@lionrapid/cli 0.3.0 → 0.5.0

package/dist/cli.js

@@ -8,19 +8,21 @@
  */
 import { Command } from 'commander';
 import { readFileSync, realpathSync } from 'node:fs';
-import { basename, dirname, join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { ConfigError, ApiKeyError, resolveApiKey, listCredentialServers, findConfigPath, loadConfig, } from './config.js';
+import { ConfigError, noTargetsNotice, ApiKeyError, keyCapability, resolveApiKey, listCredentialServers, findConfigPath, loadConfig, } from './config.js';
 import { ApiError, NetworkError, LionRapidApiClient } from './api-client.js';
 import { ExitCode, exitCodeForError } from './exit-codes.js';
 import { emitJson, errorEnvelope } from './output.js';
 import { defaultJobHistoryPath, recordJobs, } from './job-history.js';
 import { loadContext, loadOfflineContext } from './commands/context.js';
-import { runInit, fetchLocaleDefaults, detectLocalesOnDisk } from './commands/init.js';
-import { runLogin, runLogout, promptHidden, DEFAULT_SERVER } from './commands/login.js';
+import { runInit, detectProject, fetchLocaleDefaults, detectLocalesOnDisk, ensureKey, summarizeSources, } from './commands/init.js';
+import { runLogin, runLogout, DEFAULT_SERVER } from './commands/login.js';
 import { runPush } from './commands/push.js';
+import { runWhoami } from './commands/whoami.js';
 import { runStatus, explainStatus } from './commands/status.js';
+import { formatLocal } from './time.js';
 import { runPull } from './commands/pull.js';
 import { runValidate } from './commands/validate.js';
 import { runTypesGenerate, runTypesGenerateServer, runTypesCheck } from './commands/types.js';
@@ -80,7 +82,9 @@ function saveQueuedJobs(jobs, ctx) {
     const entries = jobs.map((job) => ({
         id: job.id,
         server: ctx.config.server,
-        project: ctx.config.project,
+        // The config's free-text label is gone; only a projectId the server
+        // confirmed is worth recording, and it may legitimately be absent.
+        ...(ctx.config.projectId ? { projectId: ctx.config.projectId } : {}),
         namespace: job.namespace,
         locale: ctx.config.sourceLocale,
         files: [job.file],
@@ -91,16 +95,22 @@ function saveQueuedJobs(jobs, ctx) {
     recordJobs(entries);
     return entries;
 }
-/** `2026-08-05 14:21:07` in local time, or the raw value if it isn't a date. */
-function when(iso) {
-    if (!iso)
-        return '—';
-    const t = Date.parse(iso);
-    if (Number.isNaN(t))
-        return iso;
-    const d = new Date(t);
-    const pad = (n) => String(n).padStart(2, '0');
-    return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
+/**
+ * `2026-08-05 14:21:07` in local time. Naive server timestamps are read as
+ * UTC — see `time.ts`; a plain `Date.parse` here made a job look like it had
+ * finished three hours before the push that queued it.
+ */
+const when = formatLocal;
+/** Where a key came from, in the terms a user would use to change it. */
+function describeKeySource(key) {
+    switch (key.source) {
+        case 'env':
+            return 'from LIONRAPID_API_KEY — overrides every saved scope';
+        case 'server-scoped':
+            return `saved for ${key.scope}`;
+        default:
+            return 'the default saved key';
+    }
 }
 /** "128 key(s) from locales/en.json → app" — what a job is carrying. */
 function jobPayload(view) {
@@ -142,7 +152,14 @@ function printJobDetail(view, out) {
         out('    · answered from this machine\'s record — the state is final, so no server call was needed');
     }
     if (label === 'dead-lettered') {
-        out('    next: fix the cause, then re-run `lionrapid push` — pushes upsert, so re-running is safe.');
+        // This sentence has now been wrong twice, which is why it carries its own
+        // test. "Re-run push" broke when push became incremental (the lock records
+        // these rows as sent, so a plain re-push skips them), and "delete the
+        // lockfile" was a workaround for a file the user was never told they had.
+        // Both flags ask the SERVER what it holds, so neither trusts the lock.
+        out('    next: fix the cause, then `lionrapid push --backfill-missing` to send just the rows');
+        out('          the server is missing, or `lionrapid push --force` to resend everything.');
+        out('          A plain `push` would skip them — the lock recorded them as sent.');
     }
     else if (label === 'queued' || label === 'processing' || label === 'retrying') {
         out(`    next: \`lionrapid status ${view.id}\` again in a moment.`);
@@ -206,9 +223,36 @@ function printStatus(res, out) {
         out(`  · the server could not be reached: ${res.offline}`);
     out('  next: run `lionrapid push`, then `lionrapid status`.');
 }
+/** Interactive picker: list the scopes and take a number or an exact name. */
+async function askWhich(scopes) {
+    console.error('Which credential do you want to remove?');
+    scopes.forEach((s, i) => console.error(`  ${i + 1}) ${s}`));
+    const answer = (await askText('Number (or blank to cancel)', '')).trim();
+    if (!answer)
+        return undefined;
+    const index = Number(answer);
+    if (Number.isInteger(index) && index >= 1 && index <= scopes.length)
+        return scopes[index - 1];
+    return scopes.includes(answer) ? answer : undefined;
+}
+/**
+ * Thrown when a non-interactive run needs an answer nobody can give.
+ *
+ * Silently accepting a default is how `https://api.lionrapid.com` — a host
+ * with no DNS record — got written into configs by CI and by agents: the
+ * prompt never appeared, so nobody ever declined it. A scaffold that names
+ * what it needs is recoverable; one that invents a value is not.
+ */
+function requireInteractive(what, flag) {
+    throw new ConfigError(`Cannot ask for ${what} — this is not an interactive terminal.\n` +
+        `  Pass ${flag} explicitly (and set LIONRAPID_API_KEY if a key is needed).`);
+}
 /**
  * One-line interactive prompt on stderr with a default. Non-TTY (CI, pipes)
  * never blocks — it returns the default immediately.
+ *
+ * Callers that must not accept an unasked default check `process.stdin.isTTY`
+ * themselves and call {@link requireInteractive}; see `init`.
  */
 function askText(question, def) {
     if (!process.stdin.isTTY)
@@ -241,7 +285,6 @@ export function buildProgram() {
     program
         .command('init')
         .description('Scaffold a lionrapid.yml config in the current project')
-        .option('--project <id>', 'project id')
         .option('--server <url>', 'API server URL')
         .option('--source <locale>', 'source locale')
         .option('--targets <list>', 'comma-separated target locales')
@@ -265,10 +308,20 @@ export function buildProgram() {
             const known = existingServer ?? (loggedIn.length === 1 ? loggedIn[0] : undefined);
             // Only ask when there's genuinely nothing to go on. After a `login`,
             // `lionrapid init` should be a single silent command.
+            // Non-interactive with nothing to go on: refuse. `askText` would
+            // return DEFAULT_SERVER without ever showing the prompt, which is
+            // how a dead host reached a config file in the first place.
+            if (!options.server && !known && !process.stdin.isTTY) {
+                requireInteractive('a server URL', '--server');
+            }
             const server = options.server ?? known ?? (await askText('Server URL', DEFAULT_SERVER));
             // The project field is a local label (the API key selects the real
             // project) — the directory name is a better default than a question.
-            const project = options.project ?? basename(process.cwd());
+            let signedIn = false;
+            let projectId;
+            // The namespaces the scaffold will declare — the only places a
+            // project id can be read from before a config exists.
+            const res0Namespaces = () => detectProject(process.cwd()).files.map((f) => f.namespace ?? 'app');
             // Locale resolution ladder: explicit flags → the project's server
             // config → locales already present in the repo → static placeholders.
             // Every rung degrades quietly, so init still works fully offline.
@@ -276,20 +329,21 @@ export function buildProgram() {
             let targets = options.targets?.split(',').map((s) => s.trim());
             const notes = [];
             if (!source || !targets) {
-                let key = options.key;
-                if (!key) {
-                    try {
-                        key = resolveApiKey({ server });
-                    }
-                    catch {
-                        // no stored key for this server — prefill stays optional
-                    }
-                }
-                if (!key && process.stdin.isTTY) {
-                    key =
-                        (await promptHidden('API key to prefill locales (Enter to skip): ')).trim() ||
-                            undefined;
-                }
+                // ONE PASS: a key typed here is verified and SAVED, so the next
+                // command finds it. `init` used to prompt, use the key to prefill
+                // locales, and throw it away — you then typed the same key into
+                // `login` and ran `init` a second time.
+                const resolved = await ensureKey({
+                    server,
+                    key: options.key,
+                    isTTY: Boolean(process.stdin.isTTY),
+                    // Mirror login: an explicit --server scopes the entry, otherwise
+                    // it is the default "my LionRapid account key".
+                    scope: options.server ? 'server' : 'default',
+                });
+                const key = resolved.key;
+                if (resolved.signedIn)
+                    signedIn = true;
                 let serverStatus = 'no-key';
                 let serverTargets;
                 if (key) {
@@ -310,6 +364,30 @@ export function buildProgram() {
                         source ??= prefill.sourceLocale; // the source locale IS real
                     }
                 }
+                // Capture the project this key resolves to, so the mismatch guard
+                // has something to check on every later push. Best-effort: the
+                // field is undeclared server-side, and a brand-new project has no
+                // rows to read it from.
+                if (key) {
+                    const probe = new LionRapidApiClient({
+                        baseUrl: server,
+                        apiKey: key,
+                        retries: 0,
+                        timeoutMs: 5000,
+                    });
+                    for (const ns of new Set(res0Namespaces())) {
+                        try {
+                            const bundle = await probe.getNamespace(source ?? 'en', ns);
+                            if (bundle.projectId) {
+                                projectId = bundle.projectId;
+                                break;
+                            }
+                        }
+                        catch {
+                            // next namespace
+                        }
+                    }
+                }
                 const onDisk = detectLocalesOnDisk(process.cwd(), source ?? 'en');
                 if (serverStatus === 'ok' && serverTargets) {
                     notes.push(`locales from ${server}: ${source} → ${serverTargets.join(', ')}`);
@@ -346,7 +424,7 @@ export function buildProgram() {
                 }
             }
             const res = runInit(process.cwd(), {
-                project,
+                ...(projectId ? { projectId } : {}),
                 server,
                 sourceLocale: source,
                 targetLocales: targets,
@@ -366,6 +444,14 @@ export function buildProgram() {
             console.log(`  detected: ${res.detected.stacks.join(', ')}`);
             for (const note of notes)
                 console.log(`  ${note}`);
+            // A declared source with nothing behind it is the difference between
+            // `doctor: sources: 1 missing` being a puzzle and being obvious.
+            if (res.missingSources.length > 0) {
+                console.log(`  ⚠ ${res.missingSources.length} declared source(s) do not exist on disk:`);
+                for (const source of res.missingSources)
+                    console.log(`      ${source}`);
+                console.log('    Remove the stale entry from lionrapid.yml, or create the file.');
+            }
             if (res.conflicts.length > 0) {
                 // Never silently overwrite a value the developer set. Show the
                 // difference and let them resolve it in the file.
@@ -378,9 +464,23 @@ export function buildProgram() {
                 console.log('    Edit lionrapid.yml to resolve, or re-run with --force to take the');
                 console.log('    project values wholesale.');
             }
+            // A key typed during this run is now saved — say so, or the user has
+            // no way to know they do not need `login`.
+            if (signedIn)
+                console.log(`  ✓ signed in to ${server} — key saved for next time`);
+            if (projectId) {
+                console.log(`  ✓ project ${projectId} — push will refuse if a key resolves elsewhere`);
+            }
+            // Close on a fact rather than a promise: parse what was just
+            // declared, so "wrote lionrapid.yml" comes with what it will push.
+            const summary = summarizeSources(process.cwd(), res.detected.files);
+            if (summary.files > 0) {
+                const arrow = targets && targets.length > 0 ? `, ${source ?? 'en'} → ${targets.join(', ')}` : '';
+                console.log(`  ✓ ${summary.strings} string(s) across ${summary.namespaces} namespace(s) in ${summary.files} file(s)${arrow}`);
+            }
             const ready = res.conflicts.length === 0 && (targets?.length ?? 0) > 0;
             console.log(ready
-                ? '  next: `lionrapid doctor` to check the setup, then `lionrapid push`.'
+                ? '  next: `lionrapid push --dry-run`, then `lionrapid push`.'
                 : '  next: fix the above in lionrapid.yml, then run `lionrapid doctor`.');
         }
         catch (err) {
@@ -412,18 +512,84 @@ export function buildProgram() {
         }
     });
     program
-        .command('logout')
-        .description('Remove a saved API key from ~/.lionrapid/credentials')
-        .option('--server <url>', 'remove the key scoped to this server URL (default: "default")')
+        .command('whoami')
+        .description('Show which API key this directory would use, and every saved scope')
         .option('--json', 'emit the result as JSON on stdout (prose to stderr)')
+        .option('-c, --config <path>', 'path to lionrapid.yml')
         .action((options) => {
         try {
-            const res = runLogout({ server: options.server });
+            const res = runWhoami({ cwd: process.cwd(), config: options.config });
             const out = options.json ? console.error : console.log;
-            const what = res.scope === 'server' ? `key for ${options.server}` : 'default key';
-            out(res.removed ? `✓ removed ${what}` : `· no ${what} was saved`);
+            // Four combinations, and the two mixed ones are the interesting ones:
+            // a key with no server (run outside a project) is still a real answer,
+            // and a server with no key is the failure worth naming.
+            if (res.server && res.key) {
+                out(`this directory → ${res.server} → ${res.key.masked} (${describeKeySource(res.key)})`);
+                out(`  ${res.key.capability.summary}`);
+            }
+            else if (res.key) {
+                out(`${res.key.masked} (${describeKeySource(res.key)}) — but no server here yet`);
+            }
+            else if (res.server) {
+                out(`this directory → ${res.server}`);
+                out('✖ no key resolves for that server');
+            }
+            else {
+                out('✖ no server and no key resolve here');
+            }
+            if (res.problem)
+                for (const line of res.problem.split('\n'))
+                    out(`  ${line}`);
+            if (res.scopes.length > 0) {
+                out('');
+                out('saved scopes');
+                const width = Math.max(...res.scopes.map((s) => s.scope.length));
+                for (const s of res.scopes)
+                    out(`  · ${s.scope.padEnd(width)}  ${s.masked}`);
+            }
+            else {
+                out('');
+                out('saved scopes: none — run `lionrapid login`');
+            }
             if (options.json)
-                emitJson('logout', true, { scope: res.scope, removed: res.removed });
+                emitJson('whoami', res.key !== undefined, res);
+        }
+        catch (err) {
+            fail(err, { json: options.json, command: 'whoami' });
+        }
+    });
+    program
+        .command('logout')
+        .description('Remove a saved API key from ~/.lionrapid/credentials')
+        .option('--server <url>', 'remove the key scoped to this server URL')
+        .option('--all', 'remove every saved key and delete the credentials file')
+        .option('--json', 'emit the result as JSON on stdout (prose to stderr)')
+        .action(async (options) => {
+        try {
+            const res = await runLogout({
+                server: options.server,
+                all: options.all,
+                // Only offer a picker on a real terminal; otherwise `runLogout`
+                // refuses rather than guessing which credential to delete.
+                choose: process.stdin.isTTY ? askWhich : undefined,
+            });
+            const out = options.json ? console.error : console.log;
+            if (!res.removed) {
+                out('· nothing was removed');
+            }
+            else if (res.scope === 'all') {
+                out(`✓ removed all ${res.removedScopes} saved key(s) — ${res.credentialsPath} deleted`);
+            }
+            else {
+                out(`✓ removed the key for ${res.scope}`);
+            }
+            if (options.json) {
+                emitJson('logout', true, {
+                    scope: res.scope,
+                    removed: res.removed,
+                    removedScopes: res.removedScopes,
+                });
+            }
         }
         catch (err) {
             fail(err, { json: options.json, command: 'logout' });
@@ -435,6 +601,8 @@ export function buildProgram() {
         .option('--target <locale>', 'push an already-translated target locale instead of the source')
         .option('--publish', 'in --target mode, mark pushed rows ready (public)')
         .option('--dry-run', 'parse + count what would be pushed, but make no network calls')
+        .option('--backfill-missing', 'send only the rows the server is missing (asks the server)')
+        .option('--force', 'ignore the lockfile and resend every row (saves overwritten server rows to .lionrapid/history/). Does NOT override server-side protection of human-committed rows')
         .option('--json', 'emit the result as JSON on stdout (prose to stderr)')
         .option('-c, --config <path>', 'path to lionrapid.yml')
         .action(async (options) => {
@@ -445,22 +613,53 @@ export function buildProgram() {
         let ctx;
         try {
             ctx = loadContext({ config: options.config });
+            // Say it BEFORE the request. A pk_ key pushes sources fine but
+            // `targets/batch` answers a bare 403 — found the hard way on
+            // 2026-08-07 while trying to publish a row.
+            if (options.target) {
+                const capability = keyCapability(resolveApiKey({ server: ctx.config.server }));
+                if (!capability.canWriteTargets) {
+                    throw new ApiKeyError(`This key cannot write target translations — ${capability.summary}\n` +
+                        '  `push --target` needs targets:write. Use a master (sk_) key:\n' +
+                        `  lionrapid login --server ${ctx.config.server}`);
+                }
+            }
             const res = await runPush(ctx.config, ctx.client, {
                 cwd: ctx.cwd,
                 target: options.target,
                 publish: options.publish,
                 dryRun: options.dryRun,
                 onJob: (job) => queued.push(job),
+                backfillMissing: options.backfillMissing,
+                force: options.force,
+                // Incremental: the lock lives at the project root, beside lionrapid.yml.
+                lockPath: ctx.cwd,
             });
             const out = options.json ? console.error : console.log;
+            const notice = noTargetsNotice(ctx.config);
+            if (notice)
+                out(notice);
             const tag = res.dryRun ? '[dry-run] would push' : '✓ pushed';
-            out(`${tag} ${res.pushed} ${res.mode} string(s) across ${res.files.length} file(s)`);
+            // Name the unchanged count, or an incremental push that sends nothing
+            // reads as a failure. "0 pushed · 653 unchanged" is a success.
+            const unchanged = res.skipped > 0 ? ` · ${res.skipped} unchanged` : '';
+            out(`${tag} ${res.pushed} ${res.mode} string(s) across ${res.files.length} file(s)${unchanged}`);
+            // The diff is the whole value of a dry run: "2 to send" cannot tell
+            // you whether you are adding strings or overwriting existing ones.
+            if (res.projectCheck === 'unavailable') {
+                out('  · project check skipped — this server disclosed no project id');
+            }
+            if (res.diff && res.pushed > 0) {
+                out(`  ${res.diff.added} new · ${res.diff.changed} changed · ${res.diff.unchanged} unchanged`);
+            }
             for (const f of res.files) {
                 if (f.error) {
                     out(`  · ${f.file}: ✖ ${f.error}`);
                     continue;
                 }
-                out(`  ${f.skipped ? '· skipped (missing)' : '·'} ${f.file}: ${f.count}`);
+                const same = f.unchanged ? ` (${f.unchanged} unchanged)` : '';
+                const held = f.refused ? ` (${f.refused} not written)` : '';
+                out(`  ${f.skipped ? '· skipped (missing)' : '·'} ${f.file}: ${f.count}${held}${same}`);
             }
             const failed = res.files.filter((f) => f.error);
             if (failed.length > 0) {
@@ -471,6 +670,25 @@ export function buildProgram() {
                 out('⚠ uploaded as drafts but not published — publishing needs an editor session token.\n' +
                     '  Set LIONRAPID_EDITOR_TOKEN, or publish in the dashboard.');
             }
+            // Rows the server declined to overwrite. Same voice as pull's
+            // kept-local warning: name the key and the reason, because a bare
+            // count tells you something happened without telling you what.
+            const refused = [
+                ...res.protected.map((r) => ({ ...r, kind: 'protected' })),
+                ...res.denied.map((r) => ({ ...r, kind: 'denied' })),
+            ];
+            if (refused.length > 0) {
+                out(`⚠ ${refused.length} row(s) were NOT overwritten — the server is protecting them:`);
+                const width = Math.max(...refused.map((r) => r.key.length));
+                for (const r of refused) {
+                    const current = r.current_text ? ` (server has: "${r.current_text}")` : '';
+                    out(`    ${r.key.padEnd(width)}  ${r.reason}${current}`);
+                }
+                // There is deliberately no override flag, so do not imply one.
+                // These are the paths that DO change a committed row.
+                out('  A human committed these. There is no CLI override — change them in the');
+                out('  Visual Editor, or use "Use for all" to apply one wording across the project.');
+            }
             // The whole point: "pushed" above is what we SENT. The server stores
             // it in the background, so print what to watch and where it is saved.
             if (res.jobs.length > 0) {
@@ -509,6 +727,7 @@ export function buildProgram() {
         .command('status')
         .argument('[job-id]', 'a job id from `push` (omit, or pass "list", for every recorded job)')
         .description('Show what the server actually did with the strings `push` queued')
+        .option('--refresh', 'ask the server again even for a job already recorded as finished')
         .option('--json', 'emit the result as JSON on stdout (prose to stderr)')
         .option('-c, --config <path>', 'path to lionrapid.yml')
         .action(async (jobId, options) => {
@@ -526,8 +745,14 @@ export function buildProgram() {
                 jobId,
                 client: ctx?.client,
                 server: ctx?.config.server,
+                refresh: options.refresh,
             });
-            printStatus(res, options.json ? console.error : console.log);
+            const out = options.json ? console.error : console.log;
+            printStatus(res, out);
+            if (res.retention === 'purged') {
+                out('  · the server no longer retains this job (finished jobs are kept ~1h) —');
+                out('    the recorded verdict above stands.');
+            }
             if (options.json)
                 emitJson('status', !res.notFound, res);
             if (res.notFound)
@@ -562,6 +787,9 @@ export function buildProgram() {
                 },
             });
             const out = options.json ? console.error : console.log;
+            const notice = noTargetsNotice(ctx.config);
+            if (notice)
+                out(notice);
             const mark = res.dryRun ? '[dry-run]' : '✓';
             for (const loc of res.locales) {
                 const pending = loc.pending > 0 ? ` (${loc.pending} pending)` : '';
@@ -577,6 +805,17 @@ export function buildProgram() {
                     out(`  · ${f.target}: ${f.count}${diff}${res.dryRun ? ' (not written)' : ''}`);
                 }
             }
+            // Name the file AND the key, or the warning is not actionable — the
+            // whole point is that you can go look at what was kept.
+            const conflicted = res.locales.flatMap((l) => l.files.flatMap((f) => (f.conflicts ?? []).map((key) => ({ target: f.target, key }))));
+            if (conflicted.length > 0) {
+                out(`⚠ ${conflicted.length} local edit(s) are newer than the server and were NOT overwritten:`);
+                const width = Math.max(...conflicted.map((c) => c.target.length));
+                for (const c of conflicted)
+                    out(`    ${c.target.padEnd(width)}  ${c.key}`);
+                out('  keep them and `lionrapid push --target <locale>`, or `lionrapid pull --force`');
+                out('  to take the server\'s version instead.');
+            }
             const failed = res.locales.flatMap((l) => l.files).filter((f) => f.error);
             if (failed.length > 0) {
                 out(`⚠ ${failed.length} file(s) failed — the successful files were still written`);
@@ -610,7 +849,17 @@ export function buildProgram() {
                 allowLocked: options.allowLocked,
             });
             const out = options.json ? console.error : console.log;
-            if (res.issues.length === 0) {
+            const notice = noTargetsNotice(ctx.config);
+            if (notice)
+                out(notice);
+            if (ctx.config.targetLocales.length === 0) {
+                // Zero targets means zero comparisons were made. Saying "all
+                // translated" here is a vacuous truth that reads as a clean bill of
+                // health — the one thing validate exists not to do.
+                out(`· nothing to validate: ${res.sourceKeys} source key(s), but no targetLocales are configured.\n` +
+                    '  Add target languages in the dashboard, then re-run `lionrapid init`.');
+            }
+            else if (res.issues.length === 0) {
                 out(`✓ all ${res.sourceKeys} source key(s) translated across target locales`);
             }
             else {

package/dist/commands/doctor.d.ts

@@ -23,6 +23,8 @@ export interface DoctorOptions {
     config?: string;
     /** Injectable fetch for tests; defaults to the client's global fetch. */
     fetchImpl?: FetchImpl;
+    /** Credentials file path (defaults to ~/.lionrapid/credentials). */
+    credentialsPath?: string;
 }
 export declare function runDoctor(opts: DoctorOptions): Promise<DoctorResult>;
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.js

@@ -10,11 +10,33 @@
  */
 import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { expandGlobEntries, findConfigPath, loadConfig, resolveApiKey, } from '../config.js';
+import { expandGlobEntries, findConfigPath, loadConfig, resolveApiKey, keyCapability, listCredentialServers, ConfigError, } from '../config.js';
 import { LionRapidApiClient } from '../api-client.js';
+/**
+ * First line only. Right for a network error (whose `cause` chain is long and
+ * repetitive), wrong for a ConfigError — see {@link configDetail}.
+ */
 function msg(err) {
     return err instanceof Error ? err.message.split('\n')[0] : String(err);
 }
+/**
+ * A config failure, with its issues.
+ *
+ * `msg()` kept the first line only, so `Invalid lionrapid config:` printed
+ * with every bullet the validator had produced discarded — a header promising
+ * a list, followed by nothing. Other commands print `err.message` whole and
+ * showed the bullets, which is what made the renderer look inconsistent: it is
+ * not per-field, it is per-command. ConfigError carries the issues as typed
+ * data, so use that rather than re-splitting a string.
+ */
+function configDetail(err) {
+    if (err instanceof ConfigError && err.issues.length > 0) {
+        return `${err.message.split('\n')[0]} ${err.issues
+            .map((i) => `${i.path}: ${i.message}`)
+            .join('; ')}`;
+    }
+    return msg(err);
+}
 export async function runDoctor(opts) {
     const checks = [];
     // 1. Config present + valid.
@@ -39,16 +61,36 @@ export async function runDoctor(opts) {
         }
     }
     catch (err) {
-        checks.push({ name: 'config', ok: false, detail: msg(err) });
+        checks.push({ name: 'config', ok: false, detail: configDetail(err) });
     }
     // 2. API key resolvable (never print the key itself).
+    //
+    // Keys are stored PER SERVER URL, so without a valid config there is no
+    // server to look one up by — the lookup cannot run, it does not fail. Saying
+    // "No API key found" here asserted something false about a key that was
+    // present and correct, and sent the owner hunting through a credentials file
+    // that had nothing wrong with it. Report the truth: skipped, and what IS
+    // saved, so they can see for themselves.
     let apiKey;
+    const savedScopes = listCredentialServers(opts.credentialsPath);
     try {
-        apiKey = resolveApiKey({ server: config?.server });
-        checks.push({ name: 'apiKey', ok: true, detail: 'resolved from env/credentials' });
+        apiKey = resolveApiKey({ server: config?.server, credentialsPath: opts.credentialsPath });
+        // Name what the key can DO, not just that it exists. A pk_ holder
+        // otherwise discovers the targets:write line mid-publish, as a bare 403.
+        checks.push({
+            name: 'apiKey',
+            ok: true,
+            detail: `resolved from env/credentials · ${keyCapability(apiKey).summary}`,
+        });
     }
     catch (err) {
-        checks.push({ name: 'apiKey', ok: false, detail: msg(err) });
+        checks.push({
+            name: 'apiKey',
+            ok: false,
+            detail: config
+                ? msg(err)
+                : `skipped — needs a valid config (keys are saved per server URL)${savedScopes.length > 0 ? `; saved: ${savedScopes.join(', ')}` : ''}`,
+        });
     }
     // 3. Server reachable + token accepted (no retries — doctor wants fast feedback).
     if (config && apiKey) {