@vxil/feature-configs 0.4.0 → 0.4.1

package/dist/index.js

@@ -1063,7 +1063,7 @@ export const PaymentsConfigSchema = Type.Object({
         // Opt-in period-end enforcement (money-path operations wave, decision D2
         // option a). ABSENT (the default) = today's behaviour: a subscription whose
         // current_period_end passed with no provider event stays entitled forever
-        // (the provider is the only clock). PRESENT = the hourly reconcile sweep
+        // (the provider is the only clock). PRESENT = the nightly reconcile sweep
         // flips an `active`/`trialing` row whose current_period_end + slackHours
         // has passed with no renewal to status 'lapsed' (+ refold, +
         // payments.subscription.lapsed); a later provider renewal event revives it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/feature-configs",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "The per-feature configuration schemas and validators behind vxil.config.ts (published for @vxil/cli and @vxil/config).",
   "license": "MIT",
   "homepage": "https://vxil.com",
@@ -24,7 +24,8 @@
   },
   "files": [
     "dist",
-    "src"
+    "src",
+    "!src/**/*.test.ts"
   ],
   "dependencies": {
     "@sinclair/typebox": "^0.34.0"

package/src/index.ts

@@ -1369,7 +1369,7 @@ export const PaymentsConfigSchema = Type.Object({
     // Opt-in period-end enforcement (money-path operations wave, decision D2
     // option a). ABSENT (the default) = today's behaviour: a subscription whose
     // current_period_end passed with no provider event stays entitled forever
-    // (the provider is the only clock). PRESENT = the hourly reconcile sweep
+    // (the provider is the only clock). PRESENT = the nightly reconcile sweep
     // flips an `active`/`trialing` row whose current_period_end + slackHours
     // has passed with no renewal to status 'lapsed' (+ refold, +
     // payments.subscription.lapsed); a later provider renewal event revives it

package/src/hooks.test.ts

@@ -1,451 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-  parseExpr, validateAst, evalExpr, runWriteHooks, runReadHooks, validateHookDef, validateHooksConfig,
-  extractRefs, inferType, highlightTokens,
-  HookParseError, HookEvalError, HookRejection, HOOK_LIMITS,
-  type HookContext, type HookDef,
-} from './hooks.js';
-import { validateFeatureConfig } from './index.js';
-
-const ctx = (item: Record<string, unknown>, before: Record<string, unknown> | null = null): HookContext => ({
-  item, before, now: '2026-06-19T00:00:00.000Z',
-});
-const run = (src: string, c: HookContext): unknown => {
-  const ast = parseExpr(src);
-  expect(validateAst(ast)).toEqual([]);
-  return evalExpr(ast, c);
-};
-
-describe('expression evaluator — correctness', () => {
-  it('arithmetic + precedence', () => {
-    expect(run('1 + 2 * 3', ctx({}))).toBe(7);
-    expect(run('(1 + 2) * 3', ctx({}))).toBe(9);
-    expect(run('10 / 4', ctx({}))).toBe(2.5);
-    expect(run('10 % 3', ctx({}))).toBe(1);
-    expect(run('-5 + 2', ctx({}))).toBe(-3);
-  });
-  it('comparisons + booleans + ternary', () => {
-    expect(run('3 > 2 && 2 >= 2', ctx({}))).toBe(true);
-    expect(run('1 == 1 || 2 == 3', ctx({}))).toBe(true);
-    expect(run('!false', ctx({}))).toBe(true);
-    expect(run('5 > 3 ? "big" : "small"', ctx({}))).toBe('big');
-    expect(run('"a" < "b"', ctx({}))).toBe(true);
-  });
-  it('member access reads own item fields; missing → undefined-safe', () => {
-    expect(run('item.weight_kg', ctx({ weight_kg: 80 }))).toBe(80);
-    expect(run('item.profile.age', ctx({ profile: { age: 30 } }))).toBe(30);
-    expect(run('coalesce(item.missing, 5)', ctx({}))).toBe(5);
-    expect(run('isNull(item.missing)', ctx({}))).toBe(true);
-  });
-  it('built-in functions', () => {
-    expect(run('round(3.7)', ctx({}))).toBe(4);
-    expect(run('max(1, 9, 3)', ctx({}))).toBe(9);
-    expect(run('concat("a", "b", "c")', ctx({}))).toBe('abc');
-    expect(run('lower("HELLO")', ctx({}))).toBe('hello');
-    expect(run('len("abcd")', ctx({}))).toBe(4);
-    expect(run('contains("hello world", "world")', ctx({}))).toBe(true);
-    expect(run('yearsBetween(now, item.dob) > 18', ctx({ dob: '1990-01-01T00:00:00Z' }))).toBe(true);
-  });
-  it('the real Mealix Mifflin–St Jeor BMR expression evaluates correctly', () => {
-    // male: (10*kg) + (6.25*cm) - (5*age) + 5
-    const expr = '(10 * item.weight_kg) + (6.25 * item.height_cm) - (5 * yearsBetween(now, item.dob)) + 5';
-    const v = run(expr, ctx({ weight_kg: 80, height_cm: 180, dob: '1994-06-19T00:00:00Z' })) as number;
-    // 800 + 1125 - 5*32 + 5 = 1770
-    expect(Math.round(v)).toBe(1770);
-  });
-});
-
-describe('runWriteHooks — derive + validate semantics', () => {
-  const hooks: Record<string, HookDef> = {
-    bmr: { collection: 'profiles', event: 'beforeWrite', kind: 'derive', field: 'bmr',
-      expr: 'round((10 * item.weight_kg) + (6.25 * item.height_cm) + 5)' },
-    posWeight: { collection: 'profiles', event: 'beforeWrite', kind: 'validate',
-      expr: 'item.weight_kg > 0', message: 'weight must be positive' },
-  };
-  it('derive sets the computed field; validate passes for valid input', () => {
-    const r = runWriteHooks(hooks, 'profiles', 'create', { weight_kg: 80, height_cm: 180 }, null, '2026-06-19T00:00:00Z');
-    expect(r.data.bmr).toBe(1930); // round(800 + 1125 + 5)
-    expect(r.derived).toContain('bmr');
-  });
-  it('validate hook rejects with its message', () => {
-    expect(() => runWriteHooks(hooks, 'profiles', 'create', { weight_kg: -1, height_cm: 180 }, null, 'x'))
-      .toThrow(HookRejection);
-    try { runWriteHooks(hooks, 'profiles', 'create', { weight_kg: 0, height_cm: 1 }, null, 'x'); }
-    catch (e) { expect((e as Error).message).toBe('weight must be positive'); }
-  });
-  it('does not run hooks for a different collection or disabled hooks', () => {
-    const r = runWriteHooks(hooks, 'other', 'create', { weight_kg: -5 }, null, 'x');
-    expect(r.derived).toEqual([]);
-    const disabled: Record<string, HookDef> = { h: { ...hooks.posWeight!, enabled: false } };
-    expect(() => runWriteHooks(disabled, 'profiles', 'create', { weight_kg: -1 }, null, 'x')).not.toThrow();
-  });
-  it('event matching: beforeCreate does not fire on update', () => {
-    const h = { c: { collection: 'p', event: 'beforeCreate' as const, kind: 'validate' as const, expr: 'false' } };
-    expect(() => runWriteHooks(h, 'p', 'update', {}, {}, 'x')).not.toThrow();
-    expect(() => runWriteHooks(h, 'p', 'create', {}, null, 'x')).toThrow(HookRejection);
-  });
-  it('a derived value is visible to a later validate hook', () => {
-    const h: Record<string, HookDef> = {
-      d: { collection: 'p', event: 'beforeWrite', kind: 'derive', field: 'total', expr: 'item.a + item.b' },
-      v: { collection: 'p', event: 'beforeWrite', kind: 'validate', expr: 'item.total <= 100', message: 'over 100' },
-    };
-    expect(() => runWriteHooks(h, 'p', 'create', { a: 60, b: 60 }, null, 'x')).toThrow(/over 100/);
-    expect(runWriteHooks(h, 'p', 'create', { a: 10, b: 20 }, null, 'x').data.total).toBe(30);
-  });
-});
-
-describe('runReadHooks — beforeRead visibility + afterRead output shaping', () => {
-  const NOW = '2026-07-01T00:00:00.000Z';
-  const row = (id: string, data: Record<string, unknown>) =>
-    ({ item_id: id, collection: 'articles', data });
-  const hooks: Record<string, HookDef> = {
-    visible: { collection: 'articles', event: 'beforeRead', kind: 'validate', expr: 'not(item.hidden)' },
-    teaser: { collection: 'articles', event: 'afterRead', kind: 'derive', field: 'teaser', expr: 'substr(item.body, 0, 4)' },
-    hideBody: { collection: 'articles', event: 'afterRead', kind: 'redact', field: 'body', expr: 'item.premium' },
-  };
-
-  it('afterRead derive sets the output field; the INPUT rows are never mutated', () => {
-    const input = [row('itm_1', { body: 'hello world' })];
-    const r = runReadHooks(hooks, 'articles', input, NOW);
-    expect(r.rows).toHaveLength(1);
-    expect((r.rows[0]!.data as Record<string, unknown>).teaser).toBe('hell');
-    expect((input[0]!.data as Record<string, unknown>).teaser).toBeUndefined(); // output copy only
-    expect(r.dropped).toBe(0);
-  });
-  it('redact removes the field when the expression is truthy, keeps it when falsy', () => {
-    const r = runReadHooks(hooks, 'articles', [
-      row('itm_1', { body: 'secret text', premium: true }),
-      row('itm_2', { body: 'public text', premium: false }),
-    ], NOW);
-    expect((r.rows[0]!.data as Record<string, unknown>).body).toBeUndefined();
-    expect((r.rows[1]!.data as Record<string, unknown>).body).toBe('public text');
-  });
-  it('beforeRead validate falsy drops the row; survivors keep input order', () => {
-    const r = runReadHooks(hooks, 'articles', [
-      row('itm_1', { body: 'a', hidden: false }),
-      row('itm_2', { body: 'b', hidden: true }),
-      row('itm_3', { body: 'c', hidden: false }),
-    ], NOW);
-    expect(r.rows.map((x) => x.item_id)).toEqual(['itm_1', 'itm_3']);
-    expect(r.dropped).toBe(1);
-  });
-  it('derives run BEFORE redacts (a derive can read a field a redact then hides)', () => {
-    const r = runReadHooks(hooks, 'articles', [row('itm_1', { body: 'premium body', premium: true })], NOW);
-    const data = r.rows[0]!.data as Record<string, unknown>;
-    expect(data.teaser).toBe('prem'); // computed from body…
-    expect(data.body).toBeUndefined(); // …which the redact then removed
-  });
-  it('a read derive that returns a non-scalar is rejected (no aliasing into the response)', () => {
-    const h: Record<string, HookDef> = {
-      bad: { collection: 'articles', event: 'afterRead', kind: 'derive', field: 'x', expr: 'item.sub' },
-    };
-    expect(() => runReadHooks(h, 'articles', [row('itm_1', { sub: { a: 1 } })], NOW)).toThrow(/scalar/);
-  });
-  it('read hooks NEVER fire in runWriteHooks; write hooks NEVER fire in runReadHooks', () => {
-    // a beforeRead validate that always fails must not reject a write…
-    const readOnly: Record<string, HookDef> = {
-      v: { collection: 'p', event: 'beforeRead', kind: 'validate', expr: 'false' },
-      d: { collection: 'p', event: 'afterRead', kind: 'derive', field: 'x', expr: '1' },
-    };
-    const w = runWriteHooks(readOnly, 'p', 'create', { a: 1 }, null, NOW);
-    expect(w.data.x).toBeUndefined();
-    expect(w.derived).toEqual([]);
-    // …and a beforeWrite validate/derive must not drop or shape a read.
-    const writeOnly: Record<string, HookDef> = {
-      v: { collection: 'p', event: 'beforeWrite', kind: 'validate', expr: 'false' },
-      d: { collection: 'p', event: 'beforeWrite', kind: 'derive', field: 'x', expr: '1' },
-    };
-    const r = runReadHooks(writeOnly, 'p', [{ item_id: 'itm_1', collection: 'p', data: { a: 1 } }], NOW);
-    expect(r.rows).toHaveLength(1);
-    expect(r.dropped).toBe(0);
-    expect((r.rows[0]!.data as Record<string, unknown>).x).toBeUndefined();
-  });
-  it('disabled/off-collection read hooks are skipped', () => {
-    const h: Record<string, HookDef> = {
-      off: { collection: 'articles', event: 'beforeRead', kind: 'validate', expr: 'false', enabled: false },
-      other: { collection: 'elsewhere', event: 'beforeRead', kind: 'validate', expr: 'false' },
-    };
-    const r = runReadHooks(h, 'articles', [row('itm_1', { a: 1 })], NOW);
-    expect(r.rows).toHaveLength(1);
-  });
-  it('the SHARED page budget bounds the whole request (exhaustion → HookEvalError)', () => {
-    // 10 read hooks (the per-collection cap) × a ~239-node expression ≈ 2.4k
-    // steps per row; ~120 rows ≈ 287k steps > maxReadEvalStepsPerRequest.
-    const wide = Array(120).fill('1').join('+'); // 239 AST nodes, < maxNodes
-    const h: Record<string, HookDef> = {};
-    for (let i = 0; i < HOOK_LIMITS.maxReadHooksPerCollection; i++) {
-      h[`d${i}`] = { collection: 'articles', event: 'afterRead', kind: 'derive', field: 'x', expr: wide };
-    }
-    const rows = Array.from({ length: 120 }, (_, i) => row(`itm_${i}`, {}));
-    expect(() => runReadHooks(h, 'articles', rows, NOW)).toThrow(/read evaluation budget/);
-    // a small page with the same hooks stays comfortably within budget
-    expect(() => runReadHooks(h, 'articles', rows.slice(0, 5), NOW)).not.toThrow();
-  });
-  it('a redact targeting a forbidden field is contained at runtime (belt-and-braces)', () => {
-    const h: Record<string, HookDef> = {
-      bad: { collection: 'articles', event: 'afterRead', kind: 'redact', field: '__proto__', expr: 'true' },
-    };
-    expect(() => runReadHooks(h, 'articles', [row('itm_1', {})], NOW)).toThrow(HookEvalError);
-  });
-});
-
-// ── read-hook caller/session context (design §5.6) ──────────────────────────
-describe('runReadHooks — caller context (verified end-user principal)', () => {
-  const NOW = '2026-07-01T00:00:00.000Z';
-  const row = (id: string, data: Record<string, unknown>) =>
-    ({ item_id: id, collection: 'notes', data });
-  // A per-viewer shaping bag: derive `is_mine`, redact `secret` when not the owner.
-  const hooks: Record<string, HookDef> = {
-    mine: { collection: 'notes', event: 'afterRead', kind: 'derive', field: 'is_mine', expr: 'caller.endUserId == item.owner' },
-    hideSecret: { collection: 'notes', event: 'afterRead', kind: 'redact', field: 'secret', expr: 'not(caller.endUserId == item.owner)' },
-    who: { collection: 'notes', event: 'afterRead', kind: 'derive', field: 'seen_by', expr: 'caller.principal' },
-  };
-
-  it('caller is passed to read hooks: derive/redact key on the verified end-user', () => {
-    const caller = { endUserId: 'usr_a', principal: 'end_user' as const };
-    const r = runReadHooks(hooks, 'notes', [
-      row('itm_1', { owner: 'usr_a', secret: 'mine' }),
-      row('itm_2', { owner: 'usr_b', secret: 'theirs' }),
-    ], NOW, caller);
-    const own = r.rows[0]!.data as Record<string, unknown>;
-    const foreign = r.rows[1]!.data as Record<string, unknown>;
-    expect(own.is_mine).toBe(true);
-    expect(own.secret).toBe('mine');      // owner keeps the secret
-    expect(own.seen_by).toBe('end_user');
-    expect(foreign.is_mine).toBe(false);
-    expect(foreign.secret).toBeUndefined(); // non-owner: redacted
-  });
-
-  it('server-caller context {endUserId:null, principal:"tenant"} is honored', () => {
-    const caller = { endUserId: null, principal: 'tenant' as const };
-    const r = runReadHooks(hooks, 'notes', [row('itm_1', { owner: 'usr_a', secret: 's' })], NOW, caller);
-    const d = r.rows[0]!.data as Record<string, unknown>;
-    expect(d.is_mine).toBe(false);   // null != 'usr_a'
-    expect(d.seen_by).toBe('tenant');
-    expect(d.secret).toBeUndefined(); // a server caller is not the owner → redacted by this hook
-  });
-
-  it('caller omitted (other runReadHooks callers) → caller is null', () => {
-    const h: Record<string, HookDef> = {
-      p: { collection: 'notes', event: 'afterRead', kind: 'derive', field: 'p', expr: 'isNull(caller)' },
-    };
-    const r = runReadHooks(h, 'notes', [row('itm_1', {})], NOW);
-    expect((r.rows[0]!.data as Record<string, unknown>).p).toBe(true);
-  });
-
-  it('validateAst allows `caller` as a root variable', () => {
-    expect(validateAst(parseExpr('caller.endUserId == item.owner'))).toEqual([]);
-    expect(validateAst(parseExpr('caller.principal == "end_user"'))).toEqual([]);
-  });
-
-  it('caller is null on the WRITE path (a write derive referencing it does not throw)', () => {
-    const wh: Record<string, HookDef> = {
-      d: { collection: 'notes', event: 'beforeCreate', kind: 'derive', field: 'x', expr: 'isNull(caller)' },
-    };
-    const out = runWriteHooks(wh, 'notes', 'create', { title: 't' }, null, NOW);
-    expect(out.data.x).toBe(true);
-  });
-});
-
-// ── the anti-malice red-team: every one of these MUST be rejected/contained ──
-describe('SAFETY — malicious / abusive inputs are rejected or contained', () => {
-  const rejected = (src: string): string[] => {
-    try { return validateAst(parseExpr(src)); }
-    catch (e) { return [(e as Error).message]; } // parse error also counts as rejected
-  };
-
-  it('rejects unknown root variables (no globals/host reach)', () => {
-    for (const bad of ['globalThis', 'process', 'self', 'window', 'global', 'env', 'require']) {
-      expect(rejected(`${bad}.x`).length).toBeGreaterThan(0);
-    }
-  });
-  it('rejects unknown functions (no fetch/eval/require/Function)', () => {
-    for (const fn of ['fetch', 'eval', 'require', 'Function', 'setTimeout', 'import', 'constructor']) {
-      expect(rejected(`${fn}(1)`).length).toBeGreaterThan(0);
-    }
-  });
-  it('rejects prototype-pollution property names at PARSE time', () => {
-    for (const p of ['__proto__', 'constructor', 'prototype']) {
-      expect(() => parseExpr(`item.${p}`)).toThrow(HookParseError);
-    }
-  });
-  it('member access never traverses the prototype chain at eval time', () => {
-    // even if a forbidden prop slipped through, ownGet returns undefined.
-    const ast = parseExpr('item.toString'); // toString is a proto method, not own
-    expect(validateAst(ast)).toEqual([]);
-    expect(evalExpr(ast, ctx({}))).toBeUndefined(); // NOT the function
-  });
-  it('a derive hook cannot target a forbidden field name', () => {
-    expect(validateHookDef('x', { collection: 'p', event: 'beforeWrite', kind: 'derive', field: '__proto__', expr: '1' }).length)
-      .toBeGreaterThan(0);
-    expect(validateHookDef('x', { collection: 'p', event: 'beforeWrite', kind: 'derive', field: 'constructor', expr: '1' }).length)
-      .toBeGreaterThan(0);
-  });
-  it('there is no regex in the language → ReDoS is impossible', () => {
-    // a "regex-looking" string is just a string literal, never compiled.
-    expect(run('contains(item.s, "(a+)+$")', ctx({ s: 'plain' }))).toBe(false);
-  });
-  it('caps source length, node count, and depth', () => {
-    expect(() => parseExpr('x'.repeat(HOOK_LIMITS.maxSourceLen + 1))).toThrow(HookParseError);
-    // deeply NESTED member access grows AST depth (parens don't wrap a node).
-    const deep = 'item' + '.a'.repeat(HOOK_LIMITS.maxDepth + 5);
-    expect(validateAst(parseExpr(deep)).some((e) => /deep/.test(e))).toBe(true);
-    const wide = Array(HOOK_LIMITS.maxNodes + 50).fill('1').join('+');
-    expect(() => parseExpr(wide)).toThrow(/node cap|too long/);
-  });
-  it('division/modulo by zero is an error, not Infinity/NaN', () => {
-    expect(() => evalExpr(parseExpr('1 / 0'), ctx({}))).toThrow(HookEvalError);
-    expect(() => evalExpr(parseExpr('1 % 0'), ctx({}))).toThrow(HookEvalError);
-  });
-  it('numeric overflow and non-finite are contained', () => {
-    expect(() => evalExpr(parseExpr('pow(10, 100)'), ctx({}))).toThrow(HookEvalError);
-    expect(() => evalExpr(parseExpr('item.x * item.x'), ctx({ x: 1e9 }))).toThrow(HookEvalError); // 1e18 > 1e15 cap
-  });
-  it('caps result string length (no memory blowup via concat)', () => {
-    const big = 'x'.repeat(3000);
-    expect(() => evalExpr(parseExpr('concat(item.a, item.a)'), ctx({ a: big }))).toThrow(HookEvalError);
-  });
-  it('is deterministic — no Date.now()/Math.random() reachable', () => {
-    expect(rejected('random()').length).toBeGreaterThan(0);
-    expect(rejected('now()').length).toBeGreaterThan(0); // now is a VAR not a function
-    // `now` as a variable is deterministic (the injected value)
-    expect(run('now', ctx({}))).toBe('2026-06-19T00:00:00.000Z');
-  });
-  it('string with operators/quotes is data, never code', () => {
-    expect(run('item.note', ctx({ note: '1; DROP TABLE x; --' }))).toBe('1; DROP TABLE x; --');
-    expect(run('"a" == "a"', ctx({}))).toBe(true);
-  });
-});
-
-describe('editor support — extractRefs / inferType / highlightTokens', () => {
-  it('extractRefs collects the input fields an expression reads', () => {
-    const refs = extractRefs(parseExpr('item.weight_kg > 0 && before.height_cm < item.profile.h'));
-    const keys = refs.map((r) => `${r.root}.${r.path.join('.')}`).sort();
-    expect(keys).toEqual(['before.height_cm', 'item.profile.h', 'item.weight_kg']);
-  });
-  it('extractRefs handles a bare root + now', () => {
-    expect(extractRefs(parseExpr('now')).map((r) => r.root)).toEqual(['now']);
-    expect(extractRefs(parseExpr('coalesce(item, 1)')).map((r) => `${r.root}.${r.path.join('.')}`)).toEqual(['item.']);
-  });
-  it('inferType produces the output type for derive/validate checking', () => {
-    expect(inferType(parseExpr('round(item.x * 2)'))).toBe('number');
-    expect(inferType(parseExpr('concat(item.a, "x")'))).toBe('string');
-    expect(inferType(parseExpr('item.x > 3 && item.y < 5'))).toBe('boolean');
-    expect(inferType(parseExpr('lower(item.name)'))).toBe('string');
-    expect(inferType(parseExpr('item.maybe'))).toBe('unknown');
-    expect(inferType(parseExpr('coalesce(item.a, item.b)'))).toBe('unknown');
-    expect(inferType(parseExpr('now'))).toBe('string');
-  });
-  it('highlightTokens covers the full source and classifies tokens', () => {
-    const toks = highlightTokens('round(item.x) + 5');
-    expect(toks.map((t) => t.value).join('')).toBe('round(item.x) + 5'); // lossless
-    expect(toks.find((t) => t.value === 'round')?.kind).toBe('fn');
-    expect(toks.find((t) => t.value === 'item')?.kind).toBe('var');
-    expect(toks.find((t) => t.value === '5')?.kind).toBe('num');
-  });
-});
-
-describe('SAFETY — red-team regressions (confirmed breaches, now fixed)', () => {
-  it('zero-arity min()/max() do not leak ±Infinity (must error)', () => {
-    expect(() => evalExpr(parseExpr('min()'), ctx({}))).toThrow(HookEvalError);
-    expect(() => evalExpr(parseExpr('max()'), ctx({}))).toThrow(HookEvalError);
-    // and via a derive sink: a config-valid-looking min() derive must reject, not persist null
-    expect(() => runWriteHooks(
-      { h: { collection: 'p', event: 'beforeWrite', kind: 'derive', field: 'score', expr: 'min()' } },
-      'p', 'create', { a: 1 }, null, 'x',
-    )).toThrow(HookEvalError);
-  });
-  it('a derive that returns a non-scalar is rejected (no aliasing/circular persist)', () => {
-    for (const expr of ['item', 'before', 'item.sub', 'coalesce(item, 1)', 'ifNull(item.sub, item)']) {
-      expect(() => runWriteHooks(
-        { h: { collection: 'p', event: 'beforeWrite', kind: 'derive', field: 'self', expr } },
-        'p', 'update', { sub: { x: 1 } }, { y: 2 }, 'x',
-      )).toThrow(/scalar/);
-    }
-  });
-  it('str() on a circular object is a contained HookEvalError, never a raw TypeError', () => {
-    const circ: Record<string, unknown> = { a: 1 };
-    circ.self = circ;
-    expect(() => evalExpr(parseExpr('string(item)'), ctx(circ))).toThrow(HookEvalError);
-    expect(() => evalExpr(parseExpr('concat(item, "x")'), ctx(circ))).toThrow(HookEvalError);
-  });
-  it('runWriteHooks rejects a forbidden derive target at runtime (belt-and-braces)', () => {
-    expect(() => runWriteHooks(
-      { h: { collection: 'p', event: 'beforeWrite', kind: 'derive', field: '__proto__', expr: '1' } },
-      'p', 'create', {}, null, 'x',
-    )).toThrow(HookEvalError);
-    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
-  });
-  it('date math obeys the numeric magnitude invariant', () => {
-    expect(run('daysBetween("2026-01-02T00:00:00Z", "2026-01-01T00:00:00Z")', ctx({}))).toBe(1);
-    expect(typeof run('yearsBetween(now, item.dob)', ctx({ dob: '1990-01-01T00:00:00Z' }))).toBe('number');
-  });
-});
-
-describe('validateHooksConfig + validateFeatureConfig(cms) — the config-time gate', () => {
-  it('rejects a derive hook with no target field', () => {
-    expect(validateHookDef('h', { collection: 'p', event: 'beforeWrite', kind: 'derive', expr: '1' }).length).toBeGreaterThan(0);
-  });
-  it('rejects a malicious expression at config time', () => {
-    const bad = validateHooksConfig({ h: { collection: 'p', event: 'beforeWrite', kind: 'validate', expr: 'fetch("http://evil")' } });
-    expect(bad.length).toBeGreaterThan(0);
-  });
-  it('caps the number of hooks', () => {
-    const many: Record<string, HookDef> = {};
-    for (let i = 0; i < 60; i++) many[`h${i}`] = { collection: 'p', event: 'beforeWrite', kind: 'validate', expr: 'true' };
-    expect(validateHooksConfig(many).some((e) => /too many hooks/.test(e))).toBe(true);
-  });
-  it('validateFeatureConfig rejects a cms config with a malicious hook', () => {
-    const r = validateFeatureConfig('cms', { hooks: { h: { collection: 'p', event: 'beforeWrite', kind: 'validate', expr: 'process.exit(1)' } } });
-    expect(r.ok).toBe(false);
-  });
-  it('validateFeatureConfig accepts a cms config with a valid hook', () => {
-    const r = validateFeatureConfig('cms', {
-      hooks: { bmr: { collection: 'profiles', event: 'beforeWrite', kind: 'derive', field: 'bmr',
-        expr: 'round((10 * item.weight_kg) + (6.25 * item.height_cm) + 5)' } },
-    });
-    expect(r.ok).toBe(true);
-  });
-  it('accepts the READ phases: beforeRead validate + afterRead derive/redact', () => {
-    const r = validateFeatureConfig('cms', {
-      hooks: {
-        visible: { collection: 'articles', event: 'beforeRead', kind: 'validate', expr: 'not(item.hidden)' },
-        teaser: { collection: 'articles', event: 'afterRead', kind: 'derive', field: 'teaser', expr: 'substr(item.body, 0, 80)' },
-        hide: { collection: 'articles', event: 'afterRead', kind: 'redact', field: 'body', expr: 'item.premium' },
-      },
-    });
-    expect(r.ok).toBe(true);
-  });
-  it('enforces the kind/event compatibility matrix', () => {
-    // redact without a field
-    expect(validateHookDef('h', { collection: 'p', event: 'afterRead', kind: 'redact', expr: 'true' })
-      .some((e) => /field is required/.test(e))).toBe(true);
-    // validate on afterRead
-    expect(validateHookDef('h', { collection: 'p', event: 'afterRead', kind: 'validate', expr: 'true' })
-      .some((e) => /cannot run on afterRead/.test(e))).toBe(true);
-    // derive on beforeRead
-    expect(validateHookDef('h', { collection: 'p', event: 'beforeRead', kind: 'derive', field: 'x', expr: '1' })
-      .some((e) => /cannot run on beforeRead/.test(e))).toBe(true);
-    // redact on a write event
-    expect(validateHookDef('h', { collection: 'p', event: 'beforeWrite', kind: 'redact', field: 'x', expr: 'true' })
-      .some((e) => /only valid on afterRead/.test(e))).toBe(true);
-    // the schema-level union also rejects the combos through validateFeatureConfig
-    const r = validateFeatureConfig('cms', {
-      hooks: { h: { collection: 'p', event: 'beforeCreate', kind: 'redact', field: 'x', expr: 'true' } },
-    });
-    expect(r.ok).toBe(false);
-  });
-  it('caps read hooks per collection at the limit', () => {
-    const many: Record<string, HookDef> = {};
-    for (let i = 0; i <= HOOK_LIMITS.maxReadHooksPerCollection; i++) {
-      many[`r${i}`] = { collection: 'articles', event: 'afterRead', kind: 'redact', field: 'x', expr: 'true' };
-    }
-    // one over the cap on ONE collection trips; the write-hook cap (50) does not
-    expect(validateHooksConfig(many).some((e) => /too many read hooks/.test(e))).toBe(true);
-    const spread: Record<string, HookDef> = {
-      a: { collection: 'a', event: 'beforeRead', kind: 'validate', expr: 'true' },
-      b: { collection: 'b', event: 'beforeRead', kind: 'validate', expr: 'true' },
-    };
-    expect(validateHooksConfig(spread)).toEqual([]);
-  });
-});