@vxil/cli

The Vxil CLI — config-as-code for backend building blocks you enable in one line. The package is @vxil/cli and it installs the vxil command — the bare vxil name on npm is blocked, so always install the scoped package. It needs Node.js 24 or newer.

npx @vxil/cli quickstart          # create a tenant + scaffold vxil.config.ts
npx @vxil/cli push                # apply your config (features, cms collections, functions)
npx @vxil/cli gen                 # generate a typed client + MCP manifest for YOUR backend
npx @vxil/cli functions dev fn    # run a tenant function locally against the remote edge
npx @vxil/cli listen --forward-to localhost:3000/webhook   # forward inbound webhook events to your local server
npx @vxil/cli mcp install --client cursor   # wire your backend's MCP server into your editor's agent
npx @vxil/cli doctor              # keys, URLs, reachability + secrets referenced-vs-stored + per-function hashes
npx @vxil/cli diff --against staging   # CI drift gate vs a named slot: exit 0 no drift · 1 drift · 2 error

Config-as-code lives in vxil.config.ts, typed by @vxil/config (also bundled as the @vxil/cli/config subpath):

import { defineConfig } from '@vxil/config';

export default defineConfig({
  // (a) per-feature config — the same typed manifests the server validates
  features: {
    auth: { enabled: true },
    cms: { enabled: true, draftPublish: true },
    // provider 'resend' needs its key: `vxil secrets set RESEND_API_KEY` (or use provider: 'mock' to try it)
    notifications: { enabled: true, provider: 'resend', resendApiKeyRef: 'secret:RESEND_API_KEY', fromEmail: '[email protected]' },
  },
  // (b) CMS schema-as-code — collections + fields, reconciled by `vxil push`
  cms: {
    collections: {
      tasks: {
        fields: {
          title: { type: 'string', required: true, indexSlot: 's1' },
          done: { type: 'bool' },
        },
      },
    },
  },
});

Verbs: init templates quickstart try login link keys account logout invites members projects billing plan push pull diff gen doctor architect versions rollback secrets env seed export import functions listen mcp cms files webhooks search dev payments migrate config users send deliveries api.

vxil quickstart [--features a,b] [--invite <code>] [--env <label>] [--dev [--ttl <h>]] [--no-push] is the front door; vxil api --help prints the operator cheat-sheet — every dashboard action as one vxil api line.

Every verb names its target. --dev selects the dev slot, --target <name> a named slot bound by vxil link <slug> --as <name> (which merges into the existing binding rather than replacing it). The selector is fail-closed — an unbound slot exits 1 telling you the fix, and never falls through to another tenant — and every write verb prints a target banner (slug + env, never a key) before it acts.

• vxil plan --explain — the config plan with every leaf tagged declared or default.
• vxil push [--skip-functions] — apply schema → config → functions; a project below the functions plan is stopped before anything is pushed, and --skip-functions pushes the rest.
• vxil diff [--against <target>] [--ignore <k,…>] [--strict-secrets] [--strict-runtime] — the CI drift gate; secrets compared by name only, and a referenced-but-unstored name is informational unless --strict-secrets. A function whose only difference is a platform setting — the functions runtime (compatibility date/flags) or the plan's CPU limit — is listed with reason: runtime <old> → <new> / reason: cpu-limit <old> ms → <new> ms and is informational under the gate (--exit-code / --against: exit 0) unless --strict-runtime — a plain vxil diff still counts it; vxil plan shows the same reason, and vxil push redeploys it under the new settings.
• vxil doctor — preflight: secrets referenced-vs-stored (advisory, names only) plus a served / published / local hash verdict per function. Under --json stdout is one JSON document; notices go to stderr.
• vxil link <slug> — reuses the key already stored for the slug on this machine; --mint for a fresh one, --key to hand one in.
• vxil keys mint --name <name> --scopes <a,b,c> [--env live|test] [--store] — mint a narrow key for a server (scopes validated locally; admin refused); the key prints once to stdout (--json → { api_key, key_id, scopes }) and is never stored unless --store. vxil keys list shows names, ids, scopes, created and last-used (never secrets); vxil keys revoke <key_id> [--yes] asks you to type the id, and refuses the key the CLI itself is using unless --yes. Needs a dashboard session (vxil login, or it prompts at a terminal; a piped / --json run fails with that remedy instead — pass --email/--password to script it, which never stores the session).
• vxil cms drop <collection> [--purge-rows] [--yes] — remove one collection definition through the same guarded ack push --allow-destructive uses (rows are retained, and a re-create brings them back; --purge-rows hard-deletes them too, and on a collection dropped earlier deletes its retained rows).
• vxil members list|invite|add|rm|uninvite and vxil invites accept <token|url> — the bound project's team from the terminal (your vxil login session): invite by e-mail with a role, add an existing account (also how you change a role), remove (typed e-mail, refuses the last owner), revoke a pending invitation, accept one.
• vxil projects list|create|rm and vxil billing status|upgrade --tier <t> — your projects and the bound project's plan. projects rm deletes any project you own after you type its slug; billing upgrade prints the hosted checkout URL (never opens a browser) and also downgrades (--tier free).
• vxil files put <path> --user <id>, vxil webhooks sources add|list|rm|test, vxil webhooks events replay|runs, vxil cms bulk-rm <collection> --filter '<json>' [--dry-run], vxil search sync run|reset <key> [--purge], vxil users import <file> — the operator actions where the CLI adds something a raw call cannot (bytes from disk, a print-once receiver URL, a dry run before a typed confirm, a chunked bulk). Everything else the dashboard does per feature is one vxil api line: vxil api --help.
• vxil gen --offline --check ignores the pinned API majors (only the online generator knows them), so an online-generated vxil.types.ts passes the offline gate.
• vxil api <METHOD> <path> ['<json>' | --data '<json>'] — call any /v1 route; bare JSON on stdout, banner on stderr.
• vxil secrets list --all-projects — the names-and-metadata matrix across every bound project (values never come back).
• vxil migrate payments --from-provider stripe|paddle|paypal|revenuecat (--customers <f.csv> | --all) [--dry-run] — backfill subscriptions through the server sync leg; resumable.
• vxil payments simulate --scenario <s> --user <id> [--tier <t>] — mock/dev projects only: drive a refund pair, cross-platform unlock, renewal, expiry, past-due grace or transfer and check the oracle.

vxil listen --forward-to <url> polls your tenant's inbound webhook events and re-POSTs each new one to your local server under the exact delivery contract production uses — same body shape, same signed X-Vxil-Jobs-Signature header (your real signing secret) — so the handler you test locally is the handler you ship. --replay-last <n> re-forwards recent events; --raw posts the stored provider payload alone.

Docs: vxil.com · Dashboard: vxil.com/dashboard

MIT © techmaker.io