@vxil/cli 0.24.1 → 0.25.0

package/dist/vxil-main.js

@@ -3182,7 +3182,8 @@ var API_STATE_DATUMS = [
   { feature: "rate-limits", datum: "policies" },
   { feature: "webhooks", datum: "subscriptions" },
   { feature: "ai", datum: "templates" },
-  { feature: "orgs", datum: "roles" }
+  { feature: "orgs", datum: "roles" },
+  { feature: "vector-search", datum: "collections" }
 ];
 function apiStateDatumOf(feature) {
   return API_STATE_DATUMS.find((d) => d.feature === feature)?.datum ?? null;
@@ -3311,6 +3312,81 @@ function planOrgRoles(declared, live) {
   for (const l of live) if (!declaredKeys.has(l.role_key)) plan.undeclared.push(l.role_key);
   return plan;
 }
+var KEYED_PROVIDERS = /* @__PURE__ */ new Set(["openai", "cohere"]);
+function planSearchCollections(declared, live) {
+  const plan = { create: [], update: [], unchanged: [], immutable: [], refused: [], undeclared: [] };
+  const byName = new Map(live.map((l) => [l.collection, l]));
+  const declaredNames = new Set(declared.map((d) => d.collection));
+  for (const d of declared) {
+    const l = byName.get(d.collection);
+    if (!l) {
+      plan.create.push({
+        collection: d.collection,
+        ...d.dimensions !== void 0 ? { dimensions: d.dimensions } : {},
+        ...d.embed && Object.keys(d.embed).length ? { embed: { ...d.embed } } : {}
+      });
+      continue;
+    }
+    if (d.dimensions !== void 0 && d.dimensions !== l.dimensions) {
+      plan.immutable.push({ collection: d.collection, declared: d.dimensions, live: l.dimensions });
+      continue;
+    }
+    const e = d.embed ?? {};
+    const changed = [];
+    const providerChanged = e.provider !== void 0 && e.provider !== (l.provider ?? null);
+    if (providerChanged) changed.push("provider");
+    if (e.model !== void 0 && l.model !== void 0 && e.model !== (l.model ?? null)) changed.push("model");
+    if (e.apiKeyRef !== void 0 && l.api_key_ref !== void 0 && e.apiKeyRef !== (l.api_key_ref ?? null)) changed.push("apiKeyRef");
+    if (!changed.length) {
+      plan.unchanged.push(d.collection);
+      continue;
+    }
+    let embed;
+    if (providerChanged) {
+      const missing = KEYED_PROVIDERS.has(e.provider) ? ["model", "apiKeyRef"].filter((k) => e[k] === void 0) : [];
+      if (missing.length) {
+        plan.refused.push({
+          collection: d.collection,
+          error: `provider change to ${e.provider} must also declare embed.${missing.join(" and embed.")} \u2014 the live ${l.provider ?? "default"} settings are never carried over to a new provider (and the new model must output the collection's ${l.dimensions} dimensions)`
+        });
+        continue;
+      }
+      embed = { ...e };
+    } else {
+      const provider = e.provider ?? l.provider ?? void 0;
+      const model = e.model ?? l.model ?? void 0;
+      const apiKeyRef = e.apiKeyRef ?? l.api_key_ref ?? void 0;
+      embed = { ...provider ? { provider } : {}, ...model ? { model } : {}, ...apiKeyRef ? { apiKeyRef } : {} };
+    }
+    const reembed = (changed.includes("provider") || changed.includes("model")) && (l.documents ?? 1) > 0;
+    plan.update.push({ body: { collection: d.collection, dimensions: l.dimensions, embed }, changed, reembed });
+  }
+  for (const l of live) if (!declaredNames.has(l.collection)) plan.undeclared.push(l.collection);
+  return plan;
+}
+function searchCollectionImmutableError(i) {
+  return `422 dimensions_immutable: declared dimensions ${i.declared} but the live collection has ${i.live} \u2014 dimensions are immutable; declare a new collection name and re-ingest`;
+}
+function pulledSearchCollections(rows) {
+  if (rows.length > SEARCH_COLLECTION_PULL_CAP) {
+    return { note: `  vector-search.collections: the tenant has ${rows.length} search collections, past the ${SEARCH_COLLECTION_PULL_CAP}-entry cap of a declared collections[] \u2014 not written; they stay live rows` };
+  }
+  return {
+    collections: rows.map((r) => {
+      const embed = {};
+      if (typeof r.provider === "string") embed.provider = r.provider;
+      if (typeof r.model === "string") embed.model = r.model;
+      if (typeof r.api_key_ref === "string") embed.apiKeyRef = r.api_key_ref;
+      return {
+        collection: String(r.collection),
+        // the server only ever stores an allowed width
+        ...typeof r.dimensions === "number" ? { dimensions: r.dimensions } : {},
+        ...Object.keys(embed).length ? { embed } : {}
+      };
+    })
+  };
+}
+var SEARCH_COLLECTION_PULL_CAP = 50;
 function emptyApiStateSummary(datum) {
   return {
     datum,
@@ -3355,7 +3431,9 @@ function formatApiStateDetail(s) {
   for (const k of s.updated) lines.push(`  ~ ${k}`);
   for (const k of s.recreated) lines.push(`  \u21BB ${k} (recreated \u2014 new id)`);
   for (const k of s.deleted) lines.push(`  - ${k} (deleted: undeclared, --allow-destructive)`);
-  for (const k of s.undeclared) lines.push(`  \xB7 ${k} \u2014 live but not declared (left in place; --allow-destructive deletes it)`);
+  for (const k of s.undeclared) {
+    lines.push(s.datum === "collections" ? `  \xB7 ${k} \u2014 live but not declared (left in place; a push never deletes a search collection)` : `  \xB7 ${k} \u2014 live but not declared (left in place; --allow-destructive deletes it)`);
+  }
   for (const k of s.pending_destructive) lines.push(`  ! ${k} \u2014 needs delete+recreate (new id); re-run with --allow-destructive`);
   for (const k of s.ambiguous) lines.push(`  ! ${k} \u2014 more than one live row carries this name; delete the extras first`);
   for (const f of s.failed) lines.push(`  \u2717 ${f.key} \u2014 ${f.error}`);
@@ -3369,6 +3447,9 @@ var PUBLIC_ASSET_TYPES = {
   webp: "image/webp",
   avif: "image/avif",
   gif: "image/gif",
+  // Favicons. A raster container (BMP/PNG frames) — no
+  // script, rendered only as an image; never a variant source.
+  ico: "image/x-icon",
   mp4: "video/mp4",
   webm: "video/webm",
   mp3: "audio/mpeg",
@@ -3382,6 +3463,7 @@ var TYPE_TO_EXT = {
   ...Object.fromEntries(Object.entries(PUBLIC_ASSET_TYPES).map(([ext, ct]) => [ct, ext])),
   "image/jpg": "jpg",
   "image/pjpeg": "jpg",
+  "image/vnd.microsoft.icon": "ico",
   "audio/mp3": "mp3",
   "audio/x-m4a": "m4a",
   "audio/m4a": "m4a",
@@ -3917,7 +3999,17 @@ var AuthConfigSchema = Type.Object({
   // OPTIONAL bag = 1 leaf. Lives in AUTH config (not orgs) because auth-v1's
   // CONFIG_KV is the auth namespace and cannot see orgs config.
   orgClaims: Type.Optional(Type.Object({
-    enabled: Type.Boolean({ default: false })
+    enabled: Type.Boolean({ default: false }),
+    // ACTIVE-ORG mode. Every mint/refresh stamps the session claim
+    // `oam: 1`, the session row stores the org it acts in (active_org_id: the
+    // most-recent membership at first mint, or the org picked by
+    // POST /v1/auth/sessions/refresh { org_id }), a refresh never falls back to
+    // another org, the org role is no longer folded into `roles`, membership
+    // changes mark live sessions `claims_stale`, and orgs membership writes are
+    // server-only for end users. Needs `enabled`. Optional WITHOUT a default
+    // (absent = off) so existing manifests fold byte-identically; inside the
+    // existing bag, so no new config leaf.
+    activeOrg: Type.Optional(Type.Boolean())
   })),
   // Note: the earlier `redirects` block was DROPPED entirely —
   // it had zero consumers (grep-verified: no worker reads config.redirects) and
@@ -3935,8 +4027,9 @@ var AuthConfigSchema = Type.Object({
   //     chars leave the worker, never the password) at sign-up / reset-confirm;
   //     fail-OPEN on network error → 422 password_breached.
   //   • captchaSecretRef — a secret-store ref (feature 'auth') holding the
-  //     Turnstile secret; when set, sign-up / OTP request / magic-link request
-  //     require `captcha_token` (403 captcha_failed otherwise).
+  //     Turnstile secret; when set, sign-up / OTP request / magic-link request /
+  //     email-verification request / password-reset request require
+  //     `captcha_token` (403 captcha_failed otherwise).
   //   • allowedRedirectOrigins — when non-empty, EVERY caller-supplied
   //     redirect/return URL (magic link, password reset, email verification,
   //     OAuth start) must match one origin exactly → 422 redirect_not_allowed.
@@ -3971,6 +4064,14 @@ var AuthConfigSchema = Type.Object({
     // account is never affected. The generic OIDC issuer keeps its own gate
     // (providers.oidc.allowedDomains + IdP assignment). auth-v1 signupGate.ts.
     inviteOnly: Type.Optional(Type.Boolean()),
+    // Squatted-address defence (guide ch. 9): a verify-link confirm with NO
+    // matching session proves the mailbox only. With verifyLinkEvicts:true it
+    // runs the eviction guard (clears a never-verified row's password, revokes
+    // its sessions, drops its provider links — the squatter defence); absent /
+    // false keeps the password, so a genuine sign-up who opens the link in a
+    // mail-app browser (or an SDK that sends no session_token) is not locked
+    // out. Optional, NO default: every existing manifest folds byte-identically.
+    verifyLinkEvicts: Type.Optional(Type.Boolean()),
     allowedEmailDomains: Type.Optional(Type.Array(
       Type.String({ minLength: 3, maxLength: 253, pattern: "^[a-z0-9][a-z0-9.-]*\\.[a-z]{2,}$" }),
       { maxItems: 32 }
@@ -4306,7 +4407,10 @@ var DeclaredOrgRoleSchema = Type.Object({
 });
 var OrgsConfigSchema = Type.Object({
   enabled: Type.Boolean({ default: true }),
-  maxOrgsPerTenant: Type.Integer({ default: 100, minimum: 1, maximum: 1e4 }),
+  // Org cap: max 100,000 (was 10,000); the default stays 100 so
+  // existing manifests fold byte-identically. The unpaged GET /v1/orgs page is
+  // clamped at 10,000 (orgs-v1 parseOrgsPage), so no response grows.
+  maxOrgsPerTenant: Type.Integer({ default: 100, minimum: 1, maximum: 1e5 }),
   maxMembersPerOrg: Type.Integer({ default: 1e3, minimum: 1, maximum: 1e5 }),
   invitationTtlHours: Type.Integer({ default: 168, minimum: 1, maximum: 720 }),
   // Declared API state (G-31): the tenant's CUSTOM role catalog. Converged by
@@ -4387,6 +4491,22 @@ var ActivityFeedConfigSchema = Type.Object({
   // per-tenant request meter are the real bounds). Re-declare it together with
   // the binding that enforces it.
 });
+var SEARCH_COLLECTION_DECLARED_CAP = 50;
+var SEARCH_COLLECTION_DIMS = [256, 384, 512, 768, 1024, 1536, 3072];
+var DeclaredSearchCollectionSchema = Type.Object({
+  collection: Type.String({ pattern: "^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$" }),
+  dimensions: Type.Optional(Type.Union(SEARCH_COLLECTION_DIMS.map((d) => Type.Literal(d)))),
+  embed: Type.Optional(Type.Object({
+    provider: Type.Optional(Type.Union([
+      Type.Literal("byov"),
+      Type.Literal("mock"),
+      Type.Literal("openai"),
+      Type.Literal("cohere")
+    ])),
+    model: Type.Optional(Type.String({ maxLength: 128 })),
+    apiKeyRef: Type.Optional(Type.String({ maxLength: 128 }))
+  }))
+});
 var VectorSearchConfigSchema = Type.Object({
   enabled: Type.Boolean({ default: true }),
   // 'auto' resolves to the default managed vector backend for the tier.
@@ -4474,7 +4594,14 @@ var VectorSearchConfigSchema = Type.Object({
       }),
       { maxItems: 8 }
     )
-  )
+  ),
+  // Declared API state: the tenant's search
+  // collections, converged by `collection` name by `vxil push` / POST
+  // /v1/apply (control-plane handlers/apiState.ts) through POST
+  // /v1/search/collections. Undeclared live collections are left and
+  // reported — there is no collection delete route, so never deleted.
+  // Absent = not managed by config. ARRAY = ONE leaf.
+  collections: Type.Optional(Type.Array(DeclaredSearchCollectionSchema, { maxItems: SEARCH_COLLECTION_DECLARED_CAP }))
 });
 var AI_TEMPLATE_NAME_PATTERN = "^[a-zA-Z0-9_.\\-]+$";
 var AI_MAX_DECLARED_TEMPLATES = 50;
@@ -4854,6 +4981,26 @@ var FunctionsConfigSchema = Type.Object({
     { enabled: Type.Boolean({ default: false }) },
     { default: {} }
   ),
+  // FN-LOG-DRAIN (2026-10-12): forward this project's function log lines, in
+  // signed batches, to the tenant's own https endpoint (functions-tail →
+  // LogDrainDO). ONE optional leaf. The ONLY member of this deploy-managed
+  // manifest a config PUT may change (handlers/functionsLogDrain.ts) — `vxil
+  // push` carries it from `features.functions.logDrain`. `dailyLines` is
+  // SERVER-SET from the plan at write time (LOG_DRAIN_LINES_PER_DAY_BY_TIER);
+  // an authored value is overwritten. `secretRef` names a functions secret
+  // (`vxil secrets set functions/<name>`), the HMAC key of the signature.
+  logDrain: Type.Optional(Type.Object({
+    url: Type.String({ minLength: 9, maxLength: 2048 }),
+    secretRef: Type.String({ pattern: "^[a-z0-9_]{1,64}$" }),
+    minLevel: Type.Optional(Type.Union([
+      Type.Literal("debug"),
+      Type.Literal("info"),
+      Type.Literal("log"),
+      Type.Literal("warn"),
+      Type.Literal("error")
+    ])),
+    dailyLines: Type.Optional(Type.Integer({ minimum: 0 }))
+  })),
   // ONE Type.Record leaf — the per-function object is DATA, not flags.
   functions: Type.Optional(
     Type.Record(
@@ -5103,6 +5250,138 @@ var FEATURE_KEYS = [
   "functions",
   "copilot"
 ];
+var CMS_RETAIN_DAYS_MAX = 3650;
+function isDeclaredRetainDays(v) {
+  return v === void 0 || v === null || typeof v === "number" && Number.isInteger(v) && v >= 1 && v <= CMS_RETAIN_DAYS_MAX;
+}
+function retainDaysShortens(declared, remote) {
+  if (declared === null) return false;
+  return remote === null || declared < remote;
+}
+
+// ../config/src/index.ts
+var CMS_ROLE_SLUG_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+var CMS_ORG_READ_ROLES_MAX = 16;
+var ORG_FIELD_SLOTS = /* @__PURE__ */ new Set(["s1", "s2", "s3", "s4"]);
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function declaredOrgField(def) {
+  if (!isObj(def)) return null;
+  const v = def.orgField ?? def.org_field;
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function workspaceCollectionErrors(name, def) {
+  if (!isObj(def)) return [];
+  const errs = [];
+  const at = `cms.collections.${name}`;
+  const camel2 = def.orgField;
+  const snake = def.org_field;
+  if (camel2 !== void 0 && snake !== void 0 && camel2 !== snake) {
+    errs.push(`${at} sets orgField and org_field to different values \u2014 send one`);
+  }
+  const rawOrg = camel2 ?? snake;
+  let orgField = null;
+  if (rawOrg !== void 0 && rawOrg !== null) {
+    if (typeof rawOrg !== "string" || rawOrg.length === 0) {
+      errs.push(`${at}.orgField must be a field name (got ${JSON.stringify(rawOrg)})`);
+    } else {
+      orgField = rawOrg;
+      const f = isObj(def.fields) ? def.fields[rawOrg] : void 0;
+      if (!isObj(f)) {
+        errs.push(`${at}.orgField '${rawOrg}' names no declared field`);
+      } else {
+        if (f.type !== "string") {
+          errs.push(`${at}.orgField '${rawOrg}' must be a string field (is ${JSON.stringify(f.type)})`);
+        }
+        const slot = f.indexSlot ?? f.index_slot;
+        if (typeof slot !== "string" || !ORG_FIELD_SLOTS.has(slot)) {
+          errs.push(`${at}.orgField '${rawOrg}' needs an indexSlot in s1\u2013s4 (every end-user read filters on it)`);
+        }
+      }
+    }
+  }
+  const owner = def.ownerField ?? def.owner_field;
+  if (orgField !== null && owner === orgField) {
+    errs.push(`${at}.orgField and ownerField must name different fields (both are '${orgField}')`);
+  }
+  const rrCamel = def.orgReadRoles;
+  const rrSnake = def.org_read_roles;
+  if (rrCamel !== void 0 && rrSnake !== void 0 && JSON.stringify(rrCamel) !== JSON.stringify(rrSnake)) {
+    errs.push(`${at} sets orgReadRoles and org_read_roles to different values \u2014 send one`);
+  }
+  const rr = rrCamel ?? rrSnake;
+  if (rr !== void 0 && rr !== null) {
+    if (!Array.isArray(rr) || rr.some((r) => typeof r !== "string" || !CMS_ROLE_SLUG_RE.test(r))) {
+      errs.push(`${at}.orgReadRoles must be an array of role slugs matching ${CMS_ROLE_SLUG_RE} (got ${JSON.stringify(rr)})`);
+    } else if (rr.length > CMS_ORG_READ_ROLES_MAX) {
+      errs.push(`${at}.orgReadRoles has ${rr.length} entries \u2014 at most ${CMS_ORG_READ_ROLES_MAX}`);
+    } else if (rr.length > 0 && orgField === null) {
+      errs.push(`${at}.orgReadRoles needs orgField (it gates reads of a workspace-scoped collection)`);
+    }
+  }
+  return errs;
+}
+var asList = (v) => Array.isArray(v) ? v : v === void 0 || v === null ? [] : [v];
+var stringsOf = (v) => asList(v).filter((s) => typeof s === "string");
+function workspaceManifestErrors(config, opts = {}) {
+  const errs = [];
+  const rawCollections = config.cms?.collections;
+  const collections = isObj(rawCollections) ? rawCollections : {};
+  const orgCols = /* @__PURE__ */ new Map();
+  for (const [name, def] of Object.entries(collections)) {
+    const of = declaredOrgField(def);
+    if (of) orgCols.set(name, of);
+  }
+  if (orgCols.size === 0) return errs;
+  const features = isObj(config.features) ? config.features : {};
+  const names = [...orgCols.keys()].join(", ");
+  const auth = isObj(features.auth) ? features.auth : {};
+  const oc = isObj(auth.orgClaims) ? auth.orgClaims : {};
+  if (opts.checkAuth !== false && (oc.enabled !== true || oc.activeOrg !== true)) {
+    errs.push(`cms.collections ${names} set orgField, which needs features.auth.orgClaims { enabled: true, activeOrg: true } \u2014 without an active org the session carries no stable workspace`);
+  }
+  const cms = isObj(features.cms) ? features.cms : {};
+  for (const [rule, r] of Object.entries(isObj(cms.cdc) ? cms.cdc : {})) {
+    if (isObj(r) && typeof r.collection === "string" && orgCols.has(r.collection)) {
+      errs.push(`features.cms.cdc.${rule}: collection '${r.collection}' is workspace-scoped (orgField) \u2014 a cdc channel is not access control, so it is refused until org channels ship (Phase 2); fan out from a function with per-workspace channel names meanwhile`);
+    }
+  }
+  const vs = isObj(features["vector-search"]) ? features["vector-search"] : {};
+  asList(vs.sync).forEach((s, i) => {
+    if (isObj(s) && typeof s.cmsCollection === "string" && orgCols.has(s.cmsCollection)) {
+      errs.push(`features.vector-search.sync[${i}]: cmsCollection '${s.cmsCollection}' is workspace-scoped (orgField) \u2014 workspace-scoped sync arrives with orgScoped (Phase 2); search through a function meanwhile`);
+    }
+  });
+  for (const [rmName, rm] of Object.entries(isObj(cms.readModels) ? cms.readModels : {})) {
+    if (!isObj(rm) || typeof rm.collection !== "string") continue;
+    const srcOrg = orgCols.get(rm.collection);
+    const to = isObj(rm.materialize) ? rm.materialize.to : void 0;
+    if (!srcOrg || typeof to !== "string") continue;
+    const tOrg = orgCols.get(to);
+    const spec = isObj(rm.spec) ? rm.spec : {};
+    const groups = [...stringsOf(spec.groupBy), ...stringsOf(spec.partitionBy)];
+    if (tOrg !== srcOrg || !groups.includes(srcOrg)) {
+      errs.push(`features.cms.readModels.${rmName}: materializes workspace-scoped '${rm.collection}' into '${to}' \u2014 the target must be an orgField collection with orgField '${srcOrg}' and the read model must group by '${srcOrg}', or one workspace's rollup rows land where every end user can read them`);
+    }
+  }
+  const orgs = isObj(features.orgs) ? features.orgs : {};
+  const longRoles = new Set(asList(orgs.roles).map((r) => isObj(r) ? r.role_key : void 0).filter((k) => typeof k === "string" && k.length > 32));
+  for (const [name] of orgCols) {
+    const def = collections[name];
+    const gate = /* @__PURE__ */ new Set([
+      ...stringsOf(def.orgReadRoles ?? def.org_read_roles),
+      ...stringsOf(def.writeRoles ?? def.write_roles)
+    ]);
+    for (const f of Object.values(isObj(def.fields) ? def.fields : {})) {
+      if (isObj(f)) for (const r of stringsOf(f.readRoles ?? f.read_roles)) gate.add(r);
+    }
+    for (const r of gate) {
+      if (r.length > 32 || longRoles.has(r)) {
+        errs.push(`cms.collections.${name}: gate role '${r}' is longer than 32 characters \u2014 an orgs role named in a cms gate must be 32 characters or fewer (longer keys stay legal in orgs)`);
+      }
+    }
+  }
+  return errs;
+}
 
 // src/lib.ts
 var MAX_FN_BINDINGS = 8;
@@ -5169,9 +5448,9 @@ function lowerAllTriggerBindings(def, name) {
   return bindings;
 }
 var CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-var VXIL_CONFIG_PKG_VERSION = "0.17.0";
-var VXIL_SDK_PKG_VERSION = "0.24.0";
-var VXIL_CLI_PKG_VERSION = "0.24.1";
+var VXIL_CONFIG_PKG_VERSION = "0.18.0";
+var VXIL_SDK_PKG_VERSION = "0.25.0";
+var VXIL_CLI_PKG_VERSION = "0.25.0";
 function ensureScaffoldPackageJson(cwd, opts = {}) {
   const file = resolve(cwd, "package.json");
   const wanted = {
@@ -5335,6 +5614,8 @@ async function loadVxilConfig(cwd = process.cwd()) {
     throw new Error(`${found}: \`features\` must be an object`);
   }
   if (typeof cfg.apiVersion === "string") loadedConfigApiVersion = cfg.apiVersion;
+  const wsErrs = workspaceManifestErrors(cfg);
+  if (wsErrs.length) throw new Error(`${found}: ${wsErrs.join("; ")}`);
   return cfg;
 }
 function diffManifest(prev, next, prefix = "") {
@@ -5353,6 +5634,19 @@ function diffManifest(prev, next, prefix = "") {
   }
   return out;
 }
+var ACTIVE_ORG_MIN_SDK = "0.25.0";
+function activeOrgEnableWarning(feature, changes) {
+  if (feature !== "auth") return null;
+  const target = ["orgClaims", "activeOrg"];
+  const at = (v, rest2) => rest2.reduce((o, k) => o && typeof o === "object" && !Array.isArray(o) ? o[k] : void 0, v);
+  const turnsOn = changes.some((c) => {
+    const segs = c.path === "" ? [] : c.path.split(".");
+    if (segs.length > target.length || segs.some((k, i) => k !== target[i])) return false;
+    const rest2 = target.slice(segs.length);
+    return at(c.to, rest2) === true && at(c.from, rest2) !== true;
+  });
+  return turnsOn ? `auth orgClaims.activeOrg turns on: apps must use @vxil/sdk ${ACTIVE_ORG_MIN_SDK} or later \u2014 older SDKs do not recover from 401 session_stale after an org membership or role change (see guide 06, orgs)` : null;
+}
 function formatDiff(changes) {
   if (!changes.length) return "  (no changes)";
   return changes.map(({ path, from, to }) => {
@@ -5415,7 +5709,6 @@ async function mapPool(items, limit, fn) {
 }
 function assembleApplyBundle(cfg, fnSources) {
   const { functions: _fnFeature, ...configFeatures } = cfg.features;
-  void _fnFeature;
   const functions = Object.entries(cfg.functions ?? {}).map(([name, def]) => {
     const source = fnSources[name];
     if (source === void 0) throw new Error(`functions: no bundled source for '${name}'`);
@@ -5434,8 +5727,11 @@ function assembleApplyBundle(cfg, fnSources) {
       ...limits ? { limits } : {}
     };
   });
+  const fnFeature = _fnFeature;
+  const features = { ...configFeatures };
+  if (fnFeature && typeof fnFeature === "object") features.functions = { logDrain: fnFeature.logDrain ?? null };
   return {
-    ...Object.keys(configFeatures).length ? { features: configFeatures } : {},
+    ...Object.keys(features).length ? { features } : {},
     ...cfg.cms?.collections && Object.keys(cfg.cms.collections).length ? { cms: { collections: cfg.cms.collections } } : {},
     ...functions.length ? { functions } : {}
   };
@@ -5593,6 +5889,40 @@ async function planOrPush({ api, features, apply, allowDestructive }) {
   }
   return results;
 }
+function sameLogDrain(want, have) {
+  const norm = (d) => {
+    if (!d || typeof d !== "object") return null;
+    const o = d;
+    return JSON.stringify([o.url, String(o.secretRef ?? "").replace(/^secret:/, ""), o.minLevel ?? "warn"]);
+  };
+  return norm(want) === norm(have);
+}
+async function planOrPushLogDrain({ api, fnFeature, apply }) {
+  if (!fnFeature || typeof fnFeature !== "object") return null;
+  const to = fnFeature.logDrain ?? null;
+  const cur = await api("GET", "/v1/config/functions");
+  const unavailable = readUnavailable("GET /v1/config/functions", cur);
+  if (unavailable) {
+    if (apply) {
+      throw new Error(`functions.logDrain: cannot read ${unavailable.route} (${unavailable.code ?? unavailable.status}) \u2014 refusing to push against a remote it could not read`);
+    }
+    return { version: 0, from: null, to, changed: false, applied: null, remoteUnavailable: unavailable };
+  }
+  const exists = cur.status === 200;
+  const version = exists ? Number(cur.body.data?.version ?? 0) : 0;
+  const from = exists ? cur.body.data?.manifest?.logDrain ?? null : null;
+  const changed = !sameLogDrain(to, from);
+  let applied = null;
+  if (apply && changed) {
+    const put = await api("PUT", "/v1/config/functions", { logDrain: to }, version > 0 ? { "if-match": String(version) } : {});
+    if (put.status !== 200) {
+      const e = put.body.error ?? {};
+      throw new Error(`push failed for functions.logDrain: ${e.code ?? put.status} ${e.message ?? ""} ${e.hint ?? ""}`);
+    }
+    applied = put.body.data?.version ?? null;
+  }
+  return { version, from, to, changed, applied };
+}
 function classifyRead(status, code) {
   if (status === 200) return "ok";
   if (status === 404) return "empty";
@@ -7951,18 +8281,18 @@ var PUBLIC_KEY_DENY_SCOPES = /* @__PURE__ */ new Set([
 var TENANT_SLUG_RE = /^[a-z0-9][a-z0-9-]{1,62}$/;
 var FUNCTION_SOURCE_MAX_BYTES = 512e3;
 var FN_PLATFORM_DEFAULT_CPU_MS = 3e4;
-function functionScriptCpuMs(declaredCpuMs, ceilingMs) {
+function functionScriptCpuMs(declaredCpuMs, ceilingMs, defaultMs = ceilingMs) {
   const d = typeof declaredCpuMs === "number" && Number.isFinite(declaredCpuMs) && declaredCpuMs >= 1 ? Math.floor(declaredCpuMs) : null;
-  return d === null ? ceilingMs : Math.min(d, ceilingMs);
+  return Math.min(d ?? defaultMs, ceilingMs);
 }
 function recordedScriptCpuMs(raw) {
   const c = raw?.cpuMs;
   return isPositiveInt(c) ? c : FN_PLATFORM_DEFAULT_CPU_MS;
 }
-function planScriptCpuMs(runtime, declaredCpuMs, ceilingMs) {
+function planScriptCpuMs(runtime, declaredCpuMs, ceilingMs, defaultMs = ceilingMs) {
   const recorded = runtime?.cpuMs;
   if (!isPositiveInt(recorded) && ceilingMs >= FN_PLATFORM_DEFAULT_CPU_MS) return FN_PLATFORM_DEFAULT_CPU_MS;
-  return functionScriptCpuMs(declaredCpuMs, ceilingMs);
+  return functionScriptCpuMs(declaredCpuMs, ceilingMs, defaultMs);
 }
 function isPositiveInt(v) {
   return typeof v === "number" && Number.isInteger(v) && v > 0;
@@ -8126,6 +8456,35 @@ function egressDecision(targetUrl, allowHosts = []) {
   return { allow: false, reason: `not-allowlisted:${host}` };
 }
 
+// ../runtime/src/logDrain.ts
+var LOG_DRAIN_SECRET_NAME_RE = /^[a-z0-9_]{1,64}$/;
+var LOG_DRAIN_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "log", "warn", "error"]);
+var LOG_DRAIN_SHAPE_HINT = 'logDrain needs { url: "https://\u2026", secretRef: "<functions secret name>", minLevel?: "debug"|"info"|"log"|"warn"|"error" } (or null to remove it)';
+function logDrainUrlError(url) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return "logDrain.url is not a URL";
+  }
+  const d = egressDecision(url, [host]);
+  if (!d.allow) return `logDrain.url is refused by the egress guard (${d.reason})`;
+  if (d.reason === "vxil-api") return "logDrain.url must be your own endpoint, not the vxil API";
+  return null;
+}
+function logDrainShapeError(drain) {
+  if (drain === null) return null;
+  const d = drain;
+  if (!d || typeof d !== "object" || Array.isArray(d) || typeof d.url !== "string" || typeof d.secretRef !== "string") {
+    return LOG_DRAIN_SHAPE_HINT;
+  }
+  if (!LOG_DRAIN_SECRET_NAME_RE.test(d.secretRef.replace(/^secret:/, ""))) {
+    return `logDrain.secretRef must be a functions secret name matching ${LOG_DRAIN_SECRET_NAME_RE.source}`;
+  }
+  if (d.minLevel !== void 0 && !LOG_DRAIN_LEVELS.has(d.minLevel)) return LOG_DRAIN_SHAPE_HINT;
+  return logDrainUrlError(d.url);
+}
+
 // ../runtime/src/jobsCallbackSig.ts
 var JOBS_SIG_HEADER = "X-Vxil-Jobs-Signature";
 function signedString(runId, tenantId, issuedAt, bodyHashHex) {
@@ -8309,7 +8668,8 @@ var DRIFT_SECTION = {
   policies: "policy",
   subscriptions: "subscription",
   templates: "template",
-  roles: "role"
+  roles: "role",
+  collections: "search-collection"
 };
 function declaredDriftKey(datum, key) {
   return `api:${DRIFT_SECTION[datum]}:${key}`;
@@ -8318,7 +8678,8 @@ var DATUM_READ_SCOPE = {
   policies: "ratelimits:read",
   subscriptions: "webhooks:read",
   templates: "ai:read",
-  roles: "orgs:read"
+  roles: "orgs:read",
+  collections: "vector-search:read"
 };
 function declaredApiStateBlocks(features) {
   const out = [];
@@ -8357,7 +8718,8 @@ var ROUTE = {
   policies: "/v1/rate-limits/policies",
   subscriptions: "/v1/webhooks/subscriptions",
   templates: "/v1/ai/templates",
-  roles: "/v1/orgs/roles"
+  roles: "/v1/orgs/roles",
+  collections: "/v1/search/collections"
 };
 function listOf(v) {
   return Array.isArray(v) ? v : [];
@@ -8422,6 +8784,14 @@ async function readOnlyPlan(api, block, allowDestructive) {
     s.updated.push(...plan.update.map((u) => u.role.role_key));
     s.unchanged.push(...plan.unchanged);
     destructive([], plan.undeclared);
+  } else if (datum === "collections") {
+    const plan = planSearchCollections(manifest.collections, listOf(data2.collections));
+    s.created.push(...plan.create.map((c) => c.collection));
+    for (const u of plan.update) (u.reembed && !allowDestructive ? s.pending_destructive : s.updated).push(u.body.collection);
+    s.unchanged.push(...plan.unchanged);
+    s.undeclared.push(...plan.undeclared);
+    for (const i of plan.immutable) s.failed.push({ key: i.collection, error: searchCollectionImmutableError(i) });
+    for (const r of plan.refused) s.failed.push({ key: r.collection, error: r.error });
   } else {
     const hashed = await Promise.all(manifest.templates.map(async (t) => ({
       template: t.template,
@@ -8823,7 +9193,9 @@ async function readRemote(api) {
   const deployRuntime = wire ? recordedFunctionsRuntime(wire) : FUNCTIONS_RUNTIME_LEGACY;
   const ceilingWire = res.status === 200 ? res.body.data?.cpuMsCeiling : void 0;
   const cpuMsCeiling = typeof ceilingWire === "number" && Number.isInteger(ceilingWire) && ceilingWire > 0 ? ceilingWire : null;
-  if (res.status !== 200) return { map: map2, unavailable, deployRuntime, cpuMsCeiling };
+  const defaultWire = res.status === 200 ? res.body.data?.cpuMsDefault : void 0;
+  const cpuMsDefault = typeof defaultWire === "number" && Number.isInteger(defaultWire) && defaultWire > 0 ? defaultWire : null;
+  if (res.status !== 200) return { map: map2, unavailable, deployRuntime, cpuMsCeiling, cpuMsDefault };
   const fns = Array.isArray(res.body.data?.functions) ? res.body.data.functions : [];
   for (const f of fns) {
     map2.set(f.name, {
@@ -8838,7 +9210,7 @@ async function readRemote(api) {
       runtime: recordedFunctionsRuntime(f.runtime)
     });
   }
-  return { map: map2, unavailable: null, deployRuntime, cpuMsCeiling };
+  return { map: map2, unavailable: null, deployRuntime, cpuMsCeiling, cpuMsDefault };
 }
 function sameSecretSet(a, b2) {
   return a.length === b2.length && a.every((x) => b2.includes(x));
@@ -8877,7 +9249,7 @@ async function planFunctions({ api, functions, cwd, apply, onNote, remoteOnly =
     const sizeWarnings = headroom ? [{ fn: name, message: headroom }] : [];
     const retryN = bindings.find((b2) => b2.retry)?.retry?.maxAttempts;
     const label = `${name} (${Math.round(bytes / 100) / 10} KB) [${bindings.map((b2) => b2.kind).join("+")}${retryN !== void 0 ? " \xB7 retry:" + retryN : ""}${def.scopes?.length ? " \xB7 " + def.scopes.join(",") : ""}${secrets.length ? " \xB7 secrets:" + secrets.map((s) => s.slice("secret:".length)).join(",") : ""}${limits?.cpuMs !== void 0 ? " \xB7 cpu:" + limits.cpuMs + "ms" : ""}${limits?.timeoutMs !== void 0 ? " \xB7 egress:" + limits.timeoutMs + "ms" : ""}]`;
-    if (remoteFn !== void 0 && remoteFn.scriptRef.endsWith(`-${sha}`) && sameSecretSet(remoteFn.secrets, secrets) && sameFunctionsRuntime(remoteFn.runtime, read.deployRuntime) && (read.cpuMsCeiling === null || recordedScriptCpuMs(remoteFn.runtime) === planScriptCpuMs(remoteFn.runtime, limits?.cpuMs, read.cpuMsCeiling)) && sameStringSet2(clampFunctionScopes(def.scopes), remoteFn.scopes) && sameStringSet2(def.egressAllow ?? [], remoteFn.egressAllow) && stableStringify(remoteFn.bindings) === stableStringify(bindings) && stableStringify(remoteFn.signature) === stableStringify(def.signature ?? null) && stableStringify(remoteFn.limits ?? null) === stableStringify(limits ?? null) && stableStringify(remoteFn.vars) === stableStringify(def.vars ?? {}) && !force) {
+    if (remoteFn !== void 0 && remoteFn.scriptRef.endsWith(`-${sha}`) && sameSecretSet(remoteFn.secrets, secrets) && sameFunctionsRuntime(remoteFn.runtime, read.deployRuntime) && (read.cpuMsCeiling === null || recordedScriptCpuMs(remoteFn.runtime) === planScriptCpuMs(remoteFn.runtime, limits?.cpuMs, read.cpuMsCeiling, read.cpuMsDefault ?? read.cpuMsCeiling)) && sameStringSet2(clampFunctionScopes(def.scopes), remoteFn.scopes) && sameStringSet2(def.egressAllow ?? [], remoteFn.egressAllow) && stableStringify(remoteFn.bindings) === stableStringify(bindings) && stableStringify(remoteFn.signature) === stableStringify(def.signature ?? null) && stableStringify(remoteFn.limits ?? null) === stableStringify(limits ?? null) && stableStringify(remoteFn.vars) === stableStringify(def.vars ?? {}) && !force) {
       return { change: { name, kind: "unchanged", detail: label }, applied: 0, cmsHooks: null, webhooks: null, warnings: sizeWarnings, hook: null };
     }
     const bindingChanges = remoteFn !== void 0 ? diffBindings(remoteFn.bindings, bindings) : null;
@@ -9053,6 +9425,12 @@ function writeRolesWidens(declared, remote) {
   if (declared.length === 0) return true;
   return declared.some((r) => !remote.includes(r));
 }
+function orgFieldWidens(declared, remote) {
+  return remote !== null && declared !== remote;
+}
+function orgReadRolesWidens(declared, remote) {
+  return writeRolesWidens(declared, remote);
+}
 function endUserAccessOf(v) {
   return v === "read" || v === "none" ? v : "readwrite";
 }
@@ -9149,6 +9527,9 @@ function remoteCollectionOf(c) {
     public: c.public === true,
     endUserAccess: endUserAccessOf(c.end_user_access),
     writeRoles: writeRolesOf(c.write_roles),
+    orgField: typeof c.org_field === "string" && c.org_field.length > 0 ? c.org_field : null,
+    orgReadRoles: writeRolesOf(c.org_read_roles),
+    retainDays: typeof c.retain_days === "number" ? c.retain_days : null,
     actions: normalizeActions(c.actions),
     fields: Array.isArray(c.fields) ? c.fields : []
   };
@@ -9163,6 +9544,9 @@ function pulledCollectionBlock(c) {
     ...rc.public ? { public: true } : {},
     ...rc.endUserAccess !== "readwrite" ? { endUserAccess: rc.endUserAccess } : {},
     ...rc.writeRoles.length ? { writeRoles: rc.writeRoles } : {},
+    ...rc.orgField ? { orgField: rc.orgField } : {},
+    ...rc.orgReadRoles.length ? { orgReadRoles: rc.orgReadRoles } : {},
+    ...rc.retainDays !== null ? { retainDays: rc.retainDays } : {},
     ...rc.actions.length ? { actions: rc.actions } : {},
     fields
   };
@@ -9227,6 +9611,12 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
     if (wr !== void 0 && (!Array.isArray(wr) || wr.some((r) => typeof r !== "string"))) {
       throw new Error(`cms.collections.${name}.writeRoles must be an array of role slugs (got ${JSON.stringify(wr)})`);
     }
+    const wsErrs = workspaceCollectionErrors(name, def);
+    if (wsErrs.length) throw new Error(wsErrs[0]);
+    const rd = def.retainDays;
+    if (!isDeclaredRetainDays(rd)) {
+      throw new Error(`cms.collections.${name}.retainDays must be an integer 1..3650 (days) or null (got ${JSON.stringify(rd)})`);
+    }
   }
   const read = await readRemote2(api);
   if (read.unavailable) {
@@ -9407,6 +9797,63 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
         });
       }
     }
+    const declaredOrg = def.orgField ?? null;
+    const declaredOrgRoles = writeRolesOf(def.orgReadRoles);
+    const orgSteps = [];
+    if (declaredOrg !== rc.orgField) {
+      const widens = orgFieldWidens(declaredOrg, rc.orgField);
+      if (!widens || allowDestructive) {
+        orgSteps.push({
+          collection: name,
+          kind: "set-org-field",
+          detail: `${name} orgField \u2192 ${declaredOrg === null ? "none" : `'${declaredOrg}'`}${rc.orgField ? ` (was '${rc.orgField}')` : ""}` + (widens ? " \u2014 WIDENS end-user access to workspace rows (full-config reconciliation)" : " (workspace scoping, narrows)")
+        });
+      } else {
+        collChanges.push({
+          collection: name,
+          kind: "warn",
+          detail: `${name}: orgField '${rc.orgField}' is set remotely but ${declaredOrg === null ? "absent" : `'${declaredOrg}'`} in config \u2014 that WIDENS which end users reach the rows, so it is NOT applied. Declare the remote orgField to keep it, or re-run with --allow-destructive.`
+        });
+      }
+    }
+    if (stableStringify(declaredOrgRoles) !== stableStringify(rc.orgReadRoles)) {
+      const widens = orgReadRolesWidens(declaredOrgRoles, rc.orgReadRoles);
+      const fmt = (r) => r.length ? `[${r.join(", ")}]` : "none (any member)";
+      if (!widens || allowDestructive) {
+        const step = {
+          collection: name,
+          kind: "set-org-read-roles",
+          detail: `${name} orgReadRoles \u2192 ${fmt(declaredOrgRoles)} (was ${fmt(rc.orgReadRoles)})` + (widens ? " \u2014 WIDENS who may read (full-config reconciliation)" : " (narrows end-user reads)")
+        };
+        if (declaredOrg === null) orgSteps.unshift(step);
+        else orgSteps.push(step);
+      } else {
+        collChanges.push({
+          collection: name,
+          kind: "warn",
+          detail: `${name}: orgReadRoles are ${fmt(rc.orgReadRoles)} remotely but ${fmt(declaredOrgRoles)} in config \u2014 that WIDENS which workspace members may read, so it is NOT applied. Declare the remote roles to keep them, or re-run with --allow-destructive to widen.`
+        });
+      }
+    }
+    collChanges.push(...orgSteps);
+    const declaredRetain = def.retainDays;
+    if (declaredRetain !== void 0 && declaredRetain !== rc.retainDays) {
+      const fmtDays = (d) => d === null ? "off (kept until deleted)" : `${d} days`;
+      const shortens = retainDaysShortens(declaredRetain, rc.retainDays);
+      if (!shortens || allowDestructive) {
+        collChanges.push({
+          collection: name,
+          kind: "set-retain-days",
+          detail: `${name} retainDays \u2192 ${fmtDays(declaredRetain)} (was ${fmtDays(rc.retainDays)})` + (shortens ? " \u2014 the nightly sweep soft-deletes items older than that" : "")
+        });
+      } else {
+        collChanges.push({
+          collection: name,
+          kind: "warn",
+          detail: `${name}: retainDays is ${fmtDays(rc.retainDays)} remotely but ${fmtDays(declaredRetain)} in config \u2014 that makes the nightly sweep soft-delete existing items, so it is NOT applied. Re-run with --allow-destructive to apply it.`
+        });
+      }
+    }
     const declaredActions = normalizeActions(def.actions);
     if (stableStringify(declaredActions) !== stableStringify(rc.actions)) {
       collChanges.push({
@@ -9482,6 +9929,10 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
         if (access !== "readwrite") body.end_user_access = access;
         const roles = writeRolesOf(def.writeRoles);
         if (roles.length > 0) body.write_roles = roles;
+        if (def.orgField) body.org_field = def.orgField;
+        const orgRoles = writeRolesOf(def.orgReadRoles);
+        if (orgRoles.length > 0) body.org_read_roles = orgRoles;
+        if (typeof def.retainDays === "number") body.retain_days = def.retainDays;
         if (def.actions && def.actions.length > 0) body.actions = normalizeActions(def.actions);
         const res = await api("POST", "/v1/cms/collections", body);
         if (res.status !== 201 && res.status !== 200 && res.body.error?.code !== "collection_exists") {
@@ -9541,6 +9992,28 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
           throw new Error(`cms: set writeRoles on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
         }
         applied++;
+      } else if (c.kind === "set-org-field" || c.kind === "set-org-read-roles") {
+        const def = collections[c.collection];
+        const remoteRc = remote.get(c.collection);
+        const isField = c.kind === "set-org-field";
+        const target = isField ? def.orgField ?? null : writeRolesOf(def.orgReadRoles);
+        const widens = isField ? orgFieldWidens(target, remoteRc?.orgField ?? null) : orgReadRolesWidens(target, remoteRc?.orgReadRoles ?? []);
+        const body = isField ? { org_field: target } : { org_read_roles: target };
+        if (widens) body.allow_destructive = true;
+        const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`, body);
+        if (res.status !== 200 && res.status !== 201) {
+          const e = res.body.error ?? {};
+          throw new Error(`cms: set ${isField ? "orgField" : "orgReadRoles"} on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
+        }
+        applied++;
+      } else if (c.kind === "set-retain-days") {
+        const target = collections[c.collection].retainDays ?? null;
+        const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`, { retain_days: target });
+        if (res.status !== 200 && res.status !== 201) {
+          const e = res.body.error ?? {};
+          throw new Error(`cms: set retainDays on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
+        }
+        applied++;
       } else if (c.kind === "set-actions") {
         const target = normalizeActions(collections[c.collection].actions);
         const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`, { actions: target });
@@ -9606,7 +10079,7 @@ function formatCmsChanges(changes) {
     if (c.kind === "destructive") return `  ! ${c.detail}`;
     if (c.kind === "warn") return `  \u26A0 ${c.detail}`;
     if (c.kind === "reindex") return `  \u21BB ${c.detail}`;
-    if (c.kind === "alter-flags" || c.kind === "set-owner-field" || c.kind === "set-end-user-access" || c.kind === "set-write-roles") return `  ~ ${c.detail}`;
+    if (c.kind === "alter-flags" || c.kind === "set-owner-field" || c.kind === "set-end-user-access" || c.kind === "set-write-roles" || c.kind === "set-retain-days") return `  ~ ${c.detail}`;
     return `  + ${c.detail}`;
   }).join("\n");
 }
@@ -12501,7 +12974,11 @@ var TOOLS = [
           description: "Explicit locale wins; otherwise the recipient's stored `locale` attribute (users_upsert attributes.locale), then the tenant's config.defaultLocale."
         },
         send_at: { type: "string", description: "future ISO instant, \u2264 30 d out (mutually exclusive with delay_seconds)" },
-        delay_seconds: { type: "number", minimum: 0, maximum: 2592e3 }
+        delay_seconds: { type: "number", minimum: 0, maximum: 2592e3 },
+        to_email: { type: "string", description: "Deliver to this address instead of the user's stored email (an invitee with no account). user_id must still exist; suppressions are checked against this address." },
+        from_name: { type: "string", maxLength: 64, description: "This send's sender name; default config fromName." },
+        from_local_part: { type: "string", pattern: "^[a-z0-9._-]{1,40}$", description: "This send's from-address local part; the domain is always the config fromEmail domain." },
+        reply_to: { type: "string", description: "This send's Reply-To address; default config replyTo." }
       },
       required: ["user_id", "template", "data"]
     },
@@ -12528,6 +13005,10 @@ var TOOLS = [
               channel: { type: "string", enum: ["email", "inbox", "both"] },
               send_at: { type: "string", description: "future ISO instant (\u2264 30 d)" },
               delay_seconds: { type: "number", minimum: 0, maximum: 2592e3 },
+              to_email: { type: "string" },
+              from_name: { type: "string", maxLength: 64 },
+              from_local_part: { type: "string", pattern: "^[a-z0-9._-]{1,40}$" },
+              reply_to: { type: "string" },
               idempotency_key: { type: "string" }
             },
             required: ["user_id", "template", "data"]
@@ -13210,14 +13691,19 @@ var TOOLS = [
   {
     name: "files_get_download_url",
     feature: "files",
-    description: "Mint a short-lived presigned GET URL for an available object.",
+    description: 'Mint a short-lived presigned GET URL for an available object. disposition "inline" opens a PDF/image/ICO/audio/video in the browser (html, svg, js and other types always download); filename sets the saved name.',
     inputSchema: {
       type: "object",
-      properties: { object_id: { type: "string" } },
+      properties: {
+        object_id: { type: "string" },
+        disposition: { type: "string", enum: ["inline", "attachment"], description: "Omit for the default (raster images inline, everything else attachment)." },
+        filename: { type: "string", description: "Download filename (sanitised server-side, at most 200 characters). Default: the upload filename." }
+      },
       required: ["object_id"]
     },
     method: "GET",
-    path: (a) => `/v1/files/${encodeURIComponent(String(a.object_id))}/download-url`
+    path: (a) => `/v1/files/${encodeURIComponent(String(a.object_id))}/download-url`,
+    queryArgs: ["disposition", "filename"]
   },
   {
     name: "files_get_download_urls",
@@ -13353,7 +13839,7 @@ var TOOLS = [
   {
     name: "cms_list_collections",
     feature: "cms",
-    description: "List the tenant's content model: collections with their typed field definitions (the schema items are validated against). Each field row carries its attributes \u2014 required, validation, index_slot, relation_to, computed/compute, is_unique, on_delete, read_roles (the end-user org roles allowed to READ that field; null = ungated), and on an equality-indexed field indexed: true + index_ready (equality filters on it are index-served once ready; until then, and on unindexed unslotted fields, they are a bounded scan \u2014 same results). A field with read_roles is omitted from end-user reads without a matching role and is never served on the public lane, so a missing key in an item's data may be a read gate rather than an unset value. Each collection row also carries end_user_access: 'readwrite' (default), 'read' (a verified end user \u2014 a thin-client key with a session \u2014 may read but every write answers 403 server_only) or 'none' (end-user reads and writes are 403 server_only), and write_roles: the roles a verified end user must hold to WRITE the collection (null = ungated; without one every end-user write answers 403 role_required, reads are unaffected); server keys are never affected. retain_days (null = keep) is the collection's retention: the nightly platform sweep soft-deletes live items created more than that many days ago.",
+    description: "List the tenant's content model: collections with their typed field definitions (the schema items are validated against). Each field row carries its attributes \u2014 required, validation, index_slot, relation_to, computed/compute, is_unique, on_delete, read_roles (the end-user org roles allowed to READ that field; null = ungated), and on an equality-indexed field indexed: true + index_ready (equality filters on it are index-served once ready; until then, and on unindexed unslotted fields, they are a bounded scan \u2014 same results). A field with read_roles is omitted from end-user reads without a matching role and is never served on the public lane, so a missing key in an item's data may be a read gate rather than an unset value. Each collection row also carries end_user_access: 'readwrite' (default), 'read' (a verified end user \u2014 a thin-client key with a session \u2014 may read but every write answers 403 server_only) or 'none' (end-user reads and writes are 403 server_only), and write_roles: the roles a verified end user must hold to WRITE the collection (null = ungated; without one every end-user write answers 403 role_required, reads are unaffected); server keys are never affected. retain_days (null = keep) is the collection's retention: the nightly platform sweep soft-deletes live items created more than that many days ago. org_field (null = none) makes the collection workspace-scoped: a verified end user reads and writes only rows of the session's active org (no active org \u2192 403 org_required) and write_roles match the active-org role; org_read_roles (null = any member) gates reads by that role.",
     inputSchema: { type: "object", properties: {} },
     method: "GET",
     path: "/v1/cms/collections"
@@ -13701,15 +14187,18 @@ var TOOLS = [
   {
     name: "orgs_session_claims",
     feature: "orgs",
-    description: "The user's ACTIVE-ORG snapshot \u2014 the { org_id, role, perms[] } auth embeds as the session-JWT `org` claim when the tenant enables auth config orgClaims. Active org = the most recent membership (by joined_at); perms = the role's effective permission set (custom catalog entry wins, capped at 32). No membership \u2192 org_id null. EVENTUAL-CONSISTENT: JWTs recompute it only at mint/refresh \u2014 use orgs_check_permission for revocation-grade authz. Read-only \u2014 needs orgs:read.",
+    description: "The org snapshot \u2014 { org_id, role, perms[] } \u2014 auth embeds as the session-JWT `org` claim when the tenant enables auth config orgClaims. Without org_id it resolves the user's MOST RECENT membership (by joined_at): the claim a session carries with plain orgClaims, and the one a first sign-in stores with orgClaims.activeOrg. With orgClaims.activeOrg a session then acts in the org it stored or switched to (POST /v1/auth/sessions/refresh with org_id), not necessarily the most recent one \u2014 pass org_id to read that org's claim. perms = the role's effective permission set (custom catalog entry wins, capped at 32). Not a member (or no membership) \u2192 org_id null. EVENTUAL-CONSISTENT: JWTs recompute it only at mint/refresh \u2014 use orgs_check_permission for revocation-grade authz. Read-only \u2014 needs orgs:read.",
     inputSchema: {
       type: "object",
-      properties: { user_id: { type: "string", description: "The end_user_id to resolve." } },
+      properties: {
+        user_id: { type: "string", description: "The end_user_id to resolve." },
+        org_id: { type: "string", description: "Optional: resolve the claim for THIS org (the active org a session picked) instead of the most recent membership." }
+      },
       required: ["user_id"]
     },
     method: "GET",
     path: "/v1/orgs/session-claims",
-    queryArgs: ["user_id"]
+    queryArgs: ["user_id", "org_id"]
   },
   {
     name: "orgs_define_role",
@@ -13868,7 +14357,7 @@ var TOOLS = [
   {
     name: "functions_list",
     feature: "functions",
-    description: "The project's deployed functions: name, endpoint (/v1/fn/<name>), trigger bindings, scopes, limits and the runtime each runs under, plus `enabled` (false while the project's functions are paused as a whole \u2014 invokes then answer 404) and `cpuMsCeiling`. Each entry carries its plain `vars` only for a server key holding features:read or features:write (never for an end-user request). Read-only; any authenticated key may read it. Use it before functions_invoke or functions_logs to get the exact names.",
+    description: "The project's deployed functions: name, endpoint (/v1/fn/<name>), trigger bindings, scopes, limits and the runtime each runs under, plus `enabled` (false while the project's functions are paused as a whole \u2014 invokes then answer 404), `cpuMsCeiling` and `cpuMsDefault` (the CPU a function declaring no limits.cpuMs gets). Each entry carries its plain `vars` only for a server key holding features:read or features:write (never for an end-user request). Read-only; any authenticated key may read it. Use it before functions_invoke or functions_logs to get the exact names.",
     inputSchema: { type: "object", properties: {} },
     method: "GET",
     path: "/v1/functions"
@@ -13892,7 +14381,7 @@ var TOOLS = [
   {
     name: "functions_logs",
     feature: "functions",
-    description: "Log records of ONE deployed function, one per invocation (ts, outcome, wall_ms, cpu_ms, console lines, exceptions), oldest first, with `next_since` \u2014 pass it back as `since` to read only newer records (a tail). Without `since`: the most recent records of the last 24 hours. Kept 14 days. Needs functions:read.",
+    description: 'Log records of ONE deployed function, one per invocation (ts, outcome, wall_ms, cpu_ms, console lines, exceptions), oldest first, with `next_since` \u2014 pass it back as `since` to read only newer records (a tail). Without `since`: the most recent records of the last 24 hours. Kept 14 days. Needs functions:read. To forward log lines to your own https endpoint (kept as long as you like), declare features.functions.logDrain { url, secretRef, minLevel } and push it, or PUT /v1/config/functions with { "logDrain": {\u2026} } (null removes it); this tool only reads.',
     inputSchema: {
       type: "object",
       properties: {
@@ -14063,7 +14552,7 @@ var TOOLS = [
   {
     name: "search_query",
     feature: "vector-search",
-    description: "Retrieve the top-k most relevant chunks from a vector-search collection. mode 'hybrid' (default) fuses semantic + keyword via RRF; 'vector' is pure semantic; 'keyword' is lexical. filter is a JSON object of equality constraints over chunk metadata. Returns ranked results with document/chunk attribution: score is the fused rank value (orders the hits, not a similarity); similarity is the cosine similarity to the query (-1..1, null in keyword mode) \u2014 threshold on similarity. embed_provider names the collection's embedder; 'mock' is the deterministic test embedder (ranks by a hash, not meaning), so tell the user search is not semantic until a real provider is set.",
+    description: "Retrieve the top-k most relevant chunks from a vector-search collection. mode 'hybrid' (default) fuses semantic + keyword via RRF; 'vector' is pure semantic; 'keyword' is lexical. filter is a JSON object over top-level chunk metadata keys, ANDed: {key: value} is equality, {key: {$in: [a, b]}} matches any of 1\u201350 values (\u22644 $in keys); any other value is refused 422. Returns ranked results with document/chunk attribution: score is the fused rank value (orders the hits, not a similarity); similarity is the cosine similarity to the query (-1..1, null in keyword mode) \u2014 threshold on similarity. embed_provider names the collection's embedder; 'mock' is the deterministic test embedder (ranks by a hash, not meaning), so tell the user search is not semantic until a real provider is set.",
     inputSchema: {
       type: "object",
       properties: {
@@ -14071,7 +14560,7 @@ var TOOLS = [
         query: { type: "string", description: "Natural-language query text." },
         top_k: { type: "number", minimum: 1, maximum: 100, default: 10 },
         mode: { type: "string", enum: ["hybrid", "vector", "keyword"], default: "hybrid" },
-        filter: { type: "object", additionalProperties: true, description: 'Metadata equality filter, e.g. {"user_id":"u_42"}.' },
+        filter: { type: "object", additionalProperties: true, description: 'Metadata filter, keys ANDed: equality {"user_id":"u_42"} or any-of {"folder":{"$in":["a","b"]}} (1\u201350 values, \u22644 $in keys). null / arrays / other operators are refused 422.' },
         rerank: { type: "boolean", description: "Apply the configured BYO reranker (config rerank block) to the fused results before top-k. Fail-open: a provider fault returns the RRF order with reranked:false." }
       },
       required: ["collection", "query"]
@@ -14237,7 +14726,7 @@ var TOOLS = [
         template: { type: "string", description: "Override the answer template (defaults to rag config defaultTemplate)." },
         top_k: { type: "number", minimum: 1, maximum: 100, description: "Chunks to retrieve before budgeting." },
         mode: { type: "string", enum: ["hybrid", "vector", "keyword"] },
-        filter: { type: "object", additionalProperties: true, description: "Metadata equality filter applied to retrieval." },
+        filter: { type: "object", additionalProperties: true, description: 'Metadata filter applied to retrieval: equality {"key":"value"} or any-of {"key":{"$in":[...]}} (1\u201350 values), keys ANDed.' },
         provider: { type: "string" },
         model: { type: "string" },
         input: { type: "object", additionalProperties: true, description: "Extra template vars beyond {{query}}/{{context}}." },
@@ -14260,7 +14749,7 @@ var TOOLS = [
         collection: { type: "string", description: "Collection to search (defaults to rag config defaultCollection)." },
         top_k: { type: "number", minimum: 1, maximum: 100, description: "Chunks to retrieve." },
         mode: { type: "string", enum: ["hybrid", "vector", "keyword"] },
-        filter: { type: "object", additionalProperties: true, description: "Metadata equality filter applied to retrieval." },
+        filter: { type: "object", additionalProperties: true, description: 'Metadata filter applied to retrieval: equality {"key":"value"} or any-of {"key":{"$in":[...]}} (1\u201350 values), keys ANDed.' },
         rerank: { type: "boolean", description: "Forward rerank:true to vector-search's BYO rerank pass (inert until configured there)." },
         boosts: { type: "object", additionalProperties: true, description: "Per-metadata-field boost specs: { field: { kind:'recency', halfLifeDays?, weight? } | { kind:'value', weights:{\u2026} } }." },
         min_score: { type: "number", description: "Drop hits below this EFFECTIVE (post-boost) score. score is a rank value (about 0.016-0.033 at the top), so a floor above ~0.033 drops every hit; use min_similarity for a relevance threshold." },
@@ -14846,6 +15335,10 @@ function collectSecretRefs(cfg) {
       if (m) add({ name: m[1], feature, via: `features.${feature}.${path}` });
     }
   }
+  const drainRef = cfg.features?.functions?.logDrain?.secretRef;
+  if (typeof drainRef === "string" && drainRef.replace(/^secret:/, "")) {
+    add({ name: drainRef.replace(/^secret:/, ""), feature: "functions", via: "features.functions.logDrain.secretRef" });
+  }
   for (const [fn, def] of Object.entries(cfg.functions ?? {})) {
     for (const ref of normalizeSecretRefs(def.secrets)) {
       const bare = ref.slice("secret:".length);
@@ -14921,7 +15414,8 @@ var COMPARED_LABELS = [
   ["subscriptions", "subscription"],
   ["campaigns", "campaign"],
   ["templates", "template"],
-  ["roles", "role"]
+  ["roles", "role"],
+  ["searchCollections", "search collection"]
 ];
 function formatCompared(c) {
   const parts = [];
@@ -15879,8 +16373,12 @@ function renderTryReport(result, opts) {
 
 // src/brief.ts
 var SITE = "https://vxil.com";
-function briefDocsUrl(docs) {
-  return docs.startsWith("/") ? `${SITE}${docs}` : docs;
+var STAGING_SITE = "https://staging.vxil.org";
+function briefSiteFor(edgeBase) {
+  return envLabelFor(edgeBase) === "production" ? SITE : STAGING_SITE;
+}
+function briefDocsUrl(docs, site = SITE) {
+  return docs.startsWith("/") ? `${site}${docs}` : docs;
 }
 function renderBriefLines(brief, opts = {}) {
   if (!brief) {
@@ -15903,7 +16401,7 @@ function renderBriefLines(brief, opts = {}) {
   }
   return out;
 }
-function renderBriefMarkdown(brief, app = {}) {
+function renderBriefMarkdown(brief, app = {}, opts = {}) {
   const name = (app.name ?? "").trim() || "Your app";
   if (!brief) {
     return [
@@ -15922,7 +16420,7 @@ function renderBriefMarkdown(brief, app = {}) {
   for (const s of brief.sections) {
     lines.push(`## ${s.title}`, "");
     for (const i of s.items) {
-      lines.push(`- **[${i.title}](${briefDocsUrl(i.docs)})** \u2014 ${i.fact}`);
+      lines.push(`- **[${i.title}](${briefDocsUrl(i.docs, opts.site)})** \u2014 ${i.fact}`);
       if (i.why) lines.push(`  _why:_ ${i.why}`);
       if (i.replaces) lines.push(`  _instead of:_ ${i.replaces}`);
     }
@@ -16095,7 +16593,9 @@ var EXTRA_KNOWN_FLAGS = [
   "include-empty",
   "include-password-hashes",
   "with-password-hashes",
+  "with-oauth-identities",
   "keep-source-id",
+  "keep-timestamps",
   "oidc-issuer",
   "only",
   "pg-schema",
@@ -16798,7 +17298,8 @@ function inferMapping(source, opts = {}) {
     if (owner) mapping.userRefColumn = owner.column;
     for (const col of t.columns) {
       if (col.name === "created_at" || col.name === "updated_at") {
-        mapping.reasons.push(`R13: ${col.name} dropped \u2014 cms manages created_at/updated_at (original values not preserved)`);
+        mapping.reasons.push(`R13: ${col.name} dropped \u2014 cms manages created_at/updated_at (original values kept with \`data --keep-timestamps\`)`);
+        mapping.sourceTimestamps = { ...mapping.sourceTimestamps, [col.name === "created_at" ? "created" : "updated"]: col.name };
         continue;
       }
       const isOwnerCol = owner?.column === col.name;
@@ -17200,6 +17701,32 @@ function storagePatch(row2, fields, resolve8) {
 function readColumns(mapping, pk, extra = []) {
   return [.../* @__PURE__ */ new Set([pk, ...mapping.fields.map((f) => f.source), ...mapping.changeColumn ? [mapping.changeColumn] : [], ...extra])];
 }
+function sourceTimestampColumns(mapping) {
+  if (mapping.sourceTimestamps) return { ...mapping.sourceTimestamps };
+  const out = {};
+  for (const r of mapping.reasons) {
+    const m = /^R13: (created_at|updated_at) dropped/.exec(r);
+    if (m?.[1] === "created_at") out.created = "created_at";
+    if (m?.[1] === "updated_at") out.updated = "updated_at";
+  }
+  return out;
+}
+var TS_MIN_MS = 0;
+var TS_FUTURE_MARGIN_MS = 6e4;
+var tsIso = (raw, nowMs) => {
+  let t;
+  if (raw instanceof Date) t = raw.getTime();
+  else if (typeof raw === "string" && raw !== "") t = Date.parse(raw);
+  else return null;
+  if (Number.isNaN(t) || t < TS_MIN_MS || t > nowMs + TS_FUTURE_MARGIN_MS) return null;
+  return new Date(t).toISOString();
+};
+function sourceTimestampsOf(row2, cols, nowMs = Date.now()) {
+  const created = cols.created ? tsIso(row2[cols.created], nowMs) : null;
+  if (created === null) return void 0;
+  const updated = cols.updated ? tsIso(row2[cols.updated], nowMs) : null;
+  return updated !== null && updated >= created ? { created_at: created, updated_at: updated } : { created_at: created };
+}
 var SCALAR_UNIQUE = /* @__PURE__ */ new Set(["string", "int", "float", "datetime"]);
 function buildItem(row2, mapping, state, tableByCollection, resolve8) {
   const full = {};
@@ -17256,7 +17783,18 @@ function holdsContent(stored, item, storageTargets) {
     return cur === rowHash(v) || storageTargets.has(k) && cur === rowHash(item.hashInput[k]);
   });
 }
-async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColumn, itemStatus = "published", delta }) {
+async function loadCmsTable({
+  deps,
+  plan,
+  mapping,
+  adapter,
+  state,
+  save,
+  pkColumn,
+  itemStatus = "published",
+  delta,
+  keepTimestamps = false
+}) {
   const table = mapping.table;
   const collection = mapping.collection;
   const key = `cms:${table}`;
@@ -17290,8 +17828,12 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
   let unhashedSame = 0;
   const enc2 = encodeURIComponent(collection);
   const start = cursors[key] ?? void 0;
+  const tsCols = keepTimestamps ? sourceTimestampColumns(mapping) : {};
+  if (keepTimestamps && tsCols.created === void 0) {
+    deps.log(`cms ${table}: --keep-timestamps \u2014 the source has no created_at column; items take the time of the import`);
+  }
   const readOpts = {
-    columns: readColumns(mapping, pk),
+    columns: readColumns(mapping, pk, [tsCols.created, tsCols.updated].filter((c) => c !== void 0)),
     ...delta && mapping.changeColumn ? { changedSince: { column: mapping.changeColumn, since: delta.since } } : {}
   };
   const noteStorage = (sourceId, row2) => {
@@ -17374,7 +17916,12 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
             continue;
           }
           if (deps.dryRun) continue;
-          const res = await deps.api("POST", `/v1/cms/items/${enc2}`, { data: item.create, status: itemStatus });
+          const srcTs = keepTimestamps ? sourceTimestampsOf(row2, tsCols) : void 0;
+          const res = await deps.api("POST", `/v1/cms/items/${enc2}`, {
+            data: item.create,
+            status: itemStatus,
+            ...srcTs ? { source_timestamps: srcTs } : {}
+          });
           if (res.status === 201 || res.status === 200) {
             const itemId = res.body.data?.item_id;
             if (typeof itemId !== "string") {
@@ -17559,11 +18106,14 @@ async function loadUsers({ deps, adapter, mapping, state, save, delta = false })
 // src/migrate/loaders/credentials.ts
 var CREDENTIALS_BATCH_MAX = 500;
 var KEY = "users:credentials";
+var IDENTITIES_PER_USER_MAX = 8;
 function credentialEntry(row2, withHashes) {
+  const identities = (row2.identities ?? []).slice(0, IDENTITIES_PER_USER_MAX);
   return {
     id: row2.id,
     ...withHashes && row2.password_hash ? { password_hash: row2.password_hash } : {},
-    ...row2.email_verified ? { email_verified: true } : {}
+    ...row2.email_verified ? { email_verified: true } : {},
+    ...identities.length > 0 ? { identities } : {}
   };
 }
 async function loadCredentials2({ deps, adapter, state, save, opts, delta = false }) {
@@ -17576,11 +18126,17 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
   const sent = hashesFor(state, KEY);
   if (cursors[KEY] === null) {
     deps.log(delta ? "credentials: incremental pass already complete for this --since window \u2014 skipping" : `credentials: already complete \u2014 skipping (\`data --since <time>\` re-reads it)`);
+    if (opts.withIdentities) {
+      deps.log("  \u26A0 --with-oauth-identities: social links attach only to users the import CREATES \u2014 users already imported by an earlier run are kept as they are and get no links. To carry the links, import into a fresh target (`vxil dev down` / a new project) with --with-password-hashes --with-oauth-identities.");
+    }
     return result;
   }
   const reasons = /* @__PURE__ */ new Map();
   let withPassword = 0;
-  for await (const batch of adapter.readCredentials(cursors[KEY] ?? void 0)) {
+  let withLinks = 0;
+  let linked = 0;
+  const readOpts = opts.withIdentities ? { identities: true } : void 0;
+  for await (const batch of adapter.readCredentials(cursors[KEY] ?? void 0, readOpts)) {
     const entries = [];
     const digests = [];
     for (const row2 of batch.rows) {
@@ -17592,6 +18148,7 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
         continue;
       }
       if (entry.password_hash) withPassword++;
+      if (entry.identities) withLinks++;
       entries.push(entry);
       digests.push(h);
     }
@@ -17609,6 +18166,7 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
         return result;
       }
       const data2 = res.body.data ?? {};
+      linked += typeof data2.identities_linked === "number" ? data2.identities_linked : 0;
       const taken = (data2.results ?? []).filter((r) => r.status === "skipped" && r.reason === "id_taken").length;
       if (taken > 0) {
         result.errors.push(`credentials: ${taken} user id(s) already belong to another vxil project in this environment (user ids are unique across projects) \u2014 most often a rehearsal dev backend that imported the same users. Delete it (\`vxil dev down\`) or the project that holds them, then re-run: the cursor was NOT advanced and the import is idempotent. Left as is, those users would get a new id at sign-up and lose their data.`);
@@ -17630,10 +18188,13 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
     if (batch.nextCursor === null) break;
   }
   if (deps.dryRun) {
-    deps.log(`credentials: DRY-RUN \u2014 would import ${result.read - result.skipped} identit(ies)` + (opts.withHashes ? `, ${withPassword} with a password hash` : " (no hashes \u2014 --with-password-hashes not set)") + (opts.oidcIssuer ? ", each linked to the source issuer for the session hand-over" : "") + "; nothing written");
+    deps.log(`credentials: DRY-RUN \u2014 would import ${result.read - result.skipped} identit(ies)` + (opts.withHashes ? `, ${withPassword} with a password hash` : " (no hashes \u2014 --with-password-hashes not set)") + (opts.oidcIssuer ? ", each linked to the source issuer for the session hand-over" : "") + (opts.withIdentities ? `, ${withLinks} with social sign-in links` : "") + "; nothing written");
   } else {
     cursors[KEY] = null;
     save();
+    if (opts.withIdentities) {
+      deps.log(`credentials: ${linked} social sign-in link(s) created for ${withLinks} user(s) \u2014 a link is made only for an identity this import creates or still holds, and a subject already linked stays put`);
+    }
   }
   if (reasons.size > 0) {
     const list = [...reasons].map(([r, n]) => `${r}=${n}`).join(" ");
@@ -18710,6 +19271,7 @@ async function runData(deps, plan, adapter, opts = {}) {
       save: g.save,
       ...opts.pkColumns?.[table] !== void 0 ? { pkColumn: opts.pkColumns[table] } : {},
       ...opts.itemStatus !== void 0 ? { itemStatus: opts.itemStatus } : {},
+      ...opts.keepTimestamps ? { keepTimestamps: true } : {},
       ...delta ? { delta } : {}
     });
     results.push(r);
@@ -19063,7 +19625,14 @@ async function runMigrateData(io, opts = {}) {
   if (opts.oidcIssuer !== void 0 && !/^https:\/\/[^\s?#]+$/.test(opts.oidcIssuer)) {
     throw new Error(`--oidc-issuer '${opts.oidcIssuer}' must be an https URL with no query or fragment (Supabase: https://<ref>.supabase.co/auth/v1)`);
   }
-  const credentials = opts.withPasswordHashes || opts.oidcIssuer !== void 0 ? { withHashes: opts.withPasswordHashes === true, ...opts.oidcIssuer !== void 0 ? { oidcIssuer: opts.oidcIssuer } : {} } : void 0;
+  if (opts.withOauthIdentities && !opts.withPasswordHashes) {
+    throw new Error("--with-oauth-identities needs --with-password-hashes in the same run: the import creates each user once, so a user with both a password and a social link would otherwise lose the password for good");
+  }
+  const credentials = opts.withPasswordHashes || opts.oidcIssuer !== void 0 || opts.withOauthIdentities ? {
+    withHashes: opts.withPasswordHashes === true,
+    ...opts.oidcIssuer !== void 0 ? { oidcIssuer: opts.oidcIssuer } : {},
+    ...opts.withOauthIdentities ? { withIdentities: true } : {}
+  } : void 0;
   const tableNames = new Set(plan.tables.map((t) => t.table));
   for (const o of opts.only ?? []) {
     if (!DATA_STEPS.has(o) && !tableNames.has(o)) {
@@ -19098,7 +19667,8 @@ async function runMigrateData(io, opts = {}) {
     ...opts.prune ? { prune: true } : {},
     ...specs ? { payments: specs } : {},
     ...credentials ? { credentials } : {},
-    ...opts.fileLinks ? { fileLinks: opts.fileLinks } : {}
+    ...opts.fileLinks ? { fileLinks: opts.fileLinks } : {},
+    ...opts.keepTimestamps ? { keepTimestamps: true } : {}
   });
   io.log(`${execute ? "\nmigrate data" : "\nmigrate data (DRY-RUN \u2014 zero writes)"}${since ? ` \u2014 incremental since ${since}${opts.prune ? " + prune" : ""}` : ""}:`);
   for (const r of results) io.log(formatLoadResult(r));
@@ -20266,7 +20836,7 @@ export default defineConfig({
     "functions": {
       "prune-receipts.ts": "// prune-receipts.ts \u2014 THE GARBAGE COLLECTOR (a vxil function, cron trigger).\n//\n// Trigger: cron `30 */6 * * *` (every 6 hours).\n//\n// A push service accepts a message and answers \"ok\" long before it knows whether\n// the device still exists. The real verdict arrives later, as a RECEIPT keyed by\n// the id the send returned. Almost nobody collects them, which is why push\n// registries only ever grow: dead tokens are re-sent to forever, quota is spent\n// on handsets that were wiped a year ago, and delivery rates look worse than\n// they are.\n//\n// This cron closes that loop:\n//   1. resume the walk of `push_tokens` where the previous tick stopped (the\n//      cursor lives in `push_state`), collecting rows that carry a `receipt_id`,\n//   2. ask the push service for those receipts, in batches,\n//   3. `DeviceNotRegistered` \u2192 DELETE the row (\u2605 invariant 3),\n//      any other error \u2192 count it and keep the device,\n//      ok \u2192 clear the receipt id; there is nothing left to check,\n//      no receipt and older than RECEIPT_MAX_AGE_H \u2192 clear it (the service no\n//      longer has it; asking forever would pin the row),\n//      Every clear is a PATCH with If-Match on the row version that was read:\n//      if `send-push` parked a NEWER receipt id on the device meanwhile, the\n//      clear is refused (409) and the newer id stays for the next walk,\n//   4. save the cursor \u2014 or '' when the walk reached the oldest row, so the\n//      next tick starts again from the newest.\n//\n// Everything is bounded: one tick reads at most MAX_ROWS rows and acts on at\n// most MAX_ACTIONS of them, so its outbound calls stay in the low hundreds.\n// Because the cursor persists, a registry of ANY size is walked end to end over\n// successive ticks \u2014 MAX_ROWS \xD7 4 ticks a day. (The walk follows the default\n// newest-first order; rows registered while a walk is in progress are covered\n// by the next walk.)\n\n// cron-walk: persisted-cursor \u2014 the walk's cursor lives in `push_state` and is saved with If-Match.\n\nimport type { CronFunctionEnvelope } from '@vxil/sdk';\n\nconst RECEIPTS_URL = 'https://exp.host/--/api/v2/push/getReceipts';\n/** Receipt ids per request. */\nconst RECEIPT_BATCH = 300;\n/** Token rows examined per cron tick. */\nconst MAX_ROWS = 2000;\n/** Rows with a pending receipt acted on per tick (each costs one PATCH or DELETE). */\nconst MAX_ACTIONS = 300;\n/** A receipt id parked longer than this is cleared as unknowable. */\nconst RECEIPT_MAX_AGE_H = 48;\n/** cms page size \u2014 100 is the default `maxPageSize` for the cms feature. */\nconst PAGE = 100;\n/** This cron's row in `push_state`. */\nconst STATE_KEY = 'prune-receipts';\n\ntype Env = CronFunctionEnvelope;\ninterface TokenRow {\n  item_id: string;\n  version?: number;\n  data: { token?: string; receipt_id?: string; receipt_at?: string; failures?: number };\n}\ninterface Receipt { status?: string; message?: string; details?: { error?: string } }\ninterface StateRow { item_id: string; version?: number; data: { cursor?: string } }\n\nexport default {\n  async fetch(req: Request): Promise<Response> {\n    const env = (await req.json().catch(() => ({}))) as Env;\n    const base = env.vxil_base ?? 'https://api.vxil.com';\n    const cms = env.scoped_jwts?.cms;\n    if (!cms) return Response.json({ error: 'missing cms scope' }, { status: 403 });\n    const H = { authorization: `Bearer ${cms}`, 'content-type': 'application/json' };\n\n    // \u2500\u2500 1. Resume the walk; collect pending receipts. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    const state = await readState(base, H, STATE_KEY);\n    if (state === 'error') return Response.json({ error: 'state_read_failed' }, { status: 502 });\n    const startedAt = state?.data.cursor || null;\n    const pending = new Map<string, TokenRow>(); // receipt_id \u2192 row\n    let cursor: string | null = startedAt;\n    let scanned = 0;\n    let wrapped = false;\n    while (scanned < MAX_ROWS && pending.size < MAX_ACTIONS) {\n      // NOTE: no `sort=` here on purpose. In the DEFAULT order (newest first)\n      // a cursor is a plain item id, which is what we persist between ticks\n      // and resume `item_id <` from. Paging beats ordering here.\n      const url = `${base}/v1/cms/items/push_tokens?limit=${PAGE}`\n        + (cursor ? `&cursor=${encodeURIComponent(cursor)}` : '');\n      const res = await fetch(url, { headers: H });\n      if (!res.ok) return Response.json({ error: 'list_failed', status: res.status }, { status: 502 });\n      const body = (await res.json()) as { data?: { items?: TokenRow[]; next_cursor?: string | null } };\n      const items = body.data?.items ?? [];\n      let stoppedEarly = false;\n      for (const it of items) {\n        scanned++;\n        if (it.data.receipt_id) pending.set(it.data.receipt_id, it);\n        cursor = it.item_id; // resume AFTER the last row actually looked at\n        if (pending.size >= MAX_ACTIONS || scanned >= MAX_ROWS) { stoppedEarly = true; break; }\n      }\n      if (stoppedEarly) break;\n      if (!body.data?.next_cursor || items.length === 0) { wrapped = true; break; }\n      cursor = body.data.next_cursor;\n    }\n    // Reached the oldest row \u2192 the next tick starts again from the newest.\n    const nextCursor = wrapped ? '' : (cursor ?? '');\n\n    // \u2500\u2500 2 + 3. Ask for verdicts and act on them. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    const ids = [...pending.keys()];\n    let checked = 0;\n    let pruned = 0;\n    let cleared = 0;\n    let expired = 0;\n    let raced = 0;\n    const errors: string[] = [];\n    const now = Date.now();\n\n    for (let i = 0; i < ids.length; i += RECEIPT_BATCH) {\n      const slice = ids.slice(i, i + RECEIPT_BATCH);\n      const res = await fetch(RECEIPTS_URL, {\n        method: 'POST',\n        headers: { 'content-type': 'application/json', accept: 'application/json' },\n        body: JSON.stringify({ ids: slice }),\n      }).catch(() => null);\n      if (!res || !res.ok) {\n        errors.push(`receipts request returned ${res?.status ?? 'network error'}`);\n        continue;\n      }\n      // Receipts come back keyed by id \u2014 a receipt that is not ready yet is\n      // simply ABSENT, which is not an error: it is checked again next walk.\n      const map = (((await res.json().catch(() => ({}))) as { data?: Record<string, Receipt> }).data) ?? {};\n      for (const id of slice) {\n        const receipt = map[id];\n        const row = pending.get(id)!;\n        if (!receipt) {\n          // Not ready \u2014 or no longer kept by the service. Past the age bound\n          // the id can never be answered: clear it so the row is not pinned.\n          const at = row.data.receipt_at ? Date.parse(row.data.receipt_at) : NaN;\n          if (Number.isFinite(at) && now - at > RECEIPT_MAX_AGE_H * 3_600_000) {\n            if (await patch(base, H, row, { receipt_id: '', checked_at: iso() })) expired++; else raced++;\n          }\n          continue;\n        }\n        checked++;\n        if (receipt.status === 'ok') {\n          // Delivered. Nothing more to check for this device.\n          if (await patch(base, H, row, { receipt_id: '', failures: 0, checked_at: iso() })) cleared++; else raced++;\n          continue;\n        }\n        const reason = receipt.details?.error ?? receipt.message ?? 'unknown';\n        if (reason === 'DeviceNotRegistered') {\n          // \u2605 INVARIANT 3. The device is gone \u2014 the row goes with it. This is\n          // also the ONLY safe automatic delete: every other error is transient\n          // or about the message, not about the device's existence.\n          await fetch(`${base}/v1/cms/items/push_tokens/${row.item_id}`, { method: 'DELETE', headers: H })\n            .catch(() => null);\n          pruned++;\n          continue;\n        }\n        if (!await patch(base, H, row, {\n          receipt_id: '',\n          failures: (row.data.failures ?? 0) + 1,\n          last_error: String(reason).slice(0, 300),\n          checked_at: iso(),\n        })) raced++;\n        errors.push(reason);\n      }\n    }\n\n    // \u2500\u2500 4. Save where the walk stopped (If-Match: a concurrent tick wins). \u2500\u2500\u2500\u2500\n    const saved = await writeState(base, H, STATE_KEY, state, nextCursor);\n\n    return Response.json({\n      scanned, pending: pending.size, checked, pruned, cleared, expired, raced,\n      resumed_from: startedAt, cursor: nextCursor, wrapped, saved, errors: errors.slice(0, 10),\n    });\n  },\n};\n\n/** Clear/record against the version that was READ. false = the row changed\n *  meanwhile (409: a newer receipt is parked \u2014 leave it) or the write failed. */\nasync function patch(base: string, H: Record<string, string>, row: TokenRow, data: Record<string, unknown>): Promise<boolean> {\n  const res = await fetch(`${base}/v1/cms/items/push_tokens/${row.item_id}`, {\n    method: 'PATCH',\n    headers: { ...H, ...(row.version !== undefined ? { 'if-match': String(row.version) } : {}) },\n    body: JSON.stringify({ data }),\n  }).catch(() => null);\n  return !!res && res.ok;\n}\n\n/** This cron's `push_state` row, null when it does not exist yet. */\nasync function readState(base: string, H: Record<string, string>, key: string): Promise<StateRow | null | 'error'> {\n  const filter = encodeURIComponent(JSON.stringify({ key }));\n  const res = await fetch(`${base}/v1/cms/items/push_state?filter=${filter}&limit=1`, { headers: H });\n  if (!res.ok) return 'error';\n  return ((await res.json()) as { data?: { items?: StateRow[] } }).data?.items?.[0] ?? null;\n}\n\n/** Persist the cursor. First tick creates the row (a racing tick's 409 on the\n *  unique `key` is fine \u2014 that tick saved its own); later ticks PATCH with\n *  If-Match so two overlapping ticks cannot both move it. */\nasync function writeState(\n  base: string, H: Record<string, string>, key: string, state: StateRow | null, cursor: string,\n): Promise<boolean> {\n  const data = { key, cursor, updated_at: iso() };\n  const res = state\n    ? await fetch(`${base}/v1/cms/items/push_state/${state.item_id}`, {\n      method: 'PATCH',\n      headers: { ...H, ...(state.version !== undefined ? { 'if-match': String(state.version) } : {}) },\n      body: JSON.stringify({ data }),\n    }).catch(() => null)\n    : await fetch(`${base}/v1/cms/items/push_state`, {\n      method: 'POST', headers: H, body: JSON.stringify({ status: 'published', data }),\n    }).catch(() => null);\n  return !!res && res.ok;\n}\n\nconst iso = () => new Date().toISOString();\n",
       "register-token.ts": "// register-token.ts \u2014 THE DEVICE REGISTRY (a vxil function with five bindings).\n//\n//   http     POST /v1/fn/register-token { token, user_id?, platform?, locale? }\n//   cmsHook  a new `push_token_claims` row (the app's async re-own request)\n//   webhook  `auth.user.erased` / `user.erased` / `user.deleted` (forget the user)\n//\n// One bundle, because all three are the same job: keeping \"which user holds\n// which device\" true. The envelope's `trigger` says which door was used.\n//\n// \u2500\u2500 http: register \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// Call it every time your app starts and every time the OS hands you a new push\n// token. It is idempotent, and it enforces the two registry invariants:\n//\n//   1. ONE TOKEN, ONE USER. `token` is declared `unique`, so the platform \u2014\n//      not this code \u2014 decides who wins a race. Two devices registering the\n//      same token at the same instant produce exactly one row; the loser sees\n//      409 `unique_violation`.\n//   2. RE-OWN ON CHANGE. A token that comes back under a DIFFERENT user is\n//      REASSIGNED, not duplicated. This is the case that matters: a resold\n//      phone, a shared tablet, a sign-out/sign-in on the same handset. Without\n//      it, the previous owner's notifications keep arriving on someone else's\n//      lock screen.\n//\n// IDENTITY. If the call carries a verified end-user session, `envelope.end_user`\n// is populated by the platform and THAT id wins \u2014 a body field can never\n// impersonate a signed-in user. In server mode (your backend, a server key)\n// there is no verified principal and `user_id` from the body is used.\n//\n// SERVER MODE re-owns immediately (a tenant-wide read finds the row whoever\n// owns it). END-USER MODE cannot see another user's row \u2014 the owner scope is\n// the fail-safe working \u2014 so the app's call files a CLAIM in\n// `push_token_claims` (owned by the caller) and answers 202\n// `{ action: 'reown_queued' }`; the cmsHook below finishes the move.\n//\n// \u2500\u2500 cmsHook: finish an async re-own \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// Runs in SERVER mode (a platform-delivered hook carries no end-user), so it can\n// read and move any row: re-read the claim, re-own (or create) the token row for\n// the claimant, delete the claim. At-least-once and re-delivered on failure\n// (`retry`), so every step is idempotent: a claim that is already gone is done.\n//\n// \u2500\u2500 webhook: erasure and deletion \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// `auth.user.erased { user_id }`, `user.erased { id }` and `user.deleted { id }`\n// (the admin delete without erase) delete every device row, pending claim and\n// the preferences row of that user \u2014 device tokens, time zone and activity are\n// personal data, and a deleted account must stop getting reminder nudges.\n// Deliberately NOT `auth.session.revoked`: that event fires on every\n// refresh-token rotation, not only on sign-out. A MERGE or REKEY\n// (`auth.user.merged` / `.rekeyed`, guest \u2192 registered) needs nothing here: the\n// app's next start registers its token under the new id, which re-owns it.\n\nimport type { CmsHookFunctionEnvelope, HttpFunctionEnvelope, WebhookFunctionEnvelope } from '@vxil/sdk';\n\ntype RegisterBody = { token?: string; user_id?: string; platform?: string; locale?: string };\ntype Env =\n  | HttpFunctionEnvelope<RegisterBody>\n  | CmsHookFunctionEnvelope\n  | WebhookFunctionEnvelope<{ user_id?: string; id?: string }>;\ninterface TokenRow { item_id: string; version?: number; data: { token?: string; end_user?: string } }\ninterface ClaimRow { item_id: string; data: { token?: string; end_user?: string; platform?: string; locale?: string } }\n\nconst PLATFORMS = new Set(['ios', 'android', 'web']);\n/** Rows deleted per erasure attempt \u2014 a person has a handful of devices; a\n *  bigger set is finished by the next attempt (each deletes the next pages). */\nconst ERASE_MAX = 200;\n\nexport default {\n  async fetch(req: Request): Promise<Response> {\n    const env = (await req.json().catch(() => ({}))) as Env;\n    const base = env.vxil_base ?? 'https://api.vxil.com';\n    const cms = env.scoped_jwts?.cms;\n    if (!cms) return json({ error: 'missing cms scope' }, 403);\n    const H = { authorization: `Bearer ${cms}`, 'content-type': 'application/json' };\n\n    if (env.trigger === 'cms-hook') return finishClaim(base, H, env);\n    if (env.trigger === 'webhook') return forgetUser(base, H, env);\n    return register(base, H, env as HttpFunctionEnvelope<RegisterBody>);\n  },\n};\n\n// \u2500\u2500 http \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nasync function register(base: string, H: Record<string, string>, env: HttpFunctionEnvelope<RegisterBody>): Promise<Response> {\n  const p = env.payload ?? {};\n  const token = typeof p.token === 'string' ? p.token.trim() : '';\n  // A VERIFIED principal always beats the body. Never trust a client-supplied\n  // user id when the platform has already told you who is calling.\n  const endUser = env.end_user?.id;\n  const owner = endUser ?? (typeof p.user_id === 'string' ? p.user_id.trim() : '');\n  if (!token) return json({ error: 'token is required' }, 400);\n  if (!owner) return json({ error: 'user_id is required (or invoke with an end-user session)' }, 400);\n  // The unique claim is capped at 256 chars; refuse early with a clear message\n  // rather than letting the write fail deep in the stack.\n  if (token.length > 256) return json({ error: 'token longer than 256 characters \u2014 store a hash instead' }, 400);\n\n  const data = tokenData(token, owner, p.platform, p.locale);\n\n  // \u2500\u2500 1. Try to create. The common case is one round-trip. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const created = await fetch(`${base}/v1/cms/items/push_tokens`, {\n    method: 'POST', headers: H, body: JSON.stringify({ status: 'published', data }),\n  });\n  if (created.ok) {\n    const body = (await created.json()) as { data?: { item_id?: string } };\n    return json({ registered: true, action: 'created', item_id: body.data?.item_id }, 201);\n  }\n  if (created.status !== 409) return json({ error: 'register_failed', status: created.status }, 502);\n\n  // \u2500\u2500 2. 409 \u21D2 the token already exists. Find it and decide. \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // In SERVER mode this read is tenant-wide and finds the row whoever owns it.\n  // In end-user mode it is owner-scoped, so a row belonging to someone else is\n  // invisible \u2014 that is the fail-safe working as designed.\n  const row = await findToken(base, H, token);\n  if (row === 'error') return json({ error: 'lookup_failed' }, 502);\n  if (!row) {\n    if (!endUser) {\n      // Server mode sees every row, so \"exists but not found\" is a race with a\n      // concurrent delete. Retrying the call settles it.\n      return json({ registered: false, error: 'conflict', hint: 'retry the call' }, 409);\n    }\n    // \u2605 The async re-own. File a claim (owned by the caller \u2014 the platform\n    // stamps the verified owner); the server-mode cmsHook moves the token.\n    const claim = await fetch(`${base}/v1/cms/items/push_token_claims`, {\n      method: 'POST', headers: H,\n      body: JSON.stringify({ status: 'published', data: claimData(token, owner, p.platform, p.locale) }),\n    });\n    if (!claim.ok) return json({ error: 'claim_failed', status: claim.status }, 502);\n    const c = (await claim.json()) as { data?: { item_id?: string } };\n    return json({ registered: false, action: 'reown_queued', claim_id: c.data?.item_id }, 202);\n  }\n\n  const moved = await reown(base, H, row, data);\n  if (!moved.ok) {\n    // 409 version_conflict = a concurrent registration already moved it. The\n    // registry is still correct; the caller can simply retry.\n    return json({ registered: false, error: 'conflict', status: moved.status }, 409);\n  }\n  const previous = row.data.end_user;\n  return json({\n    registered: true,\n    action: previous && previous !== owner ? 'reowned' : 'refreshed',\n    item_id: row.item_id,\n    ...(previous && previous !== owner ? { previous_owner: previous } : {}),\n  }, 200);\n}\n\n// \u2500\u2500 cmsHook \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nasync function finishClaim(base: string, H: Record<string, string>, env: CmsHookFunctionEnvelope): Promise<Response> {\n  const { collection, item_id: claimId } = env.payload ?? ({} as CmsHookFunctionEnvelope['payload']);\n  // The platform filters on the binding's collection; this guard is belt and braces.\n  if (collection !== 'push_token_claims' || !claimId) return json({ skipped: true }, 200);\n\n  const got = await fetch(`${base}/v1/cms/items/push_token_claims/${claimId}`, { headers: H });\n  if (got.status === 404) return json({ done: true, reason: 'claim already handled' }, 200);\n  if (!got.ok) return json({ error: 'claim_read_failed', status: got.status }, 502); // non-2xx \u2192 another attempt (maxAttempts: 3)\n  const claim = ((await got.json()) as { data?: ClaimRow }).data;\n  const token = claim?.data.token;\n  const owner = claim?.data.end_user;\n  if (!token || !owner) {\n    await deleteItem(base, H, 'push_token_claims', claimId);\n    return json({ done: true, reason: 'empty claim dropped' }, 200);\n  }\n\n  const data = tokenData(token, owner, claim.data.platform, claim.data.locale);\n  const row = await findToken(base, H, token);\n  if (row === 'error') return json({ error: 'lookup_failed' }, 502); // non-2xx \u2192 another attempt (maxAttempts: 3)\n  let action: string;\n  if (!row) {\n    // The holder deleted it in the meantime: the claimant simply registers it.\n    const created = await fetch(`${base}/v1/cms/items/push_tokens`, {\n      method: 'POST', headers: H, body: JSON.stringify({ status: 'published', data }),\n    });\n    // 409 = it was registered again concurrently; the next delivery re-reads.\n    if (!created.ok) return json({ error: 'create_failed', status: created.status }, 502);\n    action = 'created';\n  } else {\n    const moved = await reown(base, H, row, data);\n    if (!moved.ok) return json({ error: 'reown_failed', status: moved.status }, 502); // another attempt re-reads (maxAttempts: 3)\n    action = row.data.end_user === owner ? 'refreshed' : 'reowned';\n  }\n  await deleteItem(base, H, 'push_token_claims', claimId);\n  return json({ done: true, action, claim_id: claimId }, 200);\n}\n\n// \u2500\u2500 webhook \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nasync function forgetUser(\n  base: string, H: Record<string, string>, env: WebhookFunctionEnvelope<{ user_id?: string; id?: string }>,\n): Promise<Response> {\n  const event = env.payload?.event;\n  const d = env.payload?.data;\n  const fields = d && !('truncated' in d) ? d : null;\n  // auth.user.erased carries `user_id`; the admin erase and delete carry `id`.\n  const userId = event === 'auth.user.erased' ? fields?.user_id\n    : event === 'user.erased' || event === 'user.deleted' ? fields?.id : undefined;\n  if (typeof userId !== 'string' || !userId) return json({ skipped: true, event }, 200);\n\n  let deleted = 0;\n  let failed = 0;\n  for (const coll of ['push_tokens', 'push_token_claims', 'push_prefs']) {\n    const filter = encodeURIComponent(JSON.stringify({ end_user: userId }));\n    while (deleted + failed < ERASE_MAX) {\n      // Always the FIRST page: what was deleted is gone, so the next read\n      // returns the next rows. A row that refuses to delete ends the loop.\n      const res = await fetch(`${base}/v1/cms/items/${coll}?filter=${filter}&limit=50`, { headers: H });\n      if (!res.ok) return json({ error: 'list_failed', status: res.status, deleted }, 502); // non-2xx \u2192 another attempt (maxAttempts: 3)\n      const items = ((await res.json()) as { data?: { items?: Array<{ item_id: string }> } }).data?.items ?? [];\n      if (items.length === 0) break;\n      let progress = 0;\n      for (const it of items) {\n        if (await deleteItem(base, H, coll, it.item_id)) { deleted++; progress++; } else failed++;\n      }\n      if (progress === 0) break;\n    }\n  }\n  // A failed delete \u2014 or a set larger than one attempt's ERASE_MAX \u2014 answers\n  // non-2xx: the binding declares maxAttempts: 3, so the jobs ladder hands it\n  // back for another attempt, which deletes the rest.\n  const unfinished = failed > 0 || deleted >= ERASE_MAX;\n  return json({ user_id: userId, deleted, failed, done: !unfinished }, unfinished ? 502 : 200);\n}\n\n// \u2500\u2500 helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nfunction tokenData(token: string, owner: string, platform: unknown, locale: unknown): Record<string, unknown> {\n  return {\n    token, end_user: owner, last_seen: new Date().toISOString(), failures: 0, last_error: '',\n    ...(typeof platform === 'string' && PLATFORMS.has(platform) ? { platform } : {}),\n    ...(typeof locale === 'string' && locale ? { locale: locale.slice(0, 16) } : {}),\n  };\n}\n\nfunction claimData(token: string, owner: string, platform: unknown, locale: unknown): Record<string, unknown> {\n  return {\n    token, end_user: owner,\n    ...(typeof platform === 'string' && PLATFORMS.has(platform) ? { platform } : {}),\n    ...(typeof locale === 'string' && locale ? { locale: locale.slice(0, 16) } : {}),\n  };\n}\n\nasync function findToken(base: string, H: Record<string, string>, token: string): Promise<TokenRow | null | 'error'> {\n  const filter = encodeURIComponent(JSON.stringify({ token }));\n  const found = await fetch(`${base}/v1/cms/items/push_tokens?filter=${filter}&limit=1`, { headers: H });\n  if (!found.ok) return 'error';\n  return ((await found.json()) as { data?: { items?: TokenRow[] } }).data?.items?.[0] ?? null;\n}\n\n/** \u2605 INVARIANT 2: re-own (or just refresh, when the owner is unchanged).\n *  If-Match makes the reassignment atomic against a concurrent registration. */\nfunction reown(base: string, H: Record<string, string>, row: TokenRow, data: Record<string, unknown>): Promise<Response> {\n  return fetch(`${base}/v1/cms/items/push_tokens/${row.item_id}`, {\n    method: 'PATCH',\n    headers: { ...H, ...(row.version !== undefined ? { 'if-match': String(row.version) } : {}) },\n    body: JSON.stringify({ data }),\n  });\n}\n\n/** true when the row is gone afterwards (a 404 counts: someone else deleted it). */\nasync function deleteItem(base: string, H: Record<string, string>, coll: string, itemId: string): Promise<boolean> {\n  const res = await fetch(`${base}/v1/cms/items/${coll}/${itemId}`, { method: 'DELETE', headers: H }).catch(() => null);\n  return !!res && (res.ok || res.status === 404);\n}\n\nconst json = (o: unknown, status: number) => Response.json(o, { status });\n",
-      "send-push.ts": "// send-push.ts \u2014 THE SENDER (a vxil function, two bindings).\n//\n//   http  POST /v1/fn/send-push \u2014 send now (below).\n//   cron  `0 * * * *` \u2014 THE REMINDER LADDER (further below).\n//\n// POST /v1/fn/send-push\n//   {\n//     \"user_ids\": [\"usr_a\", \"usr_b\"],\n//     \"messages\": {                       // keyed by locale; \"default\" is required\n//       \"default\": { \"title\": \"You're in\", \"body\": \"Pro is active on this device.\" },\n//       \"ar\":      { \"title\": \"\u062A\u0645 \u0627\u0644\u062A\u0641\u0639\u064A\u0644\", \"body\": \"\u0623\u0635\u0628\u062D \u0627\u0634\u062A\u0631\u0627\u0643 Pro \u0645\u0641\u0639\u0651\u0644\u0627\u064B.\" },\n//       \"fr\":      { \"title\": \"C'est actif\", \"body\": \"Pro est activ\xE9 sur cet appareil.\" }\n//     },\n//     \"data\": { \"screen\": \"billing\" }     // optional payload handed to your app\n//   }\n//\n// It resolves each user's live devices, picks the copy for THAT DEVICE'S locale\n// (captured at registration), and posts to the push service in batches.\n//\n// LOCALIZATION IS PER DEVICE, NOT PER USER. One person can carry an English\n// phone and an Arabic tablet. Because `locale` lives on the token row, the right\n// copy goes to each device with no extra lookup.\n//\n// Two failure kinds, handled differently:\n//   \u2022 an IMMEDIATE per-message error (`DeviceNotRegistered`) \u2014 the token is dead\n//     right now; delete the row.\n//   \u2022 an accepted message \u2014 the service returns a RECEIPT id, and the real\n//     verdict arrives later. Store the id (and when); `prune-receipts` collects it.\n//\n// \u2500\u2500 The reminder ladder (cron, hourly) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// Re-engagement for users who stopped opening the app: one nudge after 1 day\n// of inactivity, one after 3, one after 7 \u2014 then silence until they come back.\n// Per user, from `push_prefs` (the app writes its own row):\n//   \u2022 `reminders: false` \u2192 never;\n//   \u2022 quiet hours [quiet_start, quiet_end) in the user's `timezone` \u2192 not now\n//     (the next hourly tick after the window sends it);\n//   \u2022 `last_active` + `ladder_step` decide the step; the APP resets\n//     `ladder_step` to 0 when it comes to the foreground.\n// ONE nudge per tick at most, and never a catch-up burst: when several rungs\n// are due at once (a user already idle for a week when the ladder first sees\n// them \u2014 the kit added to a live app, reminders turned back on, a held cron),\n// only the HIGHEST due rung is sent and the steps below it are skipped. And a\n// rung waits its own gap after the previous nudge (`last_reminded_at`), so\n// 1 d \u2192 3 d \u2192 7 d stay 2 and 4 days apart even when a step went out late.\n// Each step is CLAIMED with If-Match on the prefs row BEFORE the send, so two\n// overlapping ticks can never send it twice (a send that then fails is a\n// missed nudge, never a duplicate one). The walk only reads users inactive for\n// at least the first step and not yet through the ladder (`ladder_step` below\n// its length \u2014 a `derive` hook writes 0 when the app leaves it out), and\n// resumes where the last tick stopped (the cursor lives in `push_state`), so\n// it covers any number of users over successive ticks: MAX_LADDER_ROWS read and\n// MAX_REMINDERS sent per tick. A skipped tick is harmless \u2014 the next resumes.\n\n// Expo's push endpoint. For raw FCM: 'https://fcm.googleapis.com/v1/projects/<id>/messages:send'\n// (and an OAuth bearer). For APNs: 'https://api.push.apple.com/3/device/<token>'\n// (one request per device, a JWT `authorization`, and an `apns-topic` header).\n// Whichever you pick, its HOST must be in the function's `egressAllow`.\n\n// cron-walk: persisted-cursor \u2014 the ladder walk's cursor lives in `push_state` and is saved with If-Match.\n\nimport type { CronFunctionEnvelope, HttpFunctionEnvelope } from '@vxil/sdk';\n\nconst PUSH_URL = 'https://exp.host/--/api/v2/push/send';\n/** Expo accepts up to 100 messages in one request. */\nconst BATCH = 100;\n/** cms page size \u2014 100 is the default `maxPageSize` for the cms feature. */\nconst PAGE = 100;\n/** Devices resolved per invocation \u2014 a guardrail, not a limit of the platform. */\nconst MAX_DEVICES = 1000;\n\n/** The ladder: hours of inactivity \u2192 the nudge, per locale ('default' required).\n *  Edit the copy; keep the hours ascending. */\nconst LADDER: ReadonlyArray<{ afterHours: number; messages: Messages }> = [\n  { afterHours: 24, messages: {\n    default: { title: 'Pick up where you left off', body: 'Your streak is waiting for you.' },\n    ar: { title: '\u0623\u0643\u0645\u0644 \u0645\u0646 \u062D\u064A\u062B \u062A\u0648\u0642\u0641\u062A', body: '\u0633\u0644\u0633\u0644\u062A\u0643 \u0628\u0627\u0646\u062A\u0638\u0627\u0631\u0643.' },\n  } },\n  { afterHours: 72, messages: {\n    default: { title: 'We saved your progress', body: 'It only takes a minute to get back on track.' },\n    ar: { title: '\u062D\u0641\u0638\u0646\u0627 \u062A\u0642\u062F\u0645\u0643', body: '\u062F\u0642\u064A\u0642\u0629 \u0648\u0627\u062D\u062F\u0629 \u062A\u0643\u0641\u064A \u0644\u0644\u0639\u0648\u062F\u0629.' },\n  } },\n  { afterHours: 168, messages: {\n    default: { title: 'Still there?', body: 'Here is what you missed this week.' },\n    ar: { title: '\u0647\u0644 \u0645\u0627 \u0632\u0644\u062A \u0647\u0646\u0627\u061F', body: '\u0625\u0644\u064A\u0643 \u0645\u0627 \u0641\u0627\u062A\u0643 \u0647\u0630\u0627 \u0627\u0644\u0623\u0633\u0628\u0648\u0639.' },\n  } },\n];\n/** `push_prefs` rows read per tick. */\nconst MAX_LADDER_ROWS = 2000;\n/** Users nudged per tick (each costs a claim PATCH, a device read and receipt PATCHes). */\nconst MAX_REMINDERS = 100;\n/** This cron's row in `push_state`. */\nconst LADDER_STATE_KEY = 'reminder-ladder';\n\ntype Copy = { title?: string; body?: string };\ntype Messages = Record<string, Copy>;\ntype Env = CronFunctionEnvelope | HttpFunctionEnvelope<{\n  user_ids?: string[];\n  messages?: Messages;\n  data?: Record<string, unknown>;\n}>;\ninterface TokenRow {\n  item_id: string;\n  version?: number;\n  data: { token?: string; end_user?: string; locale?: string; failures?: number };\n}\n/** One entry of Expo's response array, positionally matched to the request. */\ninterface Ticket { status?: string; id?: string; message?: string; details?: { error?: string } }\ninterface PrefRow {\n  item_id: string;\n  version?: number;\n  data: {\n    end_user?: string; timezone?: string; reminders?: boolean; quiet_start?: number; quiet_end?: number;\n    last_active?: string; ladder_step?: number; last_reminded_at?: string;\n  };\n}\ninterface StateRow { item_id: string; version?: number; data: { cursor?: string } }\n\nexport default {\n  async fetch(req: Request): Promise<Response> {\n    const env = (await req.json().catch(() => ({}))) as Env;\n    const base = env.vxil_base ?? 'https://api.vxil.com';\n    const cms = env.scoped_jwts?.cms;\n    if (!cms) return json({ error: 'missing cms scope' }, 403);\n    const H = { authorization: `Bearer ${cms}`, 'content-type': 'application/json' };\n    if (env.trigger === 'cron') return ladder(base, H);\n\n    const p = (env as Exclude<Env, CronFunctionEnvelope>).payload ?? {};\n    const userIds = Array.isArray(p.user_ids) ? p.user_ids.filter((u) => typeof u === 'string' && u) : [];\n    const messages = p.messages ?? {};\n    if (userIds.length === 0) return json({ error: 'user_ids is required' }, 400);\n    if (!messages.default?.title && !messages.default?.body) {\n      return json({ error: 'messages.default { title, body } is required' }, 400);\n    }\n    const devices = await resolveDevices(base, H, userIds);\n    if (devices.length === 0) return json({ sent: 0, devices: 0, note: 'no registered devices' }, 200);\n    const out = await sendTo(base, H, devices.map((d) => ({ device: d, messages })), p.data);\n    return json({ devices: devices.length, ...out }, 200);\n  },\n};\n\n/** \u2500\u2500 1. Resolve devices. One filtered read per user (owner-scoped by value,\n *  not by principal \u2014 this runs in server mode). */\nasync function resolveDevices(base: string, H: Record<string, string>, userIds: string[]): Promise<TokenRow[]> {\n  const devices: TokenRow[] = [];\n  for (const uid of userIds) {\n    if (devices.length >= MAX_DEVICES) break;\n    const filter = encodeURIComponent(JSON.stringify({ end_user: uid }));\n    const res = await fetch(`${base}/v1/cms/items/push_tokens?filter=${filter}&limit=50`, { headers: H });\n    if (!res.ok) continue;\n    const items = ((await res.json()) as { data?: { items?: TokenRow[] } }).data?.items ?? [];\n    for (const it of items) if (it.data.token) devices.push(it);\n  }\n  return devices;\n}\n\n/** \u2500\u2500 2 + 3. One message per device in that device's language; send in\n *  batches; reconcile each ticket back to its device by index. */\nasync function sendTo(\n  base: string, H: Record<string, string>,\n  targets: Array<{ device: TokenRow; messages: Messages }>, data?: Record<string, unknown>,\n): Promise<{ accepted: number; dropped: number; errors: string[] }> {\n  const outgoing = targets.map(({ device, messages }) => {\n    const copy = pick(messages, device.data.locale);\n    return {\n      to: device.data.token!,\n      ...(copy.title ? { title: copy.title } : {}),\n      ...(copy.body ? { body: copy.body } : {}),\n      ...(data ? { data } : {}),\n      sound: 'default',\n    };\n  });\n  let accepted = 0;\n  let dropped = 0;\n  const errors: string[] = [];\n  for (let i = 0; i < outgoing.length; i += BATCH) {\n    const slice = outgoing.slice(i, i + BATCH);\n    const res = await fetch(PUSH_URL, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json', accept: 'application/json' },\n      body: JSON.stringify(slice),\n    }).catch(() => null);\n    if (!res || !res.ok) {\n      errors.push(`push service returned ${res?.status ?? 'network error'} for batch ${i / BATCH}`);\n      continue;\n    }\n    const tickets = (((await res.json().catch(() => ({}))) as { data?: Ticket[] }).data) ?? [];\n    for (let k = 0; k < slice.length; k++) {\n      const device = targets[i + k]!.device;\n      const ticket = tickets[k];\n      if (ticket?.status === 'ok' && ticket.id) {\n        // Accepted, verdict pending. Park the receipt id (and when) for prune-receipts.\n        accepted++;\n        await patch(base, H, device, { receipt_id: ticket.id, receipt_at: new Date().toISOString(), failures: 0, last_error: '' });\n        continue;\n      }\n      const reason = ticket?.details?.error ?? ticket?.message ?? 'unknown';\n      if (reason === 'DeviceNotRegistered') {\n        // Definitive: this token will never deliver again. \u2605 INVARIANT 3.\n        await del(base, H, device);\n        dropped++;\n        continue;\n      }\n      // Anything else (MessageTooBig, MessageRateExceeded, a transient fault)\n      // is NOT a reason to delete a device. Count it and move on.\n      await patch(base, H, device, {\n        failures: (device.data.failures ?? 0) + 1,\n        last_error: String(reason).slice(0, 300),\n      });\n      errors.push(reason);\n    }\n  }\n  return { accepted, dropped, errors: errors.slice(0, 10) };\n}\n\n// \u2500\u2500 The reminder ladder \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nasync function ladder(base: string, H: Record<string, string>): Promise<Response> {\n  const now = new Date();\n  const state = await readState(base, H, LADDER_STATE_KEY);\n  if (state === 'error') return json({ error: 'state_read_failed' }, 502);\n  const startedAt = state?.data.cursor || null;\n  // Only users idle for at least the first step, with a rung still ahead of\n  // them, can be due: both terms ride slot indexes (`last_active` t1,\n  // `ladder_step` n1), so active users and finished ladders are never read.\n  const idleSince = new Date(now.getTime() - LADDER[0]!.afterHours * 3_600_000).toISOString();\n  const filter = encodeURIComponent(JSON.stringify({\n    last_active: { $lt: idleSince }, ladder_step: { $lt: LADDER.length },\n  }));\n\n  const due: Array<{ row: PrefRow; step: number }> = [];\n  let cursor: string | null = startedAt;\n  let scanned = 0;\n  let wrapped = false;\n  let quiet = 0;\n  scan: while (scanned < MAX_LADDER_ROWS) {\n    const res = await fetch(`${base}/v1/cms/items/push_prefs?filter=${filter}&limit=${PAGE}`\n      + (cursor ? `&cursor=${encodeURIComponent(cursor)}` : ''), { headers: H });\n    if (!res.ok) return json({ error: 'list_failed', status: res.status }, 502);\n    const body = (await res.json()) as { data?: { items?: PrefRow[]; next_cursor?: string | null } };\n    const items = body.data?.items ?? [];\n    for (const it of items) {\n      scanned++;\n      cursor = it.item_id;\n      const step = dueStep(it.data, now);\n      if (step !== null) {\n        if (inQuietHours(it.data, now)) quiet++; // left for a later tick: the cursor wraps back to it\n        else due.push({ row: it, step });\n      }\n      if (due.length >= MAX_REMINDERS || scanned >= MAX_LADDER_ROWS) break scan;\n    }\n    if (!body.data?.next_cursor || items.length === 0) { wrapped = true; break; }\n    cursor = body.data.next_cursor;\n  }\n  const nextCursor = wrapped ? '' : (cursor ?? '');\n\n  // Claim each step FIRST (If-Match): a concurrent tick that claimed it wins,\n  // and this one skips the user \u2014 never a double nudge.\n  const targets: Array<{ device: TokenRow; messages: Messages }> = [];\n  let claimed = 0;\n  for (const { row, step } of due) {\n    const res = await fetch(`${base}/v1/cms/items/push_prefs/${row.item_id}`, {\n      method: 'PATCH',\n      headers: { ...H, ...(row.version !== undefined ? { 'if-match': String(row.version) } : {}) },\n      body: JSON.stringify({ data: { ladder_step: step + 1, last_reminded_at: now.toISOString() } }),\n    }).catch(() => null);\n    if (!res || !res.ok) continue;\n    claimed++;\n    for (const device of await resolveDevices(base, H, [row.data.end_user!])) {\n      targets.push({ device, messages: LADDER[step]!.messages });\n    }\n  }\n  const sent = targets.length > 0\n    ? await sendTo(base, H, targets, { reason: 'reminder' })\n    : { accepted: 0, dropped: 0, errors: [] as string[] };\n  const saved = await writeState(base, H, LADDER_STATE_KEY, state, nextCursor);\n  return json({\n    ladder: true, scanned, due: due.length, quiet, claimed, devices: targets.length, ...sent,\n    resumed_from: startedAt, cursor: nextCursor, wrapped, saved,\n  }, 200);\n}\n\n/** The ladder step due for this user now, or null. Exported for tests.\n *  The HIGHEST rung whose idle threshold is met (the claim then moves\n *  `ladder_step` past it, so the rungs below are skipped, never sent late), and\n *  only once that rung's gap since the previous nudge has passed. */\nexport function dueStep(p: PrefRow['data'], now: Date): number | null {\n  if (p.reminders === false || !p.end_user || !p.last_active) return null;\n  const idleH = (now.getTime() - Date.parse(p.last_active)) / 3_600_000;\n  if (!Number.isFinite(idleH)) return null;\n  const from = Math.max(0, Math.trunc(p.ladder_step ?? 0));\n  let step: number | null = null;\n  for (let r = from; r < LADDER.length; r++) if (idleH >= LADDER[r]!.afterHours) step = r;\n  if (step === null) return null;\n  if (step > 0 && p.last_reminded_at) {\n    const sinceH = (now.getTime() - Date.parse(p.last_reminded_at)) / 3_600_000;\n    const gapH = LADDER[step]!.afterHours - LADDER[step - 1]!.afterHours;\n    if (Number.isFinite(sinceH) && sinceH < gapH) return null;\n  }\n  return step;\n}\n\n/** Is it inside the user's quiet hours [quiet_start, quiet_end) in THEIR zone?\n *  The window may wrap midnight; equal or missing bounds mean none. An unknown\n *  zone is evaluated in UTC. Exported for tests. */\nexport function inQuietHours(p: PrefRow['data'], now: Date): boolean {\n  const start = p.quiet_start;\n  const end = p.quiet_end;\n  if (typeof start !== 'number' || typeof end !== 'number' || start === end) return false;\n  const h = localHour(now, p.timezone);\n  return start < end ? h >= start && h < end : h >= start || h < end;\n}\n\n/** One formatter per zone, kept for the isolate's life: building an Intl formatter is the\n *  expensive part, and a tick can test hundreds of users in the same few zones\n *  (CPU per invocation is capped \u2014 2,000 ms on a Free staging/development project, 50 ms on a Free dev slot). */\nconst ZONE_FMT = new Map<string, Intl.DateTimeFormat | null>();\nfunction zoneFormatter(tz: string): Intl.DateTimeFormat | null {\n  if (!ZONE_FMT.has(tz)) {\n    let f: Intl.DateTimeFormat | null = null;\n    try { f = new Intl.DateTimeFormat('en-US', { timeZone: tz, hour: 'numeric', hourCycle: 'h23' }); } catch { /* unknown zone */ }\n    if (ZONE_FMT.size < 500) ZONE_FMT.set(tz, f);\n    return f;\n  }\n  return ZONE_FMT.get(tz)!;\n}\n\nfunction localHour(now: Date, tz: string | undefined): number {\n  try {\n    const part = zoneFormatter(tz || 'UTC')?.formatToParts(now).find((x) => x.type === 'hour');\n    const h = Number(part?.value);\n    if (Number.isInteger(h)) return h % 24;\n  } catch { /* unknown zone \u2192 UTC below */ }\n  return now.getUTCHours();\n}\n\nasync function readState(base: string, H: Record<string, string>, key: string): Promise<StateRow | null | 'error'> {\n  const filter = encodeURIComponent(JSON.stringify({ key }));\n  const res = await fetch(`${base}/v1/cms/items/push_state?filter=${filter}&limit=1`, { headers: H });\n  if (!res.ok) return 'error';\n  return ((await res.json()) as { data?: { items?: StateRow[] } }).data?.items?.[0] ?? null;\n}\n\nasync function writeState(\n  base: string, H: Record<string, string>, key: string, state: StateRow | null, cursor: string,\n): Promise<boolean> {\n  const data = { key, cursor, updated_at: new Date().toISOString() };\n  const res = state\n    ? await fetch(`${base}/v1/cms/items/push_state/${state.item_id}`, {\n      method: 'PATCH',\n      headers: { ...H, ...(state.version !== undefined ? { 'if-match': String(state.version) } : {}) },\n      body: JSON.stringify({ data }),\n    }).catch(() => null)\n    : await fetch(`${base}/v1/cms/items/push_state`, {\n      method: 'POST', headers: H, body: JSON.stringify({ status: 'published', data }),\n    }).catch(() => null);\n  return !!res && res.ok;\n}\n\n/** Locale match: exact ('pt-BR'), then the base language ('pt'), then default. */\nfunction pick(messages: Messages, locale: string | undefined): Copy {\n  if (locale) {\n    if (messages[locale]) return messages[locale]!;\n    const bare = locale.split('-')[0]!;\n    if (messages[bare]) return messages[bare]!;\n  }\n  return messages.default ?? {};\n}\n\nasync function patch(base: string, H: Record<string, string>, d: TokenRow, data: Record<string, unknown>) {\n  await fetch(`${base}/v1/cms/items/push_tokens/${d.item_id}`, {\n    method: 'PATCH', headers: H, body: JSON.stringify({ data }),\n  }).catch(() => null);\n}\nasync function del(base: string, H: Record<string, string>, d: TokenRow) {\n  await fetch(`${base}/v1/cms/items/push_tokens/${d.item_id}`, { method: 'DELETE', headers: H }).catch(() => null);\n}\nconst json = (o: unknown, status: number) => Response.json(o, { status });\n"
+      "send-push.ts": "// send-push.ts \u2014 THE SENDER (a vxil function, two bindings).\n//\n//   http  POST /v1/fn/send-push \u2014 send now (below).\n//   cron  `0 * * * *` \u2014 THE REMINDER LADDER (further below).\n//\n// POST /v1/fn/send-push\n//   {\n//     \"user_ids\": [\"usr_a\", \"usr_b\"],\n//     \"messages\": {                       // keyed by locale; \"default\" is required\n//       \"default\": { \"title\": \"You're in\", \"body\": \"Pro is active on this device.\" },\n//       \"ar\":      { \"title\": \"\u062A\u0645 \u0627\u0644\u062A\u0641\u0639\u064A\u0644\", \"body\": \"\u0623\u0635\u0628\u062D \u0627\u0634\u062A\u0631\u0627\u0643 Pro \u0645\u0641\u0639\u0651\u0644\u0627\u064B.\" },\n//       \"fr\":      { \"title\": \"C'est actif\", \"body\": \"Pro est activ\xE9 sur cet appareil.\" }\n//     },\n//     \"data\": { \"screen\": \"billing\" }     // optional payload handed to your app\n//   }\n//\n// It resolves each user's live devices, picks the copy for THAT DEVICE'S locale\n// (captured at registration), and posts to the push service in batches.\n//\n// LOCALIZATION IS PER DEVICE, NOT PER USER. One person can carry an English\n// phone and an Arabic tablet. Because `locale` lives on the token row, the right\n// copy goes to each device with no extra lookup.\n//\n// Two failure kinds, handled differently:\n//   \u2022 an IMMEDIATE per-message error (`DeviceNotRegistered`) \u2014 the token is dead\n//     right now; delete the row.\n//   \u2022 an accepted message \u2014 the service returns a RECEIPT id, and the real\n//     verdict arrives later. Store the id (and when); `prune-receipts` collects it.\n//\n// \u2500\u2500 The reminder ladder (cron, hourly) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// Re-engagement for users who stopped opening the app: one nudge after 1 day\n// of inactivity, one after 3, one after 7 \u2014 then silence until they come back.\n// Per user, from `push_prefs` (the app writes its own row):\n//   \u2022 `reminders: false` \u2192 never;\n//   \u2022 quiet hours [quiet_start, quiet_end) in the user's `timezone` \u2192 not now\n//     (the next hourly tick after the window sends it);\n//   \u2022 `last_active` + `ladder_step` decide the step; the APP resets\n//     `ladder_step` to 0 when it comes to the foreground.\n// ONE nudge per tick at most, and never a catch-up burst: when several rungs\n// are due at once (a user already idle for a week when the ladder first sees\n// them \u2014 the kit added to a live app, reminders turned back on, a held cron),\n// only the HIGHEST due rung is sent and the steps below it are skipped. And a\n// rung waits its own gap after the previous nudge (`last_reminded_at`), so\n// 1 d \u2192 3 d \u2192 7 d stay 2 and 4 days apart even when a step went out late.\n// Each step is CLAIMED with If-Match on the prefs row BEFORE the send, so two\n// overlapping ticks can never send it twice (a send that then fails is a\n// missed nudge, never a duplicate one). The walk only reads users inactive for\n// at least the first step and not yet through the ladder (`ladder_step` below\n// its length \u2014 a `derive` hook writes 0 when the app leaves it out), and\n// resumes where the last tick stopped (the cursor lives in `push_state`), so\n// it covers any number of users over successive ticks: MAX_LADDER_ROWS read and\n// MAX_REMINDERS sent per tick. A skipped tick is harmless \u2014 the next resumes.\n\n// Expo's push endpoint. For raw FCM: 'https://fcm.googleapis.com/v1/projects/<id>/messages:send'\n// (and an OAuth bearer). For APNs: 'https://api.push.apple.com/3/device/<token>'\n// (one request per device, a JWT `authorization`, and an `apns-topic` header).\n// Whichever you pick, its HOST must be in the function's `egressAllow`.\n\n// cron-walk: persisted-cursor \u2014 the ladder walk's cursor lives in `push_state` and is saved with If-Match.\n\nimport type { CronFunctionEnvelope, HttpFunctionEnvelope } from '@vxil/sdk';\n\nconst PUSH_URL = 'https://exp.host/--/api/v2/push/send';\n/** Expo accepts up to 100 messages in one request. */\nconst BATCH = 100;\n/** cms page size \u2014 100 is the default `maxPageSize` for the cms feature. */\nconst PAGE = 100;\n/** Devices resolved per invocation \u2014 a guardrail, not a limit of the platform. */\nconst MAX_DEVICES = 1000;\n\n/** The ladder: hours of inactivity \u2192 the nudge, per locale ('default' required).\n *  Edit the copy; keep the hours ascending. */\nconst LADDER: ReadonlyArray<{ afterHours: number; messages: Messages }> = [\n  { afterHours: 24, messages: {\n    default: { title: 'Pick up where you left off', body: 'Your streak is waiting for you.' },\n    ar: { title: '\u0623\u0643\u0645\u0644 \u0645\u0646 \u062D\u064A\u062B \u062A\u0648\u0642\u0641\u062A', body: '\u0633\u0644\u0633\u0644\u062A\u0643 \u0628\u0627\u0646\u062A\u0638\u0627\u0631\u0643.' },\n  } },\n  { afterHours: 72, messages: {\n    default: { title: 'We saved your progress', body: 'It only takes a minute to get back on track.' },\n    ar: { title: '\u062D\u0641\u0638\u0646\u0627 \u062A\u0642\u062F\u0645\u0643', body: '\u062F\u0642\u064A\u0642\u0629 \u0648\u0627\u062D\u062F\u0629 \u062A\u0643\u0641\u064A \u0644\u0644\u0639\u0648\u062F\u0629.' },\n  } },\n  { afterHours: 168, messages: {\n    default: { title: 'Still there?', body: 'Here is what you missed this week.' },\n    ar: { title: '\u0647\u0644 \u0645\u0627 \u0632\u0644\u062A \u0647\u0646\u0627\u061F', body: '\u0625\u0644\u064A\u0643 \u0645\u0627 \u0641\u0627\u062A\u0643 \u0647\u0630\u0627 \u0627\u0644\u0623\u0633\u0628\u0648\u0639.' },\n  } },\n];\n/** `push_prefs` rows read per tick. */\nconst MAX_LADDER_ROWS = 2000;\n/** Users nudged per tick (each costs a claim PATCH, a device read and receipt PATCHes). */\nconst MAX_REMINDERS = 100;\n/** This cron's row in `push_state`. */\nconst LADDER_STATE_KEY = 'reminder-ladder';\n\ntype Copy = { title?: string; body?: string };\ntype Messages = Record<string, Copy>;\ntype Env = CronFunctionEnvelope | HttpFunctionEnvelope<{\n  user_ids?: string[];\n  messages?: Messages;\n  data?: Record<string, unknown>;\n}>;\ninterface TokenRow {\n  item_id: string;\n  version?: number;\n  data: { token?: string; end_user?: string; locale?: string; failures?: number };\n}\n/** One entry of Expo's response array, positionally matched to the request. */\ninterface Ticket { status?: string; id?: string; message?: string; details?: { error?: string } }\ninterface PrefRow {\n  item_id: string;\n  version?: number;\n  data: {\n    end_user?: string; timezone?: string; reminders?: boolean; quiet_start?: number; quiet_end?: number;\n    last_active?: string; ladder_step?: number; last_reminded_at?: string;\n  };\n}\ninterface StateRow { item_id: string; version?: number; data: { cursor?: string } }\n\nexport default {\n  async fetch(req: Request): Promise<Response> {\n    const env = (await req.json().catch(() => ({}))) as Env;\n    const base = env.vxil_base ?? 'https://api.vxil.com';\n    const cms = env.scoped_jwts?.cms;\n    if (!cms) return json({ error: 'missing cms scope' }, 403);\n    const H = { authorization: `Bearer ${cms}`, 'content-type': 'application/json' };\n    if (env.trigger === 'cron') return ladder(base, H);\n\n    const p = (env as Exclude<Env, CronFunctionEnvelope>).payload ?? {};\n    const userIds = Array.isArray(p.user_ids) ? p.user_ids.filter((u) => typeof u === 'string' && u) : [];\n    const messages = p.messages ?? {};\n    if (userIds.length === 0) return json({ error: 'user_ids is required' }, 400);\n    if (!messages.default?.title && !messages.default?.body) {\n      return json({ error: 'messages.default { title, body } is required' }, 400);\n    }\n    const devices = await resolveDevices(base, H, userIds);\n    if (devices.length === 0) return json({ sent: 0, devices: 0, note: 'no registered devices' }, 200);\n    const out = await sendTo(base, H, devices.map((d) => ({ device: d, messages })), p.data);\n    return json({ devices: devices.length, ...out }, 200);\n  },\n};\n\n/** \u2500\u2500 1. Resolve devices. One filtered read per user (owner-scoped by value,\n *  not by principal \u2014 this runs in server mode). */\nasync function resolveDevices(base: string, H: Record<string, string>, userIds: string[]): Promise<TokenRow[]> {\n  const devices: TokenRow[] = [];\n  for (const uid of userIds) {\n    if (devices.length >= MAX_DEVICES) break;\n    const filter = encodeURIComponent(JSON.stringify({ end_user: uid }));\n    const res = await fetch(`${base}/v1/cms/items/push_tokens?filter=${filter}&limit=50`, { headers: H });\n    if (!res.ok) continue;\n    const items = ((await res.json()) as { data?: { items?: TokenRow[] } }).data?.items ?? [];\n    for (const it of items) if (it.data.token) devices.push(it);\n  }\n  return devices;\n}\n\n/** \u2500\u2500 2 + 3. One message per device in that device's language; send in\n *  batches; reconcile each ticket back to its device by index. */\nasync function sendTo(\n  base: string, H: Record<string, string>,\n  targets: Array<{ device: TokenRow; messages: Messages }>, data?: Record<string, unknown>,\n): Promise<{ accepted: number; dropped: number; errors: string[] }> {\n  const outgoing = targets.map(({ device, messages }) => {\n    const copy = pick(messages, device.data.locale);\n    return {\n      to: device.data.token!,\n      ...(copy.title ? { title: copy.title } : {}),\n      ...(copy.body ? { body: copy.body } : {}),\n      ...(data ? { data } : {}),\n      sound: 'default',\n    };\n  });\n  let accepted = 0;\n  let dropped = 0;\n  const errors: string[] = [];\n  for (let i = 0; i < outgoing.length; i += BATCH) {\n    const slice = outgoing.slice(i, i + BATCH);\n    const res = await fetch(PUSH_URL, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json', accept: 'application/json' },\n      body: JSON.stringify(slice),\n    }).catch(() => null);\n    if (!res || !res.ok) {\n      errors.push(`push service returned ${res?.status ?? 'network error'} for batch ${i / BATCH}`);\n      continue;\n    }\n    const tickets = (((await res.json().catch(() => ({}))) as { data?: Ticket[] }).data) ?? [];\n    for (let k = 0; k < slice.length; k++) {\n      const device = targets[i + k]!.device;\n      const ticket = tickets[k];\n      if (ticket?.status === 'ok' && ticket.id) {\n        // Accepted, verdict pending. Park the receipt id (and when) for prune-receipts.\n        accepted++;\n        await patch(base, H, device, { receipt_id: ticket.id, receipt_at: new Date().toISOString(), failures: 0, last_error: '' });\n        continue;\n      }\n      const reason = ticket?.details?.error ?? ticket?.message ?? 'unknown';\n      if (reason === 'DeviceNotRegistered') {\n        // Definitive: this token will never deliver again. \u2605 INVARIANT 3.\n        await del(base, H, device);\n        dropped++;\n        continue;\n      }\n      // Anything else (MessageTooBig, MessageRateExceeded, a transient fault)\n      // is NOT a reason to delete a device. Count it and move on.\n      await patch(base, H, device, {\n        failures: (device.data.failures ?? 0) + 1,\n        last_error: String(reason).slice(0, 300),\n      });\n      errors.push(reason);\n    }\n  }\n  return { accepted, dropped, errors: errors.slice(0, 10) };\n}\n\n// \u2500\u2500 The reminder ladder \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nasync function ladder(base: string, H: Record<string, string>): Promise<Response> {\n  const now = new Date();\n  const state = await readState(base, H, LADDER_STATE_KEY);\n  if (state === 'error') return json({ error: 'state_read_failed' }, 502);\n  const startedAt = state?.data.cursor || null;\n  // Only users idle for at least the first step, with a rung still ahead of\n  // them, can be due: both terms ride slot indexes (`last_active` t1,\n  // `ladder_step` n1), so active users and finished ladders are never read.\n  const idleSince = new Date(now.getTime() - LADDER[0]!.afterHours * 3_600_000).toISOString();\n  const filter = encodeURIComponent(JSON.stringify({\n    last_active: { $lt: idleSince }, ladder_step: { $lt: LADDER.length },\n  }));\n\n  const due: Array<{ row: PrefRow; step: number }> = [];\n  let cursor: string | null = startedAt;\n  let scanned = 0;\n  let wrapped = false;\n  let quiet = 0;\n  scan: while (scanned < MAX_LADDER_ROWS) {\n    const res = await fetch(`${base}/v1/cms/items/push_prefs?filter=${filter}&limit=${PAGE}`\n      + (cursor ? `&cursor=${encodeURIComponent(cursor)}` : ''), { headers: H });\n    if (!res.ok) return json({ error: 'list_failed', status: res.status }, 502);\n    const body = (await res.json()) as { data?: { items?: PrefRow[]; next_cursor?: string | null } };\n    const items = body.data?.items ?? [];\n    for (const it of items) {\n      scanned++;\n      cursor = it.item_id;\n      const step = dueStep(it.data, now);\n      if (step !== null) {\n        if (inQuietHours(it.data, now)) quiet++; // left for a later tick: the cursor wraps back to it\n        else due.push({ row: it, step });\n      }\n      if (due.length >= MAX_REMINDERS || scanned >= MAX_LADDER_ROWS) break scan;\n    }\n    if (!body.data?.next_cursor || items.length === 0) { wrapped = true; break; }\n    cursor = body.data.next_cursor;\n  }\n  const nextCursor = wrapped ? '' : (cursor ?? '');\n\n  // Claim each step FIRST (If-Match): a concurrent tick that claimed it wins,\n  // and this one skips the user \u2014 never a double nudge.\n  const targets: Array<{ device: TokenRow; messages: Messages }> = [];\n  let claimed = 0;\n  for (const { row, step } of due) {\n    const res = await fetch(`${base}/v1/cms/items/push_prefs/${row.item_id}`, {\n      method: 'PATCH',\n      headers: { ...H, ...(row.version !== undefined ? { 'if-match': String(row.version) } : {}) },\n      body: JSON.stringify({ data: { ladder_step: step + 1, last_reminded_at: now.toISOString() } }),\n    }).catch(() => null);\n    if (!res || !res.ok) continue;\n    claimed++;\n    for (const device of await resolveDevices(base, H, [row.data.end_user!])) {\n      targets.push({ device, messages: LADDER[step]!.messages });\n    }\n  }\n  const sent = targets.length > 0\n    ? await sendTo(base, H, targets, { reason: 'reminder' })\n    : { accepted: 0, dropped: 0, errors: [] as string[] };\n  const saved = await writeState(base, H, LADDER_STATE_KEY, state, nextCursor);\n  return json({\n    ladder: true, scanned, due: due.length, quiet, claimed, devices: targets.length, ...sent,\n    resumed_from: startedAt, cursor: nextCursor, wrapped, saved,\n  }, 200);\n}\n\n/** The ladder step due for this user now, or null. Exported for tests.\n *  The HIGHEST rung whose idle threshold is met (the claim then moves\n *  `ladder_step` past it, so the rungs below are skipped, never sent late), and\n *  only once that rung's gap since the previous nudge has passed. */\nexport function dueStep(p: PrefRow['data'], now: Date): number | null {\n  if (p.reminders === false || !p.end_user || !p.last_active) return null;\n  const idleH = (now.getTime() - Date.parse(p.last_active)) / 3_600_000;\n  if (!Number.isFinite(idleH)) return null;\n  const from = Math.max(0, Math.trunc(p.ladder_step ?? 0));\n  let step: number | null = null;\n  for (let r = from; r < LADDER.length; r++) if (idleH >= LADDER[r]!.afterHours) step = r;\n  if (step === null) return null;\n  if (step > 0 && p.last_reminded_at) {\n    const sinceH = (now.getTime() - Date.parse(p.last_reminded_at)) / 3_600_000;\n    const gapH = LADDER[step]!.afterHours - LADDER[step - 1]!.afterHours;\n    if (Number.isFinite(sinceH) && sinceH < gapH) return null;\n  }\n  return step;\n}\n\n/** Is it inside the user's quiet hours [quiet_start, quiet_end) in THEIR zone?\n *  The window may wrap midnight; equal or missing bounds mean none. An unknown\n *  zone is evaluated in UTC. Exported for tests. */\nexport function inQuietHours(p: PrefRow['data'], now: Date): boolean {\n  const start = p.quiet_start;\n  const end = p.quiet_end;\n  if (typeof start !== 'number' || typeof end !== 'number' || start === end) return false;\n  const h = localHour(now, p.timezone);\n  return start < end ? h >= start && h < end : h >= start || h < end;\n}\n\n/** One formatter per zone, kept for the isolate's life: building an Intl formatter is the\n *  expensive part, and a tick can test hundreds of users in the same few zones\n *  (CPU per invocation is capped \u2014 2,000 ms on a Free staging/development project; on a dev slot 50 ms unless the function declares limits.cpuMs, up to 2,000; both within a 500,000 CPU-ms daily budget). */\nconst ZONE_FMT = new Map<string, Intl.DateTimeFormat | null>();\nfunction zoneFormatter(tz: string): Intl.DateTimeFormat | null {\n  if (!ZONE_FMT.has(tz)) {\n    let f: Intl.DateTimeFormat | null = null;\n    try { f = new Intl.DateTimeFormat('en-US', { timeZone: tz, hour: 'numeric', hourCycle: 'h23' }); } catch { /* unknown zone */ }\n    if (ZONE_FMT.size < 500) ZONE_FMT.set(tz, f);\n    return f;\n  }\n  return ZONE_FMT.get(tz)!;\n}\n\nfunction localHour(now: Date, tz: string | undefined): number {\n  try {\n    const part = zoneFormatter(tz || 'UTC')?.formatToParts(now).find((x) => x.type === 'hour');\n    const h = Number(part?.value);\n    if (Number.isInteger(h)) return h % 24;\n  } catch { /* unknown zone \u2192 UTC below */ }\n  return now.getUTCHours();\n}\n\nasync function readState(base: string, H: Record<string, string>, key: string): Promise<StateRow | null | 'error'> {\n  const filter = encodeURIComponent(JSON.stringify({ key }));\n  const res = await fetch(`${base}/v1/cms/items/push_state?filter=${filter}&limit=1`, { headers: H });\n  if (!res.ok) return 'error';\n  return ((await res.json()) as { data?: { items?: StateRow[] } }).data?.items?.[0] ?? null;\n}\n\nasync function writeState(\n  base: string, H: Record<string, string>, key: string, state: StateRow | null, cursor: string,\n): Promise<boolean> {\n  const data = { key, cursor, updated_at: new Date().toISOString() };\n  const res = state\n    ? await fetch(`${base}/v1/cms/items/push_state/${state.item_id}`, {\n      method: 'PATCH',\n      headers: { ...H, ...(state.version !== undefined ? { 'if-match': String(state.version) } : {}) },\n      body: JSON.stringify({ data }),\n    }).catch(() => null)\n    : await fetch(`${base}/v1/cms/items/push_state`, {\n      method: 'POST', headers: H, body: JSON.stringify({ status: 'published', data }),\n    }).catch(() => null);\n  return !!res && res.ok;\n}\n\n/** Locale match: exact ('pt-BR'), then the base language ('pt'), then default. */\nfunction pick(messages: Messages, locale: string | undefined): Copy {\n  if (locale) {\n    if (messages[locale]) return messages[locale]!;\n    const bare = locale.split('-')[0]!;\n    if (messages[bare]) return messages[bare]!;\n  }\n  return messages.default ?? {};\n}\n\nasync function patch(base: string, H: Record<string, string>, d: TokenRow, data: Record<string, unknown>) {\n  await fetch(`${base}/v1/cms/items/push_tokens/${d.item_id}`, {\n    method: 'PATCH', headers: H, body: JSON.stringify({ data }),\n  }).catch(() => null);\n}\nasync function del(base: string, H: Record<string, string>, d: TokenRow) {\n  await fetch(`${base}/v1/cms/items/push_tokens/${d.item_id}`, { method: 'DELETE', headers: H }).catch(() => null);\n}\nconst json = (o: unknown, status: number) => Response.json(o, { status });\n"
     }
   },
   {
@@ -21040,6 +21610,9 @@ function quoteIdent2(name) {
   if (!IDENT_RE2.test(name)) throw new Error(`unsafe identifier '${name}' \u2014 only [A-Za-z_][A-Za-z0-9_]* is readable`);
   return `"${name}"`;
 }
+function parseTimestampNoTz(text) {
+  return /* @__PURE__ */ new Date(`${text.replace(" ", "T")}Z`);
+}
 function redactSourceUrl(url) {
   try {
     const u = new URL(url);
@@ -21292,6 +21865,10 @@ var GenericPgAdapter = class {
       // transaction-pooler (pgbouncer/supavisor) compatible
       onnotice: () => {
       },
+      // timestamp-without-tz read as UTC (the session only ever reads).
+      types: {
+        timestampNoTz: { to: 1114, from: [1114], parse: parseTimestampNoTz, serialize: (d) => d.toISOString() }
+      },
       connection: {
         application_name: "vxil-migrate",
         // startup-parameter copies of the session SETs — they survive driver
@@ -21608,6 +22185,25 @@ var supabaseSql = {
       params: after !== null ? [after] : []
     };
   },
+  /** auth.identities column NAMES (GoTrue added `provider_id` in 2023; older
+   *  projects kept the provider subject in `id`). */
+  identitiesColumns: () => ({
+    text: `
+      SELECT a.attname AS column_name
+      FROM pg_attribute a
+      JOIN pg_class c ON c.oid = a.attrelid
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = 'auth' AND c.relname = 'identities'
+        AND a.attnum > 0 AND NOT a.attisdropped`,
+    params: []
+  }),
+  /** MIGRATE-OAUTH-IDENTITIES: the social links of ONE credentials page —
+   *  provider + the provider's subject only (never identity_data, never a
+   *  token), the four providers vxil links by subject. */
+  identitiesFor: (userIds, subjectColumn) => ({
+    text: `SELECT user_id::text AS user_id, provider, ${subjectColumn}::text AS subject FROM auth.identities WHERE user_id = ANY($1::uuid[]) AND provider IN ('google', 'apple', 'github', 'facebook') ORDER BY user_id, provider, ${subjectColumn}`,
+    params: [userIds]
+  }),
   /** does this database carry the Storage schema? */
   storageProbe: () => ({
     text: `SELECT to_regclass('storage.buckets') IS NOT NULL AS present`,
@@ -21700,17 +22296,36 @@ var SupabaseAdapter = class extends GenericPgAdapter {
   }
   /** Credential pages (supabaseSql.credentialsPage). The rows hold bcrypt
    *  hashes: never logged, never written anywhere but the import request. */
-  async *readCredentials(cursor) {
+  async *readCredentials(cursor, opts = {}) {
     const source = await this.introspect();
     if (!source.authUsers?.present) throw new Error("auth.users not present on this source");
     const cols = source.authUsers.columns ?? [];
     if (!cols.includes("encrypted_password")) throw new Error("auth.users has no encrypted_password column \u2014 nothing to import");
+    let subjectColumn = null;
+    if (opts.identities) {
+      const icols = (await this.q(supabaseSql.identitiesColumns())).map((r) => r.column_name);
+      if (!icols.includes("user_id") || !icols.includes("provider")) {
+        throw new Error("auth.identities not found on this source \u2014 drop --with-oauth-identities");
+      }
+      subjectColumn = icols.includes("provider_id") ? "provider_id" : "id";
+    }
     let after = cursor !== void 0 && cursor !== "" ? cursor : null;
     for (; ; ) {
       const rows = await this.q(supabaseSql.credentialsPage(after, this.batchSize, cols.includes("deleted_at")));
+      const links = /* @__PURE__ */ new Map();
+      if (subjectColumn !== null && rows.length > 0) {
+        for (const r of await this.q(supabaseSql.identitiesFor(rows.map((x) => String(x.id)), subjectColumn))) {
+          if (typeof r.subject !== "string" || r.subject === "") continue;
+          const list = links.get(String(r.user_id)) ?? [];
+          list.push({ provider: String(r.provider), subject: r.subject });
+          links.set(String(r.user_id), list);
+        }
+      }
       const out = rows.map((r) => {
         const h = typeof r.encrypted_password === "string" && r.encrypted_password.length > 0 ? r.encrypted_password : null;
-        return { id: String(r.id), password_hash: h, email_verified: r.email_verified === true };
+        const row2 = { id: String(r.id), password_hash: h, email_verified: r.email_verified === true };
+        if (subjectColumn !== null) row2.identities = links.get(String(r.id)) ?? [];
+        return row2;
       });
       const next = rows.length === this.batchSize ? String(rows[rows.length - 1].id) : null;
       yield { rows: out, nextCursor: next };
@@ -22422,6 +23037,11 @@ async function runApply(apply, sel = "prod", opts = {}) {
       report.errors++;
     }
   };
+  {
+    const drain = cfg.features?.functions?.logDrain;
+    const drainErr = drain === void 0 ? null : logDrainShapeError(drain);
+    if (drainErr) throw new Error(`features.functions.logDrain: ${drainErr} \u2014 nothing was ${apply ? "pushed" : "planned"}`);
+  }
   let cmsApi = api;
   if (apply) {
     const enabledAt = await enableCmsBeforeSchema({ api, cfg });
@@ -22453,7 +23073,6 @@ cms: enabled (v${enabledAt}) before its schema \u2014 the declared cms config fo
     compared.collections += Object.keys(cfg.cms.collections).length;
   });
   const { functions: _fnFeature, ...configFeatures } = cfg.features;
-  void _fnFeature;
   const serverApiState = {};
   await runSection("config", async () => {
     if (!Object.keys(configFeatures).length) return;
@@ -22470,6 +23089,8 @@ ${r.feature}:`);
       }
       console.log(`
 ${r.feature} (remote v${r.version}):`);
+      const activeOrgWarn = activeOrgEnableWarning(r.feature, r.changes);
+      if (activeOrgWarn) console.error(`vxil: warning \u2014 ${activeOrgWarn}`);
       const { kept, ignored } = partitionConfigChanges(r.feature, r.changes, ignore);
       console.log(formatDiff(kept));
       if (ignored.length) console.log(`  (${ignored.length} ignored: ${ignored.map((c) => c.path).join(", ")})`);
@@ -22482,6 +23103,30 @@ ${r.feature} (remote v${r.version}):`);
       compared.features++;
     }
   });
+  await runSection("log-drain", async () => {
+    const r = await planOrPushLogDrain({ api, fnFeature: _fnFeature, apply });
+    if (!r) return;
+    if (r.remoteUnavailable) {
+      console.log("\nfunctions.logDrain:");
+      notCompared(r.remoteUnavailable, "needs features:read or admin");
+      return;
+    }
+    const show = (d) => {
+      const url = d?.url;
+      if (typeof url !== "string") return "(none)";
+      try {
+        return new URL(url).host;
+      } catch {
+        return "(invalid url)";
+      }
+    };
+    console.log(`
+functions.logDrain (remote v${r.version}):`);
+    console.log(r.changed ? `  ~ logDrain: ${show(r.from)} \u2192 ${show(r.to)}` : "  (no changes)");
+    if (r.applied) console.log(`  \u2713 applied as v${r.applied}`);
+    if (r.changed) count("config:functions.logDrain");
+    compared.features++;
+  });
   const strictApiState = hasFlag("strict-api-state");
   const declaredApiStateKeys = [];
   await runSection("api-state", async () => {
@@ -22530,7 +23175,8 @@ ${r.feature}.${r.datum} (declared in config):`);
         if (!apply) count(key);
       }
       const n = r.summary.created.length + r.summary.updated.length + r.summary.recreated.length + r.summary.unchanged.length + r.summary.undeclared.length + r.summary.deleted.length + r.summary.pending_destructive.length + r.summary.ambiguous.length;
-      compared[r.datum] = (compared[r.datum] ?? 0) + n;
+      const ck = r.datum === "collections" ? "searchCollections" : r.datum;
+      compared[ck] = (compared[ck] ?? 0) + n;
     }
   });
   await runSection("functions", async () => {
@@ -24234,7 +24880,7 @@ ${formatSummary(state)}`);
     case "architect": {
       const description = positional(0).join(" ").trim();
       if (!description) fail('usage: vxil architect "<describe your app>" [--name <n>] [--out vxil.config.ts] [--brief <file.md>|--no-brief]');
-      const { api } = requireApi(selector());
+      const { api, baseUrl } = requireApi(selector());
       const nameFlag = flag("name");
       const noBrief = hasFlag("no-brief");
       const briefOut = flag("brief");
@@ -24275,7 +24921,7 @@ ${plan.rationale}`);
         if (briefOut && !plan.brief) {
           fail(`--brief ${briefOut}: the server returned no brief \u2014 nothing written`);
         } else if (briefOut) {
-          writeFileSync6(briefOut, renderBriefMarkdown(plan.brief, plan.app ?? {}));
+          writeFileSync6(briefOut, renderBriefMarkdown(plan.brief, plan.app ?? {}, { site: briefSiteFor(baseUrl) }));
           console.log(`\u2713 wrote ${briefOut}`);
         } else if (plan.brief) {
           console.log("  (run again with --brief brief.md to write the full brief as markdown)");
@@ -24344,6 +24990,16 @@ ${plan.rationale}`);
           if (pulled.note) pullNotes.push(pulled.note);
         }
       }
+      if (features.includes("vector-search")) {
+        const r = await api("GET", "/v1/search/collections");
+        if (r.status === 200 && featBlocks["vector-search"]) {
+          const block = featBlocks["vector-search"];
+          const pulled = pulledSearchCollections(r.body.data?.collections ?? []);
+          if (pulled.collections) block.collections = pulled.collections;
+          else delete block.collections;
+          if (pulled.note) pullNotes.push(pulled.note);
+        }
+      }
       if (features.includes("ai")) {
         const block = featBlocks.ai;
         delete block.templates;
@@ -24895,7 +25551,7 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
   architect "<describe your app>" \u2014 plain English in, a reviewed vxil.config.ts draft out
   plan [--explain] \xB7 push [--dev|--target <name>|--prod] [--server [--resume <apply_id>]] [--no-gen] [--skip-functions] \xB7 pull \xB7 gen [--check] [--offline] [--out <f>] [--no-mcp] [--mcp-out <f>]
     push production overrides: --allow-mock-in-prod \xB7 --allow-sandbox-in-prod \xB7 --allow-dev-origins-in-prod \xB7 --yes
-  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>] [--strict-secrets] [--strict-api-state] [--api-state]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (an unreadable remote is 2; secrets by name only, unstored refs informational unless --strict-secrets; declared policies/subscriptions/templates/roles compared to live, an undeclared live row informational unless --strict-api-state)
+  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>] [--strict-secrets] [--strict-api-state] [--api-state]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (an unreadable remote is 2; secrets by name only, unstored refs informational unless --strict-secrets; declared policies/subscriptions/templates/roles/search collections compared to live, an undeclared live row informational unless --strict-api-state)
   doctor [--dev|--target <name>]  \u2014 + secrets referenced-vs-stored (advisory) + per-function served/published/local hash + keys with last-used (stored session)
   versions <feature> \xB7 rollback <feature> --to <v>
   config draft show|save [--file <f>]|publish|discard <feature> \xB7 config draft duplicate <feature> --from <v>  \u2014 stage a config change without making it live
@@ -25767,6 +26423,9 @@ function migrateUsage() {
           rehashed at each user's first sign-in) \xB7 [--oidc-issuer https://<ref>.supabase.co/auth/v1]
           link users for the installed-app session hand-over \xB7 [--file-links shared-link] stored
           public file URLs become stable shared links instead of object ids
+          \xB7 [--with-oauth-identities] carry the Google/Apple/GitHub/Facebook sign-in links (needs
+          --with-password-hashes in the same run) \xB7 [--keep-timestamps] keep each row's source
+          created_at / updated_at (cms creates; server key only)
   verify  reconcile source vs target counts + re-links + restate the residuals (exit 1 on deltas)
   payments --from-provider stripe|paddle|paypal|revenuecat (--customers <file.csv> | --all) [--dry-run]
           backfill SUBSCRIPTIONS through the server sync leg (the project's own provider keys; resumable via
@@ -25871,6 +26530,8 @@ ${migrateUsage()}`);
         resume: hasFlag("resume"),
         ...hasFlag("with-password-hashes") ? { withPasswordHashes: true } : {},
         ...oidcIssuer !== void 0 ? { oidcIssuer } : {},
+        ...hasFlag("with-oauth-identities") ? { withOauthIdentities: true } : {},
+        ...hasFlag("keep-timestamps") ? { keepTimestamps: true } : {},
         ...fileLinks !== void 0 ? { fileLinks } : {},
         ...only?.length ? { only } : {},
         ...hasFlag("assume-schema") ? { assumeSchema: true } : {},