@varde-flyt/vfac 0.7.1 → 0.9.0

package/dist/vfac.mjs

@@ -11988,12 +11988,26 @@ var coerce = {
 };
 var NEVER = INVALID;
 
+// ../product-configuration/dist/configuration-bounds.js
+var MAX_CONFIGURATION_DEPTH = 6;
+var MAX_CONFIGURATION_LEAVES = 256;
+var MAX_CONFIGURATION_NODES = 512;
+var MAX_CONFIGURATION_CHILDREN = 64;
+var MAX_CONFIGURATION_VALUE_LEAVES = 1e3;
+var MAX_CONFIGURATION_ISSUES = 50;
+var MAX_CONFIGURATION_VALUE_BYTES = 16384;
+
 // ../product-configuration/dist/json-schema-annex.js
 var ANNEXES = /* @__PURE__ */ new WeakMap();
 function withJsonSchemaAnnex(schema, annex) {
   ANNEXES.set(schema, annex);
   return schema;
 }
+var DEFINITION_NAMES = /* @__PURE__ */ new WeakMap();
+function withJsonSchemaDefinition(schema, name) {
+  DEFINITION_NAMES.set(schema, name);
+  return schema;
+}
 
 // ../product-configuration/dist/infrastructure-vocabulary.js
 function tokenizeIdentifier(identifier) {
@@ -12211,7 +12225,20 @@ var ConfigurationGroupSchema = external_exports.enum([
 var CONFIGURATION_PROPERTY_NAME_REGEX = /^[a-z][a-zA-Z0-9]{1,47}$/;
 var PropertyNameSchema = external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX, "Configuration property names must be camelCase, start with a lowercase letter, and be 2\u201348 characters.");
 var TitleSchema = external_exports.string().min(2).max(80).describe("Customer-facing field label.");
-var HelpTextSchema = external_exports.string().min(10).max(400).describe("Customer-facing explanation. Required for security-sensitive choices.");
+var V1_LEAF_BOUNDS = {
+  help: 400,
+  enumValues: 40,
+  stringLength: 4096,
+  defaultLength: 400
+};
+var V2_LEAF_BOUNDS = {
+  help: 2e3,
+  enumValues: 256,
+  stringLength: 16384,
+  defaultLength: 2e3
+};
+var MAX_DECLARABLE_STRING_LENGTH = V2_LEAF_BOUNDS.stringLength;
+var helpTextSchema = (bounds) => external_exports.string().min(10).max(bounds.help).describe("Customer-facing explanation. Required for security-sensitive choices.");
 var SECRET_COUPLING_ANNEX = {
   allOf: [
     {
@@ -12230,69 +12257,156 @@ var SECRET_COUPLING_ANNEX = {
     }
   ]
 };
-var StringPropertySchema = external_exports.object({
-  type: external_exports.literal("string"),
-  title: TitleSchema,
-  description: HelpTextSchema.optional(),
-  group: ConfigurationGroupSchema,
-  enum: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40).optional(),
-  minLength: external_exports.number().int().min(0).max(4096).optional(),
-  /**
-   * Required unless the value is constrained by `enum`. An unbounded string
-   * reaching the Control Plane as desired state is an unbounded write.
-   */
-  maxLength: external_exports.number().int().min(1).max(4096).optional(),
-  pattern: external_exports.string().min(1).max(200).optional(),
-  default: external_exports.string().max(400).optional(),
-  /**
-   * docs/PRODUCT_DEFINITION_GUIDE.md "Secrets": secret input is marked
-   * write-only AND secret. Both flags, and the refinement below makes one
-   * without the other a validation error.
-   */
-  writeOnly: external_exports.boolean().optional(),
-  "x-secret": external_exports.boolean().optional()
-}).strict();
-withJsonSchemaAnnex(StringPropertySchema, SECRET_COUPLING_ANNEX);
-var NumberPropertySchema = external_exports.object({
-  type: external_exports.enum(["integer", "number"]),
-  title: TitleSchema,
-  description: HelpTextSchema.optional(),
-  group: ConfigurationGroupSchema,
-  /** Both bounds required — "numeric limits" in the guide is not optional. */
-  minimum: external_exports.number(),
-  maximum: external_exports.number(),
-  default: external_exports.number().optional()
-}).strict();
-var BooleanPropertySchema = external_exports.object({
-  type: external_exports.literal("boolean"),
-  title: TitleSchema,
-  description: HelpTextSchema.optional(),
-  group: ConfigurationGroupSchema,
-  default: external_exports.boolean().optional()
-}).strict();
-var ArrayItemsSchema = external_exports.object({
-  type: external_exports.literal("string"),
-  enum: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40).optional(),
-  maxLength: external_exports.number().int().min(1).max(400).optional()
-}).strict();
-var ArrayPropertySchema = external_exports.object({
-  type: external_exports.literal("array"),
-  title: TitleSchema,
-  description: HelpTextSchema.optional(),
-  group: ConfigurationGroupSchema,
-  items: ArrayItemsSchema,
-  minItems: external_exports.number().int().min(0).max(100).optional(),
-  /** Required: an unbounded list is an unbounded write. */
-  maxItems: external_exports.number().int().min(1).max(100),
-  uniqueItems: external_exports.boolean().optional(),
-  default: external_exports.array(external_exports.string().max(200)).max(100).optional()
-}).strict();
+function leafShapes(bounds) {
+  const help = helpTextSchema(bounds);
+  const enumMembers = external_exports.array(external_exports.string().min(1).max(80)).min(1).max(bounds.enumValues).optional();
+  const string = external_exports.object({
+    type: external_exports.literal("string"),
+    title: TitleSchema,
+    description: help.optional(),
+    group: ConfigurationGroupSchema,
+    enum: enumMembers,
+    minLength: external_exports.number().int().min(0).max(bounds.stringLength).optional(),
+    /**
+     * Required unless the value is constrained by `enum`. An unbounded string
+     * reaching the Control Plane as desired state is an unbounded write.
+     */
+    maxLength: external_exports.number().int().min(1).max(bounds.stringLength).optional(),
+    pattern: external_exports.string().min(1).max(200).optional(),
+    default: external_exports.string().max(bounds.defaultLength).optional(),
+    /**
+     * docs/PRODUCT_DEFINITION_GUIDE.md "Secrets": secret input is marked
+     * write-only AND secret. Both flags, and the refinement below makes one
+     * without the other a validation error.
+     */
+    writeOnly: external_exports.boolean().optional(),
+    "x-secret": external_exports.boolean().optional()
+  }).strict();
+  withJsonSchemaAnnex(string, SECRET_COUPLING_ANNEX);
+  const number = external_exports.object({
+    type: external_exports.enum(["integer", "number"]),
+    title: TitleSchema,
+    description: help.optional(),
+    group: ConfigurationGroupSchema,
+    /** Both bounds required — "numeric limits" in the guide is not optional. */
+    minimum: external_exports.number(),
+    maximum: external_exports.number(),
+    default: external_exports.number().optional()
+  }).strict();
+  const boolean = external_exports.object({
+    type: external_exports.literal("boolean"),
+    title: TitleSchema,
+    description: help.optional(),
+    group: ConfigurationGroupSchema,
+    default: external_exports.boolean().optional()
+  }).strict();
+  const items = external_exports.object({
+    type: external_exports.literal("string"),
+    enum: enumMembers,
+    maxLength: external_exports.number().int().min(1).max(bounds.defaultLength).optional()
+  }).strict();
+  const array = external_exports.object({
+    type: external_exports.literal("array"),
+    title: TitleSchema,
+    description: help.optional(),
+    group: ConfigurationGroupSchema,
+    items,
+    minItems: external_exports.number().int().min(0).max(100).optional(),
+    /** Required: an unbounded list is an unbounded write. */
+    maxItems: external_exports.number().int().min(1).max(100),
+    uniqueItems: external_exports.boolean().optional(),
+    default: external_exports.array(external_exports.string().max(200)).max(100).optional()
+  }).strict();
+  return { string, number, boolean, items, array };
+}
+var V1_LEAVES = leafShapes(V1_LEAF_BOUNDS);
+var V2_LEAVES = leafShapes(V2_LEAF_BOUNDS);
+var StringPropertySchema = V1_LEAVES.string;
+var NumberPropertySchema = V1_LEAVES.number;
+var BooleanPropertySchema = V1_LEAVES.boolean;
+var ArrayPropertySchema = V1_LEAVES.array;
+var MAX_CONFIGURATION_PROPERTIES = 40;
 var ConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
   StringPropertySchema,
   NumberPropertySchema,
   BooleanPropertySchema,
   ArrayPropertySchema
 ]);
+var NestedStringPropertySchema = V2_LEAVES.string.omit({ "x-secret": true, writeOnly: true }).extend({ group: ConfigurationGroupSchema.optional() });
+var V2_NESTED_LEAVES = {
+  string: NestedStringPropertySchema,
+  number: V2_LEAVES.number.extend({ group: ConfigurationGroupSchema.optional() }),
+  boolean: V2_LEAVES.boolean.extend({ group: ConfigurationGroupSchema.optional() }),
+  array: V2_LEAVES.array.extend({ group: ConfigurationGroupSchema.optional() }),
+  items: V2_LEAVES.items
+};
+function childBagShape(child) {
+  return {
+    properties: external_exports.record(PropertyNameSchema, child),
+    required: external_exports.array(PropertyNameSchema).max(MAX_CONFIGURATION_CHILDREN).optional(),
+    /**
+     * All-or-none rules, scoped to THIS container.
+     *
+     * ON THE CONTAINER, NEVER AS ROOT CLAUSES NAMING PATHS. The published key
+     * promises that "a publisher running an off-the-shelf validator over that
+     * file must get the answer the platform gives", and JSON Schema 2020-12
+     * scopes `dependentRequired` to the object that CARRIES it. A root clause
+     * naming `/upstream/token` would be a rule no standard validator applies —
+     * the one thing this key may not become. Written here it keeps exactly the
+     * meaning it has everywhere else, and the generated artifact carries it on
+     * the right node.
+     *
+     * A REPEATABLE GROUP GETS ONE PER ROW, which is the honest reading: "if this
+     * server has a URL it needs a token" is a fact about a server, not about the
+     * list.
+     */
+    dependentRequired: external_exports.record(PropertyNameSchema, external_exports.array(PropertyNameSchema).min(1).max(MAX_CONFIGURATION_CHILDREN)).optional().describe("Settings inside this group that must be supplied together."),
+    additionalProperties: external_exports.literal(false)
+  };
+}
+function propertyUnion(levelsBelow, leafSet) {
+  const leaves = [leafSet.string, leafSet.number, leafSet.boolean];
+  if (levelsBelow <= 0) {
+    return [...leaves, leafSet.array];
+  }
+  const level = MAX_CONFIGURATION_DEPTH - levelsBelow + 1;
+  const child = withJsonSchemaDefinition(external_exports.discriminatedUnion("type", propertyUnion(levelsBelow - 1, V2_NESTED_LEAVES)), `configurationPropertyLevel${level}`);
+  const bag = childBagShape(child);
+  const groupItems = external_exports.object({ type: external_exports.literal("object"), ...bag }).strict();
+  return [
+    ...leaves,
+    // ONE `array` BRANCH, NOT TWO, because a discriminated union may not carry
+    // two options with the same discriminator value ("duplicate value array" —
+    // zod refuses it at construction). The item shape is the inner
+    // discriminator, which is also what keeps a v1 document's
+    // `items: {type: 'string'}` reading exactly as it always did.
+    leafSet.array.extend({
+      items: external_exports.discriminatedUnion("type", [V2_LEAVES.items, groupItems])
+    }),
+    /**
+     * A group of related settings.
+     *
+     * NO `default`. A container cannot carry one, structurally — `.strict()`
+     * refuses the key — and that removes a whole class of question rather than
+     * answering it: what a whole-subtree default means when the customer
+     * supplied half of it, how it interacts with `dependentRequired`'s
+     * load-bearing "a defaulted setting is never absent", and what
+     * `seedConfiguration` should write into a served example and a file on
+     * disk. Defaults are a LEAF concept here.
+     */
+    external_exports.object({
+      type: external_exports.literal("object"),
+      title: TitleSchema,
+      description: helpTextSchema(V2_LEAF_BOUNDS).optional(),
+      // INHERITED BELOW THE ROOT, for the reason `V2_NESTED_LEAVES` states: a
+      // group is a bucket for a whole subtree, and repeating it is the only
+      // value that could be written.
+      group: levelsBelow === MAX_CONFIGURATION_DEPTH - 1 ? ConfigurationGroupSchema : ConfigurationGroupSchema.optional(),
+      ...bag
+    }).strict()
+  ];
+}
+var RootConfigurationPropertySchema = external_exports.discriminatedUnion("type", propertyUnion(MAX_CONFIGURATION_DEPTH - 1, V2_LEAVES));
 var CustomerConfigurationObjectSchema = external_exports.object({
   type: external_exports.literal("object"),
   properties: external_exports.record(PropertyNameSchema, ConfigurationPropertySchema).describe("Customer-editable settings, keyed by camelCase property name."),
@@ -12326,7 +12440,6 @@ var CustomerConfigurationObjectSchema = external_exports.object({
    */
   additionalProperties: external_exports.literal(false)
 }).strict();
-var MAX_CONFIGURATION_PROPERTIES = 40;
 var CustomerConfigurationSchema = CustomerConfigurationObjectSchema.superRefine((config, ctx) => {
   const names = Object.keys(config.properties);
   if (names.length > MAX_CONFIGURATION_PROPERTIES) {
@@ -12338,195 +12451,205 @@ var CustomerConfigurationSchema = CustomerConfigurationObjectSchema.superRefine(
   }
   for (const name of names) {
     const property = config.properties[name];
-    const path = ["properties", name];
-    const infrastructure = infrastructureVocabularyViolation(name);
-    if (infrastructure) {
+    checkDeclaredProperty(name, property, ["properties", name], ctx, true);
+  }
+  for (const name of config.required ?? []) {
+    if (!Object.hasOwn(config.properties, name)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path,
-        message: `${infrastructure}. Customer settings describe outcomes, not infrastructure.`
+        path: ["required"],
+        message: `"${name}" is listed as required but is not a declared property.`
       });
     }
+  }
+  const duplicates = (config.required ?? []).filter((name, index, all) => all.indexOf(name) !== index);
+  if (duplicates.length > 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["required"],
+      message: `Duplicate required entries: ${[...new Set(duplicates)].join(", ")}.`
+    });
+  }
+  checkDependentRequired(config, ctx);
+});
+function checkDeclaredProperty(name, property, path, ctx, atRoot) {
+  const infrastructure = infrastructureVocabularyViolation(name);
+  if (infrastructure) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path,
+      message: `${infrastructure}. Customer settings describe outcomes, not infrastructure.`
+    });
+  }
+  if (atRoot) {
     const platformOwned = platformOwnedFieldViolation(name);
     if (platformOwned) {
       ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path, message: `${platformOwned}.` });
     }
-    for (const [label, values] of enumerableValues(property)) {
-      for (const value of values) {
-        const violation = infrastructureValueViolation(value);
-        if (violation) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: [...path, label],
-            message: `${violation}. Customer settings offer outcomes, not infrastructure sizes.`
-          });
-        }
-      }
-    }
-    if (property.type === "string") {
-      const secret = property["x-secret"] === true;
-      const credential = credentialNameViolation(name);
-      if (credential && !secret) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `${credential} and must be declared "x-secret": true with "writeOnly": true, or renamed if it is not one.`
-        });
-      }
-      if (secret && property.writeOnly !== true) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" is marked x-secret but not writeOnly \u2014 a read API could echo the value.`
-        });
-      }
-      if (property.writeOnly === true && !secret) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" is marked writeOnly but not x-secret \u2014 the value would not be routed to the secret flow.`
-        });
-      }
-      if (secret && property.default !== void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "default"],
-          message: `"${name}" is a secret and must not declare a default value.`
-        });
-      }
-      if (secret && property.enum !== void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "enum"],
-          message: `"${name}" is a secret; an enum would enumerate candidate secret values.`
-        });
-      }
-      if (property.enum === void 0 && property.maxLength === void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" must declare either an enum or a maxLength.`
-        });
-      }
-      if (property.enum !== void 0 && property.default !== void 0 && !property.enum.includes(property.default)) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "default"],
-          message: `"${name}" declares a default outside its enum.`
-        });
-      }
-      if (property.minLength !== void 0 && property.maxLength !== void 0 && property.minLength > property.maxLength) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" has minLength greater than maxLength.`
-        });
-      }
-      if (property.default !== void 0 && property.maxLength !== void 0 && property.default.length > property.maxLength) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "default"],
-          message: `"${name}" declares a default longer than its own maxLength.`
-        });
-      }
-      if (property.pattern !== void 0 && !isSafeRegex(property.pattern)) {
+  }
+  for (const [label, values] of enumerableValues(property)) {
+    for (const value of values) {
+      const violation = infrastructureValueViolation(value);
+      if (violation) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: [...path, "pattern"],
-          message: `"${name}" declares a pattern that is not a valid regular expression.`
+          path: [...path, label],
+          message: `${violation}. Customer settings offer outcomes, not infrastructure sizes.`
         });
       }
     }
-    if (property.type === "integer" || property.type === "number") {
-      if (property.minimum > property.maximum) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" has minimum greater than maximum.`
-        });
-      }
-      if (property.default !== void 0 && (property.default < property.minimum || property.default > property.maximum)) {
+  }
+  if (property.type === "string") {
+    const secret = property["x-secret"] === true;
+    const credential = credentialNameViolation(name);
+    if (credential && !secret) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        // THE REMEDIATION HAS TO BE ONE THE CONTRACT ALLOWS. At the root, the
+        // answer is to declare the two markers. Below it, that answer is
+        // IMPOSSIBLE — the nested shape omits both keys and `.strict()` refuses
+        // them — so telling a publisher to add them sends them to write a
+        // second invalid document, and an agent following the validator loops.
+        // A validator's errors are part of the agent-facing contract.
+        message: atRoot ? `${credential} and must be declared "x-secret": true with "writeOnly": true, or renamed if it is not one.` : `${credential}, and a credential must be a TOP-LEVEL setting in this contract format \u2014 move it out of the group and declare it "x-secret": true with "writeOnly": true, or rename it if it is not one.`
+      });
+    }
+    if (secret && property.writeOnly !== true) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" is marked x-secret but not writeOnly \u2014 a read API could echo the value.`
+      });
+    }
+    if (property.writeOnly === true && !secret) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" is marked writeOnly but not x-secret \u2014 the value would not be routed to the secret flow.`
+      });
+    }
+    if (secret && property.default !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" is a secret and must not declare a default value.`
+      });
+    }
+    if (secret && property.enum !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "enum"],
+        message: `"${name}" is a secret; an enum would enumerate candidate secret values.`
+      });
+    }
+    if (property.enum === void 0 && property.maxLength === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" must declare either an enum or a maxLength.`
+      });
+    }
+    if (property.enum !== void 0 && property.default !== void 0 && !property.enum.includes(property.default)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" declares a default outside its enum.`
+      });
+    }
+    if (property.minLength !== void 0 && property.maxLength !== void 0 && property.minLength > property.maxLength) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" has minLength greater than maxLength.`
+      });
+    }
+    if (property.default !== void 0 && property.maxLength !== void 0 && property.default.length > property.maxLength) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" declares a default longer than its own maxLength.`
+      });
+    }
+    if (property.pattern !== void 0 && !isSafeRegex(property.pattern)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "pattern"],
+        message: `"${name}" declares a pattern that is not a valid regular expression.`
+      });
+    }
+  }
+  if (property.type === "integer" || property.type === "number") {
+    if (property.minimum > property.maximum) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" has minimum greater than maximum.`
+      });
+    }
+    if (property.default !== void 0 && (property.default < property.minimum || property.default > property.maximum)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" declares a default outside its minimum/maximum range.`
+      });
+    }
+    if (property.type === "integer" && !Number.isInteger(property.default ?? 0)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "default"],
+        message: `"${name}" is an integer but declares a fractional default.`
+      });
+    }
+  }
+  if (property.type === "array") {
+    const allowed = property.items.enum;
+    if (allowed === void 0 && property.items.maxLength === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "items"],
+        message: `"${name}" items must declare either an enum or a maxLength.`
+      });
+    }
+    if (property.minItems !== void 0 && property.minItems > property.maxItems) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path,
+        message: `"${name}" has minItems greater than maxItems.`
+      });
+    }
+    if (property.default !== void 0) {
+      if (property.default.length > property.maxItems) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
           path: [...path, "default"],
-          message: `"${name}" declares a default outside its minimum/maximum range.`
+          message: `"${name}" declares a default longer than maxItems.`
         });
       }
-      if (property.type === "integer" && !Number.isInteger(property.default ?? 0)) {
+      const outside = allowed ? property.default.filter((value) => !allowed.includes(value)) : [];
+      if (outside.length > 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
           path: [...path, "default"],
-          message: `"${name}" is an integer but declares a fractional default.`
-        });
-      }
-    }
-    if (property.type === "array") {
-      const allowed = property.items.enum;
-      if (allowed === void 0 && property.items.maxLength === void 0) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "items"],
-          message: `"${name}" items must declare either an enum or a maxLength.`
-        });
-      }
-      if (property.minItems !== void 0 && property.minItems > property.maxItems) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path,
-          message: `"${name}" has minItems greater than maxItems.`
+          message: `"${name}" declares default values outside its items enum: ${outside.join(", ")}.`
         });
       }
-      if (property.default !== void 0) {
-        if (property.default.length > property.maxItems) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: [...path, "default"],
-            message: `"${name}" declares a default longer than maxItems.`
-          });
-        }
-        const outside = allowed ? property.default.filter((value) => !allowed.includes(value)) : [];
-        if (outside.length > 0) {
-          ctx.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: [...path, "default"],
-            message: `"${name}" declares default values outside its items enum: ${outside.join(", ")}.`
-          });
-        }
-      }
     }
   }
-  for (const name of config.required ?? []) {
-    if (!Object.hasOwn(config.properties, name)) {
-      ctx.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["required"],
-        message: `"${name}" is listed as required but is not a declared property.`
-      });
-    }
-  }
-  const duplicates = (config.required ?? []).filter((name, index, all) => all.indexOf(name) !== index);
-  if (duplicates.length > 0) {
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["required"],
-      message: `Duplicate required entries: ${[...new Set(duplicates)].join(", ")}.`
-    });
-  }
-  checkDependentRequired(config, ctx);
-});
-function checkDependentRequired(config, ctx) {
+}
+function checkDependentRequired(config, ctx, at = []) {
   const clauses = Object.entries(config.dependentRequired ?? {});
   if (clauses.length === 0)
     return;
   if (clauses.length > MAX_CONFIGURATION_PROPERTIES) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
-      path: ["dependentRequired"],
+      path: [...at, "dependentRequired"],
       message: `A Product may declare at most ${MAX_CONFIGURATION_PROPERTIES} dependent-required groups; found ${clauses.length}.`
     });
   }
   for (const [trigger, dependents] of clauses) {
-    const path = ["dependentRequired", trigger];
+    const path = [...at, "dependentRequired", trigger];
     const declaredTrigger = config.properties[trigger];
     if (declaredTrigger === void 0) {
       ctx.addIssue({
@@ -12635,42 +12758,424 @@ function checkOneSecretPerGroup(config, ctx) {
     });
   }
 }
-function enumerableValues(property) {
-  const out = [];
-  if (property.type === "string") {
-    if (property.enum)
-      out.push(["enum", property.enum]);
-    if (property.default !== void 0)
-      out.push(["default", [property.default]]);
+var CustomerConfigurationV2ObjectSchema = external_exports.object({
+  type: external_exports.literal("object"),
+  properties: external_exports.record(PropertyNameSchema, RootConfigurationPropertySchema).describe("Customer-editable settings, keyed by camelCase property name."),
+  required: external_exports.array(PropertyNameSchema).max(MAX_CONFIGURATION_CHILDREN).optional(),
+  /**
+   * ROOT PROPERTIES ONLY, in v2.0.
+   *
+   * The published key promises that "a publisher running an off-the-shelf
+   * validator over that file must get the answer the platform gives", and
+   * JSON Schema 2020-12 `dependentRequired` is scoped to the object that
+   * carries it. A clause naming a nested leaf would be a rule no standard
+   * validator applies, which is the one thing this key may not become. A
+   * nested object may not carry its own clause either — that is expressible
+   * and honest, and it is deliberately left for when something needs it.
+   */
+  dependentRequired: external_exports.record(PropertyNameSchema, external_exports.array(PropertyNameSchema).min(1).max(MAX_CONFIGURATION_CHILDREN)).optional().describe("Settings that must be supplied together, keyed by the triggering property."),
+  additionalProperties: external_exports.literal(false)
+}).strict();
+function countNodes(property) {
+  const children = childrenOf(property);
+  if (children === null)
+    return { leaves: 1, nodes: 1, instantiated: 1 };
+  let leaves = 0;
+  let nodes = 1;
+  let instantiated = 0;
+  for (const child of Object.values(children.properties)) {
+    const inner = countNodes(child);
+    leaves += inner.leaves;
+    nodes += inner.nodes;
+    instantiated += inner.instantiated;
+  }
+  if (property.type === "array")
+    instantiated *= property.maxItems;
+  return { leaves, nodes, instantiated };
+}
+function childrenOf(property) {
+  if (property.type === "object")
+    return property;
+  if (property.type === "array" && property.items.type === "object")
+    return property.items;
+  return null;
+}
+function minimumConfigurationBytes(config) {
+  return minimumGroupBytes(config.properties, config.required ?? []);
+}
+function minimumGroupBytes(properties, required) {
+  const names = new Set(required);
+  let total = 2;
+  for (const [name, property] of Object.entries(properties)) {
+    const isContainer = childrenOf(property) !== null;
+    if (isContainer ? !names.has(name) : !names.has(name) && declaredLeafDefault(property) === void 0) {
+      continue;
+    }
+    total += name.length + 3 + minimumPropertyBytes(property);
+  }
+  return total;
+}
+function minimumPropertyBytes(property) {
+  const children = childrenOf(property);
+  if (children !== null) {
+    const inner = minimumGroupBytes(children.properties, children.required ?? []);
+    return property.type === "array" ? 2 + (property.minItems ?? 0) * inner : inner;
+  }
+  switch (property.type) {
+    case "string": {
+      const shortestEnum = property.enum?.reduce((a, b) => a.length <= b.length ? a : b);
+      const shortest = shortestEnum?.length ?? Math.max(property.minLength ?? 0, 1);
+      return shortest + 2;
+    }
+    case "integer":
+    case "number":
+      return 1;
+    case "boolean":
+      return 4;
+    case "array":
+      return 2 + (property.minItems ?? 0) * 3;
+    case "object":
+      return 2;
+  }
+}
+function declaredLeafDefault(property) {
+  return property.type === "object" ? void 0 : property.default;
+}
+function checkPropertyDeclaration(name, property, path, ctx, atRoot) {
+  const children = childrenOf(property);
+  if (children === null) {
+    checkDeclaredProperty(name, property, path, ctx, atRoot);
+    return;
+  }
+  const infrastructure = infrastructureVocabularyViolation(name);
+  if (infrastructure) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path,
+      message: `${infrastructure}. Customer settings describe outcomes, not infrastructure.`
+    });
+  }
+  if (atRoot) {
+    const platformOwned = platformOwnedFieldViolation(name);
+    if (platformOwned) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path, message: `${platformOwned}.` });
+    }
+  }
+  const childNames = Object.keys(children.properties);
+  if (childNames.length === 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [...path, "properties"],
+      message: `"${name}" declares no settings. A group with nothing in it renders as an empty section.`
+    });
+  }
+  if (childNames.length > MAX_CONFIGURATION_CHILDREN) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [...path, "properties"],
+      message: `"${name}" may declare at most ${MAX_CONFIGURATION_CHILDREN} settings; found ${childNames.length}.`
+    });
+  }
+  if (property.type === "array" && property.default !== void 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [...path, "default"],
+      message: `"${name}" is a list of groups and cannot declare a default. Declare defaults on the settings inside it.`
+    });
+  }
+  if (property.type === "array" && property.minItems !== void 0 && property.minItems > property.maxItems) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path,
+      message: `"${name}" has minItems greater than maxItems.`
+    });
+  }
+  for (const childName of childNames) {
+    checkPropertyDeclaration(childName, children.properties[childName], [...path, "properties", childName], ctx, false);
+  }
+  for (const required of children.required ?? []) {
+    if (!Object.hasOwn(children.properties, required)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "required"],
+        message: `"${required}" is listed as required in "${name}" but is not one of its settings.`
+      });
+    }
+  }
+  const scoped = children;
+  if (scoped.dependentRequired !== void 0) {
+    checkDependentRequired(
+      { properties: children.properties, dependentRequired: scoped.dependentRequired },
+      ctx,
+      // An ARRAY's children live under `items`, which is where the key it
+      // constrains actually sits in the document.
+      property.type === "array" ? [...path, "items"] : path
+    );
+  }
+}
+var CustomerConfigurationV2Schema = CustomerConfigurationV2ObjectSchema.superRefine((config, ctx) => {
+  const names = Object.keys(config.properties);
+  if (names.length > MAX_CONFIGURATION_CHILDREN) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `A Product may declare at most ${MAX_CONFIGURATION_CHILDREN} root settings; found ${names.length}. Group them, or declare fewer.`
+    });
+  }
+  let leaves = 0;
+  let nodes = 0;
+  let instantiated = 0;
+  for (const name of names) {
+    const property = config.properties[name];
+    const path = ["properties", name];
+    const counted = countNodes(property);
+    leaves += counted.leaves;
+    nodes += counted.nodes;
+    instantiated += counted.instantiated;
+    checkPropertyDeclaration(name, property, path, ctx, true);
+  }
+  if (leaves > MAX_CONFIGURATION_LEAVES) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `A Product may declare at most ${MAX_CONFIGURATION_LEAVES} customer settings in total; found ${leaves}.`
+    });
+  }
+  if (nodes > MAX_CONFIGURATION_NODES) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `A Product may declare at most ${MAX_CONFIGURATION_NODES} configuration nodes; found ${nodes}.`
+    });
+  }
+  if (instantiated > MAX_CONFIGURATION_VALUE_LEAVES) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `This Product's settings could expand to ${instantiated} values. A list instantiates everything inside it once per item, so lists inside lists MULTIPLY. At most ${MAX_CONFIGURATION_VALUE_LEAVES} are allowed; reduce maxItems on the lists, or the number of settings inside them.`
+    });
+  }
+  for (const name of config.required ?? []) {
+    if (!Object.hasOwn(config.properties, name)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["required"],
+        message: `"${name}" is listed as required but is not a declared property.`
+      });
+    }
+  }
+  const floor = minimumConfigurationBytes(config);
+  if (floor > MAX_CONFIGURATION_VALUE_BYTES) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["properties"],
+      message: `The smallest configuration that could satisfy this Product is at least ${floor} bytes, and the limit is ${MAX_CONFIGURATION_VALUE_BYTES}. No customer could deploy it \u2014 reduce the required settings, their minimum lengths, or a list's minItems.`
+    });
+  }
+  checkDependentRequired(config, ctx);
+  checkOneSecretPerGroup(config, ctx);
+});
+function enumerableValues(property) {
+  const out = [];
+  if (property.type === "string") {
+    if (property.enum)
+      out.push(["enum", property.enum]);
+    if (property.default !== void 0)
+      out.push(["default", [property.default]]);
+  }
+  if (property.type === "array") {
+    if (property.items.enum)
+      out.push(["items", property.items.enum]);
+    if (property.default)
+      out.push(["default", property.default]);
+  }
+  return out;
+}
+function isSafeRegex(pattern) {
+  try {
+    new RegExp(pattern);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isSecretProperty(property) {
+  return property.type === "string" && property["x-secret"] === true;
+}
+
+// ../product-configuration/dist/configuration-path.js
+var MAX_CONFIGURATION_PATH_SEGMENTS = 2 * MAX_CONFIGURATION_DEPTH - 1;
+function isIndexSegment(raw) {
+  return /^\d+$/.test(raw) && String(Number(raw)) === raw;
+}
+function isPathSegment(segment) {
+  if (typeof segment === "number")
+    return Number.isInteger(segment) && segment >= 0;
+  return CONFIGURATION_PROPERTY_NAME_REGEX.test(segment) || isIndexSegment(segment);
+}
+function configurationPath(...segments) {
+  if (segments.length === 0 || segments.length > MAX_CONFIGURATION_PATH_SEGMENTS)
+    return null;
+  if (!segments.every(isPathSegment))
+    return null;
+  if (typeof segments[0] === "number" || isIndexSegment(String(segments[0])))
+    return null;
+  if (segments.length === 1)
+    return String(segments[0]);
+  return `/${segments.map(String).join("/")}`;
+}
+function parseConfigurationPath(raw) {
+  if (typeof raw !== "string" || raw.length === 0)
+    return null;
+  if (!raw.startsWith("/"))
+    return configurationPath(raw);
+  const segments = raw.slice(1).split("/");
+  if (segments.length < 2)
+    return null;
+  return configurationPath(...segments);
+}
+function pathSegments(path) {
+  const raw = path.startsWith("/") ? path.slice(1).split("/") : [path];
+  return raw.map((segment) => isIndexSegment(segment) ? Number(segment) : segment);
+}
+function declarationPathOf(path) {
+  const segments = pathSegments(path).filter((segment) => typeof segment !== "number");
+  return configurationPath(...segments) ?? path;
+}
+function printableConfigurationPath(path) {
+  return pathSegments(path).join(".");
+}
+
+// ../product-configuration/dist/canonical-json.js
+function canonicalise(value, path) {
+  if (value === null)
+    return "null";
+  if (typeof value === "string")
+    return JSON.stringify(value);
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`canonicalJson: non-finite number at ${path}`);
+    }
+    return JSON.stringify(value === 0 ? 0 : value);
+  }
+  if (typeof value !== "object") {
+    throw new Error(`canonicalJson: ${typeof value} is not JSON at ${path}`);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item, i) => canonicalise(item, `${path}[${i}]`)).join(",")}]`;
+  }
+  const entries = Object.entries(value);
+  for (const [key, item] of entries) {
+    if (item === void 0) {
+      throw new Error(`canonicalJson: undefined property at ${path}.${key}`);
+    }
+  }
+  const sorted = entries.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  const body = sorted.map(([key, item]) => `${JSON.stringify(key)}:${canonicalise(item, `${path}.${key}`)}`).join(",");
+  return `{${body}}`;
+}
+function canonicalJson(value) {
+  return canonicalise(value, "$");
+}
+
+// ../product-configuration/dist/configuration-tree.js
+function underList(node) {
+  return node.containers.some((container) => container.kind === "array");
+}
+function containerChildren(property) {
+  if (property.type === "object" && property.properties !== void 0) {
+    return {
+      kind: "object",
+      properties: property.properties,
+      required: property.required ?? []
+    };
   }
-  if (property.type === "array") {
-    if (property.items.enum)
-      out.push(["items", property.items.enum]);
-    if (property.default)
-      out.push(["default", property.default]);
+  if (property.type === "array" && property.items !== void 0) {
+    const items = property.items;
+    if (items.type !== "object" || items.properties === void 0)
+      return null;
+    return {
+      kind: "array",
+      properties: items.properties,
+      required: items.required ?? []
+    };
   }
+  return null;
+}
+function isConfigurationContainer(property) {
+  return containerChildren(property) !== null;
+}
+function configurationLeaves(schema) {
+  const out = [];
+  walkDeclarations(schema.properties, [], [], (leaf) => out.push(leaf));
   return out;
 }
-function isSafeRegex(pattern) {
-  try {
-    new RegExp(pattern);
-    return true;
-  } catch {
-    return false;
+function configurationContainers(schema) {
+  const out = [];
+  walkDeclarations(schema.properties, [], [], () => {
+  }, (container) => out.push(container));
+  return out;
+}
+function walkDeclarations(properties, ancestors, base, onLeaf, onContainer = () => {
+}) {
+  for (const [name, property] of Object.entries(properties)) {
+    const segments = [...base, name];
+    const path = configurationPath(...segments);
+    if (path === null)
+      continue;
+    const children = containerChildren(property);
+    if (children === null) {
+      onLeaf({ path, name, property, containers: ancestors });
+      continue;
+    }
+    const container = {
+      path,
+      name,
+      kind: children.kind,
+      property,
+      required: children.required,
+      containers: ancestors
+    };
+    onContainer(container);
+    walkDeclarations(children.properties, [...ancestors, container], segments, onLeaf, onContainer);
   }
 }
+function leafAt(schema, path) {
+  const declaration = declarationPathOf(path);
+  return configurationLeaves(schema).find((leaf) => leaf.path === declaration) ?? null;
+}
+function declaresPath(schema, path) {
+  if (leafAt(schema, path) !== null)
+    return true;
+  return configurationContainers(schema).some((container) => container.path === declarationPathOf(path));
+}
 
 // ../product-configuration/dist/customer-configuration-input.js
-var ABSOLUTE_MAX_STRING = 8192;
+var ABSOLUTE_MAX_STRING = MAX_DECLARABLE_STRING_LENGTH;
 var MAX_REPORTED_UNDECLARED_KEYS = 10;
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isSecretProperty(property) {
-  return property.type === "string" && property["x-secret"] === true;
+function report(walk, field, message) {
+  if (walk.issues.length >= MAX_CONFIGURATION_ISSUES) {
+    walk.suppressed += 1;
+    return;
+  }
+  walk.issues.push({ field, message });
+}
+function drain(walk, collected) {
+  for (const issue of collected)
+    report(walk, issue.field, issue.message);
 }
 function validateSubmittedConfiguration(schema, submitted, presence = {}) {
-  const issues = [];
+  const walk = {
+    issues: [],
+    suppressed: 0,
+    leaves: 0,
+    referenced: new Set(presence.referenced ?? [])
+  };
   const supplied = /* @__PURE__ */ new Set();
   if (submitted !== void 0 && submitted !== null && !isPlainObject(submitted)) {
     return {
@@ -12680,64 +13185,211 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
     };
   }
   const input = isPlainObject(submitted) ? submitted : {};
-  const undeclared = Object.keys(input).filter((name) => !Object.hasOwn(schema.properties, name));
-  for (const name of undeclared.slice(0, MAX_REPORTED_UNDECLARED_KEYS)) {
-    issues.push({
-      field: CONFIGURATION_PROPERTY_NAME_REGEX.test(name) ? name : "",
-      message: "This Product does not declare a setting with that name."
-    });
-  }
-  if (undeclared.length > MAX_REPORTED_UNDECLARED_KEYS) {
-    issues.push({
+  const secrets = {};
+  const configuration = validateObject({ properties: schema.properties, required: schema.required }, input, null, walk, { secrets, supplied });
+  drain(walk, crossFieldIssues(schema, supplied, presence));
+  if (walk.suppressed > 0) {
+    walk.issues.push({
       field: "",
-      // A COUNT, never the names. The count is the actionable part and it
-      // cannot carry anything the caller chose.
-      message: `${undeclared.length - MAX_REPORTED_UNDECLARED_KEYS} further settings are not declared by this Product.`
+      message: `${walk.suppressed} further problems were found and are not listed.`
     });
   }
-  const required = new Set(schema.required ?? []);
-  const configuration = {};
-  const secrets = {};
-  for (const [name, property] of Object.entries(schema.properties)) {
-    const blank = typeof input[name] === "string" && input[name].trim().length === 0;
-    const present = Object.hasOwn(input, name) && input[name] !== void 0 && !blank;
-    const secret = isSecretProperty(property);
-    if (present)
-      supplied.add(name);
+  if (declaresContainer(schema)) {
+    const size = utf8ByteLength(JSON.stringify(configuration));
+    if (size > MAX_CONFIGURATION_VALUE_BYTES) {
+      report(walk, "", `This configuration is ${size} bytes once defaults are applied, and the limit is ${MAX_CONFIGURATION_VALUE_BYTES}. Remove some items.`);
+    }
+  }
+  if (walk.issues.length > 0)
+    return { ok: false, issues: walk.issues, partial: configuration };
+  return { ok: true, configuration, secrets };
+}
+function utf8ByteLength(value) {
+  return new TextEncoder().encode(value).length;
+}
+function declaresContainer(schema) {
+  return Object.values(schema.properties).some((property) => isConfigurationContainer(property));
+}
+function containsReferenced(walk, container) {
+  if (walk.referenced.size === 0)
+    return false;
+  const parsedOuter = parseConfigurationPath(container);
+  if (parsedOuter === null)
+    return false;
+  const outer = pathSegments(parsedOuter);
+  for (const candidate of walk.referenced) {
+    const parsed = parseConfigurationPath(candidate);
+    if (parsed === null)
+      continue;
+    const inner = pathSegments(parsed);
+    if (inner.length <= outer.length)
+      continue;
+    if (outer.every((segment, index) => inner[index] === segment))
+      return true;
+  }
+  return false;
+}
+function validateObject(declaration, input, container, walk, root) {
+  const required = new Set(declaration.required ?? []);
+  const out = {};
+  const fieldFor = (name) => {
+    const path = container === null ? configurationPath(name) : configurationPath(...pathSegments(container), name);
+    return path ?? "";
+  };
+  const undeclared = Object.keys(input).filter((name) => !Object.hasOwn(declaration.properties, name));
+  for (const name of undeclared.slice(0, MAX_REPORTED_UNDECLARED_KEYS)) {
+    report(walk, fieldFor(name), "This Product does not declare a setting with that name.");
+  }
+  if (undeclared.length > MAX_REPORTED_UNDECLARED_KEYS) {
+    report(walk, container === null ? "" : container, `${undeclared.length - MAX_REPORTED_UNDECLARED_KEYS} further settings are not declared by this Product.`);
+  }
+  for (const [name, property] of Object.entries(declaration.properties)) {
+    const field = fieldFor(name);
+    const children = containerDeclaration(property);
+    if (children !== null) {
+      const value = input[name];
+      const filled = validateContainer(name, property, children, value, field, walk);
+      if (filled !== void 0)
+        out[name] = filled;
+      else if (required.has(name) && !containsReferenced(walk, field))
+        report(walk, field, "This setting is required.");
+      continue;
+    }
+    const leaf = property;
+    if (walk.referenced.has(field)) {
+      const sent = input[name];
+      if (Object.hasOwn(input, name) && sent !== void 0) {
+        report(walk, field, "This setting is answered by another Resource, so it cannot also be set here.");
+      }
+      continue;
+    }
+    const raw = input[name];
+    const blank = typeof raw === "string" && raw.trim().length === 0;
+    const present = Object.hasOwn(input, name) && raw !== void 0 && !blank;
+    const secret = root !== null && isSecretProperty(leaf);
+    if (present && root !== null && container === null)
+      root.supplied.add(name);
     if (!present) {
-      const fallback = secret ? void 0 : defaultOf(property);
+      const fallback = secret ? void 0 : defaultOf(leaf);
       if (fallback !== void 0) {
-        configuration[name] = fallback;
+        walk.leaves += 1;
+        out[name] = fallback;
       } else if (required.has(name)) {
-        issues.push({ field: name, message: "This setting is required." });
+        report(walk, field, "This setting is required.");
       }
       continue;
     }
-    const value = input[name];
-    const before = issues.length;
-    const checked = checkProperty(name, property, value, issues);
-    if (issues.length !== before || checked === void 0)
+    walk.leaves += 1;
+    const collected = [];
+    const checked = checkProperty(field, leaf, raw, collected);
+    if (collected.length > 0 || checked === void 0) {
+      drain(walk, collected);
       continue;
+    }
     if (secret) {
       if (typeof checked === "string" && checked.length > 0)
-        secrets[name] = checked;
-      else if (required.has(name)) {
-        issues.push({ field: name, message: "This setting is required." });
+        root.secrets[name] = checked;
+      else if (required.has(name))
+        report(walk, field, "This setting is required.");
+      continue;
+    }
+    out[name] = checked;
+  }
+  if (declaration.dependentRequired !== void 0) {
+    const suppliedHere = new Set(Object.keys(out));
+    for (const [trigger, dependents] of Object.entries(declaration.dependentRequired)) {
+      if (!suppliedHere.has(trigger) && !containsReferenced(walk, fieldFor(trigger)))
+        continue;
+      for (const dependent of dependents) {
+        if (suppliedHere.has(dependent) || containsReferenced(walk, fieldFor(dependent)))
+          continue;
+        report(walk, fieldFor(dependent), `This setting is required when ${labelOf(declaration, trigger)} is configured.`);
       }
+    }
+  }
+  return out;
+}
+function containerDeclaration(property) {
+  if (property.type === "object" && property.properties !== void 0) {
+    return {
+      kind: "object",
+      properties: property.properties,
+      required: property.required,
+      // CARRIED THROUGH, or the rule the container declares is one the walk
+      // never sees — it publishes cleanly and enforces nothing.
+      dependentRequired: property.dependentRequired,
+      maxItems: 1
+    };
+  }
+  if (property.type === "array" && property.items !== void 0) {
+    const items = property.items;
+    if (items.type !== "object" || items.properties === void 0)
+      return null;
+    return {
+      kind: "array",
+      properties: items.properties,
+      required: items.required,
+      dependentRequired: items.dependentRequired,
+      maxItems: property.maxItems ?? 0,
+      minItems: property.minItems,
+      uniqueItems: property.uniqueItems === true
+    };
+  }
+  return null;
+}
+function validateContainer(name, property, children, value, field, walk) {
+  const path = parseConfigurationPath(field);
+  if (children.kind === "object") {
+    if (value === void 0)
+      return void 0;
+    if (!isPlainObject(value)) {
+      report(walk, field, "Expected a group of settings.");
+      return void 0;
+    }
+    const filled = validateObject(children, value, path, walk, null);
+    return Object.keys(filled).length === 0 ? void 0 : filled;
+  }
+  if (value === void 0)
+    return void 0;
+  if (!Array.isArray(value)) {
+    report(walk, field, "Expected a list.");
+    return void 0;
+  }
+  if (value.length > children.maxItems) {
+    report(walk, field, `At most ${children.maxItems} items are allowed.`);
+    return void 0;
+  }
+  if (children.minItems !== void 0 && value.length < children.minItems) {
+    report(walk, field, `At least ${children.minItems} items are required.`);
+    return void 0;
+  }
+  const out = [];
+  for (const [index, element] of value.entries()) {
+    if (walk.leaves >= MAX_CONFIGURATION_VALUE_LEAVES) {
+      report(walk, field, "This configuration has too many values.");
+      break;
+    }
+    if (!isPlainObject(element)) {
+      report(walk, `${field}`, `Item ${index + 1} is not a group of settings.`);
       continue;
     }
-    configuration[name] = checked;
+    const elementPath = path === null ? null : configurationPath(...pathSegments(path), index);
+    out.push(validateObject(children, element, elementPath, walk, null));
   }
-  issues.push(...crossFieldIssues(schema, supplied, presence));
-  if (issues.length > 0)
-    return { ok: false, issues, partial: configuration };
-  return { ok: true, configuration, secrets };
+  if (children.uniqueItems === true) {
+    const seen = new Set(out.map((entry) => canonicalJson(entry)));
+    if (seen.size !== out.length) {
+      report(walk, field, "Items must be unique.");
+      return void 0;
+    }
+  }
+  return out;
 }
 function crossFieldIssues(schema, supplied, presence) {
   const clauses = Object.entries(schema.dependentRequired ?? {});
   if (clauses.length === 0)
     return [];
-  const alsoPresent = new Set(presence.present ?? []);
+  const alsoPresent = /* @__PURE__ */ new Set([...presence.present ?? [], ...presence.referenced ?? []]);
   const unknown = new Set(presence.unknown ?? []);
   const known = (name) => !unknown.has(name);
   const held = (name) => supplied.has(name) || alsoPresent.has(name);
@@ -12762,7 +13414,7 @@ function crossFieldIssues(schema, supplied, presence) {
 }
 function labelOf(schema, name) {
   const property = schema.properties[name];
-  return property === void 0 ? `"${name}"` : `"${property.title}"`;
+  return property?.title === void 0 ? `"${name}"` : `"${property.title}"`;
 }
 function withoutCrossFieldRules(schema) {
   if (schema.dependentRequired === void 0)
@@ -12905,11 +13557,11 @@ var RESOURCE_KEY_RULE = "A resource key is 3\u201363 characters of lowercase let
 var ResourceKeySchema = external_exports.string().regex(RESOURCE_KEY_PATTERN, RESOURCE_KEY_RULE).describe(RESOURCE_KEY_RULE);
 
 // ../product-configuration/dist/product-instance-example.js
-function resolveExampleChoice(options, selected, declaredDefault) {
+function resolveExampleChoice(options, selected, declaredDefault2) {
   if (selected !== void 0)
     return options.includes(selected) ? { value: selected, issue: null } : { value: null, issue: "invalid" };
-  if (declaredDefault !== void 0 && options.includes(declaredDefault))
-    return { value: declaredDefault, issue: null };
+  if (declaredDefault2 !== void 0 && options.includes(declaredDefault2))
+    return { value: declaredDefault2, issue: null };
   if (options.length === 1)
     return { value: options[0], issue: null };
   return { value: null, issue: options.length === 0 ? "unavailable" : "required" };
@@ -12920,7 +13572,6 @@ function isSecret(declaration) {
 function seedConfiguration(configuration) {
   const properties = configuration?.properties ?? {};
   const required = new Set(configuration?.required ?? []);
-  const values = {};
   const open = [];
   const requiredSecrets = [];
   const groups = Object.entries(configuration?.dependentRequired ?? {}).map(([trigger, dependents]) => {
@@ -12931,22 +13582,81 @@ function seedConfiguration(configuration) {
       secrets: members.filter((name) => isSecret(properties[name] ?? {}))
     };
   }).sort((a, b) => a.trigger.localeCompare(b.trigger));
+  const values = seedProperties(properties, required, [], open, requiredSecrets);
+  return { values, open, requiredSecrets, groups };
+}
+function seedProperties(properties, required, ancestors, open, requiredSecrets) {
+  const values = {};
   for (const [name, declaration] of Object.entries(properties)) {
-    if (isSecret(declaration)) {
+    if (requiredSecrets !== null && isSecret(declaration)) {
       if (required.has(name))
         requiredSecrets.push(name);
       continue;
     }
+    const children = containerChildren2(declaration);
+    if (children !== null) {
+      if (!required.has(name))
+        continue;
+      const childRequired = new Set(children.required);
+      const inner = [...ancestors, name];
+      if (children.kind === "object") {
+        values[name] = seedProperties(children.properties, childRequired, inner, open, null);
+        continue;
+      }
+      const count = children.minItems ?? 0;
+      values[name] = Array.from({ length: count }, () => seedProperties(children.properties, childRequired, inner, open, null));
+      if (count > 1)
+        dedupeOpen(open);
+      continue;
+    }
     if (declaration.default !== void 0) {
       values[name] = declaration.default;
       continue;
     }
     if (required.has(name)) {
       values[name] = "";
-      open.push({ name, type: declaration.type ?? null });
+      const path = configurationPath(...ancestors, name);
+      open.push({
+        name: path ?? name,
+        label: path === null ? name : printableConfigurationPath(path),
+        type: declaration.type ?? null
+      });
     }
   }
-  return { values, open, requiredSecrets, groups };
+  return values;
+}
+function containerChildren2(declaration) {
+  const node = declaration;
+  if (node.type === "object" && node.properties !== void 0) {
+    return {
+      kind: "object",
+      properties: node.properties,
+      required: node.required ?? []
+    };
+  }
+  if (node.type === "array" && node.items !== void 0) {
+    const items = node.items;
+    if (items.type !== "object" || items.properties === void 0)
+      return null;
+    return {
+      kind: "array",
+      properties: items.properties,
+      required: items.required ?? [],
+      ...typeof node.minItems === "number" ? { minItems: node.minItems } : {}
+    };
+  }
+  return null;
+}
+function dedupeOpen(open) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = open.filter((entry) => {
+    if (seen.has(entry.name))
+      return false;
+    seen.add(entry.name);
+    return true;
+  });
+  open.length = 0;
+  open.push(...unique);
 }
 function productInstanceExample(input) {
   return {
@@ -13059,13 +13769,32 @@ var OperationStatusSchema = external_exports.enum([
 
 // ../product-contracts/dist/api-version.js
 var PRODUCT_API_VERSION = "products.vardeflyt.no/v1";
+var PRODUCT_API_VERSION_V2 = "products.vardeflyt.no/v2";
+var PARSEABLE_PRODUCT_API_VERSIONS = /* @__PURE__ */ new Set([
+  PRODUCT_API_VERSION,
+  PRODUCT_API_VERSION_V2
+]);
+function supportedList() {
+  return [...PARSEABLE_PRODUCT_API_VERSIONS].map((value) => `"${value}"`).join(" or ");
+}
+function unsupportedProductApiVersionMessage() {
+  return `apiVersion must be ${supportedList()}. An unrecognized contract format is refused rather than ignored.`;
+}
 var PRODUCT_DEFINITION_KIND = "ProductDefinition";
 var DEPLOYMENT_BLUEPRINT_KIND = "DeploymentBlueprint";
 var ProductApiVersionSchema = external_exports.literal(PRODUCT_API_VERSION, {
   errorMap: () => ({
-    message: `apiVersion must be "${PRODUCT_API_VERSION}". An unrecognized contract format is refused rather than ignored.`
+    message: `apiVersion must be ${supportedList()}. An unrecognized contract format is refused rather than ignored.`
   })
 });
+var ProductApiVersionV2Schema = external_exports.literal(PRODUCT_API_VERSION_V2, {
+  errorMap: () => ({
+    message: `apiVersion must be ${supportedList()}. An unrecognized contract format is refused rather than ignored.`
+  })
+});
+var ProductApiVersionAnySchema = external_exports.union([ProductApiVersionSchema, ProductApiVersionV2Schema], {
+  errorMap: () => ({ message: unsupportedProductApiVersionMessage() })
+}).describe("The Product contract format this document is written against.");
 var ResourceApiVersionSchema = external_exports.literal(RESOURCE_API_VERSION, {
   errorMap: () => ({
     message: `apiVersion must be "${RESOURCE_API_VERSION}". An unrecognized contract format is refused rather than ignored.`
@@ -13442,6 +14171,18 @@ var ProductConditionSchema = external_exports.object({
    */
   description: external_exports.string().min(10).max(300)
 }).strict();
+var RequiredWhenSchema = external_exports.object({
+  /** A declared, non-secret customer-configuration property. */
+  property: external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX, "Must name a declared customer-configuration property."),
+  /** The values that make this dependency required. Non-empty. */
+  anyOf: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40)
+}).strict();
+var RequiredWhenV2Schema = external_exports.object({
+  path: external_exports.string().refine((raw) => parseConfigurationPath(raw) !== null, {
+    message: 'A configuration path is a root property name, or an RFC 6901 pointer such as "/assistant/model".'
+  }),
+  anyOf: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40)
+}).strict();
 var ProductDependencySchema = external_exports.object({
   /**
    * OPTIONAL ONLY WHEN `interface` IS PRESENT, enforced below.
@@ -13556,13 +14297,11 @@ var ProductDependencySchema = external_exports.object({
    * `.optional()`, never `.default()` — see the Blueprint's banner on
    * `runtime`. Every dependency published to date carries none.
    */
-  requiredWhen: external_exports.object({
-    /** A declared, non-secret customer-configuration property. */
-    property: external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX, "Must name a declared customer-configuration property."),
-    /** The values that make this dependency required. Non-empty. */
-    anyOf: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40)
-  }).strict().optional()
+  requiredWhen: RequiredWhenSchema.optional()
 }).strict();
+var ProductDependencyV2Schema = ProductDependencySchema.extend({
+  requiredWhen: RequiredWhenV2Schema.optional()
+});
 var ServiceInterfaceProvideSchema = external_exports.object({
   key: ServiceBindingKeySchema,
   interfaceId: ServiceInterfaceIdSchema,
@@ -13699,7 +14438,14 @@ var ProductDefinitionObjectSchema = external_exports.object({
    */
   blueprint: external_exports.object({ version: ContractVersionSchema }).strict()
 }).strict();
-var ProductDefinitionSchema = ProductDefinitionObjectSchema.superRefine((definition, ctx) => {
+var ProductDefinitionSchema = ProductDefinitionObjectSchema.superRefine(checkProductDefinition);
+var ProductDefinitionV2ObjectSchema = ProductDefinitionObjectSchema.extend({
+  apiVersion: ProductApiVersionV2Schema,
+  configuration: CustomerConfigurationV2Schema,
+  dependencies: external_exports.array(ProductDependencyV2Schema).max(8)
+});
+var ProductDefinitionV2Schema = ProductDefinitionV2ObjectSchema.superRefine(checkProductDefinition);
+function checkProductDefinition(definition, ctx) {
   const profileIds = definition.profiles.map((profile) => profile.id);
   const duplicateProfiles = profileIds.filter((id, i) => profileIds.indexOf(id) !== i);
   if (duplicateProfiles.length > 0) {
@@ -13821,42 +14567,55 @@ var ProductDefinitionSchema = ProductDefinitionObjectSchema.superRefine((definit
         message: "Repeated values in `anyOf`."
       });
     }
-    const property = definition.configuration.properties[condition.property];
-    if (property === void 0) {
+    const named = "path" in condition ? condition.path : condition.property;
+    const member = "path" in condition ? "path" : "property";
+    const parsed = parseConfigurationPath(named);
+    const leaf = parsed === null ? null : leafAt(definition.configuration, parsed);
+    if (leaf === null) {
+      const isGroup = parsed !== null && declaresPath(definition.configuration, parsed);
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, member],
+        message: isGroup ? `"${named}" is a group of settings, which holds no single value to compare. Name one setting inside it.` : `"${named}" is not a declared customer configuration property.`
+      });
+      return;
+    }
+    if (underList(leaf)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...at, "property"],
-        message: `"${condition.property}" is not a declared customer configuration property.`
+        path: [...at, member],
+        message: `"${named}" is inside a list, so it names one value per item rather than one value. A condition must name a setting the instance holds exactly once.`
       });
       return;
     }
+    const property = leaf.property;
     if (property.type !== "string") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...at, "property"],
-        message: `"${condition.property}" is a ${property.type} setting; a condition compares string values.`
+        path: [...at, member],
+        message: `"${named}" is a ${property.type} setting; a condition compares string values.`
       });
       return;
     }
-    if (property["x-secret"] === true) {
+    if (isSecretProperty(property)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...at, "property"],
-        message: `"${condition.property}" is a secret. The platform never reads a secret's value, so a condition on one could never be evaluated.`
+        path: [...at, member],
+        message: `"${named}" is a secret. The platform never reads a secret's value, so a condition on one could never be evaluated.`
       });
       return;
     }
     const single = withoutCrossFieldRules({
       ...definition.configuration,
-      properties: { [condition.property]: property },
-      required: [condition.property]
+      properties: { [leaf.name]: property },
+      required: [leaf.name]
     });
-    const outside = condition.anyOf.filter((value) => !validateSubmittedConfiguration(single, { [condition.property]: value }).ok);
+    const outside = condition.anyOf.filter((value) => !validateSubmittedConfiguration(single, { [leaf.name]: value }).ok);
     if (outside.length > 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: [...at, "anyOf"],
-        message: `"${condition.property}" never accepts ${outside.map((v) => `"${v}"`).join(", ")}, so this condition could never make the dependency required.`
+        message: `"${named}" never accepts ${outside.map((v) => `"${v}"`).join(", ")}, so this condition could never make the dependency required.`
       });
     }
   });
@@ -13970,7 +14729,7 @@ var ProductDefinitionSchema = ProductDefinitionObjectSchema.superRefine((definit
       message: 'dataResidency "global" contradicts externalProcessing false \u2014 data cannot be global without leaving the tenant boundary.'
     });
   }
-});
+}
 
 // ../product-contracts/dist/announcements.js
 var ANNOUNCED_PRODUCTS = Object.freeze([
@@ -14160,108 +14919,166 @@ var ComponentIngressSchema = external_exports.discriminatedUnion("exposure", [
     authentication: external_exports.enum(["signed-request", "mtls"])
   }).strict()
 ]);
+var LiteralEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("literal"),
+  name: EnvVarNameSchema,
+  value: external_exports.string().max(512)
+}).strict();
+var InstanceEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("instance"),
+  name: EnvVarNameSchema,
+  /** Closed set: the Control Plane knows these without Product knowledge. */
+  field: external_exports.enum([
+    "tenantKey",
+    "tenantId",
+    "projectId",
+    "productInstanceId",
+    "instanceKey",
+    "productId",
+    "productVersion",
+    "profile",
+    "region",
+    "environment"
+  ])
+}).strict();
+var PlatformEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("platform"),
+  name: EnvVarNameSchema,
+  key: external_exports.enum(["controlPlaneUrl", "observabilityEndpoint", "logLevel", "serviceVersion"])
+}).strict();
+var ComponentEndpointEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("component-endpoint"),
+  name: EnvVarNameSchema,
+  /** Resolved to the sibling component's private URL at reconcile time. */
+  componentId: ComponentIdSchema
+}).strict();
+var ComponentPublicUrlEnvBindingSchema = external_exports.object({
+  /**
+   * The CUSTOMER-FACING address of a PUBLIC component — the URL a browser
+   * opens, not the in-network one a sibling calls.
+   *
+   * WHY THE PLATFORM HAS TO SUPPLY IT. The address is assigned during
+   * deployment, so nobody knows it earlier: not the publisher, who writes
+   * the contract months before, and not the customer, who would otherwise
+   * be asked to type an address that does not exist yet. A console that
+   * needs its own address — to build an OAuth redirect URI, to put an
+   * absolute link in an email — had no way to learn it, and asking the
+   * customer produced exactly the failure you would expect: an empty
+   * setting and a console nobody can sign in to.
+   *
+   * It is deliberately NOT derivable from the request. A server behind a
+   * proxy infers its bind address, which looks right in development and is
+   * wrong in production; a forwarded Host header is attacker-controlled.
+   * The platform knows the answer, so the platform states it.
+   *
+   * `componentId` may name this component or another, but it must be a
+   * PUBLIC one: `validateProductContracts` refuses a private target, the
+   * same rule `outputs` already carries, because a private endpoint is not
+   * an address to hand out.
+   */
+  source: external_exports.literal("component-public-url"),
+  name: EnvVarNameSchema,
+  componentId: ComponentIdSchema
+}).strict();
+var ServiceBindingAttributeEnvBindingSchema = external_exports.object({
+  /**
+   * A NON-SECRET value from a service binding to ANOTHER Product.
+   *
+   * THE ONLY SOURCE THAT LEAVES THIS PRODUCT INSTANCE. Every other member of
+   * this union resolves inside one deployment: a literal, a fact about this
+   * instance, a sibling component's address, a setting this customer typed.
+   * This one is answered by a different Product Instance, possibly in a
+   * different logical Project, which is why it is the only source whose
+   * value can be absent for a reason that is nobody's mistake.
+   *
+   * ABSENT WHILE THE BINDING IS PENDING, and absent rather than empty. The
+   * variable is left out of the container entirely until the provider
+   * completes the binding, so a Product can tell "not yet" from "set to
+   * nothing" — the same rule `configuration` already follows. Read
+   * `VFAC_SERVICE_BINDING_<KEY>_STATUS`, which the platform injects for
+   * every declared binding, rather than inferring readiness from absence.
+   *
+   * CREDENTIALS DO NOT COME THIS WAY. `field` must name a field the
+   * interface classifies as an attribute; a secret field bound here is
+   * refused by `validateProductContracts()`, and the credential-shaped-name
+   * rule below refuses the variable name independently.
+   */
+  source: external_exports.literal("service-binding-attribute"),
+  name: EnvVarNameSchema,
+  /** The `serviceBindings[].key` this value comes from. */
+  binding: ServiceBindingKeySchema,
+  /** The interface field, e.g. `issuerUrl`. Checked against the registry. */
+  field: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/)
+}).strict();
+var ConfigurationEnvBindingSchema = external_exports.object({
+  source: external_exports.literal("configuration"),
+  name: EnvVarNameSchema,
+  /**
+   * A NON-SECRET customer setting from the Product Definition.
+   * `validateProductContracts()` rejects a reference to an `x-secret`
+   * property — those travel through `secrets[]` and Secret Manager, never
+   * through plain environment wiring.
+   */
+  property: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/)
+}).strict();
 var EnvBindingSchema = external_exports.discriminatedUnion("source", [
+  LiteralEnvBindingSchema,
+  InstanceEnvBindingSchema,
+  PlatformEnvBindingSchema,
+  ComponentEndpointEnvBindingSchema,
+  ComponentPublicUrlEnvBindingSchema,
+  ServiceBindingAttributeEnvBindingSchema,
+  ConfigurationEnvBindingSchema
+]);
+var ConfigurationBindingPathSchema = external_exports.string().refine((raw) => parseConfigurationPath(raw) !== null, {
+  message: 'A configuration path is a root property name, or an RFC 6901 pointer such as "/assistant/model".'
+}).refine((raw) => !/\/\d+(\/|$)/.test(raw), {
+  message: 'A Blueprint binds a DECLARED setting, so a path may not carry a list index. Bind the list with "configuration-json".'
+});
+var EnvBindingV2Schema = external_exports.discriminatedUnion("source", [
+  LiteralEnvBindingSchema,
+  InstanceEnvBindingSchema,
+  PlatformEnvBindingSchema,
+  ComponentEndpointEnvBindingSchema,
+  ComponentPublicUrlEnvBindingSchema,
+  ServiceBindingAttributeEnvBindingSchema,
   external_exports.object({
-    source: external_exports.literal("literal"),
-    name: EnvVarNameSchema,
-    value: external_exports.string().max(512)
-  }).strict(),
-  external_exports.object({
-    source: external_exports.literal("instance"),
-    name: EnvVarNameSchema,
-    /** Closed set: the Control Plane knows these without Product knowledge. */
-    field: external_exports.enum([
-      "tenantKey",
-      "tenantId",
-      "projectId",
-      "productInstanceId",
-      "instanceKey",
-      "productId",
-      "productVersion",
-      "profile",
-      "region",
-      "environment"
-    ])
-  }).strict(),
-  external_exports.object({
-    source: external_exports.literal("platform"),
-    name: EnvVarNameSchema,
-    key: external_exports.enum(["controlPlaneUrl", "observabilityEndpoint", "logLevel", "serviceVersion"])
-  }).strict(),
-  external_exports.object({
-    source: external_exports.literal("component-endpoint"),
+    source: external_exports.literal("configuration"),
     name: EnvVarNameSchema,
-    /** Resolved to the sibling component's private URL at reconcile time. */
-    componentId: ComponentIdSchema
-  }).strict(),
-  external_exports.object({
     /**
-     * The CUSTOMER-FACING address of a PUBLIC component — the URL a browser
-     * opens, not the in-network one a sibling calls.
-     *
-     * WHY THE PLATFORM HAS TO SUPPLY IT. The address is assigned during
-     * deployment, so nobody knows it earlier: not the publisher, who writes
-     * the contract months before, and not the customer, who would otherwise
-     * be asked to type an address that does not exist yet. A console that
-     * needs its own address — to build an OAuth redirect URI, to put an
-     * absolute link in an email — had no way to learn it, and asking the
-     * customer produced exactly the failure you would expect: an empty
-     * setting and a console nobody can sign in to.
+     * A NON-SECRET customer setting, named by its canonical path.
      *
-     * It is deliberately NOT derivable from the request. A server behind a
-     * proxy infers its bind address, which looks right in development and is
-     * wrong in production; a forwarded Host header is attacker-controlled.
-     * The platform knows the answer, so the platform states it.
-     *
-     * `componentId` may name this component or another, but it must be a
-     * PUBLIC one: `validateProductContracts` refuses a private target, the
-     * same rule `outputs` already carries, because a private endpoint is not
-     * an address to hand out.
+     * `validateProductContracts` refuses a path that names no leaf, a path
+     * that names a GROUP — a group has no scalar rendering, and
+     * `configuration-json` is how one is carried — and any `x-secret`
+     * property, which travels through `secrets[]` and never through plain
+     * environment wiring.
      */
-    source: external_exports.literal("component-public-url"),
-    name: EnvVarNameSchema,
-    componentId: ComponentIdSchema
+    path: ConfigurationBindingPathSchema
   }).strict(),
   external_exports.object({
+    source: external_exports.literal("configuration-json"),
+    name: EnvVarNameSchema,
     /**
-     * A NON-SECRET value from a service binding to ANOTHER Product.
+     * THE WHOLE VALIDATED CONFIGURATION, OR ONE SUBTREE OF IT, AS JSON.
      *
-     * THE ONLY SOURCE THAT LEAVES THIS PRODUCT INSTANCE. Every other member of
-     * this union resolves inside one deployment: a literal, a fact about this
-     * instance, a sibling component's address, a setting this customer typed.
-     * This one is answered by a different Product Instance, possibly in a
-     * different logical Project, which is why it is the only source whose
-     * value can be absent for a reason that is nobody's mistake.
+     * WHY THIS EXISTS. A component may carry at most forty environment
+     * bindings, and a nested Product spends one per leaf — so the format that
+     * lets a Product have structure would immediately run out of room to
+     * deliver it. This binds a whole document instead, and the Product's own
+     * runtime translates it into whatever shape it wants. The Control Plane
+     * learns nothing about that shape, which is the point.
      *
-     * ABSENT WHILE THE BINDING IS PENDING, and absent rather than empty. The
-     * variable is left out of the container entirely until the provider
-     * completes the binding, so a Product can tell "not yet" from "set to
-     * nothing" — the same rule `configuration` already follows. Read
-     * `VFAC_SERVICE_BINDING_<KEY>_STATUS`, which the platform injects for
-     * every declared binding, rather than inferring readiness from absence.
+     * WHAT IT CARRIES: validated, non-secret configuration with resolved
+     * ORDINARY resource references materialised in place. Never a secret
+     * value — secrets are root-only and travel through `secrets[]`, and a
+     * subtree cannot contain one. Serialised with `canonicalJson`, so the same
+     * logical configuration is the same bytes and the environment fingerprint
+     * does not move on key order alone.
      *
-     * CREDENTIALS DO NOT COME THIS WAY. `field` must name a field the
-     * interface classifies as an attribute; a secret field bound here is
-     * refused by `validateProductContracts()`, and the credential-shaped-name
-     * rule below refuses the variable name independently.
-     */
-    source: external_exports.literal("service-binding-attribute"),
-    name: EnvVarNameSchema,
-    /** The `serviceBindings[].key` this value comes from. */
-    binding: ServiceBindingKeySchema,
-    /** The interface field, e.g. `issuerUrl`. Checked against the registry. */
-    field: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/)
-  }).strict(),
-  external_exports.object({
-    source: external_exports.literal("configuration"),
-    name: EnvVarNameSchema,
-    /**
-     * A NON-SECRET customer setting from the Product Definition.
-     * `validateProductContracts()` rejects a reference to an `x-secret`
-     * property — those travel through `secrets[]` and Secret Manager, never
-     * through plain environment wiring.
+     * Absent `path` means the whole document.
      */
-    property: external_exports.string().regex(/^[a-z][a-zA-Z0-9]{1,47}$/)
+    path: ConfigurationBindingPathSchema.optional()
   }).strict()
 ]);
 var MAX_BOOTSTRAP_SCRIPT_LENGTH = 32768;
@@ -14473,11 +15290,12 @@ var ComponentDependencySchema = external_exports.object({
   minVersion: ContractVersionSchema.optional(),
   maxVersion: ContractVersionSchema.optional()
 }).strict();
+var MAX_COMPONENT_ENV_BINDINGS = 40;
 var componentCommonShape = {
   id: ComponentIdSchema.describe("Scoped by its Product; does not repeat the Product ID (\xA78)."),
   kind: ComponentKindSchema,
   description: external_exports.string().min(10).max(300),
-  env: external_exports.array(EnvBindingSchema).max(40),
+  env: external_exports.array(EnvBindingSchema).max(MAX_COMPONENT_ENV_BINDINGS),
   dependsOn: external_exports.array(ComponentDependencySchema).max(8)
 };
 var ServerlessContainerComponentSchema = external_exports.object({
@@ -14529,6 +15347,16 @@ var RuntimeComponentSchema = external_exports.discriminatedUnion("runtime", [
   ServerlessContainerComponentSchema,
   VirtualMachineComponentSchema
 ]);
+var ServerlessContainerComponentV2Schema = ServerlessContainerComponentSchema.extend({
+  env: external_exports.array(EnvBindingV2Schema).max(MAX_COMPONENT_ENV_BINDINGS)
+});
+var VirtualMachineComponentV2Schema = VirtualMachineComponentSchema.extend({
+  env: external_exports.array(EnvBindingV2Schema).max(MAX_COMPONENT_ENV_BINDINGS)
+});
+var RuntimeComponentV2Schema = external_exports.discriminatedUnion("runtime", [
+  ServerlessContainerComponentV2Schema,
+  VirtualMachineComponentV2Schema
+]);
 function isVirtualMachineComponent(component) {
   return component.runtime === "virtual-machine";
 }
@@ -14777,7 +15605,47 @@ var BlueprintLifecycleSchema = external_exports.object({
      * the service-interface surface is unchanged. Nothing published to date
      * regresses, and a release cannot strand an instance by forgetting it.
      */
-    directFromVersions: external_exports.array(ContractVersionSchema).max(20).optional()
+    directFromVersions: external_exports.array(ContractVersionSchema).max(20).optional(),
+    /**
+     * How a stored configuration is carried across a release that MOVED a
+     * setting.
+     *
+     * THE CASE THIS EXISTS FOR is a flat Product taking on structure:
+     * `assistantName` becomes `/assistant/name`. Nothing else on this
+     * platform can express that. Without it the target release simply does
+     * not declare `assistantName`, so the upgrade drops the customer's value
+     * and then refuses the deploy for a missing required setting — and the
+     * customer's answer is gone either way.
+     *
+     * `move` AND NOTHING ELSE. A migration the platform cannot fully
+     * evaluate is one it cannot apply safely, and every other operation a
+     * publisher might want — rename a value, split one setting into two,
+     * compute a default — needs the Product's own knowledge of what those
+     * values MEAN. Moving a value is the one thing the platform can do
+     * correctly without knowing anything about it.
+     *
+     * APPLIED AT CUTOVER, in the transaction that writes the new
+     * configuration, and to the REFERENCE ROWS as well as the stored
+     * document — a Resource Reference is identified by the path it answers,
+     * so a setting that moved takes its edge with it or the edge points at
+     * nothing.
+     *
+     * AN ABSENT SOURCE IS A NO-OP, deliberately. A customer who never
+     * answered an optional setting has nothing to carry, and inventing an
+     * empty value for them would turn "not configured" into "configured
+     * blank" — two states this platform keeps apart everywhere else.
+     *
+     * `.optional()`, never `.default([])`, for the reason
+     * `directFromVersions` states one field above: a materialised key makes
+     * a byte-identical republish `RELEASED_CONTRACT_MUTATED`.
+     */
+    configurationMigrations: external_exports.array(external_exports.object({
+      op: external_exports.literal("move"),
+      /** Where the value is today, in the release being left. */
+      from: ConfigurationBindingPathSchema,
+      /** Where this release declares it. */
+      to: ConfigurationBindingPathSchema
+    }).strict()).max(40).optional()
   }).strict(),
   rollback: external_exports.object({
     supported: external_exports.boolean(),
@@ -14903,7 +15771,14 @@ function isOidcClientServiceBinding(binding) {
 }
 var DeploymentBlueprintObjectSchema = external_exports.object({
   /** The CONTRACT FORMAT version — not the Blueprint's. See api-version.ts. */
-  apiVersion: ProductApiVersionSchema,
+  /**
+   * The SHARED base carries either literal; each format pins its own below.
+   *
+   * Nothing parses this object schema directly — `DeploymentBlueprintV1Schema`
+   * and `…V2Schema` extend it — so the permissive literal here is never what a
+   * document is held to, and never what an artifact publishes.
+   */
+  apiVersion: ProductApiVersionAnySchema,
   kind: kindSchema(DEPLOYMENT_BLUEPRINT_KIND),
   productId: ProductIdSchema,
   /** This Blueprint's own version. The Definition pins it exactly. */
@@ -14971,7 +15846,17 @@ var DeploymentBlueprintObjectSchema = external_exports.object({
   outputs: external_exports.array(BlueprintOutputSchema).min(1).max(12),
   lifecycle: BlueprintLifecycleSchema
 }).strict();
-var DeploymentBlueprintSchema = DeploymentBlueprintObjectSchema.superRefine((blueprint, ctx) => {
+var DeploymentBlueprintV1ObjectSchema = DeploymentBlueprintObjectSchema.extend({
+  apiVersion: ProductApiVersionSchema
+});
+var DeploymentBlueprintV2ObjectSchema = DeploymentBlueprintObjectSchema.extend({
+  apiVersion: ProductApiVersionV2Schema,
+  components: external_exports.array(RuntimeComponentV2Schema).min(1).max(MAX_RUNTIME_COMPONENTS)
+});
+var DeploymentBlueprintV1Schema = DeploymentBlueprintV1ObjectSchema.superRefine(checkDeploymentBlueprint);
+var DeploymentBlueprintV2Schema = DeploymentBlueprintV2ObjectSchema.superRefine(checkDeploymentBlueprint);
+var DeploymentBlueprintSchema = DeploymentBlueprintV1Schema;
+function checkDeploymentBlueprint(blueprint, ctx) {
   const componentIds = blueprint.components.map((component) => component.id);
   const knownComponents = new Set(componentIds);
   const publicComponents = new Set(blueprint.components.filter((component) => component.ingress.exposure === "public").map((component) => component.id));
@@ -15072,13 +15957,7 @@ var DeploymentBlueprintSchema = DeploymentBlueprintObjectSchema.superRefine((blu
     });
     const handoff = resource.bootstrap.productHandoff;
     if (handoff !== void 0) {
-      const handoffPath = [
-        "dynamicResources",
-        index,
-        "bootstrap",
-        "productHandoff",
-        "componentId"
-      ];
+      const handoffPath = ["dynamicResources", index, "bootstrap", "productHandoff", "componentId"];
       const target = blueprint.components.find((component) => component.id === handoff.componentId);
       if (target === void 0) {
         ctx.addIssue({
@@ -15689,7 +16568,7 @@ var DeploymentBlueprintSchema = DeploymentBlueprintObjectSchema.superRefine((blu
       });
     }
   }
-});
+}
 
 // ../product-contracts/dist/deployability.js
 var VIRTUAL_MACHINE_PROFILE_INTERFACE = {
@@ -15730,6 +16609,9 @@ function isTerminalAction(action) {
 }
 var ManifestActionSchema = external_exports.enum(MANIFEST_ACTIONS);
 
+// ../product-contracts/dist/contract-issue.js
+var MAX_SEGMENTS = MAX_CONFIGURATION_PATH_SEGMENTS + 2;
+
 // ../product-contracts/dist/resource-output-reference.js
 var OUTPUT_KEY_RULE = "Output keys are camelCase.";
 var ResourceOutputReferenceSchema = external_exports.object({
@@ -15896,7 +16778,33 @@ var ProductSubmissionObjectSchema = external_exports.object({
   definition: ProductDefinitionSchema,
   blueprint: DeploymentBlueprintSchema
 }).strict();
-var ProductSubmissionSchema = ProductSubmissionObjectSchema.superRefine((submission, ctx) => {
+var submissionShape = {
+  kind: kindSchema(PRODUCT_SUBMISSION_KIND),
+  submission: SubmissionEnvelopeSchema
+};
+var ProductSubmissionV1ObjectSchema = external_exports.object({
+  apiVersion: ProductApiVersionSchema,
+  ...submissionShape,
+  definition: ProductDefinitionSchema,
+  blueprint: DeploymentBlueprintV1Schema
+}).strict();
+var ProductSubmissionV2ObjectSchema = external_exports.object({
+  apiVersion: ProductApiVersionV2Schema,
+  ...submissionShape,
+  definition: ProductDefinitionV2Schema,
+  blueprint: DeploymentBlueprintV2Schema
+}).strict();
+var ProductSubmissionV1Schema = ProductSubmissionV1ObjectSchema.superRefine(checkProductSubmission);
+var ProductSubmissionV2Schema = ProductSubmissionV2ObjectSchema.superRefine(checkProductSubmission);
+var ProductSubmissionSchema = ProductSubmissionV1Schema;
+function checkProductSubmission(submission, ctx) {
+  if (submission.definition.apiVersion !== submission.apiVersion) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["definition", "apiVersion"],
+      message: `This submission is written against "${submission.apiVersion}" but its Product Definition declares "${submission.definition.apiVersion}". One submission is one contract format.`
+    });
+  }
   if (submission.definition.id !== submission.submission.productId) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -15918,7 +16826,7 @@ var ProductSubmissionSchema = ProductSubmissionObjectSchema.superRefine((submiss
       message: `The Product Definition is version "${submission.definition.version}" but the submission claims "${submission.submission.version}". They must be the same version.`
     });
   }
-});
+}
 var PUBLISH_RULE_ANNEX = {
   allOf: [
     {
@@ -16371,12 +17279,12 @@ async function runDoctor(parsed) {
       ok: false,
       detail: "not set. Run `vfac context set --endpoint https://your-organization.cloud.vardeflyt.no`, or set VFAC_ENDPOINT."
     });
-    return report(checks, json);
+    return report2(checks, json);
   }
   const checked = validateEndpoint(resolved.value, resolved.source);
   if (!checked.ok) {
     checks.push({ name: "Endpoint", ok: false, detail: checked.message });
-    return report(checks, json);
+    return report2(checks, json);
   }
   const endpoint = checked.endpoint;
   checks.push({
@@ -16396,16 +17304,16 @@ async function runDoctor(parsed) {
   const probe = await probeMachineApi({ endpoint });
   if (!probe.ok) {
     checks.push({ name: "Machine API", ok: false, detail: probe.message });
-    return report(checks, json);
+    return report2(checks, json);
   }
   checks.push({ name: "Machine API", ok: true, detail: probe.apiVersion });
   const compatible = compatibility(cliVersion(), probe.minimumCliVersion);
   checks.push(compatible);
-  if (!compatible.ok) return report(checks, json);
+  if (!compatible.ok) return report2(checks, json);
   const signedIn = await signIn({ endpoint });
   if (!signedIn.ok) {
     checks.push({ name: "Context Gate", ok: false, detail: signedIn.message });
-    return report(checks, json);
+    return report2(checks, json);
   }
   checks.push({
     name: "Context Gate",
@@ -16426,7 +17334,7 @@ async function runDoctor(parsed) {
       ok: false,
       detail: who.error.status === 404 ? "this Tenant Portal does not serve /api/v1/whoami yet \u2014 it is running an older build." : who.error.message
     });
-    return report(checks, json);
+    return report2(checks, json);
   }
   const access = who.data.access;
   const projects = access.projects.map((project) => project.projectId);
@@ -16486,7 +17394,7 @@ async function runDoctor(parsed) {
     detail: "run `vfac guide` for the platform's own instructions, written for a machine"
   });
   checks.push(await updateAvailable(cliVersion()));
-  return report(checks, json);
+  return report2(checks, json);
 }
 function compatibility(local, declared) {
   const name = "Compatibility";
@@ -16566,7 +17474,7 @@ async function updateAvailable(local) {
     facts
   };
 }
-function report(checks, json) {
+function report2(checks, json) {
   const failed = checks.filter((check) => !check.ok);
   if (json) {
     process.stdout.write(`${JSON.stringify({ ok: failed.length === 0, checks })}
@@ -16942,16 +17850,14 @@ function renderProduct(product) {
     (profile) => `${profile.id}${profile.default ? " (default)" : ""}`
   );
   lines.push(`  profile         ${profiles.join(", ") || "(none declared)"}`);
-  const properties = product.configuration?.properties ?? {};
-  const required = product.configuration?.required ?? [];
-  if (required.length > 0) {
+  const seed = seedConfiguration(product.configuration);
+  if (seed.open.length > 0 || seed.requiredSecrets.length > 0) {
     lines.push("", "  Required configuration");
-    for (const name of required) {
-      const property = properties[name];
-      const secret = property?.writeOnly === true || property?.["x-secret"] === true;
-      lines.push(
-        `    ${name}${secret ? "  (secret \u2014 pass --secret " + name + "=env:VAR)" : `  ${property?.type ?? ""}`}`
-      );
+    for (const name of seed.requiredSecrets) {
+      lines.push(`    ${name}  (secret \u2014 pass --secret ${name}=env:VAR)`);
+    }
+    for (const setting of seed.open) {
+      lines.push(`    ${setting.label}  ${setting.type ?? ""}`.trimEnd());
     }
   }
   const needed = (product.dependencies ?? []).filter((dependency) => dependency.required);
@@ -17224,7 +18130,7 @@ async function runManifestInit(parsed) {
   }
   for (const setting of seed.open) {
     notes.push(
-      `spec.configuration.${setting.name}  \u2014 required${setting.type ? ` (${setting.type})` : ""}`
+      `spec.configuration.${setting.label}  \u2014 required${setting.type ? ` (${setting.type})` : ""}`
     );
   }
   for (const group of seed.groups) {