noxctl 0.7.4 → 0.9.0

package/dist/cli.js

@@ -7,7 +7,8 @@ import { readActivePointer, readActivePointerOutcome, writeActivePointer, delete
 import { setResolvedProfile } from './auth.js';
 import { applyPeriod } from './date-periods.js';
 import { DEFAULT_PROFILE, InvalidProfileNameError } from './profile-name.js';
-import { invoiceListColumns, invoiceDetailColumns, invoiceConfirmColumns, customerListColumns, customerDetailColumns, voucherListColumns, voucherDetailColumns, voucherRowColumns, accountListColumns, companyDetailColumns, articleListColumns, articleDetailColumns, supplierListColumns, supplierDetailColumns, supplierInvoiceListColumns, supplierInvoiceDetailColumns, supplierInvoiceConfirmColumns, invoicePaymentListColumns, invoicePaymentDetailColumns, supplierInvoicePaymentListColumns, supplierInvoicePaymentDetailColumns, offerListColumns, offerDetailColumns, orderListColumns, orderDetailColumns, projectListColumns, projectDetailColumns, costCenterListColumns, costCenterDetailColumns, taxReductionListColumns, taxReductionDetailColumns, priceListListColumns, priceListDetailColumns, priceListColumns, priceDetailColumns, financialYearListColumns, financialYearDetailColumns, lockedPeriodDetailColumns, contractListColumns, contractDetailColumns, recurringListColumns, recurringDetailColumns, invoiceRequestListColumns, invoiceRequestDetailColumns, topCustomerColumns, monthlyRevenueColumns, voucherAttachmentColumns, employeeListColumns, employeeDetailColumns, salaryTransactionListColumns, salaryTransactionDetailColumns, attendanceTransactionListColumns, attendanceTransactionDetailColumns, absenceTransactionListColumns, absenceTransactionDetailColumns, scheduleTimeDetailColumns, } from './views.js';
+import { VERSION } from './version.js';
+import { invoiceListColumns, invoiceDetailColumns, invoiceConfirmColumns, invoiceAttachmentColumns, invoiceAttachmentListColumns, customerListColumns, customerDetailColumns, voucherListColumns, voucherDetailColumns, voucherRowColumns, accountListColumns, companyDetailColumns, articleListColumns, articleDetailColumns, supplierListColumns, supplierDetailColumns, supplierInvoiceListColumns, supplierInvoiceDetailColumns, supplierInvoiceConfirmColumns, invoicePaymentListColumns, invoicePaymentDetailColumns, supplierInvoicePaymentListColumns, supplierInvoicePaymentDetailColumns, offerListColumns, offerDetailColumns, orderListColumns, orderDetailColumns, projectListColumns, projectDetailColumns, costCenterListColumns, costCenterDetailColumns, taxReductionListColumns, taxReductionDetailColumns, priceListListColumns, priceListDetailColumns, priceListColumns, priceDetailColumns, financialYearListColumns, financialYearDetailColumns, lockedPeriodDetailColumns, contractListColumns, contractDetailColumns, recurringListColumns, recurringDetailColumns, invoiceRequestListColumns, invoiceRequestDetailColumns, topCustomerColumns, monthlyRevenueColumns, voucherAttachmentColumns, employeeListColumns, employeeDetailColumns, salaryTransactionListColumns, salaryTransactionDetailColumns, attendanceTransactionListColumns, attendanceTransactionDetailColumns, absenceTransactionListColumns, absenceTransactionDetailColumns, scheduleTimeDetailColumns, } from './views.js';
 const program = new Command();
 // A closed downstream pipe (`noxctl ... | head`, or a reader that exits early)
 // makes stdout emit EPIPE. That is normal for a CLI, and without this listener
@@ -22,7 +23,7 @@ process.stdout.on('error', (err) => {
 program
     .name('noxctl')
     .description('CLI and MCP server for Fortnox accounting')
-    .version('0.7.4')
+    .version(VERSION)
     .addOption(new Option('-o, --output <format>', 'Output format (default: table on TTY, json when piped)')
     .choices(['json', 'table'])
     .default(undefined))
@@ -105,7 +106,7 @@ program.hook('preAction', async (thisCommand, actionCommand) => {
         }
         throw err;
     }
-    setResolvedProfile(resolvedProfileInfo.name);
+    setResolvedProfile(resolvedProfileInfo.name, resolvedProfileInfo.source);
     // Banner ownership: MCP `serve` prints its own banner in bindStartupProfile
     // so host logs (Claude Desktop) always see it. Suppress here to avoid a
     // duplicate on TTY invocations like `noxctl --profile X serve`.
@@ -198,15 +199,23 @@ program
     .option('--profile <name>', 'Profile to create/re-auth (defaults to resolved profile or "default")')
     .option('--with-salary', 'Also request the Lön (salary/payroll) scope — requires the Lön permission enabled on your Fortnox app')
     .option('--with-orders', 'Also request the offer/order scopes — requires the Order licence on the Fortnox company')
+    .option('--with-archive', 'Also request the archive (Arkivplats) scope — lets noxctl read files from the Fortnox file archive, e.g. attachments made via the Fortnox web UI')
     .action(async (initOpts) => {
-    const { loadCredentials, runOAuthSetup, SCOPES, SALARY_SCOPE, ORDER_SCOPES } = await import('./auth.js');
+    const { inspectCredentials, runOAuthSetup, SCOPES, SALARY_SCOPE, ORDER_SCOPES, ARCHIVE_SCOPE, } = await import('./auth.js');
     const { validateProfileName } = await import('./profile-name.js');
-    // Opt-in scopes: flag for TTY, env var for non-interactive/CI runs. Both are
-    // licence-gated in Fortnox (Lön / Order), and asking for a scope the company
-    // is not licensed for fails the whole authorization — hence not defaults.
+    // Opt-in scopes: flag for TTY, env var for non-interactive/CI runs. All are
+    // licence-gated in Fortnox (Lön / Order / Arkivplats), and asking for a scope
+    // the company is not licensed for fails the whole authorization — hence not
+    // defaults.
     const withSalary = Boolean(initOpts.withSalary) || process.env.FORTNOX_WITH_SALARY === '1';
     const withOrders = Boolean(initOpts.withOrders) || process.env.FORTNOX_WITH_ORDERS === '1';
-    const scopes = [SCOPES, withOrders ? ORDER_SCOPES : '', withSalary ? SALARY_SCOPE : '']
+    const withArchive = Boolean(initOpts.withArchive) || process.env.FORTNOX_WITH_ARCHIVE === '1';
+    const scopes = [
+        SCOPES,
+        withOrders ? ORDER_SCOPES : '',
+        withSalary ? SALARY_SCOPE : '',
+        withArchive ? ARCHIVE_SCOPE : '',
+    ]
         .filter(Boolean)
         .join(' ');
     let targetProfile;
@@ -222,11 +231,15 @@ program
     // (verification via getCompanyInfo, runOAuthSetup's internal saveCredentials
     // call chain) targets the profile being initialized — not a stale pointer.
     if (targetProfile.toLowerCase() !== resolvedProfileInfo.name.toLowerCase()) {
-        setResolvedProfile(targetProfile);
+        setResolvedProfile(targetProfile, 'flag');
         resolvedProfileInfo = { name: targetProfile, source: 'flag' };
     }
     // Step 1: Check if already configured
-    const existing = await loadCredentials(targetProfile);
+    const inspection = await inspectCredentials(targetProfile);
+    if (inspection.state === 'locked' || inspection.state === 'inaccessible') {
+        fail(inspection.detail);
+    }
+    const existing = inspection.credentials;
     if (existing) {
         console.log('Existing credentials found.');
         if (process.stdin.isTTY && process.stdout.isTTY) {
@@ -556,9 +569,12 @@ profile
         console.error(err instanceof Error ? err.message : String(err));
         process.exit(2);
     }
-    const { loadCredentials } = await import('./auth.js');
-    const creds = await loadCredentials(validated);
-    if (!creds) {
+    const { inspectCredentials } = await import('./auth.js');
+    const inspection = await inspectCredentials(validated);
+    if (inspection.state === 'locked' || inspection.state === 'inaccessible') {
+        fail(inspection.detail);
+    }
+    if (inspection.state === 'missing') {
         console.error(`No credentials found for profile "${validated}". Run \`noxctl init --profile ${validated}\` first.`);
         process.exit(1);
     }
@@ -606,7 +622,7 @@ program
     .command('doctor')
     .description('Check setup: credentials, token, API connectivity, and scopes')
     .action(async () => {
-    const { loadCredentials } = await import('./auth.js');
+    const { inspectCredentials } = await import('./auth.js');
     let ok = true;
     function pass(label, detail) {
         console.log(`  ✓ ${label}${detail ? ` — ${detail}` : ''}`);
@@ -641,6 +657,9 @@ program
             if (state === 'locked') {
                 fail('Dedicated keychain', 'locked — run `noxctl keychain unlock` (tap your YubiKey)');
             }
+            else if (state === 'missing') {
+                fail('Dedicated keychain', `configured but inaccessible at ${activePath} — inspect it from an unsandboxed terminal`);
+            }
             else {
                 pass('Dedicated keychain', `active, ${state} (${activePath})`);
             }
@@ -682,27 +701,21 @@ program
     catch {
         // best-effort diagnostic — don't block doctor on filesystem issues
     }
-    // 3. Credentials exist
-    let creds;
-    try {
-        creds = await loadCredentials();
-    }
-    catch (err) {
-        const { KeychainLockedError } = await import('./keychain-target.js');
-        if (err instanceof KeychainLockedError) {
-            fail('Credentials', err.message);
-            console.log(`\n${ok ? 'All checks passed.' : 'Some checks failed.'}`);
-            return;
-        }
-        throw err;
+    // 3. Credential state
+    const inspection = await inspectCredentials();
+    if (inspection.state === 'locked' || inspection.state === 'inaccessible') {
+        fail('Credentials', `${inspection.state} — ${inspection.detail}`);
+        console.log(`\n${ok ? 'All checks passed.' : 'Some checks failed.'}`);
+        return;
     }
-    if (!creds) {
-        fail('Credentials', `not found for profile "${resolvedProfileInfo.name}" — run \`noxctl init${resolvedProfileInfo.name === DEFAULT_PROFILE
+    if (inspection.state === 'missing') {
+        fail('Credentials', `missing — not found for profile "${resolvedProfileInfo.name}" — run \`noxctl init${resolvedProfileInfo.name === DEFAULT_PROFILE
             ? ''
             : ` --profile ${resolvedProfileInfo.name}`}\` to set up`);
         console.log(`\n${ok ? 'All checks passed.' : 'Some checks failed.'}`);
         return;
     }
+    const creds = inspection.credentials;
     pass('Credentials', 'found');
     if (creds.company_name) {
         pass('Company (cached)', creds.company_name);
@@ -795,6 +808,12 @@ keychain
     const onDarwin = process.platform === 'darwin';
     console.log('Keychain status\n');
     console.log(`  Platform          ${process.platform}${onDarwin ? '' : ' (dedicated keychain is macOS-only)'}`);
+    const { inspectCredentials } = await import('./auth.js');
+    const inspection = await inspectCredentials();
+    console.log(`  Credential state  ${inspection.state} — profile "${inspection.profile}" (source: ${inspection.source})`);
+    if (inspection.state === 'locked' || inspection.state === 'inaccessible') {
+        console.log(`\n  ${inspection.detail}`);
+    }
     if (!onDarwin)
         return;
     const activePath = kt.activeKeychainPath();
@@ -822,10 +841,13 @@ keychain
     .action(async () => {
     requireDarwin();
     const kt = await import('./keychain-target.js');
-    const kcPath = kt.activeKeychainPath() ?? kt.dedicatedKeychainPath();
+    const activePath = kt.activeKeychainPath();
+    const kcPath = activePath ?? kt.dedicatedKeychainPath();
     const state = kt.keychainLockState(kcPath);
     if (state === 'missing') {
-        console.error('No dedicated keychain found. Run `noxctl keychain init` first.');
+        console.error(activePath
+            ? `The configured keychain at ${kcPath} is inaccessible. Retry from an unsandboxed terminal; do not re-run noxctl keychain init.`
+            : 'No dedicated keychain found. Run `noxctl keychain init` first.');
         process.exit(1);
     }
     if (state === 'unlocked') {
@@ -868,9 +890,12 @@ keychain
     .action(async () => {
     requireDarwin();
     const kt = await import('./keychain-target.js');
-    const kcPath = kt.activeKeychainPath() ?? kt.dedicatedKeychainPath();
+    const activePath = kt.activeKeychainPath();
+    const kcPath = activePath ?? kt.dedicatedKeychainPath();
     if (kt.keychainLockState(kcPath) === 'missing') {
-        console.error('No dedicated keychain found.');
+        console.error(activePath
+            ? `The configured keychain at ${kcPath} is inaccessible. Retry from an unsandboxed terminal.`
+            : 'No dedicated keychain found.');
         process.exit(1);
     }
     kt.lockKeychain(kcPath);
@@ -1263,6 +1288,47 @@ invoices
     const data = await creditInvoice(documentNumber);
     outputConfirmation(`Invoice ${documentNumber} credited.`, json(), data, invoiceConfirmColumns, 'Invoice');
 });
+invoices
+    .command('attach <documentNumber> <files...>')
+    .description('Upload receipt/underlag files and attach them to a customer invoice')
+    .option('--no-include-on-send', 'Do not bundle the file when the invoice is sent (default: bundled)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview without uploading')
+    .addHelpText('after', `
+Requires the "archive" scope — run \`noxctl init --with-archive\` first if
+\`noxctl doctor\` reports it missing.
+
+Examples:
+  noxctl invoices attach 91110646 underlag.pdf
+  noxctl invoices attach 91110646 underlag.pdf --no-include-on-send`)
+    .action(async (documentNumber, files, opts) => {
+    const { attachInvoiceFiles } = await import('./operations/invoices.js');
+    if (!(await confirmMutation(`Attach ${files.length} file(s) to invoice ${documentNumber}`, opts, {
+        files,
+        includeOnSend: opts.includeOnSend ?? true,
+    }))) {
+        return;
+    }
+    const results = await attachInvoiceFiles({
+        documentNumber,
+        filePaths: files,
+        includeOnSend: opts.includeOnSend,
+    });
+    if (json()) {
+        console.log(JSON.stringify({ Attachments: results }, null, 2));
+    }
+    else {
+        outputList(results, invoiceAttachmentColumns, false, results);
+    }
+});
+invoices
+    .command('attachments <documentNumber>')
+    .description('List files attached to a customer invoice')
+    .action(async (documentNumber) => {
+    const { listInvoiceAttachments } = await import('./operations/invoices.js');
+    const results = await listInvoiceAttachments(documentNumber);
+    outputList(results, invoiceAttachmentListColumns, json(), { Attachments: results });
+});
 // --- tax ---
 const tax = program.command('tax').description('Tax operations');
 tax
@@ -1748,6 +1814,51 @@ Examples:
         outputList(results, voucherAttachmentColumns, false, results);
     }
 });
+vouchers
+    .command('attachments <series> <voucherNumber>')
+    .description('List files (receipts/underlag) attached to a voucher')
+    .option('--year <number>', 'Financial year (recommended — voucher numbers reset between financial years)', parseInt)
+    .action(async (series, voucherNumber, opts) => {
+    const { listVoucherAttachments } = await import('./operations/vouchers.js');
+    const attachments = await listVoucherAttachments(series, voucherNumber, opts.year);
+    if (json()) {
+        console.log(JSON.stringify({ Attachments: attachments }, null, 2));
+    }
+    else {
+        outputList(attachments, voucherAttachmentColumns, false, attachments);
+    }
+});
+vouchers
+    .command('file <fileId>')
+    .description('Download a file attached to a voucher (get the fileId from "vouchers attachments")')
+    .option('-f, --file <path>', 'Write the file here (- for stdout; default: voucher-file-<fileId><ext>)')
+    .addHelpText('after', `
+Examples:
+  noxctl vouchers attachments A 60 --year 4
+  noxctl vouchers file c7e578d8-59a7-4e00-b29b-b99e4d9ede63
+  noxctl vouchers file c7e578d8-59a7-4e00-b29b-b99e4d9ede63 --file receipt.pdf`)
+    .action(async (fileId, opts) => {
+    const { getVoucherFile, extensionForMime } = await import('./operations/vouchers.js');
+    const toStdout = opts.file === '-';
+    if (toStdout && program.opts().output === 'json') {
+        throw new Error('--file - writes raw file bytes to stdout and cannot be combined with --output json.');
+    }
+    const file = await getVoucherFile(fileId);
+    if (toStdout) {
+        await new Promise((resolve, reject) => {
+            process.stdout.write(file.buffer, (err) => (err ? reject(err) : resolve()));
+        });
+        return;
+    }
+    const path = opts.file ?? `voucher-file-${fileId}${extensionForMime(file.contentType)}`;
+    writeFileSync(path, file.buffer);
+    outputConfirmation(`File saved to ${path} (${file.contentType}, ${file.buffer.length} bytes).`, json(), {
+        FileId: fileId,
+        Path: path,
+        ContentType: file.contentType,
+        Bytes: file.buffer.length,
+    });
+});
 // --- invoice-payments ---
 const invoicePayments = program
     .command('invoice-payments')