@smartreviq/cli 0.3.1 → 0.3.3

package/LICENSE.md

@@ -0,0 +1,16 @@
+# License
+
+Copyright (c) 2026 SmartRevIQ. All rights reserved.
+
+This software is a component of the SmartRevIQ service. It is published so
+that SmartRevIQ customers can manage the configuration of their own
+SmartRevIQ environments from their own repositories and pipelines.
+
+Use is permitted only by parties holding a current subscription to the
+SmartRevIQ service, and is governed by the terms of the agreement under
+which that subscription is held.
+
+No other rights are granted. This software may not be redistributed,
+sublicensed, sold, or incorporated into another product or service, and may
+not be reverse engineered except to the extent that such a restriction is
+unenforceable under applicable law.

package/README.md

@@ -1,6 +1,6 @@
 # sriq
 
-Edit, test and ship SmartRevIQ process-engine scripts from VS Code or WebStorm.
+Edit, test and ship SmartRevIQ process-engine scripts from your editor and CI.
 
 No IDE plugin. The CLI writes ordinary project files — `jsconfig.json`, type
 declarations, launch configurations — and both editors read them through the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@smartreviq/cli",
-  "version": "0.3.1",
-  "description": "Edit, test and ship SmartRevIQ process-engine scripts from VS Code or WebStorm.",
+  "version": "0.3.3",
+  "description": "Edit, test and ship SmartRevIQ process-engine scripts from your editor and CI.",
   "type": "module",
   "bin": {
     "sriq": "bin/sriq.mjs"
@@ -21,12 +21,7 @@
     "acorn": "^8.19.0",
     "typescript": "^5.9.3"
   },
-  "license": "UNLICENSED",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/SmartRevIQ/smartreviq-backend.git",
-    "directory": "tools/sriq"
-  },
+  "license": "SEE LICENSE IN LICENSE.md",
   "publishConfig": {
     "access": "public"
   },

package/src/cli.mjs

@@ -669,6 +669,22 @@ function localScripts(root) {
   return out;
 }
 
+/**
+ * Every script key the environment holds, as `folder/name.script`.
+ *
+ * One request. Deliberately NOT wrapped in a try/catch: if this fails, the
+ * caller cannot distinguish a script that is absent from one it simply could
+ * not read, and every answer it gives afterwards would be invented.
+ */
+async function listRemoteKeys(api) {
+  const listing = await api.listScripts();
+  const keys = new Set();
+  for (const [folder, names] of Object.entries(listing ?? {})) {
+    for (const n of names) if (n.endsWith('.script')) keys.add(`${folder}/${n}`);
+  }
+  return keys;
+}
+
 async function cmdPush(argv) {
   const { root, config, target, flags, positional } = projectTarget(argv);
   const api = clientFor(target);
@@ -680,6 +696,7 @@ async function cmdPush(argv) {
     log(`${yellow('→')} target: ${bold(target.env)} ${dim(target.api)}`);
   }
   const platform = platformOwned(root);
+  const remoteKeys = await listRemoteKeys(api);
 
   let targets = localScripts(root);
   if (positional.length) {
@@ -714,11 +731,17 @@ async function cmdPush(argv) {
     }
 
     const body = unwrap(text);
-    let remote = null;
-    try { remote = await api.getScript(s3Name, t.folder); } catch { /* new script */ }
+    const key = `${t.folder}/${s3Name}`;
+    if (!remoteKeys.has(key)) {
+      changed.push({ ...t, s3Name, body, isNew: true });
+      continue;
+    }
+    // Existence came from the listing; this only answers "has it changed".
+    // Reading a failure here as "new" is what let an expired token report a
+    // whole project as added — see listRemoteKeys.
+    const remote = await api.getScript(s3Name, t.folder);
     if (remote === body) continue;
-
-    changed.push({ ...t, s3Name, body, isNew: remote === null });
+    changed.push({ ...t, s3Name, body, isNew: false });
   }
 
   if (blocked.length) {
@@ -756,14 +779,26 @@ async function cmdStatus(argv) {
   const api = clientFor(target);
 
   const locals = localScripts(root);
+
+  // THE LISTING DECIDES WHAT EXISTS. It used to be inferred: fetch each script
+  // and treat any failure as "not there". That reads a 401 as a new script, so
+  // an expired token — they last an hour — turned a clean status into every
+  // file reported as added. Observed on a 422-script project, which also
+  // showed how convincing the wrong answer looks.
+  //
+  // The error code cannot rescue that inference either: a script that really
+  // is absent comes back 500 SYSTEM_ERROR, the same as a server fault. So the
+  // guess is replaced by the one authoritative answer, which this command was
+  // already fetching for orphan detection, and a failure to get it is fatal
+  // rather than best-effort — without it, A and M cannot be told apart.
+  const remoteKeys = await listRemoteKeys(api);
   const rows = [];
   for (const t of locals) {
-    const s3Name = toRemoteName(t.localName);
+    const key = `${t.folder}/${toRemoteName(t.localName)}`;
+    if (!remoteKeys.has(key)) { rows.push(['A', `${t.folder}/${t.localName}`]); continue; }
     const body = unwrap(readFileSync(t.absPath, 'utf8'));
-    let remote = null;
-    try { remote = await api.getScript(s3Name, t.folder); } catch { /* new */ }
-    if (remote === null) rows.push(['A', `${t.folder}/${t.localName}`]);
-    else if (remote !== body) rows.push(['M', `${t.folder}/${t.localName}`]);
+    const remote = await api.getScript(toRemoteName(t.localName), t.folder);
+    if (remote !== body) rows.push(['M', `${t.folder}/${t.localName}`]);
   }
 
   // Scripts live on the environment with no local file. `push` only ever
@@ -776,13 +811,8 @@ async function cmdStatus(argv) {
   // and the real answer is simply `sriq pull`.
   let orphans = [];
   if (locals.length) {
-    try {
-      const listing = await api.listScripts();
-      const here = new Set(locals.map((t) => `${t.folder}/${toRemoteName(t.localName)}`));
-      orphans = Object.entries(listing)
-        .flatMap(([folder, names]) => names.map((n) => `${folder}/${n}`))
-        .filter((k) => !here.has(k));
-    } catch { /* best effort — the per-script diff above is the contract */ }
+    const here = new Set(locals.map((t) => `${t.folder}/${toRemoteName(t.localName)}`));
+    orphans = [...remoteKeys].filter((k) => !here.has(k));
   }
 
   log(`${bold(target.env)} ${dim(target.api + (target.apiPrefix ?? DEFAULT_API_PREFIX))}`);
@@ -824,7 +854,7 @@ async function cmdRun(argv) {
 
   if (!safeMode) log(yellow('! running with writes ENABLED (--unsafe)'));
 
-  if (flags.local) return runLocally({ abs, api, config, flags, safeMode });
+  if (flags.local) return runLocally({ abs, api, root, target, flags, safeMode });
 
   let result;
   if (flags.doc) {
@@ -844,7 +874,18 @@ async function cmdRun(argv) {
  * every api call forwarded to the environment. See runner.mjs for the fidelity
  * caveat this prints.
  */
-async function runLocally({ abs, api, config, flags, safeMode }) {
+/**
+ * `--local` was dead on arrival. Three names this function uses were never
+ * passed to it — `config`, which it does not actually need, plus `root` and
+ * `target`, which it does — so every invocation threw `config is not defined`
+ * before reaching the runner, and the next two were waiting behind it.
+ *
+ * The runner's own tests pass and always did: they exercise runner.mjs
+ * directly, never the handful of lines of CLI wiring between the flag and it.
+ * A test that spawns the command is the only thing that would have caught
+ * this, which is why one now exists.
+ */
+async function runLocally({ abs, api, root, target, flags, safeMode }) {
   const { createRemoteApi, installGlobals, runScriptFile } = await import('./runner.mjs');
 
   let doc = null;

package/src/client.mjs

@@ -25,8 +25,8 @@
  * reads as rejected credentials rather than as a misrouted request.
  *
  * Both Lambdas rewrite `/api/v1/` to `/api/` before their own routers see the
- * path (src-auth/index.mts, src-handler/index.mts), so the prefixed form is
- * correct for every endpoint listed above, on every environment.
+ * path, so the prefixed form is correct for every endpoint listed above, on
+ * every environment.
  *
  * Overridable per project through `.sriq.json` "apiPrefix", so an environment
  * that routes differently can be worked around without waiting for a release.
@@ -79,8 +79,15 @@ export class Client {
         // matters most — an SSO-only account being refused a password login
         // reads as an expired session, which it is not.
         const said = parsed?.message || parsed?.error;
+        // The status goes in the text even when the server said something
+        // useful. Without it "Invalid token" is just a sentence: it does not
+        // say an AUTH check failed, so it reads as a problem with the script
+        // or the request. A reader who sees 401 knows to re-authenticate
+        // without being told to — which matters, because telling them to would
+        // be wrong for the SSO-only account this branch exists to serve.
         throw new ApiError(
-          said || 'Unauthorized. Your session may have expired — run `sriq login`.',
+          said ? `${said} (401 — ${method} ${fullPath})`
+               : 'Unauthorized. Your session may have expired — run `sriq login`.',
           401, parsed
         );
       }