@getxflow/cli 1.0.6 → 1.0.8

package/dist/commands/auth.js

@@ -141,6 +141,8 @@ async function whoami() {
         const pkg = me.billing.package_title ? `, ${me.billing.package_title}` : '';
         (0, ui_1.out)('');
         (0, ui_1.out)(`Plan: ${me.billing.plan_title}${pkg}${SUBSCRIPTION_STATE[me.billing.status] ?? ''}`);
+        if (me.billing.functions_stopped)
+            (0, ui_1.warn)(me.billing.functions_stopped);
     }
     if (me.quotas) {
         (0, ui_1.out)('');

package/dist/commands/db.js

@@ -148,7 +148,13 @@ function moveLine(move) {
     return move.finished_at ? `${move.note} (${(0, ui_1.formatAge)(move.finished_at)})` : move.note;
 }
 function printDatabases(databases, total, truncated) {
-    (0, ui_1.table)(databases.map((database) => [database.name, database.id, database.schema ?? '-', serverLabel(database.server)]));
+    (0, ui_1.table)(databases.map((database) => [
+        database.name,
+        database.id,
+        database.schema ?? '-',
+        serverLabel(database.server),
+        typeof database.bytes === 'number' ? (0, ui_1.formatBytes)(database.bytes) : '',
+    ]));
     if (truncated)
         (0, ui_1.note)((0, ui_1.dim)(`  Shown ${databases.length} of ${total}`));
     for (const database of databases) {

package/dist/session.js

@@ -55,12 +55,18 @@ function anonymous(config) {
  */
 async function findOrgFor(apiUrl, path) {
     const dead = [];
+    let frozen = null;
     for (const candidate of (0, credentials_1.listOrgs)(apiUrl)) {
         try {
             await (0, api_1.apiJson)({ apiUrl, token: candidate.token }, path);
             return { hit: candidate, dead };
         }
         catch (e) {
+            // A frozen organization refuses every path, so it may or may not hold this one.
+            if (e instanceof api_1.ApiError && e.limit?.code === 'subscription_blocked') {
+                frozen ??= e;
+                continue;
+            }
             if (e instanceof api_1.ApiError && (e.status === 401 || e.status === 403)) {
                 dead.push(candidate);
                 continue;
@@ -70,6 +76,8 @@ async function findOrgFor(apiUrl, path) {
             throw e;
         }
     }
+    if (frozen)
+        throw frozen;
     return { hit: null, dead };
 }
 function findProjectOrg(apiUrl, projectId) {

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '1.0.6';
+exports.CLI_VERSION = '1.0.8';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -23,7 +23,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 1.0.6, so the copy you are reading can be older than
+These instructions ship with xflow CLI 1.0.8, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -59,7 +59,8 @@ the error points away from the cause. The sections below carry the details.
 7. When `xflow db migrate` answers `db_write_locked`, or an INSERT or CREATE TABLE in a
    function fails with `permission denied` (42501), the database is over its plan size and
    Postgres itself refuses. Reads, updates and deletes keep working, so the fix is a migration
-   that deletes data, never a rewrite of the SQL. Write comes back within the hour.
+   that deletes data, never a rewrite of the SQL. Write comes back within the hour. The limit
+   is shared by the organization: `xflow db list` shows the size of each project database.
 8. Heavy media does not travel with the sources. Photos, video and PDFs go up with
    `xflow storage push`, not into the repository: the archive is capped at 10 MB.
 
@@ -120,6 +121,10 @@ halfway through the work into a sentence said before it starts.
   deleting it.
 - Function minutes are shared by the whole organization: every app, page and schedule spends
   them. When they run out, every function of the organization stops (`functions_stopped`).
+- An unpaid plan stops the functions at once, and five days later freezes the organization:
+  every command except `xflow whoami`, and every MCP tool, answers `subscription_blocked`,
+  apps and pages show a "suspended" page. Nothing is deleted and no code fixes it: tell the
+  person that the owner pays the invoice in the organization settings, section «Тариф» (Plan).
 - The cap on how long one function call may run is written into the function when it is
   deployed, so a plan change reaches the cloud only with the next `xflow deploy functions` of
   each project, in both directions.
@@ -239,8 +244,8 @@ A person sets this in the web interface; you cannot, and you should not ask for
 - The plan decides which levels exist: on Free an app opens only inside xflow, Start adds the
   direct address and "Anyone with the link".
 - At the closed level the platform signs people in, and a function receives the person in
-  `event.xflow.user` (`id`, `role` in the organization, `name`). Keep roles inside the app
-  (doctor, receptionist) in your own table keyed by `user.id`.
+  `event.xflow.user` (`id`, `role` in the organization, `name`, `access` to the project).
+  Keep roles inside the app (doctor, receptionist) in your own table keyed by `user.id`.
 - People outside the organization (patients, pickers, clients) are not xflow accounts: make the
   app "Anyone with the link" and give it its own sign-in, see below.
 - At "Anyone with the link" the platform signs nobody in: `event.xflow.user` is null for
@@ -394,8 +399,8 @@ exports.handler = async (event) => {
   //         project), 'external' (an outside service with a key), 'schedule',
   //         'platform' (a person through xflow functions invoke or the web interface)
   // slug:   the address name of the calling app (<id>--<org>) or page, null otherwise
-  // user:   { id, role, name } of a signed-in person,
-  //         null for anonymous visitors, pages, keys
+  // user:   { id, role, name, access } of a signed-in person, null for anonymous
+  //         visitors, pages, keys. access: 'view' | 'edit' on this project
   // ip:     the visitor's address, null for a schedule
 }
 ```
@@ -403,6 +408,18 @@ exports.handler = async (event) => {
 Never trust an identity that arrives in the body or in a header of the request: the page lives
 on someone else's computer. `event.xflow` is the only identity the platform stands behind.
 
+Project access is separate from the role: a person who only views the project (`access:
+'view'`) still reaches every function. A function that writes refuses them:
+
+```js
+if (event.xflow.user && event.xflow.user.access !== 'edit') {
+  return { statusCode: 403, body: JSON.stringify({ error: 'Read-only access' }) }
+}
+```
+
+To remember who did something, store `user.id` and `user.name` in the row: the name is never
+empty, and the app has no other way to look up other people.
+
 A function that changes data should say who may call it instead of checking the role by hand:
 
 ```js