@getxflow/cli 0.24.0 → 0.26.0

package/dist/bin.js

@@ -26,6 +26,7 @@ const schedules_1 = require("./commands/schedules");
 const skills_1 = require("./commands/skills");
 const sources_1 = require("./commands/sources");
 const storage_1 = require("./commands/storage");
+const pages_1 = require("./commands/pages");
 const deploy_1 = require("./commands/deploy");
 const dev_1 = require("./commands/dev");
 const update_1 = require("./commands/update");
@@ -194,6 +195,28 @@ async function run(args) {
                 return;
             }
             throw new errors_1.CliError(`Unknown command: storage ${second}`, 'Available: ls, push and rm');
+        case 'pages':
+            if (second === 'create') {
+                await (0, pages_1.pagesCreate)(rest);
+                return;
+            }
+            if (second === 'deploy') {
+                await (0, pages_1.pagesDeploy)(rest);
+                return;
+            }
+            if (second === 'status') {
+                await (0, pages_1.pagesStatus)(rest);
+                return;
+            }
+            if (second === 'rollback') {
+                await (0, pages_1.pagesRollback)(rest);
+                return;
+            }
+            if (second === undefined || second === 'list') {
+                await (0, pages_1.pagesList)(rest);
+                return;
+            }
+            throw new errors_1.CliError(`Unknown command: pages ${second}`, 'Available: list, create, deploy, status and rollback');
         case 'status':
             await (0, sources_1.status)();
             return;
@@ -294,11 +317,15 @@ async function main() {
                 (0, ui_1.fatalNote)((0, ui_1.dim)(`  ${(0, limits_1.limitLine)(e.limit)}`));
             if (e.hint)
                 (0, ui_1.fatalNote)((0, ui_1.dim)(`  ${e.hint}`));
+            if (e.code === 'unauthorized' && process.env.XFLOW_TOKEN?.trim()) {
+                // Signing in again changes nothing here: the stored key is not the one being sent.
+                (0, ui_1.fatalNote)((0, ui_1.dim)('  XFLOW_TOKEN is set, so that is the key refused: put the current one there'));
+            }
             if (e.code === 'not_found') {
                 // XFLOW_TOKEN is taken as given and no organization is looked for, so a
                 // project of another one answers "not found" with nothing else to say.
                 if (process.env.XFLOW_TOKEN?.trim()) {
-                    (0, ui_1.fatalNote)((0, ui_1.dim)('  XFLOW_TOKEN is set: it is the key of one organization and is used as it comes, so a project of another one is not found'));
+                    (0, ui_1.fatalNote)((0, ui_1.dim)('  XFLOW_TOKEN is set: it is the key of one organization and is used as it comes, so a project or a page of another one is not found'));
                 }
                 else if ((0, credentials_1.anyMultipleOrgs)()) {
                     (0, ui_1.fatalNote)((0, ui_1.dim)('  Several organizations are signed in: the answer may live in another one, see xflow org'));

package/dist/commands/auth.js

@@ -92,13 +92,10 @@ function logout(args) {
         return;
     }
     const orgs = (0, credentials_1.listOrgs)(apiUrl);
+    // The pointer always lands on a stored key, so no active one means no keys.
     const active = orgs.find((org) => org.active);
     if (!active) {
-        // A record from an older CLI names no organization: forget the whole address.
-        if ((0, credentials_1.forgetAllOrgs)(apiUrl))
-            (0, ui_1.ok)(`The key for ${apiUrl} is deleted`);
-        else
-            (0, ui_1.warn)(`There is no stored key for ${apiUrl}`);
+        (0, ui_1.warn)(`There is no stored key for ${apiUrl}`);
         return;
     }
     const { nextActive } = (0, credentials_1.forgetOrg)(apiUrl, active.organizationId);

package/dist/commands/deploy.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.versionComment = versionComment;
 exports.deploy = deploy;
 exports.publish = publish;
 exports.rollback = rollback;
@@ -118,21 +119,26 @@ async function assertBuildAllowed(client, projectId) {
 const MAX_COMMENT_LENGTH = 200;
 /** Control and bidi-override characters: they spoof terminals, not comments. */
 const COMMENT_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
+/** The version comment as typed after -m, cleaned; empty when there is none. Pages take the same. */
+function versionComment(raw) {
+    const comment = (raw ?? '')
+        .replace(/\s+/g, ' ')
+        .replace(COMMENT_CONTROL_CHARS, '')
+        .trim();
+    if (comment.length > MAX_COMMENT_LENGTH) {
+        throw new errors_1.CliError(`The version comment is too long: ${MAX_COMMENT_LENGTH} characters at most`, 'One short line about what changed in this version is enough');
+    }
+    return comment;
+}
 /**
  * The version comment, checked before anything goes up: a refusal after the push
  * would leave the project with a revision newer than its build for no good reason.
  */
 function requireComment(args) {
-    const comment = ((0, args_1.flagString)(args, 'message') ?? '')
-        .replace(/\s+/g, ' ')
-        .replace(COMMENT_CONTROL_CHARS, '')
-        .trim();
+    const comment = versionComment((0, args_1.flagString)(args, 'message'));
     if (!comment) {
         throw new errors_1.CliError('Every version needs a comment saying what changed in it', 'Add -m: xflow deploy -m "Cart and card payments". One short line, written in the language the user speaks: it names this version in the history');
     }
-    if (comment.length > MAX_COMMENT_LENGTH) {
-        throw new errors_1.CliError(`The version comment is too long: ${MAX_COMMENT_LENGTH} characters at most`, 'One short line about what changed in this version is enough');
-    }
     return comment;
 }
 async function deploy(args) {

package/dist/commands/org.js

@@ -18,13 +18,7 @@ function orgList() {
     const apiUrl = (0, config_1.apiUrlFor)((0, config_1.localConfig)());
     const orgs = (0, credentials_1.listOrgs)(apiUrl);
     if (orgs.length === 0) {
-        if ((0, credentials_1.storedKeyInputs)(apiUrl).legacyToken) {
-            (0, ui_1.note)(`One key is stored for ${apiUrl}, its organization is unknown`);
-            (0, ui_1.note)((0, ui_1.dim)('  Sign in again to refresh it: xflow login'));
-        }
-        else {
-            (0, ui_1.note)(`No keys for ${apiUrl}. Sign in: xflow login`);
-        }
+        (0, ui_1.note)(`No keys for ${apiUrl}. Sign in: xflow login`);
         return;
     }
     (0, ui_1.table)(orgs.map((org) => [org.active ? '*' : ' ', org.name ?? '(unnamed)', org.organizationId]));
@@ -62,9 +56,6 @@ function orgSwitch(args) {
     const apiUrl = (0, config_1.apiUrlFor)((0, config_1.localConfig)());
     const orgs = (0, credentials_1.listOrgs)(apiUrl);
     if (orgs.length === 0) {
-        if ((0, credentials_1.storedKeyInputs)(apiUrl).legacyToken) {
-            throw new errors_1.CliError(`The stored key for ${apiUrl} names no organization`, 'Sign in again to refresh it: xflow login');
-        }
         throw new errors_1.CliError(`No keys for ${apiUrl}`, 'Sign in: xflow login');
     }
     const byId = orgs.find((org) => org.organizationId === wanted);

package/dist/commands/pages.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pagesList = pagesList;
+exports.pagesCreate = pagesCreate;
+exports.pagesDeploy = pagesDeploy;
+exports.pagesStatus = pagesStatus;
+exports.pagesRollback = pagesRollback;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const api_1 = require("../api");
+const args_1 = require("../args");
+const config_1 = require("../config");
+const credentials_1 = require("../credentials");
+const errors_1 = require("../errors");
+const session_1 = require("../session");
+const ui_1 = require("../ui");
+const zip_1 = require("../zip");
+const deploy_1 = require("./deploy");
+const storage_1 = require("./storage");
+/**
+ * Pages: public sites of the organization at <name>.xflowpage.ru. They open without
+ * signing in and outside the platform, and an upload is live at once.
+ */
+/** Keep in sync with the platform: a refusal here saves the upload. */
+const MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+const MAX_UNPACKED_BYTES = 25 * 1024 * 1024;
+const MAX_FILES = 1000;
+/** Where build tools write the site: named when the folder turns out to be the sources. */
+const BUILD_DIRS = ['dist', 'build', 'out'];
+/** A page belongs to the organization, not to a project: the key is picked as for xflow org members. */
+function pagesClient() {
+    return (0, session_1.connect)((0, config_1.localConfig)());
+}
+function pagePath(ref) {
+    return `/api/v1/pages/${encodeURIComponent(ref)}`;
+}
+function clip(text, max) {
+    return text.length > max ? `${text.slice(0, max - 1)}…` : text;
+}
+function stateOf(page) {
+    if (page.status === 'blocked')
+        return 'taken down';
+    if (page.status === 'disabled')
+        return 'switched off';
+    return page.current_revision === null ? 'empty' : 'live';
+}
+function describeState(page) {
+    if (page.status === 'blocked') {
+        const reason = page.blocked_reason ? ': ' + page.blocked_reason : '';
+        return `Taken down by the platform${reason}. Write to team@getxflow.com if it is a mistake`;
+    }
+    if (page.status === 'disabled')
+        return 'Switched off: the address shows a placeholder until a person switches it on';
+    if (page.current_revision === null)
+        return 'Empty: nothing is uploaded yet';
+    return `Live: version ${page.current_revision}, put there ${(0, ui_1.formatAge)(page.deployed_at)}`;
+}
+async function pagesList(args) {
+    const client = pagesClient();
+    const { pages } = await (0, api_1.apiJson)(client, '/api/v1/pages');
+    if ((0, args_1.flagBool)(args, 'json')) {
+        (0, ui_1.out)(JSON.stringify({ pages }, null, 2));
+        return;
+    }
+    if (pages.length === 0) {
+        (0, ui_1.note)('The organization has no pages yet');
+        (0, ui_1.note)((0, ui_1.dim)('  A new one: xflow pages create "Price list"'));
+    }
+    else {
+        (0, ui_1.table)(pages.map((page) => [
+            page.slug,
+            clip(page.title, 40),
+            stateOf(page),
+            (0, ui_1.formatAge)(page.deployed_at ?? page.created_at),
+            page.url,
+        ]));
+    }
+    const orgs = (0, credentials_1.listOrgs)(client.apiUrl);
+    if (client.source === 'active' && orgs.length > 1) {
+        const name = orgs.find((org) => org.active)?.name;
+        const whose = name ? `"${name}"` : 'the active organization';
+        (0, ui_1.note)((0, ui_1.dim)(`  Pages of ${whose} only. For another organization: xflow org switch <name or id>`));
+    }
+}
+async function pagesCreate(args) {
+    const title = args.words.slice(1).join(' ').trim();
+    if (!title) {
+        throw new errors_1.CliError('A title is required', 'For example: xflow pages create "Price list" --slug price-list');
+    }
+    const slug = (0, args_1.flagString)(args, 'slug');
+    const { page } = await (0, api_1.apiJson)(pagesClient(), '/api/v1/pages', {
+        method: 'POST',
+        body: slug ? { title, slug } : { title },
+    });
+    (0, ui_1.ok)(`Page "${page.title}" created`);
+    (0, ui_1.out)(page.url);
+    (0, ui_1.note)((0, ui_1.dim)(`  Nothing is on it yet: xflow pages deploy ${page.slug} <folder, .zip or .html>`));
+}
+function assertUploadSize(bytes) {
+    if (bytes <= MAX_UPLOAD_BYTES)
+        return;
+    throw new errors_1.CliError(`The upload is ${(0, ui_1.formatBytes)(bytes)}, a page takes ${MAX_UPLOAD_BYTES / 1024 / 1024} MB at most`, 'Pages are for sites, presentations and invoices: compress the images and drop the sourcemaps');
+}
+/**
+ * The folder of a built site, zipped here. The sources of a site are refused before the
+ * walk: the platform would reject them anyway, and node_modules is a long way down.
+ */
+function zipSite(absolute, source) {
+    const built = BUILD_DIRS.find((dir) => (0, node_fs_1.existsSync)((0, node_path_1.join)(absolute, dir, 'index.html')));
+    const pointAtBuild = built
+        ? `The built site is in ${(0, node_path_1.join)(source, built)}: upload that folder`
+        : 'Build it and upload the folder the build writes';
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(absolute, 'package.json'))) {
+        throw new errors_1.CliError(`${source} holds the sources of a site, not a built one`, pointAtBuild);
+    }
+    if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(absolute, 'index.html'))) {
+        throw new errors_1.CliError(`There is no index.html at the top of ${source}`, built ? pointAtBuild : 'The start page of a site is index.html at the top of its folder');
+    }
+    const files = (0, storage_1.collectMedia)(absolute);
+    if (files.length > MAX_FILES) {
+        throw new errors_1.CliError(`${source} holds ${files.length} files, a page takes ${MAX_FILES} at most`, 'Drop what the site never loads');
+    }
+    const bytes = files.reduce((sum, file) => sum + file.size, 0);
+    if (bytes > MAX_UNPACKED_BYTES) {
+        throw new errors_1.CliError(`${source} is ${(0, ui_1.formatBytes)(bytes)}, a page takes ${MAX_UNPACKED_BYTES / 1024 / 1024} MB at most`, 'Compress the images and drop the sourcemaps');
+    }
+    const body = (0, zip_1.zipCreate)(files.map((file) => ({ path: file.remote, content: (0, node_fs_1.readFileSync)(file.absolute) })));
+    assertUploadSize(body.length);
+    return { kind: 'zip', body, label: `${files.length} file(s), ${(0, ui_1.formatBytes)(bytes)}` };
+}
+function readUpload(source) {
+    const absolute = (0, node_path_1.resolve)(source);
+    let stat;
+    try {
+        stat = (0, node_fs_1.statSync)(absolute);
+    }
+    catch {
+        throw new errors_1.CliError(`No such file or folder: ${source}`);
+    }
+    if (stat.isDirectory())
+        return zipSite(absolute, source);
+    const extension = (0, node_path_1.extname)(absolute).toLowerCase();
+    if (extension !== '.html' && extension !== '.htm' && extension !== '.zip') {
+        throw new errors_1.CliError(`${(0, node_path_1.basename)(absolute)} cannot be a page`, 'A page goes up as a folder with index.html at the top, its .zip, or one .html file');
+    }
+    assertUploadSize(stat.size);
+    return {
+        kind: extension === '.zip' ? 'zip' : 'html',
+        body: (0, node_fs_1.readFileSync)(absolute),
+        label: `${(0, node_path_1.basename)(absolute)}, ${(0, ui_1.formatBytes)(stat.size)}`,
+    };
+}
+async function pagesDeploy(args) {
+    const [, ref, source] = args.words;
+    if (!ref || !source) {
+        throw new errors_1.CliError('A page and what to upload are required', 'For example: xflow pages deploy price-list ./dist. The pages: xflow pages');
+    }
+    const comment = (0, deploy_1.versionComment)((0, args_1.flagString)(args, 'message'));
+    const upload = readUpload(source);
+    const client = pagesClient();
+    (0, ui_1.step)(`Uploading ${upload.label}`);
+    const query = comment ? `?comment=${encodeURIComponent(comment)}` : '';
+    const result = await (0, api_1.apiUpload)(client, `${pagePath(ref)}/deploy${query}`, upload.body, {
+        'Content-Type': upload.kind === 'zip' ? 'application/zip' : 'text/html',
+    });
+    if (result.status === 'unchanged') {
+        (0, ui_1.ok)(`Nothing changed: version ${result.revision} is already on the address`);
+    }
+    else if (result.status === 'stored') {
+        (0, ui_1.warn)(`The page is switched off: version ${result.revision} is kept, not shown`);
+        (0, ui_1.note)((0, ui_1.dim)('  It goes live when a person switches the page on'));
+    }
+    else {
+        (0, ui_1.ok)(`Version ${result.revision} is live: ${result.file_count} file(s), ${(0, ui_1.formatBytes)(result.size_bytes)}`);
+    }
+    (0, ui_1.out)(result.page.url);
+    if (result.status === 'deployed') {
+        (0, ui_1.note)((0, ui_1.dim)(`  Anyone with the address sees it within seconds. The versions: xflow pages status ${result.page.slug}`));
+    }
+}
+async function pagesStatus(args) {
+    const ref = args.words[1];
+    if (!ref)
+        throw new errors_1.CliError('A page is required', 'The name from its address, or its id. The pages: xflow pages');
+    const data = await (0, api_1.apiJson)(pagesClient(), `${pagePath(ref)}/revisions`);
+    if ((0, args_1.flagBool)(args, 'json')) {
+        (0, ui_1.out)(JSON.stringify(data, null, 2));
+        return;
+    }
+    const { page, revisions } = data;
+    (0, ui_1.out)(`${(0, ui_1.bold)(page.title)}  ${page.url}`);
+    (0, ui_1.out)(describeState(page));
+    if (revisions.length === 0) {
+        (0, ui_1.note)((0, ui_1.dim)(`  Upload: xflow pages deploy ${page.slug} <folder, .zip or .html>`));
+        return;
+    }
+    (0, ui_1.out)();
+    (0, ui_1.table)(revisions.map((revision) => [
+        String(revision.revision),
+        (0, ui_1.formatAge)(revision.created_at),
+        `${revision.file_count} file(s)`,
+        (0, ui_1.formatBytes)(revision.size_bytes),
+        clip(revision.comment ?? '', 60),
+        revision.current ? 'current' : revision.restorable ? '' : 'files removed',
+    ]));
+    (0, ui_1.note)((0, ui_1.dim)(`  Put a version back: xflow pages rollback ${page.slug} <number>. The files of the last 5 are kept`));
+}
+async function pagesRollback(args) {
+    const [, ref, raw] = args.words;
+    if (!ref || !raw) {
+        throw new errors_1.CliError('A page and a version number are required', 'For example: xflow pages rollback price-list 2. The versions: xflow pages status <page>');
+    }
+    const revision = Number(raw);
+    if (!Number.isInteger(revision) || revision < 1) {
+        throw new errors_1.CliError(`A version number is a positive integer, got "${raw}"`, `The versions: xflow pages status ${ref}`);
+    }
+    const { page } = await (0, api_1.apiJson)(pagesClient(), `${pagePath(ref)}/rollback`, {
+        method: 'POST',
+        body: { revision },
+    });
+    if (page.status === 'active')
+        (0, ui_1.ok)(`Version ${revision} is back on the address`);
+    else
+        (0, ui_1.warn)(`The page is switched off: version ${revision} is current and goes live when it is switched on`);
+    (0, ui_1.out)(page.url);
+}

package/dist/commands/storage.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.contentTypeFor = contentTypeFor;
+exports.collectMedia = collectMedia;
 exports.planBatches = planBatches;
 exports.caseCollisions = caseCollisions;
 exports.storageList = storageList;
@@ -74,7 +75,7 @@ function contentTypeFor(name) {
  * what one is asked to put there so it stays out of the 10 MB archive.
  *
  * Dot entries and symlinks are skipped: pointing push at a working copy should
- * not upload .git, and a link is not ours to follow.
+ * not upload .git, and a link is not ours to follow. Pages walk a site the same way.
  */
 function collectMedia(root, prefix = '') {
     const found = [];

package/dist/credentials.js

@@ -47,56 +47,38 @@ function writeStore(store) {
 function isLegacy(value) {
     return !!value && typeof value.token === 'string';
 }
-/** The mirror for older CLIs: the key of the active organization, or nothing. */
-function syncLegacy(store, apiUrl) {
-    const address = store.orgs?.[apiUrl];
-    if (!address)
-        return;
-    const active = address.active ? address.keys[address.active] : undefined;
-    if (active && address.active) {
-        store[apiUrl] = { token: active.token, organizationId: address.active, savedAt: active.savedAt };
-        address.mirror = address.active;
-    }
-    else {
-        delete store[apiUrl];
-        address.mirror = null;
-    }
-}
 /**
- * Fold writes made by an older CLI back into the map. Its login rewrites only
- * the mirror record, its logout deletes only it; both are treated as what the
- * person meant: "sign in to this organization" and "forget the key I am using".
+ * Fold a record predating the map into it and erase the record. A record naming
+ * no organization cannot be placed in the map and is dropped: the answer is one
+ * xflow login, while leaving it would leave the key where the old proxy looks.
  * Returns true when the store changed and has to be written back.
  */
 function reconcile(store, apiUrl) {
     const legacy = store[apiUrl];
-    let address = store.orgs?.[apiUrl];
     let changed = false;
-    if (isLegacy(legacy) && legacy.organizationId) {
-        const orgs = address ?? { active: null, keys: {} };
-        const known = orgs.keys[legacy.organizationId];
-        if (!known || known.token !== legacy.token || orgs.active !== legacy.organizationId) {
-            orgs.keys[legacy.organizationId] = { ...known, token: legacy.token, savedAt: legacy.savedAt };
-            orgs.active = legacy.organizationId;
+    if (isLegacy(legacy)) {
+        if (legacy.organizationId) {
+            const orgs = store.orgs?.[apiUrl] ?? { active: null, keys: {} };
+            // The map wins: it is what this CLI wrote last.
+            if (!orgs.keys[legacy.organizationId]) {
+                orgs.keys[legacy.organizationId] = { token: legacy.token, savedAt: legacy.savedAt };
+            }
             store.orgs = store.orgs ?? {};
             store.orgs[apiUrl] = orgs;
-            address = orgs;
-            changed = true;
-        }
-    }
-    if (!isLegacy(legacy) && address?.active && address.keys[address.active]) {
-        if (address.mirror === address.active) {
-            // The mirror we wrote for this key is gone: an older CLI logged out.
-            delete address.keys[address.active];
-            address.active = null;
         }
-        // Otherwise no mirror was ever written for this key (a hand-made or
-        // restored file): deleting it would lose a key nobody asked to forget.
-        // Either way the store changed: the mirror has to be rebuilt.
+        delete store[apiUrl];
         changed = true;
     }
-    // The pointer must land on a stored key, or on nothing.
+    const address = store.orgs?.[apiUrl];
     if (address) {
+        // The field the erased record was tracked by. Left in place, a 0.24.0 still on
+        // the machine reads "the mirror I wrote is gone" as a logout and drops the key.
+        const stale = address;
+        if ('mirror' in stale) {
+            delete stale.mirror;
+            changed = true;
+        }
+        // The pointer must land on a stored key, or on nothing.
         const ids = Object.keys(address.keys);
         const active = address.active && address.keys[address.active] ? address.active : (ids[0] ?? null);
         if (address.active !== active) {
@@ -104,8 +86,6 @@ function reconcile(store, apiUrl) {
             changed = true;
         }
     }
-    if (changed)
-        syncLegacy(store, apiUrl);
     return changed;
 }
 /** Read the store with the drift of older CLIs healed, persisting the healing. */
@@ -116,7 +96,6 @@ function load(apiUrl) {
     return store;
 }
 function commit(store, apiUrl) {
-    syncLegacy(store, apiUrl);
     const address = store.orgs?.[apiUrl];
     if (address && Object.keys(address.keys).length === 0) {
         delete store.orgs?.[apiUrl];
@@ -158,32 +137,38 @@ function saveOrgCredential(apiUrl, organizationId, token, name) {
 /** Cache the display name; a stale one is refreshed by any login or whoami. */
 function rememberOrgName(apiUrl, organizationId, name) {
     const store = readStore();
-    reconcile(store, apiUrl);
+    let changed = reconcile(store, apiUrl);
     const entry = store.orgs?.[apiUrl]?.keys[organizationId];
-    if (!entry || entry.name === name)
-        return;
-    entry.name = name;
-    commit(store, apiUrl);
+    if (entry && entry.name !== name) {
+        entry.name = name;
+        changed = true;
+    }
+    if (changed)
+        commit(store, apiUrl);
 }
 function setActiveOrg(apiUrl, organizationId) {
     const store = readStore();
-    reconcile(store, apiUrl);
+    let changed = reconcile(store, apiUrl);
     const orgs = store.orgs?.[apiUrl];
-    if (!orgs?.keys[organizationId])
-        return false;
-    if (orgs.active !== organizationId) {
+    const known = !!orgs?.keys[organizationId];
+    if (orgs && known && orgs.active !== organizationId) {
         orgs.active = organizationId;
-        commit(store, apiUrl);
+        changed = true;
     }
-    return true;
+    if (changed)
+        commit(store, apiUrl);
+    return known;
 }
 /** Forget one organization; the pointer moves to any remaining one. */
 function forgetOrg(apiUrl, organizationId) {
     const store = readStore();
-    reconcile(store, apiUrl);
+    const healed = reconcile(store, apiUrl);
     const orgs = store.orgs?.[apiUrl];
-    if (!orgs?.keys[organizationId])
+    if (!orgs?.keys[organizationId]) {
+        if (healed)
+            commit(store, apiUrl);
         return { removed: false, nextActive: null };
+    }
     delete orgs.keys[organizationId];
     if (orgs.active === organizationId)
         orgs.active = Object.keys(orgs.keys)[0] ?? null;
@@ -199,8 +184,9 @@ function forgetOrg(apiUrl, organizationId) {
 /** Forget every key of the address; other addresses are untouched. */
 function forgetAllOrgs(apiUrl) {
     const store = readStore();
-    reconcile(store, apiUrl);
-    const had = !!store.orgs?.[apiUrl] || isLegacy(store[apiUrl]);
+    // A record erased by reconcile was a key as well: counted here, or the address
+    // looks empty and the erasure never reaches the file.
+    const had = reconcile(store, apiUrl) || !!store.orgs?.[apiUrl];
     if (!had)
         return false;
     if (store.orgs) {
@@ -236,16 +222,9 @@ function pickKey(inputs) {
     const active = activeId ? inputs.orgs?.keys[activeId] : undefined;
     if (active && activeId)
         return { token: active.token, source: 'active', organizationId: activeId };
-    if (inputs.legacyToken)
-        return { token: inputs.legacyToken, source: 'active', organizationId: null };
     return null;
 }
 /** The store-backed half of pickKey's inputs; the caller adds env and the folder binding. */
 function storedKeyInputs(apiUrl) {
-    const store = load(apiUrl);
-    const legacy = store[apiUrl];
-    return {
-        orgs: store.orgs?.[apiUrl] ?? null,
-        legacyToken: isLegacy(legacy) ? legacy.token : null,
-    };
+    return { orgs: load(apiUrl).orgs?.[apiUrl] ?? null };
 }

package/dist/flags.js

@@ -81,6 +81,12 @@ exports.KNOWN = {
     'storage push': ['to', 'replace', 'json', 'project'],
     'storage rm': ['folder', 'yes', 'project'],
     'storage remove': ['folder', 'yes', 'project'],
+    pages: ['json'],
+    'pages list': ['json'],
+    'pages create': ['slug'],
+    'pages deploy': ['message'],
+    'pages status': ['json'],
+    'pages rollback': [],
     status: [],
     dev: [],
     pull: ['into', 'force', 'revision'],
@@ -127,6 +133,7 @@ const NAMESPACES = new Set([
     'schedules',
     'db',
     'storage',
+    'pages',
     'mcp',
 ]);
 /** The command these words name, as far as the table knows it. */

package/dist/help.js

@@ -89,6 +89,15 @@ ${(0, ui_1.bold)('Database')}
   xflow db migrate [--dry-run] [--allow-destructive]
                                   apply the migrations from migrations/*.sql
 
+${(0, ui_1.bold)('Pages')}
+  xflow pages                     public sites of the organization at <name>.xflowpage.ru
+  xflow pages create <title> [--slug name]
+                                  a new page, empty until the first upload
+  xflow pages deploy <page> <folder|.zip|.html> [-m "what changed"]
+                                  upload the site: live at once, there is no publish step
+  xflow pages status <page>       the page and its versions
+  xflow pages rollback <page> <N> put an earlier version back on the address
+
 ${(0, ui_1.bold)('Reference')}
   xflow logs [--limit N]          browser errors from the released application
   xflow projects list             projects of the organization
@@ -202,6 +211,55 @@ active one outside. With several signed in, a line under the table says whose
 projects these are.
 
 ${(0, ui_1.bold)('xflow link <id>')} binds the current folder to a project; ${(0, ui_1.bold)('xflow init')} makes a new one.`,
+    link: `${(0, ui_1.bold)('xflow link')} <id>: bind this folder to a project
+
+Writes xflow.json and .xflow/state.json, points .env at the project and lays down the
+instructions for the agents. The id comes from ${(0, ui_1.bold)('xflow projects list')}; a project of
+another signed-in organization is found too, and the folder is bound to that organization.
+
+An empty folder (.git alone counts as empty) also gets the latest sources, so there is no
+${(0, ui_1.bold)('pull')} after it: pull would refuse the folder anyway, it is not empty any more. A
+folder with files keeps them as they are: ${(0, ui_1.bold)('xflow status')} says how they differ from
+the server revision, ${(0, ui_1.bold)('xflow pull --into ./server-copy')} fetches it next to them.
+
+In a folder that is already linked, the command points xflow.json at the other project and
+keeps the rest of the file. A new project instead of an existing one: ${(0, ui_1.bold)('xflow init')}.`,
+    pages: `${(0, ui_1.bold)('xflow pages')}: public sites of the organization
+
+A page is a static site at https://<name>.xflowpage.ru: a landing page, a presentation, an
+invoice for people outside the organization. It opens by its address for anyone, without
+signing in and outside the platform. A project is the opposite: it opens only inside the
+platform, for the members of the organization.
+
+  xflow pages                          the pages, their state and address
+  xflow pages create <title>           a new page, empty until the first upload
+      --slug <name>                    the name in the address; without it the name is made
+                                       from the title, with a random tail
+  xflow pages deploy <page> <path>     upload a folder with index.html at the top, its .zip,
+                                       or one .html file
+      -m <text>                        what changed, one short line: it names the version
+  xflow pages status <page>            the page and its versions
+  xflow pages rollback <page> <N>      put version N back on the address
+
+${(0, ui_1.bold)('<page>')} is the name from the address or the id. ${(0, ui_1.bold)('--json')} on list and status
+prints the answer as JSON. A page belongs to the organization, not to a project, so there is
+no ${(0, ui_1.bold)('--project')}: the key is picked as for every other command (${(0, ui_1.bold)('xflow help org')}).
+
+${(0, ui_1.bold)('An upload is live at once.')} There is no draft and no publish step: anyone with the
+address sees the new version within seconds. Uploading the same files again changes nothing.
+The files of the last 5 versions are kept, so a rollback takes seconds and needs no upload.
+
+What goes up is the built site: HTML, CSS, JS, images, fonts, PDF, audio and video. No code
+runs on the platform side, and a folder with package.json is refused as the sources of a site:
+build it and upload what the build writes. Dot entries are skipped. At most 5 MB zipped, 25 MB
+unpacked and 1000 files.
+
+The page is public, so a file holding a secret key is refused whole: every visitor would read
+it. Search engines are asked not to index pages, so do not promise SEO.
+
+A page takes the key of the whole organization, the one ${(0, ui_1.bold)('xflow login')} issues. The
+section is in beta: XFlow support switches it on for an organization. Switching a page off
+and deleting it are for a person, in the platform interface.`,
     update: `${(0, ui_1.bold)('xflow update')}: bring the CLI up to date
 
 Installs the published version and, if anything changed, rewrites the platform
@@ -547,8 +605,10 @@ so the cloud functions answer here the way they do on the platform. The key is p
 as for every other command (${(0, ui_1.bold)('xflow help org')}): with several organizations signed
 in, the right one is found and the folder is bound to it.
 
-Use it instead of a bare ${(0, ui_1.bold)('npm run dev')}, which gets no key from here: its function
-calls fail, or go out under the key of whichever organization is active.
+Use it instead of a bare ${(0, ui_1.bold)('npm run dev')}: that one is handed no key, so its calls to
+cloud functions fail. In a project made before this command the failure reads "No access
+key for the platform: run xflow login", and signing in will not help, because the key is
+no longer left in a file for that dev server to pick up.
 
 The platform address comes from the CLI too, not from .env, so the key goes to the
 platform that issued it and nowhere else. It never reaches the browser: the page gets

package/dist/session.js

@@ -84,7 +84,7 @@ async function findProjectOrg(apiUrl, projectId) {
  */
 async function connectProject(projectId, root, config) {
     const session = connect(config, { ignoreFolder: root === null });
-    if (session.source !== 'active' || session.organizationId === null)
+    if (session.source !== 'active')
         return session;
     const orgs = (0, credentials_1.listOrgs)(session.apiUrl);
     if (orgs.length <= 1)

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '0.24.0';
+exports.CLI_VERSION = '0.26.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "CLI for the XFlow platform: source sync, deployment and publishing of applications",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: xflow
-description: Build, deploy and publish apps on the XFlow platform with the xflow CLI. Use whenever the project root has xflow.json or VITE_XFLOW_* variables, and for any task that touches deployment, publishing, rollback, source sync, the project database or SQL migrations, cloud functions, schedules, environment variables and secrets, file storage and uploads of photos, video or PDFs, connected accounts of external services, production errors and logs, or UI built on the platform design system.
+description: Build, deploy and publish apps on the XFlow platform with the xflow CLI. Use whenever the project root has xflow.json or VITE_XFLOW_* variables, and for any task that touches deployment, publishing, rollback, source sync, the project database or SQL migrations, cloud functions, schedules, environment variables and secrets, file storage and uploads of photos, video or PDFs, connected accounts of external services, production errors and logs, UI built on the platform design system, or a public page on xflowpage.ru (a landing page, presentation or invoice for people outside the organization).
 ---
 
 # XFlow
@@ -22,7 +22,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 0.24.0, so the copy you are reading can be older than
+These instructions ship with xflow CLI 0.26.0, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -125,9 +125,9 @@ outside the project folder); building it over the current one needs a human.
 
 Pages are kept for the **three latest successful builds** plus whatever dev and live show;
 older versions stay in the history with `pages_kept` false, readable but not openable. The
-history holds the **last 30 builds**, the sources the **last 50 revisions** (a revision a live
-version was built from is never deleted). Three builds is the whole rollback depth, hours on an
-active project: keep anything you must not lose in your own git repository.
+history holds the **last 30 builds**, each keeping the revision it was built from; any other
+revision is kept only while it is among the **10 latest**. Three builds is the whole rollback
+depth, hours on an active project: keep anything you must not lose in your own git repository.
 
 **The only link you give a person is the project page**, `https://app.getxflow.com/projects/<id>`,
 which the CLI prints for you. Refer to builds by their number ("version 481203 is built, 092399
@@ -520,6 +520,31 @@ What the app may do with files is decided inside that function, because the page
 by whoever opened it. Never send the key to the frontend: the build gate stops on a key found in
 the sources, and a key that reached a visitor deletes every file of the project.
 
+## Pages
+
+A page is a public static site at `https://<name>.xflowpage.ru`: a landing page, a
+presentation, an invoice for people outside the organization. Anyone with the address opens it,
+without signing in and outside the platform. A project is the opposite, it opens only inside the
+platform: pick a page when the audience is outside the organization.
+
+- `xflow pages create "Price list"` makes an empty page and prints its address. `--slug
+  price-list` picks the name, otherwise it comes from the title with a random tail.
+- `xflow pages deploy <page> <folder|.zip|.html> -m "what changed"` uploads the built site.
+  **It is public the moment the command finishes**: no draft, no publish step. Upload when the
+  user wants the page out, and give them the address the CLI printed.
+- `xflow pages status <page>` lists the versions, `xflow pages rollback <page> <N>` puts one back
+  in seconds; the files of the last 5 are kept.
+- Static files only: HTML, CSS, JS, images, fonts, PDF, audio, video. No server code, database
+  or functions on a page. Upload what the build writes (`dist`), never a folder with
+  `package.json`. At most 5 MB zipped, 25 MB unpacked, 1000 files.
+- Everything in a page is readable by every visitor. Never put a key, token or password into
+  it: a known key format gets the upload refused, anything else simply leaks.
+- Search engines are asked not to index pages: do not promise SEO.
+- The MCP `pages` tool uploads one self-contained HTML document up to 150 KB.
+- Pages take the key of the whole organization, the one `xflow login` issues. The section is in
+  beta, switched on per organization by XFlow support: that refusal is not yours to fix. Switching
+  a page off and deleting it are for a person, in the platform interface.
+
 ## Organizations and keys
 
 One key per organization, stored side by side rather than replacing each other: `xflow org`
@@ -602,7 +627,8 @@ own devtools.
 
 Run the app locally with `xflow dev`, not a bare `npm run dev`: it hands the dev server
 the key of the project's organization, which cloud functions need to answer, and their
-current addresses, including functions someone else deployed. The server answers
+current addresses, including functions someone else deployed. A bare `npm run dev` gets
+no key at all, so its function calls fail whatever the error says. The server answers
 `127.0.0.1` alone, because it holds that key: a phone on the same network cannot open it,
 and neither can anybody else on that network.