@vxil/cli 0.36.0 → 0.36.1

package/dist/_vxil-feature-configs.d.ts

@@ -73,6 +73,24 @@ export declare const SNS_TOPIC_ARN_PATTERN = "^arn:aws(-[a-z]+)?:sns:[a-z0-9-]+:
  * a list so a newly launched SES region needs no vxil release; a typo still
  * fails at `vxil push` (TypeBox), never as a DNS error on the first send. */
 export declare const SES_REGION_PATTERN = "^[a-z]{2}(-[a-z]+)+-\\d$";
+/** (w45 W44-WEBHOOK-SECRETREF-PATTERN) the ONE pattern every webhook secret
+ *  ref shares (notifications `webhookSecretRef`, payments `stripe` / `paddle`
+ *  / `revenuecat` `webhookSecretRef`): a secret-store name, letters, digits or
+ *  '_', at most 64, with the optional `secret:` prefix both resolvers strip
+ *  (payments-v1 resolveProviderSecrets, notifications-v1
+ *  resolveTenantSecretRef). Stored secret names are lowercase-only
+ *  (control-plane SECRET_NAME_RE), so both resolvers LOWERCASE the name after
+ *  the strip: a capital ref reads its lowercase row. Upper case is accepted
+ *  (founder decision D-k2-1 option (a), parked; built per the w45 brief) so
+ *  this pattern refuses no stored config: the w45 read-only count found
+ *  stored refs with capitals on staging, which never resolved before the
+ *  lowercasing (so they were not live). A typo shape (a space, '-', '.', a
+ *  path, an empty or over-long name) is refused at push instead of failing
+ *  closed only when a webhook arrives. */
+export declare const WEBHOOK_SECRET_REF_PATTERN = "^(secret:)?[A-Za-z0-9_]{1,64}$";
+/** The validator's message for a ref that misses WEBHOOK_SECRET_REF_PATTERN
+ *  (TypeBox's own reads "Expected string to match '…'"). */
+export declare const WEBHOOK_SECRET_REF_MESSAGE = "a secret ref is the name of a stored secret: lowercase letters, numbers or '_' (capitals are read as lowercase), at most 64 characters, optionally prefixed 'secret:'";
 export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     fromEmail: import("@sinclair/typebox").TString;
@@ -834,6 +852,7 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
         webhookSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         acceptSandbox: import("@sinclair/typebox").TBoolean;
         sandboxUsers: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        testStore: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"accept">, import("@sinclair/typebox").TLiteral<"reject">]>>;
     }>>;
     paypal: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         clientIdRef: import("@sinclair/typebox").TString;

package/dist/vxil-main.js

@@ -5322,7 +5322,7 @@ function isDeclaredOnOwnerErase(v) {
 function onOwnerEraseWidens(declared, remote) {
   return declared === "delete" && remote !== "delete";
 }
-var FN_RETRY_MAX_ATTEMPTS, FN_FORWARD_HEADERS_MAX, FN_SERVER_SCOPES_MAX, NOTIF_OVERRIDE_SUBJECT_MAX, NOTIF_OVERRIDE_BODY_MAX, NOTIF_OVERRIDE_MAX_BYTES, SNS_TOPIC_ARN_PATTERN, SES_REGION_PATTERN, NotificationsConfigSchema, GENERATION_DEFAULTS, GENERATION_BOUNDS, JobsConfigSchema, OAuthRefsSchema, AppleRefsSchema, OidcProviderSchema, REDIRECT_ORIGIN_PATTERN, AuthConfigSchema, RL_POLICY_NAME_PATTERN, RL_MAX_DECLARED_POLICIES, DeclaredRlPolicySchema, RateLimitsConfigSchema, FilesConfigSchema, DeclaredWebhookSubscriptionSchema, WebhooksConfigSchema, CommentsConfigSchema, CMS_MAX_COLLECTIONS_CEILING, CMS_QUERY_DEFAULTS, CmsConfigSchema, McpConfigSchema, RealtimeConfigSchema, PresenceConfigSchema, DeclaredOrgRoleSchema, OrgsConfigSchema, ActivityFeedConfigSchema, SEARCH_COLLECTION_DECLARED_CAP, SEARCH_COLLECTION_DIMS, DeclaredSearchCollectionSchema, HybridLaneWeights, VectorSearchConfigSchema, AI_TEMPLATE_NAME_PATTERN, AI_MAX_DECLARED_TEMPLATES, DeclaredAiTemplateSchema, AiConfigSchema, RagConfigSchema, PaymentsConfigSchema, FunctionsConfigSchema, CopilotConfigSchema, DENY_FUNCTION_SCOPES, FEATURE_KEYS, CMS_RETAIN_DAYS_MAX, CMS_DELETED_RETAIN_DAYS_MAX, CMS_DELETED_RETAIN_DAYS_DEFAULT;
+var FN_RETRY_MAX_ATTEMPTS, FN_FORWARD_HEADERS_MAX, FN_SERVER_SCOPES_MAX, NOTIF_OVERRIDE_SUBJECT_MAX, NOTIF_OVERRIDE_BODY_MAX, NOTIF_OVERRIDE_MAX_BYTES, SNS_TOPIC_ARN_PATTERN, SES_REGION_PATTERN, WEBHOOK_SECRET_REF_PATTERN, webhookSecretRef, NotificationsConfigSchema, GENERATION_DEFAULTS, GENERATION_BOUNDS, JobsConfigSchema, OAuthRefsSchema, AppleRefsSchema, OidcProviderSchema, REDIRECT_ORIGIN_PATTERN, AuthConfigSchema, RL_POLICY_NAME_PATTERN, RL_MAX_DECLARED_POLICIES, DeclaredRlPolicySchema, RateLimitsConfigSchema, FilesConfigSchema, DeclaredWebhookSubscriptionSchema, WebhooksConfigSchema, CommentsConfigSchema, CMS_MAX_COLLECTIONS_CEILING, CMS_QUERY_DEFAULTS, CmsConfigSchema, McpConfigSchema, RealtimeConfigSchema, PresenceConfigSchema, DeclaredOrgRoleSchema, OrgsConfigSchema, ActivityFeedConfigSchema, SEARCH_COLLECTION_DECLARED_CAP, SEARCH_COLLECTION_DIMS, DeclaredSearchCollectionSchema, HybridLaneWeights, VectorSearchConfigSchema, AI_TEMPLATE_NAME_PATTERN, AI_MAX_DECLARED_TEMPLATES, DeclaredAiTemplateSchema, AiConfigSchema, RagConfigSchema, PaymentsConfigSchema, FunctionsConfigSchema, CopilotConfigSchema, DENY_FUNCTION_SCOPES, FEATURE_KEYS, CMS_RETAIN_DAYS_MAX, CMS_DELETED_RETAIN_DAYS_MAX, CMS_DELETED_RETAIN_DAYS_DEFAULT;
 var init_src = __esm({
   "../feature-configs/src/index.ts"() {
     "use strict";
@@ -5354,6 +5354,8 @@ var init_src = __esm({
     NOTIF_OVERRIDE_MAX_BYTES = 64 * 1024;
     SNS_TOPIC_ARN_PATTERN = "^arn:aws(-[a-z]+)?:sns:[a-z0-9-]+:\\d{12}:[A-Za-z0-9_-]{1,256}$";
     SES_REGION_PATTERN = "^[a-z]{2}(-[a-z]+)+-\\d$";
+    WEBHOOK_SECRET_REF_PATTERN = "^(secret:)?[A-Za-z0-9_]{1,64}$";
+    webhookSecretRef = () => Type.String({ pattern: WEBHOOK_SECRET_REF_PATTERN });
     NotificationsConfigSchema = Type.Object({
       enabled: Type.Boolean({ default: true }),
       fromEmail: Type.String({ format: "email" }),
@@ -5369,7 +5371,7 @@ var init_src = __esm({
       // instead of the platform-wide PROVIDER_WEBHOOK_SECRET, binding the signature
       // to the tenant so a signed event for tenant A can never validate at tenant
       // B's webhook URL (mirrors payments revenuecat.webhookSecretRef).
-      webhookSecretRef: Type.Optional(Type.String()),
+      webhookSecretRef: Type.Optional(webhookSecretRef()),
       // 'mock' exists for staging/e2e (deterministic provider); 'resend' is MVP;
       // 'ses' (2026-09-19) is the second real provider — Amazon SES v2, BYO IAM
       // keys, same delivery/suppression/preference pipeline as resend.
@@ -6722,12 +6724,12 @@ var init_src = __esm({
       // "configure it or not", not each inner ref — guide ch. 6, auth).
       stripe: Type.Optional(Type.Object({
         secretKeyRef: Type.String(),
-        webhookSecretRef: Type.String(),
+        webhookSecretRef: webhookSecretRef(),
         taxEnabled: Type.Boolean({ default: false })
       })),
       paddle: Type.Optional(Type.Object({
         apiKeyRef: Type.String(),
-        webhookSecretRef: Type.String(),
+        webhookSecretRef: webhookSecretRef(),
         sandbox: Type.Boolean({ default: false })
       })),
       revenuecat: Type.Optional(Type.Object({
@@ -6743,7 +6745,7 @@ var init_src = __esm({
         // verification, it fails CLOSED: every delivery is 401 bad_signature with a
         // `sig_failed` row that can never be reprocessed. Mirrors stripe/paddle
         // webhookSecretRef.
-        webhookSecretRef: Type.Optional(Type.String()),
+        webhookSecretRef: Type.Optional(webhookSecretRef()),
         // Environment integrity. RevenueCat posts SANDBOX
         // and PRODUCTION events to the SAME webhook with the same auth header, so a
         // sandbox purchase would otherwise fold into production entitlements. A
@@ -6761,7 +6763,19 @@ var init_src = __esm({
         // TestFlight purchase and is refused by the CLI's production promotion
         // gate). No default on purpose (Value.Default would materialize it into
         // every RC manifest); absent = an empty list.
-        sandboxUsers: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 256 }), { maxItems: 20 }))
+        sandboxUsers: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 256 }), { maxItems: 20 })),
+        // (2026-11-03) RevenueCat Test Store purchases.
+        // A Test Store purchase is SANDBOX data that needs no store account,
+        // invite or license tester (anyone with the app's public `test_` key can
+        // make one), so `acceptSandbox: true` on a production project would fold
+        // it. 'reject' refuses every delivery whose RAW RevenueCat event says
+        // `store: TEST_STORE` (and every sync/restore snapshot from the Test
+        // Store) BEFORE any other environment rule, `sandboxUsers` included: the
+        // delivery is kept as outcome 'rejected_test_store' (200, never folded).
+        // Absent = 'accept' (today's behaviour). No schema default on purpose
+        // (the sandboxUsers rule: Value.Default would materialize it into every RC
+        // manifest); the reader (payments-v1 environmentAccepted) owns the default.
+        testStore: Type.Optional(Type.Union([Type.Literal("accept"), Type.Literal("reject")]))
       })),
       paypal: Type.Optional(Type.Object({
         clientIdRef: Type.String(),
@@ -9031,9 +9045,9 @@ var init_lib = __esm({
       timeoutMs: { min: 1e3, max: 12e4 }
     };
     CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-    VXIL_CONFIG_PKG_VERSION = "0.26.1";
-    VXIL_SDK_PKG_VERSION = "0.35.2";
-    VXIL_CLI_PKG_VERSION = "0.36.0";
+    VXIL_CONFIG_PKG_VERSION = "0.27.0";
+    VXIL_SDK_PKG_VERSION = "0.35.3";
+    VXIL_CLI_PKG_VERSION = "0.36.1";
     SCAFFOLD_NODE_TYPES_RANGE = "^24.0.0";
     SCAFFOLD_TSCONFIG = {
       compilerOptions: {
@@ -13341,7 +13355,7 @@ function promotionRefusals(cfg, allowed) {
     out.push({
       kind: "sandbox",
       flag: PROMOTION_OVERRIDE_FLAGS.sandbox,
-      message: `sandbox provider flags [${sandboxes.join(", ")}] would ship to a live money path (a sandbox key signs with the wrong secret; revenuecat.acceptSandbox folds EVERY TestFlight / test-track purchase into live entitlements \u2014 for store review, list the reviewer app_user_ids in revenuecat.sandboxUsers instead, which a production push allows). Set them false, or override with --${PROMOTION_OVERRIDE_FLAGS.sandbox}.`
+      message: `sandbox provider flags [${sandboxes.join(", ")}] would ship to a live money path (a sandbox key signs with the wrong secret; revenuecat.acceptSandbox folds EVERY TestFlight / test-track purchase into live entitlements \u2014 for store review, list the reviewer app_user_ids in revenuecat.sandboxUsers instead, which a production push allows; if you override it for testers, also set revenuecat.testStore: 'reject', or anyone with the Test Store key folds a purchase). Set them false, or override with --${PROMOTION_OVERRIDE_FLAGS.sandbox}.`
     });
   }
   const devOrigins = devRedirectOrigins(redirectOrigins(cfg));
@@ -17505,13 +17519,13 @@ var TOOLS = [
   {
     name: "payments_list_webhook_events",
     feature: "payments",
-    description: "List provider webhook deliveries from the event log, newest-first: outcome (received|processed|error|sig_failed|parse_failed|reprocessed|ignored|unowned|rejected_environment), the provider-reported environment (production|sandbox), signature status, error, and timestamps per delivery. Use it to diagnose billing sync issues (e.g. an unmapped price or product, or a RevenueCat entitlement id that is not a ledger.tierMap key (with no ledger.priceMap hit) \u2192 outcome error, a misconfigured webhook secret producing sig_failed rows, sandbox deliveries landing as rejected_environment). An unmapped one-off product lands `error` unless you set ledger.unmappedProduct:'ignore', which lands it `ignored` instead. Read-only \u2014 needs payments:read. Server-side key only (403 server_only on a thin-client/end-user key) \u2014 the log is tenant-wide and carries provider payloads. Payloads are detail-only (console surface).",
+    description: "List provider webhook deliveries from the event log, newest-first: outcome (received|processed|error|sig_failed|parse_failed|reprocessed|ignored|unowned|rejected_environment|rejected_test_store), the provider-reported environment (production|sandbox), signature status, error, and timestamps per delivery. Use it to diagnose billing sync issues (e.g. an unmapped price or product, or a RevenueCat entitlement id that is not a ledger.tierMap key (with no ledger.priceMap hit) \u2192 outcome error, a misconfigured webhook secret producing sig_failed rows, sandbox deliveries landing as rejected_environment, RevenueCat Test Store purchases refused under revenuecat.testStore 'reject' landing as rejected_test_store). An unmapped one-off product lands `error` unless you set ledger.unmappedProduct:'ignore', which lands it `ignored` instead. Read-only \u2014 needs payments:read. Server-side key only (403 server_only on a thin-client/end-user key) \u2014 the log is tenant-wide and carries provider payloads. Payloads are detail-only (console surface).",
     inputSchema: {
       type: "object",
       properties: {
         provider: { type: "string", enum: ["mock", "stripe", "paddle", "revenuecat", "paypal"] },
         event_type: { type: "string", description: "Exact event type filter, e.g. 'subscription.updated'." },
-        outcome: { type: "string", enum: ["received", "processed", "error", "sig_failed", "parse_failed", "reprocessed", "ignored", "unowned", "rejected_environment"] },
+        outcome: { type: "string", enum: ["received", "processed", "error", "sig_failed", "parse_failed", "reprocessed", "ignored", "unowned", "rejected_environment", "rejected_test_store"] },
         environment: { type: "string", enum: ["production", "sandbox"], description: "The provider-reported environment of the delivery (a separate axis from the API key label)." },
         provider_charge_id: { type: "string", maxLength: 200, description: "Exact match on the normalised charge id (the same provider_charge_id a payments.charge.* event carries): the delivery that recorded that charge plus any refund/dispute against it \u2014 usually one row, so ONE detail read (GET /v1/payments/webhook-events/{eventId}) fetches the verified payload. Rows received before 2026-09-19 carry no charge id." },
         provider_evt_id: { type: "string", maxLength: 200, description: "Exact match on the provider's own event id (the provider_evt_id every row shows)." },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/cli",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "private": false,
   "description": "The vxil CLI — init, quickstart, push, gen, secrets, keys, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",
@@ -45,8 +45,8 @@
     }
   },
   "devDependencies": {
-    "@vxil/config": "0.26.1",
-    "@vxil/feature-configs": "0.23.2",
+    "@vxil/config": "0.27.0",
+    "@vxil/feature-configs": "0.24.0",
     "@vxil/runtime": "0.0.1",
     "@vxil/types": "0.0.1",
     "miniflare": "^4.20260730.0"