@vxil/cli 0.26.1 → 0.26.3

package/README.md

@@ -23,7 +23,8 @@ export default defineConfig({
   features: {
     auth: { enabled: true },
     cms: { enabled: true, draftPublish: true },
-    notifications: { enabled: true, provider: 'resend', fromEmail: 'noreply@example.com' },
+    // provider 'resend' needs its key: `vxil secrets set RESEND_API_KEY` (or use provider: 'mock' to try it)
+    notifications: { enabled: true, provider: 'resend', resendApiKeyRef: 'secret:RESEND_API_KEY', fromEmail: 'noreply@example.com' },
   },
   // (b) CMS schema-as-code — collections + fields, reconciled by `vxil push`
   cms: {

package/dist/_vxil-feature-configs.d.ts

@@ -334,6 +334,7 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
         breachedPasswords: import("@sinclair/typebox").TBoolean;
         captchaSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         captchaOnReset: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        emailChangeStepUp: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         allowedRedirectOrigins: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         inviteOnly: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         verifyLinkEvicts: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;

package/dist/vxil-main.js

@@ -4079,6 +4079,12 @@ var AuthConfigSchema = Type.Object({
     // Optional, NO default (absent = false): every existing manifest folds
     // byte-identically and reset stays ungated. Inert without captchaSecretRef.
     captchaOnReset: Type.Optional(Type.Boolean()),
+    // AUTH-EMAIL-CHANGE-GUARD (2026-10-13): when true, POST /email/change/request
+    // answers 403 step_up_required unless THIS session passed a step-up in the
+    // last 300 s (the password-change mechanism: auth.sessions.elevated_at).
+    // Optional, NO default (absent = false) — existing manifests fold unchanged.
+    // Requires otp.enabled (cross-field rule in validateFeatureConfig).
+    emailChangeStepUp: Type.Optional(Type.Boolean()),
     allowedRedirectOrigins: Type.Optional(Type.Array(
       Type.String({ minLength: 8, maxLength: 253, pattern: REDIRECT_ORIGIN_PATTERN }),
       { maxItems: 32 }
@@ -5536,9 +5542,9 @@ function lowerAllTriggerBindings(def, name) {
   return bindings;
 }
 var CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-var VXIL_CONFIG_PKG_VERSION = "0.19.0";
-var VXIL_SDK_PKG_VERSION = "0.26.0";
-var VXIL_CLI_PKG_VERSION = "0.26.1";
+var VXIL_CONFIG_PKG_VERSION = "0.19.1";
+var VXIL_SDK_PKG_VERSION = "0.26.2";
+var VXIL_CLI_PKG_VERSION = "0.26.3";
 function ensureScaffoldPackageJson(cwd, opts = {}) {
   const file = resolve(cwd, "package.json");
   const wanted = {
@@ -14949,7 +14955,7 @@ var TOOLS = [
   {
     name: "payments_list_webhook_events",
     feature: "payments",
-    description: "List provider webhook deliveries from the event log, newest-first: outcome (received|processed|error|sig_failed|parse_failed|reprocessed|ignored|unowned|rejected_environment), the provider-reported environment (production|sandbox), signature status, error, and timestamps per delivery. Use it to diagnose billing sync issues (e.g. an unmapped price or product \u2192 outcome error, a misconfigured webhook secret producing sig_failed rows, sandbox deliveries landing as rejected_environment). An unmapped one-off product lands `error` unless you set ledger.unmappedProduct:'ignore', which lands it `ignored` instead. Read-only \u2014 needs payments:read. Server-side key only (403 server_only on a thin-client/end-user key) \u2014 the log is tenant-wide and carries provider payloads. Payloads are detail-only (console surface).",
+    description: "List provider webhook deliveries from the event log, newest-first: outcome (received|processed|error|sig_failed|parse_failed|reprocessed|ignored|unowned|rejected_environment), the provider-reported environment (production|sandbox), signature status, error, and timestamps per delivery. Use it to diagnose billing sync issues (e.g. an unmapped price or product, or a RevenueCat entitlement id that is not a ledger.tierMap key (with no ledger.priceMap hit) \u2192 outcome error, a misconfigured webhook secret producing sig_failed rows, sandbox deliveries landing as rejected_environment). An unmapped one-off product lands `error` unless you set ledger.unmappedProduct:'ignore', which lands it `ignored` instead. Read-only \u2014 needs payments:read. Server-side key only (403 server_only on a thin-client/end-user key) \u2014 the log is tenant-wide and carries provider payloads. Payloads are detail-only (console surface).",
     inputSchema: {
       type: "object",
       properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/cli",
-  "version": "0.26.1",
+  "version": "0.26.3",
   "private": false,
   "description": "The vxil CLI — init, quickstart, push, gen, secrets, keys, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",
@@ -45,8 +45,8 @@
     }
   },
   "devDependencies": {
-    "@vxil/config": "0.19.0",
-    "@vxil/feature-configs": "0.17.0",
+    "@vxil/config": "0.19.1",
+    "@vxil/feature-configs": "0.17.1",
     "@vxil/runtime": "0.0.1",
     "@vxil/types": "0.0.1",
     "miniflare": "^4.20260730.0"