Question: A puzzle on type-specification in a proc's arguments

I want to write a proc, say f, that takes an single argument Z, as in
f := proc(Z::?) ...
where the only acceptable Z values are pairs [x,y], where x and y are selected from the set {a,b,c,d}. The entries a,b,c,d of that set are prescribed symbolic constants. 

Thus, the following are legal calls to f:
f([a,a]), f([a,b]), f([d,c])
but these are illegal:
f([a]), f([a,b,c]), f([a,x])

I don't know what to put for the "::?" in the proc's definition in order to enforce those constraints.  Any ideas?

Extra: In fact, I would prefer to ban the f([a,a]) option as well (no repeated symbols) but that's of secondary importance since it is easy to inspect and handle that within the proc's body.

Please Wait...