@vxil/cli 0.4.1 → 0.4.3

package/dist/_vxil-feature-configs-hooks.d.ts

@@ -10,7 +10,7 @@ export declare const HOOK_LIMITS: {
     readonly maxReadHooksPerCollection: 10;
 };
 /** The ONLY root variables an expression may reference. `caller` is the VERIFIED
- *  end-user principal (docs/end-user-principals-design.md §5.6) — read-only and
+ *  end-user principal (https://vxil.com/docs/guide/09-security-and-multitenancy) — read-only and
  *  populated ONLY on the READ path (runReadHooks); on the write path and in
  *  server-caller mode it is null, exactly like `before` on a create. It carries
  *  `caller.endUserId` (the verified session sub, or null) and `caller.principal`

package/dist/config.d.ts

@@ -76,7 +76,7 @@ export type CoversFieldAttrs<Covered extends FieldAttrName> = [
 export interface CollectionDef {
     singular?: string;
     fields: Record<string, FieldDef>;
-    /** End-user owner-scoping (docs/end-user-principals-design.md §5.1): names an
+    /** End-user owner-scoping (https://vxil.com/docs/guide/09-security-and-multitenancy): names an
      *  existing `string` field on this collection that holds the owner (end-user)
      *  id. When set, the cms worker auto-scopes owned reads/writes to the VERIFIED
      *  end-user principal in end-user mode (default-deny) — and is a no-op in
@@ -138,9 +138,9 @@ export interface FunctionDef {
      *  functions:write, secrets:write rejected; payments:write / notifications:send /
      *  users:* allowed as owner-granted business scopes). */
     scopes?: string[];
-    /** tenant_secrets refs injected under KEK_FUNCTIONS (productization). */
+    /** Names of tenant secrets injected into the function at invoke time. */
     secrets?: string[];
-    /** Outbound-Worker host allowlist (deny-by-default egress guard). */
+    /** Outbound host allowlist (deny-by-default egress guard). */
     egressAllow?: string[];
     limits?: {
         cpuMs?: number;
@@ -171,7 +171,7 @@ export interface SeedSpec {
         email?: string;
     }[];
 }
-/** The released API majors (docs/feature-versioning.md §3), a CLOSED union —
+/** The released API majors (see https://vxil.com/docs/guide/12-going-to-production), a CLOSED union —
  *  `'v1'` is the only released major, so `apiVersion: 'v2'` is a COMPILE error
  *  until a v2 GAs. `defineConfig` also validates it at runtime against
  *  `RELEASED_API_VERSIONS`. */
@@ -183,7 +183,7 @@ export declare const RELEASED_API_VERSIONS: readonly ApiVersion[];
 export interface VxilConfig {
     /** target environment label; resolved to a baseUrl by `vxil link` / `--env`. */
     env?: string;
-    /** Pin the API major the CLI targets (default `'v1'`, docs/feature-versioning.md).
+    /** Pin the API major the CLI targets (default `'v1'`; see https://vxil.com/docs/guide/12-going-to-production).
      *  Path-major, per-platform: a breaking change ships as a new major on a new
      *  path with a ≥6-month deprecation window. `VXIL_API_VERSION` overrides this
      *  for a one-off invocation. */

package/dist/config.js

@@ -3,7 +3,7 @@ var RELEASED_API_VERSIONS = ["v1"];
 function defineConfig(c) {
   if (c.apiVersion !== void 0 && !RELEASED_API_VERSIONS.includes(c.apiVersion)) {
     throw new Error(
-      `vxil.config: apiVersion '${String(c.apiVersion)}' is not a released API major (released: ${RELEASED_API_VERSIONS.map((v) => `'${v}'`).join(", ")}). A new major ships as a new path with its own deprecation window \u2014 see docs/feature-versioning.md.`
+      `vxil.config: apiVersion '${String(c.apiVersion)}' is not a released API major (released: ${RELEASED_API_VERSIONS.map((v) => `'${v}'`).join(", ")}). A new major ships as a new path with its own deprecation window \u2014 see https://vxil.com/docs/guide/12-going-to-production.`
     );
   }
   return c;