@vxil/cli 0.5.1 → 0.5.2

package/README.md

@@ -44,8 +44,12 @@ Verbs: `init templates quickstart try login link plan push pull diff gen doctor
 **Every verb names its target.** `--dev` selects the dev slot, `--target <name>` a named slot bound by `vxil link <slug> --as <name>` (which merges into the existing binding rather than replacing it). The selector is **fail-closed** — an unbound slot exits 1 telling you the fix, and never falls through to another tenant — and every write verb prints a target banner (slug + env, never a key) before it acts.
 
 - `vxil plan --explain` — the config plan with every leaf tagged *declared* or *default*.
-- `vxil diff [--against <target>] [--ignore <k,…>]` — the CI drift gate; secrets compared by name only.
-- `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function.
+- `vxil push [--skip-functions]` — apply schema → config → functions; a project below the functions plan is stopped *before anything is pushed*, and `--skip-functions` pushes the rest.
+- `vxil diff [--against <target>] [--ignore <k,…>] [--strict-secrets]` — the CI drift gate; secrets compared by name only, and a referenced-but-unstored name is informational unless `--strict-secrets`.
+- `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function. Under `--json` stdout is one JSON document; notices go to stderr.
+- `vxil link <slug>` — reuses the key already stored for the slug on this machine; `--mint` for a fresh one, `--key` to hand one in.
+- `vxil cms drop <collection> [--yes]` — remove one collection definition through the same guarded ack `push --allow-destructive` uses (rows are retained).
+- `vxil api <METHOD> <path> ['<json>' | --data '<json>']` — call any `/v1` route; bare JSON on stdout, banner on stderr.
 - `vxil secrets list --all-projects` — the names-and-metadata matrix across every bound project (values never come back).
 - `vxil migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run]` — backfill subscriptions through the server sync leg; resumable.
 - `vxil payments simulate --scenario <s> --user <id> [--tier <t>]` — mock/dev projects only: drive a refund pair, cross-platform unlock, renewal, expiry, past-due grace or transfer and check the oracle.

package/dist/_vxil-feature-configs.d.ts

@@ -37,6 +37,12 @@ export declare function validateNotificationOverrides(templates: {
         text?: string;
     }>>;
 } | undefined): string[];
+/** AWS region grammar for `notifications.ses.region` (`us-east-1`,
+ * `eu-central-1`, `ap-southeast-2`, `us-gov-west-1`, …): two-letter partition,
+ * one or more lowercase words, a single digit. Pinned as a pattern rather than
+ * a list so a newly launched SES region needs no vxil release; a typo still
+ * fails at `vxil push` (TypeBox), never as a DNS error on the first send. */
+export declare const SES_REGION_PATTERN = "^[a-z]{2}(-[a-z]+)+-\\d$";
 export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     fromEmail: import("@sinclair/typebox").TString;
@@ -44,7 +50,12 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
     replyTo: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     resendApiKeyRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     webhookSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
-    provider: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resend">, import("@sinclair/typebox").TLiteral<"mock">]>;
+    provider: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resend">, import("@sinclair/typebox").TLiteral<"ses">, import("@sinclair/typebox").TLiteral<"mock">]>;
+    ses: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        region: import("@sinclair/typebox").TString;
+        accessKeyIdRef: import("@sinclair/typebox").TString;
+        secretAccessKeyRef: import("@sinclair/typebox").TString;
+    }>>;
     defaultLocale: import("@sinclair/typebox").TString;
     retry: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         maxAttempts: import("@sinclair/typebox").TInteger;
@@ -53,10 +64,10 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
     suppression: import("@sinclair/typebox").TObject<{
         softBounceThreshold: import("@sinclair/typebox").TInteger;
     }>;
-    rateLimit: import("@sinclair/typebox").TObject<{
+    rateLimit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         perDay: import("@sinclair/typebox").TInteger;
         perTenantSec: import("@sinclair/typebox").TInteger;
-    }>;
+    }>>;
     templates: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         allowOverride: import("@sinclair/typebox").TBoolean;
         overrides: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
@@ -150,6 +161,17 @@ declare const OidcProviderSchema: import("@sinclair/typebox").TObject<{
     allowedDomains: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     autoLink: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
+export declare const REDIRECT_ORIGIN_PATTERN = "^(https://[^/?#\\s]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]{1,5})?)$";
+/** THE scheme rule for a redirect/return URL: https anywhere, http on loopback
+ *  only. Takes the parsed URL (or any {protocol, hostname} pair) so the config
+ *  validator and the worker's runtime guard call the identical predicate. */
+export declare function redirectSchemeAllowed(u: {
+    protocol: string;
+    hostname: string;
+}): boolean;
+/** An allow-list ENTRY is a bare origin that parses and passes the scheme
+ *  rule. Used by validateFeatureConfig (auth) on top of the coarse pattern. */
+export declare function isAllowedRedirectOriginEntry(entry: string): boolean;
 export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     methods: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{

package/dist/config.d.ts

@@ -221,6 +221,15 @@ export type ApiVersion = 'v1';
  *  only by a real v2. */
 export declare const RELEASED_API_VERSIONS: readonly ApiVersion[];
 /** The whole vxil backend, declared in one typed, version-controlled file. */
+/** Recursive partial: a `vxil.config.ts` may write any SUBSET of a nested bag
+ *  (`auth: { otp: { enabled: true } }`) — the server applies the defaults for
+ *  the rest (Value.Default). A shallow `Partial` made `tsc` reject every
+ *  partially-written nested bag, including the guide's own skeleton
+ *  (found by the 2026-09-19 cvskit dry-run). Arrays and primitives are kept
+ *  as-is; only plain object bags recurse. */
+export type DeepPartial<T> = T extends readonly unknown[] ? T : T extends object ? {
+    [K in keyof T]?: DeepPartial<T[K]>;
+} : T;
 export interface VxilConfig {
     /** target environment label; resolved to a baseUrl by `vxil link` / `--env`. */
     env?: string;
@@ -233,25 +242,25 @@ export interface VxilConfig {
      *  same Value.Default/Clean pipeline the server uses. Keys match FEATURE_SCHEMAS
      *  exactly (note the hyphenated ids). */
     features?: {
-        notifications?: Partial<NotificationsConfig>;
-        jobs?: Partial<JobsConfig>;
-        auth?: Partial<AuthConfig>;
-        'rate-limits'?: Partial<RateLimitsConfig>;
-        files?: Partial<FilesConfig>;
-        webhooks?: Partial<WebhooksConfig>;
-        comments?: Partial<CommentsConfig>;
-        cms?: Partial<CmsConfig>;
-        mcp?: Partial<McpConfig>;
-        realtime?: Partial<RealtimeConfig>;
-        presence?: Partial<PresenceConfig>;
-        orgs?: Partial<OrgsConfig>;
-        'activity-feed'?: Partial<ActivityFeedConfig>;
-        'vector-search'?: Partial<VectorSearchConfig>;
-        ai?: Partial<AiConfig>;
-        rag?: Partial<RagConfig>;
-        payments?: Partial<PaymentsConfig>;
-        functions?: Partial<FunctionsConfig>;
-        copilot?: Partial<CopilotConfig>;
+        notifications?: DeepPartial<NotificationsConfig>;
+        jobs?: DeepPartial<JobsConfig>;
+        auth?: DeepPartial<AuthConfig>;
+        'rate-limits'?: DeepPartial<RateLimitsConfig>;
+        files?: DeepPartial<FilesConfig>;
+        webhooks?: DeepPartial<WebhooksConfig>;
+        comments?: DeepPartial<CommentsConfig>;
+        cms?: DeepPartial<CmsConfig>;
+        mcp?: DeepPartial<McpConfig>;
+        realtime?: DeepPartial<RealtimeConfig>;
+        presence?: DeepPartial<PresenceConfig>;
+        orgs?: DeepPartial<OrgsConfig>;
+        'activity-feed'?: DeepPartial<ActivityFeedConfig>;
+        'vector-search'?: DeepPartial<VectorSearchConfig>;
+        ai?: DeepPartial<AiConfig>;
+        rag?: DeepPartial<RagConfig>;
+        payments?: DeepPartial<PaymentsConfig>;
+        functions?: DeepPartial<FunctionsConfig>;
+        copilot?: DeepPartial<CopilotConfig>;
     };
     /** (b) CMS SCHEMA-AS-CODE — collections + fields. `push` reconciles them
      *  additively against GET /v1/cms/collections (no destructive drops without

package/dist/vxil.js

@@ -47,7 +47,7 @@ function lowerTriggerBindings(trigger) {
   return [{ kind: "http", ...str2("path") ? { path: str2("path") } : {} }];
 }
 var CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-var VXIL_CONFIG_PKG_VERSION = "0.4.0";
+var VXIL_CONFIG_PKG_VERSION = "0.4.1";
 function ensureScaffoldPackageJson(cwd) {
   const file = resolve(cwd, "package.json");
   const spec = `^${VXIL_CONFIG_PKG_VERSION}`;
@@ -551,7 +551,7 @@ import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync
 import { homedir } from "node:os";
 import { dirname as dirname2, resolve as resolve2, relative, isAbsolute, sep } from "node:path";
 import { createHash } from "node:crypto";
-var MAX_SOURCE_BYTES = 256e3;
+var MAX_SOURCE_BYTES = 512e3;
 function sourceSha12(source) {
   return createHash("sha256").update(source, "utf8").digest("hex").slice(0, 12);
 }
@@ -609,7 +609,7 @@ function assertBundleContained(projectRoot, inputs, opts = {}) {
   const root = resolve2(projectRoot);
   const rootReal = realpathSafe(root);
   const wsReal = realpathSafe(opts.workspaceRoot ?? workspaceRootCached(root));
-  const note = opts.onEscape ?? ((msg) => console.log(msg));
+  const note = opts.onEscape ?? ((msg) => console.error(msg));
   for (const input of inputs) {
     const abs = resolve2(root, input);
     const absReal = realpathSafe(abs);
@@ -641,9 +641,11 @@ async function bundleFunction(entryPath, opts = {}) {
   const root = resolve2(opts.projectRoot ?? process.cwd());
   const workspaceRoot = workspaceRootCached(root);
   const entry = resolve2(entryPath);
-  assertBundleContained(root, [entry], { workspaceRoot, what: "entry" });
+  const contained = { workspaceRoot, ...opts.onNote ? { onEscape: opts.onNote } : {} };
+  assertBundleContained(root, [entry], { ...contained, what: "entry" });
   const esbuild = await import("esbuild");
-  const result = await esbuild.build({
+  const minify = opts.minify ?? true;
+  const build = (min) => esbuild.build({
     entryPoints: [entry],
     bundle: true,
     format: "esm",
@@ -652,22 +654,45 @@ async function bundleFunction(entryPath, opts = {}) {
     target: "es2022",
     write: false,
     legalComments: "none",
+    minify: min,
+    keepNames: min,
+    // readable stack traces / log lines on the minified bundle
+    sourcemap: false,
+    // never uploaded, never emitted
     absWorkingDir: root,
     metafile: true,
     // drives the import-containment check below (non-executing)
     plugins: []
     // explicitly none — build plugins are code execution
   });
+  const result = await build(minify);
   const out = result.outputFiles?.[0];
   if (!out) throw new Error(`esbuild produced no output for ${entryPath}`);
-  assertBundleContained(root, Object.keys(result.metafile?.inputs ?? {}), { workspaceRoot });
+  assertBundleContained(root, Object.keys(result.metafile?.inputs ?? {}), contained);
   const source = out.text;
   const bytes = Buffer.byteLength(source, "utf8");
   if (bytes > MAX_SOURCE_BYTES) {
-    throw new Error(`bundled ${entryPath} is ${Math.round(bytes / 1e3)} KB \u2014 exceeds the ${MAX_SOURCE_BYTES / 1e3} KB deploy cap`);
+    let raw = null;
+    if (minify) {
+      try {
+        const rawOut = (await build(false)).outputFiles?.[0];
+        if (rawOut) raw = Buffer.byteLength(rawOut.text, "utf8");
+      } catch {
+        raw = null;
+      }
+    }
+    throw new Error(formatBundleTooLarge(entryPath, bytes, raw, minify));
   }
   return { source, bytes };
 }
+function kb(n) {
+  return `${Math.round(n / 100) / 10} KB`;
+}
+function formatBundleTooLarge(entryPath, bytes, rawBytes, minified) {
+  const measured = minified ? `${kb(bytes)} minified` : kb(bytes);
+  const raw = rawBytes !== null && minified ? ` (${kb(rawBytes)} unminified)` : "";
+  return `bundled ${entryPath} is ${measured}${raw} \u2014 exceeds the ${MAX_SOURCE_BYTES / 1e3} KB deploy cap (the cap is measured on the minified bundle, which is what gets uploaded; trim imports or split the function)`;
+}
 function stableStringify(v) {
   if (Array.isArray(v)) return `[${v.map(stableStringify).join(",")}]`;
   if (v !== null && typeof v === "object") {
@@ -716,7 +741,7 @@ var DENY_FUNCTION_SCOPES = /* @__PURE__ */ new Set(["admin", "*", "features:writ
 function clampFunctionScopes(scopes) {
   return (scopes ?? []).map(String).filter((s) => s && !DENY_FUNCTION_SCOPES.has(s));
 }
-async function planFunctions({ api, functions, cwd, apply }) {
+async function planFunctions({ api, functions, cwd, apply, onNote }) {
   const read = await readRemote(api);
   if (read.unavailable) {
     if (apply) {
@@ -731,7 +756,7 @@ async function planFunctions({ api, functions, cwd, apply }) {
     if (!/^[a-z][a-z0-9-]{0,47}$/.test(name)) {
       throw new Error(`functions: invalid name '${name}' (must match /^[a-z][a-z0-9-]{0,47}$/)`);
     }
-    const { source, bytes } = await bundleFunction(resolve2(cwd, def.entry), { projectRoot: cwd });
+    const { source, bytes } = await bundleFunction(resolve2(cwd, def.entry), { projectRoot: cwd, ...onNote ? { onNote } : {} });
     const triggerKind = def.trigger?.kind ?? "http";
     const secrets = normalizeSecretRefs(def.secrets);
     const bindings = lowerTriggerBindings(def.trigger);
@@ -758,9 +783,10 @@ async function planFunctions({ api, functions, cwd, apply }) {
       const data2 = res.body.data;
       const cmsHooks = data2?.cms_hook_subscriptions ?? null;
       const webhooks = data2?.webhook_subscriptions ?? null;
-      return { change, applied: 1, cmsHooks, webhooks };
+      const warnings2 = (data2?.warnings ?? []).map((message) => ({ fn: name, message: String(message) }));
+      return { change, applied: 1, cmsHooks, webhooks, warnings: warnings2 };
     }
-    return { change, applied: 0, cmsHooks: null, webhooks: null };
+    return { change, applied: 0, cmsHooks: null, webhooks: null, warnings: [] };
   });
   const changes = results.map((r) => r.change);
   const applied = results.reduce((s, r) => s + r.applied, 0);
@@ -771,13 +797,47 @@ async function planFunctions({ api, functions, cwd, apply }) {
   }, null);
   const cmsHookSubscriptions = sum((r) => r.cmsHooks);
   const webhookSubscriptions = sum((r) => r.webhooks);
-  return { changes, applied, cmsHookSubscriptions, webhookSubscriptions };
+  const warnings = results.flatMap((r) => r.warnings ?? []);
+  return { changes, applied, cmsHookSubscriptions, webhookSubscriptions, ...warnings.length ? { warnings } : {} };
 }
 function formatFnChanges(changes) {
   const actionable = changes.filter((c) => c.kind !== "unchanged");
   if (!actionable.length) return "  (no function changes)";
   return actionable.map((c) => `  ${c.kind === "deploy-new" ? "+" : "~"} ${c.detail}`).join("\n");
 }
+async function probeFunctionsEntitlement(api, name) {
+  const res = await api("POST", `/v1/functions/${encodeURIComponent(name)}`, {});
+  if (res.status === 402 || res.status === 403) {
+    const e = res.body.error ?? {};
+    return {
+      entitled: false,
+      status: res.status,
+      ...e.code ? { code: e.code } : {},
+      ...e.message ? { message: e.message } : {},
+      ...e.hint ? { hint: e.hint } : {},
+      ...e.fixUrl ? { fixUrl: e.fixUrl } : {}
+    };
+  }
+  return { entitled: true };
+}
+function billingPageFor(tenantId, baseUrl) {
+  const tid = tenantId && tenantId !== "(unknown)" ? tenantId : "<tenant>";
+  const path = `/dashboard/${tid}/billing`;
+  try {
+    if (/(^|\.)api\.vxil\.com$/.test(new URL(baseUrl).hostname)) return `https://vxil.com${path}`;
+  } catch {
+  }
+  return path;
+}
+function formatFunctionsPreflight(e, opts) {
+  const n = `${opts.declared} declared function(s)`;
+  if (e.code === "sandbox_restricted" || e.status === 403) {
+    return `functions: this project cannot deploy functions (${e.code ?? e.status}${e.message ? ` \u2014 ${e.message}` : ""}); ${n} would be refused.${e.hint ? ` ${e.hint}` : ""}` + (opts.verb === "push" ? " Run `vxil push --skip-functions` to push everything else." : "");
+  }
+  const plan = /'([a-z]+)' plan/.exec(e.message ?? "")?.[1];
+  const planLabel = plan ? `the ${plan[0].toUpperCase()}${plan.slice(1)} plan` : "a paid plan";
+  return `functions need ${planLabel}${e.message ? ` (${e.message})` : ""} \u2014 ${n} would be refused with 402 tier_required. Upgrade in the dashboard (${billingPageFor(opts.tenantId, opts.baseUrl)})` + (opts.verb === "push" ? ", or run `vxil push --skip-functions` to push the cms schema and feature config without them" : "") + ".";
+}
 function formatLogLines(lines) {
   const out = [];
   for (const l of lines) {
@@ -1188,11 +1248,7 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
 async function applyDestructive(api, collections, c) {
   const ok2xx = (status) => status >= 200 && status < 300;
   if (c.op === "drop-collection") {
-    const res2 = await api("POST", "/v1/cms/collections", { drop_collection: c.collection, allow_destructive: true });
-    if (!ok2xx(res2.status) && res2.body.error?.code !== "not_found") {
-      const e = res2.body.error ?? {};
-      throw new Error(`cms: drop collection ${c.collection} failed: ${e.code ?? res2.status} ${e.message ?? ""}`);
-    }
+    await dropCollection(api, c.collection);
     return 1;
   }
   const path = `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`;
@@ -1231,6 +1287,53 @@ function formatCmsChanges(changes) {
     return `  + ${c.detail}`;
   }).join("\n");
 }
+async function planCollectionDrop(api, collection) {
+  const read = await readRemote2(api);
+  if (read.unavailable) return { exists: false, fields: 0, rows: null, remoteUnavailable: read.unavailable };
+  const rc = read.map.get(collection);
+  if (!rc) return { exists: false, fields: 0, rows: null };
+  return { exists: true, fields: rc.fields.length, rows: await liveRowCount(api, collection) };
+}
+async function dropCollection(api, collection) {
+  const res = await api("POST", "/v1/cms/collections", { drop_collection: collection, allow_destructive: true });
+  if ((res.status < 200 || res.status >= 300) && res.body.error?.code !== "not_found") {
+    const e = res.body.error ?? {};
+    throw new Error(`cms: drop collection ${collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
+  }
+}
+function formatCollectionDrop(collection, plan, declaredLocally) {
+  const rows = plan.rows === null ? "an unknown number of live rows" : `${plan.rows} live row(s)`;
+  const lines = [
+    `  ! drop collection ${collection} (${plan.fields} field(s), ${rows}) \u2014 the definition is removed; stored item rows are NOT deleted (they become unreachable through the API until a collection of that name exists again)`
+  ];
+  if (declaredLocally) {
+    lines.push(`  \u26A0 '${collection}' is still declared in vxil.config.ts \u2014 the next \`vxil push\` re-creates it (empty); remove it from the config too`);
+  }
+  return lines.join("\n");
+}
+
+// src/apiCmd.ts
+var API_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+var API_USAGE = "usage: vxil api <GET|POST|PUT|PATCH|DELETE> </v1/...> ['<json body>' | --data '<json body>']";
+function parseApiArgs(positionals, dataFlag) {
+  const [rawMethod, path, ...extra] = positionals;
+  const method = (rawMethod ?? "").toUpperCase();
+  if (!rawMethod || !API_METHODS.includes(method)) throw new Error(API_USAGE);
+  if (!path || !path.startsWith("/")) throw new Error(API_USAGE);
+  const positionalBody = extra[0];
+  if (extra.length > 1) throw new Error(`${API_USAGE} \u2014 too many arguments (${extra.length} after the path; quote the JSON body as ONE argument)`);
+  if (positionalBody !== void 0 && dataFlag !== void 0) {
+    throw new Error("pass the body either as the third argument or with --data, not both");
+  }
+  const raw = positionalBody ?? dataFlag;
+  if (raw === void 0) return { method, path };
+  try {
+    return { method, path, body: JSON.parse(raw) };
+  } catch {
+    const via = positionalBody !== void 0 ? "the body argument" : "--data";
+    throw new Error(`${via} must be valid JSON (got ${JSON.stringify(raw.length > 60 ? `${raw.slice(0, 57)}\u2026` : raw)})`);
+  }
+}
 
 // ../types/src/ulid.ts
 var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
@@ -5074,7 +5177,13 @@ var TOOLS = [
           },
           description: "Prompt-cache breakpoints (anthropic; ignored elsewhere): system caches the system prompt, messages caches the transcript prefix, ttl picks 5m (default) or 1h. A cache hit only lowers input_tokens."
         },
-        user_id: { type: "string", description: "Opaque end_user_id for per-user usage metering." }
+        user_id: { type: "string", description: "Opaque end_user_id for per-user usage metering." },
+        correlation_id: {
+          type: "string",
+          minLength: 1,
+          maxLength: 128,
+          description: "Your own opaque handle for this generation (1..128 chars): stored on the row and echoed on the answer; on mode:job it also rides the job.generation.completed|failed events next to generation_id, so you never need a run\u2192record link."
+        }
       }
     },
     method: "POST",
@@ -5247,6 +5356,8 @@ var TOOLS = [
         event_type: { type: "string", description: "Exact event type filter, e.g. 'subscription.updated'." },
         outcome: { type: "string", enum: ["received", "processed", "error", "sig_failed", "parse_failed", "reprocessed", "ignored", "unowned", "rejected_environment"] },
         environment: { type: "string", enum: ["production", "sandbox"], description: "The provider-reported environment of the delivery (a separate axis from the API key label)." },
+        provider_charge_id: { type: "string", maxLength: 200, description: "Exact match on the normalised charge id (the same provider_charge_id a payments.charge.* event carries): the delivery that recorded that charge plus any refund/dispute against it \u2014 usually one row, so ONE detail read (GET /v1/payments/webhook-events/{eventId}) fetches the verified payload. Rows received before 2026-09-19 carry no charge id." },
+        provider_evt_id: { type: "string", maxLength: 200, description: "Exact match on the provider's own event id (the provider_evt_id every row shows)." },
         since: { type: "string", description: "ISO-8601 lower bound on received_at." },
         cursor: { type: "string", description: "Opaque keyset cursor from a prior page (next_cursor)." },
         limit: { type: "number", default: 50, description: "Page size, clamped 1..100." }
@@ -5254,7 +5365,7 @@ var TOOLS = [
     },
     method: "GET",
     path: "/v1/payments/webhook-events",
-    queryArgs: ["provider", "event_type", "outcome", "environment", "since", "cursor", "limit"]
+    queryArgs: ["provider", "event_type", "outcome", "environment", "provider_charge_id", "provider_evt_id", "since", "cursor", "limit"]
   },
   {
     name: "mcp_get_signing_secret",
@@ -5769,6 +5880,10 @@ function partitionConfigChanges(feature, changes, patterns) {
   for (const c of changes) (isIgnored(`config:${feature}.${c.path}`, patterns) ? ignored : kept).push(c);
   return { kept, ignored };
 }
+function unstoredSecretVerdict(opts) {
+  if (opts.ignored) return "ignored";
+  return opts.strict ? "drift" : "informational";
+}
 function driftExitCode(r) {
   if (r.errors > 0) return 2;
   return r.drift > 0 ? 1 : 0;
@@ -5825,14 +5940,15 @@ function secretsChecks(refs, stored) {
   }
   return out;
 }
-var MOCK_PROVIDER_NOTE = "notifications provider is 'mock': sends succeed and are recorded, but NO email leaves vxil (sign-in codes, magic links and password resets are silently swallowed). Store your provider key (`vxil secrets set notifications/resend_api_key`) and set provider: 'resend' + resendApiKeyRef in your notifications config before you rely on delivery";
+var MOCK_PROVIDER_NOTE = "notifications provider is 'mock': sends succeed and are recorded, but NO email leaves vxil (sign-in codes, magic links and password resets are silently swallowed). Store your provider key (`vxil secrets set notifications/resend_api_key`) and set provider: 'resend' + resendApiKeyRef in your notifications config before you rely on delivery (or, for Amazon SES: store notifications/ses_access_key_id + notifications/ses_secret_access_key and set provider: 'ses' + ses: { region, accessKeyIdRef, secretAccessKeyRef })";
 function notificationsProviderChecks(manifest) {
   if (!manifest || manifest.enabled === false) return [];
   if (manifest.provider !== "mock") {
+    const region = manifest.provider === "ses" && manifest.ses?.region ? ` (${manifest.ses.region})` : "";
     return [{
       name: "notifications provider",
       ok: true,
-      detail: `${String(manifest.provider ?? "resend")}${manifest.fromEmail ? ` \xB7 from ${manifest.fromEmail}` : ""}`
+      detail: `${String(manifest.provider ?? "resend")}${region}${manifest.fromEmail ? ` \xB7 from ${manifest.fromEmail}` : ""}`
     }];
   }
   return [{ name: "notifications provider", ok: true, warn: true, detail: MOCK_PROVIDER_NOTE }];
@@ -5983,6 +6099,20 @@ async function linkViaDeviceFlow(dash, slug, io) {
   }
   throw new Error("link timed out waiting for browser approval \u2014 run `vxil link <slug>` again");
 }
+async function linkViaStoredKey(api, slug, storedKey) {
+  let res;
+  try {
+    res = await api("GET", "/v1/features");
+  } catch (e2) {
+    return { invalid: `could not reach the edge (${e2.message})` };
+  }
+  if (res.status === 200) {
+    const tenantId = res.body.meta?.tenant_id;
+    return { result: { slug, tenant_id: tenantId && tenantId.length ? tenantId : "(unknown)", api_key: storedKey } };
+  }
+  const e = res.body.error;
+  return { invalid: `${e?.code ?? res.status}${e?.message ? ` \u2014 ${e.message}` : ""}` };
+}
 
 // src/secretsValue.ts
 var ARGV_SECRET_WARNING = `WARNING: --value <v> puts the secret on the command line \u2014 it lands in shell history and is
@@ -9367,8 +9497,8 @@ export default defineConfig({
     ],
     "hasFunctions": false,
     "byoKeys": [],
-    "configSrc": "import { defineConfig } from '@vxil/config';\n\n// \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// \"Sales CRM\" \u2014 companies \u2192 contacts \u2192 a deal pipeline, declared end-to-end in\n// ONE typed file. A BLUEPRINT composing shipped building blocks \u2014\n//   \u2022 cms           \u2192 companies \u2192 contacts \u2192 deals (resolved by relation), with a\n//                     Lane-A STATE MACHINE guarding the pipeline stage\n//   \u2022 activity-feed \u2192 the per-deal timeline (calls, emails, notes) + the rep bell\n//   \u2022 notifications \u2192 the email channel (mock provider until you bring a key)\n// Everything here is DATA the tenant owns and edits after `vxil init`.\n// \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport default defineConfig({\n  env: 'staging',\n\n  features: {\n    cms: {\n      hooks: {\n        // THE PIPELINE STATE MACHINE (Lane-A validate \u2014 runs inside the write\n        // transaction): a deal may only move lead \u2192 qualified \u2192 proposal \u2192\n        // won | lost. Any other transition is a clean 422, rolled back\n        // atomically. Cross-row work (e.g. \"email the rep on won\") belongs in\n        // a function or webhook, never in a hook \u2014 hooks are pure row logic.\n        deal_stage_machine: {\n          collection: 'deals',\n          event: 'beforeUpdate',\n          kind: 'validate',\n          expr:\n            'item.stage == before.stage' +\n            \" || (before.stage == 'lead' && item.stage == 'qualified')\" +\n            \" || (before.stage == 'qualified' && item.stage == 'proposal')\" +\n            \" || (before.stage == 'proposal' && (item.stage == 'won' || item.stage == 'lost'))\",\n          message: 'illegal pipeline transition (lead \u2192 qualified \u2192 proposal \u2192 won|lost)',\n        },\n      },\n    },\n\n    // The per-deal timeline. The DEFAULT feed groups already fit a CRM:\n    // `timeline` (flat, chronological) keyed per deal \u2014 ingest with\n    //   POST /v1/feeds/timeline/{deal_item_id}/activities { actor, verb, object }\n    // \u2014 and the aggregated `notification` bell per rep.\n    'activity-feed': {},\n\n    // Email channel. `mock` is the zero-config staging provider; for real\n    // sends switch to provider: 'resend' and set `resendApiKeyRef`.\n    notifications: { provider: 'mock', fromEmail: 'noreply@crm.app' },\n  },\n\n  // \u2500\u2500 Schema-as-code: the cms collections (\u22648 index slots each: s1\u2013s4/n1\u2013n2/t1\u2013t2) \u2500\u2500\n  cms: {\n    collections: {\n      companies: {\n        singular: 'company',\n        fields: {\n          name: { type: 'string', required: true, indexSlot: 's1' },\n          // Want `domain` unique? Declare `unique: true` right here \u2014 value\n          // uniqueness (cms.md \xA79.3) is carried by `vxil push` on collection/field\n          // CREATE. Flipping it on an ALREADY-pushed field is an in-place alter\n          // via the dashboard field designer or a same-name+type re-add through\n          // POST /v1/cms/collections/companies/fields (push diffs name+type only).\n          domain: { type: 'string', indexSlot: 's2' },\n          industry: { type: 'string', indexSlot: 's3' },\n          employees: { type: 'int', indexSlot: 'n1' },\n        },\n      },\n      contacts: {\n        singular: 'contact',\n        fields: {\n          name: { type: 'string', required: true, indexSlot: 's1' },\n          email: { type: 'string', indexSlot: 's2' }, // unique \u21D2 see the `domain` note above\n          company: { type: 'relation', relationTo: 'companies', indexSlot: 's3' },\n          last_touch: { type: 'datetime', indexSlot: 't1' },\n          phone: { type: 'string' }, // stored, not indexed\n        },\n      },\n      deals: {\n        singular: 'deal',\n        fields: {\n          title: { type: 'string', required: true, indexSlot: 's1' },\n          // The pipeline stage: enum-validated on every write; the Lane-A hook\n          // above additionally locks the TRANSITIONS between stages.\n          stage: {\n            type: 'string',\n            required: true,\n            indexSlot: 's2',\n            validation: { enum: ['lead', 'qualified', 'proposal', 'won', 'lost'] },\n          },\n          company: { type: 'relation', relationTo: 'companies', indexSlot: 's3' },\n          owner: { type: 'string', indexSlot: 's4' }, // the rep working the deal\n          amount_cents: { type: 'int', indexSlot: 'n1', validation: { min: 0 } },\n          close_date: { type: 'datetime', indexSlot: 't1' },\n          notes: { type: 'text' },\n        },\n      },\n    },\n  },\n\n  // `vxil seed` POSTs each item verbatim \u2014 item_ids are assigned at runtime, so\n  // the `company` relation on contacts/deals is left unset here; link records\n  // after seeding (PATCH the created items with the company's item_id).\n  seed: {\n    cms: [\n      {\n        collection: 'companies',\n        items: [{ name: 'Acme Corp', domain: 'acme.com', industry: 'Manufacturing', employees: 250 }],\n      },\n      {\n        collection: 'contacts',\n        items: [{ name: 'Jane Porter', email: 'jane@acme.com', phone: '+1 555 0100' }],\n      },\n      {\n        collection: 'deals',\n        items: [\n          { title: 'Acme starter plan', stage: 'lead', owner: 'jordan', amount_cents: 480_000 },\n          { title: 'Acme enterprise rollout', stage: 'proposal', owner: 'sam', amount_cents: 12_000_000 },\n        ],\n      },\n    ],\n  },\n});\n",
-    "readme": '# Sales CRM template\n\nA sales CRM backend \u2014 companies, contacts, and a deal pipeline \u2014 declared end-to-end in one typed\n`vxil.config.ts`. Stage transitions are guarded by a Lane-A state machine that runs inside the write\ntransaction, every deal gets an activity timeline via `activity-feed`, and `notifications` provides\nthe email channel (mock provider until you bring your own key).\n\n**What it provisions:**\n- `companies` \u2014 name, domain, industry, employee count (slot-bound for range/sort). To make\n  `domain`/`email` unique, declare `unique: true` on the field \u2014 carried by `vxil push` on create\n  (`cms.md` \xA79.3); flipping it on an already-pushed field is a dashboard/REST in-place alter.\n- `contacts` \u2014 name, email, `company` relation, `last_touch` datetime.\n- `deals` \u2014 title, enum-validated `stage`, `company` relation, `owner` (the rep), `amount_cents`,\n  `close_date`. A Lane-A `validate` hook locks the pipeline: `lead \u2192 qualified \u2192 proposal \u2192 won|lost`.\n- Features: `cms` + `activity-feed` (per-deal timelines + the rep notification bell, default feed\n  groups) + `notifications` (mock provider; swap to `resend` + `resendApiKeyRef` for real sends).\n\n**Apply it:**\n\n```bash\nvxil init --template crm\nvxil quickstart   # or `vxil link` to an existing tenant\nvxil push\nvxil gen          # then optionally: `vxil seed` (1 company, 1 contact, 2 deals)\n```\n\n**What to learn from this:**\n1. **The pipeline state machine** \u2014 a `validate` hook on `beforeUpdate` compares `item.stage` to\n   `before.stage` and rejects any illegal transition with a clean 422, atomically in the same write.\n   Field-level `validation.enum` handles membership; the hook handles the *transitions*.\n2. **Pipeline value by stage** \u2014 one bounded group-by aggregate (`stage` is slot-bound, `amount_cents`\n   is an `n*` slot), no SQL:\n   ```bash\n   curl -X POST https://api.vxil.com/v1/cms/items/deals/aggregate \\\n     -H "Authorization: Bearer $VXIL_KEY" -H \'content-type: application/json\' \\\n     -d \'{"aggregates":[{"fn":"sum","field":"amount_cents","as":"pipeline_cents"},{"fn":"count"}],"groupBy":["stage"]}\'\n   # \u2192 { "groups": [{ "key": {"stage":"proposal"}, "count": 1, "pipeline_cents": 12000000 }, \u2026], "scanned": \u2026 }\n   ```\n3. **The deal timeline** \u2014 each call/email/note is one ingest to the default `timeline` feed group:\n   `POST /v1/feeds/timeline/{deal_item_id}/activities` with `{ actor, verb, object }` (idempotent on\n   `foreign_id` + `time`); read it back with keyset cursors, or typed via `vx.from(\'deals\').query(\u2026)`\n   for the pipeline board itself.\n\n**Go deeper:** vxil.com/docs/guide/07-validation-and-hooks (hooks), vxil.com/docs/api (aggregates), vxil.com/docs/guide/06-feature-catalog (activity-feed,\nnotifications), and `examples/ecommerce/` for a bigger state machine in the wild.\n\n**Own the shape.** The config is yours after `init` \u2014 nothing is locked.\n',
+    "configSrc": "import { defineConfig } from '@vxil/config';\n\n// \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// \"Sales CRM\" \u2014 companies \u2192 contacts \u2192 a deal pipeline, declared end-to-end in\n// ONE typed file. A BLUEPRINT composing shipped building blocks \u2014\n//   \u2022 cms           \u2192 companies \u2192 contacts \u2192 deals (resolved by relation), with a\n//                     Lane-A STATE MACHINE guarding the pipeline stage\n//   \u2022 activity-feed \u2192 the per-deal timeline (calls, emails, notes) + the rep bell\n//   \u2022 notifications \u2192 the email channel (mock provider until you bring a key)\n// Everything here is DATA the tenant owns and edits after `vxil init`.\n// \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport default defineConfig({\n  env: 'staging',\n\n  features: {\n    cms: {\n      hooks: {\n        // THE PIPELINE STATE MACHINE (Lane-A validate \u2014 runs inside the write\n        // transaction): a deal may only move lead \u2192 qualified \u2192 proposal \u2192\n        // won | lost. Any other transition is a clean 422, rolled back\n        // atomically. Cross-row work (e.g. \"email the rep on won\") belongs in\n        // a function or webhook, never in a hook \u2014 hooks are pure row logic.\n        deal_stage_machine: {\n          collection: 'deals',\n          event: 'beforeUpdate',\n          kind: 'validate',\n          expr:\n            'item.stage == before.stage' +\n            \" || (before.stage == 'lead' && item.stage == 'qualified')\" +\n            \" || (before.stage == 'qualified' && item.stage == 'proposal')\" +\n            \" || (before.stage == 'proposal' && (item.stage == 'won' || item.stage == 'lost'))\",\n          message: 'illegal pipeline transition (lead \u2192 qualified \u2192 proposal \u2192 won|lost)',\n        },\n      },\n    },\n\n    // The per-deal timeline. The DEFAULT feed groups already fit a CRM:\n    // `timeline` (flat, chronological) keyed per deal \u2014 ingest with\n    //   POST /v1/feeds/timeline/{deal_item_id}/activities { actor, verb, object }\n    // \u2014 and the aggregated `notification` bell per rep.\n    'activity-feed': {},\n\n    // Email channel. `mock` is the zero-config staging provider; for real\n    // sends switch to provider: 'resend' and set `resendApiKeyRef`, or to\n    // provider: 'ses' with `ses: { region, accessKeyIdRef, secretAccessKeyRef }`.\n    notifications: { provider: 'mock', fromEmail: 'noreply@crm.app' },\n  },\n\n  // \u2500\u2500 Schema-as-code: the cms collections (\u22648 index slots each: s1\u2013s4/n1\u2013n2/t1\u2013t2) \u2500\u2500\n  cms: {\n    collections: {\n      companies: {\n        singular: 'company',\n        fields: {\n          name: { type: 'string', required: true, indexSlot: 's1' },\n          // Want `domain` unique? Declare `unique: true` right here \u2014 value\n          // uniqueness (cms.md \xA79.3) is carried by `vxil push` on collection/field\n          // CREATE. Flipping it on an ALREADY-pushed field is an in-place alter\n          // via the dashboard field designer or a same-name+type re-add through\n          // POST /v1/cms/collections/companies/fields (push diffs name+type only).\n          domain: { type: 'string', indexSlot: 's2' },\n          industry: { type: 'string', indexSlot: 's3' },\n          employees: { type: 'int', indexSlot: 'n1' },\n        },\n      },\n      contacts: {\n        singular: 'contact',\n        fields: {\n          name: { type: 'string', required: true, indexSlot: 's1' },\n          email: { type: 'string', indexSlot: 's2' }, // unique \u21D2 see the `domain` note above\n          company: { type: 'relation', relationTo: 'companies', indexSlot: 's3' },\n          last_touch: { type: 'datetime', indexSlot: 't1' },\n          phone: { type: 'string' }, // stored, not indexed\n        },\n      },\n      deals: {\n        singular: 'deal',\n        fields: {\n          title: { type: 'string', required: true, indexSlot: 's1' },\n          // The pipeline stage: enum-validated on every write; the Lane-A hook\n          // above additionally locks the TRANSITIONS between stages.\n          stage: {\n            type: 'string',\n            required: true,\n            indexSlot: 's2',\n            validation: { enum: ['lead', 'qualified', 'proposal', 'won', 'lost'] },\n          },\n          company: { type: 'relation', relationTo: 'companies', indexSlot: 's3' },\n          owner: { type: 'string', indexSlot: 's4' }, // the rep working the deal\n          amount_cents: { type: 'int', indexSlot: 'n1', validation: { min: 0 } },\n          close_date: { type: 'datetime', indexSlot: 't1' },\n          notes: { type: 'text' },\n        },\n      },\n    },\n  },\n\n  // `vxil seed` POSTs each item verbatim \u2014 item_ids are assigned at runtime, so\n  // the `company` relation on contacts/deals is left unset here; link records\n  // after seeding (PATCH the created items with the company's item_id).\n  seed: {\n    cms: [\n      {\n        collection: 'companies',\n        items: [{ name: 'Acme Corp', domain: 'acme.com', industry: 'Manufacturing', employees: 250 }],\n      },\n      {\n        collection: 'contacts',\n        items: [{ name: 'Jane Porter', email: 'jane@acme.com', phone: '+1 555 0100' }],\n      },\n      {\n        collection: 'deals',\n        items: [\n          { title: 'Acme starter plan', stage: 'lead', owner: 'jordan', amount_cents: 480_000 },\n          { title: 'Acme enterprise rollout', stage: 'proposal', owner: 'sam', amount_cents: 12_000_000 },\n        ],\n      },\n    ],\n  },\n});\n",
+    "readme": '# Sales CRM template\n\nA sales CRM backend \u2014 companies, contacts, and a deal pipeline \u2014 declared end-to-end in one typed\n`vxil.config.ts`. Stage transitions are guarded by a Lane-A state machine that runs inside the write\ntransaction, every deal gets an activity timeline via `activity-feed`, and `notifications` provides\nthe email channel (mock provider until you bring your own key).\n\n**What it provisions:**\n- `companies` \u2014 name, domain, industry, employee count (slot-bound for range/sort). To make\n  `domain`/`email` unique, declare `unique: true` on the field \u2014 carried by `vxil push` on create\n  (`cms.md` \xA79.3); flipping it on an already-pushed field is a dashboard/REST in-place alter.\n- `contacts` \u2014 name, email, `company` relation, `last_touch` datetime.\n- `deals` \u2014 title, enum-validated `stage`, `company` relation, `owner` (the rep), `amount_cents`,\n  `close_date`. A Lane-A `validate` hook locks the pipeline: `lead \u2192 qualified \u2192 proposal \u2192 won|lost`.\n- Features: `cms` + `activity-feed` (per-deal timelines + the rep notification bell, default feed\n  groups) + `notifications` (mock provider; swap to `resend` + `resendApiKeyRef`, or `ses` +\n  `ses: { region, accessKeyIdRef, secretAccessKeyRef }`, for real sends).\n\n**Apply it:**\n\n```bash\nvxil init --template crm\nvxil quickstart   # or `vxil link` to an existing tenant\nvxil push\nvxil gen          # then optionally: `vxil seed` (1 company, 1 contact, 2 deals)\n```\n\n**What to learn from this:**\n1. **The pipeline state machine** \u2014 a `validate` hook on `beforeUpdate` compares `item.stage` to\n   `before.stage` and rejects any illegal transition with a clean 422, atomically in the same write.\n   Field-level `validation.enum` handles membership; the hook handles the *transitions*.\n2. **Pipeline value by stage** \u2014 one bounded group-by aggregate (`stage` is slot-bound, `amount_cents`\n   is an `n*` slot), no SQL:\n   ```bash\n   curl -X POST https://api.vxil.com/v1/cms/items/deals/aggregate \\\n     -H "Authorization: Bearer $VXIL_KEY" -H \'content-type: application/json\' \\\n     -d \'{"aggregates":[{"fn":"sum","field":"amount_cents","as":"pipeline_cents"},{"fn":"count"}],"groupBy":["stage"]}\'\n   # \u2192 { "groups": [{ "key": {"stage":"proposal"}, "count": 1, "pipeline_cents": 12000000 }, \u2026], "scanned": \u2026 }\n   ```\n3. **The deal timeline** \u2014 each call/email/note is one ingest to the default `timeline` feed group:\n   `POST /v1/feeds/timeline/{deal_item_id}/activities` with `{ actor, verb, object }` (idempotent on\n   `foreign_id` + `time`); read it back with keyset cursors, or typed via `vx.from(\'deals\').query(\u2026)`\n   for the pipeline board itself.\n\n**Go deeper:** vxil.com/docs/guide/07-validation-and-hooks (hooks), vxil.com/docs/api (aggregates), vxil.com/docs/guide/06-feature-catalog (activity-feed,\nnotifications), and `examples/ecommerce/` for a bigger state machine in the wild.\n\n**Own the shape.** The config is yours after `init` \u2014 nothing is locked.\n',
     "functions": {}
   },
   {
@@ -11211,6 +11341,22 @@ async function runApply(apply, sel = "prod", opts = {}) {
     process.exit(2);
   }
   const cwd = process.cwd();
+  const declaredFns = Object.keys(cfg.functions ?? {});
+  const skipFunctions = hasFlag("skip-functions");
+  if (declaredFns.length && !skipFunctions && !gate) {
+    const ent = await probeFunctionsEntitlement(api, declaredFns[0]);
+    if (!ent.entitled) {
+      const msg = formatFunctionsPreflight(ent, {
+        declared: declaredFns.length,
+        baseUrl: target.baseUrl,
+        verb: apply ? "push" : "plan",
+        ...target.tenantId ? { tenantId: target.tenantId } : {}
+      });
+      if (apply) fail(`${msg}
+(nothing was pushed)`);
+      console.error(`vxil: warning \u2014 ${msg}`);
+    }
+  }
   const notCompared = (u, hint) => {
     console.log(formatNotCompared(u, hint));
     if (gate) report.errors++;
@@ -11281,6 +11427,11 @@ ${r.feature} (remote v${r.version}):`);
       }
       return;
     }
+    if (skipFunctions) {
+      console.log(`
+functions: skipped (--skip-functions) \u2014 ${declaredFns.length} declared function(s) not ${apply ? "deployed" : "compared"}`);
+      return;
+    }
     const r = await planFunctions({ api, functions: cfg.functions, cwd, apply });
     console.log("\nfunctions:");
     if (r.remoteUnavailable) {
@@ -11289,6 +11440,9 @@ ${r.feature} (remote v${r.version}):`);
     }
     console.log(formatFnChanges(r.changes));
     if (apply && r.applied) console.log(`  \u2713 deployed ${r.applied} function(s)`);
+    for (const w of r.warnings ?? []) {
+      console.error(`  ! ${w.fn}: ${w.message}`);
+    }
     if (apply && r.cmsHookSubscriptions && (r.cmsHookSubscriptions.created || r.cmsHookSubscriptions.deleted)) {
       console.log(`  \u2713 cms-hook subscription reconciled (+${r.cmsHookSubscriptions.created} / -${r.cmsHookSubscriptions.deleted})`);
     }
@@ -11298,6 +11452,8 @@ ${r.feature} (remote v${r.version}):`);
     for (const c of r.changes) if (c.kind !== "unchanged") count(`function:${c.name}`);
     compared.functions += Object.keys(cfg.functions).length;
   });
+  const strictSecrets = hasFlag("strict-secrets");
+  const informationalKeys = [];
   if (!apply && (gate || explain)) {
     await runSection("secrets", async () => {
       const refs = collectSecretRefs(cfg);
@@ -11314,9 +11470,16 @@ ${r.feature} (remote v${r.version}):`);
       const cmp = compareSecretNames(refs, stored);
       if (!cmp.missing.length && !cmp.unreferenced.length) console.log(`  (in sync \u2014 ${cmp.present.length} ref(s), all stored)`);
       for (const m of cmp.missing) {
-        const ign = isIgnored(`secret:${m.name}`, ignore);
-        console.log(`  ${ign ? "\xB7" : "-"} secret:${m.name}${m.feature ? ` (${m.feature})` : ""} referenced at ${m.via} but NOT stored on the target` + (m.stored_elsewhere?.length ? ` (stored under ${m.stored_elsewhere.join(", ")} instead)` : "") + (ign ? " \u2014 ignored" : ""));
-        count(`secret:${m.name}`);
+        const key = `secret:${m.name}`;
+        const verdict = unstoredSecretVerdict({ strict: strictSecrets, ignored: isIgnored(key, ignore) });
+        const mark = verdict === "drift" ? "-" : "\xB7";
+        console.log(`  ${mark} ${key}${m.feature ? ` (${m.feature})` : ""} referenced at ${m.via} but NOT stored on the target` + (m.stored_elsewhere?.length ? ` (stored under ${m.stored_elsewhere.join(", ")} instead)` : "") + (verdict === "ignored" ? " \u2014 ignored" : verdict === "informational" ? " \u2014 informational (not counted; --strict-secrets counts it)" : ""));
+        if (verdict === "informational") {
+          report.informational = (report.informational ?? 0) + 1;
+          informationalKeys.push(key);
+        } else {
+          count(key);
+        }
       }
       for (const u of cmp.unreferenced) console.log(`  \xB7 ${u.feature}/${u.secret_name} stored but not referenced by this config (informational)`);
       if (cmp.missing.length) console.log("  note: a push with an unstored ref is a WARNING, never a 422 \u2014 set values after the push with `vxil secrets set <feature>/<name>`");
@@ -11367,14 +11530,19 @@ api state \u2014 ${self.target.tenantSlug ?? "(env key)"} vs ${other.target.tena
         exit_code: code,
         target: target.tenantSlug ?? null,
         env: target.envLabel,
-        ...report,
+        drift: report.drift,
+        ignored: report.ignored,
+        errors: report.errors,
+        informational: report.informational ?? 0,
         compared,
         ignored_keys: ignoredKeys,
+        informational_keys: informationalKeys,
+        strict_secrets: strictSecrets,
         ...opts.apiState ? { api_state: apiStateCounts } : {}
       }));
     } else {
       console.log(`
-vxil diff \u2192 ${report.drift} drift item(s), ${report.ignored} ignored, ${report.errors} error(s) \u2014 compared ${formatCompared(compared)} \u2014 exit ${code}`);
+vxil diff \u2192 ${report.drift} drift item(s), ${report.ignored} ignored, ${report.informational ?? 0} informational, ${report.errors} error(s) \u2014 compared ${formatCompared(compared)} \u2014 exit ${code}`);
     }
     process.exit(code);
   }
@@ -11382,7 +11550,7 @@ vxil diff \u2192 ${report.drift} drift item(s), ${report.ignored} ignored, ${rep
   if (apply && !hasFlag("no-gen")) await runGen(sel);
 }
 async function runServerApply(sel) {
-  const { api } = requireApi(sel, { write: "push --server" });
+  const { api, target } = requireApi(sel, { write: "push --server" });
   const resume = flag("resume");
   if (resume) {
     const done2 = await serverApply({ api, resume });
@@ -11394,8 +11562,26 @@ apply ${done2.apply_id}: ${done2.status}`);
     if (done2.status === "succeeded" && !hasFlag("no-gen")) await runGen(sel);
     return;
   }
-  const cfg = await loadVxilConfig();
+  const loaded = await loadVxilConfig();
   const cwd = process.cwd();
+  const { functions: declaredFns, ...rest2 } = loaded;
+  const cfg = hasFlag("skip-functions") ? rest2 : loaded;
+  const fnNames = Object.keys(cfg.functions ?? {});
+  if (hasFlag("skip-functions") && declaredFns && Object.keys(declaredFns).length) {
+    console.log(`functions: skipped (--skip-functions) \u2014 ${Object.keys(declaredFns).length} declared function(s) not deployed`);
+  }
+  if (fnNames.length) {
+    const ent = await probeFunctionsEntitlement(api, fnNames[0]);
+    if (!ent.entitled) {
+      fail(`${formatFunctionsPreflight(ent, {
+        declared: fnNames.length,
+        baseUrl: target.baseUrl,
+        verb: "push",
+        ...target.tenantId ? { tenantId: target.tenantId } : {}
+      })}
+(nothing was applied)`);
+    }
+  }
   const fnSources = {};
   for (const [name, def] of Object.entries(cfg.functions ?? {})) {
     fnSources[name] = (await bundleFunction(resolve7(cwd, def.entry), { projectRoot: cwd })).source;
@@ -11968,7 +12154,7 @@ try {
     }
     case "link": {
       const slug = positional(0)[0];
-      if (!slug) fail("usage: vxil link <slug> [--key <api_key>] [--tenant <id>] [--as dev|<target-name>] [--env <label>]");
+      if (!slug) fail("usage: vxil link <slug> [--key <api_key>] [--tenant <id>] [--as dev|<target-name>] [--env <label>] [--mint]");
       const base = process.env.VXIL_BASE_URL ?? DEFAULT_BASE;
       const directKey = flag("key");
       if (directKey) {
@@ -11977,8 +12163,19 @@ try {
         console.log(`\u2713 linked '${slug}' ${bound} (using provided --key)`);
         break;
       }
-      const dash = makeDash(dashboardBase(base));
       const creds = loadCredentials();
+      const stored = creds.keys?.[slug];
+      if (stored && !hasFlag("mint")) {
+        const r = await linkViaStoredKey(makeApi({ apiKey: stored, baseUrl: base }), slug, stored);
+        if ("result" in r) {
+          const tenantId = flag("tenant") ?? r.result.tenant_id;
+          const bound = persistLink(slug, tenantId, stored, base);
+          console.log(`\u2713 linked '${slug}' ${bound} (using the key already stored for this slug in ~/.vxil/credentials.json \u2014 pass --mint for a new one)`);
+          break;
+        }
+        console.error(`stored key for '${slug}' was refused (${r.invalid}) \u2014 minting a new one\u2026`);
+      }
+      const dash = makeDash(dashboardBase(base));
       const keyName = `cli-${hostname()}`.slice(0, 100);
       if (creds.session) {
         const r = await linkViaSession(dash, creds.session, slug, keyName);
@@ -12363,6 +12560,35 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
     }
     case "cms": {
       const [sub] = positional(0);
+      if (sub === "drop") {
+        const [collection] = positional(1);
+        if (!collection) fail("usage: vxil cms drop <collection> [--yes]");
+        const { api: api2, target } = requireApi(selector(), { write: `cms drop ${collection}` });
+        const plan = await planCollectionDrop(api2, collection);
+        if (plan.remoteUnavailable) {
+          fail(`cannot read ${plan.remoteUnavailable.route} (${plan.remoteUnavailable.code ?? plan.remoteUnavailable.status}) \u2014 refusing to drop against an unread target`);
+        }
+        if (!plan.exists) fail(`collection '${collection}' does not exist on tenant '${target.tenantSlug ?? "(env key)"}' \u2014 nothing to drop`);
+        let declaredLocally = false;
+        try {
+          const cfg = await loadVxilConfig();
+          declaredLocally = Object.prototype.hasOwnProperty.call(cfg.cms?.collections ?? {}, collection);
+        } catch {
+        }
+        console.error(formatCollectionDrop(collection, plan, declaredLocally));
+        if (!hasFlag("yes")) {
+          if (!process.stdin.isTTY) fail("cms drop is destructive \u2014 pass --yes to confirm in a non-interactive run");
+          const ans = await prompt(`drop collection '${collection}'? type the collection name to confirm: `);
+          if (ans !== collection) fail("confirmation did not match \u2014 aborted.");
+        }
+        await dropCollection(api2, collection);
+        if (jsonOut) {
+          console.log(JSON.stringify({ ok: true, collection, fields: plan.fields, rows: plan.rows, declared_locally: declaredLocally }));
+        } else {
+          console.log(`\u2713 dropped collection ${collection} (${plan.fields} field(s); ${plan.rows === null ? "stored rows" : `${plan.rows} stored row(s)`} retained, unreachable until re-created)`);
+        }
+        break;
+      }
       const { api } = requireApi(selector());
       if (sub === "status") {
         printEnvelope(await api("GET", "/v1/cms/collections"));
@@ -12383,7 +12609,7 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
           console.log(`  \u26A0 ${done.skipped} row(s) were written while the re-index ran and were NOT re-projected \u2014 re-run \`vxil cms reindex ${collection}\` when writes are quiet`);
         }
       } else {
-        fail("usage: vxil cms status|pull|reindex <collection> [--field <field>]");
+        fail("usage: vxil cms status|pull|reindex <collection> [--field <field>]|drop <collection> [--yes]");
       }
       break;
     }
@@ -12459,28 +12685,24 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
       break;
     }
     case "api": {
-      const [method, path] = rest;
-      if (!method || !path?.startsWith("/")) fail("usage: vxil api <GET|POST|PUT|PATCH|DELETE> </v1/...> [--data '<json>']");
-      const { api } = requireApi(selector(), method.toUpperCase() === "GET" ? {} : { write: `api ${method.toUpperCase()} ${path}` });
-      let body;
-      const raw = flag("data");
-      if (raw !== void 0) {
-        try {
-          body = JSON.parse(raw);
-        } catch {
-          fail("--data must be valid JSON");
-        }
+      let parsed;
+      try {
+        parsed = parseApiArgs(positional(0), flag("data"));
+      } catch (e) {
+        fail(e.message);
       }
-      printEnvelope(await api(method.toUpperCase(), path, body));
+      const { method, path, body } = parsed;
+      const { api } = requireApi(selector(), method === "GET" ? {} : { write: `api ${method} ${path}` });
+      printEnvelope(await api(method, path, body));
       break;
     }
     default:
       console.log(`vxil \u2014 a Supabase-grade code-first CLI for the whole platform
-  init [--template <id>] \xB7 templates \xB7 try (keyless sandbox) \xB7 quickstart [--dev --ttl <h>] \xB7 login \xB7 link <slug> [--as dev|<name>]
+  init [--template <id>] \xB7 templates \xB7 try (keyless sandbox) \xB7 quickstart [--dev --ttl <h>] \xB7 login \xB7 link <slug> [--key <k>] [--as dev|<name>] [--mint]
   architect "<describe your app>" \u2014 plain English in, a reviewed vxil.config.ts draft out
-  plan [--explain] \xB7 push [--dev|--target <name>|--prod] [--server [--resume <apply_id>]] [--no-gen] \xB7 pull \xB7 gen [--check] [--offline] [--out <f>] [--no-mcp] [--mcp-out <f>]
+  plan [--explain] \xB7 push [--dev|--target <name>|--prod] [--server [--resume <apply_id>]] [--no-gen] [--skip-functions] \xB7 pull \xB7 gen [--check] [--offline] [--out <f>] [--no-mcp] [--mcp-out <f>]
     push production overrides: --allow-mock-in-prod \xB7 --allow-sandbox-in-prod \xB7 --allow-dev-origins-in-prod \xB7 --yes
-  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>] [--api-state]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (an unreadable remote is 2; secrets by name only)
+  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>] [--strict-secrets] [--api-state]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (an unreadable remote is 2; secrets by name only, unstored refs informational unless --strict-secrets)
   doctor [--dev|--target <name>]  \u2014 + secrets referenced-vs-stored (advisory) + per-function served/published/local hash
   versions <feature> \xB7 rollback <feature> --to <v>
   secrets set|list [--all-projects]|rm \xB7 seed \xB7 export|import <feature>
@@ -12489,11 +12711,11 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
   migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run]  \u2014 backfill subscriptions via the server sync leg (resumable)
   payments simulate --scenario refund-pair|cross-platform-unlock|renewal|expiry|past-due-grace|transfer --user <id> [--tier <t>]  \u2014 mock/dev projects only
   env pull [--dev] [--file <f>] [--print] [--no-gitignore]
-  functions new|deploy|list|delete|invoke [--async]|logs [--tail]|dev <name> [--port <n>] \xB7 cms status|pull|reindex <collection> \xB7 dev up [--ttl <h>] [--new]|down [--yes]|seed|reset
+  functions new|deploy|list|delete|invoke [--async]|logs [--tail]|dev <name> [--port <n>] \xB7 cms status|pull|reindex <collection>|drop <collection> [--yes] \xB7 dev up [--ttl <h>] [--new]|down [--yes]|seed|reset
   listen --forward-to <url> [--dev] [--source <id>] [--events <prefix,\u2026>] [--replay-last <n>] [--interval <s>] [--show-runs] [--raw]  \u2014 forward inbound webhook events to a local server
   mcp install [--client cursor|claude|vscode] [--project] [--print] [--key <k>] [--scopes a,b] [--name <server>]  \u2014 connect your editor's agent to this backend's MCP server
   dev branch [<name>] [--ttl <h=24>] [--no-env] [--print] | --list | --rm <name> [--yes]
-  config get \xB7 users \xB7 send \xB7 deliveries \xB7 api <METHOD> <path>
+  config get \xB7 users \xB7 send \xB7 deliveries \xB7 api <METHOD> <path> ['<json>' | --data '<json>']
   global: --json (machine-readable + exit codes)`);
       process.exit(cmd ? 1 : 0);
   }
@@ -13003,7 +13225,7 @@ async function runFunctionsDev(name) {
     // parity with the deploy pipeline's metadata
     outboundService: (req) => outbound(req)
   });
-  const first = await bundleFunction(entry, { projectRoot: cwd });
+  const first = await bundleFunction(entry, { projectRoot: cwd, minify: false });
   const mf = new Miniflare(mfOptions(first.source));
   const { secrets, missing } = resolveDevSecrets(def.secrets, process.env);
   for (const m of missing) {
@@ -13062,7 +13284,7 @@ async function runFunctionsDev(name) {
     timer2 = setTimeout(() => {
       void (async () => {
         try {
-          const rebuilt = await bundleFunction(entry, { projectRoot: cwd });
+          const rebuilt = await bundleFunction(entry, { projectRoot: cwd, minify: false });
           await mf.setOptions(mfOptions(rebuilt.source));
           console.log(`  \u21BB rebuilt '${name}' (${Math.round(rebuilt.bytes / 100) / 10} KB) \u2014 hot-swapped`);
         } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/cli",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "private": false,
   "description": "The vxil CLI — init, quickstart, push, gen, secrets, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",
@@ -46,7 +46,7 @@
   },
   "devDependencies": {
     "miniflare": "^4.20260611.0",
-    "@vxil/config": "0.4.0",
+    "@vxil/config": "0.4.1",
     "@vxil/runtime": "0.0.1",
     "@vxil/types": "0.0.1"
   },