@vxil/cli 0.33.0 → 0.35.0

package/dist/_vxil-feature-configs-chatWebhook.d.ts

@@ -0,0 +1,16 @@
+/** ALERT-CHAT-DEST: the secret-name grammar of `webhooks.alerts.chatWebhook.secret`
+ *  (the secret store's own SECRET_NAME_RE, optionally `secret:`-prefixed like
+ *  every other *Ref). */
+export declare const CHAT_WEBHOOK_SECRET_PATTERN = "^(secret:)?[a-z0-9_]{1,64}$";
+/** ALERT-CHAT-DEST: where a failure-alert chat webhook may point. EXACT hosts,
+ *  plus two Microsoft Teams Workflows suffixes (each tenant gets its own
+ *  sub-domain there). Nothing else: the digest cron POSTs from vxil's own
+ *  network, so an open URL would be an SSRF / exfiltration door. */
+export declare const CHAT_WEBHOOK_HOSTS: readonly string[];
+export declare const CHAT_WEBHOOK_HOST_SUFFIXES: readonly string[];
+/** ALERT-CHAT-DEST: null when `raw` is a chat webhook URL the digest may POST
+ *  to, else a short reason. https only, default port, no credentials in the
+ *  authority, host on the allowlist. PURE — shared by the digest cron (the
+ *  enforcing check) and the dashboard (an early hint before the value is
+ *  stored write-only). */
+export declare function chatWebhookUrlError(raw: string): string | null;

package/dist/_vxil-feature-configs-cmsRules.d.ts

@@ -30,7 +30,7 @@ export declare const CmsRuleParamsSchema: import("@sinclair/typebox").TObject<{
 }>;
 export declare const CmsRuleEntrySchema: import("@sinclair/typebox").TObject<{
     app: import("@sinclair/typebox").TString;
-    kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"stamp_actor" | "create_by_role" | "owner_only_edit" | "role_gate" | "archive_by_role" | "state_flow" | "no_self_decision" | "capacity" | "no_overlap">[]>;
+    kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"owner_only_edit" | "archive_by_role" | "state_flow" | "stamp_actor" | "create_by_role" | "role_gate" | "no_self_decision" | "capacity" | "no_overlap">[]>;
     collection: import("@sinclair/typebox").TString;
     params: import("@sinclair/typebox").TObject<{
         field: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;

package/dist/_vxil-feature-configs-hooks.d.ts

@@ -224,4 +224,24 @@ export declare function highlightTokens(src: string): Array<{
     value: string;
     kind: HlKind;
 }>;
+/** = control-plane `appHookOwnership.APP_HOOK_RE` (the App builder ownership
+ *  marker `app_` + an app id + `_`; parity pinned by the control-plane
+ *  appgenDoors test). Only a name carrying a real App builder app id. */
+export declare const APP_OWNED_HOOK_RE: RegExp;
+/** The App builder rule kinds whose DELETE is not free for an end user
+ *  (= the non-'free' keys of control-plane `appgenDoors.DELETE_SEMANTICS`;
+ *  parity pinned by the control-plane appgenDoors test). appgenRules names a
+ *  rule's hooks `<stem><collection>_<kind>[…]`. */
+export declare const APP_DELETE_GUARDED_RULE_KINDS: readonly ["owner_only_edit", "archive_by_role", "state_flow"];
+/** The collections that carry an enabled App builder hook of a
+ *  delete-guarded rule kind. An END-USER cascade (cascade / set_null) into one
+ *  of them is refused by cms runCascade — the platform twin of the app proxy's
+ *  D5 parent-delete refusal (a guard on the child list cannot be bypassed by
+ *  deleting its parent). Structural: the hook NAME the App builder compiler
+ *  writes, never user text. A rule that compiles no write check (archive_by_role
+ *  on the proxy lane) carries the always-true `<list>_archive_by_role_delete_guard`
+ *  marker (control-plane appgenRules.withDeleteGuardMarkers), so this set equals
+ *  the lists the proxy's appgenDoors.doorsOf guards (parity pinned in the
+ *  control-plane appgenDoors test). Pure. */
+export declare function appDeleteGuardedCollections(hooks: Record<string, HookDef> | undefined): ReadonlySet<string>;
 export {};

package/dist/_vxil-feature-configs.d.ts

@@ -1,5 +1,6 @@
 import { type Static, type TSchema } from '@sinclair/typebox';
 import { ACTIVITY_FEED_BUILTIN_GROUPS } from './_vxil-feature-configs-feedGroups.js';
+export { CHAT_WEBHOOK_HOSTS, CHAT_WEBHOOK_HOST_SUFFIXES, CHAT_WEBHOOK_SECRET_PATTERN, chatWebhookUrlError } from './_vxil-feature-configs-chatWebhook.js';
 export { AI_THINKING_LEVELS, geminiThinkingLevelError, minimalThinkingLevel, type GeminiThinkingLevel } from './_vxil-feature-configs-geminiThinking.js';
 export * from './_vxil-feature-configs-hooks.js';
 export * from './_vxil-feature-configs-readmodels.js';
@@ -440,6 +441,9 @@ export declare const WebhooksConfigSchema: import("@sinclair/typebox").TObject<{
         enabled: import("@sinclair/typebox").TBoolean;
         minLevel: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"warn">, import("@sinclair/typebox").TLiteral<"error">]>;
         digestMinutes: import("@sinclair/typebox").TInteger;
+        chatWebhook: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            secret: import("@sinclair/typebox").TString;
+        }>>;
     }>>;
     subscriptions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
         target_url: import("@sinclair/typebox").TString;
@@ -511,7 +515,7 @@ export declare const CmsConfigSchema: import("@sinclair/typebox").TObject<{
     }>>>;
     rules: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
         app: import("@sinclair/typebox").TString;
-        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"stamp_actor" | "create_by_role" | "owner_only_edit" | "role_gate" | "archive_by_role" | "state_flow" | "no_self_decision" | "capacity" | "no_overlap">[]>;
+        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"owner_only_edit" | "archive_by_role" | "state_flow" | "stamp_actor" | "create_by_role" | "role_gate" | "no_self_decision" | "capacity" | "no_overlap">[]>;
         collection: import("@sinclair/typebox").TString;
         params: import("@sinclair/typebox").TObject<{
             field: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;

package/dist/config.d.ts

@@ -136,6 +136,15 @@ export interface CollectionDef {
      *  a config leaf) and carried by BOTH push paths; widening (clearing, or
      *  adding a role) needs `vxil push --allow-destructive`. */
     writeRoles?: string[];
+    /** W39-3: role slugs whose VERIFIED holders MANAGE this owned collection —
+     *  they read every row (get / list / count) and may update another member's
+     *  row through the single-item PATCH; the collection's hooks still decide
+     *  which fields (every other door stays owner-scoped). Needs `ownerField`
+     *  and an end-user-writable `endUserAccess`. Absent / `[]` = none. Up to 16
+     *  slugs. Carried by BOTH push paths; adding a role widens reads and needs
+     *  `vxil push --allow-destructive`. The App builder sets `['app_manager']`
+     *  on its members apps' own-only lists while the app names managers. */
+    managerRoles?: string[];
     /** Retention in days (guide ch. 4): items created more than this many days
      *  ago are soft-deleted by the nightly sweep (recoverable for 30 days). An
      *  integer 1..3650, or `null` to keep items until deleted. ABSENT = not

package/dist/vxil-main.js

@@ -5199,6 +5199,15 @@ var init_feedGroups = __esm({
   }
 });
 
+// ../feature-configs/src/chatWebhook.ts
+var CHAT_WEBHOOK_SECRET_PATTERN;
+var init_chatWebhook = __esm({
+  "../feature-configs/src/chatWebhook.ts"() {
+    "use strict";
+    CHAT_WEBHOOK_SECRET_PATTERN = "^(secret:)?[a-z0-9_]{1,64}$";
+  }
+});
+
 // ../feature-configs/src/canonicalJson.ts
 function canonicalJson(v) {
   if (Array.isArray(v)) return `[${v.map((x) => canonicalJson(x) ?? "null").join(",")}]`;
@@ -5324,6 +5333,8 @@ var init_src = __esm({
     init_publicAssets();
     init_geminiThinking();
     init_feedGroups();
+    init_chatWebhook();
+    init_chatWebhook();
     init_cmsRules();
     init_geminiThinking();
     init_hooks();
@@ -6074,7 +6085,20 @@ var init_src = __esm({
       alerts: Type.Optional(Type.Object({
         enabled: Type.Boolean({ default: false }),
         minLevel: Type.Union([Type.Literal("warn"), Type.Literal("error")], { default: "error" }),
-        digestMinutes: Type.Integer({ default: 15, minimum: 0, maximum: 1440 })
+        digestMinutes: Type.Integer({ default: 15, minimum: 0, maximum: 1440 }),
+        // ALERT-CHAT-DEST (w41, founder decision D 2026-10-30): a chat webhook
+        // (Google Chat / Slack / Teams Workflows) that receives the SAME digest as
+        // a `{ text }` POST, beside the owner e-mail. The URL embeds the channel's
+        // key/token, so it is NEVER a config value: `secret` NAMES a tenant secret
+        // stored under feature 'webhooks' (PUT /v1/secrets/webhooks/<name>,
+        // envelope-encrypted under KEK_WEBHOOKS), resolved only by the digest cron.
+        // The host is checked against CHAT_WEBHOOK_HOSTS at send time (the value
+        // is write-only, so it cannot be checked here). Optional, NO default —
+        // existing manifests fold byte-identically. Inside the alerts bag, so the
+        // leaf count is unchanged.
+        chatWebhook: Type.Optional(Type.Object({
+          secret: Type.String({ pattern: CHAT_WEBHOOK_SECRET_PATTERN })
+        }))
       })),
       // DECLARED API STATE (2026-09-23): the tenant's OUTBOUND
       // subscriptions as config. Keyed by `target_url` — the only stable identity a
@@ -7246,7 +7270,7 @@ function formatRulesSummary(s, needsAck = false) {
   if (!s.added.length && !s.removed.length) return "  rules (server summary): no rule added or removed";
   return [
     "  rules (server summary):",
-    ...s.added.map((l) => `  + ${oneLine(l.sentence)}  ${enforcedTag(l)}`),
+    ...s.added.flatMap((l) => [`  + ${oneLine(l.sentence)}  ${enforcedTag(l)}`, ...unwrittenLine(l)]),
     ...s.removed.map((l) => `  - ${oneLine(l.sentence)}  ${enforcedTag(l)}${needsAck ? NEEDS_ACK : ""}`)
   ].join("\n");
 }
@@ -7308,7 +7332,7 @@ ${tail}`;
   return `${head}export default defineConfig(${marked.slice(0, at)}${block}${marked.slice(at + needle.length)});
 ${tail}`;
 }
-var isObj, isLine, oneLine, enforcedTag, NEEDS_ACK, RULES_MARK;
+var isObj, isLine, oneLine, enforcedTag, NEEDS_ACK, unwrittenLine, RULES_MARK;
 var init_cmsRulesView = __esm({
   "src/cmsRulesView.ts"() {
     "use strict";
@@ -7319,6 +7343,10 @@ var init_cmsRulesView = __esm({
     oneLine = (s) => s.replace(/[\r\n\u2028\u2029]+/g, " ").trim();
     enforcedTag = (l) => l.enforced_by === "server" ? "[enforced_by: server]" : `[enforced_by: app \u2014 only writes through ${oneLine(l.app)}]`;
     NEEDS_ACK = "  (needs --allow-rule-removal)";
+    unwrittenLine = (l) => {
+      const keys = Array.isArray(l.unwritten_keys) ? l.unwritten_keys.filter((k) => typeof k === "string").map(oneLine) : [];
+      return keys.length ? [`    ! ${oneLine(l.app)}'s page does not send ${keys.join(", ")}: the app refuses those creates until it does (fix the page in App builder)`] : [];
+    };
     RULES_MARK = "\0vxil-pull-rules\0";
   }
 });
@@ -7601,7 +7629,7 @@ var init_src3 = __esm({
       // Dedicated write scope for the BYO-secret path. PUT /v1/secrets/:feature/:name
       // requires THIS (or 'admin') as of 2026-07-17 ('features:write' is no
       // longer secret-write-equivalent). GET/DELETE /v1/secrets still also accept
-      // 'features:write'.
+      // 'features:write'; GET also accepts 'features:read' (names + ref only, 2026-10-30).
       "secrets:write",
       "users:read",
       "users:write",
@@ -7776,6 +7804,7 @@ var init_src3 = __esm({
 var functions_exports = {};
 __export(functions_exports, {
   BUNDLE_HEADROOM_WARN_RATIO: () => BUNDLE_HEADROOM_WARN_RATIO,
+  DEPLOY_ENTITLEMENT_NOT_PROBED: () => DEPLOY_ENTITLEMENT_NOT_PROBED,
   FN_LIMIT_BOUNDS: () => FN_LIMIT_BOUNDS,
   MAX_FN_BINDINGS: () => MAX_FN_BINDINGS,
   assertBundleContained: () => assertBundleContained,
@@ -7787,6 +7816,7 @@ __export(functions_exports, {
   describeBinding: () => describeBinding,
   describeRuntime: () => describeRuntime,
   diffBindings: () => diffBindings,
+  entitlementNotProbed: () => entitlementNotProbed,
   formatBundleTooLarge: () => formatBundleTooLarge,
   formatFnChanges: () => formatFnChanges,
   formatFunctionsPreflight: () => formatFunctionsPreflight,
@@ -8292,6 +8322,9 @@ async function probeFunctionsEntitlement(api, name) {
   }
   return { entitled: true };
 }
+function entitlementNotProbed(e) {
+  return !e.entitled && e.status === 403 && e.code === "insufficient_scope";
+}
 function billingPageFor(tenantId, baseUrl) {
   const tid = tenantId && tenantId !== "(unknown)" ? tenantId : "<tenant>";
   const path = `/dashboard/${tid}/billing`;
@@ -8303,6 +8336,10 @@ function billingPageFor(tenantId, baseUrl) {
 }
 function formatFunctionsPreflight(e, opts) {
   const n = `${opts.declared} declared function(s)`;
+  if (entitlementNotProbed(e)) {
+    if (opts.verb === "plan") return DEPLOY_ENTITLEMENT_NOT_PROBED.trim();
+    return `functions: the pushing key lacks features:write (insufficient_scope${e.message ? ` \u2014 ${e.message}` : ""}); ${n} would be refused. Push with a key that holds features:write, or run \`vxil push --skip-functions\` to push everything else.`;
+  }
   if (e.code === "sandbox_restricted" || e.status === 403) {
     return `functions: this project cannot deploy functions (${e.code ?? e.status}${e.message ? ` \u2014 ${e.message}` : ""}); ${n} would be refused.${e.hint ? ` ${e.hint}` : ""}` + (opts.verb === "push" ? " Run `vxil push --skip-functions` to push everything else." : "");
   }
@@ -8330,7 +8367,7 @@ function formatLogLines(lines) {
   }
   return out.length ? out.join("\n") : "  (no log lines)";
 }
-var WIRING_WARNING, WORKSPACE_ROOTS, BUNDLE_HEADROOM_WARN_RATIO;
+var WIRING_WARNING, WORKSPACE_ROOTS, BUNDLE_HEADROOM_WARN_RATIO, DEPLOY_ENTITLEMENT_NOT_PROBED;
 var init_functions = __esm({
   "src/functions.ts"() {
     "use strict";
@@ -8341,6 +8378,7 @@ var init_functions = __esm({
     WIRING_WARNING = /trigger subscription|cron schedule/i;
     WORKSPACE_ROOTS = /* @__PURE__ */ new Map();
     BUNDLE_HEADROOM_WARN_RATIO = 0.8;
+    DEPLOY_ENTITLEMENT_NOT_PROBED = "  ! not probed: deploy entitlement (needs features:write)";
   }
 });
 
@@ -8731,7 +8769,7 @@ function applyEnvelope(r, what) {
   }
   return r.body.data;
 }
-async function serverApply({ api, bundle, resume, allowDestructive, allowRuleRemoval, onPlan }) {
+async function serverApply({ api, bundle, resume, allowDestructive, allowRuleRemoval, onPlan, poll }) {
   if (resume) {
     return applyEnvelope(await api("POST", "/v1/apply", { apply_id: resume, mode: "apply" }), "apply resume");
   }
@@ -8746,10 +8784,44 @@ async function serverApply({ api, bundle, resume, allowDestructive, allowRuleRem
     "apply plan"
   );
   onPlan?.(plan);
-  return applyEnvelope(
-    await api("POST", "/v1/apply", { apply_id: plan.apply_id, mode: "apply" }),
-    `apply execute (resume with: vxil push --server --resume ${plan.apply_id})`
-  );
+  let executed;
+  try {
+    executed = await api("POST", "/v1/apply", { apply_id: plan.apply_id, mode: "apply" });
+  } catch (e) {
+    return pollApplyAfterTransportError({ api, applyId: plan.apply_id, cause: e, ...poll ?? {} });
+  }
+  return applyEnvelope(executed, `apply execute (resume with: vxil push --server --resume ${plan.apply_id})`);
+}
+async function pollApplyAfterTransportError({ api, applyId, cause, intervalMs = APPLY_POLL_INTERVAL_MS, maxMs = APPLY_POLL_MAX_MS, sleep, onWait }) {
+  const wait = sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const why = cause?.message ?? String(cause);
+  const resumeHint = `resume with: vxil push --server --resume ${applyId}`;
+  onWait?.(`  \u2026 the apply answer was lost in transport (${why}) \u2014 reading apply ${applyId} every ${intervalMs / 1e3} s (up to ${maxMs / 1e3} s)`);
+  let last = null;
+  const maxReads = Math.max(1, Math.floor(maxMs / intervalMs));
+  for (let n = 1; ; n++) {
+    let res = null;
+    try {
+      res = await api("GET", `/v1/apply/${encodeURIComponent(applyId)}`);
+    } catch {
+    }
+    if (res && res.status >= 400 && res.status < 500 && res.status !== 429) {
+      try {
+        applyEnvelope(res, `apply ${applyId} status read (${resumeHint})`);
+      } catch (e) {
+        throw new ApplyUnreadError(applyId, e.message);
+      }
+    }
+    const readable = res && res.status < 400 && !res.body?.error && typeof res.body?.data?.status === "string";
+    if (res && readable) {
+      last = applyEnvelope(res, `apply ${applyId} status read (${resumeHint})`);
+      if (last.status !== "running" && last.status !== "planned") return { ...last, polled: true };
+    }
+    if (n >= maxReads) break;
+    await wait(intervalMs);
+  }
+  if (!last) throw new ApplyUnreadError(applyId, `apply execute: ${why}; apply ${applyId} could not be read for ${maxMs / 1e3} s \u2014 check it with \`vxil api GET /v1/apply/${applyId}\`, then ${resumeHint} if it is still running`);
+  return { ...last, polled: true };
 }
 function cmsEnableManifest(declared) {
   return declared.limits !== void 0 ? { ...CMS_ENABLE_MANIFEST, limits: declared.limits } : { ...CMS_ENABLE_MANIFEST };
@@ -8933,7 +9005,7 @@ function readUnavailable(route, res) {
 function formatNotCompared(u, hint) {
   return `  ! not compared: ${u.route} \u2192 ${u.code ?? u.status}${u.message ? ` \u2014 ${u.message}` : ""}${hint ? ` (${hint})` : ""}`;
 }
-var MAX_FN_BINDINGS, FN_LIMIT_BOUNDS, CONFIG_FILENAMES, VXIL_CONFIG_PKG_VERSION, VXIL_SDK_PKG_VERSION, VXIL_CLI_PKG_VERSION, SCAFFOLD_NODE_TYPES_RANGE, SCAFFOLD_TSCONFIG, CONFIG_IMPORT_SPECIFIERS, QUICKSTART_DEFAULT_FEATURES, APP_HOOK_RE, ACTIVE_ORG_MIN_SDK, loadedConfigApiVersion, STEP_GLYPH, PUSH_READ_CONCURRENCY, CMS_ENABLE_MANIFEST, CMS_PROPAGATION_ATTEMPTS, CMS_PROPAGATION_DELAY_MS;
+var MAX_FN_BINDINGS, FN_LIMIT_BOUNDS, CONFIG_FILENAMES, VXIL_CONFIG_PKG_VERSION, VXIL_SDK_PKG_VERSION, VXIL_CLI_PKG_VERSION, SCAFFOLD_NODE_TYPES_RANGE, SCAFFOLD_TSCONFIG, CONFIG_IMPORT_SPECIFIERS, QUICKSTART_DEFAULT_FEATURES, APP_HOOK_RE, ACTIVE_ORG_MIN_SDK, loadedConfigApiVersion, STEP_GLYPH, ApplyUnreadError, APPLY_POLL_INTERVAL_MS, APPLY_POLL_MAX_MS, PUSH_READ_CONCURRENCY, CMS_ENABLE_MANIFEST, CMS_PROPAGATION_ATTEMPTS, CMS_PROPAGATION_DELAY_MS;
 var init_lib = __esm({
   "src/lib.ts"() {
     "use strict";
@@ -8946,9 +9018,9 @@ var init_lib = __esm({
       timeoutMs: { min: 1e3, max: 12e4 }
     };
     CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-    VXIL_CONFIG_PKG_VERSION = "0.25.0";
-    VXIL_SDK_PKG_VERSION = "0.32.0";
-    VXIL_CLI_PKG_VERSION = "0.33.0";
+    VXIL_CONFIG_PKG_VERSION = "0.26.0";
+    VXIL_SDK_PKG_VERSION = "0.34.0";
+    VXIL_CLI_PKG_VERSION = "0.35.0";
     SCAFFOLD_NODE_TYPES_RANGE = "^24.0.0";
     SCAFFOLD_TSCONFIG = {
       compilerOptions: {
@@ -8973,6 +9045,16 @@ var init_lib = __esm({
       rolled_back: "\u21A9",
       kept: "\u2248"
     };
+    ApplyUnreadError = class extends Error {
+      constructor(applyId, message) {
+        super(message);
+        this.applyId = applyId;
+        this.name = "ApplyUnreadError";
+      }
+      applyId;
+    };
+    APPLY_POLL_INTERVAL_MS = 5e3;
+    APPLY_POLL_MAX_MS = 12e4;
     PUSH_READ_CONCURRENCY = 5;
     CMS_ENABLE_MANIFEST = { enabled: true };
     CMS_PROPAGATION_ATTEMPTS = 4;
@@ -11160,6 +11242,10 @@ async function aiTemplateContentSha256(t) {
   }));
 }
 
+// ../runtime/src/innerJwt.ts
+var APP_MANAGER_ROLE = "app_manager";
+var enc = new TextEncoder();
+
 // ../runtime/src/egress.ts
 function isPrivateIPv4(host) {
   const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
@@ -11748,6 +11834,12 @@ function writeRolesWidens(declared, remote) {
   if (declared.length === 0) return true;
   return declared.some((r) => !remote.includes(r));
 }
+function appBuilderManagersKept(declared, remote) {
+  return !declared && remote.length === 1 && remote[0] === APP_MANAGER_ROLE;
+}
+function managerRolesWidens(declared, remote) {
+  return declared.some((r) => !remote.includes(r));
+}
 function orgFieldWidens(declared, remote) {
   return remote !== null && declared !== remote;
 }
@@ -11852,6 +11944,7 @@ function remoteCollectionOf(c) {
     writeRoles: writeRolesOf(c.write_roles),
     orgField: typeof c.org_field === "string" && c.org_field.length > 0 ? c.org_field : null,
     orgReadRoles: writeRolesOf(c.org_read_roles),
+    managerRoles: writeRolesOf(c.manager_roles),
     retainDays: typeof c.retain_days === "number" ? c.retain_days : null,
     deletedRetainDays: typeof c.deleted_retain_days === "number" ? c.deleted_retain_days : null,
     onOwnerErase: c.on_owner_erase === "delete" ? "delete" : "keep",
@@ -11871,6 +11964,7 @@ function pulledCollectionBlock(c) {
     ...rc.writeRoles.length ? { writeRoles: rc.writeRoles } : {},
     ...rc.orgField ? { orgField: rc.orgField } : {},
     ...rc.orgReadRoles.length ? { orgReadRoles: rc.orgReadRoles } : {},
+    ...rc.managerRoles.length ? { managerRoles: rc.managerRoles } : {},
     ...rc.retainDays !== null ? { retainDays: rc.retainDays } : {},
     ...rc.deletedRetainDays !== null ? { deletedRetainDays: rc.deletedRetainDays } : {},
     ...rc.onOwnerErase === "delete" ? { onOwnerErase: "delete" } : {},
@@ -11938,6 +12032,10 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
     if (wr !== void 0 && (!Array.isArray(wr) || wr.some((r) => typeof r !== "string"))) {
       throw new Error(`cms.collections.${name}.writeRoles must be an array of role slugs (got ${JSON.stringify(wr)})`);
     }
+    const mr = def.managerRoles;
+    if (mr !== void 0 && (!Array.isArray(mr) || mr.some((r) => typeof r !== "string"))) {
+      throw new Error(`cms.collections.${name}.managerRoles must be an array of role slugs (got ${JSON.stringify(mr)})`);
+    }
     const wsErrs = workspaceCollectionErrors(name, def);
     if (wsErrs.length) throw new Error(wsErrs[0]);
     const rd = def.retainDays;
@@ -12132,6 +12230,24 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
         });
       }
     }
+    const declaredMgr = writeRolesOf(def.managerRoles);
+    if (!appBuilderManagersKept(def.managerRoles !== void 0, rc.managerRoles) && stableStringify(declaredMgr) !== stableStringify(rc.managerRoles)) {
+      const widens = managerRolesWidens(declaredMgr, rc.managerRoles);
+      const fmt = (r) => r.length ? `[${r.join(", ")}]` : "none";
+      if (!widens || allowDestructive) {
+        collChanges.push({
+          collection: name,
+          kind: "set-manager-roles",
+          detail: `${name} managerRoles \u2192 ${fmt(declaredMgr)} (was ${fmt(rc.managerRoles)})` + (widens ? " \u2014 WIDENS who reads every row (full-config reconciliation)" : " (narrows end-user reads)")
+        });
+      } else {
+        collChanges.push({
+          collection: name,
+          kind: "warn",
+          detail: `${name}: managerRoles are ${fmt(rc.managerRoles)} remotely but ${fmt(declaredMgr)} in config \u2014 that WIDENS which end users read every row, so it is NOT applied. Declare the remote roles to keep them, or re-run with --allow-destructive to widen.`
+        });
+      }
+    }
     const declaredOrg = def.orgField ?? null;
     const declaredOrgRoles = writeRolesOf(def.orgReadRoles);
     const orgSteps = [];
@@ -12291,6 +12407,8 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
         if (access !== "readwrite") body.end_user_access = access;
         const roles = writeRolesOf(def.writeRoles);
         if (roles.length > 0) body.write_roles = roles;
+        const mgrRoles = writeRolesOf(def.managerRoles);
+        if (mgrRoles.length > 0) body.manager_roles = mgrRoles;
         if (def.orgField) body.org_field = def.orgField;
         const orgRoles = writeRolesOf(def.orgReadRoles);
         if (orgRoles.length > 0) body.org_read_roles = orgRoles;
@@ -12357,6 +12475,14 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
           throw new Error(`cms: set writeRoles on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
         }
         applied++;
+      } else if (c.kind === "set-manager-roles") {
+        const target = writeRolesOf(collections[c.collection].managerRoles);
+        const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`, { manager_roles: target });
+        if (res.status !== 200 && res.status !== 201) {
+          const e = res.body.error ?? {};
+          throw new Error(`cms: set managerRoles on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
+        }
+        applied++;
       } else if (c.kind === "set-org-field" || c.kind === "set-org-read-roles") {
         const def = collections[c.collection];
         const remoteRc = remote.get(c.collection);
@@ -12453,7 +12579,7 @@ function formatCmsChanges(changes) {
     if (c.kind === "destructive") return `  ! ${c.detail}`;
     if (c.kind === "warn") return `  \u26A0 ${c.detail}`;
     if (c.kind === "reindex") return `  \u21BB ${c.detail}`;
-    if (c.kind === "alter-flags" || c.kind === "set-owner-field" || c.kind === "set-end-user-access" || c.kind === "set-write-roles" || c.kind === "set-retain-days" || c.kind === "set-deleted-retain-days" || c.kind === "set-on-owner-erase") return `  ~ ${c.detail}`;
+    if (c.kind === "alter-flags" || c.kind === "set-owner-field" || c.kind === "set-end-user-access" || c.kind === "set-write-roles" || c.kind === "set-manager-roles" || c.kind === "set-retain-days" || c.kind === "set-deleted-retain-days" || c.kind === "set-on-owner-erase") return `  ~ ${c.detail}`;
     return `  + ${c.detail}`;
   }).join("\n");
 }
@@ -12805,6 +12931,10 @@ function storedSessionFor(creds, dashBase) {
   if (host !== dashboardOrigin(dashBase)) return { session: null, reason: "other-host", host };
   return { session: creds.session, host };
 }
+function sessionExpiryFrom(setCookie, now) {
+  const m = /;\s*max-age=(\d+)/i.exec(setCookie ?? "");
+  return m ? new Date(now.getTime() + Number(m[1]) * 1e3).toISOString() : void 0;
+}
 function sessionNotForTarget(s, target) {
   if (s.reason === "other-host") return `the stored dashboard session belongs to ${s.host}, not this target (${dashboardOrigin(target)}) \u2014 run \`vxil login\` against this target to use it here`;
   if (s.reason === "unbound") return `the stored dashboard session has no recorded host (written by an older CLI) and is not sent anywhere \u2014 run \`vxil login\` again to bind it`;
@@ -16328,7 +16458,7 @@ var TOOLS = [
   {
     name: "cms_list_collections",
     feature: "cms",
-    description: "List the tenant's content model: collections with their typed field definitions (the schema items are validated against). Each field row carries its attributes \u2014 required, validation, index_slot, relation_to, computed/compute, is_unique, on_delete, read_roles (the end-user org roles allowed to READ that field; null = ungated), and on an equality-indexed field indexed: true + index_ready (equality filters on it are index-served once ready; until then, and on unindexed unslotted fields, they are a bounded scan \u2014 same results). A field with read_roles is omitted from end-user reads without a matching role and is never served on the public lane, so a missing key in an item's data may be a read gate rather than an unset value. Each collection row also carries end_user_access: 'readwrite' (default), 'read' (a verified end user \u2014 a thin-client key with a session \u2014 may read but every write answers 403 server_only), 'none' (end-user reads and writes are 403 server_only) or 'read_all' (a verified end user reads every row, past owner_field, and writes only their own), and write_roles: the roles a verified end user must hold to WRITE the collection (null = ungated; without one every end-user write answers 403 role_required, reads are unaffected); server keys are never affected. retain_days (null = keep) is the collection's retention: the nightly platform sweep soft-deletes live items created more than that many days ago. deleted_retain_days (null = 30) is how many days a deleted item stays restorable before the nightly cleanup purges it. on_owner_erase 'delete' (null = keep) means a GDPR erase of a user hard-deletes the items they own here. org_field (null = none) makes the collection workspace-scoped: a verified end user reads and writes only rows of the session's active org (no active org \u2192 403 org_required) and write_roles match the active-org role; org_read_roles (null = any member) gates reads by that role.",
+    description: "List the tenant's content model: collections with their typed field definitions (the schema items are validated against). Each field row carries its attributes \u2014 required, validation, index_slot, relation_to, computed/compute, is_unique, on_delete, read_roles (the end-user org roles allowed to READ that field; null = ungated), and on an equality-indexed field indexed: true + index_ready (equality filters on it are index-served once ready; until then, and on unindexed unslotted fields, they are a bounded scan \u2014 same results). A field with read_roles is omitted from end-user reads without a matching role and is never served on the public lane, so a missing key in an item's data may be a read gate rather than an unset value. Each collection row also carries end_user_access: 'readwrite' (default), 'read' (a verified end user \u2014 a thin-client key with a session \u2014 may read but every write answers 403 server_only), 'none' (end-user reads and writes are 403 server_only) or 'read_all' (a verified end user reads every row, past owner_field, and writes only their own), and write_roles: the roles a verified end user must hold to WRITE the collection (null = ungated; without one every end-user write answers 403 role_required, reads are unaffected); manager_roles: the roles whose verified holders manage an owned collection (get / list / count read every row, the single-item update may change another member's row under the collection's hooks; null = none); server keys are never affected. retain_days (null = keep) is the collection's retention: the nightly platform sweep soft-deletes live items created more than that many days ago. deleted_retain_days (null = 30) is how many days a deleted item stays restorable before the nightly cleanup purges it. on_owner_erase 'delete' (null = keep) means a GDPR erase of a user hard-deletes the items they own here. org_field (null = none) makes the collection workspace-scoped: a verified end user reads and writes only rows of the session's active org (no active org \u2192 403 org_required) and write_roles match the active-org role; org_read_roles (null = any member) gates reads by that role.",
     inputSchema: { type: "object", properties: {} },
     method: "GET",
     path: "/v1/cms/collections"
@@ -17428,7 +17558,7 @@ var TOOLS = [
     // Substrate tool (no `feature` — always-on like users_upsert): usage is a
     // platform property, not a feature you enable.
     name: "usage_current",
-    description: "Current-month usage for this project: requests used, the plan's included quota, remaining (null when the plan has no fixed cap), month-to-date per-feature metered detail (may lag \u2014 it is aggregated periodically), and `routes` \u2014 the same request count split by the surface that served it (the resolved upstream; /v1/fn/* reports as 'fn-invoke', busiest first, observational only), `files` (live private objects and bytes vs the storage `limit` uploads are held to \u2014 422 quota_exceeded at it) and `functions` (today's UTC call count vs the plan's `limit_per_day`, and on a Free staging/development project `cpu_ms_today` vs its `cpu_ms_limit_per_day` CPU budget \u2014 429 cpu_ms_per_day past it; a snapshot that can trail by a minute or two, null when there is no snapshot for today), and `daily_caps` \u2014 each daily lane of the plan (api_calls, App builder units, functions CPU, realtime, bandwidth, image transforms, and db_bytes \u2014 the database size measured nightly, over which cms creates and updates answer 413 db_size_limit) with `used` (null where not readable yet), `cap`, `resets_at` (null for db_bytes) and `state` ('warning' at 80 %, 'reached' at the cap), for the pool the caps count in (a Free account's projects share one). Read-only. Call this before a bulk run to self-check remaining quota: the Free tier is hard-capped (429 quota_exceeded when exhausted); paid tiers have no monthly cap and are never billed for overage. Needs usage:read or features:read.",
+    description: "Current-month usage for this project: requests used, the plan's included quota, remaining (null when the plan has no fixed cap), month-to-date per-feature metered detail (may lag \u2014 it is aggregated periodically), and `routes` \u2014 the same request count split by the surface that served it (the resolved upstream; /v1/fn/* reports as 'fn-invoke', busiest first, observational only), `files` (live private objects and bytes vs the storage `limit` uploads are held to \u2014 422 quota_exceeded at it) and `functions` (today's UTC call count vs the plan's `limit_per_day`, and `cpu_ms_today` (CPU-ms charged today, settled to measured CPU plus a small per-call dispatch overhead) vs `cpu_ms_limit_per_day`, the enforced daily CPU budget on every plan (Free production 150,000, a Free staging or development project 500,000, a paid project its plan row; null on Enterprise) \u2014 429 cpu_ms_per_day past it; a snapshot that can trail by a minute or two, null when there is no snapshot for today), and `daily_caps` \u2014 each daily lane of the plan (api_calls, App builder units, functions CPU, realtime, bandwidth, image transforms, and db_bytes \u2014 the database size measured nightly, over which cms creates and updates answer 413 db_size_limit) with `used` (null where not readable yet), `cap`, `resets_at` (null for db_bytes) and `state` ('warning' at 80 %, 'reached' at the cap), for the pool the caps count in (a Free account's projects share one). Read-only. Call this before a bulk run to self-check remaining quota: the Free tier is hard-capped (429 quota_exceeded when exhausted); paid tiers have no monthly cap and are never billed for overage. Needs usage:read or features:read.",
     inputSchema: { type: "object", properties: {} },
     method: "GET",
     path: "/v1/usage"
@@ -17486,7 +17616,7 @@ var TOOLS = [
   },
   {
     name: "config_put",
-    description: "Replace ONE feature's configuration with `body` (the whole manifest, as config_get returns it). DRY RUN BY DEFAULT: without `dry_run: false` nothing is written and the answer is the validated manifest and summary the write would produce, so preview first, then repeat with dry_run false. A real write needs `if_match` (the version from config_get) once the feature has a version; a stale one answers 409 config_version_conflict, so read again and retry. The answer is the server's own summary (new version, and for rate-limits, webhooks and ai the declared rows planned or applied) \u2014 nothing undeclared is deleted. Hooks named app_* belong to App builder apps: they are kept as stored, and a write that declares or changes one is refused (422 reserved_hook_name). cms `rules` (App builder rules): a body without it keeps them; adding one needs no ack, but removing or changing one is refused (422 rules_widening, naming the rules) unless allow_rule_removal is true \u2014 when you did not mean to remove them, read config_get again (your body is older than the app's rules). functions accepts only a logDrain change, with dry_run false. Needs features:write.",
+    description: "Replace ONE feature's configuration with `body` (the whole manifest, as config_get returns it). DRY RUN BY DEFAULT: without `dry_run: false` nothing is written and the answer is the validated manifest and summary the write would produce, so preview first, then repeat with dry_run false. A real write needs `if_match` (the version from config_get) once the feature has a version; a stale one answers 409 config_version_conflict, so read again and retry. The answer is the server's own summary (new version, and for rate-limits, webhooks and ai the declared rows planned or applied) \u2014 nothing undeclared is deleted. Hooks named app_* belong to App builder apps: they are kept as stored, and a write that declares or changes one is refused (422 reserved_hook_name). cms `rules` (App builder rules): a body without it keeps them; adding one needs no ack, but removing or changing one is refused (422 rules_widening, naming the rules) unless allow_rule_removal is true \u2014 when you did not mean to remove them, read config_get again (your body is older than the app's rules). functions accepts only a logDrain change, with dry_run false. webhooks `alerts` is the failure-alert digest ({ enabled, minLevel, digestMinutes }); `alerts.chatWebhook: { secret: \"<name>\" }` also posts each digest as { text } to a Google Chat, Slack or Teams Workflows webhook whose URL is stored as the webhooks secret <name> (PUT /v1/secrets/webhooks/<name>; the URL is never a config value, and only chat.googleapis.com, hooks.slack.com, *.webhook.office.com and *.logic.azure.com are posted to). A dry run (the default) needs features:read; a write (dry_run false) needs features:write.",
     inputSchema: {
       type: "object",
       properties: {
@@ -17907,6 +18037,10 @@ function collectSecretRefs(cfg) {
   if (typeof drainRef === "string" && drainRef.replace(/^secret:/, "")) {
     add({ name: drainRef.replace(/^secret:/, ""), feature: "functions", via: "features.functions.logDrain.secretRef" });
   }
+  const chatRef = cfg.features?.webhooks?.alerts?.chatWebhook?.secret;
+  if (typeof chatRef === "string" && chatRef.replace(/^secret:/, "")) {
+    add({ name: chatRef.replace(/^secret:/, ""), feature: "webhooks", via: "features.webhooks.alerts.chatWebhook.secret" });
+  }
   for (const [fn, def] of Object.entries(cfg.functions ?? {})) {
     for (const ref of normalizeSecretRefs(def.secrets)) {
       const bare = ref.slice("secret:".length);
@@ -17965,6 +18099,10 @@ function unstoredSecretVerdict(opts) {
   if (opts.ignored) return "ignored";
   return opts.strict ? "drift" : "informational";
 }
+var SECRETS_NOT_COMPARED_LINE = "  ! not compared: secrets (needs features:read or secrets:write)";
+function secretsListRefusal(opts) {
+  return opts.status === 403 && opts.code === "insufficient_scope" && !opts.strict ? "skip" : "error";
+}
 function platformOnlyFnVerdict(opts) {
   if (opts.ignored) return "ignored";
   return opts.gate && !opts.strict ? "informational" : "drift";
@@ -18265,6 +18403,18 @@ function devSlotExpiryCheck(dev, now) {
     detail: `'${dev.slug}' expires ${dev.expires_at} (in ${hours}h)` + (hours < 72 ? " \u2014 run `vxil dev up` to extend" : "")
   };
 }
+function dashboardSessionCheck(creds, now) {
+  const name = "dashboard session";
+  if (!creds.session) return { name, ok: true, detail: "no session \u2014 `vxil login` signs in (only session verbs such as `vxil keys` need one)" };
+  const host = creds.session_host ? ` \xB7 bound to ${creds.session_host}` : " \xB7 no recorded host (run `vxil login` again to bind it)";
+  const who = creds.session_account ?? "(account not recorded by the CLI that signed in \u2014 `vxil account show` names it)";
+  const exp = creds.session_expires_at ? new Date(creds.session_expires_at) : null;
+  if (exp && !Number.isNaN(exp.getTime()) && exp.getTime() <= now.getTime()) {
+    return { name, ok: true, warn: true, detail: `${who} \xB7 expired ${exp.toISOString().slice(0, 16).replace("T", " ")} UTC${host} \u2014 \`vxil login\` again` };
+  }
+  const when2 = exp && !Number.isNaN(exp.getTime()) ? `expires ${exp.toISOString().slice(0, 16).replace("T", " ")} UTC` : "expiry not recorded";
+  return { name, ok: true, detail: `${who} \xB7 ${when2}${host}` };
+}
 
 // src/keys.ts
 init_src3();
@@ -18561,9 +18711,9 @@ function renderInvites(l) {
 
 // src/configDrafts.ts
 init_lib();
-var enc = encodeURIComponent;
+var enc2 = encodeURIComponent;
 async function showDraft(api, feature) {
-  const r = await api("GET", `/v1/config/${enc(feature)}/draft`);
+  const r = await api("GET", `/v1/config/${enc2(feature)}/draft`);
   if (r.status === 404) return { none: true };
   if (r.status !== 200) throw new Error(`could not read the ${feature} draft (${apiErrText(r)})`);
   const d = r.body.data ?? {};
@@ -18574,7 +18724,7 @@ async function showDraft(api, feature) {
     ...d.applied_by ? { applied_by: d.applied_by } : {},
     ...d.created_at ? { created_at: d.created_at } : {}
   };
-  const cur = await api("GET", `/v1/config/${enc(feature)}`);
+  const cur = await api("GET", `/v1/config/${enc2(feature)}`);
   if (cur.status !== 200 && cur.status !== 404) {
     throw new Error(`could not read the active ${feature} config to compare (${apiErrText(cur)})`);
   }
@@ -18583,12 +18733,12 @@ async function showDraft(api, feature) {
   return { draft, activeVersion, changes: diffManifest(active, draft.manifest) };
 }
 async function saveDraft(api, feature, manifest) {
-  const r = await api("PUT", `/v1/config/${enc(feature)}/draft`, manifest);
+  const r = await api("PUT", `/v1/config/${enc2(feature)}/draft`, manifest);
   if (r.status !== 200) throw new Error(`draft not saved (${apiErrText(r)})`);
   return { feature, manifest: r.body.data?.manifest ?? manifest };
 }
 async function publishDraft(api, feature) {
-  const r = await api("POST", `/v1/config/${enc(feature)}/draft/publish`);
+  const r = await api("POST", `/v1/config/${enc2(feature)}/draft/publish`);
   if (r.status === 404) throw new Error(`no ${feature} draft to publish \u2014 \`vxil config draft save ${feature}\` stages one`);
   if (r.status !== 200) throw new Error(`draft not published (${apiErrText(r)})`);
   const d = r.body.data ?? {};
@@ -18599,7 +18749,7 @@ async function publishDraft(api, feature) {
   };
 }
 async function discardDraft(api, feature) {
-  const r = await api("DELETE", `/v1/config/${enc(feature)}/draft`);
+  const r = await api("DELETE", `/v1/config/${enc2(feature)}/draft`);
   if (r.status === 404) return { discarded: false };
   if (r.status !== 200) throw new Error(`draft not discarded (${apiErrText(r)})`);
   return { discarded: true };
@@ -18611,7 +18761,7 @@ function parseVersion(raw) {
   return { version: Number(raw) };
 }
 async function duplicateToDraft(api, feature, version) {
-  const r = await api("POST", `/v1/config/${enc(feature)}/versions/${version}/duplicate`);
+  const r = await api("POST", `/v1/config/${enc2(feature)}/versions/${version}/duplicate`);
   if (r.status === 404) throw new Error(`${feature} has no published version ${version} \u2014 \`vxil versions ${feature}\` lists them`);
   if (r.status !== 200) throw new Error(`could not copy version ${version} into a draft (${apiErrText(r)})`);
   return {
@@ -19404,7 +19554,9 @@ function serverApplyErrorJson(input) {
   return {
     ok: false,
     exit_code: input.exitCode,
-    apply_id: null,
+    // a run that planned but lost the execute answer
+    // (and could not read the journal back) still names its apply
+    apply_id: input.applyId ?? null,
     status: null,
     steps: [],
     trigger_wiring: null,
@@ -20653,7 +20805,7 @@ async function loadCmsTable({
   let patched = 0;
   let unhashed = 0;
   let unhashedSame = 0;
-  const enc2 = encodeURIComponent(collection);
+  const enc3 = encodeURIComponent(collection);
   const start = cursors[key] ?? void 0;
   const tsCols = keepTimestamps ? sourceTimestampColumns(mapping) : {};
   if (keepTimestamps && tsCols.created === void 0) {
@@ -20707,7 +20859,7 @@ async function loadCmsTable({
                 patched++;
                 continue;
               }
-              const cur = await deps.api("GET", `/v1/cms/items/${enc2}/${encodeURIComponent(existing)}`);
+              const cur = await deps.api("GET", `/v1/cms/items/${enc3}/${encodeURIComponent(existing)}`);
               const stored = cur.status === 200 ? cur.body.data?.data : void 0;
               if (holdsContent(stored, item, storageTargets)) {
                 hashes[sourceId] = h;
@@ -20723,7 +20875,7 @@ async function loadCmsTable({
               patched++;
               continue;
             }
-            const res2 = await deps.api("PATCH", `/v1/cms/items/${enc2}/${encodeURIComponent(existing)}`, { data: item.full });
+            const res2 = await deps.api("PATCH", `/v1/cms/items/${enc3}/${encodeURIComponent(existing)}`, { data: item.full });
             if (res2.status === 200) {
               hashes[sourceId] = h;
               noteStorage(sourceId, row2);
@@ -20744,7 +20896,7 @@ async function loadCmsTable({
           }
           if (deps.dryRun) continue;
           const srcTs = keepTimestamps ? sourceTimestampsOf(row2, tsCols) : void 0;
-          const res = await deps.api("POST", `/v1/cms/items/${enc2}`, {
+          const res = await deps.api("POST", `/v1/cms/items/${enc3}`, {
             data: item.create,
             status: itemStatus,
             ...srcTs ? { source_timestamps: srcTs } : {}
@@ -20766,7 +20918,7 @@ async function loadCmsTable({
           const createdVal = dedupeField ? item.create[dedupeField.target] : void 0;
           if (res.status === 409 && res.body.error?.code === "unique_violation" && dedupeField && createdVal !== void 0) {
             const filter = encodeURIComponent(JSON.stringify({ [dedupeField.target]: createdVal }));
-            const q = await deps.api("GET", `/v1/cms/items/${enc2}?filter=${filter}&limit=1`);
+            const q = await deps.api("GET", `/v1/cms/items/${enc3}?filter=${filter}&limit=1`);
             const items = q.body.data?.items ?? [];
             if (q.status === 200 && items.length > 0 && typeof items[0].item_id === "string") {
               idMap[sourceId] = items[0].item_id;
@@ -21308,7 +21460,7 @@ async function loadFiles({ deps, plan, adapter, state, save, filesOwner, filesOr
     const itmMap = state.idMap[table] ?? {};
     const linked = hashesFor(state, rk);
     const pk = sourcePkColumn(mapping);
-    const enc2 = encodeURIComponent(mapping.collection);
+    const enc3 = encodeURIComponent(mapping.collection);
     let misses = 0;
     let privateUrls = 0;
     const columns = [pk, ...storageFields.map((f) => f.source)];
@@ -21354,7 +21506,7 @@ async function loadFiles({ deps, plan, adapter, state, save, filesOwner, filesOr
           }
           continue;
         }
-        const res = await deps.api("PATCH", `/v1/cms/items/${enc2}/${encodeURIComponent(itm)}`, { data: patch });
+        const res = await deps.api("PATCH", `/v1/cms/items/${enc3}/${encodeURIComponent(itm)}`, { data: patch });
         if (res.status !== 200) {
           result.errors.push(apiErrorLine(`files relink ${table} row '${sourceId}' (item ${itm})`, res));
           if (result.errors.length >= ROW_FAILURE_CAP) {
@@ -21617,7 +21769,7 @@ async function loadVectors({ deps, plan, target, adapter, state, save, delta })
   const pk = sourcePkColumn(mapping);
   const idMap = state.idMap[target.table] ?? {};
   const ingested = hashesFor(state, key);
-  const enc2 = encodeURIComponent(target.collection);
+  const enc3 = encodeURIComponent(target.collection);
   let noText = 0;
   let noItem = 0;
   const opts = {
@@ -21648,7 +21800,7 @@ async function loadVectors({ deps, plan, target, adapter, state, save, delta })
         } else if (doc.why === "no-text") noText++;
         result.skipped++;
         if (ingested[sourceId] !== void 0 && !deps.dryRun) {
-          const del = await deps.api("DELETE", `/v1/search/${enc2}/documents/${encodeURIComponent(docId)}`);
+          const del = await deps.api("DELETE", `/v1/search/${enc3}/documents/${encodeURIComponent(docId)}`);
           if (del.status === 200 || del.status === 404) delete ingested[sourceId];
         }
         if (result.errors.length >= ROW_FAILURE_CAP) break;
@@ -21660,7 +21812,7 @@ async function loadVectors({ deps, plan, target, adapter, state, save, delta })
         continue;
       }
       if (deps.dryRun) continue;
-      const res = await deps.api("POST", `/v1/search/${enc2}/documents`, {
+      const res = await deps.api("POST", `/v1/search/${enc3}/documents`, {
         doc_id: docId,
         chunks: [{ content: text, vector }],
         metadata: {}
@@ -26143,10 +26295,15 @@ function noKeyMessage(t) {
   if (t.slot === "named") return `no API key stored for target '${t.slotName}' (tenant '${t.tenantSlug}') \u2014 re-run \`vxil link ${t.tenantSlug} --as ${t.slotName}\``;
   return "no API key \u2014 run `vxil quickstart` or `vxil link <slug>`, or set VXIL_API_KEY";
 }
-function storeSession(cookie, dashBase) {
+function storeSession(cookie, dashBase, account, setCookie) {
   const creds = loadCredentials();
   creds.session = cookie;
   creds.session_host = dashboardOrigin(dashBase);
+  const expires = sessionExpiryFrom(setCookie, /* @__PURE__ */ new Date());
+  if (account) creds.session_account = account;
+  else delete creds.session_account;
+  if (expires) creds.session_expires_at = expires;
+  else delete creds.session_expires_at;
   saveCredentials(creds);
 }
 function sessionForTarget(dashBase) {
@@ -26183,7 +26340,7 @@ async function interactiveLogin(dash, dashBase) {
   const cookie = r.cookie?.split(";")[0];
   if (!cookie) fail("login succeeded but returned no session cookie");
   if (mustPrompt) {
-    storeSession(cookie, dashBase);
+    storeSession(cookie, dashBase, e, r.cookie);
     console.error(`\u2713 signed in \u2014 session stored in ~/.vxil/credentials.json (for ${dashboardOrigin(dashBase)})`);
   }
   return cookie;
@@ -26594,7 +26751,9 @@ async function runApply(apply, sel = "prod", opts = {}) {
   const skipFunctions = hasFlag("skip-functions");
   if (declaredFns.length && !skipFunctions && !gate) {
     const ent = await probeFunctionsEntitlement(api, declaredFns[0]);
-    if (!ent.entitled) {
+    if (!apply && entitlementNotProbed(ent)) {
+      console.error(DEPLOY_ENTITLEMENT_NOT_PROBED);
+    } else if (!ent.entitled) {
       const msg = formatFunctionsPreflight(ent, {
         declared: declaredFns.length,
         baseUrl: target.baseUrl,
@@ -26877,9 +27036,13 @@ functions: skipped (--skip-functions) \u2014 ${declaredFns.length} declared func
       const res = await api("GET", "/v1/secrets");
       console.log("\nsecrets (names only \u2014 values are never read or compared):");
       if (res.status !== 200) {
+        if (secretsListRefusal({ status: res.status, ...res.body.error?.code ? { code: res.body.error.code } : {}, strict: strictSecrets }) === "skip") {
+          console.log(SECRETS_NOT_COMPARED_LINE);
+          return;
+        }
         notCompared(
           { route: "GET /v1/secrets", status: res.status, ...res.body.error?.code ? { code: res.body.error.code } : {}, ...res.body.error?.message ? { message: res.body.error.message } : {} },
-          "needs features:write, secrets:write or admin"
+          "needs features:read, secrets:write or admin"
         );
         return;
       }
@@ -27122,9 +27285,21 @@ ${formatTriggerWiring(w).join("\n")}`);
       say(formatApplySteps(plan.steps));
       for (const w of plan.warnings ?? []) say(`  ! ${w}`);
       say("\napplying server-side\u2026");
+    },
+    // a transport error on execute reads the journal back
+    poll: { onWait: say }
+  }).catch((e) => {
+    if (e instanceof ApplyUnreadError && jsonOut) {
+      jsonFailDoc = (error, exitCode) => JSON.stringify(serverApplyErrorJson({ error, exitCode, applyId: e.applyId }));
     }
+    throw e;
   });
-  for (let attempt = 1; done.status === "running" && onlyPropagationDeferred(done.steps) && attempt <= CMS_PROPAGATION_ATTEMPTS; attempt++) {
+  if (done.polled && (done.status === "running" || done.status === "planned")) {
+    report(done, false);
+    const problems2 = { hard: [], strict: [] };
+    return finish(done, problems2, 1, `apply ${done.apply_id} is still ${done.status} after the execute answer was lost in transport \u2014 it was NOT resumed automatically; check it with \`vxil api GET /v1/apply/${done.apply_id}\`, then resume with: vxil push --server --resume ${done.apply_id}`);
+  }
+  for (let attempt = 1; !done.polled && done.status === "running" && onlyPropagationDeferred(done.steps) && attempt <= CMS_PROPAGATION_ATTEMPTS; attempt++) {
     if (attempt === 1) report(done, false);
     say(`  \u2026 deferred: the feature config is still propagating \u2014 waiting ${CMS_PROPAGATION_DELAY_MS / 1e3} s, then resuming the same apply (${attempt}/${CMS_PROPAGATION_ATTEMPTS})`);
     await new Promise((r) => setTimeout(r, CMS_PROPAGATION_DELAY_MS));
@@ -27384,6 +27559,7 @@ async function runDoctor() {
       detail: t.apiKey ? `${t.slot === "named" ? `target '${t.slotName}'` : t.slot === "dev" ? "dev slot" : t.slot === "env" ? "VXIL_API_KEY (no project binding)" : "primary"} \u2192 tenant '${t.tenantSlug ?? "(unknown slug)"}' \xB7 ${t.envLabel} \xB7 ${t.baseUrl} \xB7 key from ${t.keySource}` : noKeyMessage(t)
     });
   }
+  checks.push(dashboardSessionCheck(loadCredentials(), /* @__PURE__ */ new Date()));
   const proj = loadProject();
   if (proj) {
     const slots = bindingSlots(proj).map((s) => `${s.label}=${s.slug}`);
@@ -27443,7 +27619,7 @@ async function runDoctor() {
         checks.push(...secretsChecks(collectSecretRefs(cfg), sres.body.data?.secrets ?? []));
       } else {
         const e = sres.body.error ?? {};
-        checks.push({ name: "secrets", ok: true, warn: true, detail: `not compared: GET /v1/secrets \u2192 ${e.code ?? sres.status} (names-only read; needs features:write, secrets:write or admin)` });
+        checks.push({ name: "secrets", ok: true, warn: true, detail: `not compared: GET /v1/secrets \u2192 ${e.code ?? sres.status} (names-only read; needs features:read, secrets:write or admin)` });
       }
     }
     if (cfg?.functions && Object.keys(cfg.functions).length) {
@@ -27810,7 +27986,7 @@ try {
       if (r.status !== 200) fail(`login failed: ${r.status} ${JSON.stringify(r.json).slice(0, 160)}`);
       const cookie = r.cookie?.split(";")[0];
       if (!cookie) fail("login succeeded but returned no session cookie");
-      storeSession(cookie, dash);
+      storeSession(cookie, dash, email, r.cookie);
       console.log(`\u2713 logged in \u2014 session stored in ~/.vxil/credentials.json (bound to ${dashboardOrigin(dash)}; it is only ever sent there)`);
       break;
     }
@@ -28087,6 +28263,8 @@ try {
       }
       delete creds.session;
       delete creds.session_host;
+      delete creds.session_account;
+      delete creds.session_expires_at;
       saveCredentials(creds);
       if (!host) {
         console.error("vxil: the stored session had no recorded dashboard host (written by an older CLI), so it was not sent anywhere to be revoked \u2014 it was removed from this machine and expires on its own");
@@ -28721,7 +28899,7 @@ ${plan.rationale}`);
           const rows = res.body.data?.secrets ?? [];
           if (!rows.length) console.log("(no secrets stored)");
           for (const r of rows) {
-            console.log(`  ${r.feature}/${r.secret_name}  (ref secret:${r.secret_name} \xB7 rotated ${r.rotated_at})`);
+            console.log(`  ${r.feature}/${r.secret_name}  (ref secret:${r.secret_name}${r.rotated_at ? ` \xB7 rotated ${r.rotated_at}` : ""})`);
           }
         }
       } else if (sub === "rm") {
@@ -29593,7 +29771,7 @@ async function runSecretsMatrix() {
     }
     const secrets = res.body.data?.secrets ?? [];
     for (const r of secrets) {
-      rows.push({ slug: s.slug, slot: s.label, feature: r.feature, secret_name: r.secret_name, rotated_at: r.rotated_at, ...r.kek_version !== void 0 ? { kek_version: r.kek_version } : {} });
+      rows.push({ slug: s.slug, slot: s.label, feature: r.feature, secret_name: r.secret_name, rotated_at: r.rotated_at ?? "-", ...r.kek_version !== void 0 ? { kek_version: r.kek_version } : {} });
     }
     tenants.push({ slug: s.slug, slot: s.label, edge, status: "ok", count: secrets.length });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/cli",
-  "version": "0.33.0",
+  "version": "0.35.0",
   "private": false,
   "description": "The vxil CLI — init, quickstart, push, gen, secrets, keys, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",
@@ -45,8 +45,8 @@
     }
   },
   "devDependencies": {
-    "@vxil/config": "0.25.0",
-    "@vxil/feature-configs": "0.23.0",
+    "@vxil/config": "0.26.0",
+    "@vxil/feature-configs": "0.23.1",
     "@vxil/runtime": "0.0.1",
     "@vxil/types": "0.0.1",
     "miniflare": "^4.20260730.0"