@getxflow/cli 0.24.0 → 0.25.0

package/dist/commands/auth.js

@@ -92,13 +92,10 @@ function logout(args) {
         return;
     }
     const orgs = (0, credentials_1.listOrgs)(apiUrl);
+    // The pointer always lands on a stored key, so no active one means no keys.
     const active = orgs.find((org) => org.active);
     if (!active) {
-        // A record from an older CLI names no organization: forget the whole address.
-        if ((0, credentials_1.forgetAllOrgs)(apiUrl))
-            (0, ui_1.ok)(`The key for ${apiUrl} is deleted`);
-        else
-            (0, ui_1.warn)(`There is no stored key for ${apiUrl}`);
+        (0, ui_1.warn)(`There is no stored key for ${apiUrl}`);
         return;
     }
     const { nextActive } = (0, credentials_1.forgetOrg)(apiUrl, active.organizationId);

package/dist/commands/org.js

@@ -18,13 +18,7 @@ function orgList() {
     const apiUrl = (0, config_1.apiUrlFor)((0, config_1.localConfig)());
     const orgs = (0, credentials_1.listOrgs)(apiUrl);
     if (orgs.length === 0) {
-        if ((0, credentials_1.storedKeyInputs)(apiUrl).legacyToken) {
-            (0, ui_1.note)(`One key is stored for ${apiUrl}, its organization is unknown`);
-            (0, ui_1.note)((0, ui_1.dim)('  Sign in again to refresh it: xflow login'));
-        }
-        else {
-            (0, ui_1.note)(`No keys for ${apiUrl}. Sign in: xflow login`);
-        }
+        (0, ui_1.note)(`No keys for ${apiUrl}. Sign in: xflow login`);
         return;
     }
     (0, ui_1.table)(orgs.map((org) => [org.active ? '*' : ' ', org.name ?? '(unnamed)', org.organizationId]));
@@ -62,9 +56,6 @@ function orgSwitch(args) {
     const apiUrl = (0, config_1.apiUrlFor)((0, config_1.localConfig)());
     const orgs = (0, credentials_1.listOrgs)(apiUrl);
     if (orgs.length === 0) {
-        if ((0, credentials_1.storedKeyInputs)(apiUrl).legacyToken) {
-            throw new errors_1.CliError(`The stored key for ${apiUrl} names no organization`, 'Sign in again to refresh it: xflow login');
-        }
         throw new errors_1.CliError(`No keys for ${apiUrl}`, 'Sign in: xflow login');
     }
     const byId = orgs.find((org) => org.organizationId === wanted);

package/dist/credentials.js

@@ -47,56 +47,38 @@ function writeStore(store) {
 function isLegacy(value) {
     return !!value && typeof value.token === 'string';
 }
-/** The mirror for older CLIs: the key of the active organization, or nothing. */
-function syncLegacy(store, apiUrl) {
-    const address = store.orgs?.[apiUrl];
-    if (!address)
-        return;
-    const active = address.active ? address.keys[address.active] : undefined;
-    if (active && address.active) {
-        store[apiUrl] = { token: active.token, organizationId: address.active, savedAt: active.savedAt };
-        address.mirror = address.active;
-    }
-    else {
-        delete store[apiUrl];
-        address.mirror = null;
-    }
-}
 /**
- * Fold writes made by an older CLI back into the map. Its login rewrites only
- * the mirror record, its logout deletes only it; both are treated as what the
- * person meant: "sign in to this organization" and "forget the key I am using".
+ * Fold a record predating the map into it and erase the record. A record naming
+ * no organization cannot be placed in the map and is dropped: the answer is one
+ * xflow login, while leaving it would leave the key where the old proxy looks.
  * Returns true when the store changed and has to be written back.
  */
 function reconcile(store, apiUrl) {
     const legacy = store[apiUrl];
-    let address = store.orgs?.[apiUrl];
     let changed = false;
-    if (isLegacy(legacy) && legacy.organizationId) {
-        const orgs = address ?? { active: null, keys: {} };
-        const known = orgs.keys[legacy.organizationId];
-        if (!known || known.token !== legacy.token || orgs.active !== legacy.organizationId) {
-            orgs.keys[legacy.organizationId] = { ...known, token: legacy.token, savedAt: legacy.savedAt };
-            orgs.active = legacy.organizationId;
+    if (isLegacy(legacy)) {
+        if (legacy.organizationId) {
+            const orgs = store.orgs?.[apiUrl] ?? { active: null, keys: {} };
+            // The map wins: it is what this CLI wrote last.
+            if (!orgs.keys[legacy.organizationId]) {
+                orgs.keys[legacy.organizationId] = { token: legacy.token, savedAt: legacy.savedAt };
+            }
             store.orgs = store.orgs ?? {};
             store.orgs[apiUrl] = orgs;
-            address = orgs;
-            changed = true;
-        }
-    }
-    if (!isLegacy(legacy) && address?.active && address.keys[address.active]) {
-        if (address.mirror === address.active) {
-            // The mirror we wrote for this key is gone: an older CLI logged out.
-            delete address.keys[address.active];
-            address.active = null;
         }
-        // Otherwise no mirror was ever written for this key (a hand-made or
-        // restored file): deleting it would lose a key nobody asked to forget.
-        // Either way the store changed: the mirror has to be rebuilt.
+        delete store[apiUrl];
         changed = true;
     }
-    // The pointer must land on a stored key, or on nothing.
+    const address = store.orgs?.[apiUrl];
     if (address) {
+        // The field the erased record was tracked by. Left in place, a 0.24.0 still on
+        // the machine reads "the mirror I wrote is gone" as a logout and drops the key.
+        const stale = address;
+        if ('mirror' in stale) {
+            delete stale.mirror;
+            changed = true;
+        }
+        // The pointer must land on a stored key, or on nothing.
         const ids = Object.keys(address.keys);
         const active = address.active && address.keys[address.active] ? address.active : (ids[0] ?? null);
         if (address.active !== active) {
@@ -104,8 +86,6 @@ function reconcile(store, apiUrl) {
             changed = true;
         }
     }
-    if (changed)
-        syncLegacy(store, apiUrl);
     return changed;
 }
 /** Read the store with the drift of older CLIs healed, persisting the healing. */
@@ -116,7 +96,6 @@ function load(apiUrl) {
     return store;
 }
 function commit(store, apiUrl) {
-    syncLegacy(store, apiUrl);
     const address = store.orgs?.[apiUrl];
     if (address && Object.keys(address.keys).length === 0) {
         delete store.orgs?.[apiUrl];
@@ -158,32 +137,38 @@ function saveOrgCredential(apiUrl, organizationId, token, name) {
 /** Cache the display name; a stale one is refreshed by any login or whoami. */
 function rememberOrgName(apiUrl, organizationId, name) {
     const store = readStore();
-    reconcile(store, apiUrl);
+    let changed = reconcile(store, apiUrl);
     const entry = store.orgs?.[apiUrl]?.keys[organizationId];
-    if (!entry || entry.name === name)
-        return;
-    entry.name = name;
-    commit(store, apiUrl);
+    if (entry && entry.name !== name) {
+        entry.name = name;
+        changed = true;
+    }
+    if (changed)
+        commit(store, apiUrl);
 }
 function setActiveOrg(apiUrl, organizationId) {
     const store = readStore();
-    reconcile(store, apiUrl);
+    let changed = reconcile(store, apiUrl);
     const orgs = store.orgs?.[apiUrl];
-    if (!orgs?.keys[organizationId])
-        return false;
-    if (orgs.active !== organizationId) {
+    const known = !!orgs?.keys[organizationId];
+    if (orgs && known && orgs.active !== organizationId) {
         orgs.active = organizationId;
-        commit(store, apiUrl);
+        changed = true;
     }
-    return true;
+    if (changed)
+        commit(store, apiUrl);
+    return known;
 }
 /** Forget one organization; the pointer moves to any remaining one. */
 function forgetOrg(apiUrl, organizationId) {
     const store = readStore();
-    reconcile(store, apiUrl);
+    const healed = reconcile(store, apiUrl);
     const orgs = store.orgs?.[apiUrl];
-    if (!orgs?.keys[organizationId])
+    if (!orgs?.keys[organizationId]) {
+        if (healed)
+            commit(store, apiUrl);
         return { removed: false, nextActive: null };
+    }
     delete orgs.keys[organizationId];
     if (orgs.active === organizationId)
         orgs.active = Object.keys(orgs.keys)[0] ?? null;
@@ -199,8 +184,9 @@ function forgetOrg(apiUrl, organizationId) {
 /** Forget every key of the address; other addresses are untouched. */
 function forgetAllOrgs(apiUrl) {
     const store = readStore();
-    reconcile(store, apiUrl);
-    const had = !!store.orgs?.[apiUrl] || isLegacy(store[apiUrl]);
+    // A record erased by reconcile was a key as well: counted here, or the address
+    // looks empty and the erasure never reaches the file.
+    const had = reconcile(store, apiUrl) || !!store.orgs?.[apiUrl];
     if (!had)
         return false;
     if (store.orgs) {
@@ -236,16 +222,9 @@ function pickKey(inputs) {
     const active = activeId ? inputs.orgs?.keys[activeId] : undefined;
     if (active && activeId)
         return { token: active.token, source: 'active', organizationId: activeId };
-    if (inputs.legacyToken)
-        return { token: inputs.legacyToken, source: 'active', organizationId: null };
     return null;
 }
 /** The store-backed half of pickKey's inputs; the caller adds env and the folder binding. */
 function storedKeyInputs(apiUrl) {
-    const store = load(apiUrl);
-    const legacy = store[apiUrl];
-    return {
-        orgs: store.orgs?.[apiUrl] ?? null,
-        legacyToken: isLegacy(legacy) ? legacy.token : null,
-    };
+    return { orgs: load(apiUrl).orgs?.[apiUrl] ?? null };
 }

package/dist/help.js

@@ -547,8 +547,10 @@ so the cloud functions answer here the way they do on the platform. The key is p
 as for every other command (${(0, ui_1.bold)('xflow help org')}): with several organizations signed
 in, the right one is found and the folder is bound to it.
 
-Use it instead of a bare ${(0, ui_1.bold)('npm run dev')}, which gets no key from here: its function
-calls fail, or go out under the key of whichever organization is active.
+Use it instead of a bare ${(0, ui_1.bold)('npm run dev')}: that one is handed no key, so its calls to
+cloud functions fail. In a project made before this command the failure reads "No access
+key for the platform: run xflow login", and signing in will not help, because the key is
+no longer left in a file for that dev server to pick up.
 
 The platform address comes from the CLI too, not from .env, so the key goes to the
 platform that issued it and nowhere else. It never reaches the browser: the page gets

package/dist/session.js

@@ -84,7 +84,7 @@ async function findProjectOrg(apiUrl, projectId) {
  */
 async function connectProject(projectId, root, config) {
     const session = connect(config, { ignoreFolder: root === null });
-    if (session.source !== 'active' || session.organizationId === null)
+    if (session.source !== 'active')
         return session;
     const orgs = (0, credentials_1.listOrgs)(session.apiUrl);
     if (orgs.length <= 1)

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '0.24.0';
+exports.CLI_VERSION = '0.25.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "CLI for the XFlow platform: source sync, deployment and publishing of applications",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -22,7 +22,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 0.24.0, so the copy you are reading can be older than
+These instructions ship with xflow CLI 0.25.0, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -602,7 +602,8 @@ own devtools.
 
 Run the app locally with `xflow dev`, not a bare `npm run dev`: it hands the dev server
 the key of the project's organization, which cloud functions need to answer, and their
-current addresses, including functions someone else deployed. The server answers
+current addresses, including functions someone else deployed. A bare `npm run dev` gets
+no key at all, so its function calls fail whatever the error says. The server answers
 `127.0.0.1` alone, because it holds that key: a phone on the same network cannot open it,
 and neither can anybody else on that network.