@getxflow/cli 1.0.2 → 1.0.4

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '1.0.2';
+exports.CLI_VERSION = '1.0.4';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -23,7 +23,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 1.0.2, so the copy you are reading can be older than
+These instructions ship with xflow CLI 1.0.4, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -233,19 +233,16 @@ A person sets this in the web interface; you cannot, and you should not ask for
 
 | Level | Who gets in |
 |---|---|
-| Project members | people who have access to the project: the team through xflow, staff with a login |
-| By list | the members named for this app |
+| Project members | people who have access to the project |
 | Anyone with the link | anybody, no sign-in at all |
 
 - The plan decides which levels exist: on Free an app opens only inside xflow, Start adds the
-  direct address, "By list" and "Anyone with the link".
-- At the two closed levels the platform signs people in, and a function receives the person in
-  `event.xflow.user` (`id`, `role` in the organization, `name`, `login`).
-- Staff (a doctor, a picker) never sign in to xflow: an admin gives them a login and a password,
-  they enter at the address of the app, `login` is set for them and null for the team. Keep
-  roles inside the app (doctor, receptionist) in your own table keyed by `user.id`.
-- A "Sign out" button: `const r = await fetch('/_xflow/logout', { method: 'POST' })`, then
-  `location.href = (await r.json()).next`. It ends every sign-in of the person.
+  direct address and "Anyone with the link".
+- At the closed level the platform signs people in, and a function receives the person in
+  `event.xflow.user` (`id`, `role` in the organization, `name`). Keep roles inside the app
+  (doctor, receptionist) in your own table keyed by `user.id`.
+- People outside the organization (patients, pickers, clients) are not xflow accounts: make the
+  app "Anyone with the link" and give it its own sign-in, see below.
 - At "Anyone with the link" the platform signs nobody in: `event.xflow.user` is null for
   visitors. Accounts, sign-in and who sees which rows are the code of your app, see below.
 - `usePlatformAuth()` in the frontend knows the person only inside the xflow frame, and even
@@ -393,7 +390,7 @@ exports.handler = async (event) => {
   //         project), 'external' (an outside service with a key), 'schedule',
   //         'platform' (a person through xflow functions invoke or the web interface)
   // slug:   the address name of the calling app (<id>--<org>) or page, null otherwise
-  // user:   { id, role, name, login } of a signed-in person (login only for staff),
+  // user:   { id, role, name } of a signed-in person,
   //         null for anonymous visitors, pages, keys
   // ip:     the visitor's address, null for a schedule
 }
@@ -410,7 +407,7 @@ exports.minRole = 'developer'   // 'member' | 'developer' | 'owner'
 
 The platform refuses anything below that role before your code runs; it applies to people
 (apps, pages, `functions invoke`), not to keys and schedules. `member` is the people who only
-use the apps (staff of a clinic, managers), `developer` and `owner` build them. In the web
+use the apps (clinic employees, managers), `developer` and `owner` build them. In the web
 interface these roles are called «Просмотр» (`member`), «Редактор» (`developer`) and «Админ»
 (`owner`). Without the line
 every member of the project can call the function. Losing access