@vxil/cli 0.6.0 → 0.8.0

package/README.md

@@ -39,7 +39,9 @@ export default defineConfig({
 });
 ```
 
-Verbs: `init templates quickstart try login link keys plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms dev payments migrate config users send deliveries api`.
+Verbs: `init templates quickstart try login link keys account logout invites members projects billing plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms files webhooks search dev payments migrate config users send deliveries api`.
+
+`vxil quickstart [--features a,b] [--invite <code>] [--env <label>] [--dev [--ttl <h>]] [--no-push]` is the front door; `vxil api --help` prints the operator cheat-sheet — every dashboard action as one `vxil api` line.
 
 **Every verb names its target.** `--dev` selects the dev slot, `--target <name>` a named slot bound by `vxil link <slug> --as <name>` (which merges into the existing binding rather than replacing it). The selector is **fail-closed** — an unbound slot exits 1 telling you the fix, and never falls through to another tenant — and every write verb prints a target banner (slug + env, never a key) before it acts.
 
@@ -50,6 +52,10 @@ Verbs: `init templates quickstart try login link keys plan push pull diff gen do
 - `vxil link <slug>` — reuses the key already stored for the slug on this machine; `--mint` for a fresh one, `--key` to hand one in.
 - `vxil keys mint --name <name> --scopes <a,b,c> [--env live|test] [--store]` — mint a **narrow** key for a server (scopes validated locally; `admin` refused); the key prints **once** to stdout (`--json` → `{ api_key, key_id, scopes }`) and is never stored unless `--store`. `vxil keys list` shows names, ids, scopes, created and last-used (never secrets); `vxil keys revoke <key_id> [--yes]` asks you to type the id, and refuses the key the CLI itself is using unless `--yes`. Needs a dashboard session (`vxil login`, or it prompts at a terminal; a piped / `--json` run fails with that remedy instead — pass `--email`/`--password` to script it, which never stores the session).
 - `vxil cms drop <collection> [--yes]` — remove one collection definition through the same guarded ack `push --allow-destructive` uses (rows are retained).
+- `vxil members list|invite|add|rm|uninvite` and `vxil invites accept <token|url>` — the bound project's team from the terminal (your `vxil login` session): invite by e-mail with a role, add an existing account (also how you change a role), remove (typed e-mail, refuses the last owner), revoke a pending invitation, accept one.
+- `vxil projects list|create|rm` and `vxil billing status|upgrade --tier <t>` — your projects and the bound project's plan. `projects rm` deletes any project you own after you type its slug; `billing upgrade` prints the hosted checkout URL (never opens a browser) and also downgrades (`--tier free`).
+- `vxil files put <path> --user <id>`, `vxil webhooks sources add|list|rm|test`, `vxil webhooks events replay|runs`, `vxil cms bulk-rm <collection> --filter '<json>' [--dry-run]`, `vxil search sync run|reset <key> [--purge]`, `vxil users import <file>` — the operator actions where the CLI adds something a raw call cannot (bytes from disk, a print-once receiver URL, a dry run before a typed confirm, a chunked bulk). Everything else the dashboard does per feature is one `vxil api` line: `vxil api --help`.
+- `vxil gen --offline --check` ignores the pinned API majors (only the online generator knows them), so an online-generated `vxil.types.ts` passes the offline gate.
 - `vxil api <METHOD> <path> ['<json>' | --data '<json>']` — call any `/v1` route; bare JSON on stdout, banner on stderr.
 - `vxil secrets list --all-projects` — the names-and-metadata matrix across every bound project (values never come back).
 - `vxil migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run]` — backfill subscriptions through the server sync leg; resumable.

package/dist/_vxil-feature-configs-apiState.d.ts

@@ -0,0 +1,181 @@
+import type { DeclaredRlPolicy, DeclaredWebhookSubscription } from './_vxil-feature-configs.js';
+/** The target_url path markers of the platform's function-delivery lanes
+ *  (control-plane fnCmsHooks.ts FN_CMSHOOK_PATH / FN_AUTHHOOK_PATH /
+ *  FN_WEBHOOK_TRIGGER_PATH — mirrored here because this package is
+ *  typebox-only). A subscription on one of them is derived from the functions
+ *  manifest by the deploy reconciler: never declarable, never "undeclared". */
+export declare const FN_TRIGGER_TARGET_MARKERS: readonly ["/v1/internal/fn/cms-hook/", "/v1/internal/fn/auth-hook/", "/v1/internal/fn/trigger/"];
+export declare function isFnTriggerSubscriptionUrl(targetUrl: string): boolean;
+export type ApiStateDatum = 'policies' | 'subscriptions' | 'templates';
+/** feature → the declared-API-state datum its config block may carry. */
+export declare const API_STATE_DATUMS: ReadonlyArray<{
+    feature: string;
+    datum: ApiStateDatum;
+}>;
+export declare function apiStateDatumOf(feature: string): ApiStateDatum | null;
+/** The declared list a validated manifest carries for its feature's datum, or
+ *  null when the feature has no datum / the block is absent. An absent block
+ *  means "not managed by config" (nothing converges, nothing is reported) —
+ *  distinct from an EMPTY array, which declares "there should be none". */
+export declare function declaredApiState(feature: string, manifest: Record<string, unknown> | null | undefined): {
+    datum: ApiStateDatum;
+    declared: unknown[];
+} | null;
+/** ONE row of GET /v1/rate-limits/policies (rate-limits-v1 core.ts Policy). */
+export interface LiveRlPolicy {
+    policy_id: string;
+    name: string;
+    key_template: string;
+    limit: number;
+    window_seconds: number;
+    behavior: string;
+    /** absent on a policy stored before the token-bucket pass → 'sliding_window' */
+    algorithm?: string;
+}
+/** The PUT /v1/rate-limits/policies/:id body the converge sends (core.ts
+ *  UpdateBody minus `name`, which is the key). */
+export interface RlPolicyPatch {
+    limit?: number;
+    window_seconds?: number;
+    behavior?: 'block' | 'shape';
+    algorithm?: 'sliding_window' | 'token_bucket';
+}
+export declare const RL_DEFAULT_BEHAVIOR: "block";
+export declare const RL_DEFAULT_ALGORITHM: "sliding_window";
+export interface RlPolicyPlan {
+    create: DeclaredRlPolicy[];
+    update: Array<{
+        policy_id: string;
+        name: string;
+        patch: RlPolicyPatch;
+        changed: string[];
+    }>;
+    /** `key_template` differs — the update route cannot change it, so the only
+     *  fix is delete+recreate (a NEW policy_id): destructive-shaped. */
+    recreate: Array<{
+        policy_id: string;
+        name: string;
+        declared: DeclaredRlPolicy;
+    }>;
+    unchanged: string[];
+    /** live rows the config does not declare (left in place by default) */
+    undeclared: Array<{
+        policy_id: string;
+        name: string;
+    }>;
+    /** a declared name matched by MORE THAN ONE live row — names are not a
+     *  unique key on the route, so the converge cannot pick; nothing is touched */
+    ambiguous: Array<{
+        name: string;
+        count: number;
+    }>;
+}
+export declare function planRlPolicies(declared: readonly DeclaredRlPolicy[], live: readonly LiveRlPolicy[]): RlPolicyPlan;
+/** ONE row of GET /v1/webhooks/subscriptions (state 'deleted' never listed). */
+export interface LiveWebhookSubscription {
+    sub_id: string;
+    target_url: string;
+    event_prefixes: string[];
+    state?: string;
+}
+export interface WebhookSubscriptionPlan {
+    create: DeclaredWebhookSubscription[];
+    /** the prefix SET differs — `PATCH /v1/webhooks/subscriptions/:subId
+     *  { event_prefixes }` (2026-09-25) changes it in place: the sub_id and the
+     *  cursor are kept, so this is an ordinary update, not destructive-shaped
+     *  (before 2026-09-25 it was delete+recreate under --allow-destructive). */
+    update: Array<{
+        sub_id: string;
+        target_url: string;
+        event_prefixes: string[];
+    }>;
+    unchanged: string[];
+    /** live rows the config does not declare, EXCLUDING the function-delivery
+     *  lanes (those derive from the functions manifest) — left in place by default */
+    undeclared: Array<{
+        sub_id: string;
+        target_url: string;
+    }>;
+}
+export declare function planWebhookSubscriptions(declared: readonly DeclaredWebhookSubscription[], live: readonly LiveWebhookSubscription[]): WebhookSubscriptionPlan;
+/** ONE row of GET /v1/ai/templates. `content_sha256` is the canonical hash of
+ *  the LATEST version's {system,user,schema} (@vxil/runtime
+ *  aiTemplateContentSha256), stamped by ai-v1 since 2026-09-23; absent on an
+ *  older server. */
+export interface LiveAiTemplate {
+    name: string;
+    latest_version: number;
+    content_sha256?: string;
+}
+/** A declared template with its content hash pre-computed by the caller (the
+ *  hash is async WebCrypto; this planner stays pure/sync). */
+export interface HashedDeclaredAiTemplate {
+    template: string;
+    content_sha256: string;
+}
+export interface AiTemplatePlan {
+    create: string[];
+    /** content differs → POST a new version (monotonic per name) */
+    update: string[];
+    unchanged: string[];
+    /** stored names the config does not declare — there is NO delete route for
+     *  templates, so these are only ever reported, never removed */
+    undeclared: string[];
+    /** live rows with no `content_sha256` (an older server): the content cannot
+     *  be compared, so each is re-put as `update` and named here */
+    unknownContent: string[];
+}
+export declare function planAiTemplates(declared: readonly HashedDeclaredAiTemplate[], live: readonly LiveAiTemplate[]): AiTemplatePlan;
+export interface ApiStateSummary {
+    datum: ApiStateDatum;
+    created: string[];
+    updated: string[];
+    /** destructive-shaped changes APPLIED under allow-destructive (delete+recreate) */
+    recreated: string[];
+    unchanged: string[];
+    /** live rows the config does not declare — left in place (or, under
+     *  allow-destructive, listed in `deleted` instead) */
+    undeclared: string[];
+    /** undeclared rows DELETED under allow-destructive */
+    deleted: string[];
+    /** destructive-shaped changes NOT applied (need allow-destructive) */
+    pending_destructive: string[];
+    /** declared keys the converge could not resolve (duplicate live rows) */
+    ambiguous: string[];
+    /** rows a route refused (a 4xx) — the converge continues past them */
+    failed: Array<{
+        key: string;
+        error: string;
+    }>;
+}
+export declare function emptyApiStateSummary(datum: ApiStateDatum): ApiStateSummary;
+/** The `api_state` object a config-write response carries (`PUT /v1/config/
+ *  :feature` and its dashboard twin, dry-run included — control-plane
+ *  handlers/apiState.ts apiStateResponseField) and the shape `vxil push` /
+ *  `vxil plan` print. `ok:false` + `deferred:true` = not converged for an
+ *  INDEFINITE reason — the feature worker has not seen the config yet, or a
+ *  transient failure (a push asks again through POST /v1/apply after its
+ *  wait); `ok:false` otherwise = a DEFINITE, named refusal (nothing to retry);
+ *  `note` = converged nothing on purpose (a disabled feature). */
+export interface ApiStateResponseField extends ApiStateSummary {
+    ok: boolean;
+    dry_run?: boolean;
+    deferred?: boolean;
+    error?: string;
+    note?: string;
+}
+/** The note every executor reports for a DISABLED feature whose block still
+ *  declares rows: the declaration is kept in the manifest and nothing is
+ *  converged (a parked feature is not a propagation window — review finding 2). */
+export declare const API_STATE_DISABLED_NOTE = "feature disabled \u2014 declaration kept, not converged";
+/** `GET /v1/rate-limits/policies` is a 100-row HARD cap with no cursor. A list
+ *  AT the cap is not a complete live set, so planning creates against it would
+ *  re-POST every declared name the cap hid (review finding 5). The server's
+ *  converge and the CLI's read-only plan refuse with this message instead. */
+export declare function rlPolicyListCapError(liveCount: number): string | null;
+export declare const RL_POLICY_LIST_CAP = 100;
+/** `+2 created · ~1 updated · =3 unchanged · 1 undeclared (left in place)` —
+ *  the one-line summary `vxil push` prints and the apply journal notes. */
+export declare function formatApiStateSummary(s: ApiStateSummary): string;
+/** The multi-line detail under the summary: one line per named row. */
+export declare function formatApiStateDetail(s: ApiStateSummary): string[];

package/dist/_vxil-feature-configs-canonicalJson.d.ts

@@ -0,0 +1,7 @@
+/** JSON.stringify with object keys sorted at every depth (arrays keep their
+ *  order; undefined-valued keys are dropped, as JSON.stringify drops them).
+ *  Two values with equal output are equal in CONTENT. A stored manifest comes
+ *  back from storage with its object keys re-ordered, so every declared-vs-
+ *  stored config compare (the server's shallowDiff, the CLI's diffManifest)
+ *  must go through this, never through plain JSON.stringify. */
+export declare function canonicalJson(v: unknown): string | undefined;

package/dist/_vxil-feature-configs-readmodels.d.ts

@@ -0,0 +1,38 @@
+export declare const READ_MODEL_LIMITS: {
+    readonly maxReadModels: 20;
+    readonly maxAggregates: 4;
+    readonly maxGroupBy: 2;
+    readonly maxWindowDays: 366;
+    readonly maxSpecBytes: 4096;
+    readonly maxCdcRules: 25;
+};
+/**
+ * Structural validation of a declared read-model `spec` — shared by the
+ * config-write gate here and re-exported for anyone needing the pure check.
+ * `kind` selects the §3.1 (aggregate) or §4.1 (rank) grammar.
+ */
+export declare function validateReadModelSpecShape(where: string, kind: 'aggregate' | 'rank', spec: unknown): string[];
+/** Shape of one declared read-model (mirrors the CmsConfigSchema Record). */
+interface ReadModelDefLike {
+    collection?: string;
+    kind?: string;
+    spec?: unknown;
+    materialize?: {
+        cron?: string;
+        to?: string;
+    };
+    enabled?: boolean;
+}
+/** Cross-field rule for CmsConfig.readModels (called from validateFeatureConfig). */
+export declare function validateReadModelsConfig(readModels: Record<string, ReadModelDefLike> | undefined): string[];
+/** Shape of one CDC rule (mirrors the CmsConfigSchema Record). */
+interface CdcRuleLike {
+    collection?: string;
+    channel?: string;
+    events?: unknown;
+    payload?: unknown;
+    enabled?: boolean;
+}
+/** Cross-field rule for CmsConfig.cdc (called from validateFeatureConfig). */
+export declare function validateCdcConfig(cdc: Record<string, CdcRuleLike> | undefined): string[];
+export {};

package/dist/_vxil-feature-configs.d.ts

@@ -1,8 +1,15 @@
 import { type Static, type TSchema } from '@sinclair/typebox';
 export * from './_vxil-feature-configs-hooks.js';
-export * from './readmodels.js';
-export * from './apiState.js';
+export * from './_vxil-feature-configs-readmodels.js';
+export * from './_vxil-feature-configs-apiState.js';
+export * from './_vxil-feature-configs-canonicalJson.js';
 export declare const RESERVED_CREDIT_TYPES: ReadonlySet<string>;
+/** F33 (2026-09-25): a function binding's `retry.maxAttempts` ceiling, and the
+ *  binding kinds that may carry `retry` — the platform-delivered event lanes
+ *  (an http invoke returns its own status; a cron tick's retry would overlap
+ *  the next tick). Read by the schema, the deploy clamp and the CLI. */
+export declare const FN_RETRY_MAX_ATTEMPTS = 5;
+export declare const FN_RETRY_BINDING_KINDS: ReadonlySet<string>;
 /** True when a credit_type is a vxil-COGS reserved type (grant/consume/config
  *  of which is restricted to internal platform machinery). */
 export declare function isReservedCreditType(creditType: string): boolean;
@@ -38,6 +45,10 @@ export declare function validateNotificationOverrides(templates: {
         text?: string;
     }>>;
 } | undefined): string[];
+/** `notifications.ses.snsTopicArn` grammar: a plain SNS topic ARN (the
+ *  `aws-cn` / `aws-us-gov` partitions included). Mirrored by SNS_TOPIC_ARN_RE
+ *  in the notifications worker's snsIntake.ts. */
+export declare const SNS_TOPIC_ARN_PATTERN = "^arn:aws(-[a-z]+)?:sns:[a-z0-9-]+:\\d{12}:[A-Za-z0-9_-]{1,256}$";
 /** AWS region grammar for `notifications.ses.region` (`us-east-1`,
  * `eu-central-1`, `ap-southeast-2`, `us-gov-west-1`, …): two-letter partition,
  * one or more lowercase words, a single digit. Pinned as a pattern rather than
@@ -56,6 +67,7 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
         region: import("@sinclair/typebox").TString;
         accessKeyIdRef: import("@sinclair/typebox").TString;
         secretAccessKeyRef: import("@sinclair/typebox").TString;
+        snsTopicArn: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>>;
     defaultLocale: import("@sinclair/typebox").TString;
     retry: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
@@ -104,6 +116,49 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
 export type NotificationsConfig = Static<typeof NotificationsConfigSchema>;
 /** The §11b.5 broadcast bag as persisted (present ⇒ leaf defaults applied). */
 export type BroadcastConfig = NonNullable<NotificationsConfig['broadcast']>;
+/** Generation-lifecycle config defaults (jobs.md §11 / §5 ≤15-flag budget). */
+export declare const GENERATION_DEFAULTS: {
+    /** per-tenant in-flight generation cap (separate budget from queue jobs) */
+    readonly maxConcurrent: 20;
+    /** default expiry/timeout when the descriptor omits one — 5 min */
+    readonly defaultTimeoutMs: number;
+    /** hard ceiling a tenant-supplied timeout is clamped to — 1 h */
+    readonly maxTimeoutMs: number;
+    /** poll-mode: how many poll cycles before giving up (→ terminal-fail) */
+    readonly pollMaxAttempts: 60;
+    /** MANDATORY per-hold cap on a `reserve_credits.amount` (clamped, never rejected) */
+    readonly maxReserveCredits: 1000;
+    /** MANDATORY per-tenant ceiling on the sum of un-settled provisional holds */
+    readonly maxOutstandingReserveCredits: 100000;
+};
+/** The inclusive [min, max] each `generation` leaf is clamped to — by the
+ *  schema at config-write time and by jobs-v1 at read time. */
+export declare const GENERATION_BOUNDS: {
+    readonly maxConcurrent: {
+        readonly min: 1;
+        readonly max: 200;
+    };
+    readonly defaultTimeoutMs: {
+        readonly min: 1000;
+        readonly max: 3600000;
+    };
+    readonly maxTimeoutMs: {
+        readonly min: 1000;
+        readonly max: 3600000;
+    };
+    readonly pollMaxAttempts: {
+        readonly min: 1;
+        readonly max: 1000;
+    };
+    readonly maxReserveCredits: {
+        readonly min: 1;
+        readonly max: 1000000;
+    };
+    readonly maxOutstandingReserveCredits: {
+        readonly min: 1;
+        readonly max: 100000000;
+    };
+};
 export declare const JobsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     retry: import("@sinclair/typebox").TObject<{
@@ -614,11 +669,14 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
         trialDays: import("@sinclair/typebox").TInteger;
     }>;
     ledger: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
-        productMap: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
+        productMap: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
             creditType: import("@sinclair/typebox").TString;
             amount: import("@sinclair/typebox").TInteger;
             period: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"once">, import("@sinclair/typebox").TLiteral<"monthly">, import("@sinclair/typebox").TLiteral<"annual">]>;
-        }>>;
+        }>, import("@sinclair/typebox").TObject<{
+            tier: import("@sinclair/typebox").TString;
+            durationDays: import("@sinclair/typebox").TInteger;
+        }>]>>;
         tierMap: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
             entitlements: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
             quotas: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TInteger>;
@@ -657,6 +715,9 @@ export declare const FunctionsConfigSchema: import("@sinclair/typebox").TObject<
             source: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
             collection: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
             event: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            retry: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+                maxAttempts: import("@sinclair/typebox").TInteger;
+            }>>;
         }>>>;
         scriptRef: import("@sinclair/typebox").TString;
         scopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;

package/dist/config.d.ts

@@ -106,6 +106,26 @@ export interface CollectionDef {
  *   session.revoked — auth.session.revoked { user_id, session_id, reason }
  *   signin.failure  — auth.signin.failure { email_hash | user_id, reason } */
 export type AuthHookEvent = 'user.created' | 'session.created' | 'session.revoked' | 'signin.failure';
+/** The opt-in re-delivery of a platform-delivered trigger (F33, 2026-09-25).
+ *  DEFAULT OFF: the platform acknowledges every delivery with a 200 whatever
+ *  the handler returned — an application error is observed (`functions.run.failed`),
+ *  never re-delivered. With `retry` set on a `queue` / `webhook` / `cmsHook` /
+ *  `authHook` trigger, a non-2xx answer of the handler is handed back to the
+ *  jobs retry ladder instead (60 s, 120 s, … backoff) and the last failed
+ *  attempt dead-letters the run (`job.dead_lettered`, replayable from the
+ *  Jobs page). Each attempt is a billed invocation and carries the SAME
+ *  `idempotency_key` — dedupe on it. Effective attempts =
+ *  min(maxAttempts, the project's `jobs.retry.defaultMaxAttempts`, default 5).
+ *  A handler that partially writes and then fails re-fires its downstream
+ *  events on EVERY attempt, so the chain is a tree (up to maxAttempts children
+ *  per hop): the causal-depth guard bounds its length (32 hops), not its size —
+ *  the breaker, the loop guard, the dead-letter quota and the daily share do.
+ *  Write only once you will return 2xx, or dedupe on idempotency_key. Not accepted on `http` (it returns its
+ *  real status to its caller) or `cron` (a retry would overlap the next tick). */
+export interface FunctionTriggerRetry {
+    /** 1–5 attempts in all (1 = a failed attempt dead-letters at once, no re-delivery) */
+    maxAttempts: number;
+}
 /** A function trigger (the §7.3 crossing). cmsHook fires on a CMS write;
  * authHook fires on ONE auth lifecycle event (default `user.created` — the
  * post-signup hook; at-least-once, ~1min fanout latency). */
@@ -118,6 +138,7 @@ export type FunctionTrigger = {
 } | {
     kind: 'queue';
     source: string;
+    retry?: FunctionTriggerRetry;
 }
 /** `webhook`: the function is woken by a webhook_subscription fan-out whose
  *  target_url is `<edge>/v1/internal/fn/trigger/<name>?tenant=<id>`. That
@@ -132,6 +153,7 @@ export type FunctionTrigger = {
  | {
     kind: 'webhook';
     source: string;
+    retry?: FunctionTriggerRetry;
 }
 /** `cmsHook`: fires after a CMS write in `collection`. The platform filters
  *  deliveries on the binding (2026-09-19): `beforeCreate` → created only,
@@ -142,15 +164,26 @@ export type FunctionTrigger = {
     kind: 'cmsHook';
     collection: string;
     event: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite';
+    retry?: FunctionTriggerRetry;
 } | {
     kind: 'authHook';
     event?: AuthHookEvent;
+    retry?: FunctionTriggerRetry;
 };
 /** A deployed tenant function — source in functions/, deployed on `vxil push`. */
 export interface FunctionDef {
     /** path to the ES-module entrypoint, e.g. ./functions/<name>.ts */
     entry: string;
     trigger?: FunctionTrigger;
+    /** Further bindings beside `trigger` (2026-09-25): a function is code + a SET
+     *  of trigger bindings, so one bundle can be reached by several front doors —
+     *  a webhook AND a cron, an http door AND a cmsHook. `trigger` and `triggers`
+     *  may both be present; the deploy carries them in that order as
+     *  `bindings[]`, at most 8 in all (the CLI refuses a 9th before the wire).
+     *  Every binding lands the same isolate; only the envelope's `trigger` /
+     *  `payload` differ. Each platform-delivered binding is billed per
+     *  invocation and bounded by the loop guard and the breaker. */
+    triggers?: FunctionTrigger[];
     /** clamped by DENY_FUNCTION_SCOPES at deploy (admin, wildcard, features:write,
      *  functions:write, secrets:write rejected; payments:write / notifications:send /
      *  users:* allowed as owner-granted business scopes). */