@vxil/cli 0.27.0 → 0.29.0

package/dist/_vxil-feature-configs-readmodels.d.ts

@@ -52,6 +52,26 @@ export declare function isOrgChannelTemplate(channel: string): boolean;
  *  `org:<id>`). Null (publish nothing) for a non-template or an org id that is
  *  not a string matching ORG_CHANNEL_ID_RE — fail closed. */
 export declare function resolveOrgChannel(template: string, orgId: unknown): string | null;
+/** MX-1022-CDC-OWNER-CHANNEL: the owner template token — one WHOLE segment of a
+ *  cdc `channel` on an owner-scoped (ownerField) collection. Each row publishes
+ *  to its owner's private channel `user:<owner>:<rest>` (realtime-v1
+ *  userChannelDenied binds an end-user token for a `user:` channel to its
+ *  verified id). Never combined with `{org}` in one channel. */
+export declare const CDC_OWNER_TOKEN = "{owner}";
+/** Every resolved owner channel starts with this prefix (realtime-v1
+ *  token.ts USER_CHANNEL_PREFIX; the `cdc-gated-fields` gate pins both equal). */
+export declare const USER_CHANNEL_PREFIX = "user:";
+/** An owner id that may enter a channel name: no ':' / '@' (realtime refuses
+ *  such ids every `user:` channel anyway), ≤ 128 chars. */
+export declare const OWNER_CHANNEL_ID_RE: RegExp;
+/** Is `channel` an owner template — exactly one segment equal to `{owner}`,
+ *  every other segment a non-empty channel-alphabet run, ≤ 128 chars? */
+export declare function isOwnerChannelTemplate(channel: string): boolean;
+/** Resolve an owner template for one row: drop the `{owner}` segment and prefix
+ *  `user:<id>:` (`meals:{owner}` → `user:<id>:meals`). Null (publish nothing)
+ *  for a non-template, an owner id that is not a string matching
+ *  OWNER_CHANNEL_ID_RE, or a result past realtime's 200-char cap — fail closed. */
+export declare function resolveOwnerChannel(template: string, ownerId: unknown): string | null;
 /** Cross-field rule for CmsConfig.cdc (called from validateFeatureConfig). */
 export declare function validateCdcConfig(cdc: Record<string, CdcRuleLike> | undefined): string[];
 /** What a payload:'full' change-data rule must know about its target
@@ -90,4 +110,14 @@ export declare function cdcFullFramesOverGatedCollections(cdc: unknown, collecti
  * Pure; one problem line per offending ENABLED rule.
  */
 export declare function cdcFixedChannelsOverOrgCollections(cdc: unknown, collections: Record<string, CdcCollectionGates>): string[];
+/**
+ * MX-1022-CDC-OWNER-CHANNEL: an `{owner}` rule is valid only on an owner-scoped
+ * collection (a live `ownerField`) that is NOT a workspace collection: a
+ * `user:` channel skips realtime's active-org check, so a member removed from a
+ * workspace who still owns rows there would keep receiving them — `{org}`
+ * serves workspace collections. The cms runtime floor (cdc.ts cdcChannelFor)
+ * publishes nothing for such a rule at every door that cannot check. Pure; one
+ * problem line per offending ENABLED rule (an unknown collection is skipped).
+ */
+export declare function cdcOwnerRulesOverNonOwnerCollections(cdc: unknown, collections: Record<string, CdcCollectionGates>): string[];
 export {};

package/dist/_vxil-feature-configs.d.ts

@@ -313,6 +313,7 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
         resendCooldownSec: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
     }>>;
     registryAdopt: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    userIdFormat: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"ulid">, import("@sinclair/typebox").TLiteral<"uuid">]>>;
     otp: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         enabled: import("@sinclair/typebox").TBoolean;
         codeTtlMinutes: import("@sinclair/typebox").TInteger;
@@ -710,6 +711,7 @@ export declare const AiConfigSchema: import("@sinclair/typebox").TObject<{
         system: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         schema: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnknown>>;
     }>>>;
+    testMarkers: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
 export type AiConfig = Static<typeof AiConfigSchema>;
 export declare const RagConfigSchema: import("@sinclair/typebox").TObject<{
@@ -805,6 +807,13 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
         deferDowngrades: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         subPeriodGrants: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
     }>>;
+    refunds: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        cancelAtProvider: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"off">, import("@sinclair/typebox").TLiteral<"period_end">, import("@sinclair/typebox").TLiteral<"immediately">]>>;
+    }>>;
+    disputes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        cancelAtProvider: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"off">, import("@sinclair/typebox").TLiteral<"period_end">]>>;
+    }>>;
+    shadow: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
 export type PaymentsConfig = Static<typeof PaymentsConfigSchema>;
 export declare const FunctionsConfigSchema: import("@sinclair/typebox").TObject<{
@@ -916,12 +925,12 @@ export type AuthHookEvent = (typeof AUTH_HOOK_EVENTS)[number];
 /** The events a `cmsHook` function binding may name — the closed union
  * `packages/config` types on the `cmsHook` trigger, and the keys of the
  * functions-v1 receiver's CMS_HOOK_EVENTS_FOR (beforeCreate → created,
- * beforeUpdate → updated, beforeWrite → both, afterPublish → published). Omitted = beforeWrite. Anything
+ * beforeUpdate → updated, beforeWrite → both, afterPublish → published, afterDelete → deleted). Omitted = beforeWrite. Anything
  * else is refused at config write (E-CMSHOOK, 2026-10-01): an unknown name used
  * to fall back to beforeWrite at delivery, so a typo like 'afterCreate' or
  * 'beforeDelete' silently subscribed the function to creates AND updates.
  * A CI gate pins every copy to this list. */
-export declare const CMS_HOOK_EVENTS: readonly ["beforeCreate", "beforeUpdate", "beforeWrite", "afterPublish"];
+export declare const CMS_HOOK_EVENTS: readonly ["beforeCreate", "beforeUpdate", "beforeWrite", "afterPublish", "afterDelete"];
 export type CmsHookEvent = (typeof CMS_HOOK_EVENTS)[number];
 /** The ONE refusal text for an unknown cmsHook binding event (the config
  * validator and the deploy route's early 422 both use it). */
@@ -1014,3 +1023,11 @@ export declare function isDeclaredRetainDays(v: unknown): v is number | null | u
  *  collection that change applies only under allow-destructive; lengthening
  *  or clearing keeps more and always applies. */
 export declare function retainDaysShortens(declared: number | null, remote: number | null): boolean;
+/** = cms-v1 core.ts DELETED_RETAIN_DAYS_MAX (a parity test pins the two). */
+export declare const CMS_DELETED_RETAIN_DAYS_MAX = 29;
+export declare function isDeclaredDeletedRetainDays(v: unknown): v is number | null | undefined;
+export declare function isDeclaredOnOwnerErase(v: unknown): v is 'delete' | 'keep' | undefined;
+/** Does moving from `remote` to `declared` make an erase delete MORE (turning
+ *  'delete' on)? On an existing collection that applies only under
+ *  allow-destructive; turning it off always applies. */
+export declare function onOwnerEraseWidens(declared: 'delete' | 'keep', remote: 'delete' | 'keep'): boolean;

package/dist/config.d.ts

@@ -140,6 +140,24 @@ export interface CollectionDef {
      *  shortening it needs `vxil push --allow-destructive` (lengthening or
      *  `null` always applies). Carried by BOTH push paths. */
     retainDays?: number | null;
+    /** Recovery window for DELETED items, in days (guide ch. 4): a soft-deleted
+     *  item stays restorable this long before the nightly cleanup purges it for
+     *  good. An integer 0..29 (0 = purged at the next nightly run, ≤ 24 h), or
+     *  `null` for the platform default of 30 days. ABSENT = not managed by
+     *  config. Shortening it on an existing collection needs
+     *  `vxil push --allow-destructive`. Carried by BOTH push paths. */
+    deletedRetainDays?: number | null;
+    /** What a GDPR erase of a user does to the items they OWN here (guide ch. 9;
+     *  needs `ownerField` — "owner" is whoever that field names):
+     *    'keep'   (default) — the items stay; the owner id resolves to the
+     *                         erased tombstone user;
+     *    'delete' — the erase hard-deletes them (live and deleted, unique values
+     *               freed) in the same transaction. Relations elsewhere are not
+     *               cascaded (they keep a dangling id).
+     *  ABSENT = not managed by config. Turning 'delete' on for an existing
+     *  collection needs `vxil push --allow-destructive`. Carried by BOTH push
+     *  paths. */
+    onOwnerErase?: 'delete' | 'keep';
     /** Per-record action buttons (guide ch. 4): `[{ key, label, fn }]`, stored on
      *  the collection (model data, not a config leaf). The dashboard renders one
      *  button per action on each record row; `POST /v1/cms/items/:coll/:id/actions/
@@ -303,12 +321,14 @@ export type FunctionTrigger =
  *  `beforeUpdate` → updated only, `beforeWrite` → created|updated,
  *  `afterPublish` → published (a draft→published transition is its own event,
  *  not an update); a write to another collection never wakes the function.
- *  Deleted/bulk events are not delivered to a cmsHook binding. `event`
+ *  `afterDelete` → deleted (one event per deleted root row — cascaded children
+ *  and GDPR erase emit none; the payload carries `id`, `owner` (+ `org`), never
+ *  the row body). Bulk-summary events are not delivered to a cmsHook binding. `event`
  *  defaults to `beforeWrite`. */
  | {
     kind: 'cmsHook';
     collection: string;
-    event?: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite' | 'afterPublish';
+    event?: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite' | 'afterPublish' | 'afterDelete';
     retry?: FunctionTriggerRetry;
 } | {
     kind: 'authHook';