@vxil/config 0.5.1 → 0.7.0

package/dist/index.d.ts

@@ -106,18 +106,45 @@ export interface CollectionDef {
  *   session.revoked — auth.session.revoked { user_id, session_id, reason }
  *   signin.failure  — auth.signin.failure { email_hash | user_id, reason } */
 export type AuthHookEvent = 'user.created' | 'session.created' | 'session.revoked' | 'signin.failure';
+/** The opt-in re-delivery of a platform-delivered trigger (F33, 2026-09-25).
+ *  DEFAULT OFF: the platform acknowledges every delivery with a 200 whatever
+ *  the handler returned — an application error is observed (`functions.run.failed`),
+ *  never re-delivered. With `retry` set on a `queue` / `webhook` / `cmsHook` /
+ *  `authHook` trigger, a non-2xx answer of the handler is handed back to the
+ *  jobs retry ladder instead (60 s, 120 s, … backoff) and the last failed
+ *  attempt dead-letters the run (`job.dead_lettered`, replayable from the
+ *  Jobs page). Each attempt is a billed invocation and carries the SAME
+ *  `idempotency_key` — dedupe on it. Effective attempts =
+ *  min(maxAttempts, the project's `jobs.retry.defaultMaxAttempts`, default 5).
+ *  A handler that partially writes and then fails re-fires its downstream
+ *  events on EVERY attempt, so the chain is a tree (up to maxAttempts children
+ *  per hop): the causal-depth guard bounds its length (32 hops), not its size —
+ *  the breaker, the loop guard, the dead-letter quota and the daily share do.
+ *  Write only once you will return 2xx, or dedupe on idempotency_key. Not accepted on `http` (it returns its
+ *  real status to its caller) or `cron` (a retry would overlap the next tick). */
+export interface FunctionTriggerRetry {
+    /** 1–5 attempts in all (1 = a failed attempt dead-letters at once, no re-delivery) */
+    maxAttempts: number;
+}
 /** A function trigger (the §7.3 crossing). cmsHook fires on a CMS write;
  * authHook fires on ONE auth lifecycle event (default `user.created` — the
  * post-signup hook; at-least-once, ~1min fanout latency). */
 export type FunctionTrigger = {
     kind: 'http';
     path?: string;
-} | {
+}
+/** `overlap: 'skip'` (2026-10-01): a due tick fires nothing while the
+ *  previous tick's run is still open (queued / running / retrying / waiting /
+ *  delayed) — the slot is counted, never caught up. Default `'allow'`. Every
+ *  cron envelope carries `scheduled_for`, the slot it was due for. */
+ | {
     kind: 'cron';
     schedule: string;
+    overlap?: 'allow' | 'skip';
 } | {
     kind: 'queue';
     source: string;
+    retry?: FunctionTriggerRetry;
 }
 /** `webhook`: the function is woken by a webhook_subscription fan-out whose
  *  target_url is `<edge>/v1/internal/fn/trigger/<name>?tenant=<id>`. That
@@ -132,6 +159,7 @@ export type FunctionTrigger = {
  | {
     kind: 'webhook';
     source: string;
+    retry?: FunctionTriggerRetry;
 }
 /** `cmsHook`: fires after a CMS write in `collection`. The platform filters
  *  deliveries on the binding (2026-09-19): `beforeCreate` → created only,
@@ -142,15 +170,26 @@ export type FunctionTrigger = {
     kind: 'cmsHook';
     collection: string;
     event: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite';
+    retry?: FunctionTriggerRetry;
 } | {
     kind: 'authHook';
     event?: AuthHookEvent;
+    retry?: FunctionTriggerRetry;
 };
 /** A deployed tenant function — source in functions/, deployed on `vxil push`. */
 export interface FunctionDef {
     /** path to the ES-module entrypoint, e.g. ./functions/<name>.ts */
     entry: string;
     trigger?: FunctionTrigger;
+    /** Further bindings beside `trigger` (2026-09-25): a function is code + a SET
+     *  of trigger bindings, so one bundle can be reached by several front doors —
+     *  a webhook AND a cron, an http door AND a cmsHook. `trigger` and `triggers`
+     *  may both be present; the deploy carries them in that order as
+     *  `bindings[]`, at most 8 in all (the CLI refuses a 9th before the wire).
+     *  Every binding lands the same isolate; only the envelope's `trigger` /
+     *  `payload` differ. Each platform-delivered binding is billed per
+     *  invocation and bounded by the loop guard and the breaker. */
+    triggers?: FunctionTrigger[];
     /** clamped by DENY_FUNCTION_SCOPES at deploy (admin, wildcard, features:write,
      *  functions:write, secrets:write rejected; payments:write / notifications:send /
      *  users:* allowed as owner-granted business scopes). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/config",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "description": "Typed vxil.config.ts authoring for the vxil backend platform — defineConfig, feature and cms field definitions (published for @vxil/cli).",
   "license": "MIT",
   "homepage": "https://vxil.com",
@@ -22,7 +22,7 @@
     "src"
   ],
   "dependencies": {
-    "@vxil/feature-configs": "0.5.1"
+    "@vxil/feature-configs": "0.7.0"
   },
   "publishConfig": {
     "access": "public"

package/src/index.ts

@@ -6,7 +6,7 @@
 // types); the control plane never executes this file. This keeps config-as-code
 // §7.3-consistent — config is DATA; the only tenant CODE that crosses into vxil
 // is (a) the Lane-A hook expressions (a closed sandbox) and (b) the functions/
-// sources (the paid, opt-in, egress-guarded crossing). Everything here is
+// sources (the opt-in, plan-limited, egress-guarded crossing). Everything here is
 // declarative. See https://vxil.com/docs/guide/05-typed-sdk-and-cli.
 import type {
   NotificationsConfig, JobsConfig, AuthConfig, RateLimitsConfig, FilesConfig,
@@ -130,13 +130,38 @@ export interface CollectionDef {
  *   signin.failure  — auth.signin.failure { email_hash | user_id, reason } */
 export type AuthHookEvent = 'user.created' | 'session.created' | 'session.revoked' | 'signin.failure';
 
+/** The opt-in re-delivery of a platform-delivered trigger (F33, 2026-09-25).
+ *  DEFAULT OFF: the platform acknowledges every delivery with a 200 whatever
+ *  the handler returned — an application error is observed (`functions.run.failed`),
+ *  never re-delivered. With `retry` set on a `queue` / `webhook` / `cmsHook` /
+ *  `authHook` trigger, a non-2xx answer of the handler is handed back to the
+ *  jobs retry ladder instead (60 s, 120 s, … backoff) and the last failed
+ *  attempt dead-letters the run (`job.dead_lettered`, replayable from the
+ *  Jobs page). Each attempt is a billed invocation and carries the SAME
+ *  `idempotency_key` — dedupe on it. Effective attempts =
+ *  min(maxAttempts, the project's `jobs.retry.defaultMaxAttempts`, default 5).
+ *  A handler that partially writes and then fails re-fires its downstream
+ *  events on EVERY attempt, so the chain is a tree (up to maxAttempts children
+ *  per hop): the causal-depth guard bounds its length (32 hops), not its size —
+ *  the breaker, the loop guard, the dead-letter quota and the daily share do.
+ *  Write only once you will return 2xx, or dedupe on idempotency_key. Not accepted on `http` (it returns its
+ *  real status to its caller) or `cron` (a retry would overlap the next tick). */
+export interface FunctionTriggerRetry {
+  /** 1–5 attempts in all (1 = a failed attempt dead-letters at once, no re-delivery) */
+  maxAttempts: number;
+}
+
 /** A function trigger (the §7.3 crossing). cmsHook fires on a CMS write;
  * authHook fires on ONE auth lifecycle event (default `user.created` — the
  * post-signup hook; at-least-once, ~1min fanout latency). */
 export type FunctionTrigger =
   | { kind: 'http'; path?: string }
-  | { kind: 'cron'; schedule: string }
-  | { kind: 'queue'; source: string }
+  /** `overlap: 'skip'` (2026-10-01): a due tick fires nothing while the
+   *  previous tick's run is still open (queued / running / retrying / waiting /
+   *  delayed) — the slot is counted, never caught up. Default `'allow'`. Every
+   *  cron envelope carries `scheduled_for`, the slot it was due for. */
+  | { kind: 'cron'; schedule: string; overlap?: 'allow' | 'skip' }
+  | { kind: 'queue'; source: string; retry?: FunctionTriggerRetry }
   /** `webhook`: the function is woken by a webhook_subscription fan-out whose
    *  target_url is `<edge>/v1/internal/fn/trigger/<name>?tenant=<id>`. That
    *  subscription is AUTO-WIRED on deploy (2026-09-19): the platform reconciles
@@ -147,20 +172,29 @@ export type FunctionTrigger =
    *  also enforced at delivery: a non-matching event is ACK-200 skipped.
    *  Declaring the binding is what opts the function into event delivery; a
    *  receiver that declares only `cron` keeps the older cron+{} wake. */
-  | { kind: 'webhook'; source: string }
+  | { kind: 'webhook'; source: string; retry?: FunctionTriggerRetry }
   /** `cmsHook`: fires after a CMS write in `collection`. The platform filters
    *  deliveries on the binding (2026-09-19): `beforeCreate` → created only,
    *  `beforeUpdate` → updated only, `beforeWrite` → created|updated; a write to
    *  another collection never wakes the function. Deleted/bulk events are not
    *  delivered to a cmsHook binding. */
-  | { kind: 'cmsHook'; collection: string; event: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite' }
-  | { kind: 'authHook'; event?: AuthHookEvent };
+  | { kind: 'cmsHook'; collection: string; event: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite'; retry?: FunctionTriggerRetry }
+  | { kind: 'authHook'; event?: AuthHookEvent; retry?: FunctionTriggerRetry };
 
 /** A deployed tenant function — source in functions/, deployed on `vxil push`. */
 export interface FunctionDef {
   /** path to the ES-module entrypoint, e.g. ./functions/<name>.ts */
   entry: string;
   trigger?: FunctionTrigger;
+  /** Further bindings beside `trigger` (2026-09-25): a function is code + a SET
+   *  of trigger bindings, so one bundle can be reached by several front doors —
+   *  a webhook AND a cron, an http door AND a cmsHook. `trigger` and `triggers`
+   *  may both be present; the deploy carries them in that order as
+   *  `bindings[]`, at most 8 in all (the CLI refuses a 9th before the wire).
+   *  Every binding lands the same isolate; only the envelope's `trigger` /
+   *  `payload` differ. Each platform-delivered binding is billed per
+   *  invocation and bounded by the loop guard and the breaker. */
+  triggers?: FunctionTrigger[];
   /** clamped by DENY_FUNCTION_SCOPES at deploy (admin, wildcard, features:write,
    *  functions:write, secrets:write rejected; payments:write / notifications:send /
    *  users:* allowed as owner-granted business scopes). */