@vxil/cli 0.4.0 → 0.4.2

package/README.md

@@ -1,6 +1,6 @@
-# vxil
+# @vxil/cli
 
-The [Vxil](https://vxil.com) CLI — config-as-code for backend building blocks you enable in one line.
+The [Vxil](https://vxil.com) CLI — config-as-code for backend building blocks you enable in one line. The package is `@vxil/cli` and it installs the `vxil` command — the bare `vxil` name on npm is blocked, so always install the scoped package.
 
 ```bash
 npx @vxil/cli quickstart          # create a tenant + scaffold vxil.config.ts
@@ -9,24 +9,46 @@ npx @vxil/cli gen                 # generate a typed client + MCP manifest for Y
 npx @vxil/cli functions dev fn    # run a tenant function locally against the remote edge
 npx @vxil/cli listen --forward-to localhost:3000/webhook   # forward inbound webhook events to your local server
 npx @vxil/cli mcp install --client cursor   # wire your backend's MCP server into your editor's agent
-npx @vxil/cli doctor              # sanity-check keys, URLs, reachability
+npx @vxil/cli doctor              # keys, URLs, reachability + secrets referenced-vs-stored + per-function hashes
+npx @vxil/cli diff --against staging   # CI drift gate vs a named slot: exit 0 no drift · 1 drift · 2 error
 ```
 
-Config-as-code lives in `vxil.config.ts`, typed via the bundled `vxil/config` subpath:
+Config-as-code lives in `vxil.config.ts`, typed by `@vxil/config` (also bundled as the `@vxil/cli/config` subpath):
 
 ```ts
 import { defineConfig } from '@vxil/config';
 
 export default defineConfig({
+  // (a) per-feature config — the same typed manifests the server validates
   features: {
-    auth: { enabled: true, methods: ['email_otp'] },
-    cms: { enabled: true, collections: { tasks: { fields: { title: 'text', done: 'boolean' } } } },
-    notifications: { enabled: true, provider: 'resend' },
+    auth: { enabled: true },
+    cms: { enabled: true, draftPublish: true },
+    notifications: { enabled: true, provider: 'resend', fromEmail: 'noreply@example.app' },
+  },
+  // (b) CMS schema-as-code — collections + fields, reconciled by `vxil push`
+  cms: {
+    collections: {
+      tasks: {
+        fields: {
+          title: { type: 'string', required: true, indexSlot: 's1' },
+          done: { type: 'bool' },
+        },
+      },
+    },
   },
 });
 ```
 
-Verbs: `init quickstart push pull diff gen secrets env seed export import functions listen mcp cms dev doctor versions rollback link apply migrate try`.
+Verbs: `init templates quickstart try login link plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms dev payments migrate config users send deliveries api`.
+
+**Every verb names its target.** `--dev` selects the dev slot, `--target <name>` a named slot bound by `vxil link <slug> --as <name>` (which merges into the existing binding rather than replacing it). The selector is **fail-closed** — an unbound slot exits 1 telling you the fix, and never falls through to another tenant — and every write verb prints a target banner (slug + env, never a key) before it acts.
+
+- `vxil plan --explain` — the config plan with every leaf tagged *declared* or *default*.
+- `vxil diff [--against <target>] [--ignore <k,…>]` — the CI drift gate; secrets compared by name only.
+- `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function.
+- `vxil secrets list --all-projects` — the names-and-metadata matrix across every bound project (values never come back).
+- `vxil migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run]` — backfill subscriptions through the server sync leg; resumable.
+- `vxil payments simulate --scenario <s> --user <id> [--tier <t>]` — mock/dev projects only: drive a refund pair, cross-platform unlock, renewal, expiry, past-due grace or transfer and check the oracle.
 
 `vxil listen --forward-to <url>` polls your tenant's inbound webhook events and re-POSTs each new one to your local server under the exact delivery contract production uses — same body shape, same signed `X-Vxil-Jobs-Signature` header (your real signing secret) — so the handler you test locally is the handler you ship. `--replay-last <n>` re-forwards recent events; `--raw` posts the stored provider payload alone.
 

package/dist/_vxil-feature-configs-hooks.d.ts

@@ -10,7 +10,7 @@ export declare const HOOK_LIMITS: {
     readonly maxReadHooksPerCollection: 10;
 };
 /** The ONLY root variables an expression may reference. `caller` is the VERIFIED
- *  end-user principal (docs/end-user-principals-design.md §5.6) — read-only and
+ *  end-user principal (https://vxil.com/docs/guide/09-security-and-multitenancy) — read-only and
  *  populated ONLY on the READ path (runReadHooks); on the write path and in
  *  server-caller mode it is null, exactly like `before` on a create. It carries
  *  `caller.endUserId` (the verified session sub, or null) and `caller.principal`

package/dist/config.d.ts

@@ -76,7 +76,7 @@ export type CoversFieldAttrs<Covered extends FieldAttrName> = [
 export interface CollectionDef {
     singular?: string;
     fields: Record<string, FieldDef>;
-    /** End-user owner-scoping (docs/end-user-principals-design.md §5.1): names an
+    /** End-user owner-scoping (https://vxil.com/docs/guide/09-security-and-multitenancy): names an
      *  existing `string` field on this collection that holds the owner (end-user)
      *  id. When set, the cms worker auto-scopes owned reads/writes to the VERIFIED
      *  end-user principal in end-user mode (default-deny) — and is a no-op in
@@ -138,9 +138,9 @@ export interface FunctionDef {
      *  functions:write, secrets:write rejected; payments:write / notifications:send /
      *  users:* allowed as owner-granted business scopes). */
     scopes?: string[];
-    /** tenant_secrets refs injected under KEK_FUNCTIONS (productization). */
+    /** Names of tenant secrets injected into the function at invoke time. */
     secrets?: string[];
-    /** Outbound-Worker host allowlist (deny-by-default egress guard). */
+    /** Outbound host allowlist (deny-by-default egress guard). */
     egressAllow?: string[];
     limits?: {
         cpuMs?: number;
@@ -171,7 +171,7 @@ export interface SeedSpec {
         email?: string;
     }[];
 }
-/** The released API majors (docs/feature-versioning.md §3), a CLOSED union —
+/** The released API majors (see https://vxil.com/docs/guide/12-going-to-production), a CLOSED union —
  *  `'v1'` is the only released major, so `apiVersion: 'v2'` is a COMPILE error
  *  until a v2 GAs. `defineConfig` also validates it at runtime against
  *  `RELEASED_API_VERSIONS`. */
@@ -183,7 +183,7 @@ export declare const RELEASED_API_VERSIONS: readonly ApiVersion[];
 export interface VxilConfig {
     /** target environment label; resolved to a baseUrl by `vxil link` / `--env`. */
     env?: string;
-    /** Pin the API major the CLI targets (default `'v1'`, docs/feature-versioning.md).
+    /** Pin the API major the CLI targets (default `'v1'`; see https://vxil.com/docs/guide/12-going-to-production).
      *  Path-major, per-platform: a breaking change ships as a new major on a new
      *  path with a ≥6-month deprecation window. `VXIL_API_VERSION` overrides this
      *  for a one-off invocation. */

package/dist/config.js

@@ -3,7 +3,7 @@ var RELEASED_API_VERSIONS = ["v1"];
 function defineConfig(c) {
   if (c.apiVersion !== void 0 && !RELEASED_API_VERSIONS.includes(c.apiVersion)) {
     throw new Error(
-      `vxil.config: apiVersion '${String(c.apiVersion)}' is not a released API major (released: ${RELEASED_API_VERSIONS.map((v) => `'${v}'`).join(", ")}). A new major ships as a new path with its own deprecation window \u2014 see docs/feature-versioning.md.`
+      `vxil.config: apiVersion '${String(c.apiVersion)}' is not a released API major (released: ${RELEASED_API_VERSIONS.map((v) => `'${v}'`).join(", ")}). A new major ships as a new path with its own deprecation window \u2014 see https://vxil.com/docs/guide/12-going-to-production.`
     );
   }
   return c;