@vxil/cli 0.5.2 → 0.5.3

package/README.md

@@ -39,7 +39,7 @@ export default defineConfig({
 });
 ```
 
-Verbs: `init templates quickstart try login link plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms dev payments migrate config users send deliveries api`.
+Verbs: `init templates quickstart try login link keys plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms dev payments migrate config users send deliveries api`.
 
 **Every verb names its target.** `--dev` selects the dev slot, `--target <name>` a named slot bound by `vxil link <slug> --as <name>` (which merges into the existing binding rather than replacing it). The selector is **fail-closed** — an unbound slot exits 1 telling you the fix, and never falls through to another tenant — and every write verb prints a target banner (slug + env, never a key) before it acts.
 
@@ -48,6 +48,7 @@ Verbs: `init templates quickstart try login link plan push pull diff gen doctor
 - `vxil diff [--against <target>] [--ignore <k,…>] [--strict-secrets]` — the CI drift gate; secrets compared by name only, and a referenced-but-unstored name is informational unless `--strict-secrets`.
 - `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function. Under `--json` stdout is one JSON document; notices go to stderr.
 - `vxil link <slug>` — reuses the key already stored for the slug on this machine; `--mint` for a fresh one, `--key` to hand one in.
+- `vxil keys mint --name <name> --scopes <a,b,c> [--env live|test] [--store]` — mint a **narrow** key for a server (scopes validated locally; `admin` refused); the key prints **once** to stdout (`--json` → `{ api_key, key_id, scopes }`) and is never stored unless `--store`. `vxil keys list` shows names, ids, scopes, created and last-used (never secrets); `vxil keys revoke <key_id> [--yes]` asks you to type the id, and refuses the key the CLI itself is using unless `--yes`. Needs a dashboard session (`vxil login`, or it prompts at a terminal; a piped / `--json` run fails with that remedy instead — pass `--email`/`--password` to script it, which never stores the session).
 - `vxil cms drop <collection> [--yes]` — remove one collection definition through the same guarded ack `push --allow-destructive` uses (rows are retained).
 - `vxil api <METHOD> <path> ['<json>' | --data '<json>']` — call any `/v1` route; bare JSON on stdout, banner on stderr.
 - `vxil secrets list --all-projects` — the names-and-metadata matrix across every bound project (values never come back).

package/dist/vxil.js

@@ -780,10 +780,10 @@ async function planFunctions({ api, functions, cwd, apply, onNote }) {
         const e = res.body.error ?? {};
         throw new Error(`functions: deploy ${name} failed: ${e.code ?? res.status} ${e.message ?? ""} ${e.hint ?? ""}`);
       }
-      const data2 = res.body.data;
-      const cmsHooks = data2?.cms_hook_subscriptions ?? null;
-      const webhooks = data2?.webhook_subscriptions ?? null;
-      const warnings2 = (data2?.warnings ?? []).map((message) => ({ fn: name, message: String(message) }));
+      const data3 = res.body.data;
+      const cmsHooks = data3?.cms_hook_subscriptions ?? null;
+      const webhooks = data3?.webhook_subscriptions ?? null;
+      const warnings2 = (data3?.warnings ?? []).map((message) => ({ fn: name, message: String(message) }));
       return { change, applied: 1, cmsHooks, webhooks, warnings: warnings2 };
     }
     return { change, applied: 0, cmsHooks: null, webhooks: null, warnings: [] };
@@ -1356,12 +1356,79 @@ function newId(prefix) {
   return `${prefix}_${ulid()}`;
 }
 
+// ../types/src/index.ts
+var KNOWN_SCOPES = [
+  "features:read",
+  "features:write",
+  // Dedicated write scope for the BYO-secret path. PUT /v1/secrets/:feature/:name
+  // requires THIS (or 'admin') as of 2026-07-17 (audit H2 — 'features:write' is no
+  // longer secret-write-equivalent). GET/DELETE /v1/secrets still also accept
+  // 'features:write'.
+  "secrets:write",
+  "users:read",
+  "users:write",
+  "notifications:send",
+  "notifications:read",
+  "jobs:read",
+  "jobs:write",
+  "auth:read",
+  "auth:write",
+  // Narrow least-privilege scope for the SIGN-IN surface only (2026-09-10,
+  // F4-25/F8-56): every auth route an anonymous or self-authenticating client
+  // must call to obtain, renew, verify or end ITS OWN session (sign-up/sign-in,
+  // magic-link, OTP, anonymous, step-up, OAuth, refresh, by-token revoke,
+  // sessions/verify, password reset). It does NOT reach the administrative
+  // routes — GET /v1/auth/sessions (auth:read), POST /v1/auth/sessions/:id/
+  // revoke and POST /v1/auth/users/:id/erase (auth:write). This is the scope a
+  // key baked into a browser/mobile bundle carries for sign-in; 'auth:write'
+  // still satisfies every route (any-of, the usage:read idiom) so existing keys
+  // keep working.
+  "auth:signin",
+  "ratelimits:read",
+  "ratelimits:write",
+  "ratelimits:check",
+  "files:read",
+  "files:write",
+  "webhooks:read",
+  "webhooks:write",
+  "comments:read",
+  "comments:write",
+  "cms:read",
+  "cms:write",
+  "realtime:read",
+  "realtime:write",
+  "presence:read",
+  "orgs:read",
+  "orgs:write",
+  "payments:read",
+  "payments:write",
+  "vector-search:read",
+  "vector-search:write",
+  "ai:read",
+  "ai:write",
+  "rag:read",
+  "rag:write",
+  "activity-feed:read",
+  "activity-feed:write",
+  "functions:invoke",
+  "functions:read",
+  "functions:write",
+  "copilot:read",
+  "copilot:write",
+  // Narrow least-privilege read for GET /v1/usage (2026-08-05, parity P0#4).
+  // The route ALSO accepts 'features:read' (any-of, the secrets:write idiom)
+  // so pre-existing keys keep working; mint this when a key should see usage
+  // and nothing else.
+  "usage:read",
+  "admin"
+];
+
 // ../runtime/src/hash.ts
 async function sha256Hex(input) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
   return [...new Uint8Array(digest)].map((b2) => b2.toString(16).padStart(2, "0")).join("");
 }
-async function hmacSha256Hex(secret, data2) {
+async function hmacSha256Hex(secret, data3) {
   const key = await crypto.subtle.importKey(
     "raw",
     new TextEncoder().encode(secret),
@@ -1369,7 +1436,7 @@ async function hmacSha256Hex(secret, data2) {
     false,
     ["sign"]
   );
-  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data2));
+  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data3));
   return [...new Uint8Array(sig)].map((b2) => b2.toString(16).padStart(2, "0")).join("");
 }
 
@@ -2301,7 +2368,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
   function drain() {
     !query && onopen(connection2);
   }
-  function data2(x) {
+  function data3(x) {
     if (incomings) {
       incomings.push(x);
       remaining -= x.length;
@@ -2355,7 +2422,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       statementId = Math.random().toString(36).slice(2);
       statementCount = 1;
       lifeTimer.start();
-      socket.on("data", data2);
+      socket.on("data", data3);
       keep_alive && socket.setKeepAlive && socket.setKeepAlive(true, 1e3 * keep_alive);
       const s = StartupMessage();
       write(s);
@@ -2398,7 +2465,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       error(Errors.connection("CONNECTION_DESTROYED", options));
     clearImmediate(nextWriteTimer);
     if (socket) {
-      socket.removeListener("data", data2);
+      socket.removeListener("data", data3);
       socket.removeListener("connect", connected);
       socket.readyState === "open" && socket.end(bytes_default().X().end());
     }
@@ -2409,7 +2476,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     remaining = 0;
     incomings = null;
     clearImmediate(nextWriteTimer);
-    socket.removeListener("data", data2);
+    socket.removeListener("data", data3);
     socket.removeListener("connect", connected);
     idleTimer.cancel();
     lifeTimer.cancel();
@@ -3001,14 +3068,14 @@ function Subscribe(postgres2, options) {
     const state2 = {
       lsn: Buffer.concat(x.consistent_point.split("/").map((x2) => Buffer.from(("00000000" + x2).slice(-8), "hex")))
     };
-    stream2.on("data", data2);
+    stream2.on("data", data3);
     stream2.on("error", error);
     stream2.on("close", sql2.close);
     return { stream: stream2, state: xs.state };
     function error(e) {
       console.error("Unexpected error during logical streaming - reconnecting", e);
     }
-    function data2(x2) {
+    function data3(x2) {
       if (x2[0] === 119) {
         parse(x2.subarray(25), state2, sql2.options.parsers, handle, options.transform);
       } else if (x2[0] === 107 && x2[17]) {
@@ -3183,9 +3250,9 @@ function largeObject(sql, oid, mode = 131072 | 262144) {
           async read(size2) {
             const l = size2 > max ? size2 - max : size2;
             max -= size2;
-            const [{ data: data2 }] = await lo.read(l);
-            this.push(data2);
-            if (data2.length < size2)
+            const [{ data: data3 }] = await lo.read(l);
+            this.push(data3);
+            if (data3.length < size2)
               this.push(null);
           }
         });
@@ -6049,7 +6116,7 @@ function errText(r) {
   const e = r.json.error;
   return e ? `${e.code ?? r.status}${e.message ? ` \u2014 ${e.message}` : ""}` : `${r.status}`;
 }
-async function linkViaSession(dash, cookie, slug, keyName) {
+async function findTenantViaSession(dash, cookie, slug) {
   const list = await dash("GET", "/dashboard/tenants", void 0, cookie);
   if (list.status === 401) return { unauthorized: true };
   if (list.status !== 200) throw new Error(`could not list projects (${errText(list)})`);
@@ -6060,6 +6127,12 @@ async function linkViaSession(dash, cookie, slug, keyName) {
       `no project '${slug}' on this account \u2014 run \`vxil quickstart\`, or ask an admin to add you as a member`
     );
   }
+  return { tenant: t };
+}
+async function linkViaSession(dash, cookie, slug, keyName) {
+  const found = await findTenantViaSession(dash, cookie, slug);
+  if ("unauthorized" in found) return found;
+  const t = found.tenant;
   const mint = await dash("POST", `/dashboard/tenants/${t.id}/api-keys`, { name: keyName }, cookie);
   if (mint.status === 401) return { unauthorized: true };
   if (mint.status !== 201 && mint.status !== 200) {
@@ -6114,6 +6187,150 @@ async function linkViaStoredKey(api, slug, storedKey) {
   return { invalid: `${e?.code ?? res.status}${e?.message ? ` \u2014 ${e.message}` : ""}` };
 }
 
+// src/keys.ts
+var MINTABLE_SCOPES = KNOWN_SCOPES.filter((s) => s !== "admin");
+function data2(r) {
+  return r.json.data ?? r.json;
+}
+function errText2(r) {
+  const e = r.json.error;
+  if (!e) return `${r.status}`;
+  return `${e.code ?? r.status}${e.message ? ` \u2014 ${e.message}` : ""}${e.hint ? `
+hint: ${e.hint}` : ""}`;
+}
+function parseScopes(raw) {
+  const list = (raw ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (!list.length) {
+    return { error: `--scopes is required \u2014 a comma-separated list of scopes, e.g. --scopes cms:read,cms:write
+valid scopes: ${MINTABLE_SCOPES.join(", ")}` };
+  }
+  const scopes = [...new Set(list)];
+  const god = scopes.filter((s) => s === "admin" || s === "*");
+  if (god.length) {
+    return { error: `'${god.join("', '")}' cannot be minted here (admin-class keys are operator-provisioned only) \u2014 name the feature scopes this key needs, e.g. --scopes cms:read,files:write` };
+  }
+  const unknown = scopes.filter((s) => !MINTABLE_SCOPES.includes(s));
+  if (unknown.length) {
+    return { error: `unknown scope${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}
+valid scopes: ${MINTABLE_SCOPES.join(", ")}` };
+  }
+  return { scopes };
+}
+function parseKeyEnv(raw) {
+  if (raw === void 0) return { env: "live" };
+  if (raw === "live" || raw === "test") return { env: raw };
+  return { error: `--env must be 'live' or 'test' (got '${raw}') \u2014 this is the key's env prefix, not the project's environment label` };
+}
+function parseKeyName(raw) {
+  const name = (raw ?? "").trim();
+  if (!name) return { error: "--name is required \u2014 a label for this key, e.g. --name web-worker" };
+  if (name.length > 100) return { error: `--name is at most 100 characters (got ${name.length})` };
+  return { name };
+}
+async function mintKeyViaSession(dash, cookie, tenantId, req) {
+  const r = await dash(
+    "POST",
+    `/dashboard/tenants/${tenantId}/api-keys`,
+    { name: req.name, scopes: req.scopes, env: req.env },
+    cookie
+  );
+  if (r.status === 401) return { unauthorized: true };
+  if (r.status !== 201 && r.status !== 200) {
+    throw new Error(`could not mint the key (${errText2(r)})`);
+  }
+  const d = data2(r);
+  if (!d.api_key || !d.key_id) throw new Error("mint returned no api_key");
+  return {
+    result: {
+      key_id: d.key_id,
+      api_key: d.api_key,
+      scopes: d.scopes ?? req.scopes,
+      env: d.env ?? req.env,
+      name: req.name,
+      ...d.prefix ? { prefix: d.prefix } : {}
+    }
+  };
+}
+async function listKeysViaSession(dash, cookie, tenantId) {
+  const r = await dash("GET", `/dashboard/tenants/${tenantId}/api-keys`, void 0, cookie);
+  if (r.status === 401) return { unauthorized: true };
+  if (r.status !== 200) throw new Error(`could not list keys (${errText2(r)})`);
+  return { keys: data2(r).keys ?? [] };
+}
+async function revokeKeyViaSession(dash, cookie, tenantId, keyId) {
+  const r = await dash("DELETE", `/dashboard/tenants/${tenantId}/api-keys/${encodeURIComponent(keyId)}`, void 0, cookie);
+  if (r.status === 401) return { unauthorized: true };
+  if (r.status === 404) throw new Error(`no active key '${keyId}' on this project (already revoked, or not this project's) \u2014 \`vxil keys list\` shows the ids`);
+  if (r.status !== 200) throw new Error(`could not revoke the key (${errText2(r)})`);
+  return { revoked: true };
+}
+function currentKeyIdFor(keys, apiKey) {
+  if (!apiKey) return void 0;
+  const hit = keys.find((k) => typeof k.prefix === "string" && k.prefix.length >= 12 && apiKey.startsWith(k.prefix));
+  return hit?.key_id;
+}
+function revokeGuard(args) {
+  const row2 = args.keys.find((k) => k.key_id === args.keyId);
+  const isCurrent = currentKeyIdFor(args.keys, args.currentApiKey) === args.keyId;
+  if (isCurrent && !args.yes) {
+    return {
+      refuse: `'${args.keyId}' is the key this CLI is using for '${args.slug}' (the one in ~/.vxil/credentials.json / VXIL_API_KEY) \u2014 revoking it breaks every vxil verb on this project until you re-link. Pass --yes to revoke it anyway, then run \`vxil link ${args.slug} --mint\` (or \`vxil keys mint \u2026 --store\`) for a replacement.`
+    };
+  }
+  return { ok: true, row: row2, isCurrent };
+}
+function mintStdout(r, json2) {
+  return json2 ? JSON.stringify({ api_key: r.api_key, key_id: r.key_id, scopes: r.scopes }) : r.api_key;
+}
+function mintNotices(r, json2, opts = {}) {
+  const storage = opts.stored ? "It was stored as this project's CLI key (~/.vxil/credentials.json), replacing the previous one." : "It was NOT stored on this machine (pass --store to make it this project's CLI key).";
+  const storeWarn = opts.storeError !== void 0 ? [`vxil: warning \u2014 --store failed: could not write ~/.vxil/credentials.json (${opts.storeError}). The key (${r.key_id}) was minted and is printed above \u2014 copy it from there now; this machine's CLI key is unchanged. To discard it instead: \`vxil keys revoke ${r.key_id}\`.`] : [];
+  if (json2) {
+    return [
+      `minted '${r.name}' (${r.key_id}, env ${r.env}) \u2014 shown ONCE; it is not retrievable again. ${storage} Revoke with \`vxil keys revoke ${r.key_id}\`.`,
+      ...storeWarn
+    ];
+  }
+  return [
+    `\u2713 minted '${r.name}' (${r.key_id}, env ${r.env}) with scopes [${r.scopes.join(", ")}]`,
+    `This key is shown ONCE and is not retrievable again \u2014 copy it now. ${storage} Revoke with \`vxil keys revoke ${r.key_id}\`.`,
+    ...storeWarn
+  ];
+}
+function when(iso) {
+  if (!iso) return "\u2014";
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? String(iso) : d.toISOString().slice(0, 16).replace("T", " ");
+}
+function renderKeyTable(keys, currentKeyId) {
+  if (!keys.length) return ["(no keys on this project)"];
+  const rows = keys.map((k) => ({
+    mark: k.key_id === currentKeyId ? "*" : " ",
+    id: k.key_id,
+    name: k.name ?? "",
+    env: k.env ?? "",
+    status: k.revoked_at ? "revoked" : k.expires_at && new Date(k.expires_at).getTime() < Date.now() ? "expired" : "active",
+    created: when(k.created_at),
+    used: when(k.last_used_at),
+    scopes: (k.scopes ?? []).join(",")
+  }));
+  const w = (f, head2) => Math.max(head2.length, ...rows.map((r) => r[f].length));
+  const cols = [
+    ["id", "KEY_ID"],
+    ["name", "NAME"],
+    ["env", "ENV"],
+    ["status", "STATUS"],
+    ["created", "CREATED"],
+    ["used", "LAST_USED"]
+  ];
+  const line = (r, pad) => `${r.mark ?? " "} ${cols.map(([f, h]) => pad ? r[f].padEnd(w(f, h)) : r[f]).join("  ")}  ${r.scopes}`;
+  const head = { mark: " ", scopes: "SCOPES" };
+  for (const [f, h] of cols) head[f] = h;
+  const out = [line(head, true), ...rows.map((r) => line(r, true))];
+  if (currentKeyId) out.push("* = the key this CLI is using for this project");
+  return out;
+}
+
 // src/secretsValue.ts
 var ARGV_SECRET_WARNING = `WARNING: --value <v> puts the secret on the command line \u2014 it lands in shell history and is
          visible in the process list. Prefer stdin:  printf '%s' "$VAL" | vxil secrets set <feature>/<name>`;
@@ -7158,7 +7375,7 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
             result.skipped++;
             continue;
           }
-          const data2 = {};
+          const data3 = {};
           let rowErr;
           for (const f of mapping.fields) {
             const raw = row2[f.source];
@@ -7174,11 +7391,11 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
                 unresolvedOptional.set(f.target, (unresolvedOptional.get(f.target) ?? 0) + 1);
                 continue;
               }
-              data2[f.target] = mapped;
+              data3[f.target] = mapped;
               continue;
             }
             if (f.storageObject) {
-              data2[f.target] = resolveObjectId(String(raw), filesMaps) ?? String(raw);
+              data3[f.target] = resolveObjectId(String(raw), filesMaps) ?? String(raw);
               continue;
             }
             const coerced = coerceValue(raw, f);
@@ -7186,7 +7403,7 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
               rowErr = coerced.err;
               break;
             }
-            data2[f.target] = coerced.value;
+            data3[f.target] = coerced.value;
           }
           if (rowErr) {
             result.skipped++;
@@ -7195,8 +7412,8 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
             continue;
           }
           if (deps.dryRun) continue;
-          if (dedupeField && data2[dedupeField.target] !== void 0) {
-            const filter = encodeURIComponent(JSON.stringify({ [dedupeField.target]: data2[dedupeField.target] }));
+          if (dedupeField && data3[dedupeField.target] !== void 0) {
+            const filter = encodeURIComponent(JSON.stringify({ [dedupeField.target]: data3[dedupeField.target] }));
             const q = await deps.api("GET", `/v1/cms/items/${enc}?filter=${filter}&limit=1`);
             const items = q.body.data?.items ?? [];
             if (q.status === 200 && items.length > 0 && typeof items[0].item_id === "string") {
@@ -7205,7 +7422,7 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
               continue;
             }
           }
-          const res = await deps.api("POST", `/v1/cms/items/${enc}`, { data: data2, status: itemStatus });
+          const res = await deps.api("POST", `/v1/cms/items/${enc}`, { data: data3, status: itemStatus });
           if (res.status === 201 || res.status === 200) {
             const itemId = res.body.data?.item_id;
             if (typeof itemId !== "string") {
@@ -11136,7 +11353,7 @@ function printEnvelope({ status, body }) {
 async function prompt(q, opts = {}) {
   const stdin = process.stdin;
   if (opts.hidden && stdin.isTTY && stdin.setRawMode) {
-    process.stdout.write(q);
+    process.stderr.write(q);
     return await new Promise((resolve8) => {
       stdin.setRawMode(true);
       stdin.resume();
@@ -11147,11 +11364,11 @@ async function prompt(q, opts = {}) {
           stdin.setRawMode(false);
           stdin.pause();
           stdin.removeListener("data", onData);
-          process.stdout.write("\n");
+          process.stderr.write("\n");
           resolve8(val);
         } else if (ch === "") {
           stdin.setRawMode(false);
-          process.stdout.write("\n");
+          process.stderr.write("\n");
           process.exit(130);
         } else if (ch === "\x7F" || ch === "\b") {
           val = val.slice(0, -1);
@@ -11162,7 +11379,7 @@ async function prompt(q, opts = {}) {
       stdin.on("data", onData);
     });
   }
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
   return await new Promise((res) => rl.question(q, (a) => {
     rl.close();
     res(a.trim());
@@ -11252,6 +11469,39 @@ async function resolveDashCookie(dash) {
   if (!cookie) fail("login succeeded but returned no session cookie");
   return cookie;
 }
+async function interactiveLogin(dash) {
+  const email = flag("email") || process.env.VXIL_DEV_EMAIL || void 0;
+  const password = flag("password") || process.env.VXIL_DEV_PASSWORD || void 0;
+  const mustPrompt = !email || !password;
+  if (mustPrompt && (!process.stdin.isTTY || !process.stdout.isTTY || jsonOut)) {
+    fail("need a dashboard session \u2014 run `vxil login` first (or pass --email/--password, or set VXIL_DEV_EMAIL/VXIL_DEV_PASSWORD); a non-interactive run cannot prompt");
+  }
+  const e = email ?? await prompt("dashboard email: ");
+  const p = password ?? await prompt("password: ", { hidden: true });
+  const r = await dash("POST", "/dashboard/login", { email: e, password: p });
+  if (r.status !== 200) fail(`login failed: ${r.status} ${JSON.stringify(r.json).slice(0, 160)}`);
+  const cookie = r.cookie?.split(";")[0];
+  if (!cookie) fail("login succeeded but returned no session cookie");
+  if (mustPrompt) {
+    const creds = loadCredentials();
+    creds.session = cookie;
+    saveCredentials(creds);
+    console.error("\u2713 signed in \u2014 session stored in ~/.vxil/credentials.json");
+  }
+  return cookie;
+}
+async function withDashSession(dash, run) {
+  const creds = loadCredentials();
+  if (creds.session) {
+    const r2 = await run(creds.session);
+    if (!("unauthorized" in r2)) return r2;
+    console.error("dashboard session expired \u2014 sign in again\u2026");
+  }
+  const cookie = await interactiveLogin(dash);
+  const r = await run(cookie);
+  if ("unauthorized" in r) fail("the dashboard rejected the fresh session \u2014 run `vxil login` and retry");
+  return r;
+}
 function requireApi(sel = "prod", opts = {}) {
   const t = resolveTargetOrFail(sel, opts.exitCode ?? 1);
   if (!t.apiKey) fail(noKeyMessage(t), opts.exitCode ?? 1);
@@ -12200,6 +12450,102 @@ try {
       }
       break;
     }
+    case "keys": {
+      const [sub, arg] = positional(0);
+      const KEYS_USAGE = "usage: vxil keys mint --name <name> --scopes <a,b,c> [--env live|test] [--store] [--json] \xB7 vxil keys list [--json] \xB7 vxil keys revoke <key_id> [--yes]";
+      if (sub === "help" || hasFlag("help")) {
+        console.log(`${KEYS_USAGE}
+  mint    a NARROW scoped key for a server on the linked project \u2014 scopes are validated
+          locally (admin refused); the key prints ONCE on stdout (--json \u2192 { api_key, key_id,
+          scopes }) and is stored as this machine's CLI key only under --store
+  list    names, ids, scopes, env, created, last-used \u2014 never a secret; * marks the CLI's key
+  revoke  type the key id to confirm (--yes for scripts); refuses the CLI's own key unless --yes
+  all three need a dashboard session: the one \`vxil login\` stored, or a sign-in at the terminal
+          (--email/--password for a script; that session is not stored). A piped / --json run never prompts
+  valid scopes: ${MINTABLE_SCOPES.join(", ")}`);
+        break;
+      }
+      if (sub !== "mint" && sub !== "list" && sub !== "revoke") fail(KEYS_USAGE);
+      const mintArgs = sub === "mint" ? (() => {
+        const name = parseKeyName(flag("name"));
+        if ("error" in name) fail(name.error);
+        const scopes = parseScopes(flag("scopes"));
+        if ("error" in scopes) fail(scopes.error);
+        const env = parseKeyEnv(flag("env"));
+        if ("error" in env) fail(env.error);
+        return { name: name.name, scopes: scopes.scopes, env: env.env };
+      })() : void 0;
+      const t = resolveTargetOrFail(selector());
+      if (!t.tenantSlug) fail("no linked project \u2014 run `vxil link <slug>` (or `vxil quickstart`) first; keys are minted on the bound project");
+      const slug = t.tenantSlug;
+      const dash = makeDash(dashboardBase(t.baseUrl));
+      const run = (fn) => withDashSession(dash, async (cookie) => {
+        let id = t.tenantId && t.tenantId !== "(unknown)" ? t.tenantId : void 0;
+        if (!id) {
+          const f = await findTenantViaSession(dash, cookie, slug);
+          if ("unauthorized" in f) return f;
+          id = f.tenant.id;
+        }
+        return fn(cookie, id);
+      });
+      if (mintArgs) {
+        announceTarget(t, "keys mint");
+        const { result } = await run((cookie, id) => mintKeyViaSession(dash, cookie, id, mintArgs));
+        console.log(mintStdout(result, jsonOut));
+        let stored = false;
+        let storeError;
+        if (hasFlag("store")) {
+          try {
+            const creds = loadCredentials();
+            creds.keys = { ...creds.keys, [slug]: result.api_key };
+            saveCredentials(creds);
+            stored = true;
+          } catch (e) {
+            storeError = e instanceof Error ? e.message : String(e);
+          }
+        }
+        for (const l of mintNotices(result, jsonOut, { stored, ...storeError !== void 0 ? { storeError } : {} })) console.error(l);
+        if (result.env !== mintArgs.env) {
+          console.error(`vxil: warning \u2014 the server minted a '${result.env}' key although --env ${mintArgs.env} was requested; revoke it (\`vxil keys revoke ${result.key_id}\`) if the env matters`);
+        }
+        break;
+      }
+      if (sub === "list") {
+        const { keys: keys2 } = await run((cookie, id) => listKeysViaSession(dash, cookie, id));
+        const current = currentKeyIdFor(keys2, t.apiKey);
+        if (jsonOut) console.log(JSON.stringify({ project: slug, current_key_id: current ?? null, keys: keys2 }, null, 2));
+        else for (const l of renderKeyTable(keys2, current)) console.log(l);
+        break;
+      }
+      const keyId = arg;
+      if (!keyId) fail("usage: vxil keys revoke <key_id> [--yes] \u2014 `vxil keys list` shows the ids");
+      const yes = hasFlag("yes");
+      const { keys } = await run((cookie, id) => listKeysViaSession(dash, cookie, id));
+      const guard = revokeGuard({ keys, keyId, currentApiKey: t.apiKey, slug, yes });
+      if ("refuse" in guard) fail(guard.refuse);
+      if (!guard.row) fail(`no key '${keyId}' on '${slug}' \u2014 \`vxil keys list\` shows the ids`);
+      if (guard.row.revoked_at) fail(`'${keyId}' is already revoked`);
+      announceTarget(t, "keys revoke");
+      if (!yes) {
+        if (!process.stdin.isTTY) fail("keys revoke is irreversible \u2014 pass --yes to confirm in a non-interactive run");
+        const ans = await prompt(`revoke key '${guard.row.name ?? keyId}' (${keyId}, scopes [${(guard.row.scopes ?? []).join(", ")}])? type the key id to confirm: `);
+        if (ans !== keyId) fail("confirmation did not match \u2014 aborted.");
+      }
+      await run((cookie, id) => revokeKeyViaSession(dash, cookie, id, keyId));
+      if (guard.isCurrent) {
+        const creds = loadCredentials();
+        const onDisk = creds.keys !== void 0 && creds.keys[slug] !== void 0 && creds.keys[slug] === t.apiKey;
+        if (onDisk && creds.keys) {
+          delete creds.keys[slug];
+          saveCredentials(creds);
+        }
+        const where = onDisk ? "removed from ~/.vxil/credentials.json" : `it came from ${t.keySource === "credentials" ? "~/.vxil/credentials.json" : t.keySource} \u2014 unset it`;
+        console.error(`this was the CLI's key for '${slug}' \u2014 ${where}; run \`vxil link ${slug} --mint\` (or \`vxil keys mint \u2026 --store\`) before the next verb`);
+      }
+      if (jsonOut) console.log(JSON.stringify({ key_id: keyId, revoked: true }));
+      else console.log(`\u2713 revoked '${guard.row.name ?? keyId}' (${keyId}) \u2014 the edge stops honouring it within seconds`);
+      break;
+    }
     case "listen": {
       const rawUrl = flag("forward-to");
       if (!rawUrl) {
@@ -12512,9 +12858,9 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
           const qs = since ? `?since=${encodeURIComponent(since)}` : "";
           const res = await api("GET", `/v1/functions/${encodeURIComponent(name)}/logs${qs}`);
           if (res.body.error) printEnvelope(res);
-          const data2 = res.body.data;
-          if (data2.lines.length) console.log(formatLogLines(data2.lines));
-          if (data2.next_since) since = data2.next_since;
+          const data3 = res.body.data;
+          if (data3.lines.length) console.log(formatLogLines(data3.lines));
+          if (data3.next_since) since = data3.next_since;
         };
         await fetchPage();
         if (hasFlag("tail")) {
@@ -12663,14 +13009,14 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
       const { api } = requireApi(selector(), { write: "send" });
       const [userId, template] = rest;
       if (!userId || !template) fail("usage: vxil send <user_id> <template> --data '<json>'");
-      let data2 = {};
+      let data3 = {};
       const raw = flag("data");
       try {
-        data2 = raw ? JSON.parse(raw) : {};
+        data3 = raw ? JSON.parse(raw) : {};
       } catch {
         fail("--data must be valid JSON");
       }
-      printEnvelope(await api("POST", "/v1/notifications/send", { user_id: userId, template, data: data2 }));
+      printEnvelope(await api("POST", "/v1/notifications/send", { user_id: userId, template, data: data3 }));
       break;
     }
     case "deliveries": {
@@ -12699,6 +13045,7 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
     default:
       console.log(`vxil \u2014 a Supabase-grade code-first CLI for the whole platform
   init [--template <id>] \xB7 templates \xB7 try (keyless sandbox) \xB7 quickstart [--dev --ttl <h>] \xB7 login \xB7 link <slug> [--key <k>] [--as dev|<name>] [--mint]
+  keys mint --name <n> --scopes <a,b,c> [--env live|test] [--store] \xB7 keys list \xB7 keys revoke <key_id> [--yes]  \u2014 a NARROW scoped key for a server (shown once; needs a vxil login session)
   architect "<describe your app>" \u2014 plain English in, a reviewed vxil.config.ts draft out
   plan [--explain] \xB7 push [--dev|--target <name>|--prod] [--server [--resume <apply_id>]] [--no-gen] [--skip-functions] \xB7 pull \xB7 gen [--check] [--offline] [--out <f>] [--no-mcp] [--mcp-out <f>]
     push production overrides: --allow-mock-in-prod \xB7 --allow-sandbox-in-prod \xB7 --allow-dev-origins-in-prod \xB7 --yes

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@vxil/cli",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "private": false,
-  "description": "The vxil CLI — init, quickstart, push, gen, secrets, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
+  "description": "The vxil CLI — init, quickstart, push, gen, secrets, keys, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",
   "homepage": "https://vxil.com",
   "keywords": [