@varde-flyt/vfac 0.7.0 → 0.8.0

package/dist/vfac.mjs

@@ -7424,22 +7424,46 @@ function parseArgs(argv) {
 }
 
 // src/config.ts
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+var salvaged = null;
+function salvagedConfigPath() {
+  return salvaged;
+}
 function configPath() {
   const base = process.env["VFAC_CONFIG_HOME"] ?? join(homedir(), ".config", "vfac");
   return join(base, "config.json");
 }
 function readStored(path = configPath()) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return {};
+  }
   try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
-    if (typeof parsed !== "object" || parsed === null) return {};
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) throw new Error("not an object");
     return parsed;
   } catch {
+    salvage(path);
     return {};
   }
 }
+function salvage(path) {
+  const kept = `${path}.corrupt`;
+  try {
+    readFileSync(kept, "utf8");
+    return;
+  } catch {
+  }
+  try {
+    renameSync(path, kept);
+    salvaged = kept;
+  } catch {
+  }
+}
 function writeStored(next, path = configPath()) {
   const directory = dirname(path);
   mkdirSync(directory, { recursive: true, mode: 448 });
@@ -11964,6 +11988,14 @@ var coerce = {
 };
 var NEVER = INVALID;
 
+// ../product-configuration/dist/configuration-bounds.js
+var MAX_CONFIGURATION_DEPTH = 2;
+var MAX_CONFIGURATION_LEAVES = 40;
+var MAX_CONFIGURATION_NODES = 60;
+var MAX_CONFIGURATION_VALUE_LEAVES = 1e3;
+var MAX_CONFIGURATION_ISSUES = 50;
+var MAX_CONFIGURATION_VALUE_BYTES = 16384;
+
 // ../product-configuration/dist/json-schema-annex.js
 var ANNEXES = /* @__PURE__ */ new WeakMap();
 function withJsonSchemaAnnex(schema, annex) {
@@ -12263,12 +12295,49 @@ var ArrayPropertySchema = external_exports.object({
   uniqueItems: external_exports.boolean().optional(),
   default: external_exports.array(external_exports.string().max(200)).max(100).optional()
 }).strict();
+var MAX_CONFIGURATION_PROPERTIES = 40;
 var ConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
   StringPropertySchema,
   NumberPropertySchema,
   BooleanPropertySchema,
   ArrayPropertySchema
 ]);
+var NestedStringPropertySchema = StringPropertySchema.omit({
+  "x-secret": true,
+  writeOnly: true
+});
+var NestedConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
+  NestedStringPropertySchema,
+  NumberPropertySchema,
+  BooleanPropertySchema,
+  ArrayPropertySchema
+]);
+var nestedPropertiesShape = {
+  properties: external_exports.record(PropertyNameSchema, NestedConfigurationPropertySchema),
+  required: external_exports.array(PropertyNameSchema).max(MAX_CONFIGURATION_PROPERTIES).optional(),
+  additionalProperties: external_exports.literal(false)
+};
+var ObjectPropertySchema = external_exports.object({
+  type: external_exports.literal("object"),
+  title: TitleSchema,
+  description: HelpTextSchema.optional(),
+  group: ConfigurationGroupSchema,
+  ...nestedPropertiesShape
+}).strict();
+var ObjectArrayItemsSchema = external_exports.object({
+  type: external_exports.literal("object"),
+  ...nestedPropertiesShape
+}).strict();
+var ArrayPropertyV2Schema = ArrayPropertySchema.extend({
+  items: external_exports.discriminatedUnion("type", [ArrayItemsSchema, ObjectArrayItemsSchema])
+});
+var RootConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
+  StringPropertySchema,
+  NumberPropertySchema,
+  BooleanPropertySchema,
+  ArrayPropertyV2Schema,
+  ObjectPropertySchema
+]);
 var CustomerConfigurationObjectSchema = external_exports.object({
   type: external_exports.literal("object"),
   properties: external_exports.record(PropertyNameSchema, ConfigurationPropertySchema).describe("Customer-editable settings, keyed by camelCase property name."),
@@ -12302,7 +12371,6 @@ var CustomerConfigurationObjectSchema = external_exports.object({
    */
   additionalProperties: external_exports.literal(false)
 }).strict();
-var MAX_CONFIGURATION_PROPERTIES = 40;
 var CustomerConfigurationSchema = CustomerConfigurationObjectSchema.superRefine((config, ctx) => {
   const names = Object.keys(config.properties);
   if (names.length > MAX_CONFIGURATION_PROPERTIES) {
@@ -12314,182 +12382,192 @@ var CustomerConfigurationSchema = CustomerConfigurationObjectSchema.superRefine(
   }
   for (const name of names) {
     const property = config.properties[name];
-    const path = ["properties", name];
-    const infrastructure = infrastructureVocabularyViolation(name);
-    if (infrastructure) {
+    checkDeclaredProperty(name, property, ["properties", name], ctx, true);
+  }
+  for (const name of config.required ?? []) {
+    if (!Object.hasOwn(config.properties, name)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path,
-        message: `${infrastructure}. Customer settings describe outcomes, not infrastructure.`
+        path: ["required"],
+        message: `"${name}" is listed as required but is not a declared property.`
       });
     }
+  }
+  const duplicates = (config.required ?? []).filter((name, index, all) => all.indexOf(name) !== index);
+  if (duplicates.length > 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["required"],
+      message: `Duplicate required entries: ${[...new Set(duplicates)].join(", ")}.`
+    });
+  }
+  checkDependentRequired(config, ctx);
+});
+function checkDeclaredProperty(name, property, path, ctx, atRoot) {
+  const infrastructure = infrastructureVocabularyViolation(name);
+  if (infrastructure) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path,
+      message: `${infrastructure}. Customer settings describe outcomes, not infrastructure.`
+    });
+  }
+  if (atRoot) {
     const platformOwned = platformOwnedFieldViolation(name);
     if (platformOwned) {
       ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path, message: `${platformOwned}.` });
     }
-    for (const [label, values] of enumerableValues(property)) {
-      for (const value of values) {
-        const violation = infrastructureValueViolation(value);
-        if (violation) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: [...path, label],
-            message: `${violation}. Customer settings offer outcomes, not infrastructure sizes.`
-          });
-        }
-      }
-    }
-    if (property.type === "string") {
-      const secret = property["x-secret"] === true;
-      const credential = credentialNameViolation(name);
-      if (credential && !secret) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `${credential} and must be declared "x-secret": true with "writeOnly": true, or renamed if it is not one.`
-        });
-      }
-      if (secret && property.writeOnly !== true) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" is marked x-secret but not writeOnly \u2014 a read API could echo the value.`
-        });
-      }
-      if (property.writeOnly === true && !secret) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" is marked writeOnly but not x-secret \u2014 the value would not be routed to the secret flow.`
-        });
-      }
-      if (secret && property.default !== void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "default"],
-          message: `"${name}" is a secret and must not declare a default value.`
-        });
-      }
-      if (secret && property.enum !== void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "enum"],
-          message: `"${name}" is a secret; an enum would enumerate candidate secret values.`
-        });
-      }
-      if (property.enum === void 0 && property.maxLength === void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" must declare either an enum or a maxLength.`
-        });
-      }
-      if (property.enum !== void 0 && property.default !== void 0 && !property.enum.includes(property.default)) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "default"],
-          message: `"${name}" declares a default outside its enum.`
-        });
-      }
-      if (property.minLength !== void 0 && property.maxLength !== void 0 && property.minLength > property.maxLength) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" has minLength greater than maxLength.`
-        });
-      }
-      if (property.default !== void 0 && property.maxLength !== void 0 && property.default.length > property.maxLength) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "default"],
-          message: `"${name}" declares a default longer than its own maxLength.`
-        });
-      }
-      if (property.pattern !== void 0 && !isSafeRegex(property.pattern)) {
+  }
+  for (const [label, values] of enumerableValues(property)) {
+    for (const value of values) {
+      const violation = infrastructureValueViolation(value);
+      if (violation) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: [...path, "pattern"],
-          message: `"${name}" declares a pattern that is not a valid regular expression.`
+          path: [...path, label],
+          message: `${violation}. Customer settings offer outcomes, not infrastructure sizes.`
         });
       }
     }
-    if (property.type === "integer" || property.type === "number") {
-      if (property.minimum > property.maximum) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" has minimum greater than maximum.`
-        });
-      }
-      if (property.default !== void 0 && (property.default < property.minimum || property.default > property.maximum)) {
+  }
+  if (property.type === "string") {
+    const secret = property["x-secret"] === true;
+    const credential = credentialNameViolation(name);
+    if (credential && !secret) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        // THE REMEDIATION HAS TO BE ONE THE CONTRACT ALLOWS. At the root, the
+        // answer is to declare the two markers. Below it, that answer is
+        // IMPOSSIBLE — the nested shape omits both keys and `.strict()` refuses
+        // them — so telling a publisher to add them sends them to write a
+        // second invalid document, and an agent following the validator loops.
+        // A validator's errors are part of the agent-facing contract.
+        message: atRoot ? `${credential} and must be declared "x-secret": true with "writeOnly": true, or renamed if it is not one.` : `${credential}, and a credential must be a TOP-LEVEL setting in this contract format \u2014 move it out of the group and declare it "x-secret": true with "writeOnly": true, or rename it if it is not one.`
+      });
+    }
+    if (secret && property.writeOnly !== true) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" is marked x-secret but not writeOnly \u2014 a read API could echo the value.`
+      });
+    }
+    if (property.writeOnly === true && !secret) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" is marked writeOnly but not x-secret \u2014 the value would not be routed to the secret flow.`
+      });
+    }
+    if (secret && property.default !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" is a secret and must not declare a default value.`
+      });
+    }
+    if (secret && property.enum !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "enum"],
+        message: `"${name}" is a secret; an enum would enumerate candidate secret values.`
+      });
+    }
+    if (property.enum === void 0 && property.maxLength === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" must declare either an enum or a maxLength.`
+      });
+    }
+    if (property.enum !== void 0 && property.default !== void 0 && !property.enum.includes(property.default)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" declares a default outside its enum.`
+      });
+    }
+    if (property.minLength !== void 0 && property.maxLength !== void 0 && property.minLength > property.maxLength) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" has minLength greater than maxLength.`
+      });
+    }
+    if (property.default !== void 0 && property.maxLength !== void 0 && property.default.length > property.maxLength) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" declares a default longer than its own maxLength.`
+      });
+    }
+    if (property.pattern !== void 0 && !isSafeRegex(property.pattern)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "pattern"],
+        message: `"${name}" declares a pattern that is not a valid regular expression.`
+      });
+    }
+  }
+  if (property.type === "integer" || property.type === "number") {
+    if (property.minimum > property.maximum) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" has minimum greater than maximum.`
+      });
+    }
+    if (property.default !== void 0 && (property.default < property.minimum || property.default > property.maximum)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" declares a default outside its minimum/maximum range.`
+      });
+    }
+    if (property.type === "integer" && !Number.isInteger(property.default ?? 0)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" is an integer but declares a fractional default.`
+      });
+    }
+  }
+  if (property.type === "array") {
+    const allowed = property.items.enum;
+    if (allowed === void 0 && property.items.maxLength === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "items"],
+        message: `"${name}" items must declare either an enum or a maxLength.`
+      });
+    }
+    if (property.minItems !== void 0 && property.minItems > property.maxItems) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" has minItems greater than maxItems.`
+      });
+    }
+    if (property.default !== void 0) {
+      if (property.default.length > property.maxItems) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
           path: [...path, "default"],
-          message: `"${name}" declares a default outside its minimum/maximum range.`
+          message: `"${name}" declares a default longer than maxItems.`
         });
       }
-      if (property.type === "integer" && !Number.isInteger(property.default ?? 0)) {
+      const outside = allowed ? property.default.filter((value) => !allowed.includes(value)) : [];
+      if (outside.length > 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
           path: [...path, "default"],
-          message: `"${name}" is an integer but declares a fractional default.`
-        });
-      }
-    }
-    if (property.type === "array") {
-      const allowed = property.items.enum;
-      if (allowed === void 0 && property.items.maxLength === void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "items"],
-          message: `"${name}" items must declare either an enum or a maxLength.`
-        });
-      }
-      if (property.minItems !== void 0 && property.minItems > property.maxItems) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" has minItems greater than maxItems.`
+          message: `"${name}" declares default values outside its items enum: ${outside.join(", ")}.`
         });
       }
-      if (property.default !== void 0) {
-        if (property.default.length > property.maxItems) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: [...path, "default"],
-            message: `"${name}" declares a default longer than maxItems.`
-          });
-        }
-        const outside = allowed ? property.default.filter((value) => !allowed.includes(value)) : [];
-        if (outside.length > 0) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: [...path, "default"],
-            message: `"${name}" declares default values outside its items enum: ${outside.join(", ")}.`
-          });
-        }
-      }
     }
   }
-  for (const name of config.required ?? []) {
-    if (!Object.hasOwn(config.properties, name)) {
-      ctx.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["required"],
-        message: `"${name}" is listed as required but is not a declared property.`
-      });
-    }
-  }
-  const duplicates = (config.required ?? []).filter((name, index, all) => all.indexOf(name) !== index);
-  if (duplicates.length > 0) {
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["required"],
-      message: `Duplicate required entries: ${[...new Set(duplicates)].join(", ")}.`
-    });
-  }
-  checkDependentRequired(config, ctx);
-});
+}
 function checkDependentRequired(config, ctx) {
   const clauses = Object.entries(config.dependentRequired ?? {});
   if (clauses.length === 0)
@@ -12611,29 +12689,400 @@ function checkOneSecretPerGroup(config, ctx) {
     });
   }
 }
-function enumerableValues(property) {
-  const out = [];
-  if (property.type === "string") {
-    if (property.enum)
-      out.push(["enum", property.enum]);
-    if (property.default !== void 0)
-      out.push(["default", [property.default]]);
+var CustomerConfigurationV2ObjectSchema = external_exports.object({
+  type: external_exports.literal("object"),
+  properties: external_exports.record(PropertyNameSchema, RootConfigurationPropertySchema).describe("Customer-editable settings, keyed by camelCase property name."),
+  required: external_exports.array(PropertyNameSchema).max(MAX_CONFIGURATION_PROPERTIES).optional(),
+  /**
+   * ROOT PROPERTIES ONLY, in v2.0.
+   *
+   * The published key promises that "a publisher running an off-the-shelf
+   * validator over that file must get the answer the platform gives", and
+   * JSON Schema 2020-12 `dependentRequired` is scoped to the object that
+   * carries it. A clause naming a nested leaf would be a rule no standard
+   * validator applies, which is the one thing this key may not become. A
+   * nested object may not carry its own clause either — that is expressible
+   * and honest, and it is deliberately left for when something needs it.
+   */
+  dependentRequired: external_exports.record(PropertyNameSchema, external_exports.array(PropertyNameSchema).min(1).max(MAX_CONFIGURATION_PROPERTIES)).optional().describe("Settings that must be supplied together, keyed by the triggering property."),
+  additionalProperties: external_exports.literal(false)
+}).strict();
+function countNodes(property) {
+  if (property.type === "object") {
+    const children = Object.keys(property.properties).length;
+    return { leaves: children, nodes: children + 1, instantiated: children };
   }
-  if (property.type === "array") {
-    if (property.items.enum)
-      out.push(["items", property.items.enum]);
-    if (property.default)
-      out.push(["default", property.default]);
+  if (property.type === "array" && property.items.type === "object") {
+    const children = Object.keys(property.items.properties).length;
+    return {
+      leaves: children,
+      nodes: children + 1,
+      instantiated: children * property.maxItems
+    };
   }
-  return out;
+  return { leaves: 1, nodes: 1, instantiated: 1 };
 }
-function isSafeRegex(pattern) {
-  try {
-    new RegExp(pattern);
-    return true;
-  } catch {
-    return false;
-  }
+function childrenOf(property) {
+  if (property.type === "object")
+    return property;
+  if (property.type === "array" && property.items.type === "object")
+    return property.items;
+  return null;
+}
+function minimumConfigurationBytes(config) {
+  const rootRequired = new Set(config.required ?? []);
+  let total = 2;
+  for (const [name, property] of Object.entries(config.properties)) {
+    const children = childrenOf(property);
+    if (children === null) {
+      if (!rootRequired.has(name) && declaredLeafDefault(property) === void 0)
+        continue;
+      total += name.length + 3 + minimumLeafBytes(property);
+      continue;
+    }
+    if (!rootRequired.has(name))
+      continue;
+    const inner = minimumGroupBytes(children.properties, children.required ?? []);
+    total += name.length + 3 + (property.type === "array" ? 2 + (property.minItems ?? 0) * inner : inner);
+  }
+  return total;
+}
+function minimumGroupBytes(properties, required) {
+  const names = new Set(required);
+  let total = 2;
+  for (const [name, property] of Object.entries(properties)) {
+    if (!names.has(name) && declaredLeafDefault(property) === void 0)
+      continue;
+    total += name.length + 3 + minimumLeafBytes(property);
+  }
+  return total;
+}
+function minimumLeafBytes(property) {
+  switch (property.type) {
+    case "string": {
+      const shortestEnum = property.enum?.reduce((a, b) => a.length <= b.length ? a : b);
+      const shortest = shortestEnum?.length ?? Math.max(property.minLength ?? 0, 1);
+      return shortest + 2;
+    }
+    case "integer":
+    case "number":
+      return 1;
+    case "boolean":
+      return 4;
+    case "array":
+      return 2 + (property.minItems ?? 0) * 3;
+    case "object":
+      return 2;
+  }
+}
+function declaredLeafDefault(property) {
+  return property.type === "object" ? void 0 : property.default;
+}
+var CustomerConfigurationV2Schema = CustomerConfigurationV2ObjectSchema.superRefine((config, ctx) => {
+  const names = Object.keys(config.properties);
+  if (names.length > MAX_CONFIGURATION_PROPERTIES) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `A Product may declare at most ${MAX_CONFIGURATION_PROPERTIES} customer settings; found ${names.length}.`
+    });
+  }
+  let leaves = 0;
+  let nodes = 0;
+  let instantiated = 0;
+  for (const name of names) {
+    const property = config.properties[name];
+    const path = ["properties", name];
+    const counted = countNodes(property);
+    leaves += counted.leaves;
+    nodes += counted.nodes;
+    instantiated += counted.instantiated;
+    const children = childrenOf(property);
+    if (children === null) {
+      checkDeclaredProperty(name, property, path, ctx, true);
+      continue;
+    }
+    const infrastructure = infrastructureVocabularyViolation(name);
+    if (infrastructure) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `${infrastructure}. Customer settings describe outcomes, not infrastructure.`
+      });
+    }
+    const platformOwned = platformOwnedFieldViolation(name);
+    if (platformOwned) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path, message: `${platformOwned}.` });
+    }
+    const childNames = Object.keys(children.properties);
+    if (childNames.length === 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "properties"],
+        message: `"${name}" declares no settings. A group with nothing in it renders as an empty section.`
+      });
+    }
+    if (childNames.length > MAX_CONFIGURATION_PROPERTIES) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "properties"],
+        message: `"${name}" may declare at most ${MAX_CONFIGURATION_PROPERTIES} settings; found ${childNames.length}.`
+      });
+    }
+    if (property.type === "array" && property.default !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" is a list of groups and cannot declare a default. Declare defaults on the settings inside it.`
+      });
+    }
+    if (property.type === "array" && property.minItems !== void 0 && property.minItems > property.maxItems) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" has minItems greater than maxItems.`
+      });
+    }
+    for (const childName of childNames) {
+      checkDeclaredProperty(childName, children.properties[childName], [...path, "properties", childName], ctx, false);
+    }
+    for (const required of children.required ?? []) {
+      if (!Object.hasOwn(children.properties, required)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [...path, "required"],
+          message: `"${required}" is listed as required in "${name}" but is not one of its settings.`
+        });
+      }
+    }
+  }
+  if (leaves > MAX_CONFIGURATION_LEAVES) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `A Product may declare at most ${MAX_CONFIGURATION_LEAVES} customer settings in total; found ${leaves}.`
+    });
+  }
+  if (nodes > MAX_CONFIGURATION_NODES) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `A Product may declare at most ${MAX_CONFIGURATION_NODES} configuration nodes; found ${nodes}.`
+    });
+  }
+  if (instantiated > MAX_CONFIGURATION_VALUE_LEAVES) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `This Product's settings could expand to ${instantiated} values \u2014 a list of groups instantiates its settings once per item. At most ${MAX_CONFIGURATION_VALUE_LEAVES} are allowed; reduce maxItems, or the number of settings inside the list.`
+    });
+  }
+  for (const name of config.required ?? []) {
+    if (!Object.hasOwn(config.properties, name)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["required"],
+        message: `"${name}" is listed as required but is not a declared property.`
+      });
+    }
+  }
+  const floor = minimumConfigurationBytes(config);
+  if (floor > MAX_CONFIGURATION_VALUE_BYTES) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `The smallest configuration that could satisfy this Product is at least ${floor} bytes, and the limit is ${MAX_CONFIGURATION_VALUE_BYTES}. No customer could deploy it \u2014 reduce the required settings, their minimum lengths, or a list's minItems.`
+    });
+  }
+  checkDependentRequired(config, ctx);
+  checkOneSecretPerGroup(config, ctx);
+});
+function enumerableValues(property) {
+  const out = [];
+  if (property.type === "string") {
+    if (property.enum)
+      out.push(["enum", property.enum]);
+    if (property.default !== void 0)
+      out.push(["default", [property.default]]);
+  }
+  if (property.type === "array") {
+    if (property.items.enum)
+      out.push(["items", property.items.enum]);
+    if (property.default)
+      out.push(["default", property.default]);
+  }
+  return out;
+}
+function isSafeRegex(pattern) {
+  try {
+    new RegExp(pattern);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isSecretProperty(property) {
+  return property.type === "string" && property["x-secret"] === true;
+}
+
+// ../product-configuration/dist/configuration-path.js
+var MAX_CONFIGURATION_PATH_SEGMENTS = MAX_CONFIGURATION_DEPTH + 1;
+function isIndexSegment(raw) {
+  return /^\d+$/.test(raw) && String(Number(raw)) === raw;
+}
+function isPathSegment(segment) {
+  if (typeof segment === "number")
+    return Number.isInteger(segment) && segment >= 0;
+  return CONFIGURATION_PROPERTY_NAME_REGEX.test(segment) || isIndexSegment(segment);
+}
+function configurationPath(...segments) {
+  if (segments.length === 0 || segments.length > MAX_CONFIGURATION_PATH_SEGMENTS)
+    return null;
+  if (!segments.every(isPathSegment))
+    return null;
+  if (typeof segments[0] === "number" || isIndexSegment(String(segments[0])))
+    return null;
+  if (segments.length === 1)
+    return String(segments[0]);
+  return `/${segments.map(String).join("/")}`;
+}
+function parseConfigurationPath(raw) {
+  if (typeof raw !== "string" || raw.length === 0)
+    return null;
+  if (!raw.startsWith("/"))
+    return configurationPath(raw);
+  const segments = raw.slice(1).split("/");
+  if (segments.length < 2)
+    return null;
+  return configurationPath(...segments);
+}
+function pathSegments(path) {
+  const raw = path.startsWith("/") ? path.slice(1).split("/") : [path];
+  return raw.map((segment) => isIndexSegment(segment) ? Number(segment) : segment);
+}
+function declarationPathOf(path) {
+  const segments = pathSegments(path).filter((segment) => typeof segment !== "number");
+  return configurationPath(...segments) ?? path;
+}
+function printableConfigurationPath(path) {
+  return pathSegments(path).join(".");
+}
+
+// ../product-configuration/dist/canonical-json.js
+function canonicalise(value, path) {
+  if (value === null)
+    return "null";
+  if (typeof value === "string")
+    return JSON.stringify(value);
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`canonicalJson: non-finite number at ${path}`);
+    }
+    return JSON.stringify(value === 0 ? 0 : value);
+  }
+  if (typeof value !== "object") {
+    throw new Error(`canonicalJson: ${typeof value} is not JSON at ${path}`);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item, i) => canonicalise(item, `${path}[${i}]`)).join(",")}]`;
+  }
+  const entries = Object.entries(value);
+  for (const [key, item] of entries) {
+    if (item === void 0) {
+      throw new Error(`canonicalJson: undefined property at ${path}.${key}`);
+    }
+  }
+  const sorted = entries.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  const body = sorted.map(([key, item]) => `${JSON.stringify(key)}:${canonicalise(item, `${path}.${key}`)}`).join(",");
+  return `{${body}}`;
+}
+function canonicalJson(value) {
+  return canonicalise(value, "$");
+}
+
+// ../product-configuration/dist/configuration-tree.js
+function containerChildren(property) {
+  if (property.type === "object" && property.properties !== void 0) {
+    return {
+      kind: "object",
+      properties: property.properties,
+      required: property.required ?? []
+    };
+  }
+  if (property.type === "array" && property.items !== void 0) {
+    const items = property.items;
+    if (items.type !== "object" || items.properties === void 0)
+      return null;
+    return {
+      kind: "array",
+      properties: items.properties,
+      required: items.required ?? []
+    };
+  }
+  return null;
+}
+function isConfigurationContainer(property) {
+  return containerChildren(property) !== null;
+}
+function configurationLeaves(schema) {
+  const out = [];
+  for (const [name, property] of Object.entries(schema.properties)) {
+    const children = containerChildren(property);
+    if (children === null) {
+      const path = configurationPath(name);
+      if (path !== null) {
+        out.push({ path, name, property, container: null });
+      }
+      continue;
+    }
+    const containerPath = configurationPath(name);
+    if (containerPath === null)
+      continue;
+    const container = {
+      path: containerPath,
+      name,
+      kind: children.kind,
+      property,
+      required: children.required
+    };
+    for (const [childName, child] of Object.entries(children.properties)) {
+      const path = configurationPath(name, childName);
+      if (path === null)
+        continue;
+      out.push({ path, name: childName, property: child, container });
+    }
+  }
+  return out;
+}
+function configurationContainers(schema) {
+  const out = [];
+  for (const [name, property] of Object.entries(schema.properties)) {
+    const children = containerChildren(property);
+    if (children === null)
+      continue;
+    const path = configurationPath(name);
+    if (path === null)
+      continue;
+    out.push({
+      path,
+      name,
+      kind: children.kind,
+      property,
+      required: children.required
+    });
+  }
+  return out;
+}
+function leafAt(schema, path) {
+  const declaration = declarationPathOf(path);
+  return configurationLeaves(schema).find((leaf) => leaf.path === declaration) ?? null;
+}
+function declaresPath(schema, path) {
+  if (leafAt(schema, path) !== null)
+    return true;
+  return configurationContainers(schema).some((container) => container.path === declarationPathOf(path));
 }
 
 // ../product-configuration/dist/customer-configuration-input.js
@@ -12642,11 +13091,24 @@ var MAX_REPORTED_UNDECLARED_KEYS = 10;
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isSecretProperty(property) {
-  return property.type === "string" && property["x-secret"] === true;
+function report(walk, field, message) {
+  if (walk.issues.length >= MAX_CONFIGURATION_ISSUES) {
+    walk.suppressed += 1;
+    return;
+  }
+  walk.issues.push({ field, message });
+}
+function drain(walk, collected) {
+  for (const issue of collected)
+    report(walk, issue.field, issue.message);
 }
 function validateSubmittedConfiguration(schema, submitted, presence = {}) {
-  const issues = [];
+  const walk = {
+    issues: [],
+    suppressed: 0,
+    leaves: 0,
+    referenced: new Set(presence.referenced ?? [])
+  };
   const supplied = /* @__PURE__ */ new Set();
   if (submitted !== void 0 && submitted !== null && !isPlainObject(submitted)) {
     return {
@@ -12656,64 +13118,195 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
     };
   }
   const input = isPlainObject(submitted) ? submitted : {};
-  const undeclared = Object.keys(input).filter((name) => !Object.hasOwn(schema.properties, name));
-  for (const name of undeclared.slice(0, MAX_REPORTED_UNDECLARED_KEYS)) {
-    issues.push({
-      field: CONFIGURATION_PROPERTY_NAME_REGEX.test(name) ? name : "",
-      message: "This Product does not declare a setting with that name."
-    });
-  }
-  if (undeclared.length > MAX_REPORTED_UNDECLARED_KEYS) {
-    issues.push({
+  const secrets = {};
+  const configuration = validateObject({ properties: schema.properties, required: schema.required }, input, null, walk, { secrets, supplied });
+  drain(walk, crossFieldIssues(schema, supplied, presence));
+  if (walk.suppressed > 0) {
+    walk.issues.push({
       field: "",
-      // A COUNT, never the names. The count is the actionable part and it
-      // cannot carry anything the caller chose.
-      message: `${undeclared.length - MAX_REPORTED_UNDECLARED_KEYS} further settings are not declared by this Product.`
+      message: `${walk.suppressed} further problems were found and are not listed.`
     });
   }
-  const required = new Set(schema.required ?? []);
-  const configuration = {};
-  const secrets = {};
-  for (const [name, property] of Object.entries(schema.properties)) {
-    const blank = typeof input[name] === "string" && input[name].trim().length === 0;
-    const present = Object.hasOwn(input, name) && input[name] !== void 0 && !blank;
-    const secret = isSecretProperty(property);
-    if (present)
-      supplied.add(name);
+  if (declaresContainer(schema)) {
+    const size = utf8ByteLength(JSON.stringify(configuration));
+    if (size > MAX_CONFIGURATION_VALUE_BYTES) {
+      report(walk, "", `This configuration is ${size} bytes once defaults are applied, and the limit is ${MAX_CONFIGURATION_VALUE_BYTES}. Remove some items.`);
+    }
+  }
+  if (walk.issues.length > 0)
+    return { ok: false, issues: walk.issues, partial: configuration };
+  return { ok: true, configuration, secrets };
+}
+function utf8ByteLength(value) {
+  return new TextEncoder().encode(value).length;
+}
+function declaresContainer(schema) {
+  return Object.values(schema.properties).some((property) => isConfigurationContainer(property));
+}
+function containsReferenced(walk, container) {
+  if (walk.referenced.size === 0)
+    return false;
+  const parsedOuter = parseConfigurationPath(container);
+  if (parsedOuter === null)
+    return false;
+  const outer = pathSegments(parsedOuter);
+  for (const candidate of walk.referenced) {
+    const parsed = parseConfigurationPath(candidate);
+    if (parsed === null)
+      continue;
+    const inner = pathSegments(parsed);
+    if (inner.length <= outer.length)
+      continue;
+    if (outer.every((segment, index) => inner[index] === segment))
+      return true;
+  }
+  return false;
+}
+function validateObject(declaration, input, container, walk, root) {
+  const required = new Set(declaration.required ?? []);
+  const out = {};
+  const fieldFor = (name) => {
+    const path = container === null ? configurationPath(name) : configurationPath(...pathSegments(container), name);
+    return path ?? "";
+  };
+  const undeclared = Object.keys(input).filter((name) => !Object.hasOwn(declaration.properties, name));
+  for (const name of undeclared.slice(0, MAX_REPORTED_UNDECLARED_KEYS)) {
+    report(walk, fieldFor(name), "This Product does not declare a setting with that name.");
+  }
+  if (undeclared.length > MAX_REPORTED_UNDECLARED_KEYS) {
+    report(walk, container === null ? "" : container, `${undeclared.length - MAX_REPORTED_UNDECLARED_KEYS} further settings are not declared by this Product.`);
+  }
+  for (const [name, property] of Object.entries(declaration.properties)) {
+    const field = fieldFor(name);
+    const children = containerDeclaration(property);
+    if (children !== null) {
+      const value = input[name];
+      const filled = validateContainer(name, property, children, value, field, walk);
+      if (filled !== void 0)
+        out[name] = filled;
+      else if (required.has(name) && !containsReferenced(walk, field))
+        report(walk, field, "This setting is required.");
+      continue;
+    }
+    const leaf = property;
+    if (walk.referenced.has(field)) {
+      const sent = input[name];
+      if (Object.hasOwn(input, name) && sent !== void 0) {
+        report(walk, field, "This setting is answered by another Resource, so it cannot also be set here.");
+      }
+      continue;
+    }
+    const raw = input[name];
+    const blank = typeof raw === "string" && raw.trim().length === 0;
+    const present = Object.hasOwn(input, name) && raw !== void 0 && !blank;
+    const secret = root !== null && isSecretProperty(leaf);
+    if (present && root !== null && container === null)
+      root.supplied.add(name);
     if (!present) {
-      const fallback = secret ? void 0 : defaultOf(property);
+      const fallback = secret ? void 0 : defaultOf(leaf);
       if (fallback !== void 0) {
-        configuration[name] = fallback;
+        walk.leaves += 1;
+        out[name] = fallback;
       } else if (required.has(name)) {
-        issues.push({ field: name, message: "This setting is required." });
+        report(walk, field, "This setting is required.");
       }
       continue;
     }
-    const value = input[name];
-    const before = issues.length;
-    const checked = checkProperty(name, property, value, issues);
-    if (issues.length !== before || checked === void 0)
+    walk.leaves += 1;
+    const collected = [];
+    const checked = checkProperty(field, leaf, raw, collected);
+    if (collected.length > 0 || checked === void 0) {
+      drain(walk, collected);
       continue;
+    }
     if (secret) {
       if (typeof checked === "string" && checked.length > 0)
-        secrets[name] = checked;
-      else if (required.has(name)) {
-        issues.push({ field: name, message: "This setting is required." });
-      }
+        root.secrets[name] = checked;
+      else if (required.has(name))
+        report(walk, field, "This setting is required.");
       continue;
     }
-    configuration[name] = checked;
+    out[name] = checked;
   }
-  issues.push(...crossFieldIssues(schema, supplied, presence));
-  if (issues.length > 0)
-    return { ok: false, issues, partial: configuration };
-  return { ok: true, configuration, secrets };
+  return out;
+}
+function containerDeclaration(property) {
+  if (property.type === "object" && property.properties !== void 0) {
+    return {
+      kind: "object",
+      properties: property.properties,
+      required: property.required,
+      maxItems: 1
+    };
+  }
+  if (property.type === "array" && property.items !== void 0) {
+    const items = property.items;
+    if (items.type !== "object" || items.properties === void 0)
+      return null;
+    return {
+      kind: "array",
+      properties: items.properties,
+      required: items.required,
+      maxItems: property.maxItems ?? 0,
+      minItems: property.minItems,
+      uniqueItems: property.uniqueItems === true
+    };
+  }
+  return null;
+}
+function validateContainer(name, property, children, value, field, walk) {
+  const path = parseConfigurationPath(field);
+  if (children.kind === "object") {
+    if (value === void 0)
+      return void 0;
+    if (!isPlainObject(value)) {
+      report(walk, field, "Expected a group of settings.");
+      return void 0;
+    }
+    const filled = validateObject(children, value, path, walk, null);
+    return Object.keys(filled).length === 0 ? void 0 : filled;
+  }
+  if (value === void 0)
+    return void 0;
+  if (!Array.isArray(value)) {
+    report(walk, field, "Expected a list.");
+    return void 0;
+  }
+  if (value.length > children.maxItems) {
+    report(walk, field, `At most ${children.maxItems} items are allowed.`);
+    return void 0;
+  }
+  if (children.minItems !== void 0 && value.length < children.minItems) {
+    report(walk, field, `At least ${children.minItems} items are required.`);
+    return void 0;
+  }
+  const out = [];
+  for (const [index, element] of value.entries()) {
+    if (walk.leaves >= MAX_CONFIGURATION_VALUE_LEAVES) {
+      report(walk, field, "This configuration has too many values.");
+      break;
+    }
+    if (!isPlainObject(element)) {
+      report(walk, `${field}`, `Item ${index + 1} is not a group of settings.`);
+      continue;
+    }
+    const elementPath = path === null ? null : configurationPath(...pathSegments(path), index);
+    out.push(validateObject(children, element, elementPath, walk, null));
+  }
+  if (children.uniqueItems === true) {
+    const seen = new Set(out.map((entry) => canonicalJson(entry)));
+    if (seen.size !== out.length) {
+      report(walk, field, "Items must be unique.");
+      return void 0;
+    }
+  }
+  return out;
 }
 function crossFieldIssues(schema, supplied, presence) {
   const clauses = Object.entries(schema.dependentRequired ?? {});
   if (clauses.length === 0)
     return [];
-  const alsoPresent = new Set(presence.present ?? []);
+  const alsoPresent = /* @__PURE__ */ new Set([...presence.present ?? [], ...presence.referenced ?? []]);
   const unknown = new Set(presence.unknown ?? []);
   const known = (name) => !unknown.has(name);
   const held = (name) => supplied.has(name) || alsoPresent.has(name);
@@ -12875,12 +13468,17 @@ function matches(pattern, value) {
 var RESOURCE_API_VERSION = "resources.vardeflyt.no/v1";
 var PRODUCT_INSTANCE_KIND = "ProductInstance";
 
+// ../product-configuration/dist/resource-key.js
+var RESOURCE_KEY_PATTERN = /^[a-z][a-z0-9-]{1,61}[a-z0-9]$/;
+var RESOURCE_KEY_RULE = "A resource key is 3\u201363 characters of lowercase letters, digits and hyphens, starting with a letter and ending with a letter or digit.";
+var ResourceKeySchema = external_exports.string().regex(RESOURCE_KEY_PATTERN, RESOURCE_KEY_RULE).describe(RESOURCE_KEY_RULE);
+
 // ../product-configuration/dist/product-instance-example.js
-function resolveExampleChoice(options, selected, declaredDefault) {
+function resolveExampleChoice(options, selected, declaredDefault2) {
   if (selected !== void 0)
     return options.includes(selected) ? { value: selected, issue: null } : { value: null, issue: "invalid" };
-  if (declaredDefault !== void 0 && options.includes(declaredDefault))
-    return { value: declaredDefault, issue: null };
+  if (declaredDefault2 !== void 0 && options.includes(declaredDefault2))
+    return { value: declaredDefault2, issue: null };
   if (options.length === 1)
     return { value: options[0], issue: null };
   return { value: null, issue: options.length === 0 ? "unavailable" : "required" };
@@ -12908,17 +13506,84 @@ function seedConfiguration(configuration) {
         requiredSecrets.push(name);
       continue;
     }
+    const children = containerChildren2(declaration);
+    if (children !== null) {
+      if (!required.has(name))
+        continue;
+      if (children.kind === "object") {
+        values[name] = seedGroup(children, name, open);
+        continue;
+      }
+      const count = children.minItems ?? 0;
+      values[name] = Array.from({ length: count }, () => seedGroup(children, name, open));
+      if (count > 1)
+        dedupeOpen(open);
+      continue;
+    }
     if (declaration.default !== void 0) {
       values[name] = declaration.default;
       continue;
     }
     if (required.has(name)) {
       values[name] = "";
-      open.push({ name, type: declaration.type ?? null });
+      open.push({ name, label: name, type: declaration.type ?? null });
     }
   }
   return { values, open, requiredSecrets, groups };
 }
+function containerChildren2(declaration) {
+  const node = declaration;
+  if (node.type === "object" && node.properties !== void 0) {
+    return {
+      kind: "object",
+      properties: node.properties,
+      required: node.required ?? []
+    };
+  }
+  if (node.type === "array" && node.items !== void 0) {
+    const items = node.items;
+    if (items.type !== "object" || items.properties === void 0)
+      return null;
+    return {
+      kind: "array",
+      properties: items.properties,
+      required: items.required ?? [],
+      ...typeof node.minItems === "number" ? { minItems: node.minItems } : {}
+    };
+  }
+  return null;
+}
+function dedupeOpen(open) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = open.filter((entry) => {
+    if (seen.has(entry.name))
+      return false;
+    seen.add(entry.name);
+    return true;
+  });
+  open.length = 0;
+  open.push(...unique);
+}
+function seedGroup(children, container, open) {
+  const required = new Set(children.required);
+  const values = {};
+  for (const [name, declaration] of Object.entries(children.properties)) {
+    if (declaration.default !== void 0) {
+      values[name] = declaration.default;
+      continue;
+    }
+    if (required.has(name)) {
+      values[name] = "";
+      const path = configurationPath(container, name);
+      open.push({
+        name: path ?? name,
+        label: path === null ? name : printableConfigurationPath(path),
+        type: declaration.type ?? null
+      });
+    }
+  }
+  return values;
+}
 function productInstanceExample(input) {
   return {
     apiVersion: RESOURCE_API_VERSION,
@@ -12937,7 +13602,7 @@ function productInstanceExample(input) {
 }
 function exampleResourceKey(name) {
   const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^[^a-z]+/, "").replace(/-+$/, "").slice(0, 63);
-  return /^[a-z][a-z0-9-]{1,61}[a-z0-9]$/.test(slug) ? slug : "";
+  return RESOURCE_KEY_PATTERN.test(slug) ? slug : "";
 }
 
 // ../platform-schemas/dist/index.js
@@ -13030,13 +13695,32 @@ var OperationStatusSchema = external_exports.enum([
 
 // ../product-contracts/dist/api-version.js
 var PRODUCT_API_VERSION = "products.vardeflyt.no/v1";
+var PRODUCT_API_VERSION_V2 = "products.vardeflyt.no/v2";
+var PARSEABLE_PRODUCT_API_VERSIONS = /* @__PURE__ */ new Set([
+  PRODUCT_API_VERSION,
+  PRODUCT_API_VERSION_V2
+]);
+function supportedList() {
+  return [...PARSEABLE_PRODUCT_API_VERSIONS].map((value) => `"${value}"`).join(" or ");
+}
+function unsupportedProductApiVersionMessage() {
+  return `apiVersion must be ${supportedList()}. An unrecognized contract format is refused rather than ignored.`;
+}
 var PRODUCT_DEFINITION_KIND = "ProductDefinition";
 var DEPLOYMENT_BLUEPRINT_KIND = "DeploymentBlueprint";
 var ProductApiVersionSchema = external_exports.literal(PRODUCT_API_VERSION, {
   errorMap: () => ({
-    message: `apiVersion must be "${PRODUCT_API_VERSION}". An unrecognized contract format is refused rather than ignored.`
+    message: `apiVersion must be ${supportedList()}. An unrecognized contract format is refused rather than ignored.`
   })
 });
+var ProductApiVersionV2Schema = external_exports.literal(PRODUCT_API_VERSION_V2, {
+  errorMap: () => ({
+    message: `apiVersion must be ${supportedList()}. An unrecognized contract format is refused rather than ignored.`
+  })
+});
+var ProductApiVersionAnySchema = external_exports.union([ProductApiVersionSchema, ProductApiVersionV2Schema], {
+  errorMap: () => ({ message: unsupportedProductApiVersionMessage() })
+}).describe("The Product contract format this document is written against.");
 var ResourceApiVersionSchema = external_exports.literal(RESOURCE_API_VERSION, {
   errorMap: () => ({
     message: `apiVersion must be "${RESOURCE_API_VERSION}". An unrecognized contract format is refused rather than ignored.`
@@ -13413,6 +14097,18 @@ var ProductConditionSchema = external_exports.object({
    */
   description: external_exports.string().min(10).max(300)
 }).strict();
+var RequiredWhenSchema = external_exports.object({
+  /** A declared, non-secret customer-configuration property. */
+  property: external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX, "Must name a declared customer-configuration property."),
+  /** The values that make this dependency required. Non-empty. */
+  anyOf: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40)
+}).strict();
+var RequiredWhenV2Schema = external_exports.object({
+  path: external_exports.string().refine((raw) => parseConfigurationPath(raw) !== null, {
+    message: 'A configuration path is a root property name, or an RFC 6901 pointer such as "/assistant/model".'
+  }),
+  anyOf: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40)
+}).strict();
 var ProductDependencySchema = external_exports.object({
   /**
    * OPTIONAL ONLY WHEN `interface` IS PRESENT, enforced below.
@@ -13527,13 +14223,11 @@ var ProductDependencySchema = external_exports.object({
    * `.optional()`, never `.default()` — see the Blueprint's banner on
    * `runtime`. Every dependency published to date carries none.
    */
-  requiredWhen: external_exports.object({
-    /** A declared, non-secret customer-configuration property. */
-    property: external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX, "Must name a declared customer-configuration property."),
-    /** The values that make this dependency required. Non-empty. */
-    anyOf: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40)
-  }).strict().optional()
+  requiredWhen: RequiredWhenSchema.optional()
 }).strict();
+var ProductDependencyV2Schema = ProductDependencySchema.extend({
+  requiredWhen: RequiredWhenV2Schema.optional()
+});
 var ServiceInterfaceProvideSchema = external_exports.object({
   key: ServiceBindingKeySchema,
   interfaceId: ServiceInterfaceIdSchema,
@@ -13670,7 +14364,14 @@ var ProductDefinitionObjectSchema = external_exports.object({
    */
   blueprint: external_exports.object({ version: ContractVersionSchema }).strict()
 }).strict();
-var ProductDefinitionSchema = ProductDefinitionObjectSchema.superRefine((definition, ctx) => {
+var ProductDefinitionSchema = ProductDefinitionObjectSchema.superRefine(checkProductDefinition);
+var ProductDefinitionV2ObjectSchema = ProductDefinitionObjectSchema.extend({
+  apiVersion: ProductApiVersionV2Schema,
+  configuration: CustomerConfigurationV2Schema,
+  dependencies: external_exports.array(ProductDependencyV2Schema).max(8)
+});
+var ProductDefinitionV2Schema = ProductDefinitionV2ObjectSchema.superRefine(checkProductDefinition);
+function checkProductDefinition(definition, ctx) {
   const profileIds = definition.profiles.map((profile) => profile.id);
   const duplicateProfiles = profileIds.filter((id, i) => profileIds.indexOf(id) !== i);
   if (duplicateProfiles.length > 0) {
@@ -13792,42 +14493,55 @@ var ProductDefinitionSchema = ProductDefinitionObjectSchema.superRefine((definit
         message: "Repeated values in `anyOf`."
       });
     }
-    const property = definition.configuration.properties[condition.property];
-    if (property === void 0) {
+    const named = "path" in condition ? condition.path : condition.property;
+    const member = "path" in condition ? "path" : "property";
+    const parsed = parseConfigurationPath(named);
+    const leaf = parsed === null ? null : leafAt(definition.configuration, parsed);
+    if (leaf === null) {
+      const isGroup = parsed !== null && declaresPath(definition.configuration, parsed);
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, member],
+        message: isGroup ? `"${named}" is a group of settings, which holds no single value to compare. Name one setting inside it.` : `"${named}" is not a declared customer configuration property.`
+      });
+      return;
+    }
+    if (leaf.container?.kind === "array") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...at, "property"],
-        message: `"${condition.property}" is not a declared customer configuration property.`
+        path: [...at, member],
+        message: `"${named}" is inside a list, so it names one value per item rather than one value. A condition must name a setting the instance holds exactly once.`
       });
       return;
     }
+    const property = leaf.property;
     if (property.type !== "string") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...at, "property"],
-        message: `"${condition.property}" is a ${property.type} setting; a condition compares string values.`
+        path: [...at, member],
+        message: `"${named}" is a ${property.type} setting; a condition compares string values.`
       });
       return;
     }
-    if (property["x-secret"] === true) {
+    if (isSecretProperty(property)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...at, "property"],
-        message: `"${condition.property}" is a secret. The platform never reads a secret's value, so a condition on one could never be evaluated.`
+        path: [...at, member],
+        message: `"${named}" is a secret. The platform never reads a secret's value, so a condition on one could never be evaluated.`
       });
       return;
     }
     const single = withoutCrossFieldRules({
       ...definition.configuration,
-      properties: { [condition.property]: property },
-      required: [condition.property]
+      properties: { [leaf.name]: property },
+      required: [leaf.name]
     });
-    const outside = condition.anyOf.filter((value) => !validateSubmittedConfiguration(single, { [condition.property]: value }).ok);
+    const outside = condition.anyOf.filter((value) => !validateSubmittedConfiguration(single, { [leaf.name]: value }).ok);
     if (outside.length > 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: [...at, "anyOf"],
-        message: `"${condition.property}" never accepts ${outside.map((v) => `"${v}"`).join(", ")}, so this condition could never make the dependency required.`
+        message: `"${named}" never accepts ${outside.map((v) => `"${v}"`).join(", ")}, so this condition could never make the dependency required.`
       });
     }
   });
@@ -13941,7 +14655,7 @@ var ProductDefinitionSchema = ProductDefinitionObjectSchema.superRefine((definit
       message: 'dataResidency "global" contradicts externalProcessing false \u2014 data cannot be global without leaving the tenant boundary.'
     });
   }
-});
+}
 
 // ../product-contracts/dist/announcements.js
 var ANNOUNCED_PRODUCTS = Object.freeze([
@@ -14131,108 +14845,166 @@ var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
     authentication: external_exports.enum(["signed-request", "mtls"])
   }).strict()
 ]);
+var LiteralEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("literal"),
+  name: EnvVarNameSchema,
+  value: external_exports.string().max(512)
+}).strict();
+var InstanceEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("instance"),
+  name: EnvVarNameSchema,
+  /** Closed set: the Control Plane knows these without Product knowledge. */
+  field: external_exports.enum([
+    "tenantKey",
+    "tenantId",
+    "projectId",
+    "productInstanceId",
+    "instanceKey",
+    "productId",
+    "productVersion",
+    "profile",
+    "region",
+    "environment"
+  ])
+}).strict();
+var PlatformEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("platform"),
+  name: EnvVarNameSchema,
+  key: external_exports.enum(["controlPlaneUrl", "observabilityEndpoint", "logLevel", "serviceVersion"])
+}).strict();
+var ComponentEndpointEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("component-endpoint"),
+  name: EnvVarNameSchema,
+  /** Resolved to the sibling component's private URL at reconcile time. */
+  componentId: ComponentIdSchema
+}).strict();
+var ComponentPublicUrlEnvBindingSchema = external_exports.object({
+  /**
+   * The CUSTOMER-FACING address of a PUBLIC component — the URL a browser
+   * opens, not the in-network one a sibling calls.
+   *
+   * WHY THE PLATFORM HAS TO SUPPLY IT. The address is assigned during
+   * deployment, so nobody knows it earlier: not the publisher, who writes
+   * the contract months before, and not the customer, who would otherwise
+   * be asked to type an address that does not exist yet. A console that
+   * needs its own address — to build an OAuth redirect URI, to put an
+   * absolute link in an email — had no way to learn it, and asking the
+   * customer produced exactly the failure you would expect: an empty
+   * setting and a console nobody can sign in to.
+   *
+   * It is deliberately NOT derivable from the request. A server behind a
+   * proxy infers its bind address, which looks right in development and is
+   * wrong in production; a forwarded Host header is attacker-controlled.
+   * The platform knows the answer, so the platform states it.
+   *
+   * `componentId` may name this component or another, but it must be a
+   * PUBLIC one: `validateProductContracts` refuses a private target, the
+   * same rule `outputs` already carries, because a private endpoint is not
+   * an address to hand out.
+   */
+  source: external_exports.literal("component-public-url"),
+  name: EnvVarNameSchema,
+  componentId: ComponentIdSchema
+}).strict();
+var ServiceBindingAttributeEnvBindingSchema = external_exports.object({
+  /**
+   * A NON-SECRET value from a service binding to ANOTHER Product.
+   *
+   * THE ONLY SOURCE THAT LEAVES THIS PRODUCT INSTANCE. Every other member of
+   * this union resolves inside one deployment: a literal, a fact about this
+   * instance, a sibling component's address, a setting this customer typed.
+   * This one is answered by a different Product Instance, possibly in a
+   * different logical Project, which is why it is the only source whose
+   * value can be absent for a reason that is nobody's mistake.
+   *
+   * ABSENT WHILE THE BINDING IS PENDING, and absent rather than empty. The
+   * variable is left out of the container entirely until the provider
+   * completes the binding, so a Product can tell "not yet" from "set to
+   * nothing" — the same rule `configuration` already follows. Read
+   * `VFAC_SERVICE_BINDING_<KEY>_STATUS`, which the platform injects for
+   * every declared binding, rather than inferring readiness from absence.
+   *
+   * CREDENTIALS DO NOT COME THIS WAY. `field` must name a field the
+   * interface classifies as an attribute; a secret field bound here is
+   * refused by `validateProductContracts()`, and the credential-shaped-name
+   * rule below refuses the variable name independently.
+   */
+  source: external_exports.literal("service-binding-attribute"),
+  name: EnvVarNameSchema,
+  /** The `serviceBindings[].key` this value comes from. */
+  binding: ServiceBindingKeySchema,
+  /** The interface field, e.g. `issuerUrl`. Checked against the registry. */
+  field: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/)
+}).strict();
+var ConfigurationEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("configuration"),
+  name: EnvVarNameSchema,
+  /**
+   * A NON-SECRET customer setting from the Product Definition.
+   * `validateProductContracts()` rejects a reference to an `x-secret`
+   * property — those travel through `secrets[]` and Secret Manager, never
+   * through plain environment wiring.
+   */
+  property: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/)
+}).strict();
 var EnvBindingSchema = external_exports.discriminatedUnion("source", [
+  LiteralEnvBindingSchema,
+  InstanceEnvBindingSchema,
+  PlatformEnvBindingSchema,
+  ComponentEndpointEnvBindingSchema,
+  ComponentPublicUrlEnvBindingSchema,
+  ServiceBindingAttributeEnvBindingSchema,
+  ConfigurationEnvBindingSchema
+]);
+var ConfigurationBindingPathSchema = external_exports.string().refine((raw) => parseConfigurationPath(raw) !== null, {
+  message: 'A configuration path is a root property name, or an RFC 6901 pointer such as "/assistant/model".'
+}).refine((raw) => !/\/\d+(\/|$)/.test(raw), {
+  message: 'A Blueprint binds a DECLARED setting, so a path may not carry a list index. Bind the list with "configuration-json".'
+});
+var EnvBindingV2Schema = external_exports.discriminatedUnion("source", [
+  LiteralEnvBindingSchema,
+  InstanceEnvBindingSchema,
+  PlatformEnvBindingSchema,
+  ComponentEndpointEnvBindingSchema,
+  ComponentPublicUrlEnvBindingSchema,
+  ServiceBindingAttributeEnvBindingSchema,
   external_exports.object({
-    source: external_exports.literal("literal"),
-    name: EnvVarNameSchema,
-    value: external_exports.string().max(512)
-  }).strict(),
-  external_exports.object({
-    source: external_exports.literal("instance"),
-    name: EnvVarNameSchema,
-    /** Closed set: the Control Plane knows these without Product knowledge. */
-    field: external_exports.enum([
-      "tenantKey",
-      "tenantId",
-      "projectId",
-      "productInstanceId",
-      "instanceKey",
-      "productId",
-      "productVersion",
-      "profile",
-      "region",
-      "environment"
-    ])
-  }).strict(),
-  external_exports.object({
-    source: external_exports.literal("platform"),
-    name: EnvVarNameSchema,
-    key: external_exports.enum(["controlPlaneUrl", "observabilityEndpoint", "logLevel", "serviceVersion"])
-  }).strict(),
-  external_exports.object({
-    source: external_exports.literal("component-endpoint"),
+    source: external_exports.literal("configuration"),
     name: EnvVarNameSchema,
-    /** Resolved to the sibling component's private URL at reconcile time. */
-    componentId: ComponentIdSchema
-  }).strict(),
-  external_exports.object({
     /**
-     * The CUSTOMER-FACING address of a PUBLIC component — the URL a browser
-     * opens, not the in-network one a sibling calls.
+     * A NON-SECRET customer setting, named by its canonical path.
      *
-     * WHY THE PLATFORM HAS TO SUPPLY IT. The address is assigned during
-     * deployment, so nobody knows it earlier: not the publisher, who writes
-     * the contract months before, and not the customer, who would otherwise
-     * be asked to type an address that does not exist yet. A console that
-     * needs its own address — to build an OAuth redirect URI, to put an
-     * absolute link in an email — had no way to learn it, and asking the
-     * customer produced exactly the failure you would expect: an empty
-     * setting and a console nobody can sign in to.
-     *
-     * It is deliberately NOT derivable from the request. A server behind a
-     * proxy infers its bind address, which looks right in development and is
-     * wrong in production; a forwarded Host header is attacker-controlled.
-     * The platform knows the answer, so the platform states it.
-     *
-     * `componentId` may name this component or another, but it must be a
-     * PUBLIC one: `validateProductContracts` refuses a private target, the
-     * same rule `outputs` already carries, because a private endpoint is not
-     * an address to hand out.
+     * `validateProductContracts` refuses a path that names no leaf, a path
+     * that names a GROUP — a group has no scalar rendering, and
+     * `configuration-json` is how one is carried — and any `x-secret`
+     * property, which travels through `secrets[]` and never through plain
+     * environment wiring.
      */
-    source: external_exports.literal("component-public-url"),
-    name: EnvVarNameSchema,
-    componentId: ComponentIdSchema
+    path: ConfigurationBindingPathSchema
   }).strict(),
   external_exports.object({
+    source: external_exports.literal("configuration-json"),
+    name: EnvVarNameSchema,
     /**
-     * A NON-SECRET value from a service binding to ANOTHER Product.
+     * THE WHOLE VALIDATED CONFIGURATION, OR ONE SUBTREE OF IT, AS JSON.
      *
-     * THE ONLY SOURCE THAT LEAVES THIS PRODUCT INSTANCE. Every other member of
-     * this union resolves inside one deployment: a literal, a fact about this
-     * instance, a sibling component's address, a setting this customer typed.
-     * This one is answered by a different Product Instance, possibly in a
-     * different logical Project, which is why it is the only source whose
-     * value can be absent for a reason that is nobody's mistake.
+     * WHY THIS EXISTS. A component may carry at most forty environment
+     * bindings, and a nested Product spends one per leaf — so the format that
+     * lets a Product have structure would immediately run out of room to
+     * deliver it. This binds a whole document instead, and the Product's own
+     * runtime translates it into whatever shape it wants. The Control Plane
+     * learns nothing about that shape, which is the point.
      *
-     * ABSENT WHILE THE BINDING IS PENDING, and absent rather than empty. The
-     * variable is left out of the container entirely until the provider
-     * completes the binding, so a Product can tell "not yet" from "set to
-     * nothing" — the same rule `configuration` already follows. Read
-     * `VFAC_SERVICE_BINDING_<KEY>_STATUS`, which the platform injects for
-     * every declared binding, rather than inferring readiness from absence.
+     * WHAT IT CARRIES: validated, non-secret configuration with resolved
+     * ORDINARY resource references materialised in place. Never a secret
+     * value — secrets are root-only and travel through `secrets[]`, and a
+     * subtree cannot contain one. Serialised with `canonicalJson`, so the same
+     * logical configuration is the same bytes and the environment fingerprint
+     * does not move on key order alone.
      *
-     * CREDENTIALS DO NOT COME THIS WAY. `field` must name a field the
-     * interface classifies as an attribute; a secret field bound here is
-     * refused by `validateProductContracts()`, and the credential-shaped-name
-     * rule below refuses the variable name independently.
+     * Absent `path` means the whole document.
      */
-    source: external_exports.literal("service-binding-attribute"),
-    name: EnvVarNameSchema,
-    /** The `serviceBindings[].key` this value comes from. */
-    binding: ServiceBindingKeySchema,
-    /** The interface field, e.g. `issuerUrl`. Checked against the registry. */
-    field: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/)
-  }).strict(),
-  external_exports.object({
-    source: external_exports.literal("configuration"),
-    name: EnvVarNameSchema,
-    /**
-     * A NON-SECRET customer setting from the Product Definition.
-     * `validateProductContracts()` rejects a reference to an `x-secret`
-     * property — those travel through `secrets[]` and Secret Manager, never
-     * through plain environment wiring.
-     */
-    property: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/)
+    path: ConfigurationBindingPathSchema.optional()
   }).strict()
 ]);
 var MAX_BOOTSTRAP_SCRIPT_LENGTH = 32768;
@@ -14444,11 +15216,12 @@ var ComponentDependencySchema = external_exports.object({
   minVersion: ContractVersionSchema.optional(),
   maxVersion: ContractVersionSchema.optional()
 }).strict();
+var MAX_COMPONENT_ENV_BINDINGS = 40;
 var componentCommonShape = {
   id: ComponentIdSchema.describe("Scoped by its Product; does not repeat the Product ID (\xA78)."),
   kind: ComponentKindSchema,
   description: external_exports.string().min(10).max(300),
-  env: external_exports.array(EnvBindingSchema).max(40),
+  env: external_exports.array(EnvBindingSchema).max(MAX_COMPONENT_ENV_BINDINGS),
   dependsOn: external_exports.array(ComponentDependencySchema).max(8)
 };
 var ServerlessContainerComponentSchema = external_exports.object({
@@ -14500,6 +15273,16 @@ var RuntimeComponentSchema = external_exports.discriminatedUnion("runtime", [
   ServerlessContainerComponentSchema,
   VirtualMachineComponentSchema
 ]);
+var ServerlessContainerComponentV2Schema = ServerlessContainerComponentSchema.extend({
+  env: external_exports.array(EnvBindingV2Schema).max(MAX_COMPONENT_ENV_BINDINGS)
+});
+var VirtualMachineComponentV2Schema = VirtualMachineComponentSchema.extend({
+  env: external_exports.array(EnvBindingV2Schema).max(MAX_COMPONENT_ENV_BINDINGS)
+});
+var RuntimeComponentV2Schema = external_exports.discriminatedUnion("runtime", [
+  ServerlessContainerComponentV2Schema,
+  VirtualMachineComponentV2Schema
+]);
 function isVirtualMachineComponent(component) {
   return component.runtime === "virtual-machine";
 }
@@ -14748,7 +15531,47 @@ var BlueprintLifecycleSchema = external_exports.object({
      * the service-interface surface is unchanged. Nothing published to date
      * regresses, and a release cannot strand an instance by forgetting it.
      */
-    directFromVersions: external_exports.array(ContractVersionSchema).max(20).optional()
+    directFromVersions: external_exports.array(ContractVersionSchema).max(20).optional(),
+    /**
+     * How a stored configuration is carried across a release that MOVED a
+     * setting.
+     *
+     * THE CASE THIS EXISTS FOR is a flat Product taking on structure:
+     * `assistantName` becomes `/assistant/name`. Nothing else on this
+     * platform can express that. Without it the target release simply does
+     * not declare `assistantName`, so the upgrade drops the customer's value
+     * and then refuses the deploy for a missing required setting — and the
+     * customer's answer is gone either way.
+     *
+     * `move` AND NOTHING ELSE. A migration the platform cannot fully
+     * evaluate is one it cannot apply safely, and every other operation a
+     * publisher might want — rename a value, split one setting into two,
+     * compute a default — needs the Product's own knowledge of what those
+     * values MEAN. Moving a value is the one thing the platform can do
+     * correctly without knowing anything about it.
+     *
+     * APPLIED AT CUTOVER, in the transaction that writes the new
+     * configuration, and to the REFERENCE ROWS as well as the stored
+     * document — a Resource Reference is identified by the path it answers,
+     * so a setting that moved takes its edge with it or the edge points at
+     * nothing.
+     *
+     * AN ABSENT SOURCE IS A NO-OP, deliberately. A customer who never
+     * answered an optional setting has nothing to carry, and inventing an
+     * empty value for them would turn "not configured" into "configured
+     * blank" — two states this platform keeps apart everywhere else.
+     *
+     * `.optional()`, never `.default([])`, for the reason
+     * `directFromVersions` states one field above: a materialised key makes
+     * a byte-identical republish `RELEASED_CONTRACT_MUTATED`.
+     */
+    configurationMigrations: external_exports.array(external_exports.object({
+      op: external_exports.literal("move"),
+      /** Where the value is today, in the release being left. */
+      from: ConfigurationBindingPathSchema,
+      /** Where this release declares it. */
+      to: ConfigurationBindingPathSchema
+    }).strict()).max(40).optional()
   }).strict(),
   rollback: external_exports.object({
     supported: external_exports.boolean(),
@@ -14874,7 +15697,14 @@ function isOidcClientServiceBinding(binding) {
 }
 var DeploymentBlueprintObjectSchema = external_exports.object({
   /** The CONTRACT FORMAT version — not the Blueprint's. See api-version.ts. */
-  apiVersion: ProductApiVersionSchema,
+  /**
+   * The SHARED base carries either literal; each format pins its own below.
+   *
+   * Nothing parses this object schema directly — `DeploymentBlueprintV1Schema`
+   * and `…V2Schema` extend it — so the permissive literal here is never what a
+   * document is held to, and never what an artifact publishes.
+   */
+  apiVersion: ProductApiVersionAnySchema,
   kind: kindSchema(DEPLOYMENT_BLUEPRINT_KIND),
   productId: ProductIdSchema,
   /** This Blueprint's own version. The Definition pins it exactly. */
@@ -14942,7 +15772,17 @@ var DeploymentBlueprintObjectSchema = external_exports.object({
   outputs: external_exports.array(BlueprintOutputSchema).min(1).max(12),
   lifecycle: BlueprintLifecycleSchema
 }).strict();
-var DeploymentBlueprintSchema = DeploymentBlueprintObjectSchema.superRefine((blueprint, ctx) => {
+var DeploymentBlueprintV1ObjectSchema = DeploymentBlueprintObjectSchema.extend({
+  apiVersion: ProductApiVersionSchema
+});
+var DeploymentBlueprintV2ObjectSchema = DeploymentBlueprintObjectSchema.extend({
+  apiVersion: ProductApiVersionV2Schema,
+  components: external_exports.array(RuntimeComponentV2Schema).min(1).max(MAX_RUNTIME_COMPONENTS)
+});
+var DeploymentBlueprintV1Schema = DeploymentBlueprintV1ObjectSchema.superRefine(checkDeploymentBlueprint);
+var DeploymentBlueprintV2Schema = DeploymentBlueprintV2ObjectSchema.superRefine(checkDeploymentBlueprint);
+var DeploymentBlueprintSchema = DeploymentBlueprintV1Schema;
+function checkDeploymentBlueprint(blueprint, ctx) {
   const componentIds = blueprint.components.map((component) => component.id);
   const knownComponents = new Set(componentIds);
   const publicComponents = new Set(blueprint.components.filter((component) => component.ingress.exposure === "public").map((component) => component.id));
@@ -15043,13 +15883,7 @@ var DeploymentBlueprintSchema = DeploymentBlueprintObjectSchema.superRefine((blu
     });
     const handoff = resource.bootstrap.productHandoff;
     if (handoff !== void 0) {
-      const handoffPath = [
-        "dynamicResources",
-        index,
-        "bootstrap",
-        "productHandoff",
-        "componentId"
-      ];
+      const handoffPath = ["dynamicResources", index, "bootstrap", "productHandoff", "componentId"];
       const target = blueprint.components.find((component) => component.id === handoff.componentId);
       if (target === void 0) {
         ctx.addIssue({
@@ -15660,7 +16494,7 @@ var DeploymentBlueprintSchema = DeploymentBlueprintObjectSchema.superRefine((blu
       });
     }
   }
-});
+}
 
 // ../product-contracts/dist/deployability.js
 var VIRTUAL_MACHINE_PROFILE_INTERFACE = {
@@ -15701,17 +16535,15 @@ function isTerminalAction(action) {
 }
 var ManifestActionSchema = external_exports.enum(MANIFEST_ACTIONS);
 
-// ../product-contracts/dist/resource-key.js
-var ResourceKeySchema = external_exports.string().regex(/^[a-z][a-z0-9-]{1,61}[a-z0-9]$/, "A resource key is 3\u201363 characters of lowercase letters, digits and hyphens, starting with a letter and ending with a letter or digit.");
-
 // ../product-contracts/dist/resource-output-reference.js
+var OUTPUT_KEY_RULE = "Output keys are camelCase.";
 var ResourceOutputReferenceSchema = external_exports.object({
   valueFrom: external_exports.object({
     resourceOutput: external_exports.object({
       /** The producing Resource's `metadata.key`, in the same Project. */
       resourceKey: ResourceKeySchema,
       /** The key of an output that Resource's Product declares. */
-      output: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/, "Output keys are camelCase.")
+      output: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/, OUTPUT_KEY_RULE)
     }).strict()
   }).strict()
 }).strict();
@@ -15869,7 +16701,33 @@ var ProductSubmissionObjectSchema = external_exports.object({
   definition: ProductDefinitionSchema,
   blueprint: DeploymentBlueprintSchema
 }).strict();
-var ProductSubmissionSchema = ProductSubmissionObjectSchema.superRefine((submission, ctx) => {
+var submissionShape = {
+  kind: kindSchema(PRODUCT_SUBMISSION_KIND),
+  submission: SubmissionEnvelopeSchema
+};
+var ProductSubmissionV1ObjectSchema = external_exports.object({
+  apiVersion: ProductApiVersionSchema,
+  ...submissionShape,
+  definition: ProductDefinitionSchema,
+  blueprint: DeploymentBlueprintV1Schema
+}).strict();
+var ProductSubmissionV2ObjectSchema = external_exports.object({
+  apiVersion: ProductApiVersionV2Schema,
+  ...submissionShape,
+  definition: ProductDefinitionV2Schema,
+  blueprint: DeploymentBlueprintV2Schema
+}).strict();
+var ProductSubmissionV1Schema = ProductSubmissionV1ObjectSchema.superRefine(checkProductSubmission);
+var ProductSubmissionV2Schema = ProductSubmissionV2ObjectSchema.superRefine(checkProductSubmission);
+var ProductSubmissionSchema = ProductSubmissionV1Schema;
+function checkProductSubmission(submission, ctx) {
+  if (submission.definition.apiVersion !== submission.apiVersion) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["definition", "apiVersion"],
+      message: `This submission is written against "${submission.apiVersion}" but its Product Definition declares "${submission.definition.apiVersion}". One submission is one contract format.`
+    });
+  }
   if (submission.definition.id !== submission.submission.productId) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -15891,7 +16749,7 @@ var ProductSubmissionSchema = ProductSubmissionObjectSchema.superRefine((submiss
       message: `The Product Definition is version "${submission.definition.version}" but the submission claims "${submission.submission.version}". They must be the same version.`
     });
   }
-});
+}
 var PUBLISH_RULE_ANNEX = {
   allOf: [
     {
@@ -16327,6 +17185,16 @@ async function runDoctor(parsed) {
   const json = parsed.flags["output"] === "json";
   const checks = [{ name: "CLI", ok: true, detail: `vfac ${cliVersion()}` }];
   const stored = readStored();
+  const salvaged2 = salvagedConfigPath();
+  if (salvaged2 !== null) {
+    checks.push({
+      name: "Config",
+      ok: true,
+      note: true,
+      detail: `the previous config could not be read and was kept at ${salvaged2}. What this command reports below is a fresh one \u2014 the endpoint and Project it held are gone until you set them again. Delete the kept file once you have; it may hold a stale session.`,
+      facts: { salvagedConfigPath: salvaged2 }
+    });
+  }
   const resolved = resolveEndpoint(parsed.flags["endpoint"], stored);
   if (!resolved) {
     checks.push({
@@ -16334,32 +17202,41 @@ async function runDoctor(parsed) {
       ok: false,
       detail: "not set. Run `vfac context set --endpoint https://your-organization.cloud.vardeflyt.no`, or set VFAC_ENDPOINT."
     });
-    return report(checks, json);
+    return report2(checks, json);
   }
   const checked = validateEndpoint(resolved.value, resolved.source);
   if (!checked.ok) {
     checks.push({ name: "Endpoint", ok: false, detail: checked.message });
-    return report(checks, json);
+    return report2(checks, json);
   }
   const endpoint = checked.endpoint;
   checks.push({
     name: "Endpoint",
     ok: true,
-    detail: `${endpoint}   (from ${resolved.source})`
+    detail: `${endpoint}   (from ${resolved.source})`,
+    facts: { endpoint, source: resolved.source }
+  });
+  const selected = stored.context?.projectId ?? null;
+  checks.push({
+    name: "Project",
+    ok: true,
+    note: selected === null,
+    detail: selected === null ? "none selected. Commands need `--project prj_\u2026`, or run `vfac context set --project prj_\u2026` once. This is not a fault \u2014 it is what a pipeline that names the Project per command looks like \u2014 but it is NOT the same thing as which Projects your credential reaches." : `${selected}   (selected in this context; which Projects the credential reaches is a separate question)`,
+    facts: { selectedProjectId: selected }
   });
   const probe = await probeMachineApi({ endpoint });
   if (!probe.ok) {
     checks.push({ name: "Machine API", ok: false, detail: probe.message });
-    return report(checks, json);
+    return report2(checks, json);
   }
   checks.push({ name: "Machine API", ok: true, detail: probe.apiVersion });
   const compatible = compatibility(cliVersion(), probe.minimumCliVersion);
   checks.push(compatible);
-  if (!compatible.ok) return report(checks, json);
+  if (!compatible.ok) return report2(checks, json);
   const signedIn = await signIn({ endpoint });
   if (!signedIn.ok) {
     checks.push({ name: "Context Gate", ok: false, detail: signedIn.message });
-    return report(checks, json);
+    return report2(checks, json);
   }
   checks.push({
     name: "Context Gate",
@@ -16380,7 +17257,7 @@ async function runDoctor(parsed) {
       ok: false,
       detail: who.error.status === 404 ? "this Tenant Portal does not serve /api/v1/whoami yet \u2014 it is running an older build." : who.error.message
     });
-    return report(checks, json);
+    return report2(checks, json);
   }
   const access = who.data.access;
   const projects = access.projects.map((project) => project.projectId);
@@ -16391,7 +17268,8 @@ async function runDoctor(parsed) {
     access.tenantWide ? {
       name: "Access",
       ok: true,
-      detail: `the whole organization \u2014 ${access.tenantPermissions.join(", ")}`
+      detail: `the whole organization \u2014 ${access.tenantPermissions.join(", ")}`,
+      facts: { scope: "organization", grantedProjectIds: null }
     } : projects.length === 0 ? {
       // A FAILURE, NOT A NOTE. This credential authenticates and can do
       // nothing at all — and the check said so in words while `report`
@@ -16421,6 +17299,14 @@ async function runDoctor(parsed) {
       // believes it can deploy and is then refused reports a platform
       // defect, which is precisely the outcome the guide now tells it not
       // to reach for. Scope and role are two questions; this answers both.
+      facts: {
+        scope: "projects",
+        // THE GRANT, and the name says which of the two questions it
+        // answers. A reader gating on `doctor --output json` had no way
+        // to tell this list from the selected Project; now the field
+        // names are the difference.
+        grantedProjectIds: projects.join(",")
+      },
       detail: `${projects.join(", ")} \u2014 and nothing organization-wide. ` + (mutating.length > 0 ? "You can deploy in those Projects, read their catalogue, and list them. " : "Read-only there: catalogue, manifests, resources and operations. An apply or a lifecycle command is refused, and that is what was granted rather than a fault. ") + "Anything ACROSS the organization \u2014 a Project you hold nothing in, or its members \u2014 is refused."
     }
   );
@@ -16431,7 +17317,7 @@ async function runDoctor(parsed) {
     detail: "run `vfac guide` for the platform's own instructions, written for a machine"
   });
   checks.push(await updateAvailable(cliVersion()));
-  return report(checks, json);
+  return report2(checks, json);
 }
 function compatibility(local, declared) {
   const name = "Compatibility";
@@ -16511,7 +17397,7 @@ async function updateAvailable(local) {
     facts
   };
 }
-function report(checks, json) {
+function report2(checks, json) {
   const failed = checks.filter((check) => !check.ok);
   if (json) {
     process.stdout.write(`${JSON.stringify({ ok: failed.length === 0, checks })}
@@ -16887,16 +17773,14 @@ function renderProduct(product) {
     (profile) => `${profile.id}${profile.default ? " (default)" : ""}`
   );
   lines.push(`  profile         ${profiles.join(", ") || "(none declared)"}`);
-  const properties = product.configuration?.properties ?? {};
-  const required = product.configuration?.required ?? [];
-  if (required.length > 0) {
+  const seed = seedConfiguration(product.configuration);
+  if (seed.open.length > 0 || seed.requiredSecrets.length > 0) {
     lines.push("", "  Required configuration");
-    for (const name of required) {
-      const property = properties[name];
-      const secret = property?.writeOnly === true || property?.["x-secret"] === true;
-      lines.push(
-        `    ${name}${secret ? "  (secret \u2014 pass --secret " + name + "=env:VAR)" : `  ${property?.type ?? ""}`}`
-      );
+    for (const name of seed.requiredSecrets) {
+      lines.push(`    ${name}  (secret \u2014 pass --secret ${name}=env:VAR)`);
+    }
+    for (const setting of seed.open) {
+      lines.push(`    ${setting.label}  ${setting.type ?? ""}`.trimEnd());
     }
   }
   const needed = (product.dependencies ?? []).filter((dependency) => dependency.required);
@@ -17129,9 +18013,7 @@ async function runManifestInit(parsed) {
   const notes = [];
   const key = parsed.flags["key"] ?? exampleResourceKey(name);
   if (!key) {
-    notes.push(
-      "metadata.key     \u2014 a stable identity, 3 to 63 characters, lower case. Required before apply"
-    );
+    notes.push(`metadata.key     \u2014 a stable identity, required before apply. ${RESOURCE_KEY_RULE}`);
   }
   const chooseable = (product.dependencies ?? []).filter(
     (dependency) => dependency.interface?.cardinality === "tenant-multiple"
@@ -17171,7 +18053,7 @@ async function runManifestInit(parsed) {
   }
   for (const setting of seed.open) {
     notes.push(
-      `spec.configuration.${setting.name}  \u2014 required${setting.type ? ` (${setting.type})` : ""}`
+      `spec.configuration.${setting.label}  \u2014 required${setting.type ? ` (${setting.type})` : ""}`
     );
   }
   for (const group of seed.groups) {
@@ -17260,6 +18142,8 @@ Run \`vfac get product-instance pri_\u2026\` to see which ones this credential m
   if (command === "delete" && !parsed.booleans.has("yes")) {
     process.stderr.write(
       `delete removes ${instanceId} and everything it is serving. This cannot be undone.
+If it was deployed from a manifest, its \`metadata.key\` stays claimed: a replacement
+needs a different key, and re-applying the same file will answer GONE.
 Re-run with --yes to confirm:  vfac lifecycle delete ${instanceId} --yes
 Or suspend it instead, which stops it and keeps it: \`vfac lifecycle suspend\`.
 `