@vxil/cli 0.26.0 → 0.26.2

package/README.md

@@ -23,7 +23,8 @@ export default defineConfig({
   features: {
     auth: { enabled: true },
     cms: { enabled: true, draftPublish: true },
-    notifications: { enabled: true, provider: 'resend', fromEmail: 'noreply@example.com' },
+    // provider 'resend' needs its key: `vxil secrets set RESEND_API_KEY` (or use provider: 'mock' to try it)
+    notifications: { enabled: true, provider: 'resend', resendApiKeyRef: 'secret:RESEND_API_KEY', fromEmail: 'noreply@example.com' },
   },
   // (b) CMS schema-as-code — collections + fields, reconciled by `vxil push`
   cms: {

package/dist/_vxil-feature-configs.d.ts

@@ -334,6 +334,7 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
         breachedPasswords: import("@sinclair/typebox").TBoolean;
         captchaSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         captchaOnReset: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        emailChangeStepUp: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         allowedRedirectOrigins: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         inviteOnly: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         verifyLinkEvicts: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;

package/dist/vxil-main.js

@@ -4079,6 +4079,12 @@ var AuthConfigSchema = Type.Object({
     // Optional, NO default (absent = false): every existing manifest folds
     // byte-identically and reset stays ungated. Inert without captchaSecretRef.
     captchaOnReset: Type.Optional(Type.Boolean()),
+    // AUTH-EMAIL-CHANGE-GUARD (2026-10-13): when true, POST /email/change/request
+    // answers 403 step_up_required unless THIS session passed a step-up in the
+    // last 300 s (the password-change mechanism: auth.sessions.elevated_at).
+    // Optional, NO default (absent = false) — existing manifests fold unchanged.
+    // Requires otp.enabled (cross-field rule in validateFeatureConfig).
+    emailChangeStepUp: Type.Optional(Type.Boolean()),
     allowedRedirectOrigins: Type.Optional(Type.Array(
       Type.String({ minLength: 8, maxLength: 253, pattern: REDIRECT_ORIGIN_PATTERN }),
       { maxItems: 32 }
@@ -5536,9 +5542,9 @@ function lowerAllTriggerBindings(def, name) {
   return bindings;
 }
 var CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-var VXIL_CONFIG_PKG_VERSION = "0.19.0";
-var VXIL_SDK_PKG_VERSION = "0.26.0";
-var VXIL_CLI_PKG_VERSION = "0.26.0";
+var VXIL_CONFIG_PKG_VERSION = "0.19.1";
+var VXIL_SDK_PKG_VERSION = "0.26.1";
+var VXIL_CLI_PKG_VERSION = "0.26.2";
 function ensureScaffoldPackageJson(cwd, opts = {}) {
   const file = resolve(cwd, "package.json");
   const wanted = {
@@ -10901,6 +10907,16 @@ function redirectOriginNotice(cfg) {
 }
 
 // src/link.ts
+function linkEnvLabel(o) {
+  if (o.envFlag !== void 0) return { env: o.envFlag, fromWorkload: false };
+  const wl = o.workload === "production" ? "production" : o.workload === "staging" ? "staging" : o.workload === "development" ? "dev" : void 0;
+  if (wl) {
+    if (o.kept !== void 0 && o.kept === "production" === (wl === "production")) return { env: o.kept, fromWorkload: false };
+    const notice = o.kept !== void 0 ? `relabelled ${o.kept} \u2192 ${wl} from the project's workload; \`--env ${o.kept}\` to keep it` : void 0;
+    return { env: wl, fromWorkload: true, ...notice ? { notice } : {} };
+  }
+  return { env: o.kept ?? envLabelFor(o.base), fromWorkload: false };
+}
 function data(r) {
   return r.json.data ?? r.json;
 }
@@ -10934,7 +10950,7 @@ async function linkViaSession(dash, cookie, slug, keyName) {
   }
   const apiKey = data(mint).api_key;
   if (!apiKey) throw new Error("mint returned no api_key");
-  return { result: { slug, tenant_id: t.id, api_key: apiKey } };
+  return { result: { slug, tenant_id: t.id, api_key: apiKey, ...typeof t.workload === "string" ? { workload: t.workload } : {} } };
 }
 async function linkViaDeviceFlow(dash, slug, io) {
   const now = io.now ?? Date.now;
@@ -10960,7 +10976,7 @@ async function linkViaDeviceFlow(dash, slug, io) {
     if (poll.status === 200) {
       const p = data(poll);
       if (!p.api_key || !p.tenant_id) throw new Error("approval returned no api_key");
-      return { slug: p.slug || slug, tenant_id: p.tenant_id, api_key: p.api_key };
+      return { slug: p.slug || slug, tenant_id: p.tenant_id, api_key: p.api_key, ...typeof p.workload === "string" ? { workload: p.workload } : {} };
     }
     throw new Error(`link failed (${errText(poll)})`);
   }
@@ -11520,6 +11536,10 @@ function isWorkload(v) {
 function workloadEnvLabel(w) {
   return w === "production" ? "production" : w === "staging" ? "staging" : "dev";
 }
+function projectCreateNextHint(slug, workload) {
+  const env = isWorkload(workload) ? ` --env ${workloadEnvLabel(workload)}` : "";
+  return `next: vxil link ${slug} --mint${env} && vxil push   (this repo's binding is unchanged until then)`;
+}
 function quickstartWorkload(workloadFlag, envFlag, dev) {
   if (workloadFlag !== void 0) {
     if (!isWorkload(workloadFlag)) return { error: `--workload must be one of ${PROJECT_WORKLOADS.join(", ")}` };
@@ -15523,6 +15543,17 @@ function formatCompared(c) {
   }
   return parts.join(" \xB7 ");
 }
+function planFooter(counts, compared) {
+  if (counts.drift > 0) return "(run `vxil push` to apply)";
+  if (counts.ignored > 0 || counts.notCompared > 0) {
+    const parts = [];
+    if (counts.ignored > 0) parts.push(`${counts.ignored} ignored (\`vxil push\` would still apply them)`);
+    if (counts.notCompared > 0) parts.push(`${counts.notCompared} not compared`);
+    return `no unignored drift found \u2014 ${parts.join(" / ")}; not a clean match`;
+  }
+  const what = formatCompared(compared);
+  return `\u2713 no drift \u2014 the target already matches your config${what ? ` (compared ${what})` : ""}; nothing to push`;
+}
 
 // src/doctor.ts
 var SECRETS_ADVISORY_NOTE = "advisory only: a config push with an unstored `secret:<name>` ref is a WARNING, never a 422 \u2014 vxil's promotion order sets production secrets AFTER the config push (`vxil secrets set <feature>/<name>`); doctor never deletes a stored secret";
@@ -16394,6 +16425,7 @@ async function reuseDevTenantBySlug(dash, cookie, slug) {
 }
 
 // src/try.ts
+var TRY_ENV_LABEL = "sandbox";
 async function mintTry(fetchImpl, base2, opts = {}) {
   const url = `${base2.replace(/\/$/, "")}/v1/try`;
   const body = opts.turnstileToken ? { turnstile_token: opts.turnstileToken } : {};
@@ -22705,16 +22737,22 @@ async function dashFetch(base2, method, path, body, cookie) {
 function makeDash(base2) {
   return (method, path, body, cookie) => dashFetch(base2, method, path, body, cookie);
 }
-function linkRequest(slug, tenantId, base2) {
+function linkRequest(slug, tenantId, base2, workload) {
   const as = flag("as");
-  const env = flag("env") ?? keptEnvLabel(loadProject(), slug, tenantId, as) ?? envLabelFor(base2);
-  return { slug, tenantId, edgeUrl: base2, env, ...as !== void 0 ? { as } : {} };
+  const { env, fromWorkload, notice } = linkEnvLabel({
+    base: base2,
+    envFlag: flag("env"),
+    kept: keptEnvLabel(loadProject(), slug, tenantId, as),
+    workload
+  });
+  if (notice) console.error(`vxil: ${notice}`);
+  return { slug, tenantId, edgeUrl: base2, env, fromWorkload, ...as !== void 0 ? { as } : {} };
 }
-function persistLink(slug, tenantId, apiKey, base2) {
-  const req = linkRequest(slug, tenantId, base2);
+function persistLink(slug, tenantId, apiKey, base2, workload) {
+  const req = linkRequest(slug, tenantId, base2, workload);
   const plan = planLinkBinding(loadProject(), req);
   if ("error" in plan) fail(plan.error);
-  const envWarn = envLabelWarning(req.env, base2);
+  const envWarn = req.fromWorkload ? null : envLabelWarning(req.env, base2);
   if (envWarn) console.error(`vxil: ${envWarn}`);
   const creds = loadCredentials();
   creds.keys = { ...creds.keys, [slug]: apiKey };
@@ -23168,7 +23206,7 @@ async function runApply(apply, sel = "prod", opts = {}) {
   const gate = !apply && !!opts.gate;
   const explain = !apply && !!opts.explain;
   const { api, target } = requireApi(sel, apply ? { write: "push" } : gate ? { exitCode: 2 } : {});
-  if (!apply) console.error(targetBanner(target, gate ? "diff" : "plan"));
+  if (!apply) console.error(targetBanner(target, gate || opts.verb === "diff" ? "diff" : "plan"));
   const report = { drift: 0, ignored: 0, errors: 0 };
   const pushProblems = { hard: [], strict: [] };
   const strictPush = apply && hasFlag("strict");
@@ -23221,8 +23259,10 @@ async function runApply(apply, sel = "prod", opts = {}) {
       if (gate) report.errors++;
     }
   }
+  let uncompared = 0;
   const notCompared = (u, hint) => {
     console.log(formatNotCompared(u, hint));
+    uncompared++;
     if (gate) report.errors++;
   };
   const runSection = async (label, fn) => {
@@ -23343,6 +23383,7 @@ ${r.feature}.${r.datum} (declared in config):`);
       console.log(formatDeclaredApiState(r, { strict: strictApiState }));
       if (r.skipped) continue;
       if (r.refused) {
+        uncompared++;
         if (gate) report.errors++;
         else console.error(`vxil: warning \u2014 ${r.feature}.${r.datum} not converged: ${r.refused}`);
         if (apply) pushProblems.strict.push(`${r.feature}.${r.datum} refused: ${r.refused}`);
@@ -23350,6 +23391,7 @@ ${r.feature}.${r.datum} (declared in config):`);
       }
       if (r.deferred) {
         console.error(`vxil: warning \u2014 ${r.feature}.${r.datum} not converged yet: ${r.deferred}`);
+        uncompared++;
         if (gate) report.errors++;
         if (apply) pushProblems.strict.push(`${r.feature}.${r.datum} deferred: ${r.deferred}`);
         continue;
@@ -23511,6 +23553,7 @@ api state \u2014 ${self.target.tenantSlug ?? "(env key)"} vs ${other.target.tena
       for (const u of b2.unavailable) notCompared(u, `--against ${other.target.tenantSlug ?? ""}`.trim());
       for (const w of [...truncationWarnings(a, "the target"), ...truncationWarnings(b2, "--against")]) {
         console.log(w);
+        uncompared++;
         if (gate) report.errors++;
       }
       if (a.unavailable.length || b2.unavailable.length) return;
@@ -23556,7 +23599,8 @@ vxil diff \u2192 ${report.drift} drift item(s), ${report.ignored} ignored, ${rep
     }
     process.exit(code);
   }
-  if (!apply) console.log("\n(run `vxil push` to apply)");
+  if (!apply) console.log(`
+${planFooter({ drift: report.drift, ignored: report.ignored, notCompared: uncompared }, compared)}`);
   if (apply && !hasFlag("no-gen")) await runGen(sel);
   if (apply) {
     const exitWith = pushExitCode(pushProblems, strictPush, target.slot === "primary" && target.tenantSlug ? { slug: target.tenantSlug } : {});
@@ -24346,7 +24390,7 @@ try {
         tenant_id: result.tenant_id,
         slug: result.slug,
         edge_url: base2,
-        env: flag("env") ?? envLabelFor(base2),
+        env: flag("env") ?? TRY_ENV_LABEL,
         ephemeral: true,
         ...result.expires_at ? { expires_at: result.expires_at } : {}
       });
@@ -24422,7 +24466,7 @@ try {
       if (linkSession) {
         const r = await linkViaSession(dash, linkSession, slug, keyName);
         if ("result" in r) {
-          const bound = persistLink(r.result.slug, r.result.tenant_id, r.result.api_key, base2);
+          const bound = persistLink(r.result.slug, r.result.tenant_id, r.result.api_key, base2, r.result.workload);
           console.log(`\u2713 linked '${slug}' ${bound} (minted a key via your dashboard session)`);
           break;
         }
@@ -24436,7 +24480,7 @@ try {
           log: (l) => console.log(l),
           sleep: (ms) => new Promise((r) => setTimeout(r, ms))
         });
-        const bound = persistLink(linked.slug, linked.tenant_id, linked.api_key, base2);
+        const bound = persistLink(linked.slug, linked.tenant_id, linked.api_key, base2, linked.workload);
         console.log(`
 \u2713 linked '${linked.slug}' ${bound} (approved in the browser)`);
       }
@@ -24794,7 +24838,7 @@ try {
         const { project } = await withDashSession(dash, base2, (c) => createProjectViaSession(dash, c, p.body));
         if (jsonOut) console.log(JSON.stringify(project, null, 2));
         else console.log(`\u2713 created '${project.slug}' (${project.display_name}, ${project.tier}${project.workload ? `, ${project.workload}` : ""}) \u2014 no key and no features yet`);
-        console.error(`next: vxil link ${project.slug} --mint && vxil push   (this repo's binding is unchanged)`);
+        console.error(projectCreateNextHint(project.slug, project.workload));
         break;
       }
       if (sub === "workload") {
@@ -25049,6 +25093,7 @@ ${formatSummary(state)}`);
       await runApply(false, sel, {
         explain: hasFlag("explain"),
         gate: against !== void 0 || hasFlag("exit-code"),
+        verb: "diff",
         ...hasFlag("api-state") ? { apiState: { self: selector(), against: againstSelector(against) } } : {}
       });
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/cli",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "private": false,
   "description": "The vxil CLI — init, quickstart, push, gen, secrets, keys, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",
@@ -45,8 +45,8 @@
     }
   },
   "devDependencies": {
-    "@vxil/config": "0.19.0",
-    "@vxil/feature-configs": "0.17.0",
+    "@vxil/config": "0.19.1",
+    "@vxil/feature-configs": "0.17.1",
     "@vxil/runtime": "0.0.1",
     "@vxil/types": "0.0.1",
     "miniflare": "^4.20260730.0"