@vxil/cli 0.4.2 → 0.5.0

package/dist/vxil.js

@@ -1,38 +1,53 @@
 #!/usr/bin/env node
 
 // bin/vxil.ts
-import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, existsSync as existsSync7, appendFileSync as appendFileSync2, readFileSync as readFileSync7, chmodSync as chmodSync2 } from "node:fs";
+import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, existsSync as existsSync8, appendFileSync as appendFileSync2, readFileSync as readFileSync8, chmodSync as chmodSync2 } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { resolve as resolve7, dirname as dirname4 } from "node:path";
+import { resolve as resolve7, dirname as dirname5 } from "node:path";
 import { createInterface } from "node:readline";
 import { watch } from "node:fs";
 import { createServer } from "node:http";
-import { homedir as homedir2, hostname } from "node:os";
+import { homedir as homedir3, hostname } from "node:os";
 
 // src/lib.ts
 import { pathToFileURL, fileURLToPath } from "node:url";
 import { resolve, dirname, basename, join } from "node:path";
 import { existsSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+var FN_LIMIT_BOUNDS = {
+  cpuMs: { min: 5, max: 3e5 },
+  timeoutMs: { min: 1e3, max: 12e4 }
+};
+function normalizeFnLimits(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const out = {};
+  for (const k of ["cpuMs", "timeoutMs"]) {
+    const v = raw[k];
+    if (typeof v !== "number" || !Number.isFinite(v)) continue;
+    const b2 = FN_LIMIT_BOUNDS[k];
+    out[k] = Math.min(b2.max, Math.max(b2.min, Math.floor(v)));
+  }
+  return Object.keys(out).length ? out : void 0;
+}
 function lowerTriggerBindings(trigger) {
   const t = trigger?.kind ?? "http";
-  const str = (k) => typeof trigger?.[k] === "string" ? trigger[k] : void 0;
-  if (t === "cron") return [{ kind: "cron", ...str("schedule") ? { schedule: str("schedule") } : {} }];
-  if (t === "queue") return [{ kind: "queue", ...str("source") ? { source: str("source") } : {} }];
-  if (t === "webhook") return [{ kind: "webhook", ...str("source") ? { source: str("source") } : {} }];
+  const str2 = (k) => typeof trigger?.[k] === "string" ? trigger[k] : void 0;
+  if (t === "cron") return [{ kind: "cron", ...str2("schedule") ? { schedule: str2("schedule") } : {} }];
+  if (t === "queue") return [{ kind: "queue", ...str2("source") ? { source: str2("source") } : {} }];
+  if (t === "webhook") return [{ kind: "webhook", ...str2("source") ? { source: str2("source") } : {} }];
   if (t === "cmsHook" || t === "cms-hook") {
     return [{
       kind: "cmsHook",
-      ...str("collection") ? { collection: str("collection") } : {},
-      ...str("event") ? { event: str("event") } : {}
+      ...str2("collection") ? { collection: str2("collection") } : {},
+      ...str2("event") ? { event: str2("event") } : {}
     }];
   }
   if (t === "authHook" || t === "auth-hook") {
-    return [{ kind: "authHook", ...str("event") ? { event: str("event") } : {} }];
+    return [{ kind: "authHook", ...str2("event") ? { event: str2("event") } : {} }];
   }
-  return [{ kind: "http", ...str("path") ? { path: str("path") } : {} }];
+  return [{ kind: "http", ...str2("path") ? { path: str2("path") } : {} }];
 }
 var CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-var VXIL_CONFIG_PKG_VERSION = "0.3.1";
+var VXIL_CONFIG_PKG_VERSION = "0.4.0";
 function ensureScaffoldPackageJson(cwd) {
   const file = resolve(cwd, "package.json");
   const spec = `^${VXIL_CONFIG_PKG_VERSION}`;
@@ -253,6 +268,7 @@ function assembleApplyBundle(cfg, fnSources) {
     const source = fnSources[name];
     if (source === void 0) throw new Error(`functions: no bundled source for '${name}'`);
     const bindings = lowerTriggerBindings(def.trigger);
+    const limits = normalizeFnLimits(def.limits);
     return {
       name,
       source,
@@ -261,7 +277,8 @@ function assembleApplyBundle(cfg, fnSources) {
       ...def.signature ? { signature: def.signature } : {},
       ...def.scopes ? { scopes: def.scopes } : {},
       ...def.egressAllow ? { egressAllow: def.egressAllow } : {},
-      ...def.secrets ? { secrets: def.secrets } : {}
+      ...def.secrets ? { secrets: def.secrets } : {},
+      ...limits ? { limits } : {}
     };
   });
   return {
@@ -319,6 +336,16 @@ async function planOrPush({ api, features, apply }) {
     }
     const effective = dry.body.data?.manifest;
     const cur = await api("GET", `/v1/config/${feature}`);
+    const unavailable = readUnavailable(`GET /v1/config/${feature}`, cur);
+    if (unavailable) {
+      if (apply) {
+        throw new Error(
+          `config: cannot read ${unavailable.route} (${unavailable.code ?? unavailable.status}${unavailable.message ? ` \u2014 ${unavailable.message}` : ""}) \u2014 refusing to push ${feature} against a remote it could not read`
+        );
+      }
+      results.push({ feature, version: 0, changes: [], applied: null, remoteUnavailable: unavailable });
+      continue;
+    }
     const exists = cur.status === 200;
     const remote = exists ? cur.body.data?.manifest : {};
     const version = exists ? cur.body.data?.version ?? 0 : 0;
@@ -341,9 +368,179 @@ async function planOrPush({ api, features, apply }) {
   }
   return results;
 }
+function classifyRead(status, code) {
+  if (status === 200) return "ok";
+  if (status === 404) return "empty";
+  if (status === 501 && (code === void 0 || code === "capability_not_enabled")) return "empty";
+  return "unavailable";
+}
+function readUnavailable(route, res) {
+  const e = res.body?.error ?? {};
+  if (classifyRead(res.status, e.code) !== "unavailable") return null;
+  return {
+    route,
+    status: res.status,
+    ...e.code ? { code: e.code } : {},
+    ...e.message ? { message: e.message } : {}
+  };
+}
+function formatNotCompared(u, hint) {
+  return `  ! not compared: ${u.route} \u2192 ${u.code ?? u.status}${u.message ? ` \u2014 ${u.message}` : ""}${hint ? ` (${hint})` : ""}`;
+}
+
+// src/apiState.ts
+var POLICY_LIST_CAP = 100;
+var CAMPAIGN_LIST_CAP = 200;
+var LEGACY_POLICY_ALGORITHM = "sliding_window";
+var DEFAULT_SUBSCRIPTION_STATE = "active";
+function str(v) {
+  return typeof v === "string" ? v : void 0;
+}
+function num(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+}
+function strList(v) {
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+}
+function defined(o) {
+  const out = {};
+  for (const [k, v] of Object.entries(o)) if (v !== void 0) out[k] = v;
+  return out;
+}
+async function fetchApiState(api) {
+  const snap = { policies: [], subscriptions: [], campaigns: [], unavailable: [], truncated: [] };
+  const read = async (route, take) => {
+    let res;
+    try {
+      res = await api("GET", route);
+    } catch (e) {
+      snap.unavailable.push({ route: `GET ${route}`, status: 0, code: "network_error", message: e.message.split("\n")[0] ?? "" });
+      return;
+    }
+    const u = readUnavailable(`GET ${route}`, res);
+    if (u) {
+      snap.unavailable.push(u);
+      return;
+    }
+    if (classifyRead(res.status, res.body.error?.code) !== "ok") return;
+    take(res.body.data ?? {});
+  };
+  await read("/v1/rate-limits/policies", (d) => {
+    const rows = Array.isArray(d.policies) ? d.policies : [];
+    for (const raw of rows) {
+      const p = raw;
+      const name = str(p.name);
+      if (!name) continue;
+      snap.policies.push(defined({
+        name,
+        limit: num(p.limit),
+        window_seconds: num(p.window_seconds),
+        behavior: str(p.behavior),
+        key_template: str(p.key_template),
+        algorithm: str(p.algorithm) ?? LEGACY_POLICY_ALGORITHM
+      }));
+    }
+    if (rows.length >= POLICY_LIST_CAP) snap.truncated.push("policy");
+  });
+  await read("/v1/webhooks/subscriptions", (d) => {
+    for (const raw of Array.isArray(d.subscriptions) ? d.subscriptions : []) {
+      const s = raw;
+      const url = str(s.target_url);
+      if (!url) continue;
+      snap.subscriptions.push({
+        target_url: url,
+        event_prefixes: strList(s.event_prefixes),
+        state: str(s.state) ?? DEFAULT_SUBSCRIPTION_STATE
+      });
+    }
+  });
+  await read("/v1/notifications/campaigns", (d) => {
+    const rows = Array.isArray(d.campaigns) ? d.campaigns : [];
+    for (const raw of rows) {
+      const c = raw;
+      const name = str(c.name);
+      if (name) snap.campaigns.push({ name });
+    }
+    if (rows.length >= CAMPAIGN_LIST_CAP) snap.truncated.push("campaign");
+  });
+  return snap;
+}
+function apiStateDriftKey(row2) {
+  return `api:${row2.section}:${row2.key}`;
+}
+function sameSet(a, b2) {
+  const A = new Set(a);
+  const B = new Set(b2);
+  return A.size === B.size && [...A].every((x) => B.has(x));
+}
+function diffBy(section, target, against, keyOf, fields) {
+  const rows = [];
+  const A = new Map(target.map((t) => [keyOf(t), t]));
+  const B = new Map(against.map((t) => [keyOf(t), t]));
+  for (const key of [.../* @__PURE__ */ new Set([...A.keys(), ...B.keys()])].sort()) {
+    const a = A.get(key);
+    const b2 = B.get(key);
+    if (a && !b2) {
+      rows.push({ section, key, kind: "only_in_target", detail: `${section} '${key}' exists on the target, not on --against` });
+      continue;
+    }
+    if (!a && b2) {
+      rows.push({ section, key, kind: "only_in_against", detail: `${section} '${key}' exists on --against, not on the target` });
+      continue;
+    }
+    for (const f of fields) {
+      const av = f.of(a);
+      const bv = f.of(b2);
+      const equal = Array.isArray(av) && Array.isArray(bv) ? sameSet(av, bv) : JSON.stringify(av ?? null) === JSON.stringify(bv ?? null);
+      if (equal) continue;
+      rows.push({
+        section,
+        key,
+        kind: "differs",
+        detail: `${section} '${key}' ${f.name}: ${JSON.stringify(av ?? null)} \u2192 ${JSON.stringify(bv ?? null)}` + (f.note ? ` ${f.note}` : "")
+      });
+    }
+  }
+  return rows;
+}
+function diffApiState(target, against) {
+  return [
+    ...diffBy("policy", target.policies, against.policies, (p) => p.name, [
+      { name: "limit", of: (p) => p.limit },
+      { name: "window_seconds", of: (p) => p.window_seconds },
+      { name: "behavior", of: (p) => p.behavior },
+      // PUT /v1/rate-limits/policies/:id cannot repair a key_template (the
+      // update body omits it) — the only fix is delete-and-recreate.
+      { name: "key_template", of: (p) => p.key_template, note: "(recreate to fix)" },
+      // Normalized at the accessor too, so a projection built by hand (or by an
+      // older CLI) can never compare `undefined` against the default.
+      { name: "algorithm", of: (p) => p.algorithm ?? LEGACY_POLICY_ALGORITHM }
+    ]),
+    ...diffBy("subscription", target.subscriptions, against.subscriptions, (s) => s.target_url, [
+      { name: "event_prefixes", of: (s) => s.event_prefixes },
+      { name: "state", of: (s) => s.state ?? DEFAULT_SUBSCRIPTION_STATE }
+    ]),
+    // Campaigns compare by PRESENCE only: everything else about a campaign
+    // (its schedule, its audience, its run state) is operational state that
+    // legitimately differs between a staging and a production tenant.
+    ...diffBy("campaign", target.campaigns, against.campaigns, (c) => c.name, [])
+  ];
+}
+function truncationWarnings(snap, side) {
+  return snap.truncated.map((s) => {
+    const cap = s === "policy" ? POLICY_LIST_CAP : CAMPAIGN_LIST_CAP;
+    return `  ! ${s} list on ${side} returned ${cap} rows \u2014 that is the route's HARD cap (no cursor), so the remainder cannot be diffed at all`;
+  });
+}
+function formatApiStateRows(rows) {
+  if (!rows.length) return "  (api state in sync)";
+  return rows.map((r) => `  ${r.kind === "differs" ? "~" : r.kind === "only_in_target" ? "+" : "-"} ${r.detail}`).join("\n");
+}
 
 // src/functions.ts
-import { resolve as resolve2, relative, isAbsolute, sep } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname as dirname2, resolve as resolve2, relative, isAbsolute, sep } from "node:path";
 import { createHash } from "node:crypto";
 var MAX_SOURCE_BYTES = 256e3;
 function sourceSha12(source) {
@@ -353,25 +550,89 @@ function escapesRoot(root, path) {
   const rel = relative(root, path);
   return rel.startsWith("..") || isAbsolute(rel);
 }
-function assertBundleContained(projectRoot, inputs) {
+function realpathSafe(p) {
+  try {
+    return realpathSync.native(resolve2(p));
+  } catch {
+    return resolve2(p);
+  }
+}
+function isWorkspaceMarker(dir) {
+  if (existsSync2(resolve2(dir, "pnpm-workspace.yaml"))) return true;
+  if (existsSync2(resolve2(dir, "turbo.json"))) return true;
+  if (existsSync2(resolve2(dir, "lerna.json"))) return true;
+  const pkg = resolve2(dir, "package.json");
+  if (!existsSync2(pkg)) return false;
+  try {
+    return JSON.parse(readFileSync2(pkg, "utf8")).workspaces !== void 0;
+  } catch {
+    return false;
+  }
+}
+function workspaceRootFor(projectRoot) {
+  const start = realpathSafe(projectRoot);
+  const home = realpathSafe(homedir());
+  const underHome = !escapesRoot(home, start);
+  let gitRoot = null;
+  let dir = start;
+  for (; ; ) {
+    if (isWorkspaceMarker(dir)) return dir;
+    if (existsSync2(resolve2(dir, ".git")) && existsSync2(resolve2(dir, "package.json"))) gitRoot = dir;
+    if (underHome && dir === home) break;
+    const up = dirname2(dir);
+    if (up === dir) break;
+    dir = up;
+  }
+  return gitRoot ?? start;
+}
+var WORKSPACE_ROOTS = /* @__PURE__ */ new Map();
+function workspaceRootCached(projectRoot) {
+  const key = resolve2(projectRoot);
+  let v = WORKSPACE_ROOTS.get(key);
+  if (v === void 0) {
+    v = workspaceRootFor(key);
+    WORKSPACE_ROOTS.set(key, v);
+  }
+  return v;
+}
+function assertBundleContained(projectRoot, inputs, opts = {}) {
+  const what = opts.what ?? "bundled import";
   const root = resolve2(projectRoot);
+  const rootReal = realpathSafe(root);
+  const wsReal = realpathSafe(opts.workspaceRoot ?? workspaceRootCached(root));
+  const note = opts.onEscape ?? ((msg) => console.log(msg));
   for (const input of inputs) {
     const abs = resolve2(root, input);
-    if (!escapesRoot(root, abs)) continue;
-    if (abs.split(sep).includes("node_modules")) continue;
+    const absReal = realpathSafe(abs);
+    if (!escapesRoot(rootReal, absReal) || !escapesRoot(root, abs)) continue;
+    if (absReal.split(sep).includes("node_modules") || abs.split(sep).includes("node_modules")) continue;
+    const pkg = workspacePackageFor(wsReal, absReal);
+    if (pkg !== null) {
+      note(`! ${what} '${input}' comes from the workspace package ${pkg}`);
+      continue;
+    }
     throw new Error(
-      `functions: bundled import '${input}' resolves outside the project root (${root}) \u2014 function source (and everything it imports) must live inside the project or node_modules`
+      `functions: ${what} '${input}' resolves outside the project root (${rootReal})${wsReal === rootReal ? "" : ` and outside any package of its workspace (${wsReal})`} \u2014 function source (and everything it imports) must live inside the project, a workspace PACKAGE (a directory with its own package.json), or node_modules${wsReal === rootReal ? "" : " (run `vxil push` from the workspace root if the import is a sibling package)"}`
     );
   }
 }
+function workspacePackageFor(workspaceRoot, path) {
+  const wsReal = realpathSafe(workspaceRoot);
+  if (escapesRoot(wsReal, path)) return null;
+  let dir = dirname2(path);
+  for (; ; ) {
+    if (dir === wsReal || !dir.startsWith(wsReal + sep)) return null;
+    if (existsSync2(resolve2(dir, "package.json"))) return dir;
+    const up = dirname2(dir);
+    if (up === dir) return null;
+    dir = up;
+  }
+}
 async function bundleFunction(entryPath, opts = {}) {
   const root = resolve2(opts.projectRoot ?? process.cwd());
+  const workspaceRoot = workspaceRootCached(root);
   const entry = resolve2(entryPath);
-  if (escapesRoot(root, entry)) {
-    throw new Error(
-      `functions: entry '${entryPath}' resolves outside the project root (${root}) \u2014 declare function entries as paths inside the project`
-    );
-  }
+  assertBundleContained(root, [entry], { workspaceRoot, what: "entry" });
   const esbuild = await import("esbuild");
   const result = await esbuild.build({
     entryPoints: [entry],
@@ -390,7 +651,7 @@ async function bundleFunction(entryPath, opts = {}) {
   });
   const out = result.outputFiles?.[0];
   if (!out) throw new Error(`esbuild produced no output for ${entryPath}`);
-  assertBundleContained(root, Object.keys(result.metafile?.inputs ?? {}));
+  assertBundleContained(root, Object.keys(result.metafile?.inputs ?? {}), { workspaceRoot });
   const source = out.text;
   const bytes = Buffer.byteLength(source, "utf8");
   if (bytes > MAX_SOURCE_BYTES) {
@@ -418,8 +679,9 @@ function normalizeSecretRefs(refs) {
 async function readRemote(api) {
   const res = await api("GET", "/v1/functions");
   const map = /* @__PURE__ */ new Map();
-  if (res.status !== 200) return map;
-  const fns = res.body.data?.functions ?? [];
+  const unavailable = readUnavailable("GET /v1/functions", res);
+  if (res.status !== 200) return { map, unavailable };
+  const fns = Array.isArray(res.body.data?.functions) ? res.body.data.functions : [];
   for (const f of fns) {
     map.set(f.name, {
       scriptRef: f.scriptRef ?? "",
@@ -427,10 +689,11 @@ async function readRemote(api) {
       scopes: f.scopes ?? [],
       egressAllow: f.egressAllow ?? [],
       bindings: f.bindings ?? [],
-      signature: f.signature ?? null
+      signature: f.signature ?? null,
+      limits: f.limits ?? null
     });
   }
-  return map;
+  return { map, unavailable: null };
 }
 function sameSecretSet(a, b2) {
   return a.length === b2.length && a.every((x) => b2.includes(x));
@@ -445,7 +708,16 @@ function clampFunctionScopes(scopes) {
   return (scopes ?? []).map(String).filter((s) => s && !DENY_FUNCTION_SCOPES.has(s));
 }
 async function planFunctions({ api, functions, cwd, apply }) {
-  const remote = await readRemote(api);
+  const read = await readRemote(api);
+  if (read.unavailable) {
+    if (apply) {
+      throw new Error(
+        `functions: cannot read ${read.unavailable.route} (${read.unavailable.code ?? read.unavailable.status}${read.unavailable.message ? ` \u2014 ${read.unavailable.message}` : ""}) \u2014 refusing to deploy a plan computed against an unread target`
+      );
+    }
+    return { changes: [], applied: 0, cmsHookSubscriptions: null, remoteUnavailable: read.unavailable };
+  }
+  const remote = read.map;
   const results = await mapPool(Object.entries(functions), 1, async ([name, def]) => {
     if (!/^[a-z][a-z0-9-]{0,47}$/.test(name)) {
       throw new Error(`functions: invalid name '${name}' (must match /^[a-z][a-z0-9-]{0,47}$/)`);
@@ -454,10 +726,11 @@ async function planFunctions({ api, functions, cwd, apply }) {
     const triggerKind = def.trigger?.kind ?? "http";
     const secrets = normalizeSecretRefs(def.secrets);
     const bindings = lowerTriggerBindings(def.trigger);
+    const limits = normalizeFnLimits(def.limits);
     const remoteFn = remote.get(name);
     const sha = sourceSha12(source);
-    const label = `${name} (${Math.round(bytes / 100) / 10} KB) [${triggerKind}${def.scopes?.length ? " \xB7 " + def.scopes.join(",") : ""}${secrets.length ? " \xB7 secrets:" + secrets.map((s) => s.slice("secret:".length)).join(",") : ""}]`;
-    if (remoteFn !== void 0 && remoteFn.scriptRef.endsWith(`-${sha}`) && sameSecretSet(remoteFn.secrets, secrets) && sameStringSet(clampFunctionScopes(def.scopes), remoteFn.scopes) && sameStringSet(def.egressAllow ?? [], remoteFn.egressAllow) && stableStringify(remoteFn.bindings) === stableStringify(bindings) && stableStringify(remoteFn.signature) === stableStringify(def.signature ?? null)) {
+    const label = `${name} (${Math.round(bytes / 100) / 10} KB) [${triggerKind}${def.scopes?.length ? " \xB7 " + def.scopes.join(",") : ""}${secrets.length ? " \xB7 secrets:" + secrets.map((s) => s.slice("secret:".length)).join(",") : ""}${limits?.cpuMs !== void 0 ? " \xB7 cpu:" + limits.cpuMs + "ms" : ""}${limits?.timeoutMs !== void 0 ? " \xB7 egress:" + limits.timeoutMs + "ms" : ""}]`;
+    if (remoteFn !== void 0 && remoteFn.scriptRef.endsWith(`-${sha}`) && sameSecretSet(remoteFn.secrets, secrets) && sameStringSet(clampFunctionScopes(def.scopes), remoteFn.scopes) && sameStringSet(def.egressAllow ?? [], remoteFn.egressAllow) && stableStringify(remoteFn.bindings) === stableStringify(bindings) && stableStringify(remoteFn.signature) === stableStringify(def.signature ?? null) && stableStringify(remoteFn.limits ?? null) === stableStringify(limits ?? null)) {
       return { change: { name, kind: "unchanged", detail: label }, applied: 0, cmsHooks: null };
     }
     const change = { name, kind: remoteFn === void 0 ? "deploy-new" : "deploy-update", detail: label };
@@ -467,6 +740,7 @@ async function planFunctions({ api, functions, cwd, apply }) {
       if (def.signature) body.signature = def.signature;
       if (def.scopes) body.scopes = def.scopes;
       if (def.egressAllow) body.egressAllow = def.egressAllow;
+      if (limits) body.limits = limits;
       const res = await api("POST", `/v1/functions/${encodeURIComponent(name)}`, body);
       if (res.status !== 200 && res.status !== 201) {
         const e = res.body.error ?? {};
@@ -510,21 +784,21 @@ function normalizeActions(raw) {
   return raw.filter((a) => !!a && typeof a === "object").map((a) => ({ key: String(a.key), label: String(a.label), fn: String(a.fn) }));
 }
 var FIELD_ATTRS = [
-  { config: "required", wire: "required", remote: "required", blank: false, alterable: false },
-  { config: "validation", wire: "validation", remote: "validation", blank: {}, alterable: false },
-  { config: "indexSlot", wire: "index_slot", remote: "index_slot", blank: null, alterable: false },
-  { config: "relationTo", wire: "relation_to", remote: "relation_to", blank: null, alterable: false },
-  { config: "computed", wire: "computed", remote: "computed", blank: false, alterable: false },
-  { config: "compute", wire: "compute", remote: "compute", blank: null, alterable: false },
-  { config: "unique", wire: "unique", remote: "is_unique", blank: false, alterable: true },
-  { config: "onDelete", wire: "on_delete", remote: "on_delete", blank: null, alterable: true },
+  { config: "required", wire: "required", remote: "required", blank: false, alter: "in-place" },
+  { config: "validation", wire: "validation", remote: "validation", blank: {}, alter: "in-place" },
+  { config: "indexSlot", wire: "index_slot", remote: "index_slot", blank: null, alter: "reindex" },
+  { config: "relationTo", wire: "relation_to", remote: "relation_to", blank: null, alter: "destructive" },
+  { config: "computed", wire: "computed", remote: "computed", blank: false, alter: "in-place" },
+  { config: "compute", wire: "compute", remote: "compute", blank: null, alter: "in-place" },
+  { config: "unique", wire: "unique", remote: "is_unique", blank: false, alter: "tighten-only" },
+  { config: "onDelete", wire: "on_delete", remote: "on_delete", blank: null, alter: "tighten-only" },
   // cms.md §18 (RB-3) field-level read security. ALTERABLE: cms-v1 rewrites the
   // gate in place on a same-type re-POST (the unique/on_delete flag-alter path),
   // so config-as-code can TIGHTEN a gate on an existing field. Blank is `null`
   // (the server stores NULL for "ungated" and normalizes `[]` to NULL), so an
   // omitted attribute diffs clean; CLEARING it WIDENS access and therefore rides
   // the same --allow-destructive gate as clearing unique/on_delete/owner_field.
-  { config: "readRoles", wire: "read_roles", remote: "read_roles", blank: null, alterable: true }
+  { config: "readRoles", wire: "read_roles", remote: "read_roles", blank: null, alter: "tighten-only" }
 ];
 function fieldToInput(name, def) {
   const out = { field: name, type: def.type };
@@ -547,41 +821,110 @@ function remoteFieldToConfig(rf) {
 function fieldAttrDelta(def, rf) {
   const d = def;
   const r = rf;
-  const flags = [];
-  const clearing = [];
-  const drift = [];
+  const out = { flags: [], clearing: [], inPlace: [], reindex: [], retarget: [], drift: [] };
   for (const a of FIELD_ATTRS) {
     const wantBlank = stableStringify(a.blank);
     const want = stableStringify(d[a.config] ?? a.blank);
     const have = stableStringify(r[a.remote] ?? a.blank);
     if (want === have) continue;
-    if (!a.alterable) {
-      drift.push(`${a.config} ${have} \u2192 ${want}`);
+    const line = `${a.config} ${have} \u2192 ${want}`;
+    if (a.alter === "tighten-only") {
+      (want === wantBlank ? out.clearing : out.flags).push(line);
       continue;
     }
-    if (want === wantBlank) clearing.push(`${a.config} ${have} \u2192 ${want}`);
-    else flags.push(`${a.config} ${have} \u2192 ${want}`);
+    if (d[a.config] === void 0) {
+      out.drift.push(line);
+      continue;
+    }
+    if (a.alter === "reindex") out.reindex.push(line);
+    else if (a.alter === "destructive") out.retarget.push(line);
+    else out.inPlace.push(line);
+  }
+  return out;
+}
+function vacateSlotBody(rf) {
+  const out = { field: rf.field, type: rf.type, index_slot: null };
+  if (rf.is_unique) out.unique = true;
+  if (rf.on_delete) out.on_delete = rf.on_delete;
+  if (rf.read_roles && rf.read_roles.length > 0) out.read_roles = rf.read_roles;
+  return out;
+}
+async function liveRowCount(api, collection) {
+  try {
+    const res = await api("GET", `/v1/cms/items/${encodeURIComponent(collection)}?count=true`);
+    const n = res.body.data?.count;
+    return typeof n === "number" ? n : null;
+  } catch {
+    return null;
   }
-  return { flags, clearing, drift };
 }
 async function readRemote2(api) {
   const res = await api("GET", "/v1/cms/collections");
   const map = /* @__PURE__ */ new Map();
-  if (res.status !== 200) return map;
-  const cols = res.body.data?.collections ?? [];
+  const unavailable = readUnavailable("GET /v1/cms/collections", res);
+  if (res.status !== 200) return { map, unavailable };
+  const cols = Array.isArray(res.body.data?.collections) ? res.body.data.collections : [];
   for (const c of cols) {
     map.set(c.collection, {
       collection: c.collection,
       ownerField: c.owner_field ?? null,
       public: c.public === true,
       actions: normalizeActions(c.actions),
-      fields: c.fields ?? []
+      fields: Array.isArray(c.fields) ? c.fields : []
     });
   }
-  return map;
+  return { map, unavailable: null };
+}
+var REINDEX_PAGE_CAP = 1e4;
+async function reindexCollection({ api, collection, field, onProgress }) {
+  const rerun = ` \u2014 re-run \`vxil cms reindex ${collection}${field ? ` --field ${field}` : ""}\` (the alter is applied; only the projection lags)`;
+  let cursor;
+  let scanned = 0;
+  let updated = 0;
+  let pages = 0;
+  let skipped = 0;
+  const page = async () => {
+    const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(collection)}/reindex`, {
+      ...field ? { field } : {},
+      ...cursor ? { cursor } : {}
+    });
+    if (res.status < 200 || res.status >= 300) {
+      const e = res.body.error ?? {};
+      throw new Error(`cms: re-index ${collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`.trimEnd() + rerun);
+    }
+    const d = res.body.data ?? {};
+    scanned += d.scanned ?? 0;
+    updated += d.updated ?? 0;
+    pages++;
+    return d;
+  };
+  for (; ; ) {
+    let d = await page();
+    if ((d.skipped ?? 0) > 0) d = await page();
+    skipped += d.skipped ?? 0;
+    onProgress?.({ scanned, updated, pages, skipped });
+    if (d.complete === true || !d.next_cursor) break;
+    if (d.next_cursor === cursor) {
+      throw new Error(`cms: re-index ${collection} stalled \u2014 the server returned the same cursor twice after ${scanned} row(s)${rerun}`);
+    }
+    if (pages >= REINDEX_PAGE_CAP) {
+      throw new Error(`cms: re-index ${collection} exceeded ${REINDEX_PAGE_CAP} pages (${scanned} row(s) scanned) without completing${rerun}`);
+    }
+    cursor = d.next_cursor;
+  }
+  return { scanned, updated, pages, skipped };
 }
-async function planCmsSchema({ api, collections, apply, allowDestructive = false }) {
-  const remote = await readRemote2(api);
+async function planCmsSchema({ api, collections, apply, allowDestructive = false, onProgress }) {
+  const read = await readRemote2(api);
+  if (read.unavailable) {
+    if (apply) {
+      throw new Error(
+        `cms: cannot read ${read.unavailable.route} (${read.unavailable.code ?? read.unavailable.status}${read.unavailable.message ? ` \u2014 ${read.unavailable.message}` : ""}) \u2014 refusing to apply a schema plan computed against an unread target`
+      );
+    }
+    return { changes: [], applied: 0, remoteUnavailable: read.unavailable };
+  }
+  const remote = read.map;
   const changes = [];
   for (const [name, def] of Object.entries(collections)) {
     const declaredFields = Object.entries(def.fields ?? {});
@@ -594,13 +937,30 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
       });
       continue;
     }
+    const pre = [];
+    const collChanges = [];
+    const post = [];
+    const slotMoved = [];
     const remoteByName = new Map(rc.fields.map((f) => [f.field, f]));
     for (const [fn, fd] of declaredFields) {
       const existing = remoteByName.get(fn);
       if (!existing) {
-        changes.push({ collection: name, kind: "add-field", field: fn, detail: `${name}.${fn} (${fd.type})` });
+        collChanges.push({ collection: name, kind: "add-field", field: fn, detail: `${name}.${fn} (${fd.type})` });
       } else if (existing.type !== fd.type) {
-        changes.push({
+        if (allowDestructive && (fd.indexSlot ?? null) !== (existing.index_slot ?? null)) {
+          if (existing.index_slot) {
+            pre.push({
+              collection: name,
+              kind: "destructive",
+              op: "vacate-slot",
+              field: fn,
+              remote: existing,
+              detail: `${name}.${fn} vacate index_slot ${existing.index_slot} (two-pass: vacate \u2192 claim)`
+            });
+          }
+          slotMoved.push(fn);
+        }
+        collChanges.push({
           collection: name,
           kind: "destructive",
           op: "alter-field",
@@ -608,61 +968,73 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
           detail: `${name}.${fn} type ${existing.type} \u2192 ${fd.type} (destructive alter)`
         });
       } else {
-        const { flags, clearing, drift } = fieldAttrDelta(fd, existing);
-        if (flags.length && clearing.length === 0) {
-          changes.push({
-            collection: name,
-            kind: "alter-flags",
-            field: fn,
-            detail: `${name}.${fn} ${flags.join(", ")} (non-destructive in-place alter)`
-          });
-        }
-        if (clearing.length) {
-          const both = [...clearing, ...flags];
+        const { flags, clearing, inPlace, reindex, retarget, drift } = fieldAttrDelta(fd, existing);
+        const destructiveAttrs = [...clearing, ...reindex, ...retarget];
+        if (destructiveAttrs.length) {
+          const all = [...destructiveAttrs, ...flags, ...inPlace];
           if (allowDestructive) {
-            changes.push({
+            if (reindex.length && existing.index_slot) {
+              pre.push({
+                collection: name,
+                kind: "destructive",
+                op: "vacate-slot",
+                field: fn,
+                remote: existing,
+                detail: `${name}.${fn} vacate index_slot ${existing.index_slot} (two-pass: vacate \u2192 claim)`
+              });
+            }
+            collChanges.push({
               collection: name,
               kind: "destructive",
               op: "alter-field",
               field: fn,
-              detail: `${name}.${fn} ${both.join(", ")} \u2014 clearing a live invariant (unique claims / on_delete cascade) (full-config reconciliation)`
+              detail: `${name}.${fn} ${all.join(", ")}` + (clearing.length ? " \u2014 clearing a live invariant (unique claims / on_delete cascade / read_roles gate)" : "") + (reindex.length ? " \u2014 an index_slot move: stored rows keep the OLD projection until the re-index runs" : "") + (retarget.length ? " \u2014 a relation retarget: every stored id now names a different collection" : "") + " (full-config reconciliation)"
             });
+            if (reindex.length) slotMoved.push(fn);
           } else {
-            changes.push({
+            collChanges.push({
               collection: name,
               kind: "warn",
               field: fn,
-              detail: `${name}.${fn} ${both.join(", ")}: this CLEARS a live invariant \u2014 clearing unique DROPS the uniqueness claims (duplicates then accepted, unrecoverable) and clearing on_delete stops cascades, so it is NOT applied (nor is any co-declared tightening on this field). Declare the attribute to keep it, or re-run with --allow-destructive to clear.`
+              detail: `${name}.${fn} ${all.join(", ")}: this is DESTRUCTIVE-SHAPED \u2014 ` + (clearing.length ? "it CLEARS a live invariant (clearing unique DROPS the uniqueness claims \u2014 duplicates then accepted, unrecoverable; clearing on_delete stops cascades; clearing read_roles WIDENS the field to every end-user); " : "") + (reindex.length ? "an index_slot move leaves stored rows on the OLD projection until a re-index, so queries on the field return the WRONG rows; " : "") + (retarget.length ? "a relation retarget repoints every stored id at another collection; " : "") + "it is NOT applied (nor is any co-declared in-place change on this field). Re-run with --allow-destructive to apply."
             });
           }
+        } else if (flags.length || inPlace.length) {
+          collChanges.push({
+            collection: name,
+            kind: "alter-flags",
+            field: fn,
+            detail: `${name}.${fn} ${[...flags, ...inPlace].join(", ")} (non-destructive in-place alter)`
+          });
         }
         if (drift.length) {
-          changes.push({
+          collChanges.push({
             collection: name,
             kind: "warn",
             field: fn,
-            detail: `${name}.${fn} drift: ${drift.join("; ")} \u2014 cms-v1 has no same-type in-place alter for these (only unique/on_delete alter in place); the difference is NOT applied. Match the config to the live definition, or re-create the field.`
+            detail: `${name}.${fn} drift: ${drift.join("; ")} \u2014 the config does NOT declare these, so they are left exactly as the live schema has them (an omitted attribute is never blanked). Declare them in vxil.config.ts to make config authoritative.`
           });
         }
+        continue;
       }
     }
     const declaredOwner = def.ownerField ?? null;
     const remoteOwner = rc.ownerField;
     if (declaredOwner !== remoteOwner) {
       if (declaredOwner !== null) {
-        changes.push({
+        collChanges.push({
           collection: name,
           kind: "set-owner-field",
           detail: `${name} owner_field \u2192 '${declaredOwner}'${remoteOwner ? ` (was '${remoteOwner}')` : ""} (end-user owner-scoping, non-destructive)`
         });
       } else if (allowDestructive) {
-        changes.push({
+        collChanges.push({
           collection: name,
           kind: "set-owner-field",
           detail: `${name} owner_field cleared (was '${remoteOwner}') \u2014 end-user owner-scoping OFF (full-config reconciliation)`
         });
       } else {
-        changes.push({
+        collChanges.push({
           collection: name,
           kind: "warn",
           detail: `${name}: owner_field '${remoteOwner}' is set remotely but absent in config \u2014 clearing it WIDENS access to every same-tenant end user, so it is NOT applied. Declare ownerField to keep it, or re-run with --allow-destructive to clear.`
@@ -671,7 +1043,7 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
     }
     const declaredPublic = def.public === true;
     if (declaredPublic !== rc.public) {
-      changes.push({
+      collChanges.push({
         collection: name,
         kind: "set-public",
         detail: `${name} public \u2192 ${declaredPublic} (keyless public delivery ${declaredPublic ? "ON" : "OFF"})`
@@ -679,7 +1051,7 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
     }
     const declaredActions = normalizeActions(def.actions);
     if (stableStringify(declaredActions) !== stableStringify(rc.actions)) {
-      changes.push({
+      collChanges.push({
         collection: name,
         kind: "set-actions",
         detail: `${name} actions \u2192 [${declaredActions.map((a) => `${a.key}\u2192${a.fn}`).join(", ")}] (was [${rc.actions.map((a) => `${a.key}\u2192${a.fn}`).join(", ")}])`
@@ -687,7 +1059,7 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
     }
     for (const f of rc.fields) {
       if (!Object.prototype.hasOwnProperty.call(def.fields ?? {}, f.field)) {
-        changes.push({
+        collChanges.push({
           collection: name,
           kind: "destructive",
           op: "drop-field",
@@ -696,6 +1068,15 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
         });
       }
     }
+    if (slotMoved.length) {
+      const n = await liveRowCount(api, name);
+      post.push({
+        collection: name,
+        kind: "reindex",
+        detail: `${name} re-index ${n === null ? "live rows" : `${n} live rows`} after the index_slot move on ${slotMoved.join(", ")}`
+      });
+    }
+    changes.push(...pre, ...collChanges, ...post);
   }
   if (allowDestructive) {
     for (const rname of remote.keys()) {
@@ -773,6 +1154,16 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
           throw new Error(`cms: set actions on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
         }
         applied++;
+      } else if (c.kind === "reindex") {
+        const done = await reindexCollection({
+          api,
+          collection: c.collection,
+          onProgress: (p) => onProgress?.(`  \u2026 re-indexed ${p.scanned} row(s) of ${c.collection}` + (p.skipped > 0 ? ` (${p.skipped} skipped \u2014 written concurrently)` : ""))
+        });
+        if (done.skipped > 0) {
+          onProgress?.(`  \u26A0 ${done.skipped} row(s) of ${c.collection} were written while the re-index ran and were NOT re-projected \u2014 re-run \`vxil cms reindex ` + c.collection + "` when writes are quiet");
+        }
+        applied++;
       } else if (c.kind === "destructive") {
         applied += await applyDestructive(api, collections, c);
       }
@@ -799,6 +1190,15 @@ async function applyDestructive(api, collections, c) {
     }
     return 1;
   }
+  if (c.op === "vacate-slot") {
+    const rf = c.remote;
+    const res2 = await api("POST", path, vacateSlotBody(rf));
+    if (!ok2xx(res2.status) && res2.body.error?.code !== "already_exists") {
+      const e = res2.body.error ?? {};
+      throw new Error(`cms: vacate ${c.collection}.${c.field} slot failed: ${e.code ?? res2.status} ${e.message ?? ""}`);
+    }
+    return 1;
+  }
   const fd = collections[c.collection].fields[c.field];
   const res = await api("POST", path, { ...fieldToInput(c.field, fd), allow_destructive: true });
   if (!ok2xx(res.status)) {
@@ -812,6 +1212,7 @@ function formatCmsChanges(changes) {
   return changes.map((c) => {
     if (c.kind === "destructive") return `  ! ${c.detail}`;
     if (c.kind === "warn") return `  \u26A0 ${c.detail}`;
+    if (c.kind === "reindex") return `  \u21BB ${c.detail}`;
     if (c.kind === "alter-flags" || c.kind === "set-owner-field") return `  ~ ${c.detail}`;
     return `  + ${c.detail}`;
   }).join("\n");
@@ -1334,8 +1735,8 @@ function typeHandlers(types2) {
 function escapeIdentifiers(xs, { transform: { column } }) {
   return xs.map((x) => escapeIdentifier(column.to ? column.to(x) : x)).join(",");
 }
-var escapeIdentifier = function escape(str) {
-  return '"' + str.replace(/"/g, '""').replace(/\./g, '"."') + '"';
+var escapeIdentifier = function escape(str2) {
+  return '"' + str2.replace(/"/g, '""').replace(/\./g, '"."') + '"';
 };
 var inferType = function inferType2(x) {
   return x instanceof Parameter ? x.type : x instanceof Date ? 1184 : x instanceof Uint8Array ? 17 : x === true || x === false ? 16 : typeof x === "bigint" ? 20 : Array.isArray(x) ? inferType2(x[0]) : 0;
@@ -1410,16 +1811,16 @@ function arrayParserLoop(s, x, parser, typarray) {
   return xs;
 }
 var toCamel = (x) => {
-  let str = x[0];
+  let str2 = x[0];
   for (let i = 1; i < x.length; i++)
-    str += x[i] === "_" ? x[++i].toUpperCase() : x[i];
-  return str;
+    str2 += x[i] === "_" ? x[++i].toUpperCase() : x[i];
+  return str2;
 };
 var toPascal = (x) => {
-  let str = x[0].toUpperCase();
+  let str2 = x[0].toUpperCase();
   for (let i = 1; i < x.length; i++)
-    str += x[i] === "_" ? x[++i].toUpperCase() : x[i];
-  return str;
+    str2 += x[i] === "_" ? x[++i].toUpperCase() : x[i];
+  return str2;
 };
 var toKebab = (x) => x.replace(/_/g, "-");
 var fromCamel = (x) => x.replace(/([A-Z])/g, "_$1").toLowerCase();
@@ -2330,8 +2731,8 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     bytes_default.i16(0);
     return bytes_default.end();
   }
-  function Parse(str, parameters, types2, name = "") {
-    bytes_default().P().str(name + bytes_default.N).str(str + bytes_default.N).i16(parameters.length);
+  function Parse(str2, parameters, types2, name = "") {
+    bytes_default().P().str(name + bytes_default.N).str(str2 + bytes_default.N).i16(parameters.length);
     parameters.forEach((x, i) => bytes_default.i32(types2[i] || 0));
     return bytes_default.end();
   }
@@ -3282,8 +3683,28 @@ function slottedFields(c) {
 function isFilterableField(f) {
   return !(f.computed && !f.index_slot);
 }
+var MAX_ENUM_UNION = 50;
+function enumUnionFor(f) {
+  const raw = f.validation?.enum;
+  if (!Array.isArray(raw) || raw.length === 0 || raw.length > MAX_ENUM_UNION) return null;
+  const base = tsTypeFor(f.type);
+  if (base !== "string" && base !== "number" && base !== "boolean") return null;
+  const members = [];
+  for (const v of raw) {
+    const t = typeof v;
+    if (t !== "string" && t !== "number" && t !== "boolean") return null;
+    if (t !== base) return null;
+    members.push(JSON.stringify(v));
+  }
+  return members.join(" | ");
+}
+function hasEnumFilter(c) {
+  return c.fields.some((f) => isFilterableField(f) && enumUnionFor(f) !== null);
+}
 function filterTypeFor(f) {
   const slot = f.index_slot ?? "";
+  const u = enumUnionFor(f);
+  if (u) return slot ? `VxilFilterRangeEnum<${u}>` : `VxilFilterEnum<${u}>`;
   if (slot.startsWith("s")) return "VxilFilterRangeText";
   if (slot.startsWith("n")) return "VxilFilterRange<number>";
   if (slot.startsWith("t")) return "VxilFilterRangeDatetime";
@@ -3308,15 +3729,16 @@ function unionOf(values2) {
 function collectionType(c) {
   const lines = [];
   const ind = "        ";
+  const typeOf = (f) => enumUnionFor(f) ?? tsTypeFor(f.type);
   const rowFields = c.fields.map((f) => {
-    const t = tsTypeFor(f.type);
+    const t = typeOf(f);
     return f.required ? `${ind}${quoteKey(f.field)}: ${t};` : `${ind}${quoteKey(f.field)}: ${t} | null;`;
   });
   const insertFields = c.fields.filter((f) => !f.computed).map((f) => {
-    const t = tsTypeFor(f.type);
+    const t = typeOf(f);
     return f.required ? `${ind}${quoteKey(f.field)}: ${t};` : `${ind}${quoteKey(f.field)}?: ${t} | null;`;
   });
-  const patchFields = c.fields.filter((f) => !f.computed).map((f) => `${ind}${quoteKey(f.field)}?: ${tsTypeFor(f.type)} | null;`);
+  const patchFields = c.fields.filter((f) => !f.computed).map((f) => `${ind}${quoteKey(f.field)}?: ${typeOf(f)} | null;`);
   const slotted = slottedFields(c);
   const sortable = unionOf([...slotted.map((f) => f.field), ...META_SORTABLE]);
   const statusUnion = unionOf([...CMS_STATUS_VALUES]);
@@ -3340,6 +3762,10 @@ ${patchFields.join("\n") || `${ind}/* (no patchable fields) */`}
       };`);
   lines.push(`      Sortable: ${sortable};`);
   lines.push(`      Filterable: ${filterable};`);
+  const relLines = c.fields.filter((f) => f.type === "relation" || f.type === "file").map((f) => `${ind}${quoteKey(f.field)}: ${f.type === "file" ? "'files'" : JSON.stringify(f.relation_to ?? null)};`);
+  lines.push(`      Relations: ${relLines.length ? `{
+${relLines.join("\n")}
+      }` : "{}"};`);
   lines.push(`    };`);
   return lines.join("\n");
 }
@@ -3382,6 +3808,9 @@ export const API_VERSIONS = {
 ` + apiVers.map(([f, v]) => `  ${quoteKey(f)}: [${v.map((x) => JSON.stringify(x)).join(", ")}],`).join("\n") + `
 } as const;` : "";
   const cmsBody = colls.length ? colls.map(collectionType).join("\n") : "    // (no collections \u2014 `vx.from(...)` is empty until you declare one)";
+  const enumAliases = colls.some(hasEnumFilter) ? `
+export type VxilFilterEnum<U extends string | number | boolean> = U | { $eq?: U; $in?: U[]; $contains?: string };
+export type VxilFilterRangeEnum<U extends string | number | boolean> = U | { $eq?: U; $ne?: U; $gt?: U; $gte?: U; $lt?: U; $lte?: U; $in?: U[]; $contains?: string };` : "";
   const fnBody = fns.length ? fns.map(functionType).join("\n") : "    // (no deployed functions)";
   return `${header}
 
@@ -3414,7 +3843,7 @@ export type VxilFilterEqText = string | { $eq?: string; $in?: string[]; $contain
 export type VxilFilterRange<T> = T | { $eq?: T; $ne?: T; $gt?: T; $gte?: T; $lt?: T; $lte?: T; $in?: T[] };
 export type VxilFilterRangeText = string | { $eq?: string; $ne?: string; $gt?: string; $gte?: string; $lt?: string; $lte?: string; $in?: string[]; $contains?: string };
 export type VxilFilterRangeDatetime = string | { $eq?: string; $ne?: string; $gt?: string; $gte?: string; $lt?: string; $lte?: string; $in?: string[]; $contains?: string };
-export type VxilFilterJson = string | number | boolean | { $eq?: string | number | boolean; $in?: (string | number | boolean)[]; $contains?: string };
+export type VxilFilterJson = string | number | boolean | { $eq?: string | number | boolean; $in?: (string | number | boolean)[]; $contains?: string };${enumAliases}
 
 // Usage \u2014 narrow the client to THIS tenant's enabled features (a disabled feature
 // becomes a compile error):
@@ -3446,12 +3875,12 @@ var TOOLS = [
   {
     name: "notifications_send",
     feature: "notifications",
-    description: "Send a transactional email to an end-user by ID. Returns a delivery_id immediately (202); delivery is asynchronous. Templates: magic-link (data: url, expires_minutes), welcome (data: app_name, first_name?), transactional (data: subject, paragraph, cta_label?, cta_url?).",
+    description: "Send a transactional email to an end-user by ID. Returns a delivery_id immediately (202); delivery is asynchronous. Templates: magic-link (data: url, expires_minutes), otp-code (data: code, expires_minutes), welcome (data: app_name, first_name?), transactional (data: subject, paragraph, cta_label?, cta_url?).",
     inputSchema: {
       type: "object",
       properties: {
         user_id: { type: "string", description: "Opaque end_user_id (your user id)." },
-        template: { type: "string", enum: ["magic-link", "welcome", "transactional"] },
+        template: { type: "string", enum: ["magic-link", "otp-code", "welcome", "transactional"] },
         data: { type: "object", additionalProperties: true },
         locale: {
           type: "string",
@@ -3537,6 +3966,42 @@ var TOOLS = [
     path: "/v1/notifications/deliveries",
     queryArgs: ["user_id", "status", "engagement", "limit"]
   },
+  {
+    name: "notifications_get_preferences",
+    feature: "notifications",
+    description: "Read one end-user's notification mutes. Returns { preferences: [{ user_id, template_id, muted, effective, updated_at }], count } \u2014 the all-templates row (template_id null) first. NO row means NOT muted. MUTE WINS: the all-templates row SHADOWS a per-template muted:false, and `effective` is what enforcement actually does with that row (render `effective`, not `muted`). A mute suppresses the user on EVERY channel before the send leaves vxil (the delivery is recorded with status 'suppressed' and last_error_code 'muted'), except auth mail (magic-link, otp-code), which is never muteable. Read-only.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        user_id: { type: "string", description: "Opaque end_user_id (your user id)." }
+      },
+      required: ["user_id"]
+    },
+    method: "GET",
+    path: "/v1/notifications/preferences",
+    queryArgs: ["user_id"]
+  },
+  {
+    name: "notifications_set_preference",
+    feature: "notifications",
+    description: "Mute or un-mute an end-user's notifications. OMIT template_id to mute every MUTEABLE template for that user (welcome, transactional); pass one of those ids to mute just that one. Auth mail (magic-link, otp-code) is NEVER muteable \u2014 passing it is a 422, and the all-templates row does not cover it, so a user can never mute itself out of sign-in. MUTE WINS: the all-templates row shadows a per-template muted:false, so clear it before re-enabling one template. Idempotent upsert \u2014 there is no delete route, muted:false is the un-mute. 404 if the user id has no live record. Needs notifications:send (a server key writing another principal's row).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        user_id: { type: "string", description: "Opaque end_user_id (your user id)." },
+        template_id: {
+          type: "string",
+          // MUTEABLE ids only — auth mail is rejected by the route (422).
+          enum: ["welcome", "transactional"],
+          description: "Omit for the ALL-templates row (muteable templates only)."
+        },
+        muted: { type: "boolean" }
+      },
+      required: ["user_id", "muted"]
+    },
+    method: "PUT",
+    path: "/v1/notifications/preferences"
+  },
   {
     name: "notifications_campaign_run",
     feature: "notifications",
@@ -3997,7 +4462,7 @@ var TOOLS = [
   {
     name: "cms_query_items",
     feature: "cms",
-    description: 'Query content items with the bounded DSL. filter is a JSON object (\u22648 terms): {"price":{"$gte":10},"status":"published"}; ops $eq $ne $gt $gte $lt $lte $in $contains $startsWith (substring/prefix, LIKE-escaped) $arrayContains/$anyOf (array fields: all-of / any-of). sort: "-field" (slot-indexed fields + created_at/updated_at/published_at). count=true returns {count} instead of a page (filter only \u2014 no sort/limit).',
+    description: 'Query content items with the bounded DSL. filter is a JSON object (\u22648 terms): {"price":{"$gte":10},"status":"published"}; ops $eq $ne $gt $gte $lt $lte $in $contains $startsWith (substring/prefix, LIKE-escaped) $arrayContains/$anyOf (array fields: all-of / any-of). sort: "-field" (slot-indexed fields + created_at/updated_at/published_at). $expand inlines relation/file fields. count=true returns {count} instead of a page (filter only \u2014 no sort/limit/$expand).',
     inputSchema: {
       type: "object",
       properties: {
@@ -4005,13 +4470,17 @@ var TOOLS = [
         filter: { type: "string", description: "JSON filter object as a string" },
         sort: { type: "string" },
         limit: { type: "number", default: 25 },
+        $expand: {
+          type: "string",
+          description: "comma-separated relation/file field names to inline (bounded depth; see cms_list_collections for relation_to). Cannot be combined with count=true."
+        },
         count: { type: "boolean", description: "true \u2192 return { count } only (no items/paging)" }
       },
       required: ["collection"]
     },
     method: "GET",
     path: (a) => `/v1/cms/items/${encodeURIComponent(String(a.collection))}`,
-    queryArgs: ["filter", "sort", "limit", "count"]
+    queryArgs: ["filter", "sort", "limit", "$expand", "count"]
   },
   {
     name: "cms_inc_item",
@@ -4575,6 +5044,22 @@ var TOOLS = [
           maxItems: 8,
           description: "Vision inputs: a public https URL, a data:image/...;base64 URL, or file:<object_id> (a files object). Provider must support the 'vision' capability."
         },
+        documents: {
+          type: "array",
+          items: { type: "string" },
+          maxItems: 8,
+          description: "Document inputs (pdf / plain text): a public https URL, a data:application/pdf;base64 URL, or file:<object_id>. Fetched and inlined server-side. Provider must support the 'documents' capability (anthropic)."
+        },
+        cache: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            system: { type: "boolean" },
+            messages: { type: "boolean" },
+            ttl: { type: "string", enum: ["5m", "1h"] }
+          },
+          description: "Prompt-cache breakpoints (anthropic; ignored elsewhere): system caches the system prompt, messages caches the transcript prefix, ttl picks 5m (default) or 1h. A cache hit only lowers input_tokens."
+        },
         user_id: { type: "string", description: "Opaque end_user_id for per-user usage metering." }
       }
     },
@@ -4740,7 +5225,7 @@ var TOOLS = [
   {
     name: "payments_list_webhook_events",
     feature: "payments",
-    description: "List provider webhook deliveries from the event log, newest-first: outcome (received|processed|error|sig_failed|parse_failed|reprocessed|ignored|unowned|rejected_environment), the provider-reported environment (production|sandbox), signature status, error, and timestamps per delivery. Use it to diagnose billing sync issues (e.g. an unmapped price or product \u2192 outcome error, a misconfigured webhook secret producing sig_failed rows, sandbox deliveries landing as rejected_environment). Read-only \u2014 needs payments:read. Payloads are detail-only (console surface).",
+    description: "List provider webhook deliveries from the event log, newest-first: outcome (received|processed|error|sig_failed|parse_failed|reprocessed|ignored|unowned|rejected_environment), the provider-reported environment (production|sandbox), signature status, error, and timestamps per delivery. Use it to diagnose billing sync issues (e.g. an unmapped price or product \u2192 outcome error, a misconfigured webhook secret producing sig_failed rows, sandbox deliveries landing as rejected_environment). An unmapped one-off product lands `error` unless you set ledger.unmappedProduct:'ignore', which lands it `ignored` instead. Read-only \u2014 needs payments:read. Server-side key only (403 server_only on a thin-client/end-user key) \u2014 the log is tenant-wide and carries provider payloads. Payloads are detail-only (console surface).",
     inputSchema: {
       type: "object",
       properties: {
@@ -4768,7 +5253,7 @@ var TOOLS = [
     // Substrate tool (no `feature` — always-on like users_upsert): usage is a
     // platform property, not a feature you enable.
     name: "usage_current",
-    description: "Current-month usage for this project: requests used, the plan's included quota, remaining (null when the plan has no fixed cap), and month-to-date per-feature metered detail (may lag \u2014 it is aggregated periodically). Read-only. Call this before a bulk run to self-check remaining quota: the Free tier is hard-capped (429 quota_exceeded when exhausted); paid tiers are never cut off mid-month. Needs usage:read or features:read.",
+    description: "Current-month usage for this project: requests used, the plan's included quota, remaining (null when the plan has no fixed cap), month-to-date per-feature metered detail (may lag \u2014 it is aggregated periodically), and `routes` \u2014 the same request count split by the surface that served it (the resolved upstream; /v1/fn/* reports as 'fn-invoke', busiest first, observational only). Read-only. Call this before a bulk run to self-check remaining quota: the Free tier is hard-capped (429 quota_exceeded when exhausted); paid tiers are never cut off mid-month. Needs usage:read or features:read.",
     inputSchema: { type: "object", properties: {} },
     method: "GET",
     path: "/v1/usage"
@@ -4828,12 +5313,13 @@ var TOOLS = [
     // Substrate meta-tool (no `feature` — always-on, subject to the caller's
     // scopes). Maps to POST /v1/plan (features:read). Advisory: proposes, never applies.
     name: "plan_backend",
-    description: 'Describe an app in plain English and get an ADVISORY vxil plan: which features to enable, a materialized config draft, and which truly-unique logic needs a tenant function. Read-only \u2014 it proposes a plan; you review and apply it via config push. e.g. "a marketplace where sellers list products and buyers leave reviews, emailing both on a sale".',
+    description: 'Describe an app in plain English and get an ADVISORY vxil plan: which features to enable, a materialized config draft, and which truly-unique logic needs a tenant function. Read-only \u2014 it proposes a plan; you review and apply it via config push. e.g. "a marketplace where sellers list products and buyers leave reviews, emailing both on a sale". The response also carries an architecture brief: the platform rules this plan implies (identity, data, money path, background work, limits) and the older patterns they replace.',
     inputSchema: {
       type: "object",
       properties: {
         description: { type: "string", description: "Plain-English description of the app you want to build." },
-        name: { type: "string", description: "Optional app name for the plan." }
+        name: { type: "string", description: "Optional app name for the plan." },
+        brief: { type: "boolean", description: "Include the architecture brief (identity, data, money path, background work, limits, and the old patterns vxil replaces). Default true; pass false for the plan alone." }
       },
       required: ["description"]
     },
@@ -4934,18 +5420,18 @@ function buildMcpCatalog(input, tools = TOOLS) {
 }
 
 // src/store.ts
-import { homedir } from "node:os";
+import { homedir as homedir2 } from "node:os";
 import { join as join2, resolve as resolve3 } from "node:path";
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2, chmodSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2, chmodSync } from "node:fs";
 function credDir() {
-  return join2(homedir(), ".vxil");
+  return join2(homedir2(), ".vxil");
 }
 function credFile() {
   return join2(credDir(), "credentials.json");
 }
 function loadCredentials() {
   try {
-    return JSON.parse(readFileSync2(credFile(), "utf8"));
+    return JSON.parse(readFileSync3(credFile(), "utf8"));
   } catch {
     return {};
   }
@@ -4963,7 +5449,7 @@ function projectFile(cwd = process.cwd()) {
 }
 function loadProject(cwd = process.cwd()) {
   try {
-    return JSON.parse(readFileSync2(projectFile(cwd), "utf8"));
+    return JSON.parse(readFileSync3(projectFile(cwd), "utf8"));
   } catch {
     return null;
   }
@@ -4999,7 +5485,15 @@ function bindNamedSlot(existing, name, slot) {
     );
   }
   if (name === "dev") {
-    return { ...existing, dev: { tenant_id: slot.tenant_id, slug: slot.slug, edge_url: slot.edge_url } };
+    return {
+      ...existing,
+      dev: {
+        tenant_id: slot.tenant_id,
+        slug: slot.slug,
+        edge_url: slot.edge_url,
+        ...slot.expires_at ? { expires_at: slot.expires_at } : {}
+      }
+    };
   }
   const { expires_at: _x, ...permanent } = slot;
   void _x;
@@ -5265,6 +5759,28 @@ function driftExitCode(r) {
   if (r.errors > 0) return 2;
   return r.drift > 0 ? 1 : 0;
 }
+function newComparedCounts(opts = {}) {
+  const base = { features: 0, collections: 0, functions: 0, secrets: 0 };
+  return opts.apiState ? { ...base, policies: 0, subscriptions: 0, campaigns: 0 } : base;
+}
+var COMPARED_LABELS = [
+  ["features", "feature"],
+  ["collections", "collection"],
+  ["functions", "function"],
+  ["secrets", "secret ref"],
+  ["policies", "policy"],
+  ["subscriptions", "subscription"],
+  ["campaigns", "campaign"]
+];
+function formatCompared(c) {
+  const parts = [];
+  for (const [key, label] of COMPARED_LABELS) {
+    const v = c[key];
+    if (v === void 0) continue;
+    parts.push(label === "policy" ? `${v} policy(ies)` : `${v} ${label}(s)`);
+  }
+  return parts.join(" \xB7 ");
+}
 
 // src/doctor.ts
 var SECRETS_ADVISORY_NOTE = "advisory only: a config push with an unstored `secret:<name>` ref is a WARNING, never a 422 \u2014 vxil's promotion order sets production secrets AFTER the config push (`vxil secrets set <feature>/<name>`); doctor never deletes a stored secret";
@@ -5307,6 +5823,17 @@ function notificationsProviderChecks(manifest) {
   }
   return [{ name: "notifications provider", ok: true, warn: true, detail: MOCK_PROVIDER_NOTE }];
 }
+var PAYMENTS_WEBHOOK_SECRET_NOTE = "payments provider is real but no per-tenant webhook secret is declared: every inbound provider delivery will be rejected 401 bad_signature and recorded as a sig_failed row (those rows can never be reprocessed, so the money events behind them are lost). There is NO platform-wide fallback. Declare <provider>.webhookSecretRef in your payments config and store the value with `vxil secrets set payments/<name>`";
+function paymentsWebhookSecretChecks(manifest) {
+  if (!manifest || manifest.enabled === false) return [];
+  const provider = String(manifest.provider ?? "");
+  if (provider === "mock" || provider === "") return [];
+  const declared = provider === "paypal" ? !!manifest.paypal?.webhookId && !!manifest.paypal?.clientIdRef && !!manifest.paypal?.secretRef : provider === "stripe" ? !!manifest.stripe?.webhookSecretRef : provider === "paddle" ? !!manifest.paddle?.webhookSecretRef : provider === "revenuecat" ? !!manifest.revenuecat?.webhookSecretRef : true;
+  if (declared) {
+    return [{ name: "payments webhook secret", ok: true, detail: `${provider} \xB7 webhook credential declared` }];
+  }
+  return [{ name: "payments webhook secret", ok: true, warn: true, detail: `${provider}: ${PAYMENTS_WEBHOOK_SECRET_NOTE}` }];
+}
 function sha12Of(scriptRef) {
   if (!scriptRef) return void 0;
   const m = /-([0-9a-f]{12})$/.exec(scriptRef);
@@ -5353,6 +5880,36 @@ function functionChecks(rows) {
     ...r.verdict === "local-changed" || r.verdict === "not-deployed" || r.verdict === "remote-only" || r.verdict === "served-unpublished" ? { warn: true } : {}
   }));
 }
+function devSlotExpiryCheck(dev, now) {
+  if (!dev) return null;
+  if (!dev.expires_at) {
+    return {
+      name: "dev slot expiry",
+      ok: true,
+      warn: true,
+      detail: `unknown for '${dev.slug}' \u2014 run \`vxil dev up\` to refresh it (a slot bound with \`vxil link --as dev\`, or written before the CLI tracked TTLs, carries none)`
+    };
+  }
+  const ms = new Date(dev.expires_at).getTime();
+  if (!Number.isFinite(ms)) {
+    return { name: "dev slot expiry", ok: true, warn: true, detail: `unreadable expiry '${dev.expires_at}' on '${dev.slug}' \u2014 run \`vxil dev up\`` };
+  }
+  const hours = Math.round((ms - now.getTime()) / 36e5);
+  if (hours <= 0) {
+    return {
+      name: "dev slot expiry",
+      ok: true,
+      warn: true,
+      detail: `'${dev.slug}' EXPIRED ${dev.expires_at} (${Math.abs(hours)}h ago) \u2014 the nightly reaper deletes it; run \`vxil dev up\``
+    };
+  }
+  return {
+    name: "dev slot expiry",
+    ok: true,
+    ...hours < 72 ? { warn: true } : {},
+    detail: `'${dev.slug}' expires ${dev.expires_at} (in ${hours}h)` + (hours < 72 ? " \u2014 run `vxil dev up` to extend" : "")
+  };
+}
 
 // src/link.ts
 function data(r) {
@@ -5441,6 +5998,37 @@ async function devDown(dash, cookie, dev) {
     `dev down failed (${e?.code ?? r.status}${e?.message ? ` \u2014 ${e.message}` : ""})`
   );
 }
+async function devExtend(dash, cookie, dev, ttlHours) {
+  const r = await dash(
+    "POST",
+    `/dashboard/tenants/${dev.tenant_id}/extend`,
+    ttlHours === void 0 ? {} : { ttl_hours: ttlHours },
+    cookie
+  );
+  if (r.status === 200) {
+    const d = r.json.data ?? r.json;
+    return { extended: true, ...d.expires_at ? { expires_at: d.expires_at } : {} };
+  }
+  if (r.status === 404) return { gone: true };
+  const e = r.json.error;
+  if (r.status === 409 && e?.code === "not_a_dev_tenant") return { notDev: true };
+  throw new Error(
+    `dev tenant extend failed (${e?.code ?? r.status}${e?.message ? ` - ${e.message}` : ""})`
+  );
+}
+var TTL_MIN_HOURS = 1;
+var TTL_MAX_HOURS = 720;
+function parseTtlFlag(raw, fallback) {
+  if (raw === void 0) return { hours: fallback };
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < TTL_MIN_HOURS || n > TTL_MAX_HOURS) {
+    return { error: `--ttl '${raw}': expected a whole number of HOURS, ${TTL_MIN_HOURS}..${TTL_MAX_HOURS} (default ${fallback})` };
+  }
+  return { hours: n };
+}
+function haveDashSession(creds, email, password) {
+  return Boolean(creds.session) || Boolean(email && password);
+}
 
 // src/envPull.ts
 var MANAGED_HEADER = "# vxil (managed by `vxil env pull`)";
@@ -5502,6 +6090,13 @@ function pickBranchSlot(binding, name, now, hasKey) {
   if (!hasKey(slot.slug)) return { create: true };
   return { reuse: slot };
 }
+function pickDevSlot(binding, now, hasKey) {
+  const slot = binding?.dev;
+  if (!slot) return { create: true };
+  if (slot.expires_at && new Date(slot.expires_at).getTime() <= now.getTime()) return { create: true };
+  if (!hasKey(slot.slug)) return { create: true };
+  return { reuse: slot };
+}
 async function createBranchTenant(dash, opts) {
   const r = await dash("POST", "/dashboard/quickstart", {
     email: opts.email,
@@ -5528,6 +6123,159 @@ async function createBranchTenant(dash, opts) {
   };
 }
 
+// src/promotionGate.ts
+var NON_PRODUCTION_ENV_LABELS = /* @__PURE__ */ new Set([
+  "staging",
+  "stage",
+  "dev",
+  "development",
+  "test",
+  "qa",
+  "preview",
+  "sandbox",
+  "local"
+]);
+function normalizeLabel(label) {
+  return label.trim().toLowerCase();
+}
+function isNonProductionLabel(label) {
+  return NON_PRODUCTION_ENV_LABELS.has(normalizeLabel(label));
+}
+function isDevSlot(t) {
+  return t.slot === "dev" || t.slot === "named" && t.selector.kind === "named" && t.selector.name === "dev";
+}
+function isProductionTarget(t) {
+  if (isDevSlot(t)) return false;
+  if (normalizeLabel(t.envLabel) === "production") return true;
+  return envLabelFor(t.baseUrl) === "production" && !isNonProductionLabel(t.envLabel);
+}
+function hostOf(baseUrl) {
+  try {
+    return new URL(baseUrl).host;
+  } catch {
+    return baseUrl;
+  }
+}
+function unrecognizedLabelNotice(t) {
+  if (isDevSlot(t)) return null;
+  if (normalizeLabel(t.envLabel) === "production") return null;
+  if (envLabelFor(t.baseUrl) !== "production") return null;
+  if (isNonProductionLabel(t.envLabel)) return null;
+  return `env label '${t.envLabel}' is not a recognized environment and the host is ${hostOf(t.baseUrl)} \u2014 treating this target as PRODUCTION (use --env staging|dev|test|qa|preview|sandbox|local to say otherwise)`;
+}
+function envLabelWarning(label, baseUrl) {
+  const l = normalizeLabel(label);
+  const host = hostOf(baseUrl);
+  if (envLabelFor(baseUrl) === "production") {
+    if (l === "production") return null;
+    if (isNonProductionLabel(l)) {
+      return `slot labelled '${label}' on the PRODUCTION host ${host} \u2014 the push promotion gate will NOT fire for it (the documented staging-twin pattern; re-link with --env production if this IS a production tenant)`;
+    }
+    return `env label '${label}' is not a recognized environment \u2014 on the PRODUCTION host ${host} it is treated as PRODUCTION (the push promotion gate WILL fire). Use production|staging|dev|test|qa|preview|sandbox|local.`;
+  }
+  if (l === "production") {
+    return `slot labelled 'production' on the non-production host ${host} \u2014 the push promotion gate WILL fire for it`;
+  }
+  return null;
+}
+function isPlainObject2(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function leafAt(manifest, dotted) {
+  let cur = manifest;
+  for (const seg of dotted.split(".")) {
+    if (!isPlainObject2(cur)) return void 0;
+    cur = cur[seg];
+  }
+  return cur;
+}
+function mockFeatures(cfg) {
+  return Object.entries(cfg.features ?? {}).filter(([, conf]) => {
+    if (!isPlainObject2(conf)) return false;
+    const c = conf;
+    return c.provider === "mock" || c.defaultProvider === "mock" || (isPlainObject2(c.embed) ? c.embed.provider === "mock" : false);
+  }).map(([f]) => f);
+}
+var SANDBOX_LEAVES = [
+  { feature: "payments", path: "paddle.sandbox" },
+  { feature: "payments", path: "paypal.sandbox" },
+  { feature: "payments", path: "revenuecat.acceptSandbox" }
+];
+function sandboxFeatures(cfg) {
+  const out = [];
+  for (const leaf of SANDBOX_LEAVES) {
+    const manifest = (cfg.features ?? {})[leaf.feature];
+    if (leafAt(manifest, leaf.path) === true) out.push(`${leaf.feature}.${leaf.path}`);
+  }
+  return out;
+}
+function isDevHost(host) {
+  const h = host.toLowerCase().replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
+  if (h === "localhost" || h.endsWith(".localhost")) return true;
+  if (h === "127.0.0.1" || h.startsWith("127.")) return true;
+  if (h === "::1") return true;
+  if (h === "local" || h.endsWith(".local")) return true;
+  if (/^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
+  if (/^192\.168\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/.test(h)) return true;
+  return false;
+}
+function devRedirectOrigins(origins = []) {
+  const out = [];
+  for (const raw of origins) {
+    if (typeof raw !== "string" || !raw) continue;
+    if (/^http:\/\//i.test(raw)) {
+      out.push(raw);
+      continue;
+    }
+    const host = raw.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/[/?#].*$/, "");
+    if (host && isDevHost(host)) out.push(raw);
+  }
+  return out;
+}
+function redirectOrigins(cfg) {
+  const v = leafAt((cfg.features ?? {}).auth, "security.allowedRedirectOrigins");
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+}
+var PROMOTION_OVERRIDE_FLAGS = {
+  mock: "allow-mock-in-prod",
+  sandbox: "allow-sandbox-in-prod",
+  origins: "allow-dev-origins-in-prod"
+};
+function promotionRefusals(cfg, allowed) {
+  const out = [];
+  const mocks = mockFeatures(cfg);
+  if (mocks.length && !allowed(PROMOTION_OVERRIDE_FLAGS.mock)) {
+    out.push({
+      kind: "mock",
+      flag: PROMOTION_OVERRIDE_FLAGS.mock,
+      message: `mock providers on [${mocks.join(", ")}] would ship to production (mock email/payments silently no-op). Set a real provider, or override with --${PROMOTION_OVERRIDE_FLAGS.mock}.`
+    });
+  }
+  const sandboxes = sandboxFeatures(cfg);
+  if (sandboxes.length && !allowed(PROMOTION_OVERRIDE_FLAGS.sandbox)) {
+    out.push({
+      kind: "sandbox",
+      flag: PROMOTION_OVERRIDE_FLAGS.sandbox,
+      message: `sandbox provider flags [${sandboxes.join(", ")}] would ship to a live money path (a sandbox key signs with the wrong secret; RevenueCat folds test purchases as outcome rejected_environment). Set them false, or override with --${PROMOTION_OVERRIDE_FLAGS.sandbox}.`
+    });
+  }
+  const devOrigins = devRedirectOrigins(redirectOrigins(cfg));
+  if (devOrigins.length && !allowed(PROMOTION_OVERRIDE_FLAGS.origins)) {
+    out.push({
+      kind: "origins",
+      flag: PROMOTION_OVERRIDE_FLAGS.origins,
+      message: `auth.security.allowedRedirectOrigins contains non-production origin(s) [${devOrigins.join(", ")}] \u2014 a loopback / .local / http:// redirect target on a production auth tenant is a token-exfiltration footgun. Remove them, or override with --${PROMOTION_OVERRIDE_FLAGS.origins}.`
+    });
+  }
+  return out;
+}
+function redirectOriginNotice(cfg) {
+  const origins = redirectOrigins(cfg);
+  if (!origins.length) return null;
+  return `auth.security.allowedRedirectOrigins (${origins.length}): ${origins.join(", ")}`;
+}
+
 // src/try.ts
 async function mintTry(fetchImpl, base, opts = {}) {
   const url = `${base.replace(/\/$/, "")}/v1/try`;
@@ -5649,11 +6397,11 @@ function formatSimulate(r) {
 }
 
 // src/migrate/paymentsSync.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname3, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname4, resolve as resolve5 } from "node:path";
 
 // src/migrate/commands.ts
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import { basename as basename2, resolve as resolve4 } from "node:path";
 
 // src/migrate/inference.ts
@@ -6135,8 +6883,8 @@ function topoOrder(cmsNames, fks, profileTable, warnings) {
 }
 
 // src/migrate/loaders/index.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
 
 // src/migrate/types.ts
 function newMigrateState() {
@@ -6949,10 +7697,10 @@ async function verifyMigration({ deps, plan, adapter, state }) {
 
 // src/migrate/loaders/index.ts
 function loadMigrateState(stateFile) {
-  if (!existsSync3(stateFile)) return newMigrateState();
+  if (!existsSync4(stateFile)) return newMigrateState();
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync3(stateFile, "utf8"));
+    parsed = JSON.parse(readFileSync4(stateFile, "utf8"));
   } catch (e) {
     throw new Error(
       `migrate state ${stateFile} is not parseable JSON (${e.message.split("\n")[0]}) \u2014 fix or delete the file (deleting restarts the migration; loaded cms rows are still deduped only if the id-map inside it is preserved).`
@@ -6970,7 +7718,7 @@ function loadMigrateState(stateFile) {
   };
 }
 function saveMigrateState(stateFile, state) {
-  mkdirSync2(dirname2(stateFile), { recursive: true });
+  mkdirSync2(dirname3(stateFile), { recursive: true });
   writeFileSync3(stateFile, JSON.stringify(state, null, 2) + "\n");
 }
 function guardReadOnly(api) {
@@ -7098,7 +7846,7 @@ function writeMigrateArtifact(path, content) {
 function ensureStateIgnored(cwd, log) {
   const entry = `${MIGRATE_DIR}/state.json`;
   const gi = resolve4(cwd, ".gitignore");
-  const existing = existsSync4(gi) ? readFileSync4(gi, "utf8") : "";
+  const existing = existsSync5(gi) ? readFileSync5(gi, "utf8") : "";
   if (gitignoreCovers(existing, entry)) return;
   const sep2 = existing === "" || existing.endsWith("\n") ? "" : "\n";
   appendFileSync(gi, `${sep2}
@@ -7135,7 +7883,7 @@ function emitResidualsMd(plan, sourceLabel) {
     "",
     "A migration is never 100% mechanical. Everything below was NOT carried",
     "automatically \u2014 each item needs a human decision or a post-cutover step",
-    "(docs/migration-import-design.md \xA710). `vxil migrate verify` restates this list.",
+    "(https://vxil.com/docs/guide/15-migrating-to-vxil#what-a-migration-cannot-carry-the-residuals). `vxil migrate verify` restates this list.",
     "",
     "## Detected in this source",
     "",
@@ -7196,12 +7944,12 @@ async function runMigratePlan({ adapter, cwd, log, sourceLabel, infer }) {
 }
 function readPlanFile(cwd) {
   const p = migratePaths(cwd);
-  if (!existsSync4(p.planFile)) {
+  if (!existsSync5(p.planFile)) {
     throw new Error(`no ${MIGRATE_DIR}/plan.json \u2014 run \`vxil migrate plan --from <provider> \u2026\` first.`);
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync4(p.planFile, "utf8"));
+    parsed = JSON.parse(readFileSync5(p.planFile, "utf8"));
   } catch (e) {
     throw new Error(`${MIGRATE_DIR}/plan.json is not parseable JSON (${e.message.split("\n")[0]}) \u2014 re-run \`vxil migrate plan\`.`);
   }
@@ -7219,10 +7967,10 @@ function readPlanFile(cwd) {
 }
 function readPaymentsSpecs(cwd) {
   const p = migratePaths(cwd);
-  if (!existsSync4(p.paymentsFile)) return void 0;
+  if (!existsSync5(p.paymentsFile)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync4(p.paymentsFile, "utf8"));
+    parsed = JSON.parse(readFileSync5(p.paymentsFile, "utf8"));
   } catch (e) {
     throw new Error(`${MIGRATE_DIR}/payments.json is not parseable JSON (${e.message.split("\n")[0]})`);
   }
@@ -7304,10 +8052,10 @@ function paymentsSyncStatePath(cwd) {
   return resolve5(cwd, MIGRATE_DIR, "payments-sync.state.json");
 }
 function loadPaymentsSyncState(path, provider) {
-  if (!existsSync5(path)) return { version: 1, provider, done: {} };
+  if (!existsSync6(path)) return { version: 1, provider, done: {} };
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(path, "utf8"));
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
   } catch (e) {
     throw new Error(`${path} is not parseable JSON (${e.message.split("\n")[0]}) \u2014 fix or delete it (deleting re-syncs every customer; the server fold is idempotent).`);
   }
@@ -7319,7 +8067,7 @@ function loadPaymentsSyncState(path, provider) {
   return { version: 1, provider, done: s.done ?? {}, ...s.usersCursor !== void 0 ? { usersCursor: s.usersCursor } : {} };
 }
 function savePaymentsSyncState(path, state) {
-  mkdirSync4(dirname3(path), { recursive: true });
+  mkdirSync4(dirname4(path), { recursive: true });
   writeFileSync5(path, JSON.stringify(state, null, 2) + "\n");
 }
 function parseCustomersCsv(text) {
@@ -8008,7 +8756,7 @@ export default defineConfig({
     "id": "agent-desk",
     "title": "Agent Desk (mcp \xB7 copilot \xB7 classify \xB7 judge \xB7 rag)",
     "vertical": "ai",
-    "summary": "The whole AI half on a deliberately small support desk \u2014 forced-label classification on every new ticket, a grounded and cited draft scored by a second judging pass, a knowledge index kept in step with a cms collection, an in-app assistant whose writes are proposed and human-confirmed, the same backend exposed as a narrowed MCP tool set for a least-privilege agent key, and a capability probe that reads the 170-event catalog so an agent can discover what it is able to react to.",
+    "summary": "The whole AI half on a deliberately small support desk \u2014 forced-label classification on every new ticket, a grounded and cited draft scored by a second judging pass, a knowledge index kept in step with a cms collection, an in-app assistant whose writes are proposed and human-confirmed, the same backend exposed as a narrowed MCP tool set for a least-privilege agent key, and a capability probe that reads the platform event catalog so an agent can discover what it is able to react to.",
     "collections": [
       "tickets",
       "kb"
@@ -9125,7 +9873,7 @@ export default defineConfig({
 ];
 
 // src/migrate/adapters/csv-json.ts
-import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync6, statSync } from "node:fs";
+import { readFileSync as readFileSync7, readdirSync, existsSync as existsSync7, statSync } from "node:fs";
 import { basename as basename3, extname, join as join3, resolve as resolve6 } from "node:path";
 function parseCsv(text) {
   const src = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
@@ -9244,11 +9992,11 @@ var CsvJsonAdapter = class {
   }
   load() {
     if (this.cache) return this.cache;
-    if (!existsSync6(this.dir)) throw new Error(`csv-json: directory not found: ${this.dir}`);
+    if (!existsSync7(this.dir)) throw new Error(`csv-json: directory not found: ${this.dir}`);
     let overrides = {};
     const schemaFile = join3(this.dir, "_schema.json");
-    if (existsSync6(schemaFile)) {
-      overrides = JSON.parse(readFileSync6(schemaFile, "utf8"));
+    if (existsSync7(schemaFile)) {
+      overrides = JSON.parse(readFileSync7(schemaFile, "utf8"));
     }
     const warnings = [
       `csv-json: column types inferred from a \u2264${this.sampleSize}-row value sample \u2014 confirm the plan before load`
@@ -9301,7 +10049,7 @@ var CsvJsonAdapter = class {
       warnings
     };
     const objectsRoot = join3(this.dir, OBJECTS_DIR);
-    if (existsSync6(objectsRoot)) {
+    if (existsSync7(objectsRoot)) {
       const buckets = readdirSync(objectsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => ({ name: e.name, objectCount: walkFiles(join3(objectsRoot, e.name)).length })).sort((a, b2) => a.name.localeCompare(b2.name));
       if (buckets.length > 0) schema.buckets = buckets;
     }
@@ -9324,7 +10072,7 @@ var CsvJsonAdapter = class {
     return this.cache;
   }
   loadCsv(file, schemaName, tableName, overrides, warnings) {
-    const parsed = parseCsv(readFileSync6(file, "utf8"));
+    const parsed = parseCsv(readFileSync7(file, "utf8"));
     const header = parsed[0];
     if (!header || header.length === 0) {
       warnings.push(`csv-json: ${basename3(file)} is empty (no header row) \u2014 skipped`);
@@ -9362,7 +10110,7 @@ var CsvJsonAdapter = class {
     return { schema: schemaName, name: tableName, columns, rows };
   }
   loadJson(file, schemaName, tableName, overrides, warnings) {
-    const parsed = JSON.parse(readFileSync6(file, "utf8"));
+    const parsed = JSON.parse(readFileSync7(file, "utf8"));
     if (!Array.isArray(parsed)) {
       warnings.push(`csv-json: ${basename3(file)} is not a JSON array of row objects \u2014 skipped`);
       return void 0;
@@ -9436,7 +10184,7 @@ var CsvJsonAdapter = class {
    *  read LAZILY per object via stream() — a dry-run never opens them. */
   async *readObjects(bucket) {
     const root = join3(this.dir, OBJECTS_DIR, bucket);
-    if (!existsSync6(root)) {
+    if (!existsSync7(root)) {
       throw new Error(`csv-json: unknown bucket '${bucket}' \u2014 no ${OBJECTS_DIR}/${bucket}/ directory in the export`);
     }
     for (const rel of walkFiles(root)) {
@@ -9446,7 +10194,7 @@ var CsvJsonAdapter = class {
         path: rel,
         contentType: EXT_CONTENT_TYPES[ext] ?? "application/octet-stream",
         size: statSync(abs).size,
-        stream: async () => readFileSync6(abs)
+        stream: async () => readFileSync7(abs)
       };
     }
   }
@@ -10212,6 +10960,11 @@ function hasFlag(name) {
   return rest.includes(`--${name}`);
 }
 var jsonOut = rest.includes("--json");
+function ttlFlag(fallback) {
+  const parsed = parseTtlFlag(flag("ttl"), fallback);
+  if ("error" in parsed) fail(parsed.error);
+  return parsed.hours;
+}
 function fail(msg, code = 1) {
   console.error(`vxil: ${msg}`);
   process.exit(code);
@@ -10303,6 +11056,8 @@ function persistLink(slug, tenantId, apiKey, base) {
   saveCredentials(creds);
   const as = flag("as");
   const env = flag("env") ?? envLabelFor(base);
+  const envWarn = envLabelWarning(env, base);
+  if (envWarn) console.error(`vxil: ${envWarn}`);
   const existing = loadProject();
   if (as !== void 0) {
     if (!TARGET_NAME_RE.test(as)) fail(`--as '${as}': a target name is 1\u201340 chars of [a-z0-9-], starting with a letter`);
@@ -10416,7 +11171,7 @@ function againstSelector(name) {
 }
 function loadDriftIgnore() {
   const f = resolve7(process.cwd(), ".vxil", "drift-ignore");
-  return parseIgnorePatterns(flag("ignore"), existsSync7(f) ? readFileSync7(f, "utf8") : void 0);
+  return parseIgnorePatterns(flag("ignore"), existsSync8(f) ? readFileSync8(f, "utf8") : void 0);
 }
 async function runApply(apply, sel = "prod", opts = {}) {
   const gate = !apply && !!opts.gate;
@@ -10424,6 +11179,7 @@ async function runApply(apply, sel = "prod", opts = {}) {
   const { api, target } = requireApi(sel, apply ? { write: "push" } : gate ? { exitCode: 2 } : {});
   if (!apply) console.error(targetBanner(target, gate ? "diff" : "plan"));
   const report = { drift: 0, ignored: 0, errors: 0 };
+  const compared = newComparedCounts({ apiState: !!opts.apiState });
   const ignore = apply ? [] : loadDriftIgnore();
   const ignoredKeys = [];
   const count = (key) => {
@@ -10441,18 +11197,55 @@ async function runApply(apply, sel = "prod", opts = {}) {
     process.exit(2);
   }
   const cwd = process.cwd();
-  if (cfg.cms?.collections && Object.keys(cfg.cms.collections).length) {
-    const r = await planCmsSchema({ api, collections: cfg.cms.collections, apply, allowDestructive: hasFlag("allow-destructive") });
+  const notCompared = (u, hint) => {
+    console.log(formatNotCompared(u, hint));
+    if (gate) report.errors++;
+  };
+  const runSection = async (label, fn) => {
+    if (!gate) {
+      await fn();
+      return;
+    }
+    try {
+      await fn();
+    } catch (e) {
+      console.log(`  ! not compared: ${label} \u2192 ${e.message.split("\n")[0]}`);
+      report.errors++;
+    }
+  };
+  await runSection("cms.schema", async () => {
+    if (!cfg.cms?.collections || !Object.keys(cfg.cms.collections).length) return;
+    const r = await planCmsSchema({
+      api,
+      collections: cfg.cms.collections,
+      apply,
+      allowDestructive: hasFlag("allow-destructive"),
+      // the C-1 re-index loop can take several pages on a big collection —
+      // print progress so a long push is never a silent stall
+      onProgress: (line) => console.log(line)
+    });
     console.log("\ncms.schema:");
+    if (r.remoteUnavailable) {
+      notCompared(r.remoteUnavailable, "needs cms:read, features:read or admin");
+      return;
+    }
     console.log(formatCmsChanges(r.changes));
     if (apply && r.applied) console.log(`  \u2713 applied ${r.applied} schema change(s)`);
     for (const c of r.changes) count(`cms:${c.collection}${c.field ? `.${c.field}` : ""}`);
-  }
+    compared.collections += Object.keys(cfg.cms.collections).length;
+  });
   const { functions: _fnFeature, ...configFeatures } = cfg.features;
   void _fnFeature;
-  if (Object.keys(configFeatures).length) {
+  await runSection("config", async () => {
+    if (!Object.keys(configFeatures).length) return;
     const results = await planOrPush({ api, features: configFeatures, apply });
     for (const r of results) {
+      if (r.remoteUnavailable) {
+        console.log(`
+${r.feature}:`);
+        notCompared(r.remoteUnavailable, "needs features:read or admin");
+        continue;
+      }
       console.log(`
 ${r.feature} (remote v${r.version}):`);
       const { kept, ignored } = partitionConfigChanges(r.feature, r.changes, ignore);
@@ -10464,29 +11257,42 @@ ${r.feature} (remote v${r.version}):`);
         console.log("  provenance (declared in vxil.config vs schema default):");
         console.log(formatExplain(r.feature, explainLeaves(configFeatures[r.feature], r.effective), new Set(r.changes.map((c) => c.path))));
       }
+      compared.features++;
+    }
+  });
+  await runSection("functions", async () => {
+    if (!cfg.functions || !Object.keys(cfg.functions).length) {
+      if (cfg.features.functions) {
+        console.log("\nfunctions: features.functions is declared but no functions/ are defined to deploy \u2014 the feature enables per-function on deploy (no feature-level config namespace).");
+      }
+      return;
     }
-  }
-  if (cfg.functions && Object.keys(cfg.functions).length) {
     const r = await planFunctions({ api, functions: cfg.functions, cwd, apply });
     console.log("\nfunctions:");
+    if (r.remoteUnavailable) {
+      notCompared(r.remoteUnavailable, "needs functions:read, features:read or admin");
+      return;
+    }
     console.log(formatFnChanges(r.changes));
     if (apply && r.applied) console.log(`  \u2713 deployed ${r.applied} function(s)`);
     if (apply && r.cmsHookSubscriptions && (r.cmsHookSubscriptions.created || r.cmsHookSubscriptions.deleted)) {
       console.log(`  \u2713 cms-hook subscription reconciled (+${r.cmsHookSubscriptions.created} / -${r.cmsHookSubscriptions.deleted})`);
     }
     for (const c of r.changes) if (c.kind !== "unchanged") count(`function:${c.name}`);
-  } else if (cfg.features.functions) {
-    console.log("\nfunctions: features.functions is declared but no functions/ are defined to deploy \u2014 the feature enables per-function on deploy (no feature-level config namespace).");
-  }
+    compared.functions += Object.keys(cfg.functions).length;
+  });
   if (!apply && (gate || explain)) {
-    const refs = collectSecretRefs(cfg);
-    const res = await api("GET", "/v1/secrets");
-    console.log("\nsecrets (names only \u2014 values are never read or compared):");
-    if (res.status !== 200) {
-      const e = res.body.error ?? {};
-      console.log(`  ! not compared: GET /v1/secrets \u2192 ${e.code ?? res.status}${e.message ? ` \u2014 ${e.message}` : ""} (needs features:write, secrets:write or admin)`);
-      if (gate) report.errors++;
-    } else {
+    await runSection("secrets", async () => {
+      const refs = collectSecretRefs(cfg);
+      const res = await api("GET", "/v1/secrets");
+      console.log("\nsecrets (names only \u2014 values are never read or compared):");
+      if (res.status !== 200) {
+        notCompared(
+          { route: "GET /v1/secrets", status: res.status, ...res.body.error?.code ? { code: res.body.error.code } : {}, ...res.body.error?.message ? { message: res.body.error.message } : {} },
+          "needs features:write, secrets:write or admin"
+        );
+        return;
+      }
       const stored = res.body.data?.secrets ?? [];
       const cmp = compareSecretNames(refs, stored);
       if (!cmp.missing.length && !cmp.unreferenced.length) console.log(`  (in sync \u2014 ${cmp.present.length} ref(s), all stored)`);
@@ -10497,15 +11303,61 @@ ${r.feature} (remote v${r.version}):`);
       }
       for (const u of cmp.unreferenced) console.log(`  \xB7 ${u.feature}/${u.secret_name} stored but not referenced by this config (informational)`);
       if (cmp.missing.length) console.log("  note: a push with an unstored ref is a WARNING, never a 422 \u2014 set values after the push with `vxil secrets set <feature>/<name>`");
-    }
+      compared.secrets += refs.length;
+    });
+  }
+  const apiStateCounts = {
+    policies: { compared: 0, drift: 0 },
+    subscriptions: { compared: 0, drift: 0 },
+    campaigns: { compared: 0, drift: 0 }
+  };
+  if (opts.apiState) {
+    await runSection("api-state", async () => {
+      const self = requireApi(opts.apiState.self, { exitCode: 2 });
+      const other = requireApi(opts.apiState.against, { exitCode: 2 });
+      console.log(`
+api state \u2014 ${self.target.tenantSlug ?? "(env key)"} vs ${other.target.tenantSlug ?? "(env key)"} (read-only: \`vxil push\` does NOT converge API state, and a config rollback does not restore it):`);
+      const [a, b2] = await Promise.all([fetchApiState(self.api), fetchApiState(other.api)]);
+      for (const u of a.unavailable) notCompared(u, `target ${self.target.tenantSlug ?? ""}`.trim());
+      for (const u of b2.unavailable) notCompared(u, `--against ${other.target.tenantSlug ?? ""}`.trim());
+      for (const w of [...truncationWarnings(a, "the target"), ...truncationWarnings(b2, "--against")]) {
+        console.log(w);
+        if (gate) report.errors++;
+      }
+      if (a.unavailable.length || b2.unavailable.length) return;
+      const rows = diffApiState(a, b2);
+      console.log(formatApiStateRows(rows));
+      for (const r of rows) count(apiStateDriftKey(r));
+      const union = (x, y, k) => (/* @__PURE__ */ new Set([...x.map(k), ...y.map(k)])).size;
+      apiStateCounts.policies.compared = union(a.policies, b2.policies, (p) => p.name);
+      apiStateCounts.subscriptions.compared = union(a.subscriptions, b2.subscriptions, (x) => x.target_url);
+      apiStateCounts.campaigns.compared = union(a.campaigns, b2.campaigns, (c) => c.name);
+      for (const r of rows) {
+        if (r.section === "policy") apiStateCounts.policies.drift++;
+        else if (r.section === "subscription") apiStateCounts.subscriptions.drift++;
+        else apiStateCounts.campaigns.drift++;
+      }
+      compared.policies = apiStateCounts.policies.compared;
+      compared.subscriptions = apiStateCounts.subscriptions.compared;
+      compared.campaigns = apiStateCounts.campaigns.compared;
+    });
   }
   if (gate) {
     const code = driftExitCode(report);
     if (jsonOut) {
-      console.log(JSON.stringify({ ok: code === 0, exit_code: code, target: target.tenantSlug ?? null, env: target.envLabel, ...report, ignored_keys: ignoredKeys }));
+      console.log(JSON.stringify({
+        ok: code === 0,
+        exit_code: code,
+        target: target.tenantSlug ?? null,
+        env: target.envLabel,
+        ...report,
+        compared,
+        ignored_keys: ignoredKeys,
+        ...opts.apiState ? { api_state: apiStateCounts } : {}
+      }));
     } else {
       console.log(`
-vxil diff \u2192 ${report.drift} drift item(s), ${report.ignored} ignored, ${report.errors} error(s) \u2014 exit ${code}`);
+vxil diff \u2192 ${report.drift} drift item(s), ${report.ignored} ignored, ${report.errors} error(s) \u2014 compared ${formatCompared(compared)} \u2014 exit ${code}`);
     }
     process.exit(code);
   }
@@ -10603,7 +11455,12 @@ async function runGen(sel = "prod", opts = {}) {
         required: !!f.required,
         index_slot: f.indexSlot ?? null,
         ...f.relationTo ? { relation_to: f.relationTo } : {},
-        ...f.computed ? { computed: f.computed } : {}
+        ...f.computed ? { computed: f.computed } : {},
+        // `validation.enum` becomes a string-literal union in the generated
+        // types, so the OFFLINE collector must carry it too (the online path
+        // gets it from GET /v1/cms/collections, which returns the whole row) —
+        // else `vxil gen --offline` and `vxil gen` would disagree.
+        ...f.validation ? { validation: f.validation } : {}
       }))
     }));
     functions = Object.entries(cfg.functions ?? {}).map(([name, def]) => ({
@@ -10651,15 +11508,15 @@ async function runGen(sel = "prod", opts = {}) {
     ...catalog ? { tools: catalog.tools.length } : {}
   };
   if (hasFlag("check")) {
-    const existing = existsSync7(outPath) ? readFileSync7(outPath, "utf8") : "";
+    const existing = existsSync8(outPath) ? readFileSync8(outPath, "utf8") : "";
     if (body(existing) !== body(src)) {
       fail(`${out} is out of date (drift) \u2014 run \`vxil gen\` and commit. A collection/feature/function changed since it was generated.`);
     }
     if (catalog) {
       let upToDate = false;
-      if (existsSync7(mcpPath)) {
+      if (existsSync8(mcpPath)) {
         try {
-          const cur = JSON.parse(readFileSync7(mcpPath, "utf8"));
+          const cur = JSON.parse(readFileSync8(mcpPath, "utf8"));
           const want = JSON.parse(JSON.stringify(catalog));
           delete cur.generated_at;
           delete want.generated_at;
@@ -10704,11 +11561,11 @@ async function runWatch(sel) {
     }, 300);
   };
   const watchers = [];
-  const cfgFile = CONFIG_FILENAMES.map((n) => resolve7(cwd, n)).find((f) => existsSync7(f));
+  const cfgFile = CONFIG_FILENAMES.map((n) => resolve7(cwd, n)).find((f) => existsSync8(f));
   if (cfgFile) watchers.push(watch(cfgFile, trigger));
   for (const dir of ["functions", "cms"]) {
     const d = resolve7(cwd, dir);
-    if (existsSync7(d)) watchers.push(watch(d, trigger));
+    if (existsSync8(d)) watchers.push(watch(d, trigger));
   }
   process.on("SIGINT", () => {
     for (const w of watchers) w.close();
@@ -10718,22 +11575,19 @@ async function runWatch(sel) {
   await new Promise(() => {
   });
 }
-function mockFeatures(cfg) {
-  return Object.entries(cfg.features).filter(([, conf]) => {
-    const c = conf;
-    return c.provider === "mock" || c.defaultProvider === "mock" || c.embed?.provider === "mock";
-  }).map(([f]) => f);
-}
-function isProductionTarget(t) {
-  return t.envLabel === "production" && t.slot !== "dev" && !(t.slot === "named" && t.selector.kind === "named" && t.selector.name === "dev");
-}
 async function promotionGate(t, explicitProd) {
   const resolvedProd = isProductionTarget(t);
   if (!resolvedProd && !explicitProd) return;
+  const labelNotice = unrecognizedLabelNotice(t);
+  if (labelNotice) console.error(`vxil: ${labelNotice}`);
   const cfg = await loadVxilConfig();
-  const mocks = mockFeatures(cfg);
-  if (mocks.length && !hasFlag("allow-mock-in-prod")) {
-    fail(`refusing to push to PRODUCTION tenant '${t.tenantSlug ?? "(env key)"}' (${t.envLabel} \xB7 resolved via ${describeSelector(t.selector)}): mock providers on [${mocks.join(", ")}] would ship to production (mock email/payments silently no-op). Set a real provider, or override with --allow-mock-in-prod.`);
+  const where = `'${t.tenantSlug ?? "(env key)"}' (${t.envLabel} \xB7 resolved via ${describeSelector(t.selector)})`;
+  const notice = redirectOriginNotice(cfg);
+  if (notice) console.error(`vxil: production review \u2014 ${notice}`);
+  const refusals = promotionRefusals(cfg, hasFlag);
+  if (refusals.length) {
+    fail(`refusing to push to PRODUCTION tenant ${where}:
+` + refusals.map((r) => `  - ${r.message}`).join("\n"));
   }
   if (hasFlag("yes")) return;
   if (!process.stdin.isTTY && !explicitProd) {
@@ -10771,6 +11625,8 @@ async function runDoctor() {
   if (proj) {
     const slots = bindingSlots(proj).map((s) => `${s.label}=${s.slug}`);
     checks.push({ name: "bound slots", ok: true, detail: `${slots.join(" \xB7 ")}${proj.dev ? "" : " (no dev slot: `--dev` fails closed until `vxil dev up` / `vxil link <slug> --as dev`)"}` });
+    const expiry = devSlotExpiryCheck(proj.dev, /* @__PURE__ */ new Date());
+    if (expiry) checks.push(expiry);
   }
   if (t?.apiKey) {
     const api = makeApi({ apiKey: t.apiKey, baseUrl: t.baseUrl });
@@ -10791,6 +11647,12 @@ async function runDoctor() {
           ));
         }
       }
+      if (live.has("payments")) {
+        const pres = await api("GET", "/v1/config/payments");
+        if (pres.status === 200) {
+          checks.push(...paymentsWebhookSecretChecks(pres.body.data?.manifest));
+        }
+      }
     } else {
       checks.push({ name: "edge reachable", ok: false, detail: `GET /v1/features \u2192 ${fres.status}` });
     }
@@ -10836,7 +11698,7 @@ async function runDoctor() {
   }
   if (cfg?.functions) {
     for (const [n, def] of Object.entries(cfg.functions)) {
-      const ok = existsSync7(resolve7(process.cwd(), def.entry));
+      const ok = existsSync8(resolve7(process.cwd(), def.entry));
       checks.push({ name: `function '${n}' entry`, ok, detail: ok ? def.entry : `missing file: ${def.entry}` });
     }
   }
@@ -10894,13 +11756,13 @@ function scaffoldProject(configSrc, fns) {
   const entries = Object.entries(fns ?? {});
   if (entries.length > 0) {
     for (const [file, src] of entries) writeFileSync6(resolve7(cwd, "functions", file), src);
-  } else if (!existsSync7(resolve7(cwd, "functions/hello.ts"))) {
+  } else if (!existsSync8(resolve7(cwd, "functions/hello.ts"))) {
     writeFileSync6(resolve7(cwd, "functions/hello.ts"), STARTER_FN);
   }
   mkdirSync5(resolve7(cwd, ".vxil"), { recursive: true });
   const gi = resolve7(cwd, ".gitignore");
   const ignore = ["", "# vxil", ".vxil/", ".env.local", ""].join("\n");
-  if (!existsSync7(gi) || !readFileSync7(gi, "utf8").includes(".vxil/")) appendFileSync2(gi, ignore);
+  if (!existsSync8(gi) || !readFileSync8(gi, "utf8").includes(".vxil/")) appendFileSync2(gi, ignore);
   const pkg = ensureScaffoldPackageJson(cwd);
   if (pkg.action === "skipped") console.log(`  ! package.json not patched: ${pkg.reason}`);
   return pkg;
@@ -10908,7 +11770,7 @@ function scaffoldProject(configSrc, fns) {
 function initProject() {
   const cwd = process.cwd();
   const cfgPath = resolve7(cwd, "vxil.config.ts");
-  if (existsSync7(cfgPath) && !hasFlag("force")) fail("vxil.config.ts already exists (use --force to overwrite)");
+  if (existsSync8(cfgPath) && !hasFlag("force")) fail("vxil.config.ts already exists (use --force to overwrite)");
   const template = flag("template") ?? "tasks";
   const tpl = TEMPLATE_CATALOG.find((t) => t.id === template);
   if (!tpl) fail(`unknown template '${template}' \u2014 run \`vxil templates\` to list the gallery, or choose: ${TEMPLATE_CATALOG.map((t) => t.id).join(", ")}`);
@@ -10950,7 +11812,7 @@ try {
       const base = process.env.VXIL_BASE_URL ?? DEFAULT_BASE;
       const dash = dashboardBase(base);
       const featuresFlag = flag("features");
-      const hasConfig = CONFIG_FILENAMES.some((n) => existsSync7(resolve7(process.cwd(), n)));
+      const hasConfig = CONFIG_FILENAMES.some((n) => existsSync8(resolve7(process.cwd(), n)));
       const features = quickstartFeatures(featuresFlag, featuresFlag === void 0 && hasConfig ? await loadVxilConfig() : null);
       const email = flag("email") ?? await prompt("email: ");
       const password = flag("password") ?? await prompt("password (>=10 chars): ", { hidden: true });
@@ -10962,7 +11824,7 @@ try {
         features,
         // --dev mints an ephemeral preview tenant the server-side TTL reaper
         // tears down after --ttl hours (default 72) — the per-PR CI backend.
-        ...hasFlag("dev") ? { kind: "dev", ttl_hours: Number(flag("ttl") ?? 72) } : {},
+        ...hasFlag("dev") ? { kind: "dev", ttl_hours: ttlFlag(72) } : {},
         // --invite: required for ACCOUNT CREATION while the backend runs the
         // invite-only launch gate (existing accounts sign in ungated).
         ...flag("invite") ? { invite_code: flag("invite") } : {}
@@ -10986,7 +11848,7 @@ try {
       const slot = { tenant_id: d.tenant_id, slug: d.app_slug, edge_url: d.edge_url ?? base, env: flag("env") ?? envLabelFor(base) };
       const merged = mergePrimaryBinding(loadProject(), slot);
       saveProject(hasFlag("dev") ? { ...merged, dev: { tenant_id: slot.tenant_id, slug: slot.slug, edge_url: slot.edge_url } } : merged);
-      if (!existsSync7(resolve7(process.cwd(), "vxil.config.ts"))) initProject();
+      if (!existsSync8(resolve7(process.cwd(), "vxil.config.ts"))) initProject();
       console.log(`
 \u2713 tenant '${d.app_slug}' created \xB7 enabled: ${(d.enabled ?? []).join(", ")}`);
       if (d.expires_at) console.log(`  dev tenant \u2014 expires ${d.expires_at} (the nightly reaper tears it down; extend by recreating)`);
@@ -11054,7 +11916,7 @@ try {
         ephemeral: true,
         ...result.expires_at ? { expires_at: result.expires_at } : {}
       });
-      if (!existsSync7(resolve7(process.cwd(), "vxil.config.ts"))) scaffoldProject(TRY_CONFIG);
+      if (!existsSync8(resolve7(process.cwd(), "vxil.config.ts"))) scaffoldProject(TRY_CONFIG);
       let genOk = true;
       try {
         await runGen("prod", { offline: true });
@@ -11175,7 +12037,14 @@ ${formatSummary(state)}`);
     case "diff": {
       const against = flag("against");
       const sel = against !== void 0 ? againstSelector(against) : selector();
-      await runApply(false, sel, { explain: hasFlag("explain"), gate: against !== void 0 || hasFlag("exit-code") });
+      if (hasFlag("api-state") && against === void 0) {
+        fail("--api-state has no local source of truth \u2014 compare two live targets: `vxil diff --api-state --against <name>`", 2);
+      }
+      await runApply(false, sel, {
+        explain: hasFlag("explain"),
+        gate: against !== void 0 || hasFlag("exit-code"),
+        ...hasFlag("api-state") ? { apiState: { self: selector(), against: againstSelector(against) } } : {}
+      });
       break;
     }
     case "push": {
@@ -11277,7 +12146,7 @@ ${plan.rationale}`);
 export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { collections: cmsBlock } }, null, 2)});
 `;
       const out = flag("out") ?? "vxil.config.ts";
-      if (existsSync7(resolve7(process.cwd(), out)) && !hasFlag("force")) fail(`${out} exists (use --force or --out <file>)`);
+      if (existsSync8(resolve7(process.cwd(), out)) && !hasFlag("force")) fail(`${out} exists (use --force or --out <file>)`);
       writeFileSync6(resolve7(process.cwd(), out), src);
       const pkgRes = ensureScaffoldPackageJson(process.cwd());
       if (pkgRes.action === "created" || pkgRes.action === "added") {
@@ -11387,7 +12256,7 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
       const file = flag("file");
       if (!feature || !file) fail("usage: vxil import <feature> --file <bundle.json> [--mode merge|replace]");
       const { api } = requireApi(selector(), { write: `import ${feature}` });
-      const bundle = JSON.parse(readFileSync7(resolve7(process.cwd(), file), "utf8"));
+      const bundle = JSON.parse(readFileSync8(resolve7(process.cwd(), file), "utf8"));
       printEnvelope(await api("POST", `/v1/import/${feature}`, { bundle, mode: flag("mode") ?? "merge" }));
       break;
     }
@@ -11401,7 +12270,7 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
         if (!name) fail("usage: vxil functions new <name>");
         mkdirSync5(resolve7(process.cwd(), "functions"), { recursive: true });
         const p = resolve7(process.cwd(), `functions/${name}.ts`);
-        if (existsSync7(p) && !hasFlag("force")) fail(`functions/${name}.ts exists`);
+        if (existsSync8(p) && !hasFlag("force")) fail(`functions/${name}.ts exists`);
         writeFileSync6(p, STARTER_FN);
         console.log(`scaffolded functions/${name}.ts \u2014 declare it in vxil.config.ts \`functions\` and \`vxil push\``);
       } else if (sub === "list") {
@@ -11481,8 +12350,22 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
         printEnvelope(await api("GET", "/v1/cms/collections"));
       } else if (sub === "pull") {
         printEnvelope(await api("GET", "/v1/cms/collections"));
+      } else if (sub === "reindex") {
+        const [collection] = positional(1);
+        if (!collection) fail("usage: vxil cms reindex <collection> [--field <field>]");
+        const field = flag("field");
+        const done = await reindexCollection({
+          api,
+          collection,
+          ...field ? { field } : {},
+          onProgress: (p) => console.log(`  \u2026 scanned ${p.scanned}, re-projected ${p.updated}` + (p.skipped > 0 ? `, ${p.skipped} skipped (written concurrently)` : ""))
+        }).catch((e) => fail(e.message));
+        console.log(`\u2713 re-indexed ${collection}${field ? `.${field}` : ""}: ${done.scanned} row(s) scanned, ${done.updated} re-projected` + (done.skipped > 0 ? `, ${done.skipped} skipped` : ""));
+        if (done.skipped > 0) {
+          console.log(`  \u26A0 ${done.skipped} row(s) were written while the re-index ran and were NOT re-projected \u2014 re-run \`vxil cms reindex ${collection}\` when writes are quiet`);
+        }
       } else {
-        fail("usage: vxil cms status|pull");
+        fail("usage: vxil cms status|pull|reindex <collection> [--field <field>]");
       }
       break;
     }
@@ -11578,7 +12461,8 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
   init [--template <id>] \xB7 templates \xB7 try (keyless sandbox) \xB7 quickstart [--dev --ttl <h>] \xB7 login \xB7 link <slug> [--as dev|<name>]
   architect "<describe your app>" \u2014 plain English in, a reviewed vxil.config.ts draft out
   plan [--explain] \xB7 push [--dev|--target <name>|--prod] [--server [--resume <apply_id>]] [--no-gen] \xB7 pull \xB7 gen [--check] [--offline] [--out <f>] [--no-mcp] [--mcp-out <f>]
-  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (secrets by name only)
+    push production overrides: --allow-mock-in-prod \xB7 --allow-sandbox-in-prod \xB7 --allow-dev-origins-in-prod \xB7 --yes
+  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>] [--api-state]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (an unreadable remote is 2; secrets by name only)
   doctor [--dev|--target <name>]  \u2014 + secrets referenced-vs-stored (advisory) + per-function served/published/local hash
   versions <feature> \xB7 rollback <feature> --to <v>
   secrets set|list [--all-projects]|rm \xB7 seed \xB7 export|import <feature>
@@ -11587,7 +12471,7 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
   migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run]  \u2014 backfill subscriptions via the server sync leg (resumable)
   payments simulate --scenario refund-pair|cross-platform-unlock|renewal|expiry|past-due-grace|transfer --user <id> [--tier <t>]  \u2014 mock/dev projects only
   env pull [--dev] [--file <f>] [--print] [--no-gitignore]
-  functions new|deploy|list|delete|invoke [--async]|logs [--tail]|dev <name> [--port <n>] \xB7 cms status|pull \xB7 dev up [--ttl <h>]|down [--yes]|seed|reset
+  functions new|deploy|list|delete|invoke [--async]|logs [--tail]|dev <name> [--port <n>] \xB7 cms status|pull|reindex <collection> \xB7 dev up [--ttl <h>] [--new]|down [--yes]|seed|reset
   listen --forward-to <url> [--dev] [--source <id>] [--events <prefix,\u2026>] [--replay-last <n>] [--interval <s>] [--show-runs] [--raw]  \u2014 forward inbound webhook events to a local server
   mcp install [--client cursor|claude|vscode] [--project] [--print] [--key <k>] [--scopes a,b] [--name <server>]  \u2014 connect your editor's agent to this backend's MCP server
   dev branch [<name>] [--ttl <h=24>] [--no-env] [--print] | --list | --rm <name> [--yes]
@@ -11621,13 +12505,7 @@ async function runDev(sub) {
   const dash = dashboardBase(base);
   const proj = loadProject();
   if (sub === "up") {
-    const name = flag("name") ?? `${proj?.slug ?? "app"}-dev`;
-    const d = await devUpCreate(dash, name, Number(flag("ttl") ?? 72));
-    const binding = proj ?? { tenant_id: d.tenant_id, slug: d.slug, edge_url: d.edge_url ?? base };
-    binding.dev = { tenant_id: d.tenant_id, slug: d.slug, edge_url: d.edge_url ?? base };
-    saveProject(binding);
-    console.log(`\u2713 dev tenant '${d.slug}' ready (keyless mock providers). Use \`vxil push --dev\` / \`vxil gen\` against it.`);
-    if (d.expires_at) console.log(`  expires ${d.expires_at} \u2014 the nightly reaper deletes it then (re-run \`vxil dev up\` to extend).`);
+    await runDevUp(dash, base, proj);
   } else if (sub === "branch") {
     await runDevBranch(dash, base);
   } else if (sub === "seed") {
@@ -11646,6 +12524,61 @@ async function runDev(sub) {
     fail("usage: vxil dev up|down|seed|reset|branch");
   }
 }
+async function runDevUp(dash, base, proj) {
+  const ttlHours = ttlFlag(72);
+  const creds = loadCredentials();
+  const decision = hasFlag("new") ? { create: true } : pickDevSlot(proj, /* @__PURE__ */ new Date(), (slug) => Boolean(creds.keys?.[slug]));
+  if ("reuse" in decision) {
+    const slot = decision.reuse;
+    let expiresAt = slot.expires_at;
+    let reaped = false;
+    try {
+      const dashFn = makeDash(dash);
+      if (!haveDashSession(creds, flag("email") ?? process.env.VXIL_DEV_EMAIL, flag("password") ?? process.env.VXIL_DEV_PASSWORD)) {
+        throw new Error("no dashboard session \u2014 run `vxil login` (or pass --email/--password) to extend the TTL");
+      }
+      const cookie = await resolveDashCookie(dashFn);
+      const r = await devExtend(dashFn, cookie, { tenant_id: slot.tenant_id }, ttlHours);
+      if ("gone" in r) {
+        console.log(`  ! dev tenant '${slot.slug}' is gone (already reaped) \u2014 creating a fresh one`);
+        reaped = true;
+      } else if ("notDev" in r) {
+        console.log(`\u2713 reusing '${slot.slug}' as the dev slot \u2014 it is a STANDARD project (bound with vxil link --as dev), so it has no TTL to extend`);
+      } else {
+        expiresAt = r.expires_at ?? expiresAt;
+        console.log(`\u2713 reusing dev tenant '${slot.slug}'${expiresAt ? ` \u2014 TTL extended to ${expiresAt}` : " \u2014 TTL extended"}`);
+      }
+    } catch (e) {
+      console.log(`  ! could not extend the dev TTL (${e.message.split("\n")[0]}) \u2014 reusing '${slot.slug}' as-is`);
+    }
+    if (!reaped) {
+      const kept = loadProject() ?? { tenant_id: slot.tenant_id, slug: slot.slug, edge_url: slot.edge_url };
+      kept.dev = {
+        tenant_id: slot.tenant_id,
+        slug: slot.slug,
+        edge_url: slot.edge_url,
+        ...expiresAt ? { expires_at: expiresAt } : {}
+      };
+      saveProject(kept);
+      console.log("  use `vxil push --dev` / `vxil gen` against it; --new forces a fresh tenant.");
+      return;
+    }
+  }
+  const name = flag("name") ?? `${proj?.slug ?? "app"}-dev`;
+  const d = await devUpCreate(dash, name, ttlHours);
+  const binding = loadProject() ?? { tenant_id: d.tenant_id, slug: d.slug, edge_url: d.edge_url ?? base };
+  binding.dev = {
+    tenant_id: d.tenant_id,
+    slug: d.slug,
+    edge_url: d.edge_url ?? base,
+    ...d.expires_at ? { expires_at: d.expires_at } : {}
+  };
+  saveProject(binding);
+  console.log(`\u2713 dev tenant '${d.slug}' ready (keyless mock providers). Use \`vxil push --dev\` / \`vxil gen\` against it.`);
+  if (d.expires_at) {
+    console.log(`  expires ${d.expires_at} \u2014 the nightly reaper deletes it then; re-run \`vxil dev up\` to extend the TTL (the same tenant is reused; --new forces a fresh one).`);
+  }
+}
 async function runDevBranch(dash, base) {
   const proj = loadProject();
   if (hasFlag("list")) {
@@ -11683,7 +12616,7 @@ async function runDevBranch(dash, base) {
     slot = decision.reuse;
     console.log(`\u2713 reusing dev branch '${name}' (tenant '${slot.slug}'${slot.expires_at ? ` \xB7 expires ${slot.expires_at}` : ""})`);
   } else {
-    const d = await devUpCreate(dash, `${proj?.slug ?? "app"}-${name}`, Number(flag("ttl") ?? 24));
+    const d = await devUpCreate(dash, `${proj?.slug ?? "app"}-${name}`, ttlFlag(24));
     slot = {
       tenant_id: d.tenant_id,
       slug: d.slug,
@@ -11771,7 +12704,7 @@ function runEnvPull(sel) {
   const fileArg = flag("file") ?? ".env.local";
   const file = resolve7(process.cwd(), fileArg);
   const note = guardEnvFile(fileArg);
-  const existing = existsSync7(file) ? readFileSync7(file, "utf8") : "";
+  const existing = existsSync8(file) ? readFileSync8(file, "utf8") : "";
   writeFileSync6(file, mergeEnvFile(existing, updates));
   try {
     chmodSync2(file, 384);
@@ -11853,7 +12786,7 @@ function guardEnvFile(fileArg) {
   const inRepo = git(["rev-parse", "--is-inside-work-tree"]);
   if (inRepo === "no-git") {
     const gi = resolve7(cwd, ".gitignore");
-    const text = existsSync7(gi) ? readFileSync7(gi, "utf8") : "";
+    const text = existsSync8(gi) ? readFileSync8(gi, "utf8") : "";
     return appendOrWarn(gitignoreCovers(text, fileArg));
   }
   if (inRepo !== 0) return void 0;
@@ -11874,9 +12807,9 @@ async function runMcpInstall() {
     client = clientFlag;
   } else {
     const hits = [];
-    if (existsSync7(resolve7(cwd, ".cursor"))) hits.push("cursor");
-    if (existsSync7(resolve7(cwd, ".vscode"))) hits.push("vscode");
-    if (existsSync7(resolve7(cwd, ".claude")) || existsSync7(resolve7(cwd, ".mcp.json"))) hits.push("claude");
+    if (existsSync8(resolve7(cwd, ".cursor"))) hits.push("cursor");
+    if (existsSync8(resolve7(cwd, ".vscode"))) hits.push("vscode");
+    if (existsSync8(resolve7(cwd, ".claude")) || existsSync8(resolve7(cwd, ".mcp.json"))) hits.push("claude");
     if (hits.length !== 1) {
       fail(hits.length === 0 ? "could not detect an editor in this directory \u2014 pass --client cursor|claude|vscode" : `multiple editor markers found (${hits.join(", ")}) \u2014 pass --client cursor|claude|vscode`);
     }
@@ -11889,7 +12822,7 @@ async function runMcpInstall() {
   }
   const t = resolve_target({ which: "prod", defaultBase: DEFAULT_BASE });
   const url = mcpUrlFor(t.baseUrl, process.env.VXIL_MCP_URL);
-  const target = configTarget(client, scope, { home: homedir2(), cwd, platform: process.platform });
+  const target = configTarget(client, scope, { home: homedir3(), cwd, platform: process.platform });
   const explicitKey = flag("key");
   const inline = needsInlineKey(client, scope);
   if (hasFlag("print")) {
@@ -11977,7 +12910,7 @@ hint: ${e.hint}` : ""}`);
     return;
   }
   const ref = keyRef(client, scope, key);
-  const existing = existsSync7(target.path) ? readFileSync7(target.path, "utf8") : null;
+  const existing = existsSync8(target.path) ? readFileSync8(target.path, "utf8") : null;
   let merged;
   try {
     merged = mergeMcpConfig(existing, { url, header: ref.header, ...ref.inputs ? { inputs: ref.inputs } : {} }, target.format, serverName);
@@ -11987,7 +12920,7 @@ hint: ${e.hint}` : ""}`);
   }
   let guardNote;
   if (client === "cursor" && scope === "project") guardNote = guardEnvFile(".cursor/mcp.json");
-  mkdirSync5(dirname4(target.path), { recursive: true });
+  mkdirSync5(dirname5(target.path), { recursive: true });
   writeFileSync6(target.path, merged);
   if (inline) {
     try {
@@ -12106,7 +13039,7 @@ async function runFunctionsDev(name) {
     });
   });
   let timer2 = null;
-  const watcher = watch(dirname4(entry), () => {
+  const watcher = watch(dirname5(entry), () => {
     if (timer2) clearTimeout(timer2);
     timer2 = setTimeout(() => {
       void (async () => {
@@ -12211,7 +13144,7 @@ ${migrateUsage()}`);
     const { api } = requireApi(selector(), dryRun ? {} : { write: `migrate payments --from-provider ${provider}` });
     const report = await runPaymentsSync({ api, cwd, log }, {
       provider,
-      ...customersFile ? { customers: parseCustomersCsv(readFileSync7(resolve7(cwd, customersFile), "utf8")) } : {},
+      ...customersFile ? { customers: parseCustomersCsv(readFileSync8(resolve7(cwd, customersFile), "utf8")) } : {},
       ...all ? { all: true } : {},
       ...dryRun ? { dryRun: true } : {}
     });