@vxil/cli 0.22.0 → 0.24.0

package/dist/_vxil-feature-configs-apiState.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredRlPolicy, DeclaredWebhookSubscription } from './_vxil-feature-configs.js';
+import type { DeclaredOrgRole, DeclaredRlPolicy, DeclaredWebhookSubscription } from './_vxil-feature-configs.js';
 /** The target_url path markers of the platform's function-delivery lanes
  *  (control-plane fnCmsHooks.ts FN_CMSHOOK_PATH / FN_AUTHHOOK_PATH /
  *  FN_WEBHOOK_TRIGGER_PATH — mirrored here because this package is
@@ -6,7 +6,7 @@ import type { DeclaredRlPolicy, DeclaredWebhookSubscription } from './_vxil-feat
  *  manifest by the deploy reconciler: never declarable, never "undeclared". */
 export declare const FN_TRIGGER_TARGET_MARKERS: readonly ["/v1/internal/fn/cms-hook/", "/v1/internal/fn/auth-hook/", "/v1/internal/fn/trigger/"];
 export declare function isFnTriggerSubscriptionUrl(targetUrl: string): boolean;
-export type ApiStateDatum = 'policies' | 'subscriptions' | 'templates';
+export type ApiStateDatum = 'policies' | 'subscriptions' | 'templates' | 'roles';
 /** feature → the declared-API-state datum its config block may carry. */
 export declare const API_STATE_DATUMS: ReadonlyArray<{
     feature: string;
@@ -126,6 +126,27 @@ export interface AiTemplatePlan {
     unknownContent: string[];
 }
 export declare function planAiTemplates(declared: readonly HashedDeclaredAiTemplate[], live: readonly LiveAiTemplate[]): AiTemplatePlan;
+/** ONE CUSTOM row of GET /v1/orgs/roles (`data.custom`; the `data.builtin`
+ *  sets are fixed and never planned). */
+export interface LiveOrgRole {
+    role_key: string;
+    name: string;
+    permissions: string[];
+    rank?: number | null;
+}
+export interface OrgRolePlan {
+    create: DeclaredOrgRole[];
+    /** name / permission SET / rank differs — POST /v1/orgs/roles upserts on
+     *  role_key in place (members keep the role), so never destructive-shaped */
+    update: Array<{
+        role: DeclaredOrgRole;
+        changed: string[];
+    }>;
+    unchanged: string[];
+    /** live custom roles the config does not declare (left in place by default) */
+    undeclared: string[];
+}
+export declare function planOrgRoles(declared: readonly DeclaredOrgRole[], live: readonly LiveOrgRole[]): OrgRolePlan;
 export interface ApiStateSummary {
     datum: ApiStateDatum;
     created: string[];
@@ -174,6 +195,13 @@ export declare const API_STATE_DISABLED_NOTE = "feature disabled \u2014 declarat
  *  converge and the CLI's read-only plan refuse with this message instead. */
 export declare function rlPolicyListCapError(liveCount: number): string | null;
 export declare const RL_POLICY_LIST_CAP = 100;
+/** `orgs.roles[]` is declared with at most this many entries (OrgsConfigSchema
+ *  maxItems), but orgs-v1 defineRole has NO per-tenant cap — a tenant past it
+ *  cannot round-trip its catalog through the config block. `vxil pull`
+ *  (2026-10-11) refuses to write the leaf rather than emit a config that fails
+ *  validation. */
+export declare function orgRoleListCapError(liveCount: number): string | null;
+export declare const ORG_ROLE_DECLARED_CAP = 100;
 /** `+2 created · ~1 updated · =3 unchanged · 1 undeclared (left in place)` —
  *  the one-line summary `vxil push` prints and the apply journal notes. */
 export declare function formatApiStateSummary(s: ApiStateSummary): string;

package/dist/_vxil-feature-configs-feedGroups.d.ts

@@ -0,0 +1,7 @@
+/** The three feed groups every tenant has without config. A declared
+ *  `feedGroups` entry is MERGED over these by name at read time (the worker's
+ *  feedTypeFor), so declaring a custom group never drops the built-ins. */
+export declare const ACTIVITY_FEED_BUILTIN_GROUPS: Record<string, {
+    type: 'flat' | 'aggregated' | 'notification';
+    aggregation?: string;
+}>;

package/dist/_vxil-feature-configs.d.ts

@@ -1,4 +1,5 @@
 import { type Static, type TSchema } from '@sinclair/typebox';
+import { ACTIVITY_FEED_BUILTIN_GROUPS } from './_vxil-feature-configs-feedGroups.js';
 export { AI_THINKING_LEVELS, geminiThinkingLevelError, minimalThinkingLevel, type GeminiThinkingLevel } from './_vxil-feature-configs-geminiThinking.js';
 export * from './_vxil-feature-configs-hooks.js';
 export * from './_vxil-feature-configs-readmodels.js';
@@ -15,6 +16,16 @@ export declare const RESERVED_CREDIT_TYPES: ReadonlySet<string>;
  *  Read by the schema, the deploy clamp and the CLI. */
 export declare const FN_RETRY_MAX_ATTEMPTS = 5;
 export declare const FN_RETRY_BINDING_KINDS: ReadonlySet<string>;
+/** An `http` binding's caps (2026-10-11; rules at fnForwardHeadersError /
+ *  fnServerScopesError). Up here because the schema below reads them. */
+export declare const FN_FORWARD_HEADERS_MAX = 8;
+export declare const FN_FORWARD_HEADER_VALUE_MAX = 256;
+export declare const FN_SERVER_SCOPES_MAX = 32;
+/** G-37 (2026-10-11): a function's plain `vars` (never secret) — at most
+ *  FN_VARS_MAX names of FN_VAR_NAME_RE, FN_VARS_MAX_BYTES of JSON in all
+ *  (rules at fnVarsError). Delivered on the envelope as `vars`. */
+export declare const FN_VARS_MAX = 32;
+export declare const FN_VARS_MAX_BYTES = 4096;
 /** True when a credit_type is a vxil-COGS reserved type (grant/consume/config
  *  of which is restricted to internal platform machinery). */
 export declare function isReservedCreditType(creditType: string): boolean;
@@ -513,13 +524,38 @@ export declare const PresenceConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
 }>;
 export type PresenceConfig = Static<typeof PresenceConfigSchema>;
+/** The orgs-v1 built-in role keys (core.ts ROLE_RANK): fixed sets that are
+ *  never declared, redefined or deleted — a custom role picks another key. */
+export declare const ORG_BUILTIN_ROLE_KEYS: readonly ["owner", "admin", "member", "viewer"];
+/** One declared custom org role (G-31, 2026-10-11) — the POST /v1/orgs/roles
+ *  body (orgs-v1 core.ts RoleBody), converged by `role_key` by `vxil push` /
+ *  `POST /v1/apply` (control-plane handlers/apiState.ts). */
+export declare const DeclaredOrgRoleSchema: import("@sinclair/typebox").TObject<{
+    role_key: import("@sinclair/typebox").TString;
+    name: import("@sinclair/typebox").TString;
+    permissions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    rank: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+}>;
+export type DeclaredOrgRole = Static<typeof DeclaredOrgRoleSchema>;
 export declare const OrgsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     maxOrgsPerTenant: import("@sinclair/typebox").TInteger;
     maxMembersPerOrg: import("@sinclair/typebox").TInteger;
     invitationTtlHours: import("@sinclair/typebox").TInteger;
+    roles: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        role_key: import("@sinclair/typebox").TString;
+        name: import("@sinclair/typebox").TString;
+        permissions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        rank: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+    }>>>;
 }>;
 export type OrgsConfig = Static<typeof OrgsConfigSchema>;
+export { ACTIVITY_FEED_BUILTIN_GROUPS };
+/** Config-write errors for activity-feed feedGroups (FEED-HYGIENE). */
+export declare function validateFeedGroups(groups: Record<string, {
+    type?: string;
+    aggregation?: string;
+}> | undefined): string[];
 export declare const ActivityFeedConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     feedGroups: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
@@ -530,8 +566,6 @@ export declare const ActivityFeedConfigSchema: import("@sinclair/typebox").TObje
     fanout: import("@sinclair/typebox").TObject<{
         celebrityThreshold: import("@sinclair/typebox").TInteger;
         maxFanoutPerJob: import("@sinclair/typebox").TInteger;
-        maxConcurrentTasks: import("@sinclair/typebox").TInteger;
-        pendingCeiling: import("@sinclair/typebox").TInteger;
     }>;
     follow: import("@sinclair/typebox").TObject<{
         copyLimit: import("@sinclair/typebox").TInteger;
@@ -541,7 +575,6 @@ export declare const ActivityFeedConfigSchema: import("@sinclair/typebox").TObje
         enabled: import("@sinclair/typebox").TBoolean;
     }>;
     crossChannel: import("@sinclair/typebox").TObject<{
-        enabled: import("@sinclair/typebox").TBoolean;
         digestCadence: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"off">, import("@sinclair/typebox").TLiteral<"hourly">, import("@sinclair/typebox").TLiteral<"daily">]>;
     }>;
 }>;
@@ -710,6 +743,7 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
                 amount: import("@sinclair/typebox").TInteger;
                 period: import("@sinclair/typebox").TString;
                 mode: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"add">, import("@sinclair/typebox").TLiteral<"reset">]>>;
+                expireOnEnd: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
             }>>>;
         }>>;
         priceMap: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TString>>;
@@ -744,10 +778,13 @@ export declare const FunctionsConfigSchema: import("@sinclair/typebox").TObject<
                 maxAttempts: import("@sinclair/typebox").TInteger;
             }>>;
             overlap: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"allow">, import("@sinclair/typebox").TLiteral<"skip">]>>;
+            forwardHeaders: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+            serverScopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         }>>>;
         scriptRef: import("@sinclair/typebox").TString;
         scopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         secrets: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        vars: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TString>>;
         egressAllow: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         runtime: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
             compatibilityDate: import("@sinclair/typebox").TString;
@@ -869,10 +906,21 @@ export declare const MCP_MAX_PROMPTS = 32;
  *  stays ALLOWED (fn→fn composition). Source of truth for both the config-write
  *  validation below and the control-plane deploy clamp. */
 export declare const DENY_FUNCTION_SCOPES: Set<string>;
+export declare function fnForwardHeadersError(raw: unknown): string | null;
+/** G-37: a function's `vars` — a plain-text string map (never a secret: it
+ *  sits in the published manifest and every config version). */
+export declare function fnVarsError(raw: unknown): string | null;
+/** FN-SERVER-SCOPES: an `http` binding's `serverScopes` — the scopes of the
+ *  tenant-only tokens (`server_jwts`) minted next to the caller-bound ones.
+ *  Each must be one of the function's own `scopes` (pass `fnScopes` once they
+ *  are known; undefined checks the shape only), so a caller can never reach
+ *  more than the author granted the function. */
+export declare function fnServerScopesError(raw: unknown, fnScopes?: readonly string[]): string | null;
 /** `{var}` names of a rate-limit key template (rate-limits-v1 core.ts
  *  templateVars parity). */
 export declare function rlTemplateVars(template: string): string[];
 export declare function validateDeclaredRlPolicies(policies: readonly DeclaredRlPolicy[] | undefined): string[];
+export declare function validateDeclaredOrgRoles(roles: readonly DeclaredOrgRole[] | undefined): string[];
 export declare function validateDeclaredWebhookSubscriptions(subscriptions: readonly DeclaredWebhookSubscription[] | undefined, maxSubscriptions: number | undefined): string[];
 /** The stored-template `schema` bounds — MIRRORED from @vxil/runtime
  *  (AI_TEMPLATE_SCHEMA_MAX_BYTES / AI_TEMPLATE_SCHEMA_MAX_DEPTH; this package is

package/dist/config.d.ts

@@ -178,10 +178,18 @@ export interface FunctionTriggerRetry {
 /** A function trigger (guide ch. 8). cmsHook fires on a CMS write;
  * authHook fires on ONE auth lifecycle event (default `user.created` — the
  * post-signup hook; at-least-once, ~1min fanout latency). */
-export type FunctionTrigger = {
+export type FunctionTrigger = 
+/** `http` (2026-10-11): `forwardHeaders` — up to 8 `x-…` request header
+ *  names copied into the envelope's `client.headers` (caller-asserted: never
+ *  for authorization); `serverScopes` — scopes (each one of the function's
+ *  own `scopes`) of extra tenant-only tokens, `server_jwts`, for writes the
+ *  end user must not make. */
+{
     kind: 'http';
     path?: string;
     retry?: FunctionTriggerRetry;
+    forwardHeaders?: string[];
+    serverScopes?: string[];
 }
 /** `overlap: 'skip'` (2026-10-01): a due tick fires nothing while the
  *  previous tick's run is still open (queued / running / retrying / waiting /
@@ -248,8 +256,16 @@ export interface FunctionDef {
      *  functions:write, secrets:write rejected; payments:write / notifications:send /
      *  users:* allowed as owner-granted business scopes). */
     scopes?: string[];
-    /** Names of tenant secrets injected into the function at invoke time. */
+    /** Names of tenant secrets injected into the function at invoke time. A
+     *  trailing `?` (`'stripe_key?'`) marks one optional: unset, it is
+     *  simply absent from `secrets`; an unset required one answers 409
+     *  `secret_missing` on every invoke. */
     secrets?: string[];
+    /** Plain settings delivered on the envelope as `vars` — a dashboard
+     *  URL, a pinned org slug, a threshold. Plain text stored in the published
+     *  config, NEVER a secret (use `secrets` for those). At most 32 names of
+     *  `[A-Za-z_][A-Za-z0-9_]{0,63}`, 4 096 bytes of JSON in all. */
+    vars?: Record<string, string>;
     /** Outbound host allowlist (deny-by-default egress guard). */
     egressAllow?: string[];
     /** Per-function resource declarations. Both optional; both clamped server-side.
@@ -294,10 +310,16 @@ export interface SecretRef {
     feature: string;
     description?: string;
 }
-/** Optional deterministic seed, applied via the per-feature import bundle. */
+/** Optional deterministic seed, applied by `vxil seed` as per-item
+ *  `POST /v1/cms/items/:collection` creates (one per row). */
 export interface SeedSpec {
+    /** `status`: what every item of the block is created as —
+     *  `'published'` lands seed rows live on a `draftPublish` collection.
+     *  Absent = the collection's default (draft under draftPublish). Set on
+     *  the block, not the item, so a field named `status` stays your data. */
     cms?: {
         collection: string;
+        status?: 'draft' | 'published';
         items: Record<string, unknown>[];
     }[];
     users?: {