@getxflow/cli 1.1.0 → 1.1.1

package/dist/commands/functions.js

@@ -24,7 +24,7 @@ async function functionsList(args) {
         fn.last_called_at ? `called ${(0, ui_1.formatAge)(fn.last_called_at)}` : 'never called',
         fn.last_error_at ? `failed ${(0, ui_1.formatAge)(fn.last_error_at)}` : '',
     ]));
-    (0, ui_1.note)((0, ui_1.dim)('  callers: the app folders and page names allowed to call it (functions in the root xflow.json)'));
+    (0, ui_1.note)((0, ui_1.dim)('  callers: the app folders allowed to call it (functions in the root xflow.json)'));
     (0, ui_1.note)((0, ui_1.dim)('  open: a caller is public, so anyone on the internet can call it; no callers: a workflow'));
     (0, ui_1.note)((0, ui_1.dim)(`  Webhooks and other functions call ${functions[0].url.replace(/\/[^/]+$/, '/<name>')} with a key`));
 }

package/dist/commands/pages.js

@@ -99,7 +99,6 @@ async function pagesCreate(args) {
     (0, ui_1.ok)(`Page "${result.page.title}" is live: ${result.file_count} file(s), ${(0, ui_1.formatBytes)(result.size_bytes)}`);
     (0, ui_1.out)(result.page.url);
     (0, ui_1.note)((0, ui_1.dim)(`  Anyone with the address sees it within seconds. The next version: xflow pages deploy ${result.page.slug} <path>`));
-    (0, ui_1.note)((0, ui_1.dim)(`  A backend for it: name "${result.page.slug}" in functions.<name>.callers of a project, xflow deploy functions, then fetch /_fn/<name>`));
 }
 function contentTypeOf(upload) {
     return upload.kind === 'zip' ? 'application/zip' : 'text/html';

package/dist/help.js

@@ -301,11 +301,10 @@ build it and upload what the build writes. Dot entries are skipped. At most 5 MB
 unpacked and 1000 files.
 
 The page is public, so a file holding a secret key is refused whole: every visitor would read
-it. A page that needs a backend (a form, a lookup) calls ${(0, ui_1.bold)('/_fn/<name>')} on its own address,
-and only a function whose callers in the root xflow.json of its project name the page answers:
-add the page name there and run ${(0, ui_1.bold)('xflow deploy functions')}. The page has to exist first.
-Such a function is open to the whole internet. Search engines are asked not to index pages,
-so do not promise SEO.
+it. A page has no backend: a form or a lookup belongs in an app with access "anyone". The one
+key a page may hold is a function key, and it opens that function to every visitor: an HTML
+form can post to its webhook address with ${(0, ui_1.bold)('?key=')}, while fetch cannot read the answer
+(no CORS). Search engines are asked not to index pages, so do not promise SEO.
 
 ${(0, ui_1.bold)('Deleting is final.')} The address goes empty and every version of the page is gone: there
 is no undo and no copy on the platform side. The name stays reserved for the organization, so
@@ -618,14 +617,14 @@ of the project runs the new code the moment it finishes; there is no publish ste
 
 Who may call a function is its callers, in the root xflow.json:
 
-  { "projectId": "…", "functions": { "book-slot": { "callers": ["zapis", "clinic-landing"] } } }
+  { "projectId": "…", "functions": { "book-slot": { "callers": ["zapis"] } } }
 
-A caller is an app folder of this project (apps/zapis is "zapis") or the name of a page of
-the organization. A function nobody lists has no callers: a workflow, woken by a schedule,
-by a service holding a key a person issued, or by ${(0, ui_1.bold)('invoke')}. ${(0, ui_1.bold)('open')} in the list means a
-caller is public (a page, or an app anyone with the link opens), so anyone on the internet
-can call it. The address in the note under the table is for webhooks and other functions,
-with a key; apps and pages call ${(0, ui_1.bold)('/_fn/<name>')} on their own address.
+A caller is an app folder of this project (apps/zapis is "zapis"); pages are static and call
+nothing. A function nobody lists has no callers: a workflow, woken by a schedule, by a service
+holding a key a person issued, or by ${(0, ui_1.bold)('invoke')}. ${(0, ui_1.bold)('open')} in the list means a caller is an app
+anyone with the link opens, so anyone on the internet can call it. The address in the note
+under the table is for webhooks and other functions, with a key; apps call ${(0, ui_1.bold)('/_fn/<name>')} on
+their own address.
 
 ${(0, ui_1.bold)('invoke')} calls it as the person who owns the key: the platform checks the role, gives
 the function a one-minute ticket and calls it itself, so the function sees

package/dist/template.js

@@ -13,7 +13,7 @@ const README = `# %NAME%
 A project on XFlow: one database, cloud functions and the apps that use them.
 
 \`\`\`
-xflow.json          projectId, and which apps and pages may call each function
+xflow.json          projectId, and which apps may call each function
 package.json        dependencies of the functions
 functions/<name>/   cloud functions, shared by every app
 migrations/         the database of the project

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '1.1.0';
+exports.CLI_VERSION = '1.1.1';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -23,7 +23,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 1.1.0, so the copy you are reading can be older than
+These instructions ship with xflow CLI 1.1.1, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -48,10 +48,10 @@ the error points away from the cause. The sections below carry the details.
 3. Never delete a `functions/<name>/` directory unless the user asked for that
    function to go. The next deploy removes it from the cloud together with its keys and
    schedules, and that is final.
-4. A function an app or a page calls needs that caller in its `callers` in the root
+4. A function an app calls needs that app in its `callers` in the root
    `xflow.json`. Without it the call answers 404 `not_bound`, and a new function is not
    reachable from anywhere.
-5. Every function with a public caller (a page, an app open to anyone) can be called by
+5. Every function called by an app open to anyone can be called by
    anybody on the internet with curl. Write it as such, see **Your function is open to the
    whole internet**.
 6. An already applied migration is never re-run, and `xflow db migrate` refuses a
@@ -128,6 +128,9 @@ halfway through the work into a sentence said before it starts.
 - The cap on how long one function call may run is written into the function when it is
   deployed, so a plan change reaches the cloud only with the next `xflow deploy functions` of
   each project, in both directions.
+- One function runs at most a plan-set number of calls at once: Free 5, Start 15, Business 35
+  per cloud zone (the cloud has three, the spread is not promised). A call over it gets 429 at
+  once: fan out in batches of that size, never all items of a list in parallel.
 
 A limit refusal is not a bad request. The CLI prints a line starting with `Plan limit:`, the
 API answers `code: "forbidden"` with a `limit` object (`code`, `used`, `limit`), MCP tools
@@ -210,8 +213,7 @@ An app:
 
 The project root: function names are lowercase latin letters, digits and hyphens, up to 41
 characters (`send-mail`, not `sendMail`); every name under `functions` in `xflow.json` has its
-`functions/<name>/index.ts`; every caller is an app folder of this project or an existing page
-of the organization (`unknown-caller`).
+`functions/<name>/index.ts`; every caller is an app folder of this project (`unknown-caller`).
 
 Passes with a line `Unfinished:` instead of blocking: the template's page title, no
 `<link rel="icon">` in `index.html`, an `exports.access` left in a function (it does nothing).
@@ -263,14 +265,14 @@ The root `xflow.json` names the callers of each function:
       "projectId": "…",
       "functions": {
         "list-slots": { "callers": ["zapis", "priem"] },
-        "book-slot":  { "callers": ["zapis", "clinic-landing"] }
+        "book-slot":  { "callers": ["zapis"] }
       }
     }
 
-- A caller is an app folder of this project (`apps/zapis` is `"zapis"`) or the address name of
-  a page of the organization (`clinic` for `clinic.xflowpage.ru`). A function without callers is
-  left out of `functions` or given `"callers": []`, the same thing.
-- A function nobody lists has no callers: no app and no page reaches it. That is a workflow,
+- A caller is an app folder of this project (`apps/zapis` is `"zapis"`); a page is never
+  a caller. A function without callers is left out of `functions` or given `"callers": []`,
+  the same thing.
+- A function nobody lists has no callers: no app reaches it. That is a workflow,
   run by a schedule, a key or `xflow functions invoke`.
 - Callers ship with `xflow deploy functions` and come back with its `--revision N`.
 - The app calls `xflow.functions.invoke('book-slot', { body })` from `src/lib/xflow.ts`. The call
@@ -281,15 +283,13 @@ The root `xflow.json` names the callers of each function:
   `invalid_credential` (401, the visitor has to sign in again), `no_access`, `role_too_low`,
   `functions_stopped` (403, minutes ran out or the plan is unpaid: a person settles it),
   `rate_limited` (429), `unavailable` (503, retry later). Branch on `code`, never on the message.
-- A page has to exist before a function can name it: create the page, then deploy functions.
 
 ## Your function is open to the whole internet
 
-A function is open when any of its callers is public: a page (always) or an app at "Anyone
-with the link". `xflow deploy functions` says so in a line of its own, `xflow functions list`
+A function is open when an app at "Anyone with the link" is among its callers. `xflow deploy functions` says so in a line of its own, `xflow functions list`
 prints `open`, the web interface marks it.
 
-Open means anybody can call it with curl, without your page: the browser is not a gate.
+Open means anybody can call it with curl, without your app: the browser is not a gate.
 Hiding the address, checking `Origin` or `Referer`, a token baked into the bundle: all of it is
 readable or forgeable and protects nothing. Write every open function as if the request came
 from a stranger, because it may:
@@ -346,14 +346,13 @@ At the closed levels do none of this: the platform already knows the person.
   is uploaded, no build, no publish step, no database. A landing page, a presentation, an invoice.
 - An app is source the platform builds: versions and publish, access levels, a database through
   functions. Anything people sign in to, enter data into or come back to.
-- A form open to strangers on a plan without "Anyone with the link" is a page: pages are public
-  on every plan.
 - Keep the sources of a page outside the project folder, or list them in `.xflowignore`: the
   root travels with `deploy functions`.
-- A page that needs a backend (a form, a lookup) calls `/_fn/<name>` on its own address with the
-  header `X-Xflow-Fn: 1` (without it 403 `bad_request`), and a function of a project answers only
-  when its callers name the page. The function is then open. A refusal carries its code in
-  `reason` of the JSON body, the same codes as above.
+- A page has no backend. A form or a lookup for strangers is an app at "Anyone with the link"
+  (a paid plan): the platform checks every call to its functions.
+- A function key on a page is allowed, and it opens that function to every visitor: an HTML
+  form posts to `https://fn.xflowpage.ru/<projectId>/<name>?key=...`, fetch cannot read the
+  answer (no CORS). Nothing guards it but the function's own checks: say so to the user.
 
 ## Cloud functions
 
@@ -397,12 +396,12 @@ The platform checks every call before your code runs and hands the answer over i
 ```js
 exports.handler = async (event) => {
   const { caller, slug, user, ip } = event.xflow
-  // caller: 'app' (an app of this project), 'page', 'service' (another function of this
+  // caller: 'app' (an app of this project), 'service' (another function of this
   //         project), 'external' (an outside service with a key), 'schedule',
   //         'platform' (a person through xflow functions invoke or the web interface)
-  // slug:   the address name of the calling app (<id>--<org>) or page, null otherwise
+  // slug:   the address name of the calling app (<id>--<org>), null otherwise
   // user:   { id, role, name, access } of a signed-in person, null for anonymous
-  //         visitors, pages, keys. access: 'view' | 'edit' on this project
+  //         visitors and keys. access: 'view' | 'edit' on this project
   // ip:     the visitor's address, null for a schedule
 }
 ```
@@ -429,7 +428,7 @@ exports.minRole = 'developer'   // 'member' | 'developer' | 'owner'
 ```
 
 The platform refuses anything below that role before your code runs; it applies to people
-(apps, pages, `functions invoke`), not to keys and schedules. `member` is the people who only
+(apps, `functions invoke`), not to keys and schedules. `member` is the people who only
 use the apps (clinic employees, managers), `developer` and `owner` build them. In the web
 interface these roles are called «Просмотр» (`member`), «Редактор» (`developer`) and «Админ»
 (`owner`). Without the line