@vxil/cli 0.21.0 → 0.23.0

package/dist/_vxil-feature-configs.d.ts

@@ -15,6 +15,11 @@ export declare const RESERVED_CREDIT_TYPES: ReadonlySet<string>;
  *  Read by the schema, the deploy clamp and the CLI. */
 export declare const FN_RETRY_MAX_ATTEMPTS = 5;
 export declare const FN_RETRY_BINDING_KINDS: ReadonlySet<string>;
+/** An `http` binding's caps (2026-10-11; rules at fnForwardHeadersError /
+ *  fnServerScopesError). Up here because the schema below reads them. */
+export declare const FN_FORWARD_HEADERS_MAX = 8;
+export declare const FN_FORWARD_HEADER_VALUE_MAX = 256;
+export declare const FN_SERVER_SCOPES_MAX = 32;
 /** True when a credit_type is a vxil-COGS reserved type (grant/consume/config
  *  of which is restricted to internal platform machinery). */
 export declare function isReservedCreditType(creditType: string): boolean;
@@ -710,6 +715,7 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
                 amount: import("@sinclair/typebox").TInteger;
                 period: import("@sinclair/typebox").TString;
                 mode: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"add">, import("@sinclair/typebox").TLiteral<"reset">]>>;
+                expireOnEnd: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
             }>>>;
         }>>;
         priceMap: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TString>>;
@@ -744,6 +750,8 @@ export declare const FunctionsConfigSchema: import("@sinclair/typebox").TObject<
                 maxAttempts: import("@sinclair/typebox").TInteger;
             }>>;
             overlap: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"allow">, import("@sinclair/typebox").TLiteral<"skip">]>>;
+            forwardHeaders: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+            serverScopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         }>>>;
         scriptRef: import("@sinclair/typebox").TString;
         scopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
@@ -824,12 +832,12 @@ export type AuthHookEvent = (typeof AUTH_HOOK_EVENTS)[number];
 /** The events a `cmsHook` function binding may name — the closed union
  * `packages/config` types on the `cmsHook` trigger, and the keys of the
  * functions-v1 receiver's CMS_HOOK_EVENTS_FOR (beforeCreate → created,
- * beforeUpdate → updated, beforeWrite → both). Omitted = beforeWrite. Anything
+ * beforeUpdate → updated, beforeWrite → both, afterPublish → published). Omitted = beforeWrite. Anything
  * else is refused at config write (E-CMSHOOK, 2026-10-01): an unknown name used
  * to fall back to beforeWrite at delivery, so a typo like 'afterCreate' or
  * 'beforeDelete' silently subscribed the function to creates AND updates.
  * A CI gate pins every copy to this list. */
-export declare const CMS_HOOK_EVENTS: readonly ["beforeCreate", "beforeUpdate", "beforeWrite"];
+export declare const CMS_HOOK_EVENTS: readonly ["beforeCreate", "beforeUpdate", "beforeWrite", "afterPublish"];
 export type CmsHookEvent = (typeof CMS_HOOK_EVENTS)[number];
 /** The ONE refusal text for an unknown cmsHook binding event (the config
  * validator and the deploy route's early 422 both use it). */
@@ -869,6 +877,13 @@ export declare const MCP_MAX_PROMPTS = 32;
  *  stays ALLOWED (fn→fn composition). Source of truth for both the config-write
  *  validation below and the control-plane deploy clamp. */
 export declare const DENY_FUNCTION_SCOPES: Set<string>;
+export declare function fnForwardHeadersError(raw: unknown): string | null;
+/** FN-SERVER-SCOPES: an `http` binding's `serverScopes` — the scopes of the
+ *  tenant-only tokens (`server_jwts`) minted next to the caller-bound ones.
+ *  Each must be one of the function's own `scopes` (pass `fnScopes` once they
+ *  are known; undefined checks the shape only), so a caller can never reach
+ *  more than the author granted the function. */
+export declare function fnServerScopesError(raw: unknown, fnScopes?: readonly string[]): string | null;
 /** `{var}` names of a rate-limit key template (rate-limits-v1 core.ts
  *  templateVars parity). */
 export declare function rlTemplateVars(template: string): string[];

package/dist/config.d.ts

@@ -178,10 +178,18 @@ export interface FunctionTriggerRetry {
 /** A function trigger (guide ch. 8). cmsHook fires on a CMS write;
  * authHook fires on ONE auth lifecycle event (default `user.created` — the
  * post-signup hook; at-least-once, ~1min fanout latency). */
-export type FunctionTrigger = {
+export type FunctionTrigger = 
+/** `http` (2026-10-11): `forwardHeaders` — up to 8 `x-…` request header
+ *  names copied into the envelope's `client.headers` (caller-asserted: never
+ *  for authorization); `serverScopes` — scopes (each one of the function's
+ *  own `scopes`) of extra tenant-only tokens, `server_jwts`, for writes the
+ *  end user must not make. */
+{
     kind: 'http';
     path?: string;
     retry?: FunctionTriggerRetry;
+    forwardHeaders?: string[];
+    serverScopes?: string[];
 }
 /** `overlap: 'skip'` (2026-10-01): a due tick fires nothing while the
  *  previous tick's run is still open (queued / running / retrying / waiting /
@@ -206,21 +214,24 @@ export type FunctionTrigger = {
  *  name — lowercase dotted segments, ≤64 chars, validated at deploy — and is
  *  also enforced at delivery: a non-matching event is ACK-200 skipped.
  *  Declaring the binding is what opts the function into event delivery; a
- *  receiver that declares only `cron` keeps the older cron+{} wake. */
+ *  receiver that declares only `cron` keeps the older cron+{} wake.
+ *  `source` is optional: a bare `{ kind: 'webhook' }` receives every event. */
  | {
     kind: 'webhook';
-    source: string;
+    source?: string;
     retry?: FunctionTriggerRetry;
 }
 /** `cmsHook`: fires after a CMS write in `collection`. The platform filters
  *  deliveries on the binding (2026-09-19): `beforeCreate` → created only,
- *  `beforeUpdate` → updated only, `beforeWrite` → created|updated; a write to
- *  another collection never wakes the function. Deleted/bulk events are not
- *  delivered to a cmsHook binding. */
+ *  `beforeUpdate` → updated only, `beforeWrite` → created|updated,
+ *  `afterPublish` → published (a draft→published transition is its own event,
+ *  not an update); a write to another collection never wakes the function.
+ *  Deleted/bulk events are not delivered to a cmsHook binding. `event`
+ *  defaults to `beforeWrite`. */
  | {
     kind: 'cmsHook';
     collection: string;
-    event: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite';
+    event?: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite' | 'afterPublish';
     retry?: FunctionTriggerRetry;
 } | {
     kind: 'authHook';