@pellux/goodvibes-tui 1.25.0 → 1.26.0

package/src/verification/verification-ledger.ts

@@ -70,12 +70,20 @@ const SETTINGS_BEHAVIOR_BASELINE = 184;
  * overlaps neither other counted set, so nothing is double-counted and nothing
  * drifts in uncounted.
  *
- * PER-KEY EVIDENCE. All 25 are read by a LIVE consumer, which is why they were
+ * PER-KEY EVIDENCE. All 42 are read by a LIVE consumer, which is why they were
  * declared at all: the SDK's mail and calendar gateway compositions
  * (platform/email/surface-config.ts and platform/calendar/caldav-gateway-config.ts)
- * resolve every one of them when the daemon serves `email.*` and `calendar.*`.
- * The three password keys additionally resolve through the daemon secret tier
- * rather than from config, and carry no secret value in config themselves.
+ * resolve every one of them when the daemon serves `email.*` and `calendar.*`,
+ * and the `surfaces.email.inbound.*` block is read by the daemon's inbound mail
+ * reader — the poller/IDLE path that makes incoming mail visible at all.
+ * The five password keys (email.password, email.imapPassword,
+ * email.imap.password, email.smtp.password, calendar.caldavPassword)
+ * additionally resolve through the daemon secret tier rather than from config,
+ * and carry no secret value in config themselves. That is now enforced on the
+ * write side too: all five are in `config/secret-config.ts`'s
+ * SECRET_CONFIG_KEYS, so the settings modal and `/config set` route an entered
+ * value into the secret store and leave only a `goodvibes://` reference in
+ * config, rather than writing the password itself into a settings file.
  */
 export const DAEMON_MAILBOX_LOCAL_SETTINGS = [
   'surfaces.email.host',
@@ -98,6 +106,31 @@ export const DAEMON_MAILBOX_LOCAL_SETTINGS = [
   'surfaces.email.smtp.port',
   'surfaces.email.smtp.password',
   'surfaces.email.smtp.secure',
+  // Inbound mail — the poller/IDLE reader the daemon runs to actually READ mail,
+  // which arrived with the platform runtime. These are counted for exactly the
+  // reason the keys above are: the same four-part persistence contract runs over
+  // every one of them in
+  // src/test/verification/daemon-mailbox-settings-persistence.test.ts, and the
+  // list is asserted there to be the complete surfaces.email.*/surfaces.calendar.*
+  // schema set. Arriving uncounted is what dropped localBehaviorPercent through
+  // its floor when the schema grew.
+  'surfaces.email.inbound.enabled',
+  'surfaces.email.inbound.accounts',
+  'surfaces.email.inbound.source',
+  'surfaces.email.inbound.gmailPollSecondsExpecting',
+  'surfaces.email.inbound.gmailPollSecondsIdle',
+  'surfaces.email.inbound.mode',
+  'surfaces.email.inbound.pollIntervalSeconds',
+  'surfaces.email.inbound.idleReissueMinutes',
+  'surfaces.email.inbound.reconnect.maxBackoffSeconds',
+  'surfaces.email.inbound.notice.route',
+  'surfaces.email.inbound.notice.mode',
+  'surfaces.email.inbound.expectationWindowMinutes',
+  'surfaces.email.inbound.dedupTtlMinutes',
+  'surfaces.email.inbound.retentionDays',
+  'surfaces.email.inbound.maxRecords',
+  'surfaces.email.inbound.capabilityRecheckMinutes',
+  'surfaces.email.inbound.onInsufficientCapability',
   'surfaces.calendar.caldavUrl',
   'surfaces.calendar.caldavUser',
   'surfaces.calendar.caldavPassword',
@@ -300,11 +333,78 @@ export const CLUSTER_GROUP_LOCAL_SETTINGS = [
   'cluster.rosterGossipSeconds',
 ] as const;
 
+/**
+ * Config keys for the daemon's payment capability: the master switch, which
+ * card to use by default, the settlement currency, CVV handling, the six
+ * budget knobs, the shipping-tier preference, the fourteen billing/shipping
+ * address sub-fields, the two approval/veto windows, and the notify-channel
+ * list. Card MATERIAL (number, expiry, CVV, cardholder name) is intentionally
+ * NOT here — see the SDK's schema-domain-payments.ts header and this repo's
+ * own input/payments-config.ts: that material lives write-only in the daemon
+ * secret store, never in CONFIG_SCHEMA, so there is nothing for a persistence
+ * contract to count.
+ *
+ * THIS CONSTANT IS NOT A DIAL, for the same reason as the sets above. Every
+ * key below is counted because
+ * `src/test/verification/payments-settings-persistence.test.ts` runs the same
+ * four-part persistence contract the other counted sets are counted for:
+ * schema default exposure, `set()` through the key's own validator to disk,
+ * reload into a fresh ConfigManager with read-back equality, and
+ * reset-to-default that also survives reload. That test also asserts this
+ * list is exactly the CONFIG_SCHEMA's `payments.*` key set, so a future SDK
+ * addition under this domain is caught (fails the inventory-integrity test)
+ * rather than silently uncounted.
+ *
+ * PER-KEY EVIDENCE. All 28 are read by the daemon's own payment capability
+ * (platform/payments, platform/control-plane/routes/payments.ts): the budget
+ * keys size the daily/overage/tolerance pools, the window keys size the
+ * veto/approval timers, cvvHandling and shipping.preferredTier select the
+ * enum behaviors `platform/payments` documents, and the address sub-fields
+ * are read directly by the daemon's shipping-address-required refusal and the
+ * card-issuer address-verification path. `enabled` and `defaultCardId` gate
+ * and select, respectively, whether/which card a purchase uses.
+ */
+export const PAYMENTS_LOCAL_SETTINGS = [
+  'payments.enabled',
+  'payments.defaultCardId',
+  'payments.currency',
+  'payments.cvvHandling',
+  'payments.budget.dailyItemCents',
+  'payments.budget.dailyOverageCents',
+  'payments.budget.perPurchaseCeilingEnabled',
+  'payments.budget.perPurchaseCeilingCents',
+  'payments.budget.overageToleranceEnabled',
+  'payments.budget.overageToleranceDailyAllowanceCents',
+  'payments.shipping.preferredTier',
+  'payments.billingAddress.name',
+  'payments.billingAddress.line1',
+  'payments.billingAddress.line2',
+  'payments.billingAddress.city',
+  'payments.billingAddress.region',
+  'payments.billingAddress.postalCode',
+  'payments.billingAddress.country',
+  'payments.shippingAddress.name',
+  'payments.shippingAddress.line1',
+  'payments.shippingAddress.line2',
+  'payments.shippingAddress.city',
+  'payments.shippingAddress.region',
+  'payments.shippingAddress.postalCode',
+  'payments.shippingAddress.country',
+  'payments.windows.vetoMinutes',
+  'payments.windows.approvalMinutes',
+  'payments.majorRetailersAdditional',
+  'payments.majorRetailersExcluded',
+  'payments.ebayMinSellerFeedbackCount',
+  'payments.ebayMinSellerPositivePercent',
+  'payments.notifyChannels',
+] as const;
+
 const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE
   + FEATURE_KNOB_LOCAL_SETTINGS.length
   + DEVICE_AND_TRIGGER_LOCAL_SETTINGS.length
   + CLUSTER_GROUP_LOCAL_SETTINGS.length
   + DAEMON_MAILBOX_LOCAL_SETTINGS.length
+  + PAYMENTS_LOCAL_SETTINGS.length
   + ENABLEMENT_KEYS_BEHAVIOR_VERIFIED;
 
 const EXTERNAL_SLASH_COMMANDS = new Set([

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.25.0';
+let _version = '1.26.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file