@movermarketingai/searchlight-cli 0.1.0

package/LICENSE.md

@@ -0,0 +1,7 @@
+# Searchlight CLI License
+
+Copyright (c) Mover Marketing Ai. All rights reserved.
+
+This package may be downloaded and installed to access Searchlight from the command line. Use of the Searchlight service requires a provisioned Searchlight account or CLI token. Downloading the CLI does not grant access to Searchlight data, customer data, API tokens, or administrative capabilities.
+
+You may not redistribute modified versions, reverse engineer server-side access controls, bypass token scoping, or use this CLI to access Searchlight without authorization.

package/README.md

@@ -0,0 +1,79 @@
+# Searchlight CLI
+
+Command-line access for approved Searchlight users, workers, and operators.
+
+Anyone can download this CLI. Searchlight data access still requires a server-issued, scoped, unrevoked token. The CLI does not bundle secrets, API keys, database credentials, or customer data.
+
+## Install
+
+```bash
+npm install -g @movermarketingai/searchlight-cli
+```
+
+Then verify the binary is available:
+
+```bash
+mmai-searchlight help
+```
+
+The `searchlight` binary is also provided, but `mmai-searchlight` is preferred to avoid name collisions.
+
+## Setup
+
+Ask your Searchlight admin for a provisioned CLI token, or create one from **Workspace Settings → CLI Access** if your account is allowed to self-serve CLI tokens.
+
+Store the token without placing it in shell history:
+
+```bash
+read -rsp "Searchlight CLI token: " SEARCHLIGHT_TOKEN && echo && \
+printf '%s' "$SEARCHLIGHT_TOKEN" | mmai-searchlight auth store --token-stdin && \
+unset SEARCHLIGHT_TOKEN
+```
+
+Validate access:
+
+```bash
+mmai-searchlight auth check
+mmai-searchlight annotations sites --json
+```
+
+By default, tokens are stored at `~/.config/searchlight/token` with mode `0600`. To use another path, set `SEARCHLIGHT_TOKEN_FILE`.
+
+## Authentication precedence
+
+The CLI uses the first available token source:
+
+1. `SEARCHLIGHT_TOKEN`
+2. `SEARCHLIGHT_WORKER_TOKEN`
+3. `SEARCHLIGHT_TOKEN_FILE`, defaulting to `~/.config/searchlight/token`
+
+Keep raw tokens in Keychain, a password manager, a locked-down machine-local file, or another approved secret store. Do not paste tokens into chat, tickets, docs, source files, screenshots, or shell history.
+
+## API target
+
+Production is used by default:
+
+```text
+https://searchlight.movermarketing.ai
+```
+
+Set `SEARCHLIGHT_BASE_URL` only when intentionally targeting a non-production Searchlight deployment.
+
+## Common commands
+
+```bash
+mmai-searchlight annotations sites --json
+mmai-searchlight annotations list --site SITE --json
+mmai-searchlight annotations add --site SITE --title TITLE --summary TEXT --dry-run
+mmai-searchlight content-runs list --site SITE --json
+mmai-searchlight tests list --site SITE --json
+```
+
+Some operator commands, such as client onboarding, require higher-trust tokens and may be unavailable to routine users.
+
+## Security model
+
+- Downloading the CLI grants no access by itself.
+- The Searchlight API enforces token hashes, scopes, allowed sites, expiry, and revocation server-side.
+- CLI-side command visibility is not an authorization boundary.
+- Provision external or contractor tokens with the narrowest possible sites/scopes and short expiries.