@varde-flyt/vfac 0.8.0 → 0.10.0

package/README.md

@@ -27,9 +27,11 @@ vfac whoami
 ```
 
 `doctor` checks the endpoint, which Project this terminal has selected, the API,
-whether this client is new enough for the platform it is pointed at, your
-credential and what that credential reaches, in that order, and reports the first
-thing that is actually wrong. A platform declares the oldest client it supports;
+whether this client is new enough for the platform it is pointed at, how this
+terminal is signed in and what that credential reaches, in that order, and reports
+the first thing that is actually wrong. Both ways of signing in count: a Context
+Gate exchanged from `VFAC_CREDENTIAL_ID` and `VFAC_CREDENTIAL_SECRET`, or a
+sign-in from `vfac login` that is still valid. A platform declares the oldest client it supports;
 below that, `doctor` fails and says so before sending your credential anywhere.
 
 The selected Project and the Projects your credential reaches are two different

package/dist/vfac.mjs

@@ -7793,7 +7793,7 @@ async function ensureSession(args) {
   const endpoint = checked.endpoint;
   const credential = credentialFromEnvironment();
   if (args.forceExchange !== true && sessionUsable(stored.session, endpoint, args.now ?? /* @__PURE__ */ new Date(), credential?.keyId)) {
-    return { ok: true, ready: { endpoint, token: stored.session.token, stored } };
+    return { ok: true, ready: { endpoint, token: stored.session.token, stored, via: "stored" } };
   }
   const signedIn = await signIn({
     endpoint,
@@ -7802,7 +7802,16 @@ async function ensureSession(args) {
   if (!signedIn.ok) return { ok: false, message: signedIn.message };
   const next = { ...stored, session: signedIn.session };
   writeStored(next);
-  return { ok: true, ready: { endpoint, token: signedIn.session.token, stored: next } };
+  return {
+    ok: true,
+    ready: {
+      endpoint,
+      token: signedIn.session.token,
+      stored: next,
+      via: "exchanged",
+      ...signedIn.gate ? { gate: signedIn.gate } : {}
+    }
+  };
 }
 function resolveProject(flag, stored) {
   return flag ?? stored.context?.projectId ?? null;
@@ -7922,8 +7931,9 @@ function renderOperation(operationId, data) {
     const retryable = failure["retryable"];
     if (typeof retryable === "boolean") {
       const again = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "`vfac lifecycle upgrade <pri_\u2026>`" : "`vfac lifecycle reconcile <pri_\u2026>`";
+      const changeIt = data["type"] === "PRODUCT_INSTANCE_UPGRADE" ? "" : ", or `vfac apply` a corrected manifest";
       lines.push(
-        retryable ? `    Another attempt can succeed: ${again}.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}.`
+        retryable ? `    Another attempt can succeed: ${again}.` : `    Repeating this unchanged fails again \u2014 fix what the lines above name, then ${again}${changeIt}.`
       );
     }
   }
@@ -11989,9 +11999,10 @@ var coerce = {
 var NEVER = INVALID;
 
 // ../product-configuration/dist/configuration-bounds.js
-var MAX_CONFIGURATION_DEPTH = 2;
-var MAX_CONFIGURATION_LEAVES = 40;
-var MAX_CONFIGURATION_NODES = 60;
+var MAX_CONFIGURATION_DEPTH = 6;
+var MAX_CONFIGURATION_LEAVES = 256;
+var MAX_CONFIGURATION_NODES = 512;
+var MAX_CONFIGURATION_CHILDREN = 64;
 var MAX_CONFIGURATION_VALUE_LEAVES = 1e3;
 var MAX_CONFIGURATION_ISSUES = 50;
 var MAX_CONFIGURATION_VALUE_BYTES = 16384;
@@ -12002,6 +12013,11 @@ function withJsonSchemaAnnex(schema, annex) {
   ANNEXES.set(schema, annex);
   return schema;
 }
+var DEFINITION_NAMES = /* @__PURE__ */ new WeakMap();
+function withJsonSchemaDefinition(schema, name) {
+  DEFINITION_NAMES.set(schema, name);
+  return schema;
+}
 
 // ../product-configuration/dist/infrastructure-vocabulary.js
 function tokenizeIdentifier(identifier) {
@@ -12218,8 +12234,31 @@ var ConfigurationGroupSchema = external_exports.enum([
 ]);
 var CONFIGURATION_PROPERTY_NAME_REGEX = /^[a-z][a-zA-Z0-9]{1,47}$/;
 var PropertyNameSchema = external_exports.string().regex(CONFIGURATION_PROPERTY_NAME_REGEX, "Configuration property names must be camelCase, start with a lowercase letter, and be 2\u201348 characters.");
+var ValueConditionSchema = external_exports.object({
+  /**
+   * The setting, as a canonical path — or a bare root key, which is the same
+   * string at depth 1. With `anyRow`, a DECLARATION path: `/servers/kind`
+   * names the setting each row answers, never one row's answer.
+   */
+  path: external_exports.string().min(1).max(400),
+  anyOf: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(20),
+  anyRow: external_exports.boolean().optional()
+}).strict();
 var TitleSchema = external_exports.string().min(2).max(80).describe("Customer-facing field label.");
-var HelpTextSchema = external_exports.string().min(10).max(400).describe("Customer-facing explanation. Required for security-sensitive choices.");
+var V1_LEAF_BOUNDS = {
+  help: 400,
+  enumValues: 40,
+  stringLength: 4096,
+  defaultLength: 400
+};
+var V2_LEAF_BOUNDS = {
+  help: 2e3,
+  enumValues: 256,
+  stringLength: 16384,
+  defaultLength: 2e3
+};
+var MAX_DECLARABLE_STRING_LENGTH = V2_LEAF_BOUNDS.stringLength;
+var helpTextSchema = (bounds) => external_exports.string().min(10).max(bounds.help).describe("Customer-facing explanation. Required for security-sensitive choices.");
 var SECRET_COUPLING_ANNEX = {
   allOf: [
     {
@@ -12238,63 +12277,91 @@ var SECRET_COUPLING_ANNEX = {
     }
   ]
 };
-var StringPropertySchema = external_exports.object({
-  type: external_exports.literal("string"),
-  title: TitleSchema,
-  description: HelpTextSchema.optional(),
-  group: ConfigurationGroupSchema,
-  enum: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40).optional(),
-  minLength: external_exports.number().int().min(0).max(4096).optional(),
-  /**
-   * Required unless the value is constrained by `enum`. An unbounded string
-   * reaching the Control Plane as desired state is an unbounded write.
-   */
-  maxLength: external_exports.number().int().min(1).max(4096).optional(),
-  pattern: external_exports.string().min(1).max(200).optional(),
-  default: external_exports.string().max(400).optional(),
-  /**
-   * docs/PRODUCT_DEFINITION_GUIDE.md "Secrets": secret input is marked
-   * write-only AND secret. Both flags, and the refinement below makes one
-   * without the other a validation error.
-   */
-  writeOnly: external_exports.boolean().optional(),
-  "x-secret": external_exports.boolean().optional()
-}).strict();
-withJsonSchemaAnnex(StringPropertySchema, SECRET_COUPLING_ANNEX);
-var NumberPropertySchema = external_exports.object({
-  type: external_exports.enum(["integer", "number"]),
-  title: TitleSchema,
-  description: HelpTextSchema.optional(),
-  group: ConfigurationGroupSchema,
-  /** Both bounds required — "numeric limits" in the guide is not optional. */
-  minimum: external_exports.number(),
-  maximum: external_exports.number(),
-  default: external_exports.number().optional()
-}).strict();
-var BooleanPropertySchema = external_exports.object({
-  type: external_exports.literal("boolean"),
-  title: TitleSchema,
-  description: HelpTextSchema.optional(),
-  group: ConfigurationGroupSchema,
-  default: external_exports.boolean().optional()
-}).strict();
-var ArrayItemsSchema = external_exports.object({
-  type: external_exports.literal("string"),
-  enum: external_exports.array(external_exports.string().min(1).max(80)).min(1).max(40).optional(),
-  maxLength: external_exports.number().int().min(1).max(400).optional()
-}).strict();
-var ArrayPropertySchema = external_exports.object({
-  type: external_exports.literal("array"),
-  title: TitleSchema,
-  description: HelpTextSchema.optional(),
-  group: ConfigurationGroupSchema,
-  items: ArrayItemsSchema,
-  minItems: external_exports.number().int().min(0).max(100).optional(),
-  /** Required: an unbounded list is an unbounded write. */
-  maxItems: external_exports.number().int().min(1).max(100),
-  uniqueItems: external_exports.boolean().optional(),
-  default: external_exports.array(external_exports.string().max(200)).max(100).optional()
-}).strict();
+function leafShapes(bounds) {
+  const help = helpTextSchema(bounds);
+  const enumMembers = external_exports.array(external_exports.string().min(1).max(80)).min(1).max(bounds.enumValues).optional();
+  const string = external_exports.object({
+    type: external_exports.literal("string"),
+    title: TitleSchema,
+    description: help.optional(),
+    group: ConfigurationGroupSchema,
+    enum: enumMembers,
+    minLength: external_exports.number().int().min(0).max(bounds.stringLength).optional(),
+    /**
+     * Required unless the value is constrained by `enum`. An unbounded string
+     * reaching the Control Plane as desired state is an unbounded write.
+     */
+    maxLength: external_exports.number().int().min(1).max(bounds.stringLength).optional(),
+    pattern: external_exports.string().min(1).max(200).optional(),
+    default: external_exports.string().max(bounds.defaultLength).optional(),
+    /**
+     * docs/PRODUCT_DEFINITION_GUIDE.md "Secrets": secret input is marked
+     * write-only AND secret. Both flags, and the refinement below makes one
+     * without the other a validation error.
+     */
+    writeOnly: external_exports.boolean().optional(),
+    "x-secret": external_exports.boolean().optional(),
+    /**
+     * The setting VALUE that makes this credential necessary.
+     *
+     * WHY IT CANNOT BE `dependentRequired`. That mechanism is keyed on
+     * PRESENCE — "if the author answered X, they must also answer Y" — and
+     * says so in as many words: "PRESENCE, NEVER A VALUE. A caller passes
+     * NAMES." A Product whose credential is needed only when a setting has one
+     * particular value could not say so, so `vfac plan`'s `requiredSecrets`
+     * could not warn before a deploy, and the refusal arrived at apply.
+     *
+     * ON A SECRET ONLY, and that is narrower than the mechanism could be. A
+     * value-conditioned requirement for an ORDINARY setting is a real gap too,
+     * but it changes what every door accepts for every property; this changes
+     * what `requiredSecrets` reports, which is one answer with one reader.
+     * Opening it wider is a separate decision with its own blast radius.
+     */
+    "x-required-when": ValueConditionSchema.optional()
+  }).strict();
+  withJsonSchemaAnnex(string, SECRET_COUPLING_ANNEX);
+  const number = external_exports.object({
+    type: external_exports.enum(["integer", "number"]),
+    title: TitleSchema,
+    description: help.optional(),
+    group: ConfigurationGroupSchema,
+    /** Both bounds required — "numeric limits" in the guide is not optional. */
+    minimum: external_exports.number(),
+    maximum: external_exports.number(),
+    default: external_exports.number().optional()
+  }).strict();
+  const boolean = external_exports.object({
+    type: external_exports.literal("boolean"),
+    title: TitleSchema,
+    description: help.optional(),
+    group: ConfigurationGroupSchema,
+    default: external_exports.boolean().optional()
+  }).strict();
+  const items = external_exports.object({
+    type: external_exports.literal("string"),
+    enum: enumMembers,
+    maxLength: external_exports.number().int().min(1).max(bounds.defaultLength).optional()
+  }).strict();
+  const array = external_exports.object({
+    type: external_exports.literal("array"),
+    title: TitleSchema,
+    description: help.optional(),
+    group: ConfigurationGroupSchema,
+    items,
+    minItems: external_exports.number().int().min(0).max(100).optional(),
+    /** Required: an unbounded list is an unbounded write. */
+    maxItems: external_exports.number().int().min(1).max(100),
+    uniqueItems: external_exports.boolean().optional(),
+    default: external_exports.array(external_exports.string().max(200)).max(100).optional()
+  }).strict();
+  return { string, number, boolean, items, array };
+}
+var V1_LEAVES = leafShapes(V1_LEAF_BOUNDS);
+var V2_LEAVES = leafShapes(V2_LEAF_BOUNDS);
+var StringPropertySchema = V1_LEAVES.string;
+var NumberPropertySchema = V1_LEAVES.number;
+var BooleanPropertySchema = V1_LEAVES.boolean;
+var ArrayPropertySchema = V1_LEAVES.array;
 var MAX_CONFIGURATION_PROPERTIES = 40;
 var ConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
   StringPropertySchema,
@@ -12302,42 +12369,81 @@ var ConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
   BooleanPropertySchema,
   ArrayPropertySchema
 ]);
-var NestedStringPropertySchema = StringPropertySchema.omit({
-  "x-secret": true,
-  writeOnly: true
-});
-var NestedConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
-  NestedStringPropertySchema,
-  NumberPropertySchema,
-  BooleanPropertySchema,
-  ArrayPropertySchema
-]);
-var nestedPropertiesShape = {
-  properties: external_exports.record(PropertyNameSchema, NestedConfigurationPropertySchema),
-  required: external_exports.array(PropertyNameSchema).max(MAX_CONFIGURATION_PROPERTIES).optional(),
-  additionalProperties: external_exports.literal(false)
+var NestedStringPropertySchema = V2_LEAVES.string.omit({ "x-secret": true, writeOnly: true, "x-required-when": true }).extend({ group: ConfigurationGroupSchema.optional() });
+var V2_NESTED_LEAVES = {
+  string: NestedStringPropertySchema,
+  number: V2_LEAVES.number.extend({ group: ConfigurationGroupSchema.optional() }),
+  boolean: V2_LEAVES.boolean.extend({ group: ConfigurationGroupSchema.optional() }),
+  array: V2_LEAVES.array.extend({ group: ConfigurationGroupSchema.optional() }),
+  items: V2_LEAVES.items
 };
-var ObjectPropertySchema = external_exports.object({
-  type: external_exports.literal("object"),
-  title: TitleSchema,
-  description: HelpTextSchema.optional(),
-  group: ConfigurationGroupSchema,
-  ...nestedPropertiesShape
-}).strict();
-var ObjectArrayItemsSchema = external_exports.object({
-  type: external_exports.literal("object"),
-  ...nestedPropertiesShape
-}).strict();
-var ArrayPropertyV2Schema = ArrayPropertySchema.extend({
-  items: external_exports.discriminatedUnion("type", [ArrayItemsSchema, ObjectArrayItemsSchema])
-});
-var RootConfigurationPropertySchema = external_exports.discriminatedUnion("type", [
-  StringPropertySchema,
-  NumberPropertySchema,
-  BooleanPropertySchema,
-  ArrayPropertyV2Schema,
-  ObjectPropertySchema
-]);
+function childBagShape(child) {
+  return {
+    properties: external_exports.record(PropertyNameSchema, child),
+    required: external_exports.array(PropertyNameSchema).max(MAX_CONFIGURATION_CHILDREN).optional(),
+    /**
+     * All-or-none rules, scoped to THIS container.
+     *
+     * ON THE CONTAINER, NEVER AS ROOT CLAUSES NAMING PATHS. The published key
+     * promises that "a publisher running an off-the-shelf validator over that
+     * file must get the answer the platform gives", and JSON Schema 2020-12
+     * scopes `dependentRequired` to the object that CARRIES it. A root clause
+     * naming `/upstream/token` would be a rule no standard validator applies —
+     * the one thing this key may not become. Written here it keeps exactly the
+     * meaning it has everywhere else, and the generated artifact carries it on
+     * the right node.
+     *
+     * A REPEATABLE GROUP GETS ONE PER ROW, which is the honest reading: "if this
+     * server has a URL it needs a token" is a fact about a server, not about the
+     * list.
+     */
+    dependentRequired: external_exports.record(PropertyNameSchema, external_exports.array(PropertyNameSchema).min(1).max(MAX_CONFIGURATION_CHILDREN)).optional().describe("Settings inside this group that must be supplied together."),
+    additionalProperties: external_exports.literal(false)
+  };
+}
+function propertyUnion(levelsBelow, leafSet) {
+  const leaves = [leafSet.string, leafSet.number, leafSet.boolean];
+  if (levelsBelow <= 0) {
+    return [...leaves, leafSet.array];
+  }
+  const level = MAX_CONFIGURATION_DEPTH - levelsBelow + 1;
+  const child = withJsonSchemaDefinition(external_exports.discriminatedUnion("type", propertyUnion(levelsBelow - 1, V2_NESTED_LEAVES)), `configurationPropertyLevel${level}`);
+  const bag = childBagShape(child);
+  const groupItems = external_exports.object({ type: external_exports.literal("object"), ...bag }).strict();
+  return [
+    ...leaves,
+    // ONE `array` BRANCH, NOT TWO, because a discriminated union may not carry
+    // two options with the same discriminator value ("duplicate value array" —
+    // zod refuses it at construction). The item shape is the inner
+    // discriminator, which is also what keeps a v1 document's
+    // `items: {type: 'string'}` reading exactly as it always did.
+    leafSet.array.extend({
+      items: external_exports.discriminatedUnion("type", [V2_LEAVES.items, groupItems])
+    }),
+    /**
+     * A group of related settings.
+     *
+     * NO `default`. A container cannot carry one, structurally — `.strict()`
+     * refuses the key — and that removes a whole class of question rather than
+     * answering it: what a whole-subtree default means when the customer
+     * supplied half of it, how it interacts with `dependentRequired`'s
+     * load-bearing "a defaulted setting is never absent", and what
+     * `seedConfiguration` should write into a served example and a file on
+     * disk. Defaults are a LEAF concept here.
+     */
+    external_exports.object({
+      type: external_exports.literal("object"),
+      title: TitleSchema,
+      description: helpTextSchema(V2_LEAF_BOUNDS).optional(),
+      // INHERITED BELOW THE ROOT, for the reason `V2_NESTED_LEAVES` states: a
+      // group is a bucket for a whole subtree, and repeating it is the only
+      // value that could be written.
+      group: levelsBelow === MAX_CONFIGURATION_DEPTH - 1 ? ConfigurationGroupSchema : ConfigurationGroupSchema.optional(),
+      ...bag
+    }).strict()
+  ];
+}
+var RootConfigurationPropertySchema = external_exports.discriminatedUnion("type", propertyUnion(MAX_CONFIGURATION_DEPTH - 1, V2_LEAVES));
 var CustomerConfigurationObjectSchema = external_exports.object({
   type: external_exports.literal("object"),
   properties: external_exports.record(PropertyNameSchema, ConfigurationPropertySchema).describe("Customer-editable settings, keyed by camelCase property name."),
@@ -12568,19 +12674,19 @@ function checkDeclaredProperty(name, property, path, ctx, atRoot) {
     }
   }
 }
-function checkDependentRequired(config, ctx) {
+function checkDependentRequired(config, ctx, at = []) {
   const clauses = Object.entries(config.dependentRequired ?? {});
   if (clauses.length === 0)
     return;
   if (clauses.length > MAX_CONFIGURATION_PROPERTIES) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
-      path: ["dependentRequired"],
+      path: [...at, "dependentRequired"],
       message: `A Product may declare at most ${MAX_CONFIGURATION_PROPERTIES} dependent-required groups; found ${clauses.length}.`
     });
   }
   for (const [trigger, dependents] of clauses) {
-    const path = ["dependentRequired", trigger];
+    const path = [...at, "dependentRequired", trigger];
     const declaredTrigger = config.properties[trigger];
     if (declaredTrigger === void 0) {
       ctx.addIssue({
@@ -12692,7 +12798,7 @@ function checkOneSecretPerGroup(config, ctx) {
 var CustomerConfigurationV2ObjectSchema = external_exports.object({
   type: external_exports.literal("object"),
   properties: external_exports.record(PropertyNameSchema, RootConfigurationPropertySchema).describe("Customer-editable settings, keyed by camelCase property name."),
-  required: external_exports.array(PropertyNameSchema).max(MAX_CONFIGURATION_PROPERTIES).optional(),
+  required: external_exports.array(PropertyNameSchema).max(MAX_CONFIGURATION_CHILDREN).optional(),
   /**
    * ROOT PROPERTIES ONLY, in v2.0.
    *
@@ -12704,23 +12810,25 @@ var CustomerConfigurationV2ObjectSchema = external_exports.object({
    * nested object may not carry its own clause either — that is expressible
    * and honest, and it is deliberately left for when something needs it.
    */
-  dependentRequired: external_exports.record(PropertyNameSchema, external_exports.array(PropertyNameSchema).min(1).max(MAX_CONFIGURATION_PROPERTIES)).optional().describe("Settings that must be supplied together, keyed by the triggering property."),
+  dependentRequired: external_exports.record(PropertyNameSchema, external_exports.array(PropertyNameSchema).min(1).max(MAX_CONFIGURATION_CHILDREN)).optional().describe("Settings that must be supplied together, keyed by the triggering property."),
   additionalProperties: external_exports.literal(false)
 }).strict();
 function countNodes(property) {
-  if (property.type === "object") {
-    const children = Object.keys(property.properties).length;
-    return { leaves: children, nodes: children + 1, instantiated: children };
-  }
-  if (property.type === "array" && property.items.type === "object") {
-    const children = Object.keys(property.items.properties).length;
-    return {
-      leaves: children,
-      nodes: children + 1,
-      instantiated: children * property.maxItems
-    };
-  }
-  return { leaves: 1, nodes: 1, instantiated: 1 };
+  const children = childrenOf(property);
+  if (children === null)
+    return { leaves: 1, nodes: 1, instantiated: 1 };
+  let leaves = 0;
+  let nodes = 1;
+  let instantiated = 0;
+  for (const child of Object.values(children.properties)) {
+    const inner = countNodes(child);
+    leaves += inner.leaves;
+    nodes += inner.nodes;
+    instantiated += inner.instantiated;
+  }
+  if (property.type === "array")
+    instantiated *= property.maxItems;
+  return { leaves, nodes, instantiated };
 }
 function childrenOf(property) {
   if (property.type === "object")
@@ -12730,34 +12838,26 @@ function childrenOf(property) {
   return null;
 }
 function minimumConfigurationBytes(config) {
-  const rootRequired = new Set(config.required ?? []);
-  let total = 2;
-  for (const [name, property] of Object.entries(config.properties)) {
-    const children = childrenOf(property);
-    if (children === null) {
-      if (!rootRequired.has(name) && declaredLeafDefault(property) === void 0)
-        continue;
-      total += name.length + 3 + minimumLeafBytes(property);
-      continue;
-    }
-    if (!rootRequired.has(name))
-      continue;
-    const inner = minimumGroupBytes(children.properties, children.required ?? []);
-    total += name.length + 3 + (property.type === "array" ? 2 + (property.minItems ?? 0) * inner : inner);
-  }
-  return total;
+  return minimumGroupBytes(config.properties, config.required ?? []);
 }
 function minimumGroupBytes(properties, required) {
   const names = new Set(required);
   let total = 2;
   for (const [name, property] of Object.entries(properties)) {
-    if (!names.has(name) && declaredLeafDefault(property) === void 0)
+    const isContainer = childrenOf(property) !== null;
+    if (isContainer ? !names.has(name) : !names.has(name) && declaredLeafDefault(property) === void 0) {
       continue;
-    total += name.length + 3 + minimumLeafBytes(property);
+    }
+    total += name.length + 3 + minimumPropertyBytes(property);
   }
   return total;
 }
-function minimumLeafBytes(property) {
+function minimumPropertyBytes(property) {
+  const children = childrenOf(property);
+  if (children !== null) {
+    const inner = minimumGroupBytes(children.properties, children.required ?? []);
+    return property.type === "array" ? 2 + (property.minItems ?? 0) * inner : inner;
+  }
   switch (property.type) {
     case "string": {
       const shortestEnum = property.enum?.reduce((a, b) => a.length <= b.length ? a : b);
@@ -12778,13 +12878,85 @@ function minimumLeafBytes(property) {
 function declaredLeafDefault(property) {
   return property.type === "object" ? void 0 : property.default;
 }
+function checkPropertyDeclaration(name, property, path, ctx, atRoot) {
+  const children = childrenOf(property);
+  if (children === null) {
+    checkDeclaredProperty(name, property, path, ctx, atRoot);
+    return;
+  }
+  const infrastructure = infrastructureVocabularyViolation(name);
+  if (infrastructure) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path,
+      message: `${infrastructure}. Customer settings describe outcomes, not infrastructure.`
+    });
+  }
+  if (atRoot) {
+    const platformOwned = platformOwnedFieldViolation(name);
+    if (platformOwned) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path, message: `${platformOwned}.` });
+    }
+  }
+  const childNames = Object.keys(children.properties);
+  if (childNames.length === 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [...path, "properties"],
+      message: `"${name}" declares no settings. A group with nothing in it renders as an empty section.`
+    });
+  }
+  if (childNames.length > MAX_CONFIGURATION_CHILDREN) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [...path, "properties"],
+      message: `"${name}" may declare at most ${MAX_CONFIGURATION_CHILDREN} settings; found ${childNames.length}.`
+    });
+  }
+  if (property.type === "array" && property.default !== void 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: [...path, "default"],
+      message: `"${name}" is a list of groups and cannot declare a default. Declare defaults on the settings inside it.`
+    });
+  }
+  if (property.type === "array" && property.minItems !== void 0 && property.minItems > property.maxItems) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path,
+      message: `"${name}" has minItems greater than maxItems.`
+    });
+  }
+  for (const childName of childNames) {
+    checkPropertyDeclaration(childName, children.properties[childName], [...path, "properties", childName], ctx, false);
+  }
+  for (const required of children.required ?? []) {
+    if (!Object.hasOwn(children.properties, required)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...path, "required"],
+        message: `"${required}" is listed as required in "${name}" but is not one of its settings.`
+      });
+    }
+  }
+  const scoped = children;
+  if (scoped.dependentRequired !== void 0) {
+    checkDependentRequired(
+      { properties: children.properties, dependentRequired: scoped.dependentRequired },
+      ctx,
+      // An ARRAY's children live under `items`, which is where the key it
+      // constrains actually sits in the document.
+      property.type === "array" ? [...path, "items"] : path
+    );
+  }
+}
 var CustomerConfigurationV2Schema = CustomerConfigurationV2ObjectSchema.superRefine((config, ctx) => {
   const names = Object.keys(config.properties);
-  if (names.length > MAX_CONFIGURATION_PROPERTIES) {
+  if (names.length > MAX_CONFIGURATION_CHILDREN) {
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
       path: ["properties"],
-      message: `A Product may declare at most ${MAX_CONFIGURATION_PROPERTIES} customer settings; found ${names.length}.`
+      message: `A Product may declare at most ${MAX_CONFIGURATION_CHILDREN} root settings; found ${names.length}. Group them, or declare fewer.`
     });
   }
   let leaves = 0;
@@ -12797,64 +12969,7 @@ var CustomerConfigurationV2Schema = CustomerConfigurationV2ObjectSchema.superRef
     leaves += counted.leaves;
     nodes += counted.nodes;
     instantiated += counted.instantiated;
-    const children = childrenOf(property);
-    if (children === null) {
-      checkDeclaredProperty(name, property, path, ctx, true);
-      continue;
-    }
-    const infrastructure = infrastructureVocabularyViolation(name);
-    if (infrastructure) {
-      ctx.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path,
-        message: `${infrastructure}. Customer settings describe outcomes, not infrastructure.`
-      });
-    }
-    const platformOwned = platformOwnedFieldViolation(name);
-    if (platformOwned) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path, message: `${platformOwned}.` });
-    }
-    const childNames = Object.keys(children.properties);
-    if (childNames.length === 0) {
-      ctx.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [...path, "properties"],
-        message: `"${name}" declares no settings. A group with nothing in it renders as an empty section.`
-      });
-    }
-    if (childNames.length > MAX_CONFIGURATION_PROPERTIES) {
-      ctx.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [...path, "properties"],
-        message: `"${name}" may declare at most ${MAX_CONFIGURATION_PROPERTIES} settings; found ${childNames.length}.`
-      });
-    }
-    if (property.type === "array" && property.default !== void 0) {
-      ctx.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [...path, "default"],
-        message: `"${name}" is a list of groups and cannot declare a default. Declare defaults on the settings inside it.`
-      });
-    }
-    if (property.type === "array" && property.minItems !== void 0 && property.minItems > property.maxItems) {
-      ctx.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path,
-        message: `"${name}" has minItems greater than maxItems.`
-      });
-    }
-    for (const childName of childNames) {
-      checkDeclaredProperty(childName, children.properties[childName], [...path, "properties", childName], ctx, false);
-    }
-    for (const required of children.required ?? []) {
-      if (!Object.hasOwn(children.properties, required)) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [...path, "required"],
-          message: `"${required}" is listed as required in "${name}" but is not one of its settings.`
-        });
-      }
-    }
+    checkPropertyDeclaration(name, property, path, ctx, true);
   }
   if (leaves > MAX_CONFIGURATION_LEAVES) {
     ctx.addIssue({
@@ -12874,7 +12989,7 @@ var CustomerConfigurationV2Schema = CustomerConfigurationV2ObjectSchema.superRef
     ctx.addIssue({
       code: external_exports.ZodIssueCode.custom,
       path: ["properties"],
-      message: `This Product's settings could expand to ${instantiated} values \u2014 a list of groups instantiates its settings once per item. At most ${MAX_CONFIGURATION_VALUE_LEAVES} are allowed; reduce maxItems, or the number of settings inside the list.`
+      message: `This Product's settings could expand to ${instantiated} values. A list instantiates everything inside it once per item, so lists inside lists MULTIPLY. At most ${MAX_CONFIGURATION_VALUE_LEAVES} are allowed; reduce maxItems on the lists, or the number of settings inside them.`
     });
   }
   for (const name of config.required ?? []) {
@@ -12926,7 +13041,7 @@ function isSecretProperty(property) {
 }
 
 // ../product-configuration/dist/configuration-path.js
-var MAX_CONFIGURATION_PATH_SEGMENTS = MAX_CONFIGURATION_DEPTH + 1;
+var MAX_CONFIGURATION_PATH_SEGMENTS = 2 * MAX_CONFIGURATION_DEPTH - 1;
 function isIndexSegment(raw) {
   return /^\d+$/.test(raw) && String(Number(raw)) === raw;
 }
@@ -12960,6 +13075,9 @@ function pathSegments(path) {
   const raw = path.startsWith("/") ? path.slice(1).split("/") : [path];
   return raw.map((segment) => isIndexSegment(segment) ? Number(segment) : segment);
 }
+function rootSegment(path) {
+  return String(pathSegments(path)[0]);
+}
 function declarationPathOf(path) {
   const segments = pathSegments(path).filter((segment) => typeof segment !== "number");
   return configurationPath(...segments) ?? path;
@@ -13003,6 +13121,9 @@ function canonicalJson(value) {
 }
 
 // ../product-configuration/dist/configuration-tree.js
+function underList(node) {
+  return node.containers.some((container) => container.kind === "array");
+}
 function containerChildren(property) {
   if (property.type === "object" && property.properties !== void 0) {
     return {
@@ -13028,52 +13149,38 @@ function isConfigurationContainer(property) {
 }
 function configurationLeaves(schema) {
   const out = [];
-  for (const [name, property] of Object.entries(schema.properties)) {
-    const children = containerChildren(property);
-    if (children === null) {
-      const path = configurationPath(name);
-      if (path !== null) {
-        out.push({ path, name, property, container: null });
-      }
-      continue;
-    }
-    const containerPath = configurationPath(name);
-    if (containerPath === null)
-      continue;
-    const container = {
-      path: containerPath,
-      name,
-      kind: children.kind,
-      property,
-      required: children.required
-    };
-    for (const [childName, child] of Object.entries(children.properties)) {
-      const path = configurationPath(name, childName);
-      if (path === null)
-        continue;
-      out.push({ path, name: childName, property: child, container });
-    }
-  }
+  walkDeclarations(schema.properties, [], [], (leaf) => out.push(leaf));
   return out;
 }
 function configurationContainers(schema) {
   const out = [];
-  for (const [name, property] of Object.entries(schema.properties)) {
-    const children = containerChildren(property);
-    if (children === null)
-      continue;
-    const path = configurationPath(name);
+  walkDeclarations(schema.properties, [], [], () => {
+  }, (container) => out.push(container));
+  return out;
+}
+function walkDeclarations(properties, ancestors, base, onLeaf, onContainer = () => {
+}) {
+  for (const [name, property] of Object.entries(properties)) {
+    const segments = [...base, name];
+    const path = configurationPath(...segments);
     if (path === null)
       continue;
-    out.push({
+    const children = containerChildren(property);
+    if (children === null) {
+      onLeaf({ path, name, property, containers: ancestors });
+      continue;
+    }
+    const container = {
       path,
       name,
       kind: children.kind,
       property,
-      required: children.required
-    });
+      required: children.required,
+      containers: ancestors
+    };
+    onContainer(container);
+    walkDeclarations(children.properties, [...ancestors, container], segments, onLeaf, onContainer);
   }
-  return out;
 }
 function leafAt(schema, path) {
   const declaration = declarationPathOf(path);
@@ -13084,11 +13191,71 @@ function declaresPath(schema, path) {
     return true;
   return configurationContainers(schema).some((container) => container.path === declarationPathOf(path));
 }
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function valueAt(configuration, path) {
+  let cursor = configuration;
+  for (const segment of segmentsOf(path)) {
+    if (typeof segment === "number") {
+      if (!Array.isArray(cursor))
+        return void 0;
+      cursor = cursor[segment];
+      continue;
+    }
+    if (!isPlainObject(cursor))
+      return void 0;
+    cursor = cursor[segment];
+  }
+  return cursor;
+}
+function valuesAt(configuration, path) {
+  let cursors = [configuration];
+  for (const segment of segmentsOf(path)) {
+    const next = [];
+    for (const cursor of cursors) {
+      if (typeof segment === "number") {
+        if (Array.isArray(cursor))
+          next.push(cursor[segment]);
+        continue;
+      }
+      if (!isPlainObject(cursor))
+        continue;
+      const value = cursor[segment];
+      if (Array.isArray(value))
+        next.push(...value);
+      else
+        next.push(value);
+    }
+    cursors = next;
+  }
+  return cursors.filter((value) => value !== void 0);
+}
+function segmentsOf(path) {
+  const raw = path.startsWith("/") ? path.slice(1).split("/") : [path];
+  return raw.map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
+}
+
+// ../product-configuration/dist/value-condition.js
+function conditionSetting(condition) {
+  return "path" in condition ? condition.path : condition.property;
+}
+function conditionRoot(condition) {
+  const path = parseConfigurationPath(conditionSetting(condition));
+  return path === null ? conditionSetting(condition) : rootSegment(path);
+}
+function conditionHolds(condition, configuration) {
+  const path = parseConfigurationPath(conditionSetting(condition));
+  if (path === null)
+    return false;
+  const matches2 = (held) => typeof held === "string" && condition.anyOf.includes(held);
+  return "anyRow" in condition && condition.anyRow === true ? valuesAt(configuration, path).some(matches2) : matches2(valueAt(configuration, path));
+}
 
 // ../product-configuration/dist/customer-configuration-input.js
-var ABSOLUTE_MAX_STRING = 8192;
+var ABSOLUTE_MAX_STRING = MAX_DECLARABLE_STRING_LENGTH;
 var MAX_REPORTED_UNDECLARED_KEYS = 10;
-function isPlainObject(value) {
+function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function report(walk, field, message) {
@@ -13110,17 +13277,17 @@ function validateSubmittedConfiguration(schema, submitted, presence = {}) {
     referenced: new Set(presence.referenced ?? [])
   };
   const supplied = /* @__PURE__ */ new Set();
-  if (submitted !== void 0 && submitted !== null && !isPlainObject(submitted)) {
+  if (submitted !== void 0 && submitted !== null && !isPlainObject2(submitted)) {
     return {
       ok: false,
       issues: [{ field: "", message: "Configuration must be an object." }],
       partial: {}
     };
   }
-  const input = isPlainObject(submitted) ? submitted : {};
+  const input = isPlainObject2(submitted) ? submitted : {};
   const secrets = {};
   const configuration = validateObject({ properties: schema.properties, required: schema.required }, input, null, walk, { secrets, supplied });
-  drain(walk, crossFieldIssues(schema, supplied, presence));
+  drain(walk, crossFieldIssues(schema, supplied, presence, configuration));
   if (walk.suppressed > 0) {
     walk.issues.push({
       field: "",
@@ -13228,6 +13395,18 @@ function validateObject(declaration, input, container, walk, root) {
     }
     out[name] = checked;
   }
+  if (declaration.dependentRequired !== void 0) {
+    const suppliedHere = new Set(Object.keys(out));
+    for (const [trigger, dependents] of Object.entries(declaration.dependentRequired)) {
+      if (!suppliedHere.has(trigger) && !containsReferenced(walk, fieldFor(trigger)))
+        continue;
+      for (const dependent of dependents) {
+        if (suppliedHere.has(dependent) || containsReferenced(walk, fieldFor(dependent)))
+          continue;
+        report(walk, fieldFor(dependent), `This setting is required when ${labelOf(declaration, trigger)} is configured.`);
+      }
+    }
+  }
   return out;
 }
 function containerDeclaration(property) {
@@ -13236,6 +13415,9 @@ function containerDeclaration(property) {
       kind: "object",
       properties: property.properties,
       required: property.required,
+      // CARRIED THROUGH, or the rule the container declares is one the walk
+      // never sees — it publishes cleanly and enforces nothing.
+      dependentRequired: property.dependentRequired,
       maxItems: 1
     };
   }
@@ -13247,6 +13429,7 @@ function containerDeclaration(property) {
       kind: "array",
       properties: items.properties,
       required: items.required,
+      dependentRequired: items.dependentRequired,
       maxItems: property.maxItems ?? 0,
       minItems: property.minItems,
       uniqueItems: property.uniqueItems === true
@@ -13259,7 +13442,7 @@ function validateContainer(name, property, children, value, field, walk) {
   if (children.kind === "object") {
     if (value === void 0)
       return void 0;
-    if (!isPlainObject(value)) {
+    if (!isPlainObject2(value)) {
       report(walk, field, "Expected a group of settings.");
       return void 0;
     }
@@ -13286,7 +13469,7 @@ function validateContainer(name, property, children, value, field, walk) {
       report(walk, field, "This configuration has too many values.");
       break;
     }
-    if (!isPlainObject(element)) {
+    if (!isPlainObject2(element)) {
       report(walk, `${field}`, `Item ${index + 1} is not a group of settings.`);
       continue;
     }
@@ -13302,9 +13485,10 @@ function validateContainer(name, property, children, value, field, walk) {
   }
   return out;
 }
-function crossFieldIssues(schema, supplied, presence) {
+function crossFieldIssues(schema, supplied, presence, configuration = {}) {
   const clauses = Object.entries(schema.dependentRequired ?? {});
-  if (clauses.length === 0)
+  const conditional = Object.entries(schema.properties).filter(([, property]) => conditionOf(property) !== void 0);
+  if (clauses.length === 0 && conditional.length === 0)
     return [];
   const alsoPresent = /* @__PURE__ */ new Set([...presence.present ?? [], ...presence.referenced ?? []]);
   const unknown = new Set(presence.unknown ?? []);
@@ -13327,13 +13511,42 @@ function crossFieldIssues(schema, supplied, presence) {
       });
     }
   }
+  for (const [name, property] of conditional) {
+    const condition = conditionOf(property);
+    if (condition === void 0 || !known(name) || held(name))
+      continue;
+    if (!conditionHolds(condition, configuration))
+      continue;
+    if (reported.has(name))
+      continue;
+    reported.add(name);
+    issues.push({
+      field: name,
+      // THE SETTING THAT MADE IT NECESSARY, never the value it holds. A message
+      // naming the value would be fine here and wrong one refactor later, when
+      // somebody conditions a secret on another secret — which the publish rules
+      // refuse precisely because nothing may read one.
+      message: `This setting is required because of what ${labelOf(schema, conditionRoot(condition))} is set to.`
+    });
+  }
   return issues;
 }
+function conditionOf(property) {
+  return property?.["x-required-when"];
+}
 function labelOf(schema, name) {
   const property = schema.properties[name];
-  return property === void 0 ? `"${name}"` : `"${property.title}"`;
+  return property?.title === void 0 ? `"${name}"` : `"${property.title}"`;
 }
 function withoutCrossFieldRules(schema) {
+  const conditioned = Object.entries(schema.properties).some(([, property]) => property["x-required-when"] !== void 0);
+  if (conditioned) {
+    const properties = Object.fromEntries(Object.entries(schema.properties).map(([name, property]) => {
+      const { "x-required-when": _dropped, ...bare } = property;
+      return [name, bare];
+    }));
+    return withoutCrossFieldRules({ ...schema, properties });
+  }
   if (schema.dependentRequired === void 0)
     return schema;
   const { dependentRequired: _removed, ...rest } = schema;
@@ -13489,7 +13702,6 @@ function isSecret(declaration) {
 function seedConfiguration(configuration) {
   const properties = configuration?.properties ?? {};
   const required = new Set(configuration?.required ?? []);
-  const values = {};
   const open = [];
   const requiredSecrets = [];
   const groups = Object.entries(configuration?.dependentRequired ?? {}).map(([trigger, dependents]) => {
@@ -13500,8 +13712,13 @@ function seedConfiguration(configuration) {
       secrets: members.filter((name) => isSecret(properties[name] ?? {}))
     };
   }).sort((a, b) => a.trigger.localeCompare(b.trigger));
+  const values = seedProperties(properties, required, [], open, requiredSecrets);
+  return { values, open, requiredSecrets, groups };
+}
+function seedProperties(properties, required, ancestors, open, requiredSecrets) {
+  const values = {};
   for (const [name, declaration] of Object.entries(properties)) {
-    if (isSecret(declaration)) {
+    if (requiredSecrets !== null && isSecret(declaration)) {
       if (required.has(name))
         requiredSecrets.push(name);
       continue;
@@ -13510,12 +13727,14 @@ function seedConfiguration(configuration) {
     if (children !== null) {
       if (!required.has(name))
         continue;
+      const childRequired = new Set(children.required);
+      const inner = [...ancestors, name];
       if (children.kind === "object") {
-        values[name] = seedGroup(children, name, open);
+        values[name] = seedProperties(children.properties, childRequired, inner, open, null);
         continue;
       }
       const count = children.minItems ?? 0;
-      values[name] = Array.from({ length: count }, () => seedGroup(children, name, open));
+      values[name] = Array.from({ length: count }, () => seedProperties(children.properties, childRequired, inner, open, null));
       if (count > 1)
         dedupeOpen(open);
       continue;
@@ -13526,10 +13745,15 @@ function seedConfiguration(configuration) {
     }
     if (required.has(name)) {
       values[name] = "";
-      open.push({ name, label: name, type: declaration.type ?? null });
+      const path = configurationPath(...ancestors, name);
+      open.push({
+        name: path ?? name,
+        label: path === null ? name : printableConfigurationPath(path),
+        type: declaration.type ?? null
+      });
     }
   }
-  return { values, open, requiredSecrets, groups };
+  return values;
 }
 function containerChildren2(declaration) {
   const node = declaration;
@@ -13564,26 +13788,6 @@ function dedupeOpen(open) {
   open.length = 0;
   open.push(...unique);
 }
-function seedGroup(children, container, open) {
-  const required = new Set(children.required);
-  const values = {};
-  for (const [name, declaration] of Object.entries(children.properties)) {
-    if (declaration.default !== void 0) {
-      values[name] = declaration.default;
-      continue;
-    }
-    if (required.has(name)) {
-      values[name] = "";
-      const path = configurationPath(container, name);
-      open.push({
-        name: path ?? name,
-        label: path === null ? name : printableConfigurationPath(path),
-        type: declaration.type ?? null
-      });
-    }
-  }
-  return values;
-}
 function productInstanceExample(input) {
   return {
     apiVersion: RESOURCE_API_VERSION,
@@ -14506,7 +14710,7 @@ function checkProductDefinition(definition, ctx) {
       });
       return;
     }
-    if (leaf.container?.kind === "array") {
+    if (underList(leaf)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: [...at, member],
@@ -14545,6 +14749,91 @@ function checkProductDefinition(definition, ctx) {
       });
     }
   });
+  for (const [name, property] of Object.entries(definition.configuration.properties ?? {})) {
+    const condition = property["x-required-when"];
+    if (condition === void 0)
+      continue;
+    const at = ["configuration", "properties", name, "x-required-when"];
+    if (!isSecretProperty(property)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at],
+        message: `"${name}" is not a secret, so "x-required-when" has nothing to report through. Declare it "x-secret": true with "writeOnly": true, or use "dependentRequired" to require one ordinary setting alongside another.`
+      });
+      continue;
+    }
+    if (new Set(condition.anyOf).size !== condition.anyOf.length) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "anyOf"],
+        message: "Repeated values in `anyOf`."
+      });
+    }
+    if (condition.path === name) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${name}" cannot be conditioned on its own value.`
+      });
+      continue;
+    }
+    const parsed = parseConfigurationPath(condition.path);
+    const leaf = parsed === null ? null : leafAt(definition.configuration, parsed);
+    if (leaf === null) {
+      const isGroup = parsed !== null && declaresPath(definition.configuration, parsed);
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: isGroup ? `"${condition.path}" is a group of settings, which holds no single value to compare. Name one setting inside it.` : `"${condition.path}" is not a declared customer configuration property.`
+      });
+      continue;
+    }
+    if (underList(leaf) && condition.anyRow !== true) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${condition.path}" is inside a list, so it names one value per item rather than one value. Add "anyRow": true to require the secret when ANY row chose one of these values, or name a setting the instance holds exactly once.`
+      });
+      continue;
+    }
+    if (!underList(leaf) && condition.anyRow === true) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "anyRow"],
+        message: `"${condition.path}" is not inside a list, so there are no rows to quantify over.`
+      });
+    }
+    const target = leaf.property;
+    if (target.type !== "string") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${condition.path}" is a ${target.type} setting; a condition compares string values.`
+      });
+      continue;
+    }
+    if (isSecretProperty(target)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "path"],
+        message: `"${condition.path}" is a secret. The platform never reads a secret's value, so a condition on one could never be evaluated.`
+      });
+      continue;
+    }
+    const single = withoutCrossFieldRules({
+      ...definition.configuration,
+      properties: { [leaf.name]: target },
+      required: [leaf.name]
+    });
+    const outside = condition.anyOf.filter((value) => !validateSubmittedConfiguration(single, { [leaf.name]: value }).ok);
+    if (outside.length > 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [...at, "anyOf"],
+        message: `"${condition.path}" never accepts ${outside.map((v) => `"${v}"`).join(", ")}, so this condition could never make the secret required.`
+      });
+    }
+  }
   const provides = definition.serviceInterfaces?.provides ?? [];
   const provideKeys = provides.map((provide) => provide.key);
   const duplicateProvideKeys = provideKeys.filter((key, i) => provideKeys.indexOf(key) !== i);
@@ -16535,6 +16824,9 @@ function isTerminalAction(action) {
 }
 var ManifestActionSchema = external_exports.enum(MANIFEST_ACTIONS);
 
+// ../product-contracts/dist/contract-issue.js
+var MAX_SEGMENTS = MAX_CONFIGURATION_PATH_SEGMENTS + 2;
+
 // ../product-contracts/dist/resource-output-reference.js
 var OUTPUT_KEY_RULE = "Output keys are camelCase.";
 var ResourceOutputReferenceSchema = external_exports.object({
@@ -16925,7 +17217,7 @@ async function runApply(verb, parsed, deps = {}) {
   if (!planned.ok) return printError(planned.error, json);
   if (verb === "plan") {
     printPlan(planned.data, json);
-    if (isUnconverged(planned.data)) {
+    if (isUnconverged(planned.data) && planned.data.action === "NO_CHANGE") {
       if (!json) {
         process.stderr.write(
           `${planned.data.manifestKey ?? "This resource"} is ${planned.data.health?.status ?? "not serving"}. Its desired state is applied; it is not running. \`vfac get operation <id>\` says why.
@@ -16934,6 +17226,12 @@ async function runApply(verb, parsed, deps = {}) {
       }
       return 1;
     }
+    if (isUnconverged(planned.data) && !json) {
+      process.stderr.write(
+        `${planned.data.manifestKey ?? "This resource"} is ${planned.data.health?.status ?? "not serving"}. This plan changes it.
+`
+      );
+    }
     return 0;
   }
   const parsedAction = ManifestActionSchema.safeParse(planned.data.action);
@@ -17233,23 +17531,20 @@ async function runDoctor(parsed) {
   const compatible = compatibility(cliVersion(), probe.minimumCliVersion);
   checks.push(compatible);
   if (!compatible.ok) return report2(checks, json);
-  const signedIn = await signIn({ endpoint });
-  if (!signedIn.ok) {
-    checks.push({ name: "Context Gate", ok: false, detail: signedIn.message });
+  const session = await ensureSession({ endpointFlag: parsed.flags["endpoint"] });
+  if (!session.ok) {
+    checks.push({ name: "Sign-in", ok: false, detail: session.message });
     return report2(checks, json);
   }
   checks.push({
-    name: "Context Gate",
+    name: "Sign-in",
     ok: true,
-    detail: signedIn.gate ? `authenticated as "${signedIn.gate.name}" (${signedIn.gate.id})` : "authenticated"
+    detail: session.ready.via === "stored" ? "a stored sign-in is still valid, so no credential was spent" : session.ready.gate ? `authenticated as "${session.ready.gate.name}" (${session.ready.gate.id})` : "authenticated"
   });
-  if (!sessionUsable(stored.session, endpoint, /* @__PURE__ */ new Date())) {
-    writeStored({ ...stored, session: signedIn.session });
-  }
   const who = await call({
     endpoint,
     path: "/api/v1/whoami",
-    token: signedIn.session.token
+    token: session.ready.token
   });
   if (!who.ok) {
     checks.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",