run402 3.7.14 → 3.8.1

package/lib/projects.mjs

@@ -1,5 +1,5 @@
 import { readFileSync } from "fs";
-import { loadKeyStore, API, allowanceAuthHeaders, resolveProjectId, getActiveProjectId, isCoreApiTarget } from "./config.mjs";
+import { allowanceAuthHeaders, resolveProjectId, getActiveProjectId, isCoreApiTarget } from "./config.mjs";
 import { loadLiveOperatorSession } from "../core-dist/operator-session.js";
 import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.js";
 import { withAutoApprove } from "./operator.mjs";
@@ -19,8 +19,7 @@ Subcommands:
   list [--org <id>] [--all]               List your projects from the server (name, site_url, custom domains, org_id, active marker)
   rename <id> --name <label>              Rename a project (fix an auto-generated name)
   get   [id]                              Authoritative server read: status, org, tier, active deploy, mailbox, usage vs limits (live; no keys)
-  info  [id]                              Show local project details: REST URL, keys (local keystore only)
-  keys  [id]                              Print anon_key and service_key as JSON (local keystore only)
+  current                                 Show the active project pointer and validation status
   sql   [id] "<query>" [--file <path>] [--params '<json>']  Run a SQL query (supports parameterized queries)
   rest  [id] <table> [params]             Query a table via the REST API (PostgREST)
   usage [id]                              Show compute/storage usage for a project
@@ -45,7 +44,7 @@ Examples:
   run402 projects list --all
   run402 projects rename prj_abc123 --name "My Site"
   run402 projects get prj_abc123
-  run402 projects info prj_abc123
+  run402 projects current
   run402 projects sql prj_abc123 "SELECT * FROM users LIMIT 5"
   run402 projects sql prj_abc123 "SELECT * FROM users WHERE id = $1" --params '[42]'
   run402 projects sql prj_abc123 --file setup.sql
@@ -56,7 +55,6 @@ Examples:
   run402 projects validate-expose prj_abc123 --file manifest.json
   run402 projects apply-expose prj_abc123 --file manifest.json
   run402 projects get-expose prj_abc123
-  run402 projects keys prj_abc123
   run402 projects delete prj_abc123 --confirm
 
 Global options (any command):
@@ -69,7 +67,9 @@ Notes:
   - Most commands that take <id> default to the active project when omitted
     (set it with 'run402 projects use <id>'). Project IDs start with 'prj_';
     any first positional that doesn't is treated as the next argument instead.
-  - 'list' is a SERVER read, not the local keystore: it shows every project the
+  - 'list', 'get', and 'use' are SERVER-authoritative project identity flows.
+    Local project keys live under 'run402 credentials project-keys ...'.
+  - 'list' is a SERVER read, not the local key cache: it shows every project the
     active wallet can reach (membership-scoped), with name, site_url, custom
     domains, and org_id. '--org <id>' filters to one org; '--all' reads the
     cross-wallet inventory for every wallet controlling your operator email
@@ -129,7 +129,7 @@ Examples:
   run402 projects list --all
   run402 projects list --wallet work
 `,
-  rename: `run402 projects rename — Rename a project
+	  rename: `run402 projects rename — Rename a project
 
 Usage:
   run402 projects rename <id> --name <label>
@@ -147,6 +147,16 @@ Notes:
 
 Examples:
   run402 projects rename prj_abc123 --name "My Site"
+	`,
+  current: `run402 projects current — Inspect active project selection
+
+Usage:
+  run402 projects current
+
+Notes:
+  - The active project pointer is local non-secret profile state, not proof that
+    local project keys exist.
+  - The command attempts an authoritative server read and reports validation.
 `,
   provision: `run402 projects provision — Provision a new Postgres project
 
@@ -541,28 +551,55 @@ async function get(projectId) {
   }
 }
 
-async function info(projectId) {
+async function current() {
+  const projectId = getActiveProjectId();
+  const out = {
+    active_project_id: projectId ?? null,
+    source: "profile_state",
+    validation: { checked: false, ok: false },
+  };
+  if (!projectId) {
+    console.log(JSON.stringify(out, null, 2));
+    return;
+  }
   try {
-    const data = await getSdk().projects.info(projectId);
-    console.log(JSON.stringify({
-      project_id: projectId,
-      rest_url: `${API}/rest/v1`,
-      anon_key: data.anon_key,
-      service_key: data.service_key,
-      site_url: data.site_url || null,
-    }, null, 2));
+    const detail = await getSdk().projects.get(projectId);
+    out.validation = { checked: true, ok: true };
+    out.project = detail;
   } catch (err) {
-    reportSdkError(err);
-  }
+    out.validation = {
+      checked: true,
+      ok: false,
+      code: err?.code ?? null,
+      message: err?.message ?? String(err),
+    };
+  }
+  console.log(JSON.stringify(out, null, 2));
 }
 
-async function keys(projectId) {
-  try {
-    const data = await getSdk().projects.keys(projectId);
-    console.log(JSON.stringify({ project_id: projectId, anon_key: data.anon_key, service_key: data.service_key }, null, 2));
-  } catch (err) {
-    reportSdkError(err);
-  }
+function commandMoved(name) {
+  fail({
+    code: "COMMAND_MOVED",
+    message: `run402 projects ${name} moved to the explicit local credential-cache surface.`,
+    hint: "Use `run402 credentials project-keys status/export --project <id>`.",
+    details: {
+      old_command: `projects ${name}`,
+      new_command: name === "keys" ? "credentials project-keys export --reveal" : "credentials project-keys status",
+      source: "local_cache",
+    },
+    next_actions: [
+      {
+        type: "run_command",
+        command: "run402 credentials project-keys status --project <id>",
+        why: "Inspect cached key presence without revealing secrets.",
+      },
+      {
+        type: "run_command",
+        command: "run402 credentials project-keys export --project <id> --reveal",
+        why: "Reveal cached project keys only when you explicitly need secret material.",
+      },
+    ],
+  });
 }
 
 async function sqlCmd(projectId, args = []) {
@@ -794,10 +831,11 @@ export async function run(sub, args) {
     case "provision": await provision(args); break;
     case "use":       await use(args[0]); break;
     case "list":      await list(args); break;
+    case "current":   await current(); break;
     case "rename":    { const { projectId, rest } = resolvePositionalProject(args, { rejectBareFirst: true, valueFlags: FLAGS_BY_SUB.rename.values }); await rename(projectId, rest); break; }
     case "get":       { const { projectId } = resolvePositionalProject(args, { rejectBareFirst: true }); await get(projectId); break; }
-    case "info":      { const { projectId } = resolvePositionalProject(args, { rejectBareFirst: true }); await info(projectId); break; }
-    case "keys":      { const { projectId } = resolvePositionalProject(args, { rejectBareFirst: true }); await keys(projectId); break; }
+    case "info":      commandMoved("info"); break;
+    case "keys":      commandMoved("keys"); break;
     case "sql":       { const { projectId, rest } = resolvePositionalProject(args, { maxBarePositionals: 1, valueFlags: FLAGS_BY_SUB.sql.values, rejectBareFirstWhenFlagPresent: ["--file"] }); await sqlCmd(projectId, rest); break; }
     case "rest":      { const { projectId, rest: restArgs } = resolvePositionalProject(args); await rest(projectId, restArgs[0], restArgs[1]); break; }
     case "usage":     { const { projectId } = resolvePositionalProject(args, { rejectBareFirst: true }); await usage(projectId); break; }

package/lib/sdk-errors.mjs

@@ -4,9 +4,8 @@
  * Maps SDK `Run402Error` subclasses into the CLI's canonical error envelope:
  * `{status: "error", code, message, retryable, safe_to_retry, ...}` on stderr,
  * `process.exit(1)`. Preserves specific behaviors:
- *   - `ProjectNotFound` → canonical envelope with `code: "PROJECT_NOT_FOUND"`
- *     and `details.source: "local_registry"` so callers can distinguish the
- *     local-registry miss from a gateway 404.
+ *   - `ProjectCredentialNotFound` → preserves
+ *     `code: "PROJECT_CREDENTIAL_NOT_FOUND"` and local-cache provenance.
  *   - HTML / non-JSON error bodies → `body_preview` field (first 500 chars),
  *     matching GH-84 behavior.
  *   - Network errors → `{status: "error", message: "..."}`.
@@ -66,6 +65,18 @@ export function parseFlagJson(name, value) {
 }
 
 export function reportSdkError(err) {
+  if (err?.name === "ProjectCredentialNotFound" || err?.code === "PROJECT_CREDENTIAL_NOT_FOUND") {
+    fail({
+      code: "PROJECT_CREDENTIAL_NOT_FOUND",
+      message: err?.message || "Local project credentials are not cached.",
+      hint: "This is a local credential-cache miss, not proof that the project does not exist. Use a principal-auth command, or import keys with `run402 credentials project-keys import --project <id> --service-key-stdin` for credential-required operations.",
+      details: err?.details,
+      next_actions: err?.nextActions,
+      retryable: err?.retryable ?? false,
+      safe_to_retry: err?.safeToRetry ?? true,
+    });
+  }
+
   if (err?.name === "ProjectNotFound") {
     const id = err.projectId || "";
     const hint = id && !String(id).startsWith("prj_")
@@ -117,6 +128,16 @@ export function reportSdkError(err) {
       "Returned as 403 even when the project does not exist, so verify the project id too.";
   }
 
+  if (typeof payload.code === "string" && payload.code.startsWith("PROJECT_CREDENTIAL_") && payload.hint === undefined) {
+    if (payload.code === "PROJECT_CREDENTIAL_PROJECT_MISMATCH") {
+      payload.hint =
+        "The supplied service key belongs to a different project than the explicit project id. Select the matching project key, or omit service-key mode and use the default principal-auth path when the command supports it.";
+    } else if (payload.code === "PROJECT_CREDENTIAL_INVALID" || payload.code === "PROJECT_CREDENTIAL_EXPIRED") {
+      payload.hint =
+        "The project credential was present but rejected by the server. Re-import or rotate the project key, or use a principal-auth command when available.";
+    }
+  }
+
   // Keep `status: "error"` as the outer envelope even if the response body
   // happened to contain its own `status` field (e.g. `{"status":"degraded"}`
   // from /health 503 responses). Downstream scripts match on this sentinel.

package/lib/sdk.mjs

@@ -8,7 +8,7 @@
  */
 
 import { run402 } from "#sdk/node";
-import { allowanceFile, projectsFile } from "./config.mjs";
+import { allowanceFile, profileStateFile, projectCredentialsFile } from "./config.mjs";
 
 export function getSdk(opts = {}) {
   // surface: "cli" opts the default credential resolution into `auto` — wallet
@@ -16,7 +16,8 @@ export function getSdk(opts = {}) {
   return run402({
     surface: "cli",
     allowancePath: allowanceFile(),
-    keystorePath: projectsFile(),
+    keystorePath: projectCredentialsFile(),
+    profileStatePath: profileStateFile(),
     ...opts,
   });
 }

package/lib/up.mjs

@@ -3,6 +3,7 @@ import { stdin as input, stderr as output } from "node:process";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs } from "./argparse.mjs";
+import { createUpdateCheckScheduler, emitUpdateNotice } from "./update-check.mjs";
 
 const HELP = `run402 up — Provision/link/deploy the current app
 
@@ -44,6 +45,11 @@ Options:
   --json-stream       Emit NDJSON progress events on stdout and a final result event.
   --quiet             Suppress action progress events on stderr.
 
+Update notices:
+  Stale CLI notices are advisory and never change the result payload or exit
+  code. Non-streaming notices are JSON on stderr; --json-stream emits
+  cli.update_available as an NDJSON event.
+
 Project resolution:
   explicit --project > .run402/project.json > manifest project_id > approved
   project creation from --name > approved active-project fallback.
@@ -184,6 +190,10 @@ export async function run(args = []) {
     });
   }
   const allowWarningCodes = collectRepeatedValues(parsed, "--allow-warning");
+  const updateScheduler = createUpdateCheckScheduler({
+    command: ["run402", "up", ...parsed],
+  });
+  emitUpdateNotice(updateScheduler.cachedNotice, { jsonStream, quiet });
 
   try {
     const sdk = getSdk();
@@ -224,11 +234,20 @@ export async function run(args = []) {
     } else {
       console.log(JSON.stringify(result, null, 2));
     }
+    if (shouldExitNonZeroForUpResult(result)) {
+      process.exitCode = 1;
+    }
   } catch (err) {
     reportSdkError(err);
   }
 }
 
+export function shouldExitNonZeroForUpResult(result) {
+  return result?.action === "up" &&
+    result?.mode === "apply" &&
+    result?.result?.app_result?.status === "deployed_unverified";
+}
+
 function parseExecutionMode(args) {
   const modes = [];
   if (args.includes("--check")) modes.push("--check");

package/lib/up.test.mjs

@@ -0,0 +1,29 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { shouldExitNonZeroForUpResult } from "./up.mjs";
+
+test("run402 up exits nonzero for deployed-but-unverified app results", () => {
+  assert.equal(shouldExitNonZeroForUpResult({
+    action: "up",
+    mode: "apply",
+    result: {
+      app_result: { status: "deployed_unverified" },
+    },
+  }), true);
+
+  assert.equal(shouldExitNonZeroForUpResult({
+    action: "up",
+    mode: "apply",
+    result: {
+      app_result: { status: "succeeded" },
+    },
+  }), false);
+
+  assert.equal(shouldExitNonZeroForUpResult({
+    action: "up",
+    mode: "check",
+    result: {
+      app_result: { status: "deployed_unverified" },
+    },
+  }), false);
+});