@vxil/feature-configs 0.4.1 → 0.5.1

package/src/index.ts

@@ -7,6 +7,7 @@ import { FormatRegistry, OptionalKind, Type, type Static, type TSchema } from '@
 import { Value } from '@sinclair/typebox/value';
 import { validateHooksConfig, type HookDef } from './hooks.js';
 import { validateCdcConfig, validateReadModelsConfig } from './readmodels.js';
+import { isFnTriggerSubscriptionUrl } from './apiState.js';
 
 // Re-export the CMS lifecycle-hook engine so feature workers (cms-v1, runtime
 // eval) and the control plane (config-time validation) share one definition.
@@ -14,6 +15,13 @@ export * from './hooks.js';
 // Re-export the cms-rel read-model/cdc config gates (the pure-mirror split:
 // grammar validated here at config-write; field existence at runtime).
 export * from './readmodels.js';
+// Re-export the DECLARED API STATE planner (roadmap §4.11 P0-3): pure
+// declared-vs-live reconciliation, shared by the control-plane apply path and
+// the CLI (`vxil plan/diff/push`), so the two push paths can never diverge.
+export * from './apiState.js';
+// Key-order-insensitive JSON: the one declared-vs-stored manifest compare
+// (control-plane shallowDiff, CLI diffManifest).
+export * from './canonicalJson.js';
 
 // TypeBox validates `format:` only for registered formats — register the ones
 // our schemas use (pragmatic RFC-lite email check; providers do the real one).
@@ -153,6 +161,13 @@ export function validateNotificationOverrides(
   return errs;
 }
 
+/** AWS region grammar for `notifications.ses.region` (`us-east-1`,
+ * `eu-central-1`, `ap-southeast-2`, `us-gov-west-1`, …): two-letter partition,
+ * one or more lowercase words, a single digit. Pinned as a pattern rather than
+ * a list so a newly launched SES region needs no vxil release; a typo still
+ * fails at `vxil push` (TypeBox), never as a DNS error on the first send. */
+export const SES_REGION_PATTERN = '^[a-z]{2}(-[a-z]+)+-\\d$';
+
 export const NotificationsConfigSchema = Type.Object({
   enabled: Type.Boolean({ default: true }),
   fromEmail: Type.String({ format: 'email' }),
@@ -169,10 +184,27 @@ export const NotificationsConfigSchema = Type.Object({
   // to the tenant so a signed event for tenant A can never validate at tenant
   // B's webhook URL (audit H6 — mirrors payments revenuecat.webhookSecretRef).
   webhookSecretRef: Type.Optional(Type.String()),
-  // 'mock' exists for staging/e2e (deterministic provider); 'resend' is MVP.
-  provider: Type.Union([Type.Literal('resend'), Type.Literal('mock')], {
+  // 'mock' exists for staging/e2e (deterministic provider); 'resend' is MVP;
+  // 'ses' (2026-09-19) is the second real provider — Amazon SES v2, BYO IAM
+  // keys, same delivery/suppression/preference pipeline as resend.
+  provider: Type.Union([Type.Literal('resend'), Type.Literal('ses'), Type.Literal('mock')], {
     default: 'resend',
   }),
+  // Amazon SES credentials (2026-09-19). ONE optional bag (= ONE leaf per the
+  // cap rule — funded by folding `rateLimit` into an Optional bag below);
+  // NO `default: {}` so an absent bag stays absent (the auth `security`
+  // precedent). Both refs are `secret:<name>` POINTERS into
+  // public.tenant_secrets (feature='notifications', KEK_NOTIFICATIONS) —
+  // exactly how resendApiKeyRef resolves; the region is plain config (not a
+  // secret) and is pattern-pinned to the AWS region grammar so a typo fails
+  // at `vxil push` instead of as a DNS error on the first send. Required
+  // (all three) when provider === 'ses' — the cross-field check in
+  // validateFeatureConfig, mirroring the resend posture.
+  ses: Type.Optional(Type.Object({
+    region: Type.String({ pattern: SES_REGION_PATTERN, maxLength: 32 }),
+    accessKeyIdRef: Type.String({ minLength: 1 }),
+    secretAccessKeyRef: Type.String({ minLength: 1 }),
+  })),
   defaultLocale: Type.String({ default: 'en-US' }),
   // nested objects carry `default: {}` so Value.Default can materialize them
   // and then recurse into the leaf defaults.
@@ -195,13 +227,19 @@ export const NotificationsConfigSchema = Type.Object({
     { softBounceThreshold: Type.Integer({ default: 3 }) },
     { default: {} },
   ),
-  rateLimit: Type.Object(
+  // `rateLimit` became an OPTIONAL bag (2 leaves → 1, the M21 `retry` trick)
+  // on 2026-09-19 to fund the `ses` credential bag above. It KEEPS
+  // `default: {}`, so Value.Default still materializes
+  // rateLimit.{perDay,perTenantSec} into every persisted manifest exactly as
+  // before (zero behavioral delta); only the TS type is now optional (the
+  // worker reads via core.ts `rateLimitOf()`'s fallback).
+  rateLimit: Type.Optional(Type.Object(
     {
       perDay: Type.Integer({ default: 100000 }),
       perTenantSec: Type.Integer({ default: 50 }),
     },
     { default: {} },
-  ),
+  )),
   // `templates` became an OPTIONAL bag (1 leaf, the same M21 trick `retry`
   // uses) to fund the D4 per-locale `overrides` map WITHOUT moving the count:
   // countLeaves scores an Optional object as ONE. `default: {}` is KEPT, so
@@ -263,13 +301,15 @@ export const NotificationsConfigSchema = Type.Object({
   })),
 });
 // Leaves: enabled, fromEmail, fromName, replyTo, resendApiKeyRef,
-// webhookSecretRef, provider, defaultLocale, retry (Optional bag = 1),
-// suppression.softBounceThreshold, rateLimit.perDay, rateLimit.perTenantSec,
-// templates (Optional bag = 1 — was templates.allowOverride, collapsed 2026-09-10
-// to fund the D4 `overrides` map at zero net cost), inboxEnabled,
-// broadcast (Optional bag = 1) → 15. Cap = 15 — AT the cap; the next flag must
-// collapse something. (`templates.overrides` is a Record MAP inside the ONE
-// optional templates leaf — DATA, not a flag — so catalog size never moves it.)
+// webhookSecretRef, provider, ses (Optional bag = 1, 2026-09-19), defaultLocale,
+// retry (Optional bag = 1), suppression.softBounceThreshold,
+// rateLimit (Optional bag = 1 — was rateLimit.{perDay,perTenantSec}, collapsed
+// 2026-09-19 to fund `ses` at zero net cost), templates (Optional bag = 1 — was
+// templates.allowOverride, collapsed 2026-09-10 to fund the D4 `overrides` map
+// at zero net cost), inboxEnabled, broadcast (Optional bag = 1) → 15. Cap = 15 —
+// AT the cap; the next flag must collapse something. (`templates.overrides` is
+// a Record MAP inside the ONE optional templates leaf — DATA, not a flag — so
+// catalog size never moves it.)
 
 export type NotificationsConfig = Static<typeof NotificationsConfigSchema>;
 /** The §11b.5 broadcast bag as persisted (present ⇒ leaf defaults applied). */
@@ -407,6 +447,46 @@ const OidcProviderSchema = Type.Object({
   autoLink: Type.Optional(Type.Boolean()),
 });
 
+// ── redirect / return-URL scheme rule — ONE predicate, two consumers ─────────
+// `security.allowedRedirectOrigins` (below) and auth-v1's runtime shape guard
+// on every caller-supplied `redirect_url` / `redirect_uri` (core.ts
+// `isAllowedRedirectUrl`) must agree on WHICH schemes a sign-in link may be
+// delivered to, or a tenant could allow-list an origin the worker then refuses
+// (or the reverse). The rule (cvskit gap 7, 2026-09-19): `https://` on any
+// host, plus PLAIN `http://` ONLY on the two loopback names — `localhost` and
+// `127.0.0.1`, any port — so a local dev server can complete a magic link
+// without a staging origin. Any other `http://` (a LAN host, `*.local`, a
+// `localhost` sub-label like `app.localhost`, `[::1]`) stays refused: the
+// token rides the link in the clear, and only a loopback name is guaranteed
+// never to leave the developer's machine. The TypeBox `pattern` is the coarse
+// shape check the schema needs; `validateFeatureConfig` re-checks every entry
+// with THIS predicate, and auth-v1 calls it on the parsed URL — the parity test
+// in index.test.ts / redirectRule.test.ts holds the two together. The CLI's
+// production promotion gate still refuses any `http://` origin on a
+// production push (cli-sdk.md), so a loopback entry is a DEV-tenant affair.
+export const REDIRECT_ORIGIN_PATTERN =
+  '^(https://[^/?#\\s]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]{1,5})?)$';
+
+/** THE scheme rule for a redirect/return URL: https anywhere, http on loopback
+ *  only. Takes the parsed URL (or any {protocol, hostname} pair) so the config
+ *  validator and the worker's runtime guard call the identical predicate. */
+export function redirectSchemeAllowed(u: { protocol: string; hostname: string }): boolean {
+  if (u.protocol === 'https:') return true;
+  if (u.protocol !== 'http:') return false;
+  const host = u.hostname.toLowerCase();
+  return host === 'localhost' || host === '127.0.0.1';
+}
+
+/** An allow-list ENTRY is a bare origin that parses and passes the scheme
+ *  rule. Used by validateFeatureConfig (auth) on top of the coarse pattern. */
+export function isAllowedRedirectOriginEntry(entry: string): boolean {
+  try {
+    return redirectSchemeAllowed(new URL(entry));
+  } catch {
+    return false;
+  }
+}
+
 export const AuthConfigSchema = Type.Object({
   enabled: Type.Boolean({ default: true }),
   // D3 (auth wave 2026-09-10): the six method toggles collapsed into ONE
@@ -568,6 +648,9 @@ export const AuthConfigSchema = Type.Object({
   //   • allowedRedirectOrigins — when non-empty, EVERY caller-supplied
   //     redirect/return URL (magic link, password reset, email verification,
   //     OAuth start) must match one origin exactly → 422 redirect_not_allowed.
+  //     Entries are `https://host[:port]`, or `http://localhost[:port]` /
+  //     `http://127.0.0.1[:port]` for local development (REDIRECT_ORIGIN_PATTERN
+  //     + redirectSchemeAllowed above — the one rule auth-v1 enforces too).
   security: Type.Optional(Type.Object({
     lockout: Type.Optional(Type.Object({
       maxFailures: Type.Integer({ default: 10, minimum: 3, maximum: 100 }),
@@ -577,7 +660,7 @@ export const AuthConfigSchema = Type.Object({
     breachedPasswords: Type.Boolean({ default: false }),
     captchaSecretRef: Type.Optional(Type.String({ minLength: 1, maxLength: 200 })),
     allowedRedirectOrigins: Type.Optional(Type.Array(
-      Type.String({ minLength: 8, maxLength: 253, pattern: '^https://[^/?#\\s]+$' }),
+      Type.String({ minLength: 8, maxLength: 253, pattern: REDIRECT_ORIGIN_PATTERN }),
       { maxItems: 32 },
     )),
   })),
@@ -598,6 +681,40 @@ export type AuthOidcConfig = Static<typeof OidcProviderSchema>;
 
 export type AuthConfig = Static<typeof AuthConfigSchema>;
 
+// ── DECLARED API STATE (roadmap §4.11 P0-3, 2026-09-23) ──────────────────────
+// A rate-limit policy is a ROW in the feature's own KV store, written by
+// POST/PUT/DELETE /v1/rate-limits/policies. It used to be API state OUTSIDE
+// vxil.config (a journaled deviation: "one writer per datum, and the writer is
+// the route"), which made a second environment non-reproducible — every tenant
+// ended up with an `ensure-rate-limit-policies.ts` + a nightly assert. The
+// rule is unchanged — one writer per datum — but the writer is now THE
+// REPOSITORY: `policies[]` declares the set, and `vxil push` / `POST /v1/apply`
+// CONVERGE the live rows onto it (upsert by `name`, via the feature's own
+// routes; workers/control-plane/src/handlers/apiState.ts). Live rows the
+// config does NOT declare are LEFT in place and reported as drift (deleted
+// only under --allow-destructive), so adopting this block on an existing
+// tenant is never a silent wipe. The item shape MIRRORS the route body
+// (rate-limits-v1 core.ts PolicyBody) exactly; `limit` / `window_seconds`
+// omitted = derived from `defaults` on create and NOT asserted afterwards;
+// `behavior` / `algorithm` omitted = the route defaults ('block' /
+// 'sliding_window') and compared as such. An ARRAY is ONE leaf (countLeaves).
+export const RL_POLICY_NAME_PATTERN = '^[a-zA-Z0-9_.:-]+$';
+/** GET /v1/rate-limits/policies lists at most 100 with no cursor (core.ts
+ *  listPolicies) — a declared set past that could never be reconciled. */
+export const RL_MAX_DECLARED_POLICIES = 100;
+/** rate-limits-v1 core.ts createPolicy: at most 8 distinct `{var}`s. */
+export const RL_KEY_TEMPLATE_MAX_VARS = 8;
+
+export const DeclaredRlPolicySchema = Type.Object({
+  name: Type.String({ minLength: 1, maxLength: 100, pattern: RL_POLICY_NAME_PATTERN }),
+  key_template: Type.String({ minLength: 1, maxLength: 300 }),
+  limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 1_000_000 })),
+  window_seconds: Type.Optional(Type.Integer({ minimum: 1, maximum: 86_400 })),
+  behavior: Type.Optional(Type.Union([Type.Literal('block'), Type.Literal('shape')])),
+  algorithm: Type.Optional(Type.Union([Type.Literal('sliding_window'), Type.Literal('token_bucket')])),
+});
+export type DeclaredRlPolicy = Static<typeof DeclaredRlPolicySchema>;
+
 export const RateLimitsConfigSchema = Type.Object({
   enabled: Type.Boolean({ default: true }),
   defaults: Type.Object(
@@ -607,12 +724,12 @@ export const RateLimitsConfigSchema = Type.Object({
     },
     { default: {} },
   ),
+  policies: Type.Optional(Type.Array(DeclaredRlPolicySchema, { maxItems: RL_MAX_DECLARED_POLICIES })),
 });
-// Leaves: 3. Cap = 15. Deviation (journaled): the doc's `policies` array is
-// managed via the dedicated REST surface (§1 contract) in the feature's own
-// KV, not duplicated into the config artifact — one writer per datum. The
-// per-identifier overrides live the same way (an `ovr:` KV sibling per policy,
-// cap 50 = a code constant, not a config leaf).
+// Leaves: 3 + policies (1 — an array is ONE leaf) = 4. Cap = 15.
+// The per-identifier OVERRIDES stay API state (an `ovr:` KV sibling per
+// policy, cap 50 = a code constant, not a config leaf): they are per-customer
+// operational exceptions, not a declaration of the backend's shape.
 
 export type RateLimitsConfig = Static<typeof RateLimitsConfigSchema>;
 
@@ -682,6 +799,12 @@ export type FilesConfig = Static<typeof FilesConfigSchema>;
 // webhooks-out (wishlist feature): outbound event fan-out over the jobs delivery
 // engine. Subscriptions live in their own table (§1 contract — one writer
 // per datum); config is just the capability gate + a cap.
+export const DeclaredWebhookSubscriptionSchema = Type.Object({
+  target_url: Type.String({ minLength: 9, maxLength: 2000 }),
+  event_prefixes: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 100 }), { maxItems: 20 })),
+});
+export type DeclaredWebhookSubscription = Static<typeof DeclaredWebhookSubscriptionSchema>;
+
 export const WebhooksConfigSchema = Type.Object({
   enabled: Type.Boolean({ default: true }),
   maxSubscriptions: Type.Integer({ default: 20, minimum: 1, maximum: 200 }),
@@ -702,13 +825,30 @@ export const WebhooksConfigSchema = Type.Object({
   // decision with its own abuse review.
   //
   // An Optional object bag counts as ONE leaf (the countLeaves rule).
+  //
+  // `digestMinutes: 0` is IMMEDIATE (roadmap §4.11 P0-4c, 2026-09-23): the
+  // pass runs every minute for the tenant and mails the `error`-level failure
+  // rows that landed since its last mail — at most one mail per minute, still
+  // to the owner accounts. 1–4 are clamped up to 5 by the reader.
   alerts: Type.Optional(Type.Object({
     enabled: Type.Boolean({ default: false }),
     minLevel: Type.Union([Type.Literal('warn'), Type.Literal('error')], { default: 'error' }),
-    digestMinutes: Type.Integer({ default: 15, minimum: 5, maximum: 1440 }),
+    digestMinutes: Type.Integer({ default: 15, minimum: 0, maximum: 1440 }),
   })),
+  // DECLARED API STATE (roadmap §4.11 P0-3, 2026-09-23): the tenant's OUTBOUND
+  // subscriptions as config. Keyed by `target_url` — the only stable identity a
+  // subscription has (there is no name column and no update route, so a changed
+  // prefix set is delete+recreate, exactly what the function-trigger reconciler
+  // does). `vxil push` / `POST /v1/apply` converge public.webhook_subscriptions
+  // onto this list (handlers/apiState.ts); undeclared live rows are LEFT and
+  // reported (deleted only under --allow-destructive). Rows on the platform's
+  // signed function-delivery lanes (/v1/internal/fn/…) are NEVER declared here
+  // — they derive from the functions manifest — and never count as undeclared.
+  // Item shape mirrors handlers/webhooks.ts createSubscription's body. An
+  // Optional ARRAY is ONE leaf.
+  subscriptions: Type.Optional(Type.Array(DeclaredWebhookSubscriptionSchema, { maxItems: 200 })),
 });
-// Leaves: 3 + alerts(1, optional bag) = 4. Cap = 15.
+// Leaves: 3 + alerts(1, optional bag) + subscriptions(1, array) = 5. Cap = 15.
 
 export type WebhooksConfig = Static<typeof WebhooksConfigSchema>;
 
@@ -732,8 +872,9 @@ export const CmsConfigSchema = Type.Object({
   draftPublish: Type.Boolean({ default: true }),
   // cms end-user default-deny fail-safe (path-to-100 §3.2, Feature B). When ON,
   // a VERIFIED end-user key (owner-scope mode) is DENIED access to any
-  // collection that declares no owner_field — 404 on read, 403 on write —
-  // instead of the default tenant-wide-shared behavior. Server-caller mode is a
+  // collection that declares no owner_field — `403 server_only` on read AND
+  // write (finding 29, 2026-09-20; reads used to be a 404) — instead of the
+  // default tenant-wide-shared behavior. Server-caller mode is a
   // byte-for-byte no-op. Default OFF preserves today's shared semantics
   // (owner.int.test.ts's shared-collection invariant). A collection that DOES
   // declare an ownerField is unaffected. ONE boolean leaf.
@@ -1133,6 +1274,16 @@ export type VectorSearchConfig = Static<typeof VectorSearchConfigSchema>;
 // intelligence (prompt TEMPLATES are config-as-code, stored/rendered but never
 // authored). 'mock' is the deterministic default until a BYO key is provisioned;
 // the real providers route via tenant_secrets keyRefs.
+export const AI_TEMPLATE_NAME_PATTERN = '^[a-zA-Z0-9_.\\-]+$';
+export const AI_MAX_DECLARED_TEMPLATES = 50;
+export const DeclaredAiTemplateSchema = Type.Object({
+  template: Type.String({ minLength: 1, maxLength: 128, pattern: AI_TEMPLATE_NAME_PATTERN }),
+  user: Type.String({ minLength: 1, maxLength: 64_000 }),
+  system: Type.Optional(Type.String({ maxLength: 32_000 })),
+  schema: Type.Optional(Type.Record(Type.String(), Type.Unknown())),
+});
+export type DeclaredAiTemplate = Static<typeof DeclaredAiTemplateSchema>;
+
 export const AiConfigSchema = Type.Object({
   enabled: Type.Boolean({ default: true }),
   // 'azure' uses the OpenAI adapter shape (azure-openai compatible; pair it with
@@ -1175,19 +1326,38 @@ export const AiConfigSchema = Type.Object({
     tokensPerUserPerDay: Type.Integer({ default: 0, minimum: 0 }), // 0 = unlimited
     consumeCredits: Type.Boolean({ default: false }),              // LIVE: reserve→settle against the payments credit ledger (a job-routed generation reserves pre-generation and 402s insufficient_credits)
   }, { default: {} }),
-  streaming: Type.Object({
+  // `streaming` became an OPTIONAL bag (3 leaves → 1, the M21 `retry` trick)
+  // on 2026-09-23 to fund the declared `templates[]` below. It KEEPS
+  // `default: {}`, so Value.Default still materializes
+  // streaming.{enabled,replayBufferFrames,flushMs} into every persisted
+  // manifest exactly as before (zero behavioral delta — ai-v1 declares its own
+  // schema mirror plain and reads the materialized leaves); only the TS type
+  // here is optional.
+  streaming: Type.Optional(Type.Object({
     enabled: Type.Boolean({ default: true }),
     replayBufferFrames: Type.Integer({ default: 256, minimum: 1 }), // §2a ring-buffer depth
     flushMs: Type.Integer({ default: 50, minimum: 0 }),             // §2a/#148 token→frame coalesce window
-  }, { default: {} }),
+  }, { default: {} })),
+  // DECLARED API STATE (roadmap §4.11 P0-3, 2026-09-23): the tenant's stored
+  // prompt templates as config. vxil STORES + versions, never authors (ai.md
+  // §0) — declaring them here changes WHO writes the row (the repository, via
+  // `vxil push`), not what vxil does with it. Converged by CONTENT: the
+  // control-plane hashes each declared entry (@vxil/runtime
+  // aiTemplateContentSha256) against the `content_sha256` GET /v1/ai/templates
+  // stamps on the latest version, and POSTs a new version ONLY when the content
+  // differs — so a push is idempotent and versions stay monotonic per name.
+  // Item shape mirrors ai-v1 core.ts TemplateBody exactly (`template` is the
+  // name). Stored templates the config does not declare are reported (there is
+  // no delete route — they are never removed). Bounded to 50 entries: the
+  // manifest rides the 1 MiB config body cap. An Optional ARRAY is ONE leaf.
+  templates: Type.Optional(Type.Array(DeclaredAiTemplateSchema, { maxItems: AI_MAX_DECLARED_TEMPLATES })),
 });
 // Leaves: enabled(1), defaultProvider(2), providers.{openai,anthropic,gemini}KeyRef(+3=5),
 //   providers.compat(+1=6 — Optional object → ONE leaf),
 //   defaults.{model,maxTokens,temperature}(+3=9), cache.ttlSeconds(10),
 //   limits.{tokensPerUserPerDay,consumeCredits}(+2=12),
-//   streaming.{enabled,replayBufferFrames,flushMs}(+3=15). countLeaves → 15. Cap = 15.
-//   ZERO headroom: any future ai knob must ride inside compat (free) or another
-//   optional object.
+//   streaming(+1=13 — Optional bag since 2026-09-23, was 3 flat leaves),
+//   templates(+1=14 — array). countLeaves → 14. Cap = 15. ONE leaf of headroom.
 
 export type AiConfig = Static<typeof AiConfigSchema>;
 
@@ -1821,6 +1991,89 @@ function publicHttpsUrlError(url: string): string | null {
  *  validation below and the control-plane deploy clamp. */
 export const DENY_FUNCTION_SCOPES = new Set(['admin', '*', 'features:write', 'functions:write', 'secrets:write']);
 
+// ── declared API state — config-write validators (roadmap §4.11 P0-3) ────────
+/** `{var}` names of a rate-limit key template (rate-limits-v1 core.ts
+ *  templateVars parity). */
+export function rlTemplateVars(template: string): string[] {
+  return [...template.matchAll(/\{([a-zA-Z0-9_]+)\}/g)].map((m) => m[1]!);
+}
+
+export function validateDeclaredRlPolicies(policies: readonly DeclaredRlPolicy[] | undefined): string[] {
+  const errs: string[] = [];
+  const seen = new Set<string>();
+  (policies ?? []).forEach((p, i) => {
+    if (seen.has(p.name)) errs.push(`/policies/${i}/name: duplicate policy name '${p.name}' (policies converge by name, so it must be unique)`);
+    seen.add(p.name);
+    if (new Set(rlTemplateVars(p.key_template)).size > RL_KEY_TEMPLATE_MAX_VARS) {
+      errs.push(`/policies/${i}/key_template: too many variables (max ${RL_KEY_TEMPLATE_MAX_VARS})`);
+    }
+  });
+  return errs;
+}
+
+export function validateDeclaredWebhookSubscriptions(
+  subscriptions: readonly DeclaredWebhookSubscription[] | undefined, maxSubscriptions: number | undefined,
+): string[] {
+  const errs: string[] = [];
+  const seen = new Set<string>();
+  const subs = subscriptions ?? [];
+  if (maxSubscriptions !== undefined && subs.length > maxSubscriptions) {
+    errs.push(`/subscriptions: ${subs.length} declared but maxSubscriptions is ${maxSubscriptions} (raise maxSubscriptions or declare fewer)`);
+  }
+  subs.forEach((sub, i) => {
+    if (seen.has(sub.target_url)) errs.push(`/subscriptions/${i}/target_url: duplicate target_url (subscriptions converge by target_url, so it must be unique)`);
+    seen.add(sub.target_url);
+    const urlErr = publicHttpsUrlError(sub.target_url);
+    if (urlErr) errs.push(`/subscriptions/${i}/target_url: ${urlErr}`);
+    else if (isFnTriggerSubscriptionUrl(sub.target_url)) {
+      errs.push(`/subscriptions/${i}/target_url: a function-delivery lane is never declared here — declare the trigger on the function (functions.<name>.trigger) and the platform reconciles its subscription`);
+    }
+  });
+  return errs;
+}
+
+/** The stored-template `schema` bounds — MIRRORED from @vxil/runtime
+ *  (AI_TEMPLATE_SCHEMA_MAX_BYTES / AI_TEMPLATE_SCHEMA_MAX_DEPTH; this package is
+ *  typebox-only). ai-v1 putTemplate refuses the same numbers at the route, so a
+ *  declared entry that passes here is never a 422 at converge. */
+export const AI_TEMPLATE_SCHEMA_MAX_BYTES = 32_000;
+export const AI_TEMPLATE_SCHEMA_MAX_DEPTH = 64;
+
+/** Nesting depth of a JSON value, iteratively (`{}` = 1, scalar = 0). */
+function jsonDepthOf(v: unknown): number {
+  let max = 0;
+  const stack: Array<{ v: unknown; d: number }> = [{ v, d: 0 }];
+  while (stack.length) {
+    const { v: cur, d } = stack.pop()!;
+    if (cur === null || typeof cur !== 'object') continue;
+    const depth = d + 1;
+    if (depth > max) max = depth;
+    for (const c of Array.isArray(cur) ? cur : Object.values(cur as Record<string, unknown>)) {
+      if (c !== null && typeof c === 'object') stack.push({ v: c, d: depth });
+    }
+  }
+  return max;
+}
+
+export function validateDeclaredAiTemplates(templates: readonly DeclaredAiTemplate[] | undefined): string[] {
+  const errs: string[] = [];
+  const seen = new Set<string>();
+  (templates ?? []).forEach((t, i) => {
+    if (seen.has(t.template)) errs.push(`/templates/${i}/template: duplicate template name '${t.template}' (templates converge by name, so it must be unique)`);
+    seen.add(t.template);
+    if (t.schema === undefined) return;
+    if (typeof t.schema !== 'object' || t.schema === null || Array.isArray(t.schema)) {
+      errs.push(`/templates/${i}/schema: must be a JSON-Schema object`);
+      return;
+    }
+    const bytes = JSON.stringify(t.schema).length;
+    if (bytes > AI_TEMPLATE_SCHEMA_MAX_BYTES) errs.push(`/templates/${i}/schema: too large (${bytes} > ${AI_TEMPLATE_SCHEMA_MAX_BYTES} bytes serialized)`);
+    const depth = jsonDepthOf(t.schema);
+    if (depth > AI_TEMPLATE_SCHEMA_MAX_DEPTH) errs.push(`/templates/${i}/schema: nests too deep (${depth} > ${AI_TEMPLATE_SCHEMA_MAX_DEPTH} levels)`);
+  });
+  return errs;
+}
+
 export function validateFeatureConfig(feature: string, raw: unknown): ConfigValidation {
   const schema = FEATURE_SCHEMAS[feature];
   if (!schema) {
@@ -1852,6 +2105,7 @@ export function validateFeatureConfig(feature: string, raw: unknown): ConfigVali
     const v = withDefaults as {
       provider?: string;
       resendApiKeyRef?: string;
+      ses?: { region?: string; accessKeyIdRef?: string; secretAccessKeyRef?: string };
       templates?: {
         allowOverride?: boolean;
         overrides?: Record<string, Record<string, { subject?: string; html?: string; text?: string }>>;
@@ -1863,6 +2117,16 @@ export function validateFeatureConfig(feature: string, raw: unknown): ConfigVali
         errors: ["/resendApiKeyRef: required when provider is 'resend' (omit it for provider 'mock')"],
       };
     }
+    // Same posture for the second real provider: `ses` without its bag is a
+    // config the worker could only fail at send time, so refuse it at push.
+    // (The bag's three members are each schema-required once the bag is
+    // present, so a partial bag already failed TypeBox above.)
+    if (v.provider === 'ses' && !v.ses) {
+      return {
+        ok: false,
+        errors: ["/ses: required when provider is 'ses' — { region, accessKeyIdRef, secretAccessKeyRef } (omit it for provider 'mock')"],
+      };
+    }
     const overrideErrs = validateNotificationOverrides(v.templates);
     if (overrideErrs.length) return { ok: false, errors: overrideErrs.slice(0, 10) };
   }
@@ -2014,22 +2278,56 @@ export function validateFeatureConfig(feature: string, raw: unknown): ConfigVali
   // write time (pure mirror of @vxil/runtime assertPublicHttpsUrl; ai-v1 re-runs
   // the authoritative runtime guard at use time — the mcp customTools idiom).
   if (feature === 'ai') {
-    const v = withDefaults as { providers?: { compat?: { openaiBaseUrl?: string } } };
+    const v = withDefaults as {
+      providers?: { compat?: { openaiBaseUrl?: string } };
+      templates?: DeclaredAiTemplate[];
+    };
     const baseUrl = v.providers?.compat?.openaiBaseUrl;
     if (baseUrl) {
       const urlErr = publicHttpsUrlError(baseUrl);
       if (urlErr) return { ok: false, errors: [`/providers/compat/openaiBaseUrl: ${urlErr}`] };
     }
+    const tplErrs = validateDeclaredAiTemplates(v.templates);
+    if (tplErrs.length) return { ok: false, errors: tplErrs.slice(0, 10) };
+  }
+  // Cross-field rules: declared API state (roadmap §4.11 P0-3). Each list is
+  // converged by NAME/URL, so a duplicate key is ambiguous and refused at push;
+  // the per-item rules mirror the feature route's own validation so a declared
+  // entry can never be one the converge would 422 on.
+  if (feature === 'rate-limits') {
+    const v = withDefaults as { policies?: DeclaredRlPolicy[] };
+    const errs = validateDeclaredRlPolicies(v.policies);
+    if (errs.length) return { ok: false, errors: errs.slice(0, 10) };
+  }
+  if (feature === 'webhooks') {
+    const v = withDefaults as { maxSubscriptions?: number; subscriptions?: DeclaredWebhookSubscription[] };
+    const errs = validateDeclaredWebhookSubscriptions(v.subscriptions, v.maxSubscriptions);
+    if (errs.length) return { ok: false, errors: errs.slice(0, 10) };
   }
   // Cross-field rule: auth otp.testRecipients (F4-29) — every entry must be an
   // email, an `*@domain` glob, or a +E.164 number; anything else would never
   // match and silently do nothing.
   if (feature === 'auth') {
-    const v = withDefaults as { otp?: { testRecipients?: string[] } };
+    const v = withDefaults as {
+      otp?: { testRecipients?: string[] };
+      security?: { allowedRedirectOrigins?: string[] };
+    };
     const bad = (v.otp?.testRecipients ?? []).filter((e) => !isTestRecipientPattern(e));
     if (bad.length) {
       return { ok: false, errors: bad.slice(0, 10).map((e) => `/otp/testRecipients: '${e}' is not an email, an *@domain glob, or a +E.164 number`) };
     }
+    // security.allowedRedirectOrigins: the SAME scheme predicate auth-v1 applies
+    // at runtime (redirectSchemeAllowed) — https anywhere, http on loopback only.
+    // The TypeBox pattern above already refused the shape; this re-check is what
+    // keeps the validator and the worker on one rule (parity-tested).
+    const badOrigin = (v.security?.allowedRedirectOrigins ?? []).filter((e) => !isAllowedRedirectOriginEntry(e));
+    if (badOrigin.length) {
+      return {
+        ok: false,
+        errors: badOrigin.slice(0, 10).map((e) =>
+          `/security/allowedRedirectOrigins: '${e}' must be an https:// origin, or http://localhost[:port] / http://127.0.0.1[:port] for local development (plain http on any other host is refused)`),
+      };
+    }
   }
   // Cross-field rule: functions. Reject privilege-escalating scopes and malformed
   // bindings at config-write time (the deploy pipeline additionally asserts the
@@ -2082,7 +2380,7 @@ export function validateFeatureConfig(feature: string, raw: unknown): ConfigVali
     const v = withDefaults as {
       agents?: Record<string, {
         actions?: { mode?: string; allow?: Record<string, unknown> };
-        guardrails?: { allowGuest?: boolean; guestToolAllow?: string[] };
+        guardrails?: { allowGuest?: boolean; guestToolAllow?: string[]; rateLimitPerUserPerDay?: number };
       }>;
       widget?: { requireAuth?: boolean };
     };
@@ -2091,7 +2389,14 @@ export function validateFeatureConfig(feature: string, raw: unknown): ConfigVali
     for (const [id, agent] of Object.entries(v.agents ?? {})) {
       const allow = agent.actions?.allow ?? {};
       const guestAllow = agent.guardrails?.guestToolAllow ?? [];
-      if (agent.guardrails?.allowGuest === true) anyGuestAgent = true;
+      if (agent.guardrails?.allowGuest === true) {
+        anyGuestAgent = true;
+        // Guests share ONE tenant-wide bucket that spends the tenant's own AI
+        // key: an unlimited (0) daily cap is never allowed alongside them.
+        if (agent.guardrails.rateLimitPerUserPerDay === 0) {
+          errs.push(`/agents/${id}/guardrails/rateLimitPerUserPerDay: 0 (unlimited) is not allowed with allowGuest: true — set a finite daily cap (guests share one tenant-wide bucket)`);
+        }
+      }
       if (knownMcpTools) {
         for (const tool of Object.keys(allow)) {
           if (!knownMcpTools.has(tool)) {