@vxil/cli 0.26.3 → 0.28.0

package/README.md

@@ -48,7 +48,7 @@ Verbs: `init templates quickstart try login link keys account logout invites mem
 
 - `vxil plan --explain` — the config plan with every leaf tagged *declared* or *default*.
 - `vxil push [--skip-functions]` — apply schema → config → functions; a project below the functions plan is stopped *before anything is pushed*, and `--skip-functions` pushes the rest.
-- `vxil diff [--against <target>] [--ignore <k,…>] [--strict-secrets]` — the CI drift gate; secrets compared by name only, and a referenced-but-unstored name is informational unless `--strict-secrets`.
+- `vxil diff [--against <target>] [--ignore <k,…>] [--strict-secrets] [--strict-runtime]` — the CI drift gate; secrets compared by name only, and a referenced-but-unstored name is informational unless `--strict-secrets`. A function whose only difference is a platform setting — the functions runtime (compatibility date/flags) or the plan's CPU limit — is listed with `reason: runtime <old> → <new>` / `reason: cpu-limit <old> ms → <new> ms` and is informational under the gate (`--exit-code` / `--against`: exit 0) unless `--strict-runtime` — a plain `vxil diff` still counts it; `vxil plan` shows the same reason, and `vxil push` redeploys it under the new settings.
 - `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function. Under `--json` stdout is one JSON document; notices go to stderr.
 - `vxil link <slug>` — reuses the key already stored for the slug on this machine; `--mint` for a fresh one, `--key` to hand one in.
 - `vxil keys mint --name <name> --scopes <a,b,c> [--env live|test] [--store]` — mint a **narrow** key for a server (scopes validated locally; `admin` refused); the key prints **once** to stdout (`--json` → `{ api_key, key_id, scopes }`) and is never stored unless `--store`. `vxil keys list` shows names, ids, scopes, created and last-used (never secrets); `vxil keys revoke <key_id> [--yes]` asks you to type the id, and refuses the key the CLI itself is using unless `--yes`. Needs a dashboard session (`vxil login`, or it prompts at a terminal; a piped / `--json` run fails with that remedy instead — pass `--email`/`--password` to script it, which never stores the session).

package/dist/_vxil-feature-configs.d.ts

@@ -234,6 +234,7 @@ declare const OidcProviderSchema: import("@sinclair/typebox").TObject<{
     }>>;
     allowedDomains: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     autoLink: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    linkOnly: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
 export declare const REDIRECT_ORIGIN_PATTERN = "^(https://[^/?#\\s]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]{1,5})?)$";
 /** THE scheme rule for a redirect/return URL: https anywhere, http on loopback
@@ -292,6 +293,7 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
             }>>;
             allowedDomains: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
             autoLink: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+            linkOnly: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         }>>;
     }>>;
     session: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
@@ -330,11 +332,13 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
             maxFailures: import("@sinclair/typebox").TInteger;
             windowMinutes: import("@sinclair/typebox").TInteger;
             lockMinutes: import("@sinclair/typebox").TInteger;
+            countOtp: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         }>>;
         breachedPasswords: import("@sinclair/typebox").TBoolean;
         captchaSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         captchaOnReset: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         emailChangeStepUp: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        canarySessions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         allowedRedirectOrigins: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         inviteOnly: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         verifyLinkEvicts: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
@@ -798,6 +802,8 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
             slackHours: import("@sinclair/typebox").TInteger;
         }>>;
         unmappedProduct: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"error">, import("@sinclair/typebox").TLiteral<"ignore">]>>;
+        deferDowngrades: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        subPeriodGrants: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
     }>>;
 }>;
 export type PaymentsConfig = Static<typeof PaymentsConfigSchema>;