@vxil/feature-configs 0.6.0 → 0.7.1

package/dist/apiState.d.ts

@@ -166,11 +166,11 @@ export interface ApiStateResponseField extends ApiStateSummary {
 }
 /** The note every executor reports for a DISABLED feature whose block still
  *  declares rows: the declaration is kept in the manifest and nothing is
- *  converged (a parked feature is not a propagation window — review finding 2). */
+ *  converged (a parked feature is not a propagation window). */
 export declare const API_STATE_DISABLED_NOTE = "feature disabled \u2014 declaration kept, not converged";
 /** `GET /v1/rate-limits/policies` is a 100-row HARD cap with no cursor. A list
  *  AT the cap is not a complete live set, so planning creates against it would
- *  re-POST every declared name the cap hid (review finding 5). The server's
+ *  re-POST every declared name the cap hid. The server's
  *  converge and the CLI's read-only plan refuse with this message instead. */
 export declare function rlPolicyListCapError(liveCount: number): string | null;
 export declare const RL_POLICY_LIST_CAP = 100;

package/dist/apiState.js

@@ -161,11 +161,11 @@ export function emptyApiStateSummary(datum) {
 }
 /** The note every executor reports for a DISABLED feature whose block still
  *  declares rows: the declaration is kept in the manifest and nothing is
- *  converged (a parked feature is not a propagation window — review finding 2). */
+ *  converged (a parked feature is not a propagation window). */
 export const API_STATE_DISABLED_NOTE = 'feature disabled — declaration kept, not converged';
 /** `GET /v1/rate-limits/policies` is a 100-row HARD cap with no cursor. A list
  *  AT the cap is not a complete live set, so planning creates against it would
- *  re-POST every declared name the cap hid (review finding 5). The server's
+ *  re-POST every declared name the cap hid. The server's
  *  converge and the CLI's read-only plan refuse with this message instead. */
 export function rlPolicyListCapError(liveCount) {
     if (liveCount < RL_POLICY_LIST_CAP)

package/dist/hooks.d.ts

@@ -69,7 +69,7 @@ export declare function parseExpr(src: string): Node;
 /** Walk the AST and reject anything outside the allow-list, plus depth bounds.
  *  Returns an array of human-readable errors (empty = safe). Pure, no eval. */
 export declare function validateAst(root: Node): string[];
-/** The VERIFIED caller/session context for read hooks (design §5.6). Read-only;
+/** The VERIFIED caller/session context for read hooks (guide ch. 7). Read-only;
  *  present only on the read path in end-user mode. In server mode / write path
  *  the whole object is null. */
 export interface HookCaller {
@@ -142,7 +142,7 @@ export interface ReadHookResult {
  *  HookEvalError (→ a clean 422, never a pinned isolate). Write events never
  *  fire here, and read events never fire in runWriteHooks. */
 export declare function runReadHooks(hooks: Record<string, HookDef> | undefined, collection: string, rows: ReadonlyArray<Record<string, unknown>>, now: string, 
-/** verified caller/session context (design §5.6) — read-only, exposed to
+/** verified caller/session context (guide ch. 7) — read-only, exposed to
  *  expressions as `caller.endUserId` / `caller.principal`. Omitted ⇒ null
  *  (server-caller mode). */
 caller?: HookCaller | null): ReadHookResult;

package/dist/hooks.js

@@ -699,7 +699,7 @@ export function runWriteHooks(hooks, collection, phase, data, before, now) {
  *  HookEvalError (→ a clean 422, never a pinned isolate). Write events never
  *  fire here, and read events never fire in runWriteHooks. */
 export function runReadHooks(hooks, collection, rows, now, 
-/** verified caller/session context (design §5.6) — read-only, exposed to
+/** verified caller/session context (guide ch. 7) — read-only, exposed to
  *  expressions as `caller.endUserId` / `caller.principal`. Omitted ⇒ null
  *  (server-caller mode). */
 caller) {

package/dist/index.d.ts

@@ -4,7 +4,7 @@ export * from './readmodels.js';
 export * from './apiState.js';
 export * from './canonicalJson.js';
 export declare const RESERVED_CREDIT_TYPES: ReadonlySet<string>;
-/** F33 (2026-09-25): a function binding's `retry.maxAttempts` ceiling, and the
+/** A function binding's `retry.maxAttempts` ceiling, and the
  *  binding kinds that may carry `retry` — the platform-delivered event lanes
  *  (an http invoke returns its own status; a cron tick's retry would overlap
  *  the next tick). Read by the schema, the deploy clamp and the CLI. */
@@ -20,14 +20,14 @@ export declare const NOTIFICATION_TEMPLATE_PLACEHOLDERS: Readonly<Record<string,
  * exist and renders EMPTY. Rejected in `subject` for exactly the reason the
  * whole allow-list exists: a silent empty render in a live email. */
 export declare const NOTIFICATION_TEMPLATE_SLOT_PLACEHOLDERS: Readonly<Record<string, readonly string[]>>;
-/** Per-override caps (D4). Bodies are emails, not documents. */
+/** Per-override caps. Bodies are emails, not documents. */
 export declare const NOTIF_OVERRIDE_SUBJECT_MAX = 500;
 export declare const NOTIF_OVERRIDE_BODY_MAX = 20000;
 /** Whole-map caps: keeps one manifest (and the KV row every send reads) small. */
 export declare const NOTIF_OVERRIDE_MAX_LOCALES_PER_TEMPLATE = 20;
 export declare const NOTIF_OVERRIDE_MAX_BYTES: number;
 /**
- * D4 — validate `templates.overrides` at CONFIG-WRITE time. Returns [] when the
+ * Validate `templates.overrides` at CONFIG-WRITE time. Returns [] when the
  * bag is absent or clean. Every rule fails LOUD rather than shipping something
  * that silently renders wrong in a customer's inbox:
  *   • overrides present with `allowOverride:false` → rejected (never inert);
@@ -91,10 +91,10 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
     }>>;
     /** in-app inbox channel (send with channel: 'inbox' | 'both') */
     inboxEnabled: import("@sinclair/typebox").TBoolean;
-    /** §11b.5 broadcast campaigns channel. Optional bag (= 1 leaf): absent means
+    /** Broadcast campaigns channel. Optional bag (= 1 leaf): absent means
      * disabled; per-campaign quiet_hours / freq_cap overrides live on the
      * notifications.campaigns ROW (tenant data), not here. Folded into the
-     * canonical schema 2026-07-18 (M21/#4 — Value.Clean previously STRIPPED the
+     * canonical schema 2026-07-18 (Value.Clean previously STRIPPED the
      * worker-local extension, so campaigns 403'd via the real config path). */
     broadcast: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         enabled: import("@sinclair/typebox").TBoolean;
@@ -114,9 +114,9 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
     }>>;
 }>;
 export type NotificationsConfig = Static<typeof NotificationsConfigSchema>;
-/** The §11b.5 broadcast bag as persisted (present ⇒ leaf defaults applied). */
+/** The broadcast bag as persisted (present ⇒ leaf defaults applied). */
 export type BroadcastConfig = NonNullable<NotificationsConfig['broadcast']>;
-/** Generation-lifecycle config defaults (jobs.md §11 / §5 ≤15-flag budget). */
+/** Generation-lifecycle config defaults (guide ch. 6, jobs). */
 export declare const GENERATION_DEFAULTS: {
     /** per-tenant in-flight generation cap (separate budget from queue jobs) */
     readonly maxConcurrent: 20;
@@ -189,14 +189,14 @@ export declare const JobsConfigSchema: import("@sinclair/typebox").TObject<{
         maxTimeoutMs: import("@sinclair/typebox").TInteger;
         /** poll-mode: how many poll cycles before giving up (→ terminal-fail) */
         pollMaxAttempts: import("@sinclair/typebox").TInteger;
-        /** MANDATORY per-hold cap on a generation `reserve_credits.amount` (jobs.md
-         * §11.8). Every requested amount is CLAMPED to this (never rejected) — a
+        /** MANDATORY per-hold cap on a generation `reserve_credits.amount`
+         * (guide ch. 6, jobs). Every requested amount is CLAMPED to this (never rejected) — a
          * conservative default so an untrusted deployed function that carries a
          * reserve block can never hold more than a bounded amount per run without
          * any tenant action. */
         maxReserveCredits: import("@sinclair/typebox").TInteger;
         /** MANDATORY per-tenant ceiling on the SUM of un-settled provisional
-         * reserve holds across all in-flight generation runs (jobs.md §11.8): a
+         * reserve holds across all in-flight generation runs (guide ch. 6, jobs): a
          * reserve whose amount would push the tenant's outstanding-holds total over
          * this is rejected 429, so a runaway function cannot hold every user at
          * once. Defaulted so no tenant action is required to be safe. */
@@ -318,7 +318,7 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
 }>;
 /** The security bag as persisted (present ⇒ leaf defaults applied). */
 export type AuthSecurityConfig = NonNullable<Static<typeof AuthConfigSchema>['security']>;
-/** The RB-2 generic OIDC / SSO issuer block (`providers.oidc`). */
+/** The generic OIDC / SSO issuer block (`providers.oidc`). */
 export type AuthOidcConfig = Static<typeof OidcProviderSchema>;
 export type AuthConfig = Static<typeof AuthConfigSchema>;
 export declare const RL_POLICY_NAME_PATTERN = "^[a-zA-Z0-9_.:-]+$";
@@ -656,6 +656,7 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
         secretApiKeyRef: import("@sinclair/typebox").TString;
         webhookSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         acceptSandbox: import("@sinclair/typebox").TBoolean;
+        sandboxUsers: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     }>>;
     paypal: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         clientIdRef: import("@sinclair/typebox").TString;
@@ -685,6 +686,7 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
                 creditType: import("@sinclair/typebox").TString;
                 amount: import("@sinclair/typebox").TInteger;
                 period: import("@sinclair/typebox").TString;
+                mode: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"add">, import("@sinclair/typebox").TLiteral<"reset">]>>;
             }>>>;
         }>>;
         priceMap: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TString>>;
@@ -718,11 +720,17 @@ export declare const FunctionsConfigSchema: import("@sinclair/typebox").TObject<
             retry: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
                 maxAttempts: import("@sinclair/typebox").TInteger;
             }>>;
+            overlap: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"allow">, import("@sinclair/typebox").TLiteral<"skip">]>>;
         }>>>;
         scriptRef: import("@sinclair/typebox").TString;
         scopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         secrets: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         egressAllow: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        runtime: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            compatibilityDate: import("@sinclair/typebox").TString;
+            compatibilityFlags: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+            cpuMs: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TNumber>;
+        }>>;
         limits: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
             cpuMs: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
             timeoutMs: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
@@ -781,16 +789,29 @@ export declare const CopilotConfigSchema: import("@sinclair/typebox").TObject<{
 export type CopilotConfig = Static<typeof CopilotConfigSchema>;
 export declare const FEATURE_SCHEMAS: Record<string, TSchema>;
 export declare const CONFIG_FLAG_CAP = 15;
-/** Counts leaf flags in a TypeBox object schema (architecture §6).
- * Per features/auth.md §4: an OPTIONAL object (e.g. a provider credential
+/** Counts leaf flags in a TypeBox object schema.
+ * Per guide ch. 6, auth: an OPTIONAL object (e.g. a provider credential
  * block) counts as ONE flag — the tenant's decision is "configure it or
  * not", not each inner ref. */
-/** The auth lifecycle events an `authHook` binding may name (F4-30) — the
+/** The auth lifecycle events an `authHook` binding may name — the
  * closed union `packages/config` types as AuthHookEvent; the control-plane
  * reconciler maps each to its `auth.<event>` audit-event prefix. */
 export declare const AUTH_HOOK_EVENTS: readonly ["user.created", "session.created", "session.revoked", "signin.failure"];
 export type AuthHookEvent = (typeof AUTH_HOOK_EVENTS)[number];
-/** F4-29 test-recipient entry grammar (shared by the validator and auth-v1's
+/** The events a `cmsHook` function binding may name — the closed union
+ * `packages/config` types on the `cmsHook` trigger, and the keys of the
+ * functions-v1 receiver's CMS_HOOK_EVENTS_FOR (beforeCreate → created,
+ * beforeUpdate → updated, beforeWrite → both). Omitted = beforeWrite. Anything
+ * else is refused at config write (E-CMSHOOK, 2026-10-01): an unknown name used
+ * to fall back to beforeWrite at delivery, so a typo like 'afterCreate' or
+ * 'beforeDelete' silently subscribed the function to creates AND updates.
+ * A CI gate pins every copy to this list. */
+export declare const CMS_HOOK_EVENTS: readonly ["beforeCreate", "beforeUpdate", "beforeWrite"];
+export type CmsHookEvent = (typeof CMS_HOOK_EVENTS)[number];
+/** The ONE refusal text for an unknown cmsHook binding event (the config
+ * validator and the deploy route's early 422 both use it). */
+export declare function cmsHookEventError(event: unknown): string | null;
+/** The OTP test-recipient entry grammar (shared by the validator and auth-v1's
  * matcher): an exact email, a `*@domain` glob, or a +E.164 phone number. */
 export declare const TEST_RECIPIENT_EMAIL_RE: RegExp;
 export declare const TEST_RECIPIENT_GLOB_RE: RegExp;