@vxil/cli 0.5.1 → 0.5.3

package/README.md

@@ -39,13 +39,18 @@ export default defineConfig({
 });
 ```
 
-Verbs: `init templates quickstart try login link plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms dev payments migrate config users send deliveries api`.
+Verbs: `init templates quickstart try login link keys plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms dev payments migrate config users send deliveries api`.
 
 **Every verb names its target.** `--dev` selects the dev slot, `--target <name>` a named slot bound by `vxil link <slug> --as <name>` (which merges into the existing binding rather than replacing it). The selector is **fail-closed** — an unbound slot exits 1 telling you the fix, and never falls through to another tenant — and every write verb prints a target banner (slug + env, never a key) before it acts.
 
 - `vxil plan --explain` — the config plan with every leaf tagged *declared* or *default*.
-- `vxil diff [--against <target>] [--ignore <k,…>]` — the CI drift gate; secrets compared by name only.
-- `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function.
+- `vxil push [--skip-functions]` — apply schema → config → functions; a project below the functions plan is stopped *before anything is pushed*, and `--skip-functions` pushes the rest.
+- `vxil diff [--against <target>] [--ignore <k,…>] [--strict-secrets]` — the CI drift gate; secrets compared by name only, and a referenced-but-unstored name is informational unless `--strict-secrets`.
+- `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function. Under `--json` stdout is one JSON document; notices go to stderr.
+- `vxil link <slug>` — reuses the key already stored for the slug on this machine; `--mint` for a fresh one, `--key` to hand one in.
+- `vxil keys mint --name <name> --scopes <a,b,c> [--env live|test] [--store]` — mint a **narrow** key for a server (scopes validated locally; `admin` refused); the key prints **once** to stdout (`--json` → `{ api_key, key_id, scopes }`) and is never stored unless `--store`. `vxil keys list` shows names, ids, scopes, created and last-used (never secrets); `vxil keys revoke <key_id> [--yes]` asks you to type the id, and refuses the key the CLI itself is using unless `--yes`. Needs a dashboard session (`vxil login`, or it prompts at a terminal; a piped / `--json` run fails with that remedy instead — pass `--email`/`--password` to script it, which never stores the session).
+- `vxil cms drop <collection> [--yes]` — remove one collection definition through the same guarded ack `push --allow-destructive` uses (rows are retained).
+- `vxil api <METHOD> <path> ['<json>' | --data '<json>']` — call any `/v1` route; bare JSON on stdout, banner on stderr.
 - `vxil secrets list --all-projects` — the names-and-metadata matrix across every bound project (values never come back).
 - `vxil migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run]` — backfill subscriptions through the server sync leg; resumable.
 - `vxil payments simulate --scenario <s> --user <id> [--tier <t>]` — mock/dev projects only: drive a refund pair, cross-platform unlock, renewal, expiry, past-due grace or transfer and check the oracle.

package/dist/_vxil-feature-configs.d.ts

@@ -37,6 +37,12 @@ export declare function validateNotificationOverrides(templates: {
         text?: string;
     }>>;
 } | undefined): string[];
+/** AWS region grammar for `notifications.ses.region` (`us-east-1`,
+ * `eu-central-1`, `ap-southeast-2`, `us-gov-west-1`, …): two-letter partition,
+ * one or more lowercase words, a single digit. Pinned as a pattern rather than
+ * a list so a newly launched SES region needs no vxil release; a typo still
+ * fails at `vxil push` (TypeBox), never as a DNS error on the first send. */
+export declare const SES_REGION_PATTERN = "^[a-z]{2}(-[a-z]+)+-\\d$";
 export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     fromEmail: import("@sinclair/typebox").TString;
@@ -44,7 +50,12 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
     replyTo: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     resendApiKeyRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     webhookSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
-    provider: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resend">, import("@sinclair/typebox").TLiteral<"mock">]>;
+    provider: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resend">, import("@sinclair/typebox").TLiteral<"ses">, import("@sinclair/typebox").TLiteral<"mock">]>;
+    ses: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        region: import("@sinclair/typebox").TString;
+        accessKeyIdRef: import("@sinclair/typebox").TString;
+        secretAccessKeyRef: import("@sinclair/typebox").TString;
+    }>>;
     defaultLocale: import("@sinclair/typebox").TString;
     retry: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         maxAttempts: import("@sinclair/typebox").TInteger;
@@ -53,10 +64,10 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
     suppression: import("@sinclair/typebox").TObject<{
         softBounceThreshold: import("@sinclair/typebox").TInteger;
     }>;
-    rateLimit: import("@sinclair/typebox").TObject<{
+    rateLimit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         perDay: import("@sinclair/typebox").TInteger;
         perTenantSec: import("@sinclair/typebox").TInteger;
-    }>;
+    }>>;
     templates: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         allowOverride: import("@sinclair/typebox").TBoolean;
         overrides: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
@@ -150,6 +161,17 @@ declare const OidcProviderSchema: import("@sinclair/typebox").TObject<{
     allowedDomains: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     autoLink: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
+export declare const REDIRECT_ORIGIN_PATTERN = "^(https://[^/?#\\s]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]{1,5})?)$";
+/** THE scheme rule for a redirect/return URL: https anywhere, http on loopback
+ *  only. Takes the parsed URL (or any {protocol, hostname} pair) so the config
+ *  validator and the worker's runtime guard call the identical predicate. */
+export declare function redirectSchemeAllowed(u: {
+    protocol: string;
+    hostname: string;
+}): boolean;
+/** An allow-list ENTRY is a bare origin that parses and passes the scheme
+ *  rule. Used by validateFeatureConfig (auth) on top of the coarse pattern. */
+export declare function isAllowedRedirectOriginEntry(entry: string): boolean;
 export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     methods: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{

package/dist/config.d.ts

@@ -221,6 +221,15 @@ export type ApiVersion = 'v1';
  *  only by a real v2. */
 export declare const RELEASED_API_VERSIONS: readonly ApiVersion[];
 /** The whole vxil backend, declared in one typed, version-controlled file. */
+/** Recursive partial: a `vxil.config.ts` may write any SUBSET of a nested bag
+ *  (`auth: { otp: { enabled: true } }`) — the server applies the defaults for
+ *  the rest (Value.Default). A shallow `Partial` made `tsc` reject every
+ *  partially-written nested bag, including the guide's own skeleton
+ *  (found by the 2026-09-19 cvskit dry-run). Arrays and primitives are kept
+ *  as-is; only plain object bags recurse. */
+export type DeepPartial<T> = T extends readonly unknown[] ? T : T extends object ? {
+    [K in keyof T]?: DeepPartial<T[K]>;
+} : T;
 export interface VxilConfig {
     /** target environment label; resolved to a baseUrl by `vxil link` / `--env`. */
     env?: string;
@@ -233,25 +242,25 @@ export interface VxilConfig {
      *  same Value.Default/Clean pipeline the server uses. Keys match FEATURE_SCHEMAS
      *  exactly (note the hyphenated ids). */
     features?: {
-        notifications?: Partial<NotificationsConfig>;
-        jobs?: Partial<JobsConfig>;
-        auth?: Partial<AuthConfig>;
-        'rate-limits'?: Partial<RateLimitsConfig>;
-        files?: Partial<FilesConfig>;
-        webhooks?: Partial<WebhooksConfig>;
-        comments?: Partial<CommentsConfig>;
-        cms?: Partial<CmsConfig>;
-        mcp?: Partial<McpConfig>;
-        realtime?: Partial<RealtimeConfig>;
-        presence?: Partial<PresenceConfig>;
-        orgs?: Partial<OrgsConfig>;
-        'activity-feed'?: Partial<ActivityFeedConfig>;
-        'vector-search'?: Partial<VectorSearchConfig>;
-        ai?: Partial<AiConfig>;
-        rag?: Partial<RagConfig>;
-        payments?: Partial<PaymentsConfig>;
-        functions?: Partial<FunctionsConfig>;
-        copilot?: Partial<CopilotConfig>;
+        notifications?: DeepPartial<NotificationsConfig>;
+        jobs?: DeepPartial<JobsConfig>;
+        auth?: DeepPartial<AuthConfig>;
+        'rate-limits'?: DeepPartial<RateLimitsConfig>;
+        files?: DeepPartial<FilesConfig>;
+        webhooks?: DeepPartial<WebhooksConfig>;
+        comments?: DeepPartial<CommentsConfig>;
+        cms?: DeepPartial<CmsConfig>;
+        mcp?: DeepPartial<McpConfig>;
+        realtime?: DeepPartial<RealtimeConfig>;
+        presence?: DeepPartial<PresenceConfig>;
+        orgs?: DeepPartial<OrgsConfig>;
+        'activity-feed'?: DeepPartial<ActivityFeedConfig>;
+        'vector-search'?: DeepPartial<VectorSearchConfig>;
+        ai?: DeepPartial<AiConfig>;
+        rag?: DeepPartial<RagConfig>;
+        payments?: DeepPartial<PaymentsConfig>;
+        functions?: DeepPartial<FunctionsConfig>;
+        copilot?: DeepPartial<CopilotConfig>;
     };
     /** (b) CMS SCHEMA-AS-CODE — collections + fields. `push` reconciles them
      *  additively against GET /v1/cms/collections (no destructive drops without