add(name);
+      const child = childAt(name);
+      if (child === void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is not a setting declared on a row of "${here}".`
+        });
+        return;
+      }
+      if (child.property.type === "array") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is a list, which holds no single value to compare across rows.`
+        });
+      }
+      if (child.property.type === "boolean") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...at, "unique", index],
+          message: `"${name}" is a true/false setting, so requiring it to be unique would cap "${here}" at two rows rather than make anything distinct. Use "atMost" to limit how many rows may answer one way.`
+        });
+      }
+    });
+    (rules.atMost ?? []).forEach((rule, index) => {
+      const ruleAt = [...at, "atMost", index];
+      const child = childAt(rule.property);
+      if (child === void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "property"],
+          message: `"${rule.property}" is not a setting declared on a row of "${here}".`
+        });
+        return;
+      }
+      if (child.property.type !== "string") {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "property"],
+          message: `"${rule.property}" is a ${child.property.type} setting; a row rule compares string values.`
+        });
+        return;
+      }
+      if (new Set(rule.anyOf).size !== rule.anyOf.length) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "anyOf"],
+          message: "Repeated values in `anyOf`."
+        });
+      }
+      if (maxItems !== void 0 && rule.max >= maxItems) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "max"],
+          message: `"${here}" holds at most ${maxItems} rows, so a limit of ${rule.max} could never be exceeded. Lower it, or remove the rule.`
+        });
+      }
+      const outside = valuesOutsideSpace(configuration, child, rule.anyOf);
+      if (outside.length > 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...ruleAt, "anyOf"],
+          message: `"${rule.property}" never accepts ${outside.map((value) => `"${value}"`).join(", ")}, so this rule could never count a row.`
+        });
+      }
+    });
+  }
+}
 
 // ../product-contracts/dist/announcements.js
 var ANNOUNCED_PRODUCTS = Object.freeze([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",