@vxil/cli 0.5.2 → 0.6.0

package/README.md

@@ -39,7 +39,7 @@ export default defineConfig({
 });
 ```
 
-Verbs: `init templates quickstart try login link plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms dev payments migrate config users send deliveries api`.
+Verbs: `init templates quickstart try login link keys plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms dev payments migrate config users send deliveries api`.
 
 **Every verb names its target.** `--dev` selects the dev slot, `--target <name>` a named slot bound by `vxil link <slug> --as <name>` (which merges into the existing binding rather than replacing it). The selector is **fail-closed** — an unbound slot exits 1 telling you the fix, and never falls through to another tenant — and every write verb prints a target banner (slug + env, never a key) before it acts.
 
@@ -48,6 +48,7 @@ Verbs: `init templates quickstart try login link plan push pull diff gen doctor
 - `vxil diff [--against <target>] [--ignore <k,…>] [--strict-secrets]` — the CI drift gate; secrets compared by name only, and a referenced-but-unstored name is informational unless `--strict-secrets`.
 - `vxil doctor` — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function. Under `--json` stdout is one JSON document; notices go to stderr.
 - `vxil link <slug>` — reuses the key already stored for the slug on this machine; `--mint` for a fresh one, `--key` to hand one in.
+- `vxil keys mint --name <name> --scopes <a,b,c> [--env live|test] [--store]` — mint a **narrow** key for a server (scopes validated locally; `admin` refused); the key prints **once** to stdout (`--json` → `{ api_key, key_id, scopes }`) and is never stored unless `--store`. `vxil keys list` shows names, ids, scopes, created and last-used (never secrets); `vxil keys revoke <key_id> [--yes]` asks you to type the id, and refuses the key the CLI itself is using unless `--yes`. Needs a dashboard session (`vxil login`, or it prompts at a terminal; a piped / `--json` run fails with that remedy instead — pass `--email`/`--password` to script it, which never stores the session).
 - `vxil cms drop <collection> [--yes]` — remove one collection definition through the same guarded ack `push --allow-destructive` uses (rows are retained).
 - `vxil api <METHOD> <path> ['<json>' | --data '<json>']` — call any `/v1` route; bare JSON on stdout, banner on stderr.
 - `vxil secrets list --all-projects` — the names-and-metadata matrix across every bound project (values never come back).

package/dist/_vxil-feature-configs.d.ts

@@ -1,6 +1,7 @@
 import { type Static, type TSchema } from '@sinclair/typebox';
 export * from './_vxil-feature-configs-hooks.js';
 export * from './readmodels.js';
+export * from './apiState.js';
 export declare const RESERVED_CREDIT_TYPES: ReadonlySet<string>;
 /** True when a credit_type is a vxil-COGS reserved type (grant/consume/config
  *  of which is restricted to internal platform machinery). */
@@ -265,12 +266,35 @@ export type AuthSecurityConfig = NonNullable<Static<typeof AuthConfigSchema>['se
 /** The RB-2 generic OIDC / SSO issuer block (`providers.oidc`). */
 export type AuthOidcConfig = Static<typeof OidcProviderSchema>;
 export type AuthConfig = Static<typeof AuthConfigSchema>;
+export declare const RL_POLICY_NAME_PATTERN = "^[a-zA-Z0-9_.:-]+$";
+/** GET /v1/rate-limits/policies lists at most 100 with no cursor (core.ts
+ *  listPolicies) — a declared set past that could never be reconciled. */
+export declare const RL_MAX_DECLARED_POLICIES = 100;
+/** rate-limits-v1 core.ts createPolicy: at most 8 distinct `{var}`s. */
+export declare const RL_KEY_TEMPLATE_MAX_VARS = 8;
+export declare const DeclaredRlPolicySchema: import("@sinclair/typebox").TObject<{
+    name: import("@sinclair/typebox").TString;
+    key_template: import("@sinclair/typebox").TString;
+    limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+    window_seconds: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+    behavior: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"block">, import("@sinclair/typebox").TLiteral<"shape">]>>;
+    algorithm: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"sliding_window">, import("@sinclair/typebox").TLiteral<"token_bucket">]>>;
+}>;
+export type DeclaredRlPolicy = Static<typeof DeclaredRlPolicySchema>;
 export declare const RateLimitsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     defaults: import("@sinclair/typebox").TObject<{
         perTenantSec: import("@sinclair/typebox").TInteger;
         burstSize: import("@sinclair/typebox").TInteger;
     }>;
+    policies: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        name: import("@sinclair/typebox").TString;
+        key_template: import("@sinclair/typebox").TString;
+        limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+        window_seconds: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+        behavior: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"block">, import("@sinclair/typebox").TLiteral<"shape">]>>;
+        algorithm: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"sliding_window">, import("@sinclair/typebox").TLiteral<"token_bucket">]>>;
+    }>>>;
 }>;
 export type RateLimitsConfig = Static<typeof RateLimitsConfigSchema>;
 export declare const FilesConfigSchema: import("@sinclair/typebox").TObject<{
@@ -301,6 +325,11 @@ export declare const FilesConfigSchema: import("@sinclair/typebox").TObject<{
     }>>;
 }>;
 export type FilesConfig = Static<typeof FilesConfigSchema>;
+export declare const DeclaredWebhookSubscriptionSchema: import("@sinclair/typebox").TObject<{
+    target_url: import("@sinclair/typebox").TString;
+    event_prefixes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+}>;
+export type DeclaredWebhookSubscription = Static<typeof DeclaredWebhookSubscriptionSchema>;
 export declare const WebhooksConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     maxSubscriptions: import("@sinclair/typebox").TInteger;
@@ -310,6 +339,10 @@ export declare const WebhooksConfigSchema: import("@sinclair/typebox").TObject<{
         minLevel: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"warn">, import("@sinclair/typebox").TLiteral<"error">]>;
         digestMinutes: import("@sinclair/typebox").TInteger;
     }>>;
+    subscriptions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        target_url: import("@sinclair/typebox").TString;
+        event_prefixes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    }>>>;
 }>;
 export type WebhooksConfig = Static<typeof WebhooksConfigSchema>;
 export declare const CommentsConfigSchema: import("@sinclair/typebox").TObject<{
@@ -476,6 +509,15 @@ export declare const VectorSearchConfigSchema: import("@sinclair/typebox").TObje
     }>>>;
 }>;
 export type VectorSearchConfig = Static<typeof VectorSearchConfigSchema>;
+export declare const AI_TEMPLATE_NAME_PATTERN = "^[a-zA-Z0-9_.\\-]+$";
+export declare const AI_MAX_DECLARED_TEMPLATES = 50;
+export declare const DeclaredAiTemplateSchema: import("@sinclair/typebox").TObject<{
+    template: import("@sinclair/typebox").TString;
+    user: import("@sinclair/typebox").TString;
+    system: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    schema: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnknown>>;
+}>;
+export type DeclaredAiTemplate = Static<typeof DeclaredAiTemplateSchema>;
 export declare const AiConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     defaultProvider: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"mock">, import("@sinclair/typebox").TLiteral<"openai">, import("@sinclair/typebox").TLiteral<"anthropic">, import("@sinclair/typebox").TLiteral<"gemini">, import("@sinclair/typebox").TLiteral<"azure">, import("@sinclair/typebox").TLiteral<"openrouter">]>;
@@ -500,11 +542,17 @@ export declare const AiConfigSchema: import("@sinclair/typebox").TObject<{
         tokensPerUserPerDay: import("@sinclair/typebox").TInteger;
         consumeCredits: import("@sinclair/typebox").TBoolean;
     }>;
-    streaming: import("@sinclair/typebox").TObject<{
+    streaming: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         enabled: import("@sinclair/typebox").TBoolean;
         replayBufferFrames: import("@sinclair/typebox").TInteger;
         flushMs: import("@sinclair/typebox").TInteger;
-    }>;
+    }>>;
+    templates: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        template: import("@sinclair/typebox").TString;
+        user: import("@sinclair/typebox").TString;
+        system: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        schema: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnknown>>;
+    }>>>;
 }>;
 export type AiConfig = Static<typeof AiConfigSchema>;
 export declare const RagConfigSchema: import("@sinclair/typebox").TObject<{
@@ -713,6 +761,18 @@ export declare const MCP_MAX_PROMPTS = 32;
  *  stays ALLOWED (fn→fn composition). Source of truth for both the config-write
  *  validation below and the control-plane deploy clamp. */
 export declare const DENY_FUNCTION_SCOPES: Set<string>;
+/** `{var}` names of a rate-limit key template (rate-limits-v1 core.ts
+ *  templateVars parity). */
+export declare function rlTemplateVars(template: string): string[];
+export declare function validateDeclaredRlPolicies(policies: readonly DeclaredRlPolicy[] | undefined): string[];
+export declare function validateDeclaredWebhookSubscriptions(subscriptions: readonly DeclaredWebhookSubscription[] | undefined, maxSubscriptions: number | undefined): string[];
+/** The stored-template `schema` bounds — MIRRORED from @vxil/runtime
+ *  (AI_TEMPLATE_SCHEMA_MAX_BYTES / AI_TEMPLATE_SCHEMA_MAX_DEPTH; this package is
+ *  typebox-only). ai-v1 putTemplate refuses the same numbers at the route, so a
+ *  declared entry that passes here is never a 422 at converge. */
+export declare const AI_TEMPLATE_SCHEMA_MAX_BYTES = 32000;
+export declare const AI_TEMPLATE_SCHEMA_MAX_DEPTH = 64;
+export declare function validateDeclaredAiTemplates(templates: readonly DeclaredAiTemplate[] | undefined): string[];
 export declare function validateFeatureConfig(feature: string, raw: unknown): ConfigValidation;
 export declare const FEATURE_KEYS: readonly ["notifications", "jobs", "auth", "rate-limits", "files", "webhooks", "comments", "cms", "mcp", "realtime", "presence", "orgs", "activity-feed", "vector-search", "ai", "rag", "payments", "functions", "copilot"];
 export type FeatureKey = (typeof FEATURE_KEYS)[number];