@vxil/cli 0.5.1 → 0.5.3

package/dist/vxil.js

@@ -47,7 +47,7 @@ function lowerTriggerBindings(trigger) {
   return [{ kind: "http", ...str2("path") ? { path: str2("path") } : {} }];
 }
 var CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-var VXIL_CONFIG_PKG_VERSION = "0.4.0";
+var VXIL_CONFIG_PKG_VERSION = "0.4.1";
 function ensureScaffoldPackageJson(cwd) {
   const file = resolve(cwd, "package.json");
   const spec = `^${VXIL_CONFIG_PKG_VERSION}`;
@@ -551,7 +551,7 @@ import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync
 import { homedir } from "node:os";
 import { dirname as dirname2, resolve as resolve2, relative, isAbsolute, sep } from "node:path";
 import { createHash } from "node:crypto";
-var MAX_SOURCE_BYTES = 256e3;
+var MAX_SOURCE_BYTES = 512e3;
 function sourceSha12(source) {
   return createHash("sha256").update(source, "utf8").digest("hex").slice(0, 12);
 }
@@ -609,7 +609,7 @@ function assertBundleContained(projectRoot, inputs, opts = {}) {
   const root = resolve2(projectRoot);
   const rootReal = realpathSafe(root);
   const wsReal = realpathSafe(opts.workspaceRoot ?? workspaceRootCached(root));
-  const note = opts.onEscape ?? ((msg) => console.log(msg));
+  const note = opts.onEscape ?? ((msg) => console.error(msg));
   for (const input of inputs) {
     const abs = resolve2(root, input);
     const absReal = realpathSafe(abs);
@@ -641,9 +641,11 @@ async function bundleFunction(entryPath, opts = {}) {
   const root = resolve2(opts.projectRoot ?? process.cwd());
   const workspaceRoot = workspaceRootCached(root);
   const entry = resolve2(entryPath);
-  assertBundleContained(root, [entry], { workspaceRoot, what: "entry" });
+  const contained = { workspaceRoot, ...opts.onNote ? { onEscape: opts.onNote } : {} };
+  assertBundleContained(root, [entry], { ...contained, what: "entry" });
   const esbuild = await import("esbuild");
-  const result = await esbuild.build({
+  const minify = opts.minify ?? true;
+  const build = (min) => esbuild.build({
     entryPoints: [entry],
     bundle: true,
     format: "esm",
@@ -652,22 +654,45 @@ async function bundleFunction(entryPath, opts = {}) {
     target: "es2022",
     write: false,
     legalComments: "none",
+    minify: min,
+    keepNames: min,
+    // readable stack traces / log lines on the minified bundle
+    sourcemap: false,
+    // never uploaded, never emitted
     absWorkingDir: root,
     metafile: true,
     // drives the import-containment check below (non-executing)
     plugins: []
     // explicitly none — build plugins are code execution
   });
+  const result = await build(minify);
   const out = result.outputFiles?.[0];
   if (!out) throw new Error(`esbuild produced no output for ${entryPath}`);
-  assertBundleContained(root, Object.keys(result.metafile?.inputs ?? {}), { workspaceRoot });
+  assertBundleContained(root, Object.keys(result.metafile?.inputs ?? {}), contained);
   const source = out.text;
   const bytes = Buffer.byteLength(source, "utf8");
   if (bytes > MAX_SOURCE_BYTES) {
-    throw new Error(`bundled ${entryPath} is ${Math.round(bytes / 1e3)} KB \u2014 exceeds the ${MAX_SOURCE_BYTES / 1e3} KB deploy cap`);
+    let raw = null;
+    if (minify) {
+      try {
+        const rawOut = (await build(false)).outputFiles?.[0];
+        if (rawOut) raw = Buffer.byteLength(rawOut.text, "utf8");
+      } catch {
+        raw = null;
+      }
+    }
+    throw new Error(formatBundleTooLarge(entryPath, bytes, raw, minify));
   }
   return { source, bytes };
 }
+function kb(n) {
+  return `${Math.round(n / 100) / 10} KB`;
+}
+function formatBundleTooLarge(entryPath, bytes, rawBytes, minified) {
+  const measured = minified ? `${kb(bytes)} minified` : kb(bytes);
+  const raw = rawBytes !== null && minified ? ` (${kb(rawBytes)} unminified)` : "";
+  return `bundled ${entryPath} is ${measured}${raw} \u2014 exceeds the ${MAX_SOURCE_BYTES / 1e3} KB deploy cap (the cap is measured on the minified bundle, which is what gets uploaded; trim imports or split the function)`;
+}
 function stableStringify(v) {
   if (Array.isArray(v)) return `[${v.map(stableStringify).join(",")}]`;
   if (v !== null && typeof v === "object") {
@@ -716,7 +741,7 @@ var DENY_FUNCTION_SCOPES = /* @__PURE__ */ new Set(["admin", "*", "features:writ
 function clampFunctionScopes(scopes) {
   return (scopes ?? []).map(String).filter((s) => s && !DENY_FUNCTION_SCOPES.has(s));
 }
-async function planFunctions({ api, functions, cwd, apply }) {
+async function planFunctions({ api, functions, cwd, apply, onNote }) {
   const read = await readRemote(api);
   if (read.unavailable) {
     if (apply) {
@@ -731,7 +756,7 @@ async function planFunctions({ api, functions, cwd, apply }) {
     if (!/^[a-z][a-z0-9-]{0,47}$/.test(name)) {
       throw new Error(`functions: invalid name '${name}' (must match /^[a-z][a-z0-9-]{0,47}$/)`);
     }
-    const { source, bytes } = await bundleFunction(resolve2(cwd, def.entry), { projectRoot: cwd });
+    const { source, bytes } = await bundleFunction(resolve2(cwd, def.entry), { projectRoot: cwd, ...onNote ? { onNote } : {} });
     const triggerKind = def.trigger?.kind ?? "http";
     const secrets = normalizeSecretRefs(def.secrets);
     const bindings = lowerTriggerBindings(def.trigger);
@@ -755,12 +780,13 @@ async function planFunctions({ api, functions, cwd, apply }) {
         const e = res.body.error ?? {};
         throw new Error(`functions: deploy ${name} failed: ${e.code ?? res.status} ${e.message ?? ""} ${e.hint ?? ""}`);
       }
-      const data2 = res.body.data;
-      const cmsHooks = data2?.cms_hook_subscriptions ?? null;
-      const webhooks = data2?.webhook_subscriptions ?? null;
-      return { change, applied: 1, cmsHooks, webhooks };
+      const data3 = res.body.data;
+      const cmsHooks = data3?.cms_hook_subscriptions ?? null;
+      const webhooks = data3?.webhook_subscriptions ?? null;
+      const warnings2 = (data3?.warnings ?? []).map((message) => ({ fn: name, message: String(message) }));
+      return { change, applied: 1, cmsHooks, webhooks, warnings: warnings2 };
     }
-    return { change, applied: 0, cmsHooks: null, webhooks: null };
+    return { change, applied: 0, cmsHooks: null, webhooks: null, warnings: [] };
   });
   const changes = results.map((r) => r.change);
   const applied = results.reduce((s, r) => s + r.applied, 0);
@@ -771,13 +797,47 @@ async function planFunctions({ api, functions, cwd, apply }) {
   }, null);
   const cmsHookSubscriptions = sum((r) => r.cmsHooks);
   const webhookSubscriptions = sum((r) => r.webhooks);
-  return { changes, applied, cmsHookSubscriptions, webhookSubscriptions };
+  const warnings = results.flatMap((r) => r.warnings ?? []);
+  return { changes, applied, cmsHookSubscriptions, webhookSubscriptions, ...warnings.length ? { warnings } : {} };
 }
 function formatFnChanges(changes) {
   const actionable = changes.filter((c) => c.kind !== "unchanged");
   if (!actionable.length) return "  (no function changes)";
   return actionable.map((c) => `  ${c.kind === "deploy-new" ? "+" : "~"} ${c.detail}`).join("\n");
 }
+async function probeFunctionsEntitlement(api, name) {
+  const res = await api("POST", `/v1/functions/${encodeURIComponent(name)}`, {});
+  if (res.status === 402 || res.status === 403) {
+    const e = res.body.error ?? {};
+    return {
+      entitled: false,
+      status: res.status,
+      ...e.code ? { code: e.code } : {},
+      ...e.message ? { message: e.message } : {},
+      ...e.hint ? { hint: e.hint } : {},
+      ...e.fixUrl ? { fixUrl: e.fixUrl } : {}
+    };
+  }
+  return { entitled: true };
+}
+function billingPageFor(tenantId, baseUrl) {
+  const tid = tenantId && tenantId !== "(unknown)" ? tenantId : "<tenant>";
+  const path = `/dashboard/${tid}/billing`;
+  try {
+    if (/(^|\.)api\.vxil\.com$/.test(new URL(baseUrl).hostname)) return `https://vxil.com${path}`;
+  } catch {
+  }
+  return path;
+}
+function formatFunctionsPreflight(e, opts) {
+  const n = `${opts.declared} declared function(s)`;
+  if (e.code === "sandbox_restricted" || e.status === 403) {
+    return `functions: this project cannot deploy functions (${e.code ?? e.status}${e.message ? ` \u2014 ${e.message}` : ""}); ${n} would be refused.${e.hint ? ` ${e.hint}` : ""}` + (opts.verb === "push" ? " Run `vxil push --skip-functions` to push everything else." : "");
+  }
+  const plan = /'([a-z]+)' plan/.exec(e.message ?? "")?.[1];
+  const planLabel = plan ? `the ${plan[0].toUpperCase()}${plan.slice(1)} plan` : "a paid plan";
+  return `functions need ${planLabel}${e.message ? ` (${e.message})` : ""} \u2014 ${n} would be refused with 402 tier_required. Upgrade in the dashboard (${billingPageFor(opts.tenantId, opts.baseUrl)})` + (opts.verb === "push" ? ", or run `vxil push --skip-functions` to push the cms schema and feature config without them" : "") + ".";
+}
 function formatLogLines(lines) {
   const out = [];
   for (const l of lines) {
@@ -1188,11 +1248,7 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
 async function applyDestructive(api, collections, c) {
   const ok2xx = (status) => status >= 200 && status < 300;
   if (c.op === "drop-collection") {
-    const res2 = await api("POST", "/v1/cms/collections", { drop_collection: c.collection, allow_destructive: true });
-    if (!ok2xx(res2.status) && res2.body.error?.code !== "not_found") {
-      const e = res2.body.error ?? {};
-      throw new Error(`cms: drop collection ${c.collection} failed: ${e.code ?? res2.status} ${e.message ?? ""}`);
-    }
+    await dropCollection(api, c.collection);
     return 1;
   }
   const path = `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`;
@@ -1231,6 +1287,53 @@ function formatCmsChanges(changes) {
     return `  + ${c.detail}`;
   }).join("\n");
 }
+async function planCollectionDrop(api, collection) {
+  const read = await readRemote2(api);
+  if (read.unavailable) return { exists: false, fields: 0, rows: null, remoteUnavailable: read.unavailable };
+  const rc = read.map.get(collection);
+  if (!rc) return { exists: false, fields: 0, rows: null };
+  return { exists: true, fields: rc.fields.length, rows: await liveRowCount(api, collection) };
+}
+async function dropCollection(api, collection) {
+  const res = await api("POST", "/v1/cms/collections", { drop_collection: collection, allow_destructive: true });
+  if ((res.status < 200 || res.status >= 300) && res.body.error?.code !== "not_found") {
+    const e = res.body.error ?? {};
+    throw new Error(`cms: drop collection ${collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
+  }
+}
+function formatCollectionDrop(collection, plan, declaredLocally) {
+  const rows = plan.rows === null ? "an unknown number of live rows" : `${plan.rows} live row(s)`;
+  const lines = [
+    `  ! drop collection ${collection} (${plan.fields} field(s), ${rows}) \u2014 the definition is removed; stored item rows are NOT deleted (they become unreachable through the API until a collection of that name exists again)`
+  ];
+  if (declaredLocally) {
+    lines.push(`  \u26A0 '${collection}' is still declared in vxil.config.ts \u2014 the next \`vxil push\` re-creates it (empty); remove it from the config too`);
+  }
+  return lines.join("\n");
+}
+
+// src/apiCmd.ts
+var API_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+var API_USAGE = "usage: vxil api <GET|POST|PUT|PATCH|DELETE> </v1/...> ['<json body>' | --data '<json body>']";
+function parseApiArgs(positionals, dataFlag) {
+  const [rawMethod, path, ...extra] = positionals;
+  const method = (rawMethod ?? "").toUpperCase();
+  if (!rawMethod || !API_METHODS.includes(method)) throw new Error(API_USAGE);
+  if (!path || !path.startsWith("/")) throw new Error(API_USAGE);
+  const positionalBody = extra[0];
+  if (extra.length > 1) throw new Error(`${API_USAGE} \u2014 too many arguments (${extra.length} after the path; quote the JSON body as ONE argument)`);
+  if (positionalBody !== void 0 && dataFlag !== void 0) {
+    throw new Error("pass the body either as the third argument or with --data, not both");
+  }
+  const raw = positionalBody ?? dataFlag;
+  if (raw === void 0) return { method, path };
+  try {
+    return { method, path, body: JSON.parse(raw) };
+  } catch {
+    const via = positionalBody !== void 0 ? "the body argument" : "--data";
+    throw new Error(`${via} must be valid JSON (got ${JSON.stringify(raw.length > 60 ? `${raw.slice(0, 57)}\u2026` : raw)})`);
+  }
+}
 
 // ../types/src/ulid.ts
 var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
@@ -1253,12 +1356,79 @@ function newId(prefix) {
   return `${prefix}_${ulid()}`;
 }
 
+// ../types/src/index.ts
+var KNOWN_SCOPES = [
+  "features:read",
+  "features:write",
+  // Dedicated write scope for the BYO-secret path. PUT /v1/secrets/:feature/:name
+  // requires THIS (or 'admin') as of 2026-07-17 (audit H2 — 'features:write' is no
+  // longer secret-write-equivalent). GET/DELETE /v1/secrets still also accept
+  // 'features:write'.
+  "secrets:write",
+  "users:read",
+  "users:write",
+  "notifications:send",
+  "notifications:read",
+  "jobs:read",
+  "jobs:write",
+  "auth:read",
+  "auth:write",
+  // Narrow least-privilege scope for the SIGN-IN surface only (2026-09-10,
+  // F4-25/F8-56): every auth route an anonymous or self-authenticating client
+  // must call to obtain, renew, verify or end ITS OWN session (sign-up/sign-in,
+  // magic-link, OTP, anonymous, step-up, OAuth, refresh, by-token revoke,
+  // sessions/verify, password reset). It does NOT reach the administrative
+  // routes — GET /v1/auth/sessions (auth:read), POST /v1/auth/sessions/:id/
+  // revoke and POST /v1/auth/users/:id/erase (auth:write). This is the scope a
+  // key baked into a browser/mobile bundle carries for sign-in; 'auth:write'
+  // still satisfies every route (any-of, the usage:read idiom) so existing keys
+  // keep working.
+  "auth:signin",
+  "ratelimits:read",
+  "ratelimits:write",
+  "ratelimits:check",
+  "files:read",
+  "files:write",
+  "webhooks:read",
+  "webhooks:write",
+  "comments:read",
+  "comments:write",
+  "cms:read",
+  "cms:write",
+  "realtime:read",
+  "realtime:write",
+  "presence:read",
+  "orgs:read",
+  "orgs:write",
+  "payments:read",
+  "payments:write",
+  "vector-search:read",
+  "vector-search:write",
+  "ai:read",
+  "ai:write",
+  "rag:read",
+  "rag:write",
+  "activity-feed:read",
+  "activity-feed:write",
+  "functions:invoke",
+  "functions:read",
+  "functions:write",
+  "copilot:read",
+  "copilot:write",
+  // Narrow least-privilege read for GET /v1/usage (2026-08-05, parity P0#4).
+  // The route ALSO accepts 'features:read' (any-of, the secrets:write idiom)
+  // so pre-existing keys keep working; mint this when a key should see usage
+  // and nothing else.
+  "usage:read",
+  "admin"
+];
+
 // ../runtime/src/hash.ts
 async function sha256Hex(input) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
   return [...new Uint8Array(digest)].map((b2) => b2.toString(16).padStart(2, "0")).join("");
 }
-async function hmacSha256Hex(secret, data2) {
+async function hmacSha256Hex(secret, data3) {
   const key = await crypto.subtle.importKey(
     "raw",
     new TextEncoder().encode(secret),
@@ -1266,7 +1436,7 @@ async function hmacSha256Hex(secret, data2) {
     false,
     ["sign"]
   );
-  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data2));
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data3));
   return [...new Uint8Array(sig)].map((b2) => b2.toString(16).padStart(2, "0")).join("");
 }
 
@@ -2198,7 +2368,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
   function drain() {
     !query && onopen(connection2);
   }
-  function data2(x) {
+  function data3(x) {
     if (incomings) {
       incomings.push(x);
       remaining -= x.length;
@@ -2252,7 +2422,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       statementId = Math.random().toString(36).slice(2);
       statementCount = 1;
       lifeTimer.start();
-      socket.on("data", data2);
+      socket.on("data", data3);
       keep_alive && socket.setKeepAlive && socket.setKeepAlive(true, 1e3 * keep_alive);
       const s = StartupMessage();
       write(s);
@@ -2295,7 +2465,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       error(Errors.connection("CONNECTION_DESTROYED", options));
     clearImmediate(nextWriteTimer);
     if (socket) {
-      socket.removeListener("data", data2);
+      socket.removeListener("data", data3);
       socket.removeListener("connect", connected);
       socket.readyState === "open" && socket.end(bytes_default().X().end());
     }
@@ -2306,7 +2476,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     remaining = 0;
     incomings = null;
     clearImmediate(nextWriteTimer);
-    socket.removeListener("data", data2);
+    socket.removeListener("data", data3);
     socket.removeListener("connect", connected);
     idleTimer.cancel();
     lifeTimer.cancel();
@@ -2898,14 +3068,14 @@ function Subscribe(postgres2, options) {
     const state2 = {
       lsn: Buffer.concat(x.consistent_point.split("/").map((x2) => Buffer.from(("00000000" + x2).slice(-8), "hex")))
     };
-    stream2.on("data", data2);
+    stream2.on("data", data3);
     stream2.on("error", error);
     stream2.on("close", sql2.close);
     return { stream: stream2, state: xs.state };
     function error(e) {
       console.error("Unexpected error during logical streaming - reconnecting", e);
     }
-    function data2(x2) {
+    function data3(x2) {
       if (x2[0] === 119) {
         parse(x2.subarray(25), state2, sql2.options.parsers, handle, options.transform);
       } else if (x2[0] === 107 && x2[17]) {
@@ -3080,9 +3250,9 @@ function largeObject(sql, oid, mode = 131072 | 262144) {
           async read(size2) {
             const l = size2 > max ? size2 - max : size2;
             max -= size2;
-            const [{ data: data2 }] = await lo.read(l);
-            this.push(data2);
-            if (data2.length < size2)
+            const [{ data: data3 }] = await lo.read(l);
+            this.push(data3);
+            if (data3.length < size2)
               this.push(null);
           }
         });
@@ -5074,7 +5244,13 @@ var TOOLS = [
           },
           description: "Prompt-cache breakpoints (anthropic; ignored elsewhere): system caches the system prompt, messages caches the transcript prefix, ttl picks 5m (default) or 1h. A cache hit only lowers input_tokens."
         },
-        user_id: { type: "string", description: "Opaque end_user_id for per-user usage metering." }
+        user_id: { type: "string", description: "Opaque end_user_id for per-user usage metering." },
+        correlation_id: {
+          type: "string",
+          minLength: 1,
+          maxLength: 128,
+          description: "Your own opaque handle for this generation (1..128 chars): stored on the row and echoed on the answer; on mode:job it also rides the job.generation.completed|failed events next to generation_id, so you never need a run\u2192record link."
+        }
       }
     },
     method: "POST",
@@ -5247,6 +5423,8 @@ var TOOLS = [
         event_type: { type: "string", description: "Exact event type filter, e.g. 'subscription.updated'." },
         outcome: { type: "string", enum: ["received", "processed", "error", "sig_failed", "parse_failed", "reprocessed", "ignored", "unowned", "rejected_environment"] },
         environment: { type: "string", enum: ["production", "sandbox"], description: "The provider-reported environment of the delivery (a separate axis from the API key label)." },
+        provider_charge_id: { type: "string", maxLength: 200, description: "Exact match on the normalised charge id (the same provider_charge_id a payments.charge.* event carries): the delivery that recorded that charge plus any refund/dispute against it \u2014 usually one row, so ONE detail read (GET /v1/payments/webhook-events/{eventId}) fetches the verified payload. Rows received before 2026-09-19 carry no charge id." },
+        provider_evt_id: { type: "string", maxLength: 200, description: "Exact match on the provider's own event id (the provider_evt_id every row shows)." },
         since: { type: "string", description: "ISO-8601 lower bound on received_at." },
         cursor: { type: "string", description: "Opaque keyset cursor from a prior page (next_cursor)." },
         limit: { type: "number", default: 50, description: "Page size, clamped 1..100." }
@@ -5254,7 +5432,7 @@ var TOOLS = [
     },
     method: "GET",
     path: "/v1/payments/webhook-events",
-    queryArgs: ["provider", "event_type", "outcome", "environment", "since", "cursor", "limit"]
+    queryArgs: ["provider", "event_type", "outcome", "environment", "provider_charge_id", "provider_evt_id", "since", "cursor", "limit"]
   },
   {
     name: "mcp_get_signing_secret",
@@ -5769,6 +5947,10 @@ function partitionConfigChanges(feature, changes, patterns) {
   for (const c of changes) (isIgnored(`config:${feature}.${c.path}`, patterns) ? ignored : kept).push(c);
   return { kept, ignored };
 }
+function unstoredSecretVerdict(opts) {
+  if (opts.ignored) return "ignored";
+  return opts.strict ? "drift" : "informational";
+}
 function driftExitCode(r) {
   if (r.errors > 0) return 2;
   return r.drift > 0 ? 1 : 0;
@@ -5825,14 +6007,15 @@ function secretsChecks(refs, stored) {
   }
   return out;
 }
-var MOCK_PROVIDER_NOTE = "notifications provider is 'mock': sends succeed and are recorded, but NO email leaves vxil (sign-in codes, magic links and password resets are silently swallowed). Store your provider key (`vxil secrets set notifications/resend_api_key`) and set provider: 'resend' + resendApiKeyRef in your notifications config before you rely on delivery";
+var MOCK_PROVIDER_NOTE = "notifications provider is 'mock': sends succeed and are recorded, but NO email leaves vxil (sign-in codes, magic links and password resets are silently swallowed). Store your provider key (`vxil secrets set notifications/resend_api_key`) and set provider: 'resend' + resendApiKeyRef in your notifications config before you rely on delivery (or, for Amazon SES: store notifications/ses_access_key_id + notifications/ses_secret_access_key and set provider: 'ses' + ses: { region, accessKeyIdRef, secretAccessKeyRef })";
 function notificationsProviderChecks(manifest) {
   if (!manifest || manifest.enabled === false) return [];
   if (manifest.provider !== "mock") {
+    const region = manifest.provider === "ses" && manifest.ses?.region ? ` (${manifest.ses.region})` : "";
     return [{
       name: "notifications provider",
       ok: true,
-      detail: `${String(manifest.provider ?? "resend")}${manifest.fromEmail ? ` \xB7 from ${manifest.fromEmail}` : ""}`
+      detail: `${String(manifest.provider ?? "resend")}${region}${manifest.fromEmail ? ` \xB7 from ${manifest.fromEmail}` : ""}`
     }];
   }
   return [{ name: "notifications provider", ok: true, warn: true, detail: MOCK_PROVIDER_NOTE }];
@@ -5933,7 +6116,7 @@ function errText(r) {
   const e = r.json.error;
   return e ? `${e.code ?? r.status}${e.message ? ` \u2014 ${e.message}` : ""}` : `${r.status}`;
 }
-async function linkViaSession(dash, cookie, slug, keyName) {
+async function findTenantViaSession(dash, cookie, slug) {
   const list = await dash("GET", "/dashboard/tenants", void 0, cookie);
   if (list.status === 401) return { unauthorized: true };
   if (list.status !== 200) throw new Error(`could not list projects (${errText(list)})`);
@@ -5944,6 +6127,12 @@ async function linkViaSession(dash, cookie, slug, keyName) {
       `no project '${slug}' on this account \u2014 run \`vxil quickstart\`, or ask an admin to add you as a member`
     );
   }
+  return { tenant: t };
+}
+async function linkViaSession(dash, cookie, slug, keyName) {
+  const found = await findTenantViaSession(dash, cookie, slug);
+  if ("unauthorized" in found) return found;
+  const t = found.tenant;
   const mint = await dash("POST", `/dashboard/tenants/${t.id}/api-keys`, { name: keyName }, cookie);
   if (mint.status === 401) return { unauthorized: true };
   if (mint.status !== 201 && mint.status !== 200) {
@@ -5983,6 +6172,164 @@ async function linkViaDeviceFlow(dash, slug, io) {
   }
   throw new Error("link timed out waiting for browser approval \u2014 run `vxil link <slug>` again");
 }
+async function linkViaStoredKey(api, slug, storedKey) {
+  let res;
+  try {
+    res = await api("GET", "/v1/features");
+  } catch (e2) {
+    return { invalid: `could not reach the edge (${e2.message})` };
+  }
+  if (res.status === 200) {
+    const tenantId = res.body.meta?.tenant_id;
+    return { result: { slug, tenant_id: tenantId && tenantId.length ? tenantId : "(unknown)", api_key: storedKey } };
+  }
+  const e = res.body.error;
+  return { invalid: `${e?.code ?? res.status}${e?.message ? ` \u2014 ${e.message}` : ""}` };
+}
+
+// src/keys.ts
+var MINTABLE_SCOPES = KNOWN_SCOPES.filter((s) => s !== "admin");
+function data2(r) {
+  return r.json.data ?? r.json;
+}
+function errText2(r) {
+  const e = r.json.error;
+  if (!e) return `${r.status}`;
+  return `${e.code ?? r.status}${e.message ? ` \u2014 ${e.message}` : ""}${e.hint ? `
+hint: ${e.hint}` : ""}`;
+}
+function parseScopes(raw) {
+  const list = (raw ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (!list.length) {
+    return { error: `--scopes is required \u2014 a comma-separated list of scopes, e.g. --scopes cms:read,cms:write
+valid scopes: ${MINTABLE_SCOPES.join(", ")}` };
+  }
+  const scopes = [...new Set(list)];
+  const god = scopes.filter((s) => s === "admin" || s === "*");
+  if (god.length) {
+    return { error: `'${god.join("', '")}' cannot be minted here (admin-class keys are operator-provisioned only) \u2014 name the feature scopes this key needs, e.g. --scopes cms:read,files:write` };
+  }
+  const unknown = scopes.filter((s) => !MINTABLE_SCOPES.includes(s));
+  if (unknown.length) {
+    return { error: `unknown scope${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}
+valid scopes: ${MINTABLE_SCOPES.join(", ")}` };
+  }
+  return { scopes };
+}
+function parseKeyEnv(raw) {
+  if (raw === void 0) return { env: "live" };
+  if (raw === "live" || raw === "test") return { env: raw };
+  return { error: `--env must be 'live' or 'test' (got '${raw}') \u2014 this is the key's env prefix, not the project's environment label` };
+}
+function parseKeyName(raw) {
+  const name = (raw ?? "").trim();
+  if (!name) return { error: "--name is required \u2014 a label for this key, e.g. --name web-worker" };
+  if (name.length > 100) return { error: `--name is at most 100 characters (got ${name.length})` };
+  return { name };
+}
+async function mintKeyViaSession(dash, cookie, tenantId, req) {
+  const r = await dash(
+    "POST",
+    `/dashboard/tenants/${tenantId}/api-keys`,
+    { name: req.name, scopes: req.scopes, env: req.env },
+    cookie
+  );
+  if (r.status === 401) return { unauthorized: true };
+  if (r.status !== 201 && r.status !== 200) {
+    throw new Error(`could not mint the key (${errText2(r)})`);
+  }
+  const d = data2(r);
+  if (!d.api_key || !d.key_id) throw new Error("mint returned no api_key");
+  return {
+    result: {
+      key_id: d.key_id,
+      api_key: d.api_key,
+      scopes: d.scopes ?? req.scopes,
+      env: d.env ?? req.env,
+      name: req.name,
+      ...d.prefix ? { prefix: d.prefix } : {}
+    }
+  };
+}
+async function listKeysViaSession(dash, cookie, tenantId) {
+  const r = await dash("GET", `/dashboard/tenants/${tenantId}/api-keys`, void 0, cookie);
+  if (r.status === 401) return { unauthorized: true };
+  if (r.status !== 200) throw new Error(`could not list keys (${errText2(r)})`);
+  return { keys: data2(r).keys ?? [] };
+}
+async function revokeKeyViaSession(dash, cookie, tenantId, keyId) {
+  const r = await dash("DELETE", `/dashboard/tenants/${tenantId}/api-keys/${encodeURIComponent(keyId)}`, void 0, cookie);
+  if (r.status === 401) return { unauthorized: true };
+  if (r.status === 404) throw new Error(`no active key '${keyId}' on this project (already revoked, or not this project's) \u2014 \`vxil keys list\` shows the ids`);
+  if (r.status !== 200) throw new Error(`could not revoke the key (${errText2(r)})`);
+  return { revoked: true };
+}
+function currentKeyIdFor(keys, apiKey) {
+  if (!apiKey) return void 0;
+  const hit = keys.find((k) => typeof k.prefix === "string" && k.prefix.length >= 12 && apiKey.startsWith(k.prefix));
+  return hit?.key_id;
+}
+function revokeGuard(args) {
+  const row2 = args.keys.find((k) => k.key_id === args.keyId);
+  const isCurrent = currentKeyIdFor(args.keys, args.currentApiKey) === args.keyId;
+  if (isCurrent && !args.yes) {
+    return {
+      refuse: `'${args.keyId}' is the key this CLI is using for '${args.slug}' (the one in ~/.vxil/credentials.json / VXIL_API_KEY) \u2014 revoking it breaks every vxil verb on this project until you re-link. Pass --yes to revoke it anyway, then run \`vxil link ${args.slug} --mint\` (or \`vxil keys mint \u2026 --store\`) for a replacement.`
+    };
+  }
+  return { ok: true, row: row2, isCurrent };
+}
+function mintStdout(r, json2) {
+  return json2 ? JSON.stringify({ api_key: r.api_key, key_id: r.key_id, scopes: r.scopes }) : r.api_key;
+}
+function mintNotices(r, json2, opts = {}) {
+  const storage = opts.stored ? "It was stored as this project's CLI key (~/.vxil/credentials.json), replacing the previous one." : "It was NOT stored on this machine (pass --store to make it this project's CLI key).";
+  const storeWarn = opts.storeError !== void 0 ? [`vxil: warning \u2014 --store failed: could not write ~/.vxil/credentials.json (${opts.storeError}). The key (${r.key_id}) was minted and is printed above \u2014 copy it from there now; this machine's CLI key is unchanged. To discard it instead: \`vxil keys revoke ${r.key_id}\`.`] : [];
+  if (json2) {
+    return [
+      `minted '${r.name}' (${r.key_id}, env ${r.env}) \u2014 shown ONCE; it is not retrievable again. ${storage} Revoke with \`vxil keys revoke ${r.key_id}\`.`,
+      ...storeWarn
+    ];
+  }
+  return [
+    `\u2713 minted '${r.name}' (${r.key_id}, env ${r.env}) with scopes [${r.scopes.join(", ")}]`,
+    `This key is shown ONCE and is not retrievable again \u2014 copy it now. ${storage} Revoke with \`vxil keys revoke ${r.key_id}\`.`,
+    ...storeWarn
+  ];
+}
+function when(iso) {
+  if (!iso) return "\u2014";
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? String(iso) : d.toISOString().slice(0, 16).replace("T", " ");
+}
+function renderKeyTable(keys, currentKeyId) {
+  if (!keys.length) return ["(no keys on this project)"];
+  const rows = keys.map((k) => ({
+    mark: k.key_id === currentKeyId ? "*" : " ",
+    id: k.key_id,
+    name: k.name ?? "",
+    env: k.env ?? "",
+    status: k.revoked_at ? "revoked" : k.expires_at && new Date(k.expires_at).getTime() < Date.now() ? "expired" : "active",
+    created: when(k.created_at),
+    used: when(k.last_used_at),
+    scopes: (k.scopes ?? []).join(",")
+  }));
+  const w = (f, head2) => Math.max(head2.length, ...rows.map((r) => r[f].length));
+  const cols = [
+    ["id", "KEY_ID"],
+    ["name", "NAME"],
+    ["env", "ENV"],
+    ["status", "STATUS"],
+    ["created", "CREATED"],
+    ["used", "LAST_USED"]
+  ];
+  const line = (r, pad) => `${r.mark ?? " "} ${cols.map(([f, h]) => pad ? r[f].padEnd(w(f, h)) : r[f]).join("  ")}  ${r.scopes}`;
+  const head = { mark: " ", scopes: "SCOPES" };
+  for (const [f, h] of cols) head[f] = h;
+  const out = [line(head, true), ...rows.map((r) => line(r, true))];
+  if (currentKeyId) out.push("* = the key this CLI is using for this project");
+  return out;
+}
 
 // src/secretsValue.ts
 var ARGV_SECRET_WARNING = `WARNING: --value <v> puts the secret on the command line \u2014 it lands in shell history and is
@@ -7028,7 +7375,7 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
             result.skipped++;
             continue;
           }
-          const data2 = {};
+          const data3 = {};
           let rowErr;
           for (const f of mapping.fields) {
             const raw = row2[f.source];
@@ -7044,11 +7391,11 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
                 unresolvedOptional.set(f.target, (unresolvedOptional.get(f.target) ?? 0) + 1);
                 continue;
               }
-              data2[f.target] = mapped;
+              data3[f.target] = mapped;
               continue;
             }
             if (f.storageObject) {
-              data2[f.target] = resolveObjectId(String(raw), filesMaps) ?? String(raw);
+              data3[f.target] = resolveObjectId(String(raw), filesMaps) ?? String(raw);
               continue;
             }
             const coerced = coerceValue(raw, f);
@@ -7056,7 +7403,7 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
               rowErr = coerced.err;
               break;
             }
-            data2[f.target] = coerced.value;
+            data3[f.target] = coerced.value;
           }
           if (rowErr) {
             result.skipped++;
@@ -7065,8 +7412,8 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
             continue;
           }
           if (deps.dryRun) continue;
-          if (dedupeField && data2[dedupeField.target] !== void 0) {
-            const filter = encodeURIComponent(JSON.stringify({ [dedupeField.target]: data2[dedupeField.target] }));
+          if (dedupeField && data3[dedupeField.target] !== void 0) {
+            const filter = encodeURIComponent(JSON.stringify({ [dedupeField.target]: data3[dedupeField.target] }));
             const q = await deps.api("GET", `/v1/cms/items/${enc}?filter=${filter}&limit=1`);
             const items = q.body.data?.items ?? [];
             if (q.status === 200 && items.length > 0 && typeof items[0].item_id === "string") {
@@ -7075,7 +7422,7 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
               continue;
             }
           }
-          const res = await deps.api("POST", `/v1/cms/items/${enc}`, { data: data2, status: itemStatus });
+          const res = await deps.api("POST", `/v1/cms/items/${enc}`, { data: data3, status: itemStatus });
           if (res.status === 201 || res.status === 200) {
             const itemId = res.body.data?.item_id;
             if (typeof itemId !== "string") {
@@ -9367,8 +9714,8 @@ export default defineConfig({
     ],
     "hasFunctions": false,
     "byoKeys": [],
-    "configSrc": "import { defineConfig } from '@vxil/config';\n\n// \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// \"Sales CRM\" \u2014 companies \u2192 contacts \u2192 a deal pipeline, declared end-to-end in\n// ONE typed file. A BLUEPRINT composing shipped building blocks \u2014\n//   \u2022 cms           \u2192 companies \u2192 contacts \u2192 deals (resolved by relation), with a\n//                     Lane-A STATE MACHINE guarding the pipeline stage\n//   \u2022 activity-feed \u2192 the per-deal timeline (calls, emails, notes) + the rep bell\n//   \u2022 notifications \u2192 the email channel (mock provider until you bring a key)\n// Everything here is DATA the tenant owns and edits after `vxil init`.\n// \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport default defineConfig({\n  env: 'staging',\n\n  features: {\n    cms: {\n      hooks: {\n        // THE PIPELINE STATE MACHINE (Lane-A validate \u2014 runs inside the write\n        // transaction): a deal may only move lead \u2192 qualified \u2192 proposal \u2192\n        // won | lost. Any other transition is a clean 422, rolled back\n        // atomically. Cross-row work (e.g. \"email the rep on won\") belongs in\n        // a function or webhook, never in a hook \u2014 hooks are pure row logic.\n        deal_stage_machine: {\n          collection: 'deals',\n          event: 'beforeUpdate',\n          kind: 'validate',\n          expr:\n            'item.stage == before.stage' +\n            \" || (before.stage == 'lead' && item.stage == 'qualified')\" +\n            \" || (before.stage == 'qualified' && item.stage == 'proposal')\" +\n            \" || (before.stage == 'proposal' && (item.stage == 'won' || item.stage == 'lost'))\",\n          message: 'illegal pipeline transition (lead \u2192 qualified \u2192 proposal \u2192 won|lost)',\n        },\n      },\n    },\n\n    // The per-deal timeline. The DEFAULT feed groups already fit a CRM:\n    // `timeline` (flat, chronological) keyed per deal \u2014 ingest with\n    //   POST /v1/feeds/timeline/{deal_item_id}/activities { actor, verb, object }\n    // \u2014 and the aggregated `notification` bell per rep.\n    'activity-feed': {},\n\n    // Email channel. `mock` is the zero-config staging provider; for real\n    // sends switch to provider: 'resend' and set `resendApiKeyRef`.\n    notifications: { provider: 'mock', fromEmail: 'noreply@crm.app' },\n  },\n\n  // \u2500\u2500 Schema-as-code: the cms collections (\u22648 index slots each: s1\u2013s4/n1\u2013n2/t1\u2013t2) \u2500\u2500\n  cms: {\n    collections: {\n      companies: {\n        singular: 'company',\n        fields: {\n          name: { type: 'string', required: true, indexSlot: 's1' },\n          // Want `domain` unique? Declare `unique: true` right here \u2014 value\n          // uniqueness (cms.md \xA79.3) is carried by `vxil push` on collection/field\n          // CREATE. Flipping it on an ALREADY-pushed field is an in-place alter\n          // via the dashboard field designer or a same-name+type re-add through\n          // POST /v1/cms/collections/companies/fields (push diffs name+type only).\n          domain: { type: 'string', indexSlot: 's2' },\n          industry: { type: 'string', indexSlot: 's3' },\n          employees: { type: 'int', indexSlot: 'n1' },\n        },\n      },\n      contacts: {\n        singular: 'contact',\n        fields: {\n          name: { type: 'string', required: true, indexSlot: 's1' },\n          email: { type: 'string', indexSlot: 's2' }, // unique \u21D2 see the `domain` note above\n          company: { type: 'relation', relationTo: 'companies', indexSlot: 's3' },\n          last_touch: { type: 'datetime', indexSlot: 't1' },\n          phone: { type: 'string' }, // stored, not indexed\n        },\n      },\n      deals: {\n        singular: 'deal',\n        fields: {\n          title: { type: 'string', required: true, indexSlot: 's1' },\n          // The pipeline stage: enum-validated on every write; the Lane-A hook\n          // above additionally locks the TRANSITIONS between stages.\n          stage: {\n            type: 'string',\n            required: true,\n            indexSlot: 's2',\n            validation: { enum: ['lead', 'qualified', 'proposal', 'won', 'lost'] },\n          },\n          company: { type: 'relation', relationTo: 'companies', indexSlot: 's3' },\n          owner: { type: 'string', indexSlot: 's4' }, // the rep working the deal\n          amount_cents: { type: 'int', indexSlot: 'n1', validation: { min: 0 } },\n          close_date: { type: 'datetime', indexSlot: 't1' },\n          notes: { type: 'text' },\n        },\n      },\n    },\n  },\n\n  // `vxil seed` POSTs each item verbatim \u2014 item_ids are assigned at runtime, so\n  // the `company` relation on contacts/deals is left unset here; link records\n  // after seeding (PATCH the created items with the company's item_id).\n  seed: {\n    cms: [\n      {\n        collection: 'companies',\n        items: [{ name: 'Acme Corp', domain: 'acme.com', industry: 'Manufacturing', employees: 250 }],\n      },\n      {\n        collection: 'contacts',\n        items: [{ name: 'Jane Porter', email: 'jane@acme.com', phone: '+1 555 0100' }],\n      },\n      {\n        collection: 'deals',\n        items: [\n          { title: 'Acme starter plan', stage: 'lead', owner: 'jordan', amount_cents: 480_000 },\n          { title: 'Acme enterprise rollout', stage: 'proposal', owner: 'sam', amount_cents: 12_000_000 },\n        ],\n      },\n    ],\n  },\n});\n",
-    "readme": '# Sales CRM template\n\nA sales CRM backend \u2014 companies, contacts, and a deal pipeline \u2014 declared end-to-end in one typed\n`vxil.config.ts`. Stage transitions are guarded by a Lane-A state machine that runs inside the write\ntransaction, every deal gets an activity timeline via `activity-feed`, and `notifications` provides\nthe email channel (mock provider until you bring your own key).\n\n**What it provisions:**\n- `companies` \u2014 name, domain, industry, employee count (slot-bound for range/sort). To make\n  `domain`/`email` unique, declare `unique: true` on the field \u2014 carried by `vxil push` on create\n  (`cms.md` \xA79.3); flipping it on an already-pushed field is a dashboard/REST in-place alter.\n- `contacts` \u2014 name, email, `company` relation, `last_touch` datetime.\n- `deals` \u2014 title, enum-validated `stage`, `company` relation, `owner` (the rep), `amount_cents`,\n  `close_date`. A Lane-A `validate` hook locks the pipeline: `lead \u2192 qualified \u2192 proposal \u2192 won|lost`.\n- Features: `cms` + `activity-feed` (per-deal timelines + the rep notification bell, default feed\n  groups) + `notifications` (mock provider; swap to `resend` + `resendApiKeyRef` for real sends).\n\n**Apply it:**\n\n```bash\nvxil init --template crm\nvxil quickstart   # or `vxil link` to an existing tenant\nvxil push\nvxil gen          # then optionally: `vxil seed` (1 company, 1 contact, 2 deals)\n```\n\n**What to learn from this:**\n1. **The pipeline state machine** \u2014 a `validate` hook on `beforeUpdate` compares `item.stage` to\n   `before.stage` and rejects any illegal transition with a clean 422, atomically in the same write.\n   Field-level `validation.enum` handles membership; the hook handles the *transitions*.\n2. **Pipeline value by stage** \u2014 one bounded group-by aggregate (`stage` is slot-bound, `amount_cents`\n   is an `n*` slot), no SQL:\n   ```bash\n   curl -X POST https://api.vxil.com/v1/cms/items/deals/aggregate \\\n     -H "Authorization: Bearer $VXIL_KEY" -H \'content-type: application/json\' \\\n     -d \'{"aggregates":[{"fn":"sum","field":"amount_cents","as":"pipeline_cents"},{"fn":"count"}],"groupBy":["stage"]}\'\n   # \u2192 { "groups": [{ "key": {"stage":"proposal"}, "count": 1, "pipeline_cents": 12000000 }, \u2026], "scanned": \u2026 }\n   ```\n3. **The deal timeline** \u2014 each call/email/note is one ingest to the default `timeline` feed group:\n   `POST /v1/feeds/timeline/{deal_item_id}/activities` with `{ actor, verb, object }` (idempotent on\n   `foreign_id` + `time`); read it back with keyset cursors, or typed via `vx.from(\'deals\').query(\u2026)`\n   for the pipeline board itself.\n\n**Go deeper:** vxil.com/docs/guide/07-validation-and-hooks (hooks), vxil.com/docs/api (aggregates), vxil.com/docs/guide/06-feature-catalog (activity-feed,\nnotifications), and `examples/ecommerce/` for a bigger state machine in the wild.\n\n**Own the shape.** The config is yours after `init` \u2014 nothing is locked.\n',
+    "configSrc": "import { defineConfig } from '@vxil/config';\n\n// \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// \"Sales CRM\" \u2014 companies \u2192 contacts \u2192 a deal pipeline, declared end-to-end in\n// ONE typed file. A BLUEPRINT composing shipped building blocks \u2014\n//   \u2022 cms           \u2192 companies \u2192 contacts \u2192 deals (resolved by relation), with a\n//                     Lane-A STATE MACHINE guarding the pipeline stage\n//   \u2022 activity-feed \u2192 the per-deal timeline (calls, emails, notes) + the rep bell\n//   \u2022 notifications \u2192 the email channel (mock provider until you bring a key)\n// Everything here is DATA the tenant owns and edits after `vxil init`.\n// \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport default defineConfig({\n  env: 'staging',\n\n  features: {\n    cms: {\n      hooks: {\n        // THE PIPELINE STATE MACHINE (Lane-A validate \u2014 runs inside the write\n        // transaction): a deal may only move lead \u2192 qualified \u2192 proposal \u2192\n        // won | lost. Any other transition is a clean 422, rolled back\n        // atomically. Cross-row work (e.g. \"email the rep on won\") belongs in\n        // a function or webhook, never in a hook \u2014 hooks are pure row logic.\n        deal_stage_machine: {\n          collection: 'deals',\n          event: 'beforeUpdate',\n          kind: 'validate',\n          expr:\n            'item.stage == before.stage' +\n            \" || (before.stage == 'lead' && item.stage == 'qualified')\" +\n            \" || (before.stage == 'qualified' && item.stage == 'proposal')\" +\n            \" || (before.stage == 'proposal' && (item.stage == 'won' || item.stage == 'lost'))\",\n          message: 'illegal pipeline transition (lead \u2192 qualified \u2192 proposal \u2192 won|lost)',\n        },\n      },\n    },\n\n    // The per-deal timeline. The DEFAULT feed groups already fit a CRM:\n    // `timeline` (flat, chronological) keyed per deal \u2014 ingest with\n    //   POST /v1/feeds/timeline/{deal_item_id}/activities { actor, verb, object }\n    // \u2014 and the aggregated `notification` bell per rep.\n    'activity-feed': {},\n\n    // Email channel. `mock` is the zero-config staging provider; for real\n    // sends switch to provider: 'resend' and set `resendApiKeyRef`, or to\n    // provider: 'ses' with `ses: { region, accessKeyIdRef, secretAccessKeyRef }`.\n    notifications: { provider: 'mock', fromEmail: 'noreply@crm.app' },\n  },\n\n  // \u2500\u2500 Schema-as-code: the cms collections (\u22648 index slots each: s1\u2013s4/n1\u2013n2/t1\u2013t2) \u2500\u2500\n  cms: {\n    collections: {\n      companies: {\n        singular: 'company',\n        fields: {\n          name: { type: 'string', required: true, indexSlot: 's1' },\n          // Want `domain` unique? Declare `unique: true` right here \u2014 value\n          // uniqueness (cms.md \xA79.3) is carried by `vxil push` on collection/field\n          // CREATE. Flipping it on an ALREADY-pushed field is an in-place alter\n          // via the dashboard field designer or a same-name+type re-add through\n          // POST /v1/cms/collections/companies/fields (push diffs name+type only).\n          domain: { type: 'string', indexSlot: 's2' },\n          industry: { type: 'string', indexSlot: 's3' },\n          employees: { type: 'int', indexSlot: 'n1' },\n        },\n      },\n      contacts: {\n        singular: 'contact',\n        fields: {\n          name: { type: 'string', required: true, indexSlot: 's1' },\n          email: { type: 'string', indexSlot: 's2' }, // unique \u21D2 see the `domain` note above\n          company: { type: 'relation', relationTo: 'companies', indexSlot: 's3' },\n          last_touch: { type: 'datetime', indexSlot: 't1' },\n          phone: { type: 'string' }, // stored, not indexed\n        },\n      },\n      deals: {\n        singular: 'deal',\n        fields: {\n          title: { type: 'string', required: true, indexSlot: 's1' },\n          // The pipeline stage: enum-validated on every write; the Lane-A hook\n          // above additionally locks the TRANSITIONS between stages.\n          stage: {\n            type: 'string',\n            required: true,\n            indexSlot: 's2',\n            validation: { enum: ['lead', 'qualified', 'proposal', 'won', 'lost'] },\n          },\n          company: { type: 'relation', relationTo: 'companies', indexSlot: 's3' },\n          owner: { type: 'string', indexSlot: 's4' }, // the rep working the deal\n          amount_cents: { type: 'int', indexSlot: 'n1', validation: { min: 0 } },\n          close_date: { type: 'datetime', indexSlot: 't1' },\n          notes: { type: 'text' },\n        },\n      },\n    },\n  },\n\n  // `vxil seed` POSTs each item verbatim \u2014 item_ids are assigned at runtime, so\n  // the `company` relation on contacts/deals is left unset here; link records\n  // after seeding (PATCH the created items with the company's item_id).\n  seed: {\n    cms: [\n      {\n        collection: 'companies',\n        items: [{ name: 'Acme Corp', domain: 'acme.com', industry: 'Manufacturing', employees: 250 }],\n      },\n      {\n        collection: 'contacts',\n        items: [{ name: 'Jane Porter', email: 'jane@acme.com', phone: '+1 555 0100' }],\n      },\n      {\n        collection: 'deals',\n        items: [\n          { title: 'Acme starter plan', stage: 'lead', owner: 'jordan', amount_cents: 480_000 },\n          { title: 'Acme enterprise rollout', stage: 'proposal', owner: 'sam', amount_cents: 12_000_000 },\n        ],\n      },\n    ],\n  },\n});\n",
+    "readme": '# Sales CRM template\n\nA sales CRM backend \u2014 companies, contacts, and a deal pipeline \u2014 declared end-to-end in one typed\n`vxil.config.ts`. Stage transitions are guarded by a Lane-A state machine that runs inside the write\ntransaction, every deal gets an activity timeline via `activity-feed`, and `notifications` provides\nthe email channel (mock provider until you bring your own key).\n\n**What it provisions:**\n- `companies` \u2014 name, domain, industry, employee count (slot-bound for range/sort). To make\n  `domain`/`email` unique, declare `unique: true` on the field \u2014 carried by `vxil push` on create\n  (`cms.md` \xA79.3); flipping it on an already-pushed field is a dashboard/REST in-place alter.\n- `contacts` \u2014 name, email, `company` relation, `last_touch` datetime.\n- `deals` \u2014 title, enum-validated `stage`, `company` relation, `owner` (the rep), `amount_cents`,\n  `close_date`. A Lane-A `validate` hook locks the pipeline: `lead \u2192 qualified \u2192 proposal \u2192 won|lost`.\n- Features: `cms` + `activity-feed` (per-deal timelines + the rep notification bell, default feed\n  groups) + `notifications` (mock provider; swap to `resend` + `resendApiKeyRef`, or `ses` +\n  `ses: { region, accessKeyIdRef, secretAccessKeyRef }`, for real sends).\n\n**Apply it:**\n\n```bash\nvxil init --template crm\nvxil quickstart   # or `vxil link` to an existing tenant\nvxil push\nvxil gen          # then optionally: `vxil seed` (1 company, 1 contact, 2 deals)\n```\n\n**What to learn from this:**\n1. **The pipeline state machine** \u2014 a `validate` hook on `beforeUpdate` compares `item.stage` to\n   `before.stage` and rejects any illegal transition with a clean 422, atomically in the same write.\n   Field-level `validation.enum` handles membership; the hook handles the *transitions*.\n2. **Pipeline value by stage** \u2014 one bounded group-by aggregate (`stage` is slot-bound, `amount_cents`\n   is an `n*` slot), no SQL:\n   ```bash\n   curl -X POST https://api.vxil.com/v1/cms/items/deals/aggregate \\\n     -H "Authorization: Bearer $VXIL_KEY" -H \'content-type: application/json\' \\\n     -d \'{"aggregates":[{"fn":"sum","field":"amount_cents","as":"pipeline_cents"},{"fn":"count"}],"groupBy":["stage"]}\'\n   # \u2192 { "groups": [{ "key": {"stage":"proposal"}, "count": 1, "pipeline_cents": 12000000 }, \u2026], "scanned": \u2026 }\n   ```\n3. **The deal timeline** \u2014 each call/email/note is one ingest to the default `timeline` feed group:\n   `POST /v1/feeds/timeline/{deal_item_id}/activities` with `{ actor, verb, object }` (idempotent on\n   `foreign_id` + `time`); read it back with keyset cursors, or typed via `vx.from(\'deals\').query(\u2026)`\n   for the pipeline board itself.\n\n**Go deeper:** vxil.com/docs/guide/07-validation-and-hooks (hooks), vxil.com/docs/api (aggregates), vxil.com/docs/guide/06-feature-catalog (activity-feed,\nnotifications), and `examples/ecommerce/` for a bigger state machine in the wild.\n\n**Own the shape.** The config is yours after `init` \u2014 nothing is locked.\n',
     "functions": {}
   },
   {
@@ -11006,7 +11353,7 @@ function printEnvelope({ status, body }) {
 async function prompt(q, opts = {}) {
   const stdin = process.stdin;
   if (opts.hidden && stdin.isTTY && stdin.setRawMode) {
-    process.stdout.write(q);
+    process.stderr.write(q);
     return await new Promise((resolve8) => {
       stdin.setRawMode(true);
       stdin.resume();
@@ -11017,11 +11364,11 @@ async function prompt(q, opts = {}) {
           stdin.setRawMode(false);
           stdin.pause();
           stdin.removeListener("data", onData);
-          process.stdout.write("\n");
+          process.stderr.write("\n");
           resolve8(val);
         } else if (ch === "") {
           stdin.setRawMode(false);
-          process.stdout.write("\n");
+          process.stderr.write("\n");
           process.exit(130);
         } else if (ch === "\x7F" || ch === "\b") {
           val = val.slice(0, -1);
@@ -11032,7 +11379,7 @@ async function prompt(q, opts = {}) {
       stdin.on("data", onData);
     });
   }
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
   return await new Promise((res) => rl.question(q, (a) => {
     rl.close();
     res(a.trim());
@@ -11122,6 +11469,39 @@ async function resolveDashCookie(dash) {
   if (!cookie) fail("login succeeded but returned no session cookie");
   return cookie;
 }
+async function interactiveLogin(dash) {
+  const email = flag("email") || process.env.VXIL_DEV_EMAIL || void 0;
+  const password = flag("password") || process.env.VXIL_DEV_PASSWORD || void 0;
+  const mustPrompt = !email || !password;
+  if (mustPrompt && (!process.stdin.isTTY || !process.stdout.isTTY || jsonOut)) {
+    fail("need a dashboard session \u2014 run `vxil login` first (or pass --email/--password, or set VXIL_DEV_EMAIL/VXIL_DEV_PASSWORD); a non-interactive run cannot prompt");
+  }
+  const e = email ?? await prompt("dashboard email: ");
+  const p = password ?? await prompt("password: ", { hidden: true });
+  const r = await dash("POST", "/dashboard/login", { email: e, password: p });
+  if (r.status !== 200) fail(`login failed: ${r.status} ${JSON.stringify(r.json).slice(0, 160)}`);
+  const cookie = r.cookie?.split(";")[0];
+  if (!cookie) fail("login succeeded but returned no session cookie");
+  if (mustPrompt) {
+    const creds = loadCredentials();
+    creds.session = cookie;
+    saveCredentials(creds);
+    console.error("\u2713 signed in \u2014 session stored in ~/.vxil/credentials.json");
+  }
+  return cookie;
+}
+async function withDashSession(dash, run) {
+  const creds = loadCredentials();
+  if (creds.session) {
+    const r2 = await run(creds.session);
+    if (!("unauthorized" in r2)) return r2;
+    console.error("dashboard session expired \u2014 sign in again\u2026");
+  }
+  const cookie = await interactiveLogin(dash);
+  const r = await run(cookie);
+  if ("unauthorized" in r) fail("the dashboard rejected the fresh session \u2014 run `vxil login` and retry");
+  return r;
+}
 function requireApi(sel = "prod", opts = {}) {
   const t = resolveTargetOrFail(sel, opts.exitCode ?? 1);
   if (!t.apiKey) fail(noKeyMessage(t), opts.exitCode ?? 1);
@@ -11211,6 +11591,22 @@ async function runApply(apply, sel = "prod", opts = {}) {
     process.exit(2);
   }
   const cwd = process.cwd();
+  const declaredFns = Object.keys(cfg.functions ?? {});
+  const skipFunctions = hasFlag("skip-functions");
+  if (declaredFns.length && !skipFunctions && !gate) {
+    const ent = await probeFunctionsEntitlement(api, declaredFns[0]);
+    if (!ent.entitled) {
+      const msg = formatFunctionsPreflight(ent, {
+        declared: declaredFns.length,
+        baseUrl: target.baseUrl,
+        verb: apply ? "push" : "plan",
+        ...target.tenantId ? { tenantId: target.tenantId } : {}
+      });
+      if (apply) fail(`${msg}
+(nothing was pushed)`);
+      console.error(`vxil: warning \u2014 ${msg}`);
+    }
+  }
   const notCompared = (u, hint) => {
     console.log(formatNotCompared(u, hint));
     if (gate) report.errors++;
@@ -11281,6 +11677,11 @@ ${r.feature} (remote v${r.version}):`);
       }
       return;
     }
+    if (skipFunctions) {
+      console.log(`
+functions: skipped (--skip-functions) \u2014 ${declaredFns.length} declared function(s) not ${apply ? "deployed" : "compared"}`);
+      return;
+    }
     const r = await planFunctions({ api, functions: cfg.functions, cwd, apply });
     console.log("\nfunctions:");
     if (r.remoteUnavailable) {
@@ -11289,6 +11690,9 @@ ${r.feature} (remote v${r.version}):`);
     }
     console.log(formatFnChanges(r.changes));
     if (apply && r.applied) console.log(`  \u2713 deployed ${r.applied} function(s)`);
+    for (const w of r.warnings ?? []) {
+      console.error(`  ! ${w.fn}: ${w.message}`);
+    }
     if (apply && r.cmsHookSubscriptions && (r.cmsHookSubscriptions.created || r.cmsHookSubscriptions.deleted)) {
       console.log(`  \u2713 cms-hook subscription reconciled (+${r.cmsHookSubscriptions.created} / -${r.cmsHookSubscriptions.deleted})`);
     }
@@ -11298,6 +11702,8 @@ ${r.feature} (remote v${r.version}):`);
     for (const c of r.changes) if (c.kind !== "unchanged") count(`function:${c.name}`);
     compared.functions += Object.keys(cfg.functions).length;
   });
+  const strictSecrets = hasFlag("strict-secrets");
+  const informationalKeys = [];
   if (!apply && (gate || explain)) {
     await runSection("secrets", async () => {
       const refs = collectSecretRefs(cfg);
@@ -11314,9 +11720,16 @@ ${r.feature} (remote v${r.version}):`);
       const cmp = compareSecretNames(refs, stored);
       if (!cmp.missing.length && !cmp.unreferenced.length) console.log(`  (in sync \u2014 ${cmp.present.length} ref(s), all stored)`);
       for (const m of cmp.missing) {
-        const ign = isIgnored(`secret:${m.name}`, ignore);
-        console.log(`  ${ign ? "\xB7" : "-"} secret:${m.name}${m.feature ? ` (${m.feature})` : ""} referenced at ${m.via} but NOT stored on the target` + (m.stored_elsewhere?.length ? ` (stored under ${m.stored_elsewhere.join(", ")} instead)` : "") + (ign ? " \u2014 ignored" : ""));
-        count(`secret:${m.name}`);
+        const key = `secret:${m.name}`;
+        const verdict = unstoredSecretVerdict({ strict: strictSecrets, ignored: isIgnored(key, ignore) });
+        const mark = verdict === "drift" ? "-" : "\xB7";
+        console.log(`  ${mark} ${key}${m.feature ? ` (${m.feature})` : ""} referenced at ${m.via} but NOT stored on the target` + (m.stored_elsewhere?.length ? ` (stored under ${m.stored_elsewhere.join(", ")} instead)` : "") + (verdict === "ignored" ? " \u2014 ignored" : verdict === "informational" ? " \u2014 informational (not counted; --strict-secrets counts it)" : ""));
+        if (verdict === "informational") {
+          report.informational = (report.informational ?? 0) + 1;
+          informationalKeys.push(key);
+        } else {
+          count(key);
+        }
       }
       for (const u of cmp.unreferenced) console.log(`  \xB7 ${u.feature}/${u.secret_name} stored but not referenced by this config (informational)`);
       if (cmp.missing.length) console.log("  note: a push with an unstored ref is a WARNING, never a 422 \u2014 set values after the push with `vxil secrets set <feature>/<name>`");
@@ -11367,14 +11780,19 @@ api state \u2014 ${self.target.tenantSlug ?? "(env key)"} vs ${other.target.tena
         exit_code: code,
         target: target.tenantSlug ?? null,
         env: target.envLabel,
-        ...report,
+        drift: report.drift,
+        ignored: report.ignored,
+        errors: report.errors,
+        informational: report.informational ?? 0,
         compared,
         ignored_keys: ignoredKeys,
+        informational_keys: informationalKeys,
+        strict_secrets: strictSecrets,
         ...opts.apiState ? { api_state: apiStateCounts } : {}
       }));
     } else {
       console.log(`
-vxil diff \u2192 ${report.drift} drift item(s), ${report.ignored} ignored, ${report.errors} error(s) \u2014 compared ${formatCompared(compared)} \u2014 exit ${code}`);
+vxil diff \u2192 ${report.drift} drift item(s), ${report.ignored} ignored, ${report.informational ?? 0} informational, ${report.errors} error(s) \u2014 compared ${formatCompared(compared)} \u2014 exit ${code}`);
     }
     process.exit(code);
   }
@@ -11382,7 +11800,7 @@ vxil diff \u2192 ${report.drift} drift item(s), ${report.ignored} ignored, ${rep
   if (apply && !hasFlag("no-gen")) await runGen(sel);
 }
 async function runServerApply(sel) {
-  const { api } = requireApi(sel, { write: "push --server" });
+  const { api, target } = requireApi(sel, { write: "push --server" });
   const resume = flag("resume");
   if (resume) {
     const done2 = await serverApply({ api, resume });
@@ -11394,8 +11812,26 @@ apply ${done2.apply_id}: ${done2.status}`);
     if (done2.status === "succeeded" && !hasFlag("no-gen")) await runGen(sel);
     return;
   }
-  const cfg = await loadVxilConfig();
+  const loaded = await loadVxilConfig();
   const cwd = process.cwd();
+  const { functions: declaredFns, ...rest2 } = loaded;
+  const cfg = hasFlag("skip-functions") ? rest2 : loaded;
+  const fnNames = Object.keys(cfg.functions ?? {});
+  if (hasFlag("skip-functions") && declaredFns && Object.keys(declaredFns).length) {
+    console.log(`functions: skipped (--skip-functions) \u2014 ${Object.keys(declaredFns).length} declared function(s) not deployed`);
+  }
+  if (fnNames.length) {
+    const ent = await probeFunctionsEntitlement(api, fnNames[0]);
+    if (!ent.entitled) {
+      fail(`${formatFunctionsPreflight(ent, {
+        declared: fnNames.length,
+        baseUrl: target.baseUrl,
+        verb: "push",
+        ...target.tenantId ? { tenantId: target.tenantId } : {}
+      })}
+(nothing was applied)`);
+    }
+  }
   const fnSources = {};
   for (const [name, def] of Object.entries(cfg.functions ?? {})) {
     fnSources[name] = (await bundleFunction(resolve7(cwd, def.entry), { projectRoot: cwd })).source;
@@ -11968,7 +12404,7 @@ try {
     }
     case "link": {
       const slug = positional(0)[0];
-      if (!slug) fail("usage: vxil link <slug> [--key <api_key>] [--tenant <id>] [--as dev|<target-name>] [--env <label>]");
+      if (!slug) fail("usage: vxil link <slug> [--key <api_key>] [--tenant <id>] [--as dev|<target-name>] [--env <label>] [--mint]");
       const base = process.env.VXIL_BASE_URL ?? DEFAULT_BASE;
       const directKey = flag("key");
       if (directKey) {
@@ -11977,8 +12413,19 @@ try {
         console.log(`\u2713 linked '${slug}' ${bound} (using provided --key)`);
         break;
       }
-      const dash = makeDash(dashboardBase(base));
       const creds = loadCredentials();
+      const stored = creds.keys?.[slug];
+      if (stored && !hasFlag("mint")) {
+        const r = await linkViaStoredKey(makeApi({ apiKey: stored, baseUrl: base }), slug, stored);
+        if ("result" in r) {
+          const tenantId = flag("tenant") ?? r.result.tenant_id;
+          const bound = persistLink(slug, tenantId, stored, base);
+          console.log(`\u2713 linked '${slug}' ${bound} (using the key already stored for this slug in ~/.vxil/credentials.json \u2014 pass --mint for a new one)`);
+          break;
+        }
+        console.error(`stored key for '${slug}' was refused (${r.invalid}) \u2014 minting a new one\u2026`);
+      }
+      const dash = makeDash(dashboardBase(base));
       const keyName = `cli-${hostname()}`.slice(0, 100);
       if (creds.session) {
         const r = await linkViaSession(dash, creds.session, slug, keyName);
@@ -12003,6 +12450,102 @@ try {
       }
       break;
     }
+    case "keys": {
+      const [sub, arg] = positional(0);
+      const KEYS_USAGE = "usage: vxil keys mint --name <name> --scopes <a,b,c> [--env live|test] [--store] [--json] \xB7 vxil keys list [--json] \xB7 vxil keys revoke <key_id> [--yes]";
+      if (sub === "help" || hasFlag("help")) {
+        console.log(`${KEYS_USAGE}
+  mint    a NARROW scoped key for a server on the linked project \u2014 scopes are validated
+          locally (admin refused); the key prints ONCE on stdout (--json \u2192 { api_key, key_id,
+          scopes }) and is stored as this machine's CLI key only under --store
+  list    names, ids, scopes, env, created, last-used \u2014 never a secret; * marks the CLI's key
+  revoke  type the key id to confirm (--yes for scripts); refuses the CLI's own key unless --yes
+  all three need a dashboard session: the one \`vxil login\` stored, or a sign-in at the terminal
+          (--email/--password for a script; that session is not stored). A piped / --json run never prompts
+  valid scopes: ${MINTABLE_SCOPES.join(", ")}`);
+        break;
+      }
+      if (sub !== "mint" && sub !== "list" && sub !== "revoke") fail(KEYS_USAGE);
+      const mintArgs = sub === "mint" ? (() => {
+        const name = parseKeyName(flag("name"));
+        if ("error" in name) fail(name.error);
+        const scopes = parseScopes(flag("scopes"));
+        if ("error" in scopes) fail(scopes.error);
+        const env = parseKeyEnv(flag("env"));
+        if ("error" in env) fail(env.error);
+        return { name: name.name, scopes: scopes.scopes, env: env.env };
+      })() : void 0;
+      const t = resolveTargetOrFail(selector());
+      if (!t.tenantSlug) fail("no linked project \u2014 run `vxil link <slug>` (or `vxil quickstart`) first; keys are minted on the bound project");
+      const slug = t.tenantSlug;
+      const dash = makeDash(dashboardBase(t.baseUrl));
+      const run = (fn) => withDashSession(dash, async (cookie) => {
+        let id = t.tenantId && t.tenantId !== "(unknown)" ? t.tenantId : void 0;
+        if (!id) {
+          const f = await findTenantViaSession(dash, cookie, slug);
+          if ("unauthorized" in f) return f;
+          id = f.tenant.id;
+        }
+        return fn(cookie, id);
+      });
+      if (mintArgs) {
+        announceTarget(t, "keys mint");
+        const { result } = await run((cookie, id) => mintKeyViaSession(dash, cookie, id, mintArgs));
+        console.log(mintStdout(result, jsonOut));
+        let stored = false;
+        let storeError;
+        if (hasFlag("store")) {
+          try {
+            const creds = loadCredentials();
+            creds.keys = { ...creds.keys, [slug]: result.api_key };
+            saveCredentials(creds);
+            stored = true;
+          } catch (e) {
+            storeError = e instanceof Error ? e.message : String(e);
+          }
+        }
+        for (const l of mintNotices(result, jsonOut, { stored, ...storeError !== void 0 ? { storeError } : {} })) console.error(l);
+        if (result.env !== mintArgs.env) {
+          console.error(`vxil: warning \u2014 the server minted a '${result.env}' key although --env ${mintArgs.env} was requested; revoke it (\`vxil keys revoke ${result.key_id}\`) if the env matters`);
+        }
+        break;
+      }
+      if (sub === "list") {
+        const { keys: keys2 } = await run((cookie, id) => listKeysViaSession(dash, cookie, id));
+        const current = currentKeyIdFor(keys2, t.apiKey);
+        if (jsonOut) console.log(JSON.stringify({ project: slug, current_key_id: current ?? null, keys: keys2 }, null, 2));
+        else for (const l of renderKeyTable(keys2, current)) console.log(l);
+        break;
+      }
+      const keyId = arg;
+      if (!keyId) fail("usage: vxil keys revoke <key_id> [--yes] \u2014 `vxil keys list` shows the ids");
+      const yes = hasFlag("yes");
+      const { keys } = await run((cookie, id) => listKeysViaSession(dash, cookie, id));
+      const guard = revokeGuard({ keys, keyId, currentApiKey: t.apiKey, slug, yes });
+      if ("refuse" in guard) fail(guard.refuse);
+      if (!guard.row) fail(`no key '${keyId}' on '${slug}' \u2014 \`vxil keys list\` shows the ids`);
+      if (guard.row.revoked_at) fail(`'${keyId}' is already revoked`);
+      announceTarget(t, "keys revoke");
+      if (!yes) {
+        if (!process.stdin.isTTY) fail("keys revoke is irreversible \u2014 pass --yes to confirm in a non-interactive run");
+        const ans = await prompt(`revoke key '${guard.row.name ?? keyId}' (${keyId}, scopes [${(guard.row.scopes ?? []).join(", ")}])? type the key id to confirm: `);
+        if (ans !== keyId) fail("confirmation did not match \u2014 aborted.");
+      }
+      await run((cookie, id) => revokeKeyViaSession(dash, cookie, id, keyId));
+      if (guard.isCurrent) {
+        const creds = loadCredentials();
+        const onDisk = creds.keys !== void 0 && creds.keys[slug] !== void 0 && creds.keys[slug] === t.apiKey;
+        if (onDisk && creds.keys) {
+          delete creds.keys[slug];
+          saveCredentials(creds);
+        }
+        const where = onDisk ? "removed from ~/.vxil/credentials.json" : `it came from ${t.keySource === "credentials" ? "~/.vxil/credentials.json" : t.keySource} \u2014 unset it`;
+        console.error(`this was the CLI's key for '${slug}' \u2014 ${where}; run \`vxil link ${slug} --mint\` (or \`vxil keys mint \u2026 --store\`) before the next verb`);
+      }
+      if (jsonOut) console.log(JSON.stringify({ key_id: keyId, revoked: true }));
+      else console.log(`\u2713 revoked '${guard.row.name ?? keyId}' (${keyId}) \u2014 the edge stops honouring it within seconds`);
+      break;
+    }
     case "listen": {
       const rawUrl = flag("forward-to");
       if (!rawUrl) {
@@ -12315,9 +12858,9 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
           const qs = since ? `?since=${encodeURIComponent(since)}` : "";
           const res = await api("GET", `/v1/functions/${encodeURIComponent(name)}/logs${qs}`);
           if (res.body.error) printEnvelope(res);
-          const data2 = res.body.data;
-          if (data2.lines.length) console.log(formatLogLines(data2.lines));
-          if (data2.next_since) since = data2.next_since;
+          const data3 = res.body.data;
+          if (data3.lines.length) console.log(formatLogLines(data3.lines));
+          if (data3.next_since) since = data3.next_since;
         };
         await fetchPage();
         if (hasFlag("tail")) {
@@ -12363,6 +12906,35 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
     }
     case "cms": {
       const [sub] = positional(0);
+      if (sub === "drop") {
+        const [collection] = positional(1);
+        if (!collection) fail("usage: vxil cms drop <collection> [--yes]");
+        const { api: api2, target } = requireApi(selector(), { write: `cms drop ${collection}` });
+        const plan = await planCollectionDrop(api2, collection);
+        if (plan.remoteUnavailable) {
+          fail(`cannot read ${plan.remoteUnavailable.route} (${plan.remoteUnavailable.code ?? plan.remoteUnavailable.status}) \u2014 refusing to drop against an unread target`);
+        }
+        if (!plan.exists) fail(`collection '${collection}' does not exist on tenant '${target.tenantSlug ?? "(env key)"}' \u2014 nothing to drop`);
+        let declaredLocally = false;
+        try {
+          const cfg = await loadVxilConfig();
+          declaredLocally = Object.prototype.hasOwnProperty.call(cfg.cms?.collections ?? {}, collection);
+        } catch {
+        }
+        console.error(formatCollectionDrop(collection, plan, declaredLocally));
+        if (!hasFlag("yes")) {
+          if (!process.stdin.isTTY) fail("cms drop is destructive \u2014 pass --yes to confirm in a non-interactive run");
+          const ans = await prompt(`drop collection '${collection}'? type the collection name to confirm: `);
+          if (ans !== collection) fail("confirmation did not match \u2014 aborted.");
+        }
+        await dropCollection(api2, collection);
+        if (jsonOut) {
+          console.log(JSON.stringify({ ok: true, collection, fields: plan.fields, rows: plan.rows, declared_locally: declaredLocally }));
+        } else {
+          console.log(`\u2713 dropped collection ${collection} (${plan.fields} field(s); ${plan.rows === null ? "stored rows" : `${plan.rows} stored row(s)`} retained, unreachable until re-created)`);
+        }
+        break;
+      }
       const { api } = requireApi(selector());
       if (sub === "status") {
         printEnvelope(await api("GET", "/v1/cms/collections"));
@@ -12383,7 +12955,7 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
           console.log(`  \u26A0 ${done.skipped} row(s) were written while the re-index ran and were NOT re-projected \u2014 re-run \`vxil cms reindex ${collection}\` when writes are quiet`);
         }
       } else {
-        fail("usage: vxil cms status|pull|reindex <collection> [--field <field>]");
+        fail("usage: vxil cms status|pull|reindex <collection> [--field <field>]|drop <collection> [--yes]");
       }
       break;
     }
@@ -12437,14 +13009,14 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
       const { api } = requireApi(selector(), { write: "send" });
       const [userId, template] = rest;
       if (!userId || !template) fail("usage: vxil send <user_id> <template> --data '<json>'");
-      let data2 = {};
+      let data3 = {};
       const raw = flag("data");
       try {
-        data2 = raw ? JSON.parse(raw) : {};
+        data3 = raw ? JSON.parse(raw) : {};
       } catch {
         fail("--data must be valid JSON");
       }
-      printEnvelope(await api("POST", "/v1/notifications/send", { user_id: userId, template, data: data2 }));
+      printEnvelope(await api("POST", "/v1/notifications/send", { user_id: userId, template, data: data3 }));
       break;
     }
     case "deliveries": {
@@ -12459,28 +13031,25 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
       break;
     }
     case "api": {
-      const [method, path] = rest;
-      if (!method || !path?.startsWith("/")) fail("usage: vxil api <GET|POST|PUT|PATCH|DELETE> </v1/...> [--data '<json>']");
-      const { api } = requireApi(selector(), method.toUpperCase() === "GET" ? {} : { write: `api ${method.toUpperCase()} ${path}` });
-      let body;
-      const raw = flag("data");
-      if (raw !== void 0) {
-        try {
-          body = JSON.parse(raw);
-        } catch {
-          fail("--data must be valid JSON");
-        }
+      let parsed;
+      try {
+        parsed = parseApiArgs(positional(0), flag("data"));
+      } catch (e) {
+        fail(e.message);
       }
-      printEnvelope(await api(method.toUpperCase(), path, body));
+      const { method, path, body } = parsed;
+      const { api } = requireApi(selector(), method === "GET" ? {} : { write: `api ${method} ${path}` });
+      printEnvelope(await api(method, path, body));
       break;
     }
     default:
       console.log(`vxil \u2014 a Supabase-grade code-first CLI for the whole platform
-  init [--template <id>] \xB7 templates \xB7 try (keyless sandbox) \xB7 quickstart [--dev --ttl <h>] \xB7 login \xB7 link <slug> [--as dev|<name>]
+  init [--template <id>] \xB7 templates \xB7 try (keyless sandbox) \xB7 quickstart [--dev --ttl <h>] \xB7 login \xB7 link <slug> [--key <k>] [--as dev|<name>] [--mint]
+  keys mint --name <n> --scopes <a,b,c> [--env live|test] [--store] \xB7 keys list \xB7 keys revoke <key_id> [--yes]  \u2014 a NARROW scoped key for a server (shown once; needs a vxil login session)
   architect "<describe your app>" \u2014 plain English in, a reviewed vxil.config.ts draft out
-  plan [--explain] \xB7 push [--dev|--target <name>|--prod] [--server [--resume <apply_id>]] [--no-gen] \xB7 pull \xB7 gen [--check] [--offline] [--out <f>] [--no-mcp] [--mcp-out <f>]
+  plan [--explain] \xB7 push [--dev|--target <name>|--prod] [--server [--resume <apply_id>]] [--no-gen] [--skip-functions] \xB7 pull \xB7 gen [--check] [--offline] [--out <f>] [--no-mcp] [--mcp-out <f>]
     push production overrides: --allow-mock-in-prod \xB7 --allow-sandbox-in-prod \xB7 --allow-dev-origins-in-prod \xB7 --yes
-  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>] [--api-state]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (an unreadable remote is 2; secrets by name only)
+  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>] [--strict-secrets] [--api-state]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (an unreadable remote is 2; secrets by name only, unstored refs informational unless --strict-secrets)
   doctor [--dev|--target <name>]  \u2014 + secrets referenced-vs-stored (advisory) + per-function served/published/local hash
   versions <feature> \xB7 rollback <feature> --to <v>
   secrets set|list [--all-projects]|rm \xB7 seed \xB7 export|import <feature>
@@ -12489,11 +13058,11 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
   migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run]  \u2014 backfill subscriptions via the server sync leg (resumable)
   payments simulate --scenario refund-pair|cross-platform-unlock|renewal|expiry|past-due-grace|transfer --user <id> [--tier <t>]  \u2014 mock/dev projects only
   env pull [--dev] [--file <f>] [--print] [--no-gitignore]
-  functions new|deploy|list|delete|invoke [--async]|logs [--tail]|dev <name> [--port <n>] \xB7 cms status|pull|reindex <collection> \xB7 dev up [--ttl <h>] [--new]|down [--yes]|seed|reset
+  functions new|deploy|list|delete|invoke [--async]|logs [--tail]|dev <name> [--port <n>] \xB7 cms status|pull|reindex <collection>|drop <collection> [--yes] \xB7 dev up [--ttl <h>] [--new]|down [--yes]|seed|reset
   listen --forward-to <url> [--dev] [--source <id>] [--events <prefix,\u2026>] [--replay-last <n>] [--interval <s>] [--show-runs] [--raw]  \u2014 forward inbound webhook events to a local server
   mcp install [--client cursor|claude|vscode] [--project] [--print] [--key <k>] [--scopes a,b] [--name <server>]  \u2014 connect your editor's agent to this backend's MCP server
   dev branch [<name>] [--ttl <h=24>] [--no-env] [--print] | --list | --rm <name> [--yes]
-  config get \xB7 users \xB7 send \xB7 deliveries \xB7 api <METHOD> <path>
+  config get \xB7 users \xB7 send \xB7 deliveries \xB7 api <METHOD> <path> ['<json>' | --data '<json>']
   global: --json (machine-readable + exit codes)`);
       process.exit(cmd ? 1 : 0);
   }
@@ -13003,7 +13572,7 @@ async function runFunctionsDev(name) {
     // parity with the deploy pipeline's metadata
     outboundService: (req) => outbound(req)
   });
-  const first = await bundleFunction(entry, { projectRoot: cwd });
+  const first = await bundleFunction(entry, { projectRoot: cwd, minify: false });
   const mf = new Miniflare(mfOptions(first.source));
   const { secrets, missing } = resolveDevSecrets(def.secrets, process.env);
   for (const m of missing) {
@@ -13062,7 +13631,7 @@ async function runFunctionsDev(name) {
     timer2 = setTimeout(() => {
       void (async () => {
         try {
-          const rebuilt = await bundleFunction(entry, { projectRoot: cwd });
+          const rebuilt = await bundleFunction(entry, { projectRoot: cwd, minify: false });
           await mf.setOptions(mfOptions(rebuilt.source));
           console.log(`  \u21BB rebuilt '${name}' (${Math.round(rebuilt.bytes / 100) / 10} KB) \u2014 hot-swapped`);
         } catch (e) {