@getxflow/cli 0.17.0 → 0.18.0

package/dist/commands/connections.js

@@ -32,6 +32,14 @@ function state(row) {
             return 'linked';
     }
 }
+/**
+ * The names of a connection as they are written in a call, braces and all. Ready to paste:
+ * guessing one costs a real request to somebody's live account, since an unknown name is
+ * left in the text and the request still goes out.
+ */
+function placeholders(row) {
+    return (row.substitutes ?? []).map((name) => `{${name}}`).join(' ');
+}
 function endpoint(projectId) {
     return `/api/v1/projects/${projectId}/connections`;
 }
@@ -69,6 +77,7 @@ async function connectionsList(args) {
         row.label,
         row.connector_key ?? '-',
         row.alias ?? '-',
+        placeholders(row) || '-',
         state(row),
     ]));
     const variables = data.connections.flatMap((row) => row.env);
@@ -76,6 +85,9 @@ async function connectionsList(args) {
         (0, ui_1.note)((0, ui_1.dim)(`  The functions get: ${variables.join(', ')}`));
         (0, ui_1.note)((0, ui_1.dim)('  A change reaches a function on its next deploy: xflow deploy'));
     }
+    if (data.connections.some((row) => placeholders(row))) {
+        (0, ui_1.note)((0, ui_1.dim)('  The fourth column is what a call fills in: xflow connections call <name> <path>'));
+    }
     if (data.connections.some((row) => !row.alias)) {
         (0, ui_1.note)((0, ui_1.dim)('  To link one: xflow connections link <name> --as ALIAS'));
     }

package/dist/help.js

@@ -372,9 +372,10 @@ the platform into the function.
   xflow connections call <name> <path>
                                    ask that API something, once, without deploying
 
-Every row says whether the connection is linked to this project (its alias) and what
-state the access is in. ${(0, ui_1.bold)('available, not linked')} is the useful one: the account
-exists in the organization, but this project gets nothing from it yet: link it.
+Every row says whether the connection is linked to this project (its alias), which of
+its fields a call can fill in (${(0, ui_1.bold)('{CLIENT_ID}')} and the like) and what state the
+access is in. ${(0, ui_1.bold)('available, not linked')} is the useful one: the account exists in
+the organization, but this project gets nothing from it yet: link it.
 
 Both commands take the name of the connection, the first column of the list, and both
 also take its identifier. ${(0, ui_1.bold)('unlink')} takes the alias as well, and prefers it: the
@@ -420,10 +421,12 @@ refusal lists them. ${(0, ui_1.bold)('--method')} defaults to GET, or to POST wh
 ${(0, ui_1.bold)('{NAME}')} in the path or in a header value is filled in by the platform from the
 fields of the connection. That is how the two-header APIs are called: Ozon wants
 ${(0, ui_1.bold)('Client-Id')} beside its key, Yandex Direct wants ${(0, ui_1.bold)('Client-Login')} for an
-agency account, and you never see those values. The names are the ones ${(0, ui_1.bold)('xflow env')}
-shows without the alias in front: ${(0, ui_1.bold)('OZON_CLIENT_ID')} is written ${(0, ui_1.bold)('{CLIENT_ID}')}.
-A name the connection does not have is left in the text as you typed it, so a typo shows up
-in the printed request instead of failing somewhere far away.
+agency account, and you never see those values. Which names a connection has is the fourth
+column of ${(0, ui_1.bold)('xflow connections')}, printed in braces and the same whether the account
+is linked or not. Do not derive them from ${(0, ui_1.bold)('xflow env')}: that list is the variables
+of a link, and it names both more and less than this one. A name the connection does not
+have is left in the text as you typed it and the request still goes out, so an invented
+name reaches somebody's live account as text.
 
 The answer is printed head first, at most a few kilobytes, and it says so when there is
 more. Ask for the shape, not the volume: one day and ${(0, ui_1.bold)('limit=1')} tells you what the

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '0.17.0';
+exports.CLI_VERSION = '0.18.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "CLI for the XFlow platform: source sync, deployment and publishing of applications",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -24,7 +24,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 0.17.0. They travel inside the package, so the copy
+These instructions ship with xflow CLI 0.18.0. They travel inside the package, so the copy
 you are reading can be older than the CLI answering your commands, and nothing about that
 is visible in the text itself.
 
@@ -396,10 +396,11 @@ something. To use the account in code, link it and deploy.
 Two refusals do need a person, and different ones: `connections:link` right — the owner of the
 key grants it where the key permissions live; `not granted to you` — ask whoever connected the account.
 
-`{NAME}` in the path or in a header value is filled in from the fields of the connection: the
-names are what `xflow env` shows without the alias in front, so `OZON_CLIENT_ID` is written
-`{CLIENT_ID}`. That is how APIs wanting a second header are called, and you never see the
-value. Only the hosts of that connector are reachable and a refusal lists them.
+`{NAME}` in the path or in a header value is filled in from the fields of the connection.
+**Take the names from `xflow connections`**, which prints them in braces for every account,
+linked or not: an invented name is left in the text as you typed it and the request goes out
+anyway, into somebody's live account. `xflow env` is not that list. Only the hosts of that
+connector are reachable and a refusal lists them.
 
 **Ask for the shape, not the volume.** One day and `limit=1` is enough to learn what the
 fields are called; the answer is printed head first and says when there is more. The whole