@getxflow/cli 0.20.1 → 0.21.0

package/dist/bin.js

@@ -27,7 +27,9 @@ const skills_1 = require("./commands/skills");
 const sources_1 = require("./commands/sources");
 const storage_1 = require("./commands/storage");
 const deploy_1 = require("./commands/deploy");
+const dev_1 = require("./commands/dev");
 const update_1 = require("./commands/update");
+/** A command that wraps another process answers with its exit code. */
 async function run(args) {
     const [first, second] = args.words;
     const rest = { ...args, words: args.words.slice(1) };
@@ -195,6 +197,8 @@ async function run(args) {
         case 'status':
             await (0, sources_1.status)();
             return;
+        case 'dev':
+            return (0, dev_1.dev)();
         case 'pull':
             await (0, sources_1.pull)(rest);
             return;
@@ -281,8 +285,7 @@ async function main() {
     let nudgeCovered = args.words[0] === 'update';
     try {
         (0, flags_1.checkFlags)(args);
-        await run(args);
-        return 0;
+        return (await run(args)) ?? 0;
     }
     catch (e) {
         if (e instanceof api_1.ApiError) {

package/dist/commands/db.js

@@ -56,7 +56,7 @@ async function dbStatus(args) {
         return;
     }
     const { root, config } = (0, config_1.requireProject)();
-    const client = (0, session_1.connect)(config);
+    const client = await (0, session_1.connectProject)(config.projectId, root, config);
     const local = readMigrations(root);
     const history = await (0, api_1.apiJson)(client, `/api/v1/projects/${config.projectId}/db/migrate`);
     const applied = new Map(history.applied.map((row) => [row.name, row]));
@@ -224,7 +224,7 @@ async function dbQuery(args) {
 }
 async function dbMigrate(args) {
     const { root, config } = (0, config_1.requireProject)();
-    const client = (0, session_1.connect)(config);
+    const client = await (0, session_1.connectProject)(config.projectId, root, config);
     const migrations = requireMigrations(root);
     const dryRun = (0, args_1.flagBool)(args, 'dry-run');
     (0, ui_1.step)(dryRun ? `Checking the migrations (${migrations.length} in the directory)` : `Applying the migrations (${migrations.length} in the directory)`);

package/dist/commands/deploy.js

@@ -185,7 +185,7 @@ async function deploy(args) {
     (0, ui_1.note)((0, ui_1.dim)('  Show the new pages to visitors: xflow publish'));
 }
 async function publish(args) {
-    const { projectId, client } = await (0, session_1.projectTarget)(args, { probe: true });
+    const { projectId, client } = await (0, session_1.projectTarget)(args);
     (0, ui_1.step)('Publishing the current dev version');
     const result = await (0, api_1.apiJson)(client, `/api/v1/projects/${projectId}/publish`, { method: 'POST', timeoutMs: 120_000 });
     if (result.already_published) {
@@ -203,7 +203,7 @@ async function rollback(args) {
     if (!deployId) {
         throw new errors_1.CliError('A version number is required', 'To see the versions: xflow deployments. For example: xflow rollback 481203');
     }
-    const { projectId, client } = await (0, session_1.projectTarget)(args, { probe: true });
+    const { projectId, client } = await (0, session_1.projectTarget)(args);
     const result = await (0, api_1.apiJson)(client, `/api/v1/projects/${projectId}/rollback`, { method: 'POST', body: { deploy_id: deployId } });
     (0, ui_1.ok)(`The project now serves the pages of build ${result.deploy_id}`);
     (0, ui_1.out)(result.project_url);
@@ -216,7 +216,7 @@ async function rollback(args) {
     (0, ui_1.note)((0, ui_1.dim)('  Visitors see these pages only after xflow publish'));
 }
 async function deployments(args) {
-    const { projectId, client } = await (0, session_1.projectTarget)(args, { probe: true });
+    const { projectId, client } = await (0, session_1.projectTarget)(args);
     const data = await (0, api_1.apiJson)(client, `/api/v1/projects/${projectId}/deployments`);
     if (data.deployments.length === 0) {
         (0, ui_1.note)('No versions yet. To build and release: xflow deploy');

package/dist/commands/dev.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dev = dev;
+const node_os_1 = require("node:os");
+const config_1 = require("../config");
+const errors_1 = require("../errors");
+const session_1 = require("../session");
+const spawn_1 = require("../spawn");
+const template_1 = require("../template");
+/**
+ * The local dev server, handed the key this CLI picks for the project. The template
+ * proxy trades it for a pass on every function call, so which organization holds the
+ * project is decided here, by the rule every other command follows.
+ *
+ * Answers with the exit code of the server.
+ */
+async function dev() {
+    const { root, config } = (0, config_1.requireProject)();
+    const client = await (0, session_1.connectProject)(config.projectId, root, config);
+    const env = {
+        ...process.env,
+        XFLOW_TOKEN: client.token,
+        // The proxy sends the key to this address unchecked, and the environment beats
+        // .env: pinned here, the key goes only to the platform that issued it.
+        VITE_XFLOW_API_URL: (0, template_1.envApiUrl)(client.apiUrl),
+    };
+    // Ctrl+C reaches the server on its own; staying alive until it is gone is what
+    // hands its exit code back instead of leaving it to print over the prompt.
+    process.on('SIGINT', () => { });
+    const result = (0, spawn_1.run)('npm', ['run', 'dev'], { stdio: 'inherit', cwd: root, env });
+    if (result.error) {
+        throw new errors_1.CliError(`Could not start npm run dev: ${result.error.message}`, 'npm ships with Node.js: check that npm works in this terminal');
+    }
+    // Killed by a signal: the code a shell would report for it.
+    const signal = result.signal ? node_os_1.constants.signals[result.signal] : 0;
+    return result.status ?? 128 + signal;
+}

package/dist/commands/env.js

@@ -104,7 +104,8 @@ async function envList(args) {
 /** Check that every referenced variable is stored. */
 async function envCheck() {
     const { root, config } = (0, config_1.requireProject)();
-    const { names } = await fetchVariables((0, session_1.connect)(config), config.projectId);
+    const client = await (0, session_1.connectProject)(config.projectId, root, config);
+    const { names } = await fetchVariables(client, config.projectId);
     const { needed, provided, opaque } = referencedByFunctions(root);
     if (needed.size === 0 && provided.size === 0 && opaque.size === 0) {
         (0, ui_1.note)('The functions of this project read no environment variables');
@@ -159,7 +160,7 @@ async function envCheck() {
 }
 async function envSet(args) {
     const { root, config } = (0, config_1.requireProject)();
-    const client = (0, session_1.connect)(config);
+    const client = await (0, session_1.connectProject)(config.projectId, root, config);
     const pair = args.words[1];
     if (!pair || !pair.includes('=')) {
         throw new errors_1.CliError('A NAME=value pair is required', 'For example: xflow env set SMTP_PASSWORD=secret');

package/dist/commands/projects.js

@@ -98,7 +98,7 @@ async function init(args) {
     (0, ui_1.out)(`  ${(0, ui_1.bold)('Next:')}`);
     (0, ui_1.out)(`    cd ${(0, node_path_1.basename)(target)}`);
     (0, ui_1.out)('    npm install');
-    (0, ui_1.out)('    npm run dev        # develop');
+    (0, ui_1.out)('    xflow dev          # develop');
     (0, ui_1.out)('    xflow deploy       # send the code, build and release');
 }
 /**
@@ -160,7 +160,7 @@ async function link(args) {
     if (client.organizationId)
         (0, config_1.writeState)(dir, { organizationId: client.organizationId });
     (0, template_1.writePlatformEnv)(dir, card.project_token, client.apiUrl, card.functions);
-    (0, ui_1.note)((0, ui_1.dim)('  .env now points at this project'));
+    (0, ui_1.note)((0, ui_1.dim)('  .env now points at this project, run it locally with xflow dev'));
     const skillReady = (0, skills_1.installSkillQuietly)(dir);
     (0, ui_1.ok)(`The folder is linked to the project "${card.name}"`);
     (0, ui_1.note)((0, ui_1.dim)(`  ${(0, node_path_1.join)(dir, config_1.CONFIG_FILE)}`));
@@ -210,7 +210,7 @@ async function list() {
     const orgs = (0, credentials_1.listOrgs)(client.apiUrl);
     if (client.source === 'active' && orgs.length > 1) {
         const name = orgs.find((org) => org.active)?.name;
-        (0, ui_1.note)((0, ui_1.dim)(`  Projects of ${name ? `"${name}"` : 'the active organization'} alone: the rest of xflow org answer after org switch`));
+        (0, ui_1.note)((0, ui_1.dim)(`  Projects of ${name ? `"${name}"` : 'the active organization'} only. For another organization: xflow org switch <name or id>`));
     }
 }
 async function get(args) {

package/dist/commands/skills.js

@@ -53,7 +53,7 @@ This project is hosted on the XFlow platform and ships through the \`xflow\` CLI
 through a git push. Read \`${exports.SKILL_IN_PROJECT}\` before deploying, publishing,
 rolling back, touching the database or migrations, cloud functions, schedules,
 environment variables, file storage and uploads, connected accounts or production logs.
-Command list: \`xflow help\`.
+Run the app locally with \`xflow dev\`. Command list: \`xflow help\`.
 `;
 /** The skill ships inside the package, next to dist. */
 function skillSource() {

package/dist/flags.js

@@ -82,6 +82,7 @@ exports.KNOWN = {
     'storage rm': ['folder', 'yes', 'project'],
     'storage remove': ['folder', 'yes', 'project'],
     status: [],
+    dev: [],
     pull: ['into', 'force', 'revision'],
     deploy: ['no-push', 'force', 'allow-removals', 'message'],
     publish: ['project'],
@@ -105,6 +106,7 @@ exports.WORKING_COPY = {
     deploy: 'it sends the sources next to it',
     pull: 'it writes the sources next to it',
     status: 'it compares the folder with the revision on the platform',
+    dev: 'it runs the dev server of the code next to it',
     'db migrate': 'it applies the files of migrations/',
     'env check': 'it looks for the variables the code of the functions reads',
     'env set': 'it names the functions that need a deploy for the value to arrive',

package/dist/help.js

@@ -40,6 +40,7 @@ ${(0, ui_1.bold)('Getting started')}
   xflow init [dir]                new project from the platform template
   xflow templates                 which templates are available
   xflow link <id>                 link this folder to a project, an empty one also gets the sources
+  xflow dev                       run the app on localhost:3000, cloud functions included
   xflow skills                    pick the agents that get the platform instructions
   xflow mcp install               give the agent platform access without a terminal
 
@@ -163,8 +164,8 @@ and ${(0, ui_1.bold)('connections unlink')} removes the link without naming the
 its variables, for the same reason.
 
 The rest cannot answer without the working copy and have nothing to do with an id
-instead: ${(0, ui_1.bold)('deploy')}, ${(0, ui_1.bold)('pull')}, ${(0, ui_1.bold)('status')}, ${(0, ui_1.bold)('db migrate')}, ${(0, ui_1.bold)('env check')},
-${(0, ui_1.bold)('env set')}. They answer about the files next to them, so
+instead: ${(0, ui_1.bold)('deploy')}, ${(0, ui_1.bold)('pull')}, ${(0, ui_1.bold)('status')}, ${(0, ui_1.bold)('dev')}, ${(0, ui_1.bold)('db migrate')},
+${(0, ui_1.bold)('env check')}, ${(0, ui_1.bold)('env set')}. They answer about the files next to them, so
 they keep asking for a folder. ${(0, ui_1.bold)('projects get')} and ${(0, ui_1.bold)('link')} take no flag either:
 they name the project by its id as an argument.
 
@@ -175,13 +176,14 @@ project, the flag therefore goes somewhere else than the folder does. An id hand
 ${(0, ui_1.bold)('projects get')} or ${(0, ui_1.bold)('link')} behaves the same way: typed by hand, it is not redirected
 by a config lying around either.
 
-The id is echoed back on every run. It is the one place a project is named by hand,
-and a wrong id answers "not found" on a read but works on a write.
+The id is echoed back on every run, with the organization that holds the project. It
+is the one place a project is named by hand, and a wrong id answers "not found" on a
+read but works on a write.
 
 With several organizations signed in, the one holding the project is looked for on
 every call: there is no folder to write the answer into, and a second place to
-remember it would be a second thing to keep true. One ${(0, ui_1.bold)('xflow org switch')} to the
-right organization spares that search.`,
+remember it would be a second thing to keep true. When most calls go to one project,
+${(0, ui_1.bold)('xflow org switch')} to its organization skips that search.`,
     projects: `${(0, ui_1.bold)('xflow projects')}: the projects of the organization
 
   xflow projects list             every project, its versions state and age
@@ -531,6 +533,20 @@ Plus a few pointer lines in ${(0, ui_1.bold)('AGENTS.md')}. A skill is picked up
 description matches the task, and "add a customers table" will not trigger it. AGENTS.md
 is always read by the agent, which is why the pointer is appended there, at the end of
 the file and once. ${(0, ui_1.bold)('CLAUDE.md')} is left alone: Claude Code reads .claude/skills anyway.`,
+    dev: `${(0, ui_1.bold)('xflow dev')}: run the application on this machine
+
+Runs ${(0, ui_1.bold)('npm run dev')} in the project folder (localhost:3000) with the access key of the
+organization that holds the project. The dev server trades that key for a visitor pass,
+so the cloud functions answer here the way they do on the platform. The key is picked
+as for every other command (${(0, ui_1.bold)('xflow help org')}): with several organizations signed
+in, the right one is found and the folder is bound to it.
+
+Use it instead of a bare ${(0, ui_1.bold)('npm run dev')}, which gets no key from here: its function
+calls fail, or go out under the key of whichever organization is active.
+
+The platform address comes from the CLI too, not from .env, so the key goes to the
+platform that issued it and nowhere else. It never reaches the browser: the page gets
+only the ${(0, ui_1.bold)('VITE_')} variables.`,
     pull: `${(0, ui_1.bold)('xflow pull')}: fetch the sources
 
 By default it fetches the latest revision into the project folder and refuses to write

package/dist/session.js

@@ -103,10 +103,6 @@ async function connectProject(projectId, root, config) {
             (0, ui_1.note)((0, ui_1.dim)(`  The project belongs to "${hit.name ?? hit.organizationId}", not to the active organization: the folder is bound to it`));
         }
     }
-    else if (hit.organizationId !== session.organizationId) {
-        // Nothing was written down, so the next command pays for the same search.
-        (0, ui_1.note)((0, ui_1.dim)(`  The project belongs to "${hit.name ?? hit.organizationId}": xflow org switch spares the next command this search`));
-    }
     return {
         apiUrl: session.apiUrl,
         token: hit.token,
@@ -129,28 +125,30 @@ function isProjectId(value) {
  * the default one or XFLOW_API_URL and nothing else: a config lying around must
  * not be able to redirect a call made by id.
  *
- * `probe` is the difference the folder path already has and keeps: publish,
- * rollback and deployments look for the organization of an unbound folder,
- * everything else takes the key it resolves to. Named by id there is no binding
- * to lean on, so the search always happens.
+ * Either way the key comes from connectProject: an unbound folder gets the
+ * organization of its project looked up once and written down, an id gets it
+ * looked up on every call.
  *
  * `root` is that folder, and null when the id was named: a command that reads the
  * sources for a check of its own then knows the check is not available rather than
  * running it against whatever folder the caller happened to stand in.
  */
-async function projectTarget(args, options) {
+async function projectTarget(args) {
     const named = (0, args_1.flagString)(args, 'project');
     if (named !== undefined) {
         if (!isProjectId(named)) {
             throw new errors_1.CliError(`--project takes a project id, got "${named}"`, 'The ids: xflow projects list');
         }
+        const client = await connectProject(named, null);
         // Echoed back on every human run: the flag is the only place the id is typed by
-        // hand, and a wrong one answers 404 on a read and works on a write. Under --json
+        // hand, and a wrong one answers 404 on a read and works on a write. The
+        // organization is named too, since it may not be the active one. Under --json
         // the line is silenced with the rest, where the payload is the whole answer.
-        (0, ui_1.note)((0, ui_1.dim)(`  Project ${named} (--project)`));
-        return { projectId: named, client: await connectProject(named, null), root: null };
+        const org = (0, credentials_1.listOrgs)(client.apiUrl).find((entry) => entry.organizationId === client.organizationId);
+        (0, ui_1.note)((0, ui_1.dim)(`  Project ${named}${org ? ` of "${org.name ?? org.organizationId}"` : ''} (--project)`));
+        return { projectId: named, client, root: null };
     }
     const { root, config } = (0, config_1.requireProject)();
-    const client = options?.probe === true ? await connectProject(config.projectId, root, config) : connect(config);
+    const client = await connectProject(config.projectId, root, config);
     return { projectId: config.projectId, client, root };
 }

package/dist/spawn.js

@@ -13,7 +13,13 @@ function quote(value) {
     return WINDOWS ? `"${value.replace(/"/g, '""')}"` : value;
 }
 function run(binary, args, options = {}) {
-    const common = { stdio: options.stdio, timeout: options.timeout, encoding: 'utf-8' };
+    const common = {
+        stdio: options.stdio,
+        timeout: options.timeout,
+        cwd: options.cwd,
+        env: options.env,
+        encoding: 'utf-8',
+    };
     return WINDOWS
         ? (0, node_child_process_1.spawnSync)([binary, ...args.map(quote)].join(' '), { ...common, shell: true })
         : (0, node_child_process_1.spawnSync)(binary, args, common);

package/dist/template.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.envApiUrl = envApiUrl;
 exports.writePlatformEnv = writePlatformEnv;
 exports.scaffoldFiles = scaffoldFiles;
 const node_fs_1 = require("node:fs");
@@ -16,7 +17,7 @@ An application on XFlow.
 
 \`\`\`bash
 npm install       # dependencies
-npm run dev       # develop on localhost:3000
+xflow dev         # develop on localhost:3000
 xflow deploy      # send the code and build it on the platform
 xflow publish     # show the dev version to visitors
 \`\`\`
@@ -38,13 +39,17 @@ function functionsEnvValue(functions) {
     }
     return JSON.stringify(map);
 }
+/** The platform address the way .env holds it, and the way every template reads it. */
+function envApiUrl(apiUrl) {
+    return apiUrl.replace(/^https?:\/\//, '');
+}
 /**
  * Point .env at the current project: written on every link and deploy, so that `npm run dev`
  * never keeps talking to the previous one. Variables of your own are left alone.
  */
 function writePlatformEnv(root, projectToken, apiUrl, functions = []) {
     writeEnvValue(root, 'VITE_XFLOW_PROJECT_TOKEN', projectToken ?? '');
-    writeEnvValue(root, 'VITE_XFLOW_API_URL', apiUrl.replace(/^https?:\/\//, ''));
+    writeEnvValue(root, 'VITE_XFLOW_API_URL', envApiUrl(apiUrl));
     writeEnvValue(root, FUNCTIONS_ENV_KEY, functionsEnvValue(functions));
 }
 /** Update one variable in .env without touching the rest of the file. */

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '0.20.1';
+exports.CLI_VERSION = '0.21.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "0.20.1",
+  "version": "0.21.0",
   "description": "CLI for the XFlow platform: source sync, deployment and publishing of applications",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -22,7 +22,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 0.20.1, so the copy you are reading can be older than
+These instructions ship with xflow CLI 0.21.0, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -594,12 +594,11 @@ rejected promises and 5xx responses. The same stream, functions included, is in
 platform UI: open the project, section «Облако» (Cloud), tab «Логи» (Logs). The last 200
 records per project are kept.
 
-Local `npm run dev` does not report anything: these logs exist for what you cannot open
-in your own devtools.
+A local run does not report anything: these logs exist for what you cannot open in your
+own devtools.
 
-Cloud functions do work under `npm run dev`, and nothing has to be configured for that:
-the dev server swaps the access key of the logged-in developer for the same narrow pass and
-forwards the call. If it answers that the key is missing, the fix is `xflow login`.
+Run the app locally with `xflow dev`, not a bare `npm run dev`: it hands the dev server
+the key of the project's organization, which cloud functions need to answer.
 
 ## Environment