@vxil/cli 0.23.0 → 0.24.0

package/dist/_vxil-feature-configs-apiState.d.ts

@@ -1,4 +1,4 @@
-import type { DeclaredRlPolicy, DeclaredWebhookSubscription } from './_vxil-feature-configs.js';
+import type { DeclaredOrgRole, DeclaredRlPolicy, DeclaredWebhookSubscription } from './_vxil-feature-configs.js';
 /** The target_url path markers of the platform's function-delivery lanes
  *  (control-plane fnCmsHooks.ts FN_CMSHOOK_PATH / FN_AUTHHOOK_PATH /
  *  FN_WEBHOOK_TRIGGER_PATH — mirrored here because this package is
@@ -6,7 +6,7 @@ import type { DeclaredRlPolicy, DeclaredWebhookSubscription } from './_vxil-feat
  *  manifest by the deploy reconciler: never declarable, never "undeclared". */
 export declare const FN_TRIGGER_TARGET_MARKERS: readonly ["/v1/internal/fn/cms-hook/", "/v1/internal/fn/auth-hook/", "/v1/internal/fn/trigger/"];
 export declare function isFnTriggerSubscriptionUrl(targetUrl: string): boolean;
-export type ApiStateDatum = 'policies' | 'subscriptions' | 'templates';
+export type ApiStateDatum = 'policies' | 'subscriptions' | 'templates' | 'roles';
 /** feature → the declared-API-state datum its config block may carry. */
 export declare const API_STATE_DATUMS: ReadonlyArray<{
     feature: string;
@@ -126,6 +126,27 @@ export interface AiTemplatePlan {
     unknownContent: string[];
 }
 export declare function planAiTemplates(declared: readonly HashedDeclaredAiTemplate[], live: readonly LiveAiTemplate[]): AiTemplatePlan;
+/** ONE CUSTOM row of GET /v1/orgs/roles (`data.custom`; the `data.builtin`
+ *  sets are fixed and never planned). */
+export interface LiveOrgRole {
+    role_key: string;
+    name: string;
+    permissions: string[];
+    rank?: number | null;
+}
+export interface OrgRolePlan {
+    create: DeclaredOrgRole[];
+    /** name / permission SET / rank differs — POST /v1/orgs/roles upserts on
+     *  role_key in place (members keep the role), so never destructive-shaped */
+    update: Array<{
+        role: DeclaredOrgRole;
+        changed: string[];
+    }>;
+    unchanged: string[];
+    /** live custom roles the config does not declare (left in place by default) */
+    undeclared: string[];
+}
+export declare function planOrgRoles(declared: readonly DeclaredOrgRole[], live: readonly LiveOrgRole[]): OrgRolePlan;
 export interface ApiStateSummary {
     datum: ApiStateDatum;
     created: string[];
@@ -174,6 +195,13 @@ export declare const API_STATE_DISABLED_NOTE = "feature disabled \u2014 declarat
  *  converge and the CLI's read-only plan refuse with this message instead. */
 export declare function rlPolicyListCapError(liveCount: number): string | null;
 export declare const RL_POLICY_LIST_CAP = 100;
+/** `orgs.roles[]` is declared with at most this many entries (OrgsConfigSchema
+ *  maxItems), but orgs-v1 defineRole has NO per-tenant cap — a tenant past it
+ *  cannot round-trip its catalog through the config block. `vxil pull`
+ *  (2026-10-11) refuses to write the leaf rather than emit a config that fails
+ *  validation. */
+export declare function orgRoleListCapError(liveCount: number): string | null;
+export declare const ORG_ROLE_DECLARED_CAP = 100;
 /** `+2 created · ~1 updated · =3 unchanged · 1 undeclared (left in place)` —
  *  the one-line summary `vxil push` prints and the apply journal notes. */
 export declare function formatApiStateSummary(s: ApiStateSummary): string;

package/dist/_vxil-feature-configs-feedGroups.d.ts

@@ -0,0 +1,7 @@
+/** The three feed groups every tenant has without config. A declared
+ *  `feedGroups` entry is MERGED over these by name at read time (the worker's
+ *  feedTypeFor), so declaring a custom group never drops the built-ins. */
+export declare const ACTIVITY_FEED_BUILTIN_GROUPS: Record<string, {
+    type: 'flat' | 'aggregated' | 'notification';
+    aggregation?: string;
+}>;

package/dist/_vxil-feature-configs.d.ts

@@ -1,4 +1,5 @@
 import { type Static, type TSchema } from '@sinclair/typebox';
+import { ACTIVITY_FEED_BUILTIN_GROUPS } from './_vxil-feature-configs-feedGroups.js';
 export { AI_THINKING_LEVELS, geminiThinkingLevelError, minimalThinkingLevel, type GeminiThinkingLevel } from './_vxil-feature-configs-geminiThinking.js';
 export * from './_vxil-feature-configs-hooks.js';
 export * from './_vxil-feature-configs-readmodels.js';
@@ -20,6 +21,11 @@ export declare const FN_RETRY_BINDING_KINDS: ReadonlySet<string>;
 export declare const FN_FORWARD_HEADERS_MAX = 8;
 export declare const FN_FORWARD_HEADER_VALUE_MAX = 256;
 export declare const FN_SERVER_SCOPES_MAX = 32;
+/** G-37 (2026-10-11): a function's plain `vars` (never secret) — at most
+ *  FN_VARS_MAX names of FN_VAR_NAME_RE, FN_VARS_MAX_BYTES of JSON in all
+ *  (rules at fnVarsError). Delivered on the envelope as `vars`. */
+export declare const FN_VARS_MAX = 32;
+export declare const FN_VARS_MAX_BYTES = 4096;
 /** True when a credit_type is a vxil-COGS reserved type (grant/consume/config
  *  of which is restricted to internal platform machinery). */
 export declare function isReservedCreditType(creditType: string): boolean;
@@ -518,13 +524,38 @@ export declare const PresenceConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
 }>;
 export type PresenceConfig = Static<typeof PresenceConfigSchema>;
+/** The orgs-v1 built-in role keys (core.ts ROLE_RANK): fixed sets that are
+ *  never declared, redefined or deleted — a custom role picks another key. */
+export declare const ORG_BUILTIN_ROLE_KEYS: readonly ["owner", "admin", "member", "viewer"];
+/** One declared custom org role (G-31, 2026-10-11) — the POST /v1/orgs/roles
+ *  body (orgs-v1 core.ts RoleBody), converged by `role_key` by `vxil push` /
+ *  `POST /v1/apply` (control-plane handlers/apiState.ts). */
+export declare const DeclaredOrgRoleSchema: import("@sinclair/typebox").TObject<{
+    role_key: import("@sinclair/typebox").TString;
+    name: import("@sinclair/typebox").TString;
+    permissions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    rank: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+}>;
+export type DeclaredOrgRole = Static<typeof DeclaredOrgRoleSchema>;
 export declare const OrgsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     maxOrgsPerTenant: import("@sinclair/typebox").TInteger;
     maxMembersPerOrg: import("@sinclair/typebox").TInteger;
     invitationTtlHours: import("@sinclair/typebox").TInteger;
+    roles: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        role_key: import("@sinclair/typebox").TString;
+        name: import("@sinclair/typebox").TString;
+        permissions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        rank: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+    }>>>;
 }>;
 export type OrgsConfig = Static<typeof OrgsConfigSchema>;
+export { ACTIVITY_FEED_BUILTIN_GROUPS };
+/** Config-write errors for activity-feed feedGroups (FEED-HYGIENE). */
+export declare function validateFeedGroups(groups: Record<string, {
+    type?: string;
+    aggregation?: string;
+}> | undefined): string[];
 export declare const ActivityFeedConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     feedGroups: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
@@ -535,8 +566,6 @@ export declare const ActivityFeedConfigSchema: import("@sinclair/typebox").TObje
     fanout: import("@sinclair/typebox").TObject<{
         celebrityThreshold: import("@sinclair/typebox").TInteger;
         maxFanoutPerJob: import("@sinclair/typebox").TInteger;
-        maxConcurrentTasks: import("@sinclair/typebox").TInteger;
-        pendingCeiling: import("@sinclair/typebox").TInteger;
     }>;
     follow: import("@sinclair/typebox").TObject<{
         copyLimit: import("@sinclair/typebox").TInteger;
@@ -546,7 +575,6 @@ export declare const ActivityFeedConfigSchema: import("@sinclair/typebox").TObje
         enabled: import("@sinclair/typebox").TBoolean;
     }>;
     crossChannel: import("@sinclair/typebox").TObject<{
-        enabled: import("@sinclair/typebox").TBoolean;
         digestCadence: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"off">, import("@sinclair/typebox").TLiteral<"hourly">, import("@sinclair/typebox").TLiteral<"daily">]>;
     }>;
 }>;
@@ -756,6 +784,7 @@ export declare const FunctionsConfigSchema: import("@sinclair/typebox").TObject<
         scriptRef: import("@sinclair/typebox").TString;
         scopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         secrets: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        vars: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TString>>;
         egressAllow: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         runtime: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
             compatibilityDate: import("@sinclair/typebox").TString;
@@ -878,6 +907,9 @@ export declare const MCP_MAX_PROMPTS = 32;
  *  validation below and the control-plane deploy clamp. */
 export declare const DENY_FUNCTION_SCOPES: Set<string>;
 export declare function fnForwardHeadersError(raw: unknown): string | null;
+/** G-37: a function's `vars` — a plain-text string map (never a secret: it
+ *  sits in the published manifest and every config version). */
+export declare function fnVarsError(raw: unknown): string | null;
 /** FN-SERVER-SCOPES: an `http` binding's `serverScopes` — the scopes of the
  *  tenant-only tokens (`server_jwts`) minted next to the caller-bound ones.
  *  Each must be one of the function's own `scopes` (pass `fnScopes` once they
@@ -888,6 +920,7 @@ export declare function fnServerScopesError(raw: unknown, fnScopes?: readonly st
  *  templateVars parity). */
 export declare function rlTemplateVars(template: string): string[];
 export declare function validateDeclaredRlPolicies(policies: readonly DeclaredRlPolicy[] | undefined): string[];
+export declare function validateDeclaredOrgRoles(roles: readonly DeclaredOrgRole[] | undefined): string[];
 export declare function validateDeclaredWebhookSubscriptions(subscriptions: readonly DeclaredWebhookSubscription[] | undefined, maxSubscriptions: number | undefined): string[];
 /** The stored-template `schema` bounds — MIRRORED from @vxil/runtime
  *  (AI_TEMPLATE_SCHEMA_MAX_BYTES / AI_TEMPLATE_SCHEMA_MAX_DEPTH; this package is

package/dist/config.d.ts

@@ -256,8 +256,16 @@ export interface FunctionDef {
      *  functions:write, secrets:write rejected; payments:write / notifications:send /
      *  users:* allowed as owner-granted business scopes). */
     scopes?: string[];
-    /** Names of tenant secrets injected into the function at invoke time. */
+    /** Names of tenant secrets injected into the function at invoke time. A
+     *  trailing `?` (`'stripe_key?'`) marks one optional: unset, it is
+     *  simply absent from `secrets`; an unset required one answers 409
+     *  `secret_missing` on every invoke. */
     secrets?: string[];
+    /** Plain settings delivered on the envelope as `vars` — a dashboard
+     *  URL, a pinned org slug, a threshold. Plain text stored in the published
+     *  config, NEVER a secret (use `secrets` for those). At most 32 names of
+     *  `[A-Za-z_][A-Za-z0-9_]{0,63}`, 4 096 bytes of JSON in all. */
+    vars?: Record<string, string>;
     /** Outbound host allowlist (deny-by-default egress guard). */
     egressAllow?: string[];
     /** Per-function resource declarations. Both optional; both clamped server-side.
@@ -302,10 +310,16 @@ export interface SecretRef {
     feature: string;
     description?: string;
 }
-/** Optional deterministic seed, applied via the per-feature import bundle. */
+/** Optional deterministic seed, applied by `vxil seed` as per-item
+ *  `POST /v1/cms/items/:collection` creates (one per row). */
 export interface SeedSpec {
+    /** `status`: what every item of the block is created as —
+     *  `'published'` lands seed rows live on a `draftPublish` collection.
+     *  Absent = the collection's default (draft under draftPublish). Set on
+     *  the block, not the item, so a field named `status` stays your data. */
     cms?: {
         collection: string;
+        status?: 'draft' | 'published';
         items: Record<string, unknown>[];
     }[];
     users?: {