@vxil/cli 0.1.0 → 0.2.0

package/dist/_vxil-feature-configs.d.ts

@@ -1,18 +1,23 @@
 import { type Static, type TSchema } from '@sinclair/typebox';
 export * from './_vxil-feature-configs-hooks.js';
 export * from './readmodels.js';
+export declare const RESERVED_CREDIT_TYPES: ReadonlySet<string>;
+/** True when a credit_type is a vxil-COGS reserved type (grant/consume/config
+ *  of which is restricted to internal platform machinery). */
+export declare function isReservedCreditType(creditType: string): boolean;
 export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     fromEmail: import("@sinclair/typebox").TString;
     fromName: import("@sinclair/typebox").TString;
     replyTo: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     resendApiKeyRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    webhookSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     provider: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resend">, import("@sinclair/typebox").TLiteral<"mock">]>;
     defaultLocale: import("@sinclair/typebox").TString;
-    retry: import("@sinclair/typebox").TObject<{
+    retry: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         maxAttempts: import("@sinclair/typebox").TInteger;
         backoff: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"exponential">, import("@sinclair/typebox").TLiteral<"linear">]>;
-    }>;
+    }>>;
     suppression: import("@sinclair/typebox").TObject<{
         softBounceThreshold: import("@sinclair/typebox").TInteger;
     }>;
@@ -25,8 +30,31 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
     }>;
     /** in-app inbox channel (send with channel: 'inbox' | 'both') */
     inboxEnabled: import("@sinclair/typebox").TBoolean;
+    /** §11b.5 broadcast campaigns channel. Optional bag (= 1 leaf): absent means
+     * disabled; per-campaign quiet_hours / freq_cap overrides live on the
+     * notifications.campaigns ROW (tenant data), not here. Folded into the
+     * canonical schema 2026-07-18 (M21/#4 — Value.Clean previously STRIPPED the
+     * worker-local extension, so campaigns 403'd via the real config path). */
+    broadcast: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        enabled: import("@sinclair/typebox").TBoolean;
+        /** tenant-default per-recipient quiet window (defer-not-drop); a
+         * per-campaign quiet_hours wins over it. Mirrors the campaigns-row shape
+         * (workers/notifications-v1 CampaignBody.quiet_hours). start/end are
+         * pattern-pinned to what the worker's parseHhMm actually parses — a
+         * looser string ('10pm') would validate but FAIL OPEN at runtime
+         * (quiet window silently ignored). */
+        defaultQuietHours: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            tz: import("@sinclair/typebox").TString;
+            start: import("@sinclair/typebox").TString;
+            end: import("@sinclair/typebox").TString;
+        }>>;
+        /** default rolling per-user-per-day campaign-send cap across campaigns */
+        freqCapPerUserPerDay: import("@sinclair/typebox").TInteger;
+    }>>;
 }>;
 export type NotificationsConfig = Static<typeof NotificationsConfigSchema>;
+/** The §11b.5 broadcast bag as persisted (present ⇒ leaf defaults applied). */
+export type BroadcastConfig = NonNullable<NotificationsConfig['broadcast']>;
 export declare const JobsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     retry: import("@sinclair/typebox").TObject<{
@@ -585,3 +613,19 @@ export declare const MCP_MAX_PROMPTS = 32;
  *  validation below and the control-plane deploy clamp. */
 export declare const DENY_FUNCTION_SCOPES: Set<string>;
 export declare function validateFeatureConfig(feature: string, raw: unknown): ConfigValidation;
+export declare const FEATURE_KEYS: readonly ["notifications", "jobs", "auth", "rate-limits", "files", "webhooks", "comments", "cms", "mcp", "realtime", "presence", "orgs", "activity-feed", "vector-search", "ai", "rag", "payments", "functions", "copilot"];
+export type FeatureKey = (typeof FEATURE_KEYS)[number];
+/** The hand-authored "when to use" intent a machine schema cannot convey.
+ *  REQUIRED for every feature (Record key-closure): a feature added to
+ *  FEATURE_KEYS without a hint is a compile error naming the missing key. */
+export interface PlannerHint {
+    /** One or two sentences: when an app needs this feature. */
+    whenToUse: string;
+    /** Soft priors — words/needs that suggest the feature (NOT a matcher). */
+    signals: string[];
+    /** When NOT to pick it (disambiguation vs neighbors). */
+    notFor: string;
+    /** Features that must be enabled alongside (runtime substrate deps). */
+    dependsOn: FeatureKey[];
+}
+export declare const FEATURE_HINTS: Record<FeatureKey, PlannerHint>;

package/dist/config.d.ts

@@ -14,7 +14,39 @@ export interface FieldDef {
     relationTo?: string;
     computed?: boolean;
     compute?: unknown;
+    /** Claims-table-enforced value uniqueness across live items (cms.md §9.3):
+     *  a duplicate write is a clean 409 unique_violation. Scalar types only
+     *  (string/int/float/datetime/relation/file). Carried on collection/field
+     *  CREATE by `vxil push` and server apply; since 2026-07-17 `vxil push` also
+     *  RECONCILES it on an existing same-type field (in-place alter via the REST
+     *  field re-add — packages/cli/src/cms.ts FIELD_ATTRS); attributes push
+     *  cannot reconcile surface as a visible plan warning, never a silent no-op. */
+    unique?: boolean;
+    /** Per-relation-field delete behavior (cms.md §11): bounded, atomic fan-out
+     *  when the referenced item is deleted. Same carriage + reconcile behavior
+     *  as `unique`. */
+    onDelete?: 'cascade' | 'set_null';
 }
+/** The CANONICAL field-attribute name set (config-side spelling), DERIVED from
+ *  `FieldDef` itself so it can never drift from the authoring type: it is every
+ *  key of `FieldDef` except `type` (which is required, not an optional carried
+ *  attribute). This is the compile-time source of truth for the config-carriage
+ *  completeness ratchet (audit 2026-07-15e #2, roadmap §4.5 P3): the CLI carriage
+ *  table (`packages/cli/src/cms.ts` FIELD_ATTRS) and the server one
+ *  (`workers/control-plane/src/handlers/apply.ts` FIELD_ATTR_DELTA) each pin
+ *  `keyof` coverage against a set that equals this — so a 9th attribute added to
+ *  `FieldDef` WITHOUT threading it through BOTH push paths is a tsc error naming
+ *  the uncovered key, not a silent half-carriage. */
+export type FieldAttrName = Exclude<keyof FieldDef, 'type'>;
+/** Compile-time exact-key closure helper: resolves to `Set` iff `Covered`
+ *  covers EVERY member of `Required` (i.e. `Required` is assignable to
+ *  `Covered`), else to the specific uncovered key literal(s) — so a `satisfies`
+ *  against the covered literal union produces a tsc error naming the field the
+ *  developer forgot to thread through the carriage table. Used by both push
+ *  paths' carriage tables to gate additions to `FieldAttrName`. */
+export type CoversFieldAttrs<Covered extends FieldAttrName> = [
+    FieldAttrName
+] extends [Covered] ? Covered : Exclude<FieldAttrName, Covered>;
 /** A CMS collection-as-code: collection slug → fields. */
 export interface CollectionDef {
     singular?: string;
@@ -23,9 +55,17 @@ export interface CollectionDef {
      *  existing `string` field on this collection that holds the owner (end-user)
      *  id. When set, the cms worker auto-scopes owned reads/writes to the VERIFIED
      *  end-user principal in end-user mode (default-deny) — and is a no-op in
-     *  server-caller mode. NOT an RLS predicate; a single declarative flag the
-     *  typed worker consults. Omit for shared/reference collections. */
+     *  server-caller mode. Not a hard-isolation predicate; a single declarative
+     *  flag the typed worker consults. Omit for shared/reference collections. */
     ownerField?: string;
+    /** Public delivery (roadmap §4.4): when true, this collection's PUBLISHED items
+     *  are servable through the keyless, edge-cached GET /v1/cms/public/:tenantId/
+     *  :collection lane (no API key). Owner-UNSCOPED (public content, not per-user);
+     *  the owner_field is stripped from every served row. Default false. Carried by
+     *  BOTH push paths (the `vxil push` cms reconciler AND control-plane /v1/apply)
+     *  with a regression test on each — an attribute read by no enforcing path ships
+     *  inert (the validation.unique / owner_field precedent). */
+    public?: boolean;
 }
 /** A function trigger (the §7.3 crossing). cmsHook fires on a CMS write;
  * authHook is the post-signup hook (fires on `auth.user.created`,
@@ -77,7 +117,7 @@ export interface FunctionDef {
 }
 /** A secret REFERENCE (never a value). `vxil secrets set <name>` writes the value. */
 export interface SecretRef {
-    /** which feature's KEK the value is envelope-encrypted under. */
+    /** which feature the value is encrypted at rest under. */
     feature: string;
     description?: string;
 }