@vxil/cli 0.5.0 → 0.5.2

package/README.md

@@ -44,8 +44,12 @@ Verbs: `init templates quickstart try login link plan push pull diff gen doctor
 **Every verb names its target.** `--dev` selects the dev slot, `--target <name>` a named slot bound by `vxil link <slug> --as <name>` (which merges into the existing binding rather than replacing it). The selector is **fail-closed** — an unbound slot exits 1 telling you the fix, and never falls through to another tenant — and every write verb prints a target banner (slug + env, never a key) before it acts.
 
 - `vxil plan --explain` — the config plan with every leaf tagged *declared* or *default*.
-- `vxil diff [--against <target>] [--ignore <k,…>]` — the CI drift gate; secrets compared by name only.
-- `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function.
+- `vxil push [--skip-functions]` — apply schema → config → functions; a project below the functions plan is stopped *before anything is pushed*, and `--skip-functions` pushes the rest.
+- `vxil diff [--against <target>] [--ignore <k,…>] [--strict-secrets]` — the CI drift gate; secrets compared by name only, and a referenced-but-unstored name is informational unless `--strict-secrets`.
+- `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function. Under `--json` stdout is one JSON document; notices go to stderr.
+- `vxil link <slug>` — reuses the key already stored for the slug on this machine; `--mint` for a fresh one, `--key` to hand one in.
+- `vxil cms drop <collection> [--yes]` — remove one collection definition through the same guarded ack `push --allow-destructive` uses (rows are retained).
+- `vxil api <METHOD> <path> ['<json>' | --data '<json>']` — call any `/v1` route; bare JSON on stdout, banner on stderr.
 - `vxil secrets list --all-projects` — the names-and-metadata matrix across every bound project (values never come back).
 - `vxil migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run]` — backfill subscriptions through the server sync leg; resumable.
 - `vxil payments simulate --scenario <s> --user <id> [--tier <t>]` — mock/dev projects only: drive a refund pair, cross-platform unlock, renewal, expiry, past-due grace or transfer and check the oracle.

package/dist/_vxil-feature-configs.d.ts

@@ -37,6 +37,12 @@ export declare function validateNotificationOverrides(templates: {
         text?: string;
     }>>;
 } | undefined): string[];
+/** AWS region grammar for `notifications.ses.region` (`us-east-1`,
+ * `eu-central-1`, `ap-southeast-2`, `us-gov-west-1`, …): two-letter partition,
+ * one or more lowercase words, a single digit. Pinned as a pattern rather than
+ * a list so a newly launched SES region needs no vxil release; a typo still
+ * fails at `vxil push` (TypeBox), never as a DNS error on the first send. */
+export declare const SES_REGION_PATTERN = "^[a-z]{2}(-[a-z]+)+-\\d$";
 export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     fromEmail: import("@sinclair/typebox").TString;
@@ -44,7 +50,12 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
     replyTo: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     resendApiKeyRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     webhookSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
-    provider: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resend">, import("@sinclair/typebox").TLiteral<"mock">]>;
+    provider: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resend">, import("@sinclair/typebox").TLiteral<"ses">, import("@sinclair/typebox").TLiteral<"mock">]>;
+    ses: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        region: import("@sinclair/typebox").TString;
+        accessKeyIdRef: import("@sinclair/typebox").TString;
+        secretAccessKeyRef: import("@sinclair/typebox").TString;
+    }>>;
     defaultLocale: import("@sinclair/typebox").TString;
     retry: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         maxAttempts: import("@sinclair/typebox").TInteger;
@@ -53,10 +64,10 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
     suppression: import("@sinclair/typebox").TObject<{
         softBounceThreshold: import("@sinclair/typebox").TInteger;
     }>;
-    rateLimit: import("@sinclair/typebox").TObject<{
+    rateLimit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         perDay: import("@sinclair/typebox").TInteger;
         perTenantSec: import("@sinclair/typebox").TInteger;
-    }>;
+    }>>;
     templates: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         allowOverride: import("@sinclair/typebox").TBoolean;
         overrides: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
@@ -150,6 +161,17 @@ declare const OidcProviderSchema: import("@sinclair/typebox").TObject<{
     allowedDomains: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     autoLink: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
+export declare const REDIRECT_ORIGIN_PATTERN = "^(https://[^/?#\\s]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]{1,5})?)$";
+/** THE scheme rule for a redirect/return URL: https anywhere, http on loopback
+ *  only. Takes the parsed URL (or any {protocol, hostname} pair) so the config
+ *  validator and the worker's runtime guard call the identical predicate. */
+export declare function redirectSchemeAllowed(u: {
+    protocol: string;
+    hostname: string;
+}): boolean;
+/** An allow-list ENTRY is a bare origin that parses and passes the scheme
+ *  rule. Used by validateFeatureConfig (auth) on top of the coarse pattern. */
+export declare function isAllowedRedirectOriginEntry(entry: string): boolean;
 export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     methods: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{

package/dist/config.d.ts

@@ -120,15 +120,25 @@ export type FunctionTrigger = {
     source: string;
 }
 /** `webhook`: the function is woken by a webhook_subscription fan-out whose
- *  target_url is `<edge>/v1/internal/fn/trigger/<name>?tenant=<id>`. `source` is
- *  an event-name PREFIX filter (e.g. 'payments.'), enforced at delivery — a
- *  non-matching event is ACK-200 skipped. Declaring the binding is what opts the
- *  function into event delivery; a receiver that declares only `cron` keeps the
- *  older cron+{} wake. */
+ *  target_url is `<edge>/v1/internal/fn/trigger/<name>?tenant=<id>`. That
+ *  subscription is AUTO-WIRED on deploy (2026-09-19): the platform reconciles
+ *  one per function declaring this binding, with `event_prefixes` = the
+ *  function's `source` values — a hand-made one equal in target + prefixes is
+ *  adopted. `source` is an event-name PREFIX (e.g. 'payments.') or a full event
+ *  name — lowercase dotted segments, ≤64 chars, validated at deploy — and is
+ *  also enforced at delivery: a non-matching event is ACK-200 skipped.
+ *  Declaring the binding is what opts the function into event delivery; a
+ *  receiver that declares only `cron` keeps the older cron+{} wake. */
  | {
     kind: 'webhook';
     source: string;
-} | {
+}
+/** `cmsHook`: fires after a CMS write in `collection`. The platform filters
+ *  deliveries on the binding (2026-09-19): `beforeCreate` → created only,
+ *  `beforeUpdate` → updated only, `beforeWrite` → created|updated; a write to
+ *  another collection never wakes the function. Deleted/bulk events are not
+ *  delivered to a cmsHook binding. */
+ | {
     kind: 'cmsHook';
     collection: string;
     event: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite';
@@ -211,6 +221,15 @@ export type ApiVersion = 'v1';
  *  only by a real v2. */
 export declare const RELEASED_API_VERSIONS: readonly ApiVersion[];
 /** The whole vxil backend, declared in one typed, version-controlled file. */
+/** Recursive partial: a `vxil.config.ts` may write any SUBSET of a nested bag
+ *  (`auth: { otp: { enabled: true } }`) — the server applies the defaults for
+ *  the rest (Value.Default). A shallow `Partial` made `tsc` reject every
+ *  partially-written nested bag, including the guide's own skeleton
+ *  (found by the 2026-09-19 cvskit dry-run). Arrays and primitives are kept
+ *  as-is; only plain object bags recurse. */
+export type DeepPartial<T> = T extends readonly unknown[] ? T : T extends object ? {
+    [K in keyof T]?: DeepPartial<T[K]>;
+} : T;
 export interface VxilConfig {
     /** target environment label; resolved to a baseUrl by `vxil link` / `--env`. */
     env?: string;
@@ -223,25 +242,25 @@ export interface VxilConfig {
      *  same Value.Default/Clean pipeline the server uses. Keys match FEATURE_SCHEMAS
      *  exactly (note the hyphenated ids). */
     features?: {
-        notifications?: Partial<NotificationsConfig>;
-        jobs?: Partial<JobsConfig>;
-        auth?: Partial<AuthConfig>;
-        'rate-limits'?: Partial<RateLimitsConfig>;
-        files?: Partial<FilesConfig>;
-        webhooks?: Partial<WebhooksConfig>;
-        comments?: Partial<CommentsConfig>;
-        cms?: Partial<CmsConfig>;
-        mcp?: Partial<McpConfig>;
-        realtime?: Partial<RealtimeConfig>;
-        presence?: Partial<PresenceConfig>;
-        orgs?: Partial<OrgsConfig>;
-        'activity-feed'?: Partial<ActivityFeedConfig>;
-        'vector-search'?: Partial<VectorSearchConfig>;
-        ai?: Partial<AiConfig>;
-        rag?: Partial<RagConfig>;
-        payments?: Partial<PaymentsConfig>;
-        functions?: Partial<FunctionsConfig>;
-        copilot?: Partial<CopilotConfig>;
+        notifications?: DeepPartial<NotificationsConfig>;
+        jobs?: DeepPartial<JobsConfig>;
+        auth?: DeepPartial<AuthConfig>;
+        'rate-limits'?: DeepPartial<RateLimitsConfig>;
+        files?: DeepPartial<FilesConfig>;
+        webhooks?: DeepPartial<WebhooksConfig>;
+        comments?: DeepPartial<CommentsConfig>;
+        cms?: DeepPartial<CmsConfig>;
+        mcp?: DeepPartial<McpConfig>;
+        realtime?: DeepPartial<RealtimeConfig>;
+        presence?: DeepPartial<PresenceConfig>;
+        orgs?: DeepPartial<OrgsConfig>;
+        'activity-feed'?: DeepPartial<ActivityFeedConfig>;
+        'vector-search'?: DeepPartial<VectorSearchConfig>;
+        ai?: DeepPartial<AiConfig>;
+        rag?: DeepPartial<RagConfig>;
+        payments?: DeepPartial<PaymentsConfig>;
+        functions?: DeepPartial<FunctionsConfig>;
+        copilot?: DeepPartial<CopilotConfig>;
     };
     /** (b) CMS SCHEMA-AS-CODE — collections + fields. `push` reconciles them
      *  additively against GET /v1/cms/collections (no destructive drops without