@getxflow/cli 0.13.0 → 0.14.0

package/dist/commands/connections.js

@@ -211,10 +211,10 @@ function looksJson(headers) {
  * credentials. For looking at what an API returns without deploying a function for it.
  */
 async function connectionsCall(args) {
-    const alias = args.words[1];
+    const connection = args.words[1];
     const path = args.words[2];
-    if (!alias) {
-        throw new errors_1.CliError('A connection is required', 'Its alias in this project: xflow connections');
+    if (!connection) {
+        throw new errors_1.CliError('A connection is required', 'Its alias in this project, or its name from the first column of xflow connections');
     }
     if (!path) {
         throw new errors_1.CliError('A path is required', 'For example: xflow connections call WB /api/v1/supplier/stocks?dateFrom=2026-09-01');
@@ -235,7 +235,7 @@ async function connectionsCall(args) {
     const data = await (0, api_1.apiJson)(client, `/api/v1/projects/${projectId}/connections/call`, {
         method: 'POST',
         body: {
-            connection: alias,
+            connection,
             path,
             method: (0, args_1.flagString)(args, 'method') ?? (body ? 'POST' : 'GET'),
             ...(body ? { body: body.text } : {}),
@@ -250,6 +250,10 @@ async function connectionsCall(args) {
         return;
     }
     const { request, response } = data;
+    // Named the account only when it was not called by its alias: with several accounts of one
+    // service under the same name, the alias is the only thing the caller already knew.
+    if (!data.alias)
+        (0, ui_1.note)((0, ui_1.dim)(`  ${data.label} (${data.connection_id}), not linked to this project`));
     (0, ui_1.note)((0, ui_1.dim)(`  ${request.method} ${request.url}`));
     for (const line of allHeaders(request.headers))
         (0, ui_1.note)((0, ui_1.dim)(`  ${line}`));

package/dist/help.js

@@ -367,7 +367,7 @@ the platform into the function.
   xflow connections link <name> --as ALIAS
                                    hand its credentials to the functions
   xflow connections unlink <ALIAS> take them away again
-  xflow connections call <ALIAS> <path>
+  xflow connections call <name> <path>
                                    ask that API something, once, without deploying
 
 Every row says whether the connection is linked to this project (its alias) and what
@@ -426,11 +426,16 @@ fields are called, while the whole dataset belongs in a cloud function. ${(0, ui
 prints the envelope for a pipe: ${(0, ui_1.bold)("--json | jq '.response.body | keys'")} gives the
 field names without the body ever entering your context.
 
-Only an account already linked to this project can be called, because its credentials
-already reach the functions of that project: the command saves a deploy, it does not widen
-what you may touch. An account that is merely available has to be linked first, and that is
-a separate right and a personal grant. The call also goes out for real: ${(0, ui_1.bold)('POST')} and
-${(0, ui_1.bold)('DELETE')} change things in somebody's live account, and no flag will undo that.`,
+An account linked to this project is called by its alias. One that is only available is
+called by its name, and no linking is needed: what the command asks is that you could have
+linked it yourself, which needs the ${(0, ui_1.bold)('connections:link')} right and the account being
+granted to you personally. Either way nothing widens: linked credentials already reach the
+functions of this project, and an account you may link you may also read by deploying a
+function into it. An account granted to somebody else stays out of reach, and the refusal
+says which of the two is missing, the right or the grant.
+
+The call goes out for real: ${(0, ui_1.bold)('POST')} and ${(0, ui_1.bold)('DELETE')} change things in
+somebody's live account, and no flag will undo that.`,
     schedules: `${(0, ui_1.bold)('xflow schedules')}: running functions on a timer
 
 A schedule is a Yandex timer trigger: it calls the function itself, with no

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '0.13.0';
+exports.CLI_VERSION = '0.14.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "CLI for the XFlow platform: source sync, deployment and publishing of applications",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -24,7 +24,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 0.13.0. They travel inside the package, so the copy
+These instructions ship with xflow CLI 0.14.0. They travel inside the package, so the copy
 you are reading can be older than the CLI answering your commands, and nothing about that
 is visible in the text itself.
 
@@ -364,7 +364,8 @@ naming rules and the flags. Unlink refuses while a function still reads one of t
 variables and names those functions, so read that list before reaching for `--force`.
 
 Linking needs the `connections:link` right on the key, and only accounts granted to the
-owner of the key personally can be linked at all. If the right was taken away, say so and
+owner of the key personally can be linked at all; the same right covers calling an unlinked
+account. If the right was taken away, say so and
 ask the person to turn it back on in the platform settings under Developers: a key cannot
 grant it to itself. Connecting a new account and switching one off stay with a person too.
 
@@ -374,15 +375,20 @@ Before writing a function against an unfamiliar API, find out what it actually a
 
 ```
 xflow connections call WB /api/v1/supplier/stocks?dateFrom=2026-09-01
+xflow connections call "Яндекс Метрика" /management/v1/counters
 xflow connections call OZON /v1/product/list --method POST --data '{}' \
     --header '{"Client-Id":"{CLIENT_ID}"}'
 ```
 
-The platform attaches the credentials and makes the request itself, so no deploy is needed
-and the key never reaches you. Only an account already linked to this project can be called:
-its credentials already reach that project's functions, so this saves a deploy rather than
-widening what you may touch. An account that is only `available, not linked` has to be linked
-first, and that stays a decision for a person.
+The platform attaches the credentials and makes the request itself, so no deploy is needed and
+the key never reaches you. A linked account is called by its alias, an `available, not linked`
+one by its name: **linking first is not needed to look**, so do not ask a person about that.
+
+**Calling is looking, not wiring**: no variable reaches the functions because you called
+something. To use the account in code, link it and deploy.
+
+Two refusals do need a person, and different ones: `connections:link` right — the owner of the
+key grants it under Developers; `not granted to you` — ask whoever connected the account.
 
 `{NAME}` in the path or in a header value is filled in from the fields of the connection: the
 names are what `xflow env` shows without the alias in front, so `OZON_CLIENT_ID` is written