@vxil/cli 0.7.0 → 0.8.0

package/README.md

@@ -39,7 +39,9 @@ export default defineConfig({
 });
 ```
 
-Verbs: `init templates quickstart try login link keys plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms dev payments migrate config users send deliveries api`.
+Verbs: `init templates quickstart try login link keys account logout invites members projects billing plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms files webhooks search dev payments migrate config users send deliveries api`.
+
+`vxil quickstart [--features a,b] [--invite <code>] [--env <label>] [--dev [--ttl <h>]] [--no-push]` is the front door; `vxil api --help` prints the operator cheat-sheet — every dashboard action as one `vxil api` line.
 
 **Every verb names its target.** `--dev` selects the dev slot, `--target <name>` a named slot bound by `vxil link <slug> --as <name>` (which merges into the existing binding rather than replacing it). The selector is **fail-closed** — an unbound slot exits 1 telling you the fix, and never falls through to another tenant — and every write verb prints a target banner (slug + env, never a key) before it acts.
 
@@ -50,6 +52,10 @@ Verbs: `init templates quickstart try login link keys plan push pull diff gen do
 - `vxil link <slug>` — reuses the key already stored for the slug on this machine; `--mint` for a fresh one, `--key` to hand one in.
 - `vxil keys mint --name <name> --scopes <a,b,c> [--env live|test] [--store]` — mint a **narrow** key for a server (scopes validated locally; `admin` refused); the key prints **once** to stdout (`--json` → `{ api_key, key_id, scopes }`) and is never stored unless `--store`. `vxil keys list` shows names, ids, scopes, created and last-used (never secrets); `vxil keys revoke <key_id> [--yes]` asks you to type the id, and refuses the key the CLI itself is using unless `--yes`. Needs a dashboard session (`vxil login`, or it prompts at a terminal; a piped / `--json` run fails with that remedy instead — pass `--email`/`--password` to script it, which never stores the session).
 - `vxil cms drop <collection> [--yes]` — remove one collection definition through the same guarded ack `push --allow-destructive` uses (rows are retained).
+- `vxil members list|invite|add|rm|uninvite` and `vxil invites accept <token|url>` — the bound project's team from the terminal (your `vxil login` session): invite by e-mail with a role, add an existing account (also how you change a role), remove (typed e-mail, refuses the last owner), revoke a pending invitation, accept one.
+- `vxil projects list|create|rm` and `vxil billing status|upgrade --tier <t>` — your projects and the bound project's plan. `projects rm` deletes any project you own after you type its slug; `billing upgrade` prints the hosted checkout URL (never opens a browser) and also downgrades (`--tier free`).
+- `vxil files put <path> --user <id>`, `vxil webhooks sources add|list|rm|test`, `vxil webhooks events replay|runs`, `vxil cms bulk-rm <collection> --filter '<json>' [--dry-run]`, `vxil search sync run|reset <key> [--purge]`, `vxil users import <file>` — the operator actions where the CLI adds something a raw call cannot (bytes from disk, a print-once receiver URL, a dry run before a typed confirm, a chunked bulk). Everything else the dashboard does per feature is one `vxil api` line: `vxil api --help`.
+- `vxil gen --offline --check` ignores the pinned API majors (only the online generator knows them), so an online-generated `vxil.types.ts` passes the offline gate.
 - `vxil api <METHOD> <path> ['<json>' | --data '<json>']` — call any `/v1` route; bare JSON on stdout, banner on stderr.
 - `vxil secrets list --all-projects` — the names-and-metadata matrix across every bound project (values never come back).
 - `vxil migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run]` — backfill subscriptions through the server sync leg; resumable.

package/dist/_vxil-feature-configs-apiState.d.ts

@@ -80,12 +80,14 @@ export interface LiveWebhookSubscription {
 }
 export interface WebhookSubscriptionPlan {
     create: DeclaredWebhookSubscription[];
-    /** the prefix SET differs — there is no update route, so delete+recreate (a
-     *  NEW sub_id, and the watermark restarts at "now"): destructive-shaped. */
-    recreate: Array<{
+    /** the prefix SET differs — `PATCH /v1/webhooks/subscriptions/:subId
+     *  { event_prefixes }` (2026-09-25) changes it in place: the sub_id and the
+     *  cursor are kept, so this is an ordinary update, not destructive-shaped
+     *  (before 2026-09-25 it was delete+recreate under --allow-destructive). */
+    update: Array<{
         sub_id: string;
         target_url: string;
-        declared: DeclaredWebhookSubscription;
+        event_prefixes: string[];
     }>;
     unchanged: string[];
     /** live rows the config does not declare, EXCLUDING the function-delivery

package/dist/_vxil-feature-configs.d.ts

@@ -4,6 +4,12 @@ export * from './_vxil-feature-configs-readmodels.js';
 export * from './_vxil-feature-configs-apiState.js';
 export * from './_vxil-feature-configs-canonicalJson.js';
 export declare const RESERVED_CREDIT_TYPES: ReadonlySet<string>;
+/** F33 (2026-09-25): a function binding's `retry.maxAttempts` ceiling, and the
+ *  binding kinds that may carry `retry` — the platform-delivered event lanes
+ *  (an http invoke returns its own status; a cron tick's retry would overlap
+ *  the next tick). Read by the schema, the deploy clamp and the CLI. */
+export declare const FN_RETRY_MAX_ATTEMPTS = 5;
+export declare const FN_RETRY_BINDING_KINDS: ReadonlySet<string>;
 /** True when a credit_type is a vxil-COGS reserved type (grant/consume/config
  *  of which is restricted to internal platform machinery). */
 export declare function isReservedCreditType(creditType: string): boolean;
@@ -39,6 +45,10 @@ export declare function validateNotificationOverrides(templates: {
         text?: string;
     }>>;
 } | undefined): string[];
+/** `notifications.ses.snsTopicArn` grammar: a plain SNS topic ARN (the
+ *  `aws-cn` / `aws-us-gov` partitions included). Mirrored by SNS_TOPIC_ARN_RE
+ *  in the notifications worker's snsIntake.ts. */
+export declare const SNS_TOPIC_ARN_PATTERN = "^arn:aws(-[a-z]+)?:sns:[a-z0-9-]+:\\d{12}:[A-Za-z0-9_-]{1,256}$";
 /** AWS region grammar for `notifications.ses.region` (`us-east-1`,
  * `eu-central-1`, `ap-southeast-2`, `us-gov-west-1`, …): two-letter partition,
  * one or more lowercase words, a single digit. Pinned as a pattern rather than
@@ -57,6 +67,7 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
         region: import("@sinclair/typebox").TString;
         accessKeyIdRef: import("@sinclair/typebox").TString;
         secretAccessKeyRef: import("@sinclair/typebox").TString;
+        snsTopicArn: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>>;
     defaultLocale: import("@sinclair/typebox").TString;
     retry: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
@@ -105,6 +116,49 @@ export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObj
 export type NotificationsConfig = Static<typeof NotificationsConfigSchema>;
 /** The §11b.5 broadcast bag as persisted (present ⇒ leaf defaults applied). */
 export type BroadcastConfig = NonNullable<NotificationsConfig['broadcast']>;
+/** Generation-lifecycle config defaults (jobs.md §11 / §5 ≤15-flag budget). */
+export declare const GENERATION_DEFAULTS: {
+    /** per-tenant in-flight generation cap (separate budget from queue jobs) */
+    readonly maxConcurrent: 20;
+    /** default expiry/timeout when the descriptor omits one — 5 min */
+    readonly defaultTimeoutMs: number;
+    /** hard ceiling a tenant-supplied timeout is clamped to — 1 h */
+    readonly maxTimeoutMs: number;
+    /** poll-mode: how many poll cycles before giving up (→ terminal-fail) */
+    readonly pollMaxAttempts: 60;
+    /** MANDATORY per-hold cap on a `reserve_credits.amount` (clamped, never rejected) */
+    readonly maxReserveCredits: 1000;
+    /** MANDATORY per-tenant ceiling on the sum of un-settled provisional holds */
+    readonly maxOutstandingReserveCredits: 100000;
+};
+/** The inclusive [min, max] each `generation` leaf is clamped to — by the
+ *  schema at config-write time and by jobs-v1 at read time. */
+export declare const GENERATION_BOUNDS: {
+    readonly maxConcurrent: {
+        readonly min: 1;
+        readonly max: 200;
+    };
+    readonly defaultTimeoutMs: {
+        readonly min: 1000;
+        readonly max: 3600000;
+    };
+    readonly maxTimeoutMs: {
+        readonly min: 1000;
+        readonly max: 3600000;
+    };
+    readonly pollMaxAttempts: {
+        readonly min: 1;
+        readonly max: 1000;
+    };
+    readonly maxReserveCredits: {
+        readonly min: 1;
+        readonly max: 1000000;
+    };
+    readonly maxOutstandingReserveCredits: {
+        readonly min: 1;
+        readonly max: 100000000;
+    };
+};
 export declare const JobsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     retry: import("@sinclair/typebox").TObject<{
@@ -615,11 +669,14 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
         trialDays: import("@sinclair/typebox").TInteger;
     }>;
     ledger: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
-        productMap: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
+        productMap: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
             creditType: import("@sinclair/typebox").TString;
             amount: import("@sinclair/typebox").TInteger;
             period: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"once">, import("@sinclair/typebox").TLiteral<"monthly">, import("@sinclair/typebox").TLiteral<"annual">]>;
-        }>>;
+        }>, import("@sinclair/typebox").TObject<{
+            tier: import("@sinclair/typebox").TString;
+            durationDays: import("@sinclair/typebox").TInteger;
+        }>]>>;
         tierMap: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
             entitlements: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
             quotas: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TInteger>;
@@ -658,6 +715,9 @@ export declare const FunctionsConfigSchema: import("@sinclair/typebox").TObject<
             source: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
             collection: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
             event: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            retry: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+                maxAttempts: import("@sinclair/typebox").TInteger;
+            }>>;
         }>>>;
         scriptRef: import("@sinclair/typebox").TString;
         scopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;

package/dist/config.d.ts

@@ -106,6 +106,26 @@ export interface CollectionDef {
  *   session.revoked — auth.session.revoked { user_id, session_id, reason }
  *   signin.failure  — auth.signin.failure { email_hash | user_id, reason } */
 export type AuthHookEvent = 'user.created' | 'session.created' | 'session.revoked' | 'signin.failure';
+/** The opt-in re-delivery of a platform-delivered trigger (F33, 2026-09-25).
+ *  DEFAULT OFF: the platform acknowledges every delivery with a 200 whatever
+ *  the handler returned — an application error is observed (`functions.run.failed`),
+ *  never re-delivered. With `retry` set on a `queue` / `webhook` / `cmsHook` /
+ *  `authHook` trigger, a non-2xx answer of the handler is handed back to the
+ *  jobs retry ladder instead (60 s, 120 s, … backoff) and the last failed
+ *  attempt dead-letters the run (`job.dead_lettered`, replayable from the
+ *  Jobs page). Each attempt is a billed invocation and carries the SAME
+ *  `idempotency_key` — dedupe on it. Effective attempts =
+ *  min(maxAttempts, the project's `jobs.retry.defaultMaxAttempts`, default 5).
+ *  A handler that partially writes and then fails re-fires its downstream
+ *  events on EVERY attempt, so the chain is a tree (up to maxAttempts children
+ *  per hop): the causal-depth guard bounds its length (32 hops), not its size —
+ *  the breaker, the loop guard, the dead-letter quota and the daily share do.
+ *  Write only once you will return 2xx, or dedupe on idempotency_key. Not accepted on `http` (it returns its
+ *  real status to its caller) or `cron` (a retry would overlap the next tick). */
+export interface FunctionTriggerRetry {
+    /** 1–5 attempts in all (1 = a failed attempt dead-letters at once, no re-delivery) */
+    maxAttempts: number;
+}
 /** A function trigger (the §7.3 crossing). cmsHook fires on a CMS write;
  * authHook fires on ONE auth lifecycle event (default `user.created` — the
  * post-signup hook; at-least-once, ~1min fanout latency). */
@@ -118,6 +138,7 @@ export type FunctionTrigger = {
 } | {
     kind: 'queue';
     source: string;
+    retry?: FunctionTriggerRetry;
 }
 /** `webhook`: the function is woken by a webhook_subscription fan-out whose
  *  target_url is `<edge>/v1/internal/fn/trigger/<name>?tenant=<id>`. That
@@ -132,6 +153,7 @@ export type FunctionTrigger = {
  | {
     kind: 'webhook';
     source: string;
+    retry?: FunctionTriggerRetry;
 }
 /** `cmsHook`: fires after a CMS write in `collection`. The platform filters
  *  deliveries on the binding (2026-09-19): `beforeCreate` → created only,
@@ -142,15 +164,26 @@ export type FunctionTrigger = {
     kind: 'cmsHook';
     collection: string;
     event: 'beforeCreate' | 'beforeUpdate' | 'beforeWrite';
+    retry?: FunctionTriggerRetry;
 } | {
     kind: 'authHook';
     event?: AuthHookEvent;
+    retry?: FunctionTriggerRetry;
 };
 /** A deployed tenant function — source in functions/, deployed on `vxil push`. */
 export interface FunctionDef {
     /** path to the ES-module entrypoint, e.g. ./functions/<name>.ts */
     entry: string;
     trigger?: FunctionTrigger;
+    /** Further bindings beside `trigger` (2026-09-25): a function is code + a SET
+     *  of trigger bindings, so one bundle can be reached by several front doors —
+     *  a webhook AND a cron, an http door AND a cmsHook. `trigger` and `triggers`
+     *  may both be present; the deploy carries them in that order as
+     *  `bindings[]`, at most 8 in all (the CLI refuses a 9th before the wire).
+     *  Every binding lands the same isolate; only the envelope's `trigger` /
+     *  `payload` differ. Each platform-delivered binding is billed per
+     *  invocation and bounded by the loop guard and the breaker. */
+    triggers?: FunctionTrigger[];
     /** clamped by DENY_FUNCTION_SCOPES at deploy (admin, wildcard, features:write,
      *  functions:write, secrets:write rejected; payments:write / notifications:send /
      *  users:* allowed as owner-granted business scopes). */