@vxil/feature-configs 0.4.1 → 0.5.1

package/dist/index.js

@@ -7,12 +7,20 @@ import { FormatRegistry, OptionalKind, Type } from '@sinclair/typebox';
 import { Value } from '@sinclair/typebox/value';
 import { validateHooksConfig } from './hooks.js';
 import { validateCdcConfig, validateReadModelsConfig } from './readmodels.js';
+import { isFnTriggerSubscriptionUrl } from './apiState.js';
 // Re-export the CMS lifecycle-hook engine so feature workers (cms-v1, runtime
 // eval) and the control plane (config-time validation) share one definition.
 export * from './hooks.js';
 // Re-export the cms-rel read-model/cdc config gates (the pure-mirror split:
 // grammar validated here at config-write; field existence at runtime).
 export * from './readmodels.js';
+// Re-export the DECLARED API STATE planner (roadmap §4.11 P0-3): pure
+// declared-vs-live reconciliation, shared by the control-plane apply path and
+// the CLI (`vxil plan/diff/push`), so the two push paths can never diverge.
+export * from './apiState.js';
+// Key-order-insensitive JSON: the one declared-vs-stored manifest compare
+// (control-plane shallowDiff, CLI diffManifest).
+export * from './canonicalJson.js';
 // TypeBox validates `format:` only for registered formats — register the ones
 // our schemas use (pragmatic RFC-lite email check; providers do the real one).
 if (!FormatRegistry.Has('email')) {
@@ -140,6 +148,12 @@ export function validateNotificationOverrides(templates) {
     }
     return errs;
 }
+/** AWS region grammar for `notifications.ses.region` (`us-east-1`,
+ * `eu-central-1`, `ap-southeast-2`, `us-gov-west-1`, …): two-letter partition,
+ * one or more lowercase words, a single digit. Pinned as a pattern rather than
+ * a list so a newly launched SES region needs no vxil release; a typo still
+ * fails at `vxil push` (TypeBox), never as a DNS error on the first send. */
+export const SES_REGION_PATTERN = '^[a-z]{2}(-[a-z]+)+-\\d$';
 export const NotificationsConfigSchema = Type.Object({
     enabled: Type.Boolean({ default: true }),
     fromEmail: Type.String({ format: 'email' }),
@@ -156,10 +170,27 @@ export const NotificationsConfigSchema = Type.Object({
     // to the tenant so a signed event for tenant A can never validate at tenant
     // B's webhook URL (audit H6 — mirrors payments revenuecat.webhookSecretRef).
     webhookSecretRef: Type.Optional(Type.String()),
-    // 'mock' exists for staging/e2e (deterministic provider); 'resend' is MVP.
-    provider: Type.Union([Type.Literal('resend'), Type.Literal('mock')], {
+    // 'mock' exists for staging/e2e (deterministic provider); 'resend' is MVP;
+    // 'ses' (2026-09-19) is the second real provider — Amazon SES v2, BYO IAM
+    // keys, same delivery/suppression/preference pipeline as resend.
+    provider: Type.Union([Type.Literal('resend'), Type.Literal('ses'), Type.Literal('mock')], {
         default: 'resend',
     }),
+    // Amazon SES credentials (2026-09-19). ONE optional bag (= ONE leaf per the
+    // cap rule — funded by folding `rateLimit` into an Optional bag below);
+    // NO `default: {}` so an absent bag stays absent (the auth `security`
+    // precedent). Both refs are `secret:<name>` POINTERS into
+    // public.tenant_secrets (feature='notifications', KEK_NOTIFICATIONS) —
+    // exactly how resendApiKeyRef resolves; the region is plain config (not a
+    // secret) and is pattern-pinned to the AWS region grammar so a typo fails
+    // at `vxil push` instead of as a DNS error on the first send. Required
+    // (all three) when provider === 'ses' — the cross-field check in
+    // validateFeatureConfig, mirroring the resend posture.
+    ses: Type.Optional(Type.Object({
+        region: Type.String({ pattern: SES_REGION_PATTERN, maxLength: 32 }),
+        accessKeyIdRef: Type.String({ minLength: 1 }),
+        secretAccessKeyRef: Type.String({ minLength: 1 }),
+    })),
     defaultLocale: Type.String({ default: 'en-US' }),
     // nested objects carry `default: {}` so Value.Default can materialize them
     // and then recurse into the leaf defaults.
@@ -176,10 +207,16 @@ export const NotificationsConfigSchema = Type.Object({
         }),
     }, { default: {} })),
     suppression: Type.Object({ softBounceThreshold: Type.Integer({ default: 3 }) }, { default: {} }),
-    rateLimit: Type.Object({
+    // `rateLimit` became an OPTIONAL bag (2 leaves → 1, the M21 `retry` trick)
+    // on 2026-09-19 to fund the `ses` credential bag above. It KEEPS
+    // `default: {}`, so Value.Default still materializes
+    // rateLimit.{perDay,perTenantSec} into every persisted manifest exactly as
+    // before (zero behavioral delta); only the TS type is now optional (the
+    // worker reads via core.ts `rateLimitOf()`'s fallback).
+    rateLimit: Type.Optional(Type.Object({
         perDay: Type.Integer({ default: 100000 }),
         perTenantSec: Type.Integer({ default: 50 }),
-    }, { default: {} }),
+    }, { default: {} })),
     // `templates` became an OPTIONAL bag (1 leaf, the same M21 trick `retry`
     // uses) to fund the D4 per-locale `overrides` map WITHOUT moving the count:
     // countLeaves scores an Optional object as ONE. `default: {}` is KEPT, so
@@ -342,6 +379,45 @@ const OidcProviderSchema = Type.Object({
     // (issuer, sub) anchor; a matching email that is not yet linked → 409.
     autoLink: Type.Optional(Type.Boolean()),
 });
+// ── redirect / return-URL scheme rule — ONE predicate, two consumers ─────────
+// `security.allowedRedirectOrigins` (below) and auth-v1's runtime shape guard
+// on every caller-supplied `redirect_url` / `redirect_uri` (core.ts
+// `isAllowedRedirectUrl`) must agree on WHICH schemes a sign-in link may be
+// delivered to, or a tenant could allow-list an origin the worker then refuses
+// (or the reverse). The rule (cvskit gap 7, 2026-09-19): `https://` on any
+// host, plus PLAIN `http://` ONLY on the two loopback names — `localhost` and
+// `127.0.0.1`, any port — so a local dev server can complete a magic link
+// without a staging origin. Any other `http://` (a LAN host, `*.local`, a
+// `localhost` sub-label like `app.localhost`, `[::1]`) stays refused: the
+// token rides the link in the clear, and only a loopback name is guaranteed
+// never to leave the developer's machine. The TypeBox `pattern` is the coarse
+// shape check the schema needs; `validateFeatureConfig` re-checks every entry
+// with THIS predicate, and auth-v1 calls it on the parsed URL — the parity test
+// in index.test.ts / redirectRule.test.ts holds the two together. The CLI's
+// production promotion gate still refuses any `http://` origin on a
+// production push (cli-sdk.md), so a loopback entry is a DEV-tenant affair.
+export const REDIRECT_ORIGIN_PATTERN = '^(https://[^/?#\\s]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]{1,5})?)$';
+/** THE scheme rule for a redirect/return URL: https anywhere, http on loopback
+ *  only. Takes the parsed URL (or any {protocol, hostname} pair) so the config
+ *  validator and the worker's runtime guard call the identical predicate. */
+export function redirectSchemeAllowed(u) {
+    if (u.protocol === 'https:')
+        return true;
+    if (u.protocol !== 'http:')
+        return false;
+    const host = u.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1';
+}
+/** An allow-list ENTRY is a bare origin that parses and passes the scheme
+ *  rule. Used by validateFeatureConfig (auth) on top of the coarse pattern. */
+export function isAllowedRedirectOriginEntry(entry) {
+    try {
+        return redirectSchemeAllowed(new URL(entry));
+    }
+    catch {
+        return false;
+    }
+}
 export const AuthConfigSchema = Type.Object({
     enabled: Type.Boolean({ default: true }),
     // D3 (auth wave 2026-09-10): the six method toggles collapsed into ONE
@@ -486,6 +562,9 @@ export const AuthConfigSchema = Type.Object({
     //   • allowedRedirectOrigins — when non-empty, EVERY caller-supplied
     //     redirect/return URL (magic link, password reset, email verification,
     //     OAuth start) must match one origin exactly → 422 redirect_not_allowed.
+    //     Entries are `https://host[:port]`, or `http://localhost[:port]` /
+    //     `http://127.0.0.1[:port]` for local development (REDIRECT_ORIGIN_PATTERN
+    //     + redirectSchemeAllowed above — the one rule auth-v1 enforces too).
     security: Type.Optional(Type.Object({
         lockout: Type.Optional(Type.Object({
             maxFailures: Type.Integer({ default: 10, minimum: 3, maximum: 100 }),
@@ -494,15 +573,47 @@ export const AuthConfigSchema = Type.Object({
         })),
         breachedPasswords: Type.Boolean({ default: false }),
         captchaSecretRef: Type.Optional(Type.String({ minLength: 1, maxLength: 200 })),
-        allowedRedirectOrigins: Type.Optional(Type.Array(Type.String({ minLength: 8, maxLength: 253, pattern: '^https://[^/?#\\s]+$' }), { maxItems: 32 })),
+        allowedRedirectOrigins: Type.Optional(Type.Array(Type.String({ minLength: 8, maxLength: 253, pattern: REDIRECT_ORIGIN_PATTERN }), { maxItems: 32 })),
     })),
 });
+// ── DECLARED API STATE (roadmap §4.11 P0-3, 2026-09-23) ──────────────────────
+// A rate-limit policy is a ROW in the feature's own KV store, written by
+// POST/PUT/DELETE /v1/rate-limits/policies. It used to be API state OUTSIDE
+// vxil.config (a journaled deviation: "one writer per datum, and the writer is
+// the route"), which made a second environment non-reproducible — every tenant
+// ended up with an `ensure-rate-limit-policies.ts` + a nightly assert. The
+// rule is unchanged — one writer per datum — but the writer is now THE
+// REPOSITORY: `policies[]` declares the set, and `vxil push` / `POST /v1/apply`
+// CONVERGE the live rows onto it (upsert by `name`, via the feature's own
+// routes; workers/control-plane/src/handlers/apiState.ts). Live rows the
+// config does NOT declare are LEFT in place and reported as drift (deleted
+// only under --allow-destructive), so adopting this block on an existing
+// tenant is never a silent wipe. The item shape MIRRORS the route body
+// (rate-limits-v1 core.ts PolicyBody) exactly; `limit` / `window_seconds`
+// omitted = derived from `defaults` on create and NOT asserted afterwards;
+// `behavior` / `algorithm` omitted = the route defaults ('block' /
+// 'sliding_window') and compared as such. An ARRAY is ONE leaf (countLeaves).
+export const RL_POLICY_NAME_PATTERN = '^[a-zA-Z0-9_.:-]+$';
+/** GET /v1/rate-limits/policies lists at most 100 with no cursor (core.ts
+ *  listPolicies) — a declared set past that could never be reconciled. */
+export const RL_MAX_DECLARED_POLICIES = 100;
+/** rate-limits-v1 core.ts createPolicy: at most 8 distinct `{var}`s. */
+export const RL_KEY_TEMPLATE_MAX_VARS = 8;
+export const DeclaredRlPolicySchema = Type.Object({
+    name: Type.String({ minLength: 1, maxLength: 100, pattern: RL_POLICY_NAME_PATTERN }),
+    key_template: Type.String({ minLength: 1, maxLength: 300 }),
+    limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 1_000_000 })),
+    window_seconds: Type.Optional(Type.Integer({ minimum: 1, maximum: 86_400 })),
+    behavior: Type.Optional(Type.Union([Type.Literal('block'), Type.Literal('shape')])),
+    algorithm: Type.Optional(Type.Union([Type.Literal('sliding_window'), Type.Literal('token_bucket')])),
+});
 export const RateLimitsConfigSchema = Type.Object({
     enabled: Type.Boolean({ default: true }),
     defaults: Type.Object({
         perTenantSec: Type.Integer({ default: 100, minimum: 1, maximum: 10000 }),
         burstSize: Type.Integer({ default: 200, minimum: 1, maximum: 20000 }),
     }, { default: {} }),
+    policies: Type.Optional(Type.Array(DeclaredRlPolicySchema, { maxItems: RL_MAX_DECLARED_POLICIES })),
 });
 export const FilesConfigSchema = Type.Object({
     enabled: Type.Boolean({ default: true }),
@@ -556,6 +667,10 @@ export const FilesConfigSchema = Type.Object({
 // webhooks-out (wishlist feature): outbound event fan-out over the jobs delivery
 // engine. Subscriptions live in their own table (§1 contract — one writer
 // per datum); config is just the capability gate + a cap.
+export const DeclaredWebhookSubscriptionSchema = Type.Object({
+    target_url: Type.String({ minLength: 9, maxLength: 2000 }),
+    event_prefixes: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 100 }), { maxItems: 20 })),
+});
 export const WebhooksConfigSchema = Type.Object({
     enabled: Type.Boolean({ default: true }),
     maxSubscriptions: Type.Integer({ default: 20, minimum: 1, maximum: 200 }),
@@ -576,11 +691,28 @@ export const WebhooksConfigSchema = Type.Object({
     // decision with its own abuse review.
     //
     // An Optional object bag counts as ONE leaf (the countLeaves rule).
+    //
+    // `digestMinutes: 0` is IMMEDIATE (roadmap §4.11 P0-4c, 2026-09-23): the
+    // pass runs every minute for the tenant and mails the `error`-level failure
+    // rows that landed since its last mail — at most one mail per minute, still
+    // to the owner accounts. 1–4 are clamped up to 5 by the reader.
     alerts: Type.Optional(Type.Object({
         enabled: Type.Boolean({ default: false }),
         minLevel: Type.Union([Type.Literal('warn'), Type.Literal('error')], { default: 'error' }),
-        digestMinutes: Type.Integer({ default: 15, minimum: 5, maximum: 1440 }),
+        digestMinutes: Type.Integer({ default: 15, minimum: 0, maximum: 1440 }),
     })),
+    // DECLARED API STATE (roadmap §4.11 P0-3, 2026-09-23): the tenant's OUTBOUND
+    // subscriptions as config. Keyed by `target_url` — the only stable identity a
+    // subscription has (there is no name column and no update route, so a changed
+    // prefix set is delete+recreate, exactly what the function-trigger reconciler
+    // does). `vxil push` / `POST /v1/apply` converge public.webhook_subscriptions
+    // onto this list (handlers/apiState.ts); undeclared live rows are LEFT and
+    // reported (deleted only under --allow-destructive). Rows on the platform's
+    // signed function-delivery lanes (/v1/internal/fn/…) are NEVER declared here
+    // — they derive from the functions manifest — and never count as undeclared.
+    // Item shape mirrors handlers/webhooks.ts createSubscription's body. An
+    // Optional ARRAY is ONE leaf.
+    subscriptions: Type.Optional(Type.Array(DeclaredWebhookSubscriptionSchema, { maxItems: 200 })),
 });
 // comments feature (wishlist): threaded discussion on tenant-defined topics.
 export const CommentsConfigSchema = Type.Object({
@@ -598,8 +730,9 @@ export const CmsConfigSchema = Type.Object({
     draftPublish: Type.Boolean({ default: true }),
     // cms end-user default-deny fail-safe (path-to-100 §3.2, Feature B). When ON,
     // a VERIFIED end-user key (owner-scope mode) is DENIED access to any
-    // collection that declares no owner_field — 404 on read, 403 on write —
-    // instead of the default tenant-wide-shared behavior. Server-caller mode is a
+    // collection that declares no owner_field — `403 server_only` on read AND
+    // write (finding 29, 2026-09-20; reads used to be a 404) — instead of the
+    // default tenant-wide-shared behavior. Server-caller mode is a
     // byte-for-byte no-op. Default OFF preserves today's shared semantics
     // (owner.int.test.ts's shared-collection invariant). A collection that DOES
     // declare an ownerField is unaffected. ONE boolean leaf.
@@ -862,6 +995,14 @@ export const VectorSearchConfigSchema = Type.Object({
 // intelligence (prompt TEMPLATES are config-as-code, stored/rendered but never
 // authored). 'mock' is the deterministic default until a BYO key is provisioned;
 // the real providers route via tenant_secrets keyRefs.
+export const AI_TEMPLATE_NAME_PATTERN = '^[a-zA-Z0-9_.\\-]+$';
+export const AI_MAX_DECLARED_TEMPLATES = 50;
+export const DeclaredAiTemplateSchema = Type.Object({
+    template: Type.String({ minLength: 1, maxLength: 128, pattern: AI_TEMPLATE_NAME_PATTERN }),
+    user: Type.String({ minLength: 1, maxLength: 64_000 }),
+    system: Type.Optional(Type.String({ maxLength: 32_000 })),
+    schema: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+});
 export const AiConfigSchema = Type.Object({
     enabled: Type.Boolean({ default: true }),
     // 'azure' uses the OpenAI adapter shape (azure-openai compatible; pair it with
@@ -901,11 +1042,31 @@ export const AiConfigSchema = Type.Object({
         tokensPerUserPerDay: Type.Integer({ default: 0, minimum: 0 }), // 0 = unlimited
         consumeCredits: Type.Boolean({ default: false }), // LIVE: reserve→settle against the payments credit ledger (a job-routed generation reserves pre-generation and 402s insufficient_credits)
     }, { default: {} }),
-    streaming: Type.Object({
+    // `streaming` became an OPTIONAL bag (3 leaves → 1, the M21 `retry` trick)
+    // on 2026-09-23 to fund the declared `templates[]` below. It KEEPS
+    // `default: {}`, so Value.Default still materializes
+    // streaming.{enabled,replayBufferFrames,flushMs} into every persisted
+    // manifest exactly as before (zero behavioral delta — ai-v1 declares its own
+    // schema mirror plain and reads the materialized leaves); only the TS type
+    // here is optional.
+    streaming: Type.Optional(Type.Object({
         enabled: Type.Boolean({ default: true }),
         replayBufferFrames: Type.Integer({ default: 256, minimum: 1 }), // §2a ring-buffer depth
         flushMs: Type.Integer({ default: 50, minimum: 0 }), // §2a/#148 token→frame coalesce window
-    }, { default: {} }),
+    }, { default: {} })),
+    // DECLARED API STATE (roadmap §4.11 P0-3, 2026-09-23): the tenant's stored
+    // prompt templates as config. vxil STORES + versions, never authors (ai.md
+    // §0) — declaring them here changes WHO writes the row (the repository, via
+    // `vxil push`), not what vxil does with it. Converged by CONTENT: the
+    // control-plane hashes each declared entry (@vxil/runtime
+    // aiTemplateContentSha256) against the `content_sha256` GET /v1/ai/templates
+    // stamps on the latest version, and POSTs a new version ONLY when the content
+    // differs — so a push is idempotent and versions stay monotonic per name.
+    // Item shape mirrors ai-v1 core.ts TemplateBody exactly (`template` is the
+    // name). Stored templates the config does not declare are reported (there is
+    // no delete route — they are never removed). Bounded to 50 entries: the
+    // manifest rides the 1 MiB config body cap. An Optional ARRAY is ONE leaf.
+    templates: Type.Optional(Type.Array(DeclaredAiTemplateSchema, { maxItems: AI_MAX_DECLARED_TEMPLATES })),
 });
 // rag feature (features/rag.md §2). Re-declared to match workers/rag-v1/src/config.ts's
 // exported RagConfigSchema. rag owns the PIPELINE knobs only — retrieval budget,
@@ -1436,6 +1597,91 @@ function publicHttpsUrlError(url) {
  *  stays ALLOWED (fn→fn composition). Source of truth for both the config-write
  *  validation below and the control-plane deploy clamp. */
 export const DENY_FUNCTION_SCOPES = new Set(['admin', '*', 'features:write', 'functions:write', 'secrets:write']);
+// ── declared API state — config-write validators (roadmap §4.11 P0-3) ────────
+/** `{var}` names of a rate-limit key template (rate-limits-v1 core.ts
+ *  templateVars parity). */
+export function rlTemplateVars(template) {
+    return [...template.matchAll(/\{([a-zA-Z0-9_]+)\}/g)].map((m) => m[1]);
+}
+export function validateDeclaredRlPolicies(policies) {
+    const errs = [];
+    const seen = new Set();
+    (policies ?? []).forEach((p, i) => {
+        if (seen.has(p.name))
+            errs.push(`/policies/${i}/name: duplicate policy name '${p.name}' (policies converge by name, so it must be unique)`);
+        seen.add(p.name);
+        if (new Set(rlTemplateVars(p.key_template)).size > RL_KEY_TEMPLATE_MAX_VARS) {
+            errs.push(`/policies/${i}/key_template: too many variables (max ${RL_KEY_TEMPLATE_MAX_VARS})`);
+        }
+    });
+    return errs;
+}
+export function validateDeclaredWebhookSubscriptions(subscriptions, maxSubscriptions) {
+    const errs = [];
+    const seen = new Set();
+    const subs = subscriptions ?? [];
+    if (maxSubscriptions !== undefined && subs.length > maxSubscriptions) {
+        errs.push(`/subscriptions: ${subs.length} declared but maxSubscriptions is ${maxSubscriptions} (raise maxSubscriptions or declare fewer)`);
+    }
+    subs.forEach((sub, i) => {
+        if (seen.has(sub.target_url))
+            errs.push(`/subscriptions/${i}/target_url: duplicate target_url (subscriptions converge by target_url, so it must be unique)`);
+        seen.add(sub.target_url);
+        const urlErr = publicHttpsUrlError(sub.target_url);
+        if (urlErr)
+            errs.push(`/subscriptions/${i}/target_url: ${urlErr}`);
+        else if (isFnTriggerSubscriptionUrl(sub.target_url)) {
+            errs.push(`/subscriptions/${i}/target_url: a function-delivery lane is never declared here — declare the trigger on the function (functions.<name>.trigger) and the platform reconciles its subscription`);
+        }
+    });
+    return errs;
+}
+/** The stored-template `schema` bounds — MIRRORED from @vxil/runtime
+ *  (AI_TEMPLATE_SCHEMA_MAX_BYTES / AI_TEMPLATE_SCHEMA_MAX_DEPTH; this package is
+ *  typebox-only). ai-v1 putTemplate refuses the same numbers at the route, so a
+ *  declared entry that passes here is never a 422 at converge. */
+export const AI_TEMPLATE_SCHEMA_MAX_BYTES = 32_000;
+export const AI_TEMPLATE_SCHEMA_MAX_DEPTH = 64;
+/** Nesting depth of a JSON value, iteratively (`{}` = 1, scalar = 0). */
+function jsonDepthOf(v) {
+    let max = 0;
+    const stack = [{ v, d: 0 }];
+    while (stack.length) {
+        const { v: cur, d } = stack.pop();
+        if (cur === null || typeof cur !== 'object')
+            continue;
+        const depth = d + 1;
+        if (depth > max)
+            max = depth;
+        for (const c of Array.isArray(cur) ? cur : Object.values(cur)) {
+            if (c !== null && typeof c === 'object')
+                stack.push({ v: c, d: depth });
+        }
+    }
+    return max;
+}
+export function validateDeclaredAiTemplates(templates) {
+    const errs = [];
+    const seen = new Set();
+    (templates ?? []).forEach((t, i) => {
+        if (seen.has(t.template))
+            errs.push(`/templates/${i}/template: duplicate template name '${t.template}' (templates converge by name, so it must be unique)`);
+        seen.add(t.template);
+        if (t.schema === undefined)
+            return;
+        if (typeof t.schema !== 'object' || t.schema === null || Array.isArray(t.schema)) {
+            errs.push(`/templates/${i}/schema: must be a JSON-Schema object`);
+            return;
+        }
+        const bytes = JSON.stringify(t.schema).length;
+        if (bytes > AI_TEMPLATE_SCHEMA_MAX_BYTES)
+            errs.push(`/templates/${i}/schema: too large (${bytes} > ${AI_TEMPLATE_SCHEMA_MAX_BYTES} bytes serialized)`);
+        const depth = jsonDepthOf(t.schema);
+        if (depth > AI_TEMPLATE_SCHEMA_MAX_DEPTH)
+            errs.push(`/templates/${i}/schema: nests too deep (${depth} > ${AI_TEMPLATE_SCHEMA_MAX_DEPTH} levels)`);
+    });
+    return errs;
+}
 export function validateFeatureConfig(feature, raw) {
     const schema = FEATURE_SCHEMAS[feature];
     if (!schema) {
@@ -1466,6 +1712,16 @@ export function validateFeatureConfig(feature, raw) {
                 errors: ["/resendApiKeyRef: required when provider is 'resend' (omit it for provider 'mock')"],
             };
         }
+        // Same posture for the second real provider: `ses` without its bag is a
+        // config the worker could only fail at send time, so refuse it at push.
+        // (The bag's three members are each schema-required once the bag is
+        // present, so a partial bag already failed TypeBox above.)
+        if (v.provider === 'ses' && !v.ses) {
+            return {
+                ok: false,
+                errors: ["/ses: required when provider is 'ses' — { region, accessKeyIdRef, secretAccessKeyRef } (omit it for provider 'mock')"],
+            };
+        }
         const overrideErrs = validateNotificationOverrides(v.templates);
         if (overrideErrs.length)
             return { ok: false, errors: overrideErrs.slice(0, 10) };
@@ -1611,6 +1867,25 @@ export function validateFeatureConfig(feature, raw) {
             if (urlErr)
                 return { ok: false, errors: [`/providers/compat/openaiBaseUrl: ${urlErr}`] };
         }
+        const tplErrs = validateDeclaredAiTemplates(v.templates);
+        if (tplErrs.length)
+            return { ok: false, errors: tplErrs.slice(0, 10) };
+    }
+    // Cross-field rules: declared API state (roadmap §4.11 P0-3). Each list is
+    // converged by NAME/URL, so a duplicate key is ambiguous and refused at push;
+    // the per-item rules mirror the feature route's own validation so a declared
+    // entry can never be one the converge would 422 on.
+    if (feature === 'rate-limits') {
+        const v = withDefaults;
+        const errs = validateDeclaredRlPolicies(v.policies);
+        if (errs.length)
+            return { ok: false, errors: errs.slice(0, 10) };
+    }
+    if (feature === 'webhooks') {
+        const v = withDefaults;
+        const errs = validateDeclaredWebhookSubscriptions(v.subscriptions, v.maxSubscriptions);
+        if (errs.length)
+            return { ok: false, errors: errs.slice(0, 10) };
     }
     // Cross-field rule: auth otp.testRecipients (F4-29) — every entry must be an
     // email, an `*@domain` glob, or a +E.164 number; anything else would never
@@ -1621,6 +1896,17 @@ export function validateFeatureConfig(feature, raw) {
         if (bad.length) {
             return { ok: false, errors: bad.slice(0, 10).map((e) => `/otp/testRecipients: '${e}' is not an email, an *@domain glob, or a +E.164 number`) };
         }
+        // security.allowedRedirectOrigins: the SAME scheme predicate auth-v1 applies
+        // at runtime (redirectSchemeAllowed) — https anywhere, http on loopback only.
+        // The TypeBox pattern above already refused the shape; this re-check is what
+        // keeps the validator and the worker on one rule (parity-tested).
+        const badOrigin = (v.security?.allowedRedirectOrigins ?? []).filter((e) => !isAllowedRedirectOriginEntry(e));
+        if (badOrigin.length) {
+            return {
+                ok: false,
+                errors: badOrigin.slice(0, 10).map((e) => `/security/allowedRedirectOrigins: '${e}' must be an https:// origin, or http://localhost[:port] / http://127.0.0.1[:port] for local development (plain http on any other host is refused)`),
+            };
+        }
     }
     // Cross-field rule: functions. Reject privilege-escalating scopes and malformed
     // bindings at config-write time (the deploy pipeline additionally asserts the
@@ -1673,8 +1959,14 @@ export function validateFeatureConfig(feature, raw) {
         for (const [id, agent] of Object.entries(v.agents ?? {})) {
             const allow = agent.actions?.allow ?? {};
             const guestAllow = agent.guardrails?.guestToolAllow ?? [];
-            if (agent.guardrails?.allowGuest === true)
+            if (agent.guardrails?.allowGuest === true) {
                 anyGuestAgent = true;
+                // Guests share ONE tenant-wide bucket that spends the tenant's own AI
+                // key: an unlimited (0) daily cap is never allowed alongside them.
+                if (agent.guardrails.rateLimitPerUserPerDay === 0) {
+                    errs.push(`/agents/${id}/guardrails/rateLimitPerUserPerDay: 0 (unlimited) is not allowed with allowGuest: true — set a finite daily cap (guests share one tenant-wide bucket)`);
+                }
+            }
             if (knownMcpTools) {
                 for (const tool of Object.keys(allow)) {
                     if (!knownMcpTools.has(tool)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/feature-configs",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "The per-feature configuration schemas and validators behind vxil.config.ts (published for @vxil/cli and @vxil/config).",
   "license": "MIT",
   "homepage": "https://vxil.com",