@getxflow/cli 1.5.0 → 1.6.0

package/dist/bin.js

@@ -25,7 +25,6 @@ const schedules_1 = require("./commands/schedules");
 const skills_1 = require("./commands/skills");
 const sources_1 = require("./commands/sources");
 const storage_1 = require("./commands/storage");
-const pages_1 = require("./commands/pages");
 const deploy_1 = require("./commands/deploy");
 const dev_1 = require("./commands/dev");
 const update_1 = require("./commands/update");
@@ -199,32 +198,6 @@ async function run(args) {
                 return;
             }
             throw new errors_1.CliError(`Unknown command: storage ${second}`, 'Available: ls, push and rm');
-        case 'pages':
-            if (second === 'create') {
-                await (0, pages_1.pagesCreate)(rest);
-                return;
-            }
-            if (second === 'deploy') {
-                await (0, pages_1.pagesDeploy)(rest);
-                return;
-            }
-            if (second === 'status') {
-                await (0, pages_1.pagesStatus)(rest);
-                return;
-            }
-            if (second === 'rollback') {
-                await (0, pages_1.pagesRollback)(rest);
-                return;
-            }
-            if (second === 'rm' || second === 'remove') {
-                await (0, pages_1.pagesRemove)(rest);
-                return;
-            }
-            if (second === undefined || second === 'list') {
-                await (0, pages_1.pagesList)(rest);
-                return;
-            }
-            throw new errors_1.CliError(`Unknown command: pages ${second}`, 'Available: list, create, deploy, status, rollback and rm');
         case 'status':
             await (0, sources_1.status)();
             return;
@@ -334,7 +307,7 @@ async function main() {
                 // XFLOW_TOKEN is taken as given and no organization is looked for, so a
                 // project of another one answers "not found" with nothing else to say.
                 if (process.env.XFLOW_TOKEN?.trim()) {
-                    (0, ui_1.fatalNote)((0, ui_1.dim)('  XFLOW_TOKEN is set: it is the key of one organization and is used as it comes, so a project or a page of another one is not found'));
+                    (0, ui_1.fatalNote)((0, ui_1.dim)('  XFLOW_TOKEN is set: it is the key of one organization and is used as it comes, so a project of another one is not found'));
                 }
                 else if (e.apiUrl && (0, credentials_1.listOrgs)(e.apiUrl).length > 1) {
                     (0, ui_1.fatalNote)((0, ui_1.dim)('  Several organizations are signed in: the answer may live in another one, see xflow org'));

package/dist/commands/deploy.js

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.versionComment = versionComment;
 exports.statedRevision = statedRevision;
 exports.deploy = deploy;
 exports.publish = publish;
@@ -70,7 +69,7 @@ async function startBuild(client, base, revision, allowRemovals, comment) {
 const MAX_COMMENT_LENGTH = 200;
 /** Control and bidi-override characters: they spoof terminals, not comments. */
 const COMMENT_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
-/** The version comment as typed after -m, cleaned; empty when there is none. Pages take the same. */
+/** The version comment as typed after -m, cleaned; empty when there is none. */
 function versionComment(raw) {
     const comment = (raw ?? '').replace(/\s+/g, ' ').replace(COMMENT_CONTROL_CHARS, '').trim();
     if (comment.length > MAX_COMMENT_LENGTH) {

package/dist/commands/env.js

@@ -8,14 +8,12 @@ exports.envRemove = envRemove;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const api_1 = require("../api");
-const args_1 = require("../args");
 const config_1 = require("../config");
 const errors_1 = require("../errors");
 const session_1 = require("../session");
 const ui_1 = require("../ui");
 const SCOPE_LABEL = {
-    organization: 'the whole organization',
-    project: 'this project only',
+    project: 'this project',
     connection: 'from a connected service, read-only',
 };
 const FUNCTIONS_DIR = 'functions';
@@ -101,7 +99,7 @@ async function envList(args) {
         (0, ui_1.note)((0, ui_1.dim)('  To store one: xflow env set SMTP_PASSWORD=secret'));
         return;
     }
-    (0, ui_1.table)(rows.map((row) => [row.name, SCOPE_LABEL[row.scope] ?? SCOPE_LABEL.organization]));
+    (0, ui_1.table)(rows.map((row) => [row.name, SCOPE_LABEL[row.scope]]));
     (0, ui_1.note)((0, ui_1.dim)('  The platform never returns values: they are visible only inside the function'));
 }
 /** Check that every referenced variable is stored. */
@@ -172,12 +170,9 @@ async function envSet(args) {
     const value = pair.slice(pair.indexOf('=') + 1);
     const result = await (0, api_1.apiJson)(client, `/api/v1/projects/${config.projectId}/env`, {
         method: 'POST',
-        // The word goes to the platform as typed: it knows the two scopes and
-        // refuses a third. Guessing here would have made --scope proj mean the
-        // whole organization, which is the opposite of what such a typo means.
-        body: { name, value, scope: (0, args_1.flagString)(args, 'scope') },
+        body: { name, value },
     });
-    (0, ui_1.ok)(`${(0, ui_1.bold)(result.name)} stored (${result.scope === 'project' ? 'this project only' : 'the whole organization'})`);
+    (0, ui_1.ok)(`${(0, ui_1.bold)(result.name)} stored`);
     // Values reach a function on its next deploy.
     const users = referencedByFunctions(root).needed.get(name);
     if (users && users.length > 0) {

package/dist/commands/storage.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.contentTypeFor = contentTypeFor;
-exports.collectMedia = collectMedia;
 exports.planBatches = planBatches;
 exports.caseCollisions = caseCollisions;
 exports.storageList = storageList;
@@ -75,7 +74,7 @@ function contentTypeFor(name) {
  * what one is asked to put there so it stays out of the 10 MB archive.
  *
  * Dot entries and symlinks are skipped: pointing push at a working copy should
- * not upload .git, and a link is not ours to follow. Pages walk a site the same way.
+ * not upload .git, and a link is not ours to follow.
  */
 function collectMedia(root, prefix = '') {
     const found = [];

package/dist/flags.js

@@ -60,7 +60,7 @@ exports.KNOWN = {
     logs: ['limit', 'project', 'app'],
     env: ['project'],
     'env list': ['project'],
-    'env set': ['scope'],
+    'env set': [],
     'env rm': ['project'],
     'env remove': ['project'],
     'env check': [],
@@ -87,14 +87,6 @@ exports.KNOWN = {
     'storage push': ['to', 'replace', 'json', 'project'],
     'storage rm': ['folder', 'yes', 'project'],
     'storage remove': ['folder', 'yes', 'project'],
-    pages: ['json'],
-    'pages list': ['json'],
-    'pages create': ['slug'],
-    'pages deploy': ['message'],
-    'pages status': ['json'],
-    'pages rollback': [],
-    'pages rm': ['yes'],
-    'pages remove': ['yes'],
     status: [],
     dev: [],
     pull: ['into', 'force', 'revision'],
@@ -144,7 +136,6 @@ const NAMESPACES = new Set([
     'schedules',
     'db',
     'storage',
-    'pages',
 ]);
 /** The command these words name, as far as the table knows it. */
 function commandOf(words) {

package/dist/help.js

@@ -98,16 +98,6 @@ ${(0, ui_1.bold)('Database')}
   xflow db migrate [--dry-run] [--allow-destructive]
                                   apply the migrations from migrations/*.sql
 
-${(0, ui_1.bold)('Pages')}
-  xflow pages                     public sites of the organization at <name>.xflowpage.ru
-  xflow pages create <title> <folder|.zip|.html> [--slug name]
-                                  a new page with the site on it, live at once
-  xflow pages deploy <page> <folder|.zip|.html> [-m "what changed"]
-                                  upload the site: live at once, there is no publish step
-  xflow pages status <page>       the page and its versions
-  xflow pages rollback <page> <N> put an earlier version back on the address
-  xflow pages rm <page> --yes     delete the page for good: the address empties
-
 ${(0, ui_1.bold)('Reference')}
   xflow logs [--limit N]          browser errors of the published apps
   xflow projects list             projects of the organization
@@ -262,53 +252,6 @@ how they differ, ${(0, ui_1.bold)('xflow pull --into ./server-copy')} fetches th
 
 In a folder that is already linked, the command points xflow.json at the other project and
 keeps the rest of the file. A new project instead of an existing one: ${(0, ui_1.bold)('xflow init')}.`,
-    pages: `${(0, ui_1.bold)('xflow pages')}: public sites of the organization
-
-A page is a static site at https://<name>.xflowpage.ru: a landing page, a presentation, an
-invoice for people outside the organization. It opens by its address for anyone, without
-signing in, and has no build, no publish step and no database. An app is the opposite: code
-the platform builds, with versions, access levels and a database through functions.
-
-  xflow pages                          the pages, their state and address
-  xflow pages create <title> <path>    a new page with its first version: there are no
-                                       empty pages
-      --slug <name>                    the name in the address; without it the name is made
-                                       from the title, with a random tail
-  xflow pages deploy <page> <path>     upload a new version
-      -m <text>                        what changed, one short line: it names the version
-  xflow pages status <page>            the page and its versions
-  xflow pages rollback <page> <N>      put version N back on the address
-  xflow pages rm <page>                delete the page
-      --yes                            without it the command names what goes and stops
-
-${(0, ui_1.bold)('<path>')} is a folder with index.html at the top, its .zip, or one .html file.
-${(0, ui_1.bold)('<page>')} is the name from the address or the id. ${(0, ui_1.bold)('--json')} on list and status
-prints the answer as JSON. A page belongs to the organization, not to a project, so there is
-no ${(0, ui_1.bold)('--project')}: the key is picked as for every other command (${(0, ui_1.bold)('xflow help org')}).
-
-${(0, ui_1.bold)('An upload is live at once.')} There is no draft and no publish step: anyone with the
-address sees the new version within seconds. Uploading the same files again changes nothing.
-The files of the last 5 versions are kept, so a rollback takes seconds and needs no upload.
-
-What goes up is the built site: HTML, CSS, JS, images, fonts, PDF, audio and video. No code
-runs on the platform side, and a folder with package.json is refused as the sources of a site:
-build it and upload what the build writes. Dot entries are skipped. At most 5 MB zipped, 25 MB
-unpacked and 1000 files.
-
-The page is public, so a file holding a secret key is refused whole: every visitor would read
-it. A page has no backend: a form or a lookup belongs in an app with access "anyone". The one
-key a page may hold is a function key, and it opens that function to every visitor: an HTML
-form can post to its webhook address with ${(0, ui_1.bold)('?key=')}, while fetch cannot read the answer
-(no CORS). Search engines are asked not to index pages, so do not promise SEO.
-
-${(0, ui_1.bold)('Deleting is final.')} The address goes empty and every version of the page is gone: there
-is no undo and no copy on the platform side. The name stays reserved for the organization, so
-the same ${(0, ui_1.bold)('--slug')} is free for the next page of yours and taken for everyone else. A
-throwaway page put up to try something is worth deleting the same way it was made.
-
-A page takes the key of the whole organization, the one ${(0, ui_1.bold)('xflow login')} issues: a key
-scoped to projects is refused. A page is deleted by whoever made it, or by the owner of the
-organization. Switching a page off for a while is for a person, in the platform interface.`,
     update: `${(0, ui_1.bold)('xflow update')}: bring the CLI up to date
 
 Installs the published version and, if anything changed, rewrites the platform
@@ -463,11 +406,7 @@ the function. So keep your own copy wherever you got it from.
   xflow env set SMTP_PASSWORD=…    store
   xflow env rm SMTP_PASSWORD       delete
 
-  --scope project                  visible to this project only
-  --scope organization             visible to every project of the organization (the default)
-
-Those two words are the whole list: a third is refused rather than read as the default,
-because a value meant for one project would have gone out to all of them.
+A variable belongs to this project: functions of other projects never see it.
 
 ${(0, ui_1.bold)('check')} reads the sources in ${(0, ui_1.bold)('functions/')} and looks for ${(0, ui_1.bold)('process.env.NAME')}
 references. The same rule applies on deploy: a function receives only the variables it
@@ -609,8 +548,7 @@ Who may call a function is its callers, in the root xflow.json:
 
   { "projectId": "…", "functions": { "book-slot": { "callers": ["zapis"] } } }
 
-A caller is an app folder of this project (apps/zapis is "zapis"); pages are static and call
-nothing. A function nobody lists has no callers: a workflow, woken by a schedule, by a service
+A caller is an app folder of this project (apps/zapis is "zapis"). A function nobody lists has no callers: a workflow, woken by a schedule, by a service
 holding a key a person issued, or by ${(0, ui_1.bold)('invoke')}. ${(0, ui_1.bold)('open')} in the list means a caller is an app
 anyone with the link opens, so anyone on the internet can call it. The address in the note
 under the table is for webhooks and other functions, with a key; apps call ${(0, ui_1.bold)('/_fn/<name>')} on

package/dist/limits.js

@@ -4,12 +4,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.limitLine = limitLine;
 exports.quotaRows = quotaRows;
 const DENIAL_LABELS = {
-    limit_projects: 'projects, the platform cap',
+    limit_projects: 'new projects today, the platform cap (resets at 00:00 UTC)',
     limit_apps: 'apps',
     plan_app_access: 'access levels of apps',
     functions_stopped: 'function minutes, the functions of the organization are stopped',
     limit_connections: 'active connector connections',
-    limit_pages: 'public pages',
     limit_functions: 'cloud functions',
     limit_builds: 'builds this month',
     limit_builds_concurrent: 'builds running at once',
@@ -32,12 +31,12 @@ function limitLine(detail) {
         : detail.code === 'limit_schedule_interval'
             ? `, every ${detail.used} min against a ${detail.limit} min minimum`
             : `, ${detail.used} of ${detail.limit} used`;
-    return `Plan limit: ${label}${numbers}. Repeating the same command will not help.`;
+    const tail = detail.code === 'limit_projects' ? 'Repeating it before then will not help.' : 'Repeating the same command will not help.';
+    return `Plan limit: ${label}${numbers}. ${tail}`;
 }
 const QUOTA_ORDER = [
     'apps',
     'connections',
-    'pages',
     'functions',
     'schedules',
     'people',
@@ -49,7 +48,6 @@ const QUOTA_ORDER = [
 const QUOTA_LABELS = {
     apps: 'Apps',
     connections: 'Active connections',
-    pages: 'Public pages',
     functions: 'Cloud functions',
     schedules: 'Schedules',
     people: 'People',

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '1.5.0';
+exports.CLI_VERSION = '1.6.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: xflow
-description: Build, deploy and publish apps on the XFlow platform with the xflow CLI. Use whenever a folder has xflow.json (the project root or an app folder in apps/), and for any task that touches a project and its apps, deployment, publishing, rollback, source sync, who may open an app or call a function, sign-in inside a public app, the project database or SQL migrations, cloud functions, schedules, environment variables and secrets, file storage and uploads of photos, video or PDFs, connected accounts of external services, production errors and logs, UI built on the template components, or a public page on xflowpage.ru (a landing page, presentation or invoice for people outside the organization).
+description: Build, deploy and publish apps on the XFlow platform with the xflow CLI. Use whenever a folder has xflow.json (the project root or an app folder in apps/), and for any task that touches a project and its apps, deployment, publishing, rollback, source sync, who may open an app or call a function, sign-in inside a public app, the project database or SQL migrations, cloud functions, schedules, environment variables and secrets, file storage and uploads of photos, video or PDFs, connected accounts of external services, production errors and logs, UI built on the template components, or a public site for people outside the organization (a landing page, presentation or invoice).
 ---
 
 # XFlow
@@ -28,7 +28,7 @@ instead of guessing; give the person https://docs.getxflow.com when they ask how
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 1.5.0, so the copy you are reading can be older than
+These instructions ship with xflow CLI 1.6.0, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -113,9 +113,10 @@ One folder per project, apps in subfolders:
 
 ## Plan limits
 
-The organization runs on a plan with limits: apps, functions, pages, active connections,
-people in the organization, database and file storage, function minutes, builds per month and at once, schedules
-(one count for all projects of the organization) and how often they may run, and which access levels an app may have. Most are finite; a plan
+The organization runs on a plan with limits: apps, active connections, people in the
+organization, database and file storage, function minutes, builds per month and at once, how often
+schedules may run, and which access levels an app may have. The number of functions, schedules
+and projects is not capped; at most 15 new projects a day (UTC) per organization, deleted ones count. Most are finite; a plan
 may leave one uncapped, and then `whoami` prints `no limit` instead of a ceiling.
 `xflow whoami` prints every one of them next to what is used, and the rights of your own key
 with them: destroying data (a migration or `db exec`), deleting files from storage, moving a database and
@@ -124,18 +125,19 @@ halfway through the work into a sentence said before it starts.
 
 - Connections are counted while active: switching an unused one off frees the seat without
   deleting it.
-- Function minutes are shared by the whole organization: every app, page and schedule spends
+- Function minutes are shared by the whole organization: every app and schedule spends
   them. When they run out, every function of the organization stops (`functions_stopped`).
 - An unpaid plan stops the functions at once, and five days later freezes the organization:
   every command except `xflow whoami` answers `subscription_blocked`,
-  apps and pages show a "suspended" page. Nothing is deleted and no code fixes it: tell the
+  apps show a "suspended" page. Nothing is deleted and no code fixes it: tell the
   person that the owner pays the invoice in the organization settings, section «Тариф» (Plan).
 - The cap on how long one function call may run is written into the function when it is
   deployed, so a plan change reaches the cloud only with the next `xflow deploy functions` of
   each project, in both directions.
-- One function runs at most a plan-set number of calls at once: Free 5, Start 15, Business 35
-  per cloud zone (the cloud has three, the spread is not promised). A call over it gets 429 at
-  once: fan out in batches of that size, never all items of a list in parallel.
+- The functions of one project take a plan-set rate: Free 5 calls a second (a burst of 60),
+  Start 20 (300), Business 50 (750). A call over the rate gets 429 at once. Calls at the same time:
+  Free 4, Start 10, Business 25, the rest wait in a queue. Fan out in batches of that size, never
+  all items of a list in parallel.
 
 A limit refusal is not a bad request. The CLI prints a line starting with `Plan limit:`, the
 API answers `code: "forbidden"` with a `limit` object (`code`, `used`, `limit`). Retrying, renaming or rewriting the code changes nothing: tell the user
@@ -274,9 +276,8 @@ The root `xflow.json` names the callers of each function:
       }
     }
 
-- A caller is an app folder of this project (`apps/zapis` is `"zapis"`); a page is never
-  a caller. A function without callers is left out of `functions` or given `"callers": []`,
-  the same thing.
+- A caller is an app folder of this project (`apps/zapis` is `"zapis"`). A function without
+  callers is left out of `functions` or given `"callers": []`, the same thing.
 - A function nobody lists has no callers: no app reaches it. That is a workflow,
   run by a schedule, a key or `xflow functions invoke`.
 - Callers ship with `xflow deploy functions` and come back with its `--revision N`.
@@ -345,19 +346,11 @@ At the closed levels do none of this: the platform already knows the person.
 - `xflow dev` does not carry `X-Session` and calls functions as you (a member).
   Try the sign-in on the app address.
 
-## Page or app
+## A site for people outside the organization
 
-- A page is finished static files at `https://<name>.xflowpage.ru`: public, live the moment it
-  is uploaded, no build, no publish step, no database. A landing page, a presentation, an invoice.
-- An app is source the platform builds: versions and publish, access levels, a database through
-  functions. Anything people sign in to, enter data into or come back to.
-- Keep the sources of a page outside the project folder, or list them in `.xflowignore`: the
-  root travels with `deploy functions`.
-- A page has no backend. A form or a lookup for strangers is an app at "Anyone with the link"
-  (a paid plan): the platform checks every call to its functions.
-- A function key on a page is allowed, and it opens that function to every visitor: an HTML
-  form posts to `https://fn.xflowpage.ru/<projectId>/<name>?key=...`, fetch cannot read the
-  answer (no CORS). Nothing guards it but the function's own checks: say so to the user.
+- A landing page, a presentation, an invoice is an app at "Anyone with the link" (a paid plan):
+  built, published and rolled back like any app, opened by its address without signing in.
+- Search engines are asked not to index apps: do not promise SEO.
 
 ## Cloud functions
 
@@ -457,11 +450,8 @@ writes one, `xflow env` lists the names, `xflow env check` names the variables y
 read but the platform does not have. Values never come back out: the only place they exist is
 inside the running function. Apps get no variables at all.
 
-A variable goes to the whole organization unless you say otherwise: `--scope project` keeps it
-to this project alone, `--scope organization` is the default, and a third word is refused.
-Pick the narrow one for anything that belongs to one project. These commands see only what
-this project can see, so `env rm` reports a variable of another project missing even though
-names are unique within the organization.
+A variable belongs to one project: functions of other projects never see it, and each project
+keeps its own value under the same name.
 
 `DATABASE_URL` and every name starting with `XFLOW` are filled in by the platform: writing them
 is refused.
@@ -571,8 +561,9 @@ Pass `DATABASE_URL` as is, without an `ssl` option. The database is PostgreSQL 1
 tune it from migrations:
 - Installed: `pg_trgm`. `gen_random_uuid()` and `uuidv7()` are built in. Never `uuid-ossp`.
   Anything else (`postgis`, `pgvector`) is a request to the person.
-- A statement is cut after 30 seconds, waiting for a lock after 10, a transaction left open after
-  60. A query that needs longer is a wrong query (a missing index, or a report that belongs in a
+- A statement is cut after 10 seconds (in a migration through `xflow db migrate`, after 2 minutes),
+  waiting for a lock after 10, a transaction left open after 60. Connections to the database of
+  one project: Free 10, Start 25, Business 50. A query that needs longer is a wrong query (a missing index, or a report that belongs in a
   scheduled function writing a summary table).
 
 Calls of one project run at the same time in one process. A `Client`, even one made at module
@@ -633,35 +624,6 @@ key to the frontend.
 A refusal comes back as `{ error, code }` (`invalid_name`, `file_too_large`, `quota_exceeded`,
 `not_uploaded`, `duplicate_name`, `forbidden_type`, `not_found`, …): branch on `code`.
 
-## Pages
-
-A page is a public static site at `https://<name>.xflowpage.ru`, outside projects. Anyone with
-the address opens it, without signing in.
-
-- `xflow pages create "Price list" ./dist` makes a page with the built site on it and prints its
-  address: there are no empty pages. `--slug price-list` picks the name, otherwise it comes from
-  the title with a random tail.
-- `xflow pages deploy <page> <folder|.zip|.html> -m "what changed"` uploads a new version.
-- **Both are public the moment the command finishes**: no draft, no publish step.
-- `xflow pages status <page>` lists the versions, `xflow pages rollback <page> <N>` puts one back
-  in seconds; the files of the last 5 are kept.
-- `xflow pages rm <page> --yes` deletes the page: the address goes empty and every version is
-  gone for good, without `--yes` the command names what goes and stops. The name stays reserved
-  for the organization. A page put up to try something out is yours to take down when you are
-  done: do not leave it standing.
-- Names are 3-40 characters. At most 100 pages per organization, 20 new and 200 uploads a day,
-  10 seconds between uploads of one page: batch changes into one upload.
-- Static files only, what the build writes (`dist`), never a folder with `package.json`. At most
-  5 MB zipped, 25 MB unpacked, 1000 files. Everything a page shows travels inside it: project
-  file storage does not serve pages.
-- A backend for a page: see **Page or app**.
-- Everything in a page is readable by every visitor. A known key format gets the upload refused,
-  anything else simply leaks.
-- Search engines are asked not to index pages or apps: do not promise SEO.
-- The tab icon is the platform's on every page: do not spend a request on a favicon of your own.
-- A page is deleted by whoever made it, or by the owner of the organization. Switching a page
-  off for a while is for a person, in the platform interface.
-
 ## Organizations and keys
 
 One key per organization, stored side by side: `xflow org` lists them, `xflow org switch

package/dist/commands/pages.js

@@ -1,257 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.pagesList = pagesList;
-exports.pagesCreate = pagesCreate;
-exports.pagesDeploy = pagesDeploy;
-exports.pagesStatus = pagesStatus;
-exports.pagesRollback = pagesRollback;
-exports.pagesRemove = pagesRemove;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const api_1 = require("../api");
-const args_1 = require("../args");
-const config_1 = require("../config");
-const credentials_1 = require("../credentials");
-const errors_1 = require("../errors");
-const session_1 = require("../session");
-const ui_1 = require("../ui");
-const zip_1 = require("../zip");
-const deploy_1 = require("./deploy");
-const storage_1 = require("./storage");
-/**
- * Pages: public sites of the organization at <name>.xflowpage.ru. They open without
- * signing in and outside the platform, and an upload is live at once.
- */
-/** Keep in sync with the platform: a refusal here saves the upload. */
-const MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
-const MAX_UNPACKED_BYTES = 25 * 1024 * 1024;
-const MAX_FILES = 1000;
-/** Where build tools write the site: named when the folder turns out to be the sources. */
-const BUILD_DIRS = ['dist', 'build', 'out'];
-/** A page belongs to the organization, not to a project: the key is picked as for xflow org members. */
-function pagesClient() {
-    return (0, session_1.connect)((0, config_1.localConfig)());
-}
-function pagePath(ref) {
-    return `/api/v1/pages/${encodeURIComponent(ref)}`;
-}
-function clip(text, max) {
-    return text.length > max ? `${text.slice(0, max - 1)}…` : text;
-}
-function stateOf(page) {
-    if (page.status === 'blocked')
-        return 'taken down';
-    if (page.status === 'disabled')
-        return 'switched off';
-    return page.current_revision === null ? 'empty' : 'live';
-}
-function describeState(page) {
-    if (page.status === 'blocked') {
-        const reason = page.blocked_reason ? ': ' + page.blocked_reason : '';
-        return `Taken down by the platform${reason}. Write to team@getxflow.com if it is a mistake`;
-    }
-    if (page.status === 'disabled')
-        return 'Switched off: the address shows a placeholder until a person switches it on';
-    if (page.current_revision === null)
-        return 'Empty: nothing is uploaded yet';
-    return `Live: version ${page.current_revision}, put there ${(0, ui_1.formatAge)(page.deployed_at)}`;
-}
-async function pagesList(args) {
-    const client = pagesClient();
-    const { pages } = await (0, api_1.apiJson)(client, '/api/v1/pages');
-    if ((0, args_1.flagBool)(args, 'json')) {
-        (0, ui_1.out)(JSON.stringify({ pages }, null, 2));
-        return;
-    }
-    if (pages.length === 0) {
-        (0, ui_1.note)('The organization has no pages yet');
-        (0, ui_1.note)((0, ui_1.dim)('  A new one: xflow pages create "Price list" ./dist'));
-    }
-    else {
-        (0, ui_1.table)(pages.map((page) => [
-            page.slug,
-            clip(page.title, 40),
-            stateOf(page),
-            (0, ui_1.formatAge)(page.deployed_at ?? page.created_at),
-            page.url,
-        ]));
-    }
-    const orgs = (0, credentials_1.listOrgs)(client.apiUrl);
-    if (client.source === 'active' && orgs.length > 1) {
-        const name = orgs.find((org) => org.active)?.name;
-        const whose = name ? `"${name}"` : 'the active organization';
-        (0, ui_1.note)((0, ui_1.dim)(`  Pages of ${whose} only. For another organization: xflow org switch <name or id>`));
-    }
-}
-async function pagesCreate(args) {
-    const source = args.words.length > 2 ? args.words[args.words.length - 1] : undefined;
-    const title = args.words.slice(1, -1).join(' ').trim();
-    if (!source || !title) {
-        throw new errors_1.CliError('A title and what to put on the page are required', 'A page is born with its first version: xflow pages create "Price list" ./dist --slug price-list');
-    }
-    const upload = readUpload(source);
-    const slug = (0, args_1.flagString)(args, 'slug');
-    const query = new URLSearchParams(slug ? { title, slug } : { title });
-    (0, ui_1.step)(`Uploading ${upload.label}`);
-    const result = await (0, api_1.apiUpload)(pagesClient(), `/api/v1/pages?${query}`, upload.body, {
-        'Content-Type': contentTypeOf(upload),
-    });
-    (0, ui_1.ok)(`Page "${result.page.title}" is live: ${result.file_count} file(s), ${(0, ui_1.formatBytes)(result.size_bytes)}`);
-    (0, ui_1.out)(result.page.url);
-    (0, ui_1.note)((0, ui_1.dim)(`  Anyone with the address sees it within seconds. The next version: xflow pages deploy ${result.page.slug} <path>`));
-}
-function contentTypeOf(upload) {
-    return upload.kind === 'zip' ? 'application/zip' : 'text/html';
-}
-function assertUploadSize(bytes) {
-    if (bytes <= MAX_UPLOAD_BYTES)
-        return;
-    throw new errors_1.CliError(`The upload is ${(0, ui_1.formatBytes)(bytes)}, a page takes ${MAX_UPLOAD_BYTES / 1024 / 1024} MB at most`, 'Pages are for sites, presentations and invoices: compress the images and drop the sourcemaps');
-}
-/**
- * The folder of a built site, zipped here. The sources of a site are refused before the
- * walk: the platform would reject them anyway, and node_modules is a long way down.
- */
-function zipSite(absolute, source) {
-    const built = BUILD_DIRS.find((dir) => (0, node_fs_1.existsSync)((0, node_path_1.join)(absolute, dir, 'index.html')));
-    const pointAtBuild = built
-        ? `The built site is in ${(0, node_path_1.join)(source, built)}: upload that folder`
-        : 'Build it and upload the folder the build writes';
-    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(absolute, 'package.json'))) {
-        throw new errors_1.CliError(`${source} holds the sources of a site, not a built one`, pointAtBuild);
-    }
-    if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(absolute, 'index.html'))) {
-        throw new errors_1.CliError(`There is no index.html at the top of ${source}`, built ? pointAtBuild : 'The start page of a site is index.html at the top of its folder');
-    }
-    const files = (0, storage_1.collectMedia)(absolute);
-    if (files.length > MAX_FILES) {
-        throw new errors_1.CliError(`${source} holds ${files.length} files, a page takes ${MAX_FILES} at most`, 'Drop what the site never loads');
-    }
-    const bytes = files.reduce((sum, file) => sum + file.size, 0);
-    if (bytes > MAX_UNPACKED_BYTES) {
-        throw new errors_1.CliError(`${source} is ${(0, ui_1.formatBytes)(bytes)}, a page takes ${MAX_UNPACKED_BYTES / 1024 / 1024} MB at most`, 'Compress the images and drop the sourcemaps');
-    }
-    const body = (0, zip_1.zipCreate)(files.map((file) => ({ path: file.remote, content: (0, node_fs_1.readFileSync)(file.absolute) })));
-    assertUploadSize(body.length);
-    return { kind: 'zip', body, label: `${files.length} file(s), ${(0, ui_1.formatBytes)(bytes)}` };
-}
-function readUpload(source) {
-    const absolute = (0, node_path_1.resolve)(source);
-    let stat;
-    try {
-        stat = (0, node_fs_1.statSync)(absolute);
-    }
-    catch {
-        throw new errors_1.CliError(`No such file or folder: ${source}`);
-    }
-    if (stat.isDirectory())
-        return zipSite(absolute, source);
-    const extension = (0, node_path_1.extname)(absolute).toLowerCase();
-    if (extension !== '.html' && extension !== '.htm' && extension !== '.zip') {
-        throw new errors_1.CliError(`${(0, node_path_1.basename)(absolute)} cannot be a page`, 'A page goes up as a folder with index.html at the top, its .zip, or one .html file');
-    }
-    assertUploadSize(stat.size);
-    return {
-        kind: extension === '.zip' ? 'zip' : 'html',
-        body: (0, node_fs_1.readFileSync)(absolute),
-        label: `${(0, node_path_1.basename)(absolute)}, ${(0, ui_1.formatBytes)(stat.size)}`,
-    };
-}
-async function pagesDeploy(args) {
-    const [, ref, source] = args.words;
-    if (!ref || !source) {
-        throw new errors_1.CliError('A page and what to upload are required', 'For example: xflow pages deploy price-list ./dist. The pages: xflow pages');
-    }
-    const comment = (0, deploy_1.versionComment)((0, args_1.flagString)(args, 'message'));
-    const upload = readUpload(source);
-    const client = pagesClient();
-    (0, ui_1.step)(`Uploading ${upload.label}`);
-    const query = comment ? `?comment=${encodeURIComponent(comment)}` : '';
-    const result = await (0, api_1.apiUpload)(client, `${pagePath(ref)}/deploy${query}`, upload.body, {
-        'Content-Type': contentTypeOf(upload),
-    });
-    if (result.status === 'unchanged') {
-        (0, ui_1.ok)(`Nothing changed: version ${result.revision} is already on the address`);
-    }
-    else if (result.status === 'stored') {
-        (0, ui_1.warn)(`The page is switched off: version ${result.revision} is kept, not shown`);
-        (0, ui_1.note)((0, ui_1.dim)('  It goes live when a person switches the page on'));
-    }
-    else {
-        (0, ui_1.ok)(`Version ${result.revision} is live: ${result.file_count} file(s), ${(0, ui_1.formatBytes)(result.size_bytes)}`);
-    }
-    (0, ui_1.out)(result.page.url);
-    if (result.status === 'deployed') {
-        (0, ui_1.note)((0, ui_1.dim)(`  Anyone with the address sees it within seconds. The versions: xflow pages status ${result.page.slug}`));
-    }
-}
-async function pagesStatus(args) {
-    const ref = args.words[1];
-    if (!ref)
-        throw new errors_1.CliError('A page is required', 'The name from its address, or its id. The pages: xflow pages');
-    const data = await (0, api_1.apiJson)(pagesClient(), `${pagePath(ref)}/revisions`);
-    if ((0, args_1.flagBool)(args, 'json')) {
-        (0, ui_1.out)(JSON.stringify(data, null, 2));
-        return;
-    }
-    const { page, revisions } = data;
-    (0, ui_1.out)(`${(0, ui_1.bold)(page.title)}  ${page.url}`);
-    (0, ui_1.out)(describeState(page));
-    if (revisions.length === 0) {
-        (0, ui_1.note)((0, ui_1.dim)(`  Upload: xflow pages deploy ${page.slug} <folder, .zip or .html>`));
-        return;
-    }
-    (0, ui_1.out)();
-    (0, ui_1.table)(revisions.map((revision) => [
-        String(revision.revision),
-        (0, ui_1.formatAge)(revision.created_at),
-        `${revision.file_count} file(s)`,
-        (0, ui_1.formatBytes)(revision.size_bytes),
-        clip(revision.comment ?? '', 60),
-        revision.current ? 'current' : revision.restorable ? '' : 'files removed',
-    ]));
-    (0, ui_1.note)((0, ui_1.dim)(`  Put a version back: xflow pages rollback ${page.slug} <number>. The files of the last 5 are kept`));
-}
-async function pagesRollback(args) {
-    const [, ref, raw] = args.words;
-    if (!ref || !raw) {
-        throw new errors_1.CliError('A page and a version number are required', 'For example: xflow pages rollback price-list 2. The versions: xflow pages status <page>');
-    }
-    const revision = Number(raw);
-    if (!Number.isInteger(revision) || revision < 1) {
-        throw new errors_1.CliError(`A version number is a positive integer, got "${raw}"`, `The versions: xflow pages status ${ref}`);
-    }
-    const { page } = await (0, api_1.apiJson)(pagesClient(), `${pagePath(ref)}/rollback`, {
-        method: 'POST',
-        body: { revision },
-    });
-    if (page.status === 'active')
-        (0, ui_1.ok)(`Version ${revision} is back on the address`);
-    else
-        (0, ui_1.warn)(`The page is switched off: version ${revision} is current and goes live when it is switched on`);
-    (0, ui_1.out)(page.url);
-}
-async function pagesRemove(args) {
-    const ref = args.words[1];
-    if (!ref) {
-        throw new errors_1.CliError('A page is required', 'The name from its address, or its id. The pages: xflow pages');
-    }
-    // The page is read first: deleting is confirmed by the name in the address, and the
-    // page can be named here by its id.
-    const client = pagesClient();
-    const { page } = await (0, api_1.apiJson)(client, pagePath(ref));
-    const query = (0, args_1.flagBool)(args, 'yes') ? `?confirm=${encodeURIComponent(page.slug)}` : '';
-    try {
-        await (0, api_1.apiJson)(client, `${pagePath(page.id)}${query}`, { method: 'DELETE' });
-    }
-    catch (e) {
-        // The platform names what goes and refuses until the answer is seen. Said in the
-        // words of this command, not of the API.
-        if (e instanceof api_1.ApiError && e.code === 'confirm_required') {
-            throw new errors_1.CliError(e.message, `To delete it anyway: xflow pages rm ${page.slug} --yes`);
-        }
-        throw e;
-    }
-    (0, ui_1.ok)(`The page is deleted: ${page.url} shows nothing now`);
-    (0, ui_1.note)((0, ui_1.dim)(`  Its versions are gone for good, the name ${page.slug} stays reserved for the organization`));
-}