@outlit/cli 3.2.1 → 3.2.2

package/dist/cli.js

@@ -104,7 +104,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@outlit/cli",
-    version: "3.2.1",
+    version: "3.2.2",
     description: "CLI for querying Outlit customer context and installing agent skills",
     license: "Apache-2.0",
     repository: {
@@ -19252,10 +19252,12 @@ function readCommandOutput2(command, args) {
     return null;
   }
 }
-function isStandaloneInstall(argv = process.argv) {
+function isStandaloneInstall2(argv = process.argv) {
   const scriptPath = argv[1];
   if (!scriptPath)
     return true;
+  if (scriptPath.startsWith("/$bunfs/") || scriptPath.startsWith("~bunfs"))
+    return true;
   const resolved = safeRealPath2(scriptPath) ?? scriptPath;
   return !/\.(?:cjs|mjs|jsx?|tsx?)$/.test(resolved);
 }
@@ -19281,8 +19283,11 @@ function safeRealPath2(filePath) {
     return null;
   }
 }
-function formatUpdateCommand2(installer = inferInstaller2()) {
-  switch (installer) {
+function formatUpdateCommand2(installer, argv = process.argv) {
+  if (isStandaloneInstall2(argv))
+    return STANDALONE_UPDATE_HINT2;
+  const resolved = installer === undefined ? inferInstaller2() : installer;
+  switch (resolved) {
     case "bun":
       return "bun add -g @outlit/cli";
     case "npm":
@@ -19343,7 +19348,7 @@ function runUpgradeCommand(command, opts) {
     throw new Error(`Upgrade command failed: ${command.displayCommand}`);
   }
 }
-var UPDATE_CHECK_INTERVAL_MS2, PACKAGE_NAME2 = "@outlit/cli", LATEST_VERSION_URL2 = "https://registry.npmjs.org/@outlit%2Fcli/latest";
+var UPDATE_CHECK_INTERVAL_MS2, PACKAGE_NAME2 = "@outlit/cli", LATEST_VERSION_URL2 = "https://registry.npmjs.org/@outlit%2Fcli/latest", STANDALONE_UPDATE_HINT2 = "re-run your original install method (for example `curl -fsSL https://outlit.ai/install.sh | bash` or `brew upgrade outlitai/tap/outlit`), or download the latest release from https://github.com/OutlitAI/outlit-sdk/releases";
 var init_update2 = __esm(() => {
   init_config();
   init_tty();
@@ -19704,26 +19709,77 @@ function checkApiKeyPresence(credential) {
 }
 async function validateApiKey(apiKey) {
   try {
-    await pingApiKey(apiKey);
-    return { name: "API validation", status: "pass", message: "Key is valid" };
+    const validation = await pingApiKey(apiKey);
+    const org = validation.organization?.name ?? validation.organization?.slug ?? validation.organizationId;
+    const keyDetail = validation.apiKey ? ` · key "${validation.apiKey.name}" (${validation.apiKey.keyType})` : "";
+    return {
+      check: {
+        name: "API validation",
+        status: "pass",
+        message: "Key is valid",
+        detail: `Org: ${org}${keyDetail}`
+      },
+      validation
+    };
   } catch (err) {
     if (isApiKeyValidationUnavailableError(err)) {
       return {
-        name: "API validation",
-        status: "warn",
-        message: "API validation is temporarily unavailable",
-        detail: "Try again shortly"
+        check: {
+          name: "API validation",
+          status: "warn",
+          message: "API validation is temporarily unavailable",
+          detail: "Try again shortly"
+        },
+        validation: null
       };
     }
     return {
-      name: "API validation",
-      status: "fail",
-      message: `API rejected key: ${errorMessage(err, "unknown error")}`,
-      detail: `Check your key at ${OUTLIT_DASHBOARD_URL}`
+      check: {
+        name: "API validation",
+        status: "fail",
+        message: `API rejected key: ${errorMessage(err, "unknown error")}`,
+        detail: `Check your key at ${OUTLIT_DASHBOARD_URL}`
+      },
+      validation: null
     };
   }
 }
-async function checkIntegrations(apiKey) {
+function grantUsable(grant, grants, createdById) {
+  if (!grants.includes(grant))
+    return false;
+  if (grant === "integrations:connect_own" && !createdById)
+    return false;
+  return true;
+}
+function checkPermissions(validation) {
+  const grants = validation.authorization.grants;
+  const createdById = validation.createdById?.trim() || null;
+  const unavailable = COMMAND_GRANTS.filter((family) => !family.anyOf.some((grant) => grantUsable(grant, grants, createdById)));
+  const detail = [
+    grants.length > 0 ? `grants: ${grants.join(", ")}` : null,
+    unavailable.length > 0 ? `unavailable to this key: ${unavailable.map((family) => family.commands).join("; ")}` : null
+  ].filter((part) => part !== null).join(" · ");
+  return {
+    name: "Permissions",
+    status: unavailable.length > 0 ? "warn" : "pass",
+    message: `${grants.length} key grant${grants.length === 1 ? "" : "s"}`,
+    detail: detail || undefined
+  };
+}
+async function checkIntegrations(apiKey, validation) {
+  const grants = validation?.authorization.grants;
+  if (grants) {
+    const createdById = validation?.createdById?.trim() || null;
+    const canRead = grantUsable("integrations:manage", grants, createdById) || grantUsable("integrations:connect_own", grants, createdById);
+    if (!canRead) {
+      return {
+        name: "Integrations",
+        status: "warn",
+        message: "API key does not grant integrations access",
+        detail: "Requires the integrations:manage grant, or integrations:connect_own on a user-created key"
+      };
+    }
+  }
   try {
     const client = await createClient(apiKey);
     const timeout = new Promise((_2, reject) => setTimeout(() => reject(new Error("Integrations check timed out")), 1e4));
@@ -19755,7 +19811,15 @@ async function checkIntegrations(apiKey) {
       status: "pass",
       message: `${ready} integration(s) ready`
     };
-  } catch {
+  } catch (err) {
+    if (isOutlitToolsApiError(err) && err.envelope?.code === "TOOL_CALL_FORBIDDEN") {
+      return {
+        name: "Integrations",
+        status: "warn",
+        message: "API key was denied integrations access",
+        detail: "Requires the integrations:manage grant, or integrations:connect_own on a user-created key"
+      };
+    }
     return {
       name: "Integrations",
       status: "warn",
@@ -19843,8 +19907,9 @@ function printChecks(checks) {
   }
   console.log("");
 }
-var FAIL_SYMBOL2, STATUS_ICONS, doctor_default, agentChecks;
+var FAIL_SYMBOL2, STATUS_ICONS, doctor_default, COMMAND_GRANTS, agentChecks;
 var init_doctor = __esm(() => {
+  init_dist4();
   init_dist();
   init_auth();
   init_output2();
@@ -19867,11 +19932,13 @@ var init_doctor = __esm(() => {
       description: [
         "Check CLI version, API key, connectivity, and agent detection.",
         "",
-        "Runs four checks in sequence:",
+        "Runs six checks in sequence:",
         "  1. CLI version -- compares against npm registry",
         "  2. API key -- checks presence and format (ok_ prefix)",
         "  3. API validation -- makes a live test call to verify the key works",
-        "  4. Agent detection -- detects supported coding agents and whether the Outlit skill is installed",
+        "  4. Permissions -- shows key grants and unavailable commands",
+        "  5. Integrations -- checks integration readiness or explains missing access",
+        "  6. Agent detection -- detects supported coding agents and whether the Outlit skill is installed",
         "",
         "Exit code: 0 if all checks pass or warn, 1 if any check fails.",
         "",
@@ -19896,9 +19963,12 @@ var init_doctor = __esm(() => {
       checks.push(checkApiKeyPresence(credential));
       if (credential) {
         const apiCheck = await validateApiKey(credential.key);
-        checks.push(apiCheck);
-        if (apiCheck.status !== "fail") {
-          checks.push(await checkIntegrations(credential.key));
+        checks.push(apiCheck.check);
+        if (apiCheck.validation) {
+          checks.push(checkPermissions(apiCheck.validation));
+        }
+        if (apiCheck.check.status !== "fail") {
+          checks.push(await checkIntegrations(credential.key, apiCheck.validation));
         }
       } else {
         checks.push({
@@ -19918,6 +19988,38 @@ var init_doctor = __esm(() => {
         process.exit(1);
     }
   });
+  COMMAND_GRANTS = [
+    {
+      commands: "customers (read), users, facts, sources, search, attention",
+      anyOf: ["customer_intelligence:read"]
+    },
+    { commands: "ws-users", anyOf: ["workspace_members:read"] },
+    { commands: "sql, schema", anyOf: ["analytics:read"] },
+    { commands: "destinations", anyOf: ["destinations:manage"] },
+    { commands: "features", anyOf: ["behavior_metrics:manage"] },
+    {
+      commands: "integrations",
+      anyOf: ["integrations:manage", "integrations:connect_own"]
+    },
+    { commands: "activation get, preview", anyOf: ["activation:read"] },
+    { commands: "activation update, disable", anyOf: ["activation:manage"] },
+    { commands: "settings get", anyOf: ["workspace_settings:read"] },
+    { commands: "settings update", anyOf: ["workspace_settings:manage"] },
+    { commands: "customers grant, revoke, owner", anyOf: ["customer_access:manage"] },
+    {
+      commands: "identity suggestions list",
+      anyOf: ["customer_intelligence:read"]
+    },
+    {
+      commands: "identity suggestions reject",
+      anyOf: ["customer_identity:review"]
+    },
+    {
+      commands: "customers merge (preview), customers merge-status",
+      anyOf: ["customer_intelligence:read"]
+    },
+    { commands: "customers merge --execute", anyOf: ["customer_identity:merge"] }
+  ];
   agentChecks = {
     "claude-code": {
       name: "Claude Code",
@@ -19955,7 +20057,7 @@ var exports_upgrade = {};
 __export(exports_upgrade, {
   default: () => upgrade_default
 });
-var STANDALONE_UPDATE_HINT = "re-run your original install method (for example `curl -fsSL https://outlit.ai/install.sh | bash` or `brew upgrade outlitai/tap/outlit`), or download the latest release from https://github.com/OutlitAI/outlit-sdk/releases", upgrade_default;
+var upgrade_default;
 var init_upgrade = __esm(() => {
   init_dist();
   init_output2();
@@ -19996,10 +20098,10 @@ var init_upgrade = __esm(() => {
         console.log(`Outlit CLI is already up to date (v${CLI_VERSION2})`);
         return;
       }
-      const standalone = isStandaloneInstall();
+      const standalone = isStandaloneInstall2();
       const upgradeCommand = standalone ? null : getUpgradeCommand();
       if (!upgradeCommand) {
-        const message = standalone ? `Outlit CLI v${latestVersion} is available. This standalone binary cannot update itself — ${STANDALONE_UPDATE_HINT}.` : `Outlit CLI v${latestVersion} is available. Could not determine how Outlit CLI was installed. Update it manually with your package manager, for example \`bun add -g @outlit/cli\` or \`npm install -g @outlit/cli\`.`;
+        const message = standalone ? `Outlit CLI v${latestVersion} is available. This standalone binary cannot update itself — ${STANDALONE_UPDATE_HINT2}.` : `Outlit CLI v${latestVersion} is available. Could not determine how Outlit CLI was installed. Update it manually with your package manager, for example \`bun add -g @outlit/cli\` or \`npm install -g @outlit/cli\`.`;
         return outputError({ message, code: standalone ? "manual_update_required" : "unknown_installer" }, json);
       }
       try {
@@ -23476,6 +23578,7 @@ var UPDATE_CHECK_INTERVAL_MS = 12 * 60 * 60 * 1000;
 var PACKAGE_NAME = "@outlit/cli";
 var LATEST_VERSION_URL = "https://registry.npmjs.org/@outlit%2Fcli/latest";
 var INTERNAL_UPDATE_FLAG = "--internal-update-check";
+var STANDALONE_UPDATE_HINT = "re-run your original install method (for example `curl -fsSL https://outlit.ai/install.sh | bash` or `brew upgrade outlitai/tap/outlit`), or download the latest release from https://github.com/OutlitAI/outlit-sdk/releases";
 function getUpdateCachePath() {
   return join2(getConfigDir(), "update-check.json");
 }
@@ -23562,6 +23665,15 @@ function readCommandOutput(command, args) {
     return null;
   }
 }
+function isStandaloneInstall(argv = process.argv) {
+  const scriptPath = argv[1];
+  if (!scriptPath)
+    return true;
+  if (scriptPath.startsWith("/$bunfs/") || scriptPath.startsWith("~bunfs"))
+    return true;
+  const resolved = safeRealPath(scriptPath) ?? scriptPath;
+  return !/\.(?:cjs|mjs|jsx?|tsx?)$/.test(resolved);
+}
 function inferInstaller() {
   const fromAgent = inferInstallerFromUserAgent(process.env.npm_config_user_agent ?? "");
   if (fromAgent)
@@ -23584,8 +23696,11 @@ function safeRealPath(filePath) {
     return null;
   }
 }
-function formatUpdateCommand(installer = inferInstaller()) {
-  switch (installer) {
+function formatUpdateCommand(installer, argv = process.argv) {
+  if (isStandaloneInstall(argv))
+    return STANDALONE_UPDATE_HINT;
+  const resolved = installer === undefined ? inferInstaller() : installer;
+  switch (resolved) {
     case "bun":
       return "bun add -g @outlit/cli";
     case "npm":
@@ -23627,26 +23742,29 @@ function printCachedUpdateNotice(argv = process.argv, notify = console.error) {
 Update with: ${notice.command}`);
   return true;
 }
-function scheduleBackgroundUpdateCheck(argv = process.argv, spawnProcess = spawn) {
+function scheduleBackgroundUpdateCheck(argv = process.argv, spawnProcess = spawn, execPath = process.execPath) {
   if (!shouldShowUpdateNotice(argv))
     return false;
   if (!isUpdateCheckDue(readCachedUpdateState()))
     return false;
-  const runtimePath = argv[0];
-  const scriptPath = argv[1];
-  if (!runtimePath || !scriptPath)
+  const standalone = isStandaloneInstall(argv);
+  const command = standalone ? execPath : argv[0];
+  const scriptPath = standalone ? null : argv[1];
+  if (!command || !standalone && !scriptPath)
     return false;
-  const child = spawnProcess(runtimePath, [scriptPath, INTERNAL_UPDATE_FLAG], {
-    detached: true,
-    stdio: "ignore"
-  });
-  child.unref?.();
-  return true;
+  try {
+    const child = spawnProcess(command, [...scriptPath ? [scriptPath] : [], INTERNAL_UPDATE_FLAG], { detached: true, stdio: "ignore" });
+    child.on?.("error", () => {});
+    child.unref?.();
+    return true;
+  } catch {
+    return false;
+  }
 }
 function initializeUpdateNotifier(opts) {
   const argv = opts?.argv ?? process.argv;
   printCachedUpdateNotice(argv, opts?.notify);
-  scheduleBackgroundUpdateCheck(argv, opts?.spawn);
+  scheduleBackgroundUpdateCheck(argv, opts?.spawn, opts?.execPath);
 }
 async function fetchLatestCliVersion() {
   const response = await fetch(LATEST_VERSION_URL, { signal: AbortSignal.timeout(5000) });
@@ -23659,7 +23777,7 @@ async function fetchLatestCliVersion() {
 }
 async function runInternalUpdateCheck(opts) {
   const fetchLatestVersion = opts?.fetchLatestVersion ?? fetchLatestCliVersion;
-  const installer = opts?.installer ?? inferInstaller();
+  const installer = isStandaloneInstall() ? null : opts?.installer ?? inferInstaller();
   try {
     const latestVersion = await fetchLatestVersion();
     writeCachedUpdateState({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outlit/cli",
-  "version": "3.2.1",
+  "version": "3.2.2",
   "description": "CLI for querying Outlit customer context and installing agent skills",
   "license": "Apache-2.0",
   "repository": {