@getxflow/cli 1.0.7 → 1.0.9

package/dist/bin.js

@@ -309,7 +309,8 @@ async function main() {
     const args = (0, args_1.parseArgs)(process.argv.slice(2));
     // Decided here rather than in each command: the header of --project, the nudges and
     // every progress line are written on the way to a payload that has to stand alone.
-    (0, ui_1.setQuiet)((0, args_1.flagBool)(args, 'json'));
+    // An invoke is always such a payload: its answer goes straight into a pipe.
+    (0, ui_1.setQuiet)((0, args_1.flagBool)(args, 'json') || (args.words[0] === 'functions' && args.words[1] === 'invoke'));
     if ((0, args_1.flagBool)(args, 'version')) {
         (0, ui_1.out)(version_1.CLI_VERSION);
         return 0;

package/dist/commands/functions.js

@@ -50,9 +50,8 @@ async function functionsInvoke(args) {
         body: { method, ...(data !== undefined && method !== 'GET' && method !== 'HEAD' ? { body: data } : {}) },
         timeoutMs: 15 * 60_000,
     });
-    (0, ui_1.note)((0, ui_1.dim)(`${answer.status} in ${answer.elapsedMs} ms`));
     if (answer.body)
-        (0, ui_1.out)((0, args_1.flagBool)(args, 'json') ? answer.body : prettyBody(answer.body));
+        (0, ui_1.out)(prettyBody(answer.body));
     if (answer.status >= 400)
         throw new errors_1.CliError(`The function answered ${answer.status}`, answer.hint);
 }

package/dist/flags.js

@@ -57,7 +57,7 @@ exports.KNOWN = {
     'mcp install': ['show-token'],
     functions: ['project'],
     'functions list': ['project'],
-    'functions invoke': ['data', 'data-file', 'json', 'method', 'project'],
+    'functions invoke': ['data', 'data-file', 'method', 'project'],
     'functions logs': ['limit', 'project'],
     logs: ['limit', 'project', 'app'],
     env: ['project'],

package/dist/help.js

@@ -634,14 +634,13 @@ ${(0, ui_1.bold)("event.xflow.caller === 'platform'")} and the person in ${(0, u
   --data '{"a":1}'        request body (the method becomes POST by default)
   --data-file body.json   the same body from a file
   --method GET            a different method
-  --json                  the answer of the function alone, exactly as it came
 
 The body has to be JSON, and it is checked before the call goes out: PowerShell
 strips double quotes from a native call, so ${(0, ui_1.bold)('--data')} needs them escaped there
 (${(0, ui_1.bold)('--data \'{\\"a\\":1}\'')}) and a file needs nothing.
 
-Prints the status, the response time and the body; under ${(0, ui_1.bold)('--json')} the body
-alone. A non-zero exit code on 4xx and 5xx: in CI such a call has to fail the step. A
+Prints the body of the answer and nothing else, so it goes straight into a pipe
+(${(0, ui_1.bold)('| jq')}, ${(0, ui_1.bold)('| python')}). A non-zero exit code on 4xx and 5xx: in CI such a call has to fail the step. A
 refusal of the guard names its reason in the body (${(0, ui_1.bold)('not_bound')}, ${(0, ui_1.bold)('no_access')},
 ${(0, ui_1.bold)('functions_stopped')}); for a crash the hint points at ${(0, ui_1.bold)('xflow functions logs <name>')}.`,
     mcp: `${(0, ui_1.bold)('xflow mcp install')}: connect the agent to the platform directly

package/dist/session.js

@@ -55,12 +55,18 @@ function anonymous(config) {
  */
 async function findOrgFor(apiUrl, path) {
     const dead = [];
+    let frozen = null;
     for (const candidate of (0, credentials_1.listOrgs)(apiUrl)) {
         try {
             await (0, api_1.apiJson)({ apiUrl, token: candidate.token }, path);
             return { hit: candidate, dead };
         }
         catch (e) {
+            // A frozen organization refuses every path, so it may or may not hold this one.
+            if (e instanceof api_1.ApiError && e.limit?.code === 'subscription_blocked') {
+                frozen ??= e;
+                continue;
+            }
             if (e instanceof api_1.ApiError && (e.status === 401 || e.status === 403)) {
                 dead.push(candidate);
                 continue;
@@ -70,6 +76,8 @@ async function findOrgFor(apiUrl, path) {
             throw e;
         }
     }
+    if (frozen)
+        throw frozen;
     return { hit: null, dead };
 }
 function findProjectOrg(apiUrl, projectId) {

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '1.0.7';
+exports.CLI_VERSION = '1.0.9';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,24 +1,24 @@
-{
-  "name": "@getxflow/cli",
-  "version": "1.0.7",
-  "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
-  "license": "UNLICENSED",
-  "engines": {
-    "node": ">=20"
-  },
-  "bin": {
-    "xflow": "dist/bin.js"
-  },
-  "files": [
-    "dist",
-    "skills"
-  ],
-  "scripts": {
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
-    "prepublishOnly": "npm run build"
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@getxflow/cli",
+  "version": "1.0.9",
+  "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
+  "license": "UNLICENSED",
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "xflow": "dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "skills"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/skills/xflow/SKILL.md

@@ -23,7 +23,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 1.0.7, so the copy you are reading can be older than
+These instructions ship with xflow CLI 1.0.9, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -121,6 +121,10 @@ halfway through the work into a sentence said before it starts.
   deleting it.
 - Function minutes are shared by the whole organization: every app, page and schedule spends
   them. When they run out, every function of the organization stops (`functions_stopped`).
+- An unpaid plan stops the functions at once, and five days later freezes the organization:
+  every command except `xflow whoami`, and every MCP tool, answers `subscription_blocked`,
+  apps and pages show a "suspended" page. Nothing is deleted and no code fixes it: tell the
+  person that the owner pays the invoice in the organization settings, section «Тариф» (Plan).
 - The cap on how long one function call may run is written into the function when it is
   deployed, so a plan change reaches the cloud only with the next `xflow deploy functions` of
   each project, in both directions.
@@ -240,8 +244,8 @@ A person sets this in the web interface; you cannot, and you should not ask for
 - The plan decides which levels exist: on Free an app opens only inside xflow, Start adds the
   direct address and "Anyone with the link".
 - At the closed level the platform signs people in, and a function receives the person in
-  `event.xflow.user` (`id`, `role` in the organization, `name`). Keep roles inside the app
-  (doctor, receptionist) in your own table keyed by `user.id`.
+  `event.xflow.user` (`id`, `role` in the organization, `name`, `access` to the project).
+  Keep roles inside the app (doctor, receptionist) in your own table keyed by `user.id`.
 - People outside the organization (patients, pickers, clients) are not xflow accounts: make the
   app "Anyone with the link" and give it its own sign-in, see below.
 - At "Anyone with the link" the platform signs nobody in: `event.xflow.user` is null for
@@ -373,8 +377,9 @@ A function whose code and variables did not change is not shipped again, and one
 ship fails the whole deploy.
 
 Debugging a deployed function is two commands: `xflow functions invoke <name>` calls it as you,
-through the platform, and prints status, timing and body (`--data '{"a":1}'`, `--data-file
-body.json`, `--method GET`, `--json` for the body alone); `xflow functions logs <name>` shows
+through the platform, and prints the body alone, ready for a pipe (`--data '{"a":1}'`, `--data-file
+body.json`, `--method GET`; 4xx and 5xx exit non-zero; Windows PowerShell 5.1 prepends a BOM when
+piping to another program, so read it with `ConvertFrom-Json` or Python's `utf-8-sig`); `xflow functions logs <name>` shows
 the crashes and 5xx answers with stacks and console output, the latest 10 (`--limit N` for more).
 Only failed calls are logged. Empty output does not clear a function that fails at module start,
 runs over its time cap or out of memory: those never reach the logs, `invoke` shows them.
@@ -395,8 +400,8 @@ exports.handler = async (event) => {
   //         project), 'external' (an outside service with a key), 'schedule',
   //         'platform' (a person through xflow functions invoke or the web interface)
   // slug:   the address name of the calling app (<id>--<org>) or page, null otherwise
-  // user:   { id, role, name } of a signed-in person,
-  //         null for anonymous visitors, pages, keys
+  // user:   { id, role, name, access } of a signed-in person, null for anonymous
+  //         visitors, pages, keys. access: 'view' | 'edit' on this project
   // ip:     the visitor's address, null for a schedule
 }
 ```
@@ -404,6 +409,18 @@ exports.handler = async (event) => {
 Never trust an identity that arrives in the body or in a header of the request: the page lives
 on someone else's computer. `event.xflow` is the only identity the platform stands behind.
 
+Project access is separate from the role: a person who only views the project (`access:
+'view'`) still reaches every function. A function that writes refuses them:
+
+```js
+if (event.xflow.user && event.xflow.user.access !== 'edit') {
+  return { statusCode: 403, body: JSON.stringify({ error: 'Read-only access' }) }
+}
+```
+
+To remember who did something, store `user.id` and `user.name` in the row: the name is never
+empty, and the app has no other way to look up other people.
+
 A function that changes data should say who may call it instead of checking the role by hand:
 
 ```js