@celonis/content-cli 1.18.0 → 1.18.1

package/commands/sdk/module.js

@@ -13,40 +13,56 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         if (v !== undefined) module.exports = v;
     }
     else if (typeof define === "function" && define.amd) {
-        define(["require", "exports", "../../core/command/module-handler", "./sdk.service"], factory);
+        define(["require", "exports", "../../core/command/module-handler", "./sdk-preview.service", "./sdk.service"], factory);
     }
 })(function (require, exports) {
     "use strict";
     const module_handler_1 = require("../../core/command/module-handler");
+    const sdk_preview_service_1 = require("./sdk-preview.service");
     const sdk_service_1 = require("./sdk.service");
     class Module extends module_handler_1.IModule {
         register(context, configurator) {
             const sdkCommand = configurator
                 .command("sdk")
                 .beta()
-                .description("Implement custom apps for Codespace assets using the Celonis SDK");
-            sdkCommand
-                .command("download")
-                .beta()
-                .description("Download the latest Celonis SDK generated for a Codespace asset")
-                .requiredOption("--appId <appId>", "Identifier of the app to download the SDK for")
-                .action(this.downloadSdk);
+                .description("Implement custom apps for Codehub assets using the Celonis SDK");
             sdkCommand
                 .command("publish")
                 .beta()
-                .description("Publish a build of a custom app as a new version of its Codespace asset")
+                .description("Publish a build of a custom app as a new version of its Codehub asset")
                 .requiredOption("--appId <appId>", "Identifier of the app to publish the build for")
                 .requiredOption("--dist <dist>", "Directory containing the build of the app")
+                .option("--buildVersion <buildVersion>", "Semantic version of the build. Defaults to the next major version")
+                .option("--message <message>", "Message describing the build, at most 500 characters")
                 .action(this.publishApp);
+            sdkCommand
+                .command("preview")
+                .beta()
+                .skipProfileLoading()
+                .description("Proxy your local dev server to preview the app inside Celonis")
+                .option("--target <target>", "URL of the local dev server to proxy", "http://localhost:4200")
+                .option("--port <port>", "Target port on which the preview is hosted", "4300")
+                .option("--allow-inline-scripts", "Allow inline scripts in your dev server's HTML")
+                .action(this.previewApp);
+            sdkCommand
+                .command("token")
+                .beta()
+                .description("Print a token with read access to the Celonis SDK, e.g. to authenticate against the npm registry")
+                .action(this.printToken);
         }
-        downloadSdk(context, command, options) {
+        publishApp(context, command, options) {
             return __awaiter(this, void 0, void 0, function* () {
-                yield new sdk_service_1.SdkService(context).downloadSdk(options.appId);
+                yield new sdk_service_1.SdkService(context).publishApp(options.appId, options.dist, options.buildVersion, options.message);
             });
         }
-        publishApp(context, command, options) {
+        previewApp(context, command, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield new sdk_preview_service_1.SdkPreviewService().previewUntilStopped(options.target, options.port, options.allowInlineScripts === true);
+            });
+        }
+        printToken(context) {
             return __awaiter(this, void 0, void 0, function* () {
-                yield new sdk_service_1.SdkService(context).publishApp(options.appId, options.dist);
+                yield new sdk_service_1.SdkService(context).printToken();
             });
         }
     }

package/commands/sdk/preview-certificate.js

@@ -0,0 +1,82 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "node:crypto", "node:fs", "node:path", "selfsigned"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.loadOrCreatePreviewCertificate = void 0;
+    const node_crypto_1 = require("node:crypto");
+    const node_fs_1 = require("node:fs");
+    const node_path_1 = require("node:path");
+    const selfsigned_1 = require("selfsigned");
+    const DAY_MS = 24 * 60 * 60 * 1000;
+    const CERT_FILE = "localhost-cert.pem";
+    const KEY_FILE = "localhost-key.pem";
+    function loadOrCreatePreviewCertificate(directory, now = new Date()) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const existing = readUsableCertificate(directory, now);
+            if (existing) {
+                return existing;
+            }
+            const generated = yield (0, selfsigned_1.generate)([{ name: "commonName", value: "localhost" }], {
+                keyType: "ec",
+                curve: "P-256",
+                algorithm: "sha256",
+                notBeforeDate: now,
+                notAfterDate: new Date(now.getTime() + 365 * DAY_MS),
+                extensions: [
+                    {
+                        name: "subjectAltName",
+                        altNames: [
+                            { type: 2, value: "localhost" },
+                            { type: 7, ip: "127.0.0.1" },
+                            { type: 7, ip: "::1" },
+                        ],
+                    },
+                ],
+            });
+            const certificate = { key: generated.private, cert: generated.cert };
+            (0, node_fs_1.mkdirSync)(directory, { recursive: true });
+            (0, node_fs_1.writeFileSync)((0, node_path_1.join)(directory, CERT_FILE), certificate.cert);
+            (0, node_fs_1.writeFileSync)((0, node_path_1.join)(directory, KEY_FILE), certificate.key, { mode: 0o600 });
+            return certificate;
+        });
+    }
+    exports.loadOrCreatePreviewCertificate = loadOrCreatePreviewCertificate;
+    function readUsableCertificate(directory, now) {
+        const certPath = (0, node_path_1.join)(directory, CERT_FILE);
+        const keyPath = (0, node_path_1.join)(directory, KEY_FILE);
+        if (!(0, node_fs_1.existsSync)(certPath) || !(0, node_fs_1.existsSync)(keyPath)) {
+            return null;
+        }
+        try {
+            const cert = (0, node_fs_1.readFileSync)(certPath, "utf8");
+            const key = (0, node_fs_1.readFileSync)(keyPath, "utf8");
+            const x509 = new node_crypto_1.X509Certificate(cert);
+            if (!x509.checkPrivateKey((0, node_crypto_1.createPrivateKey)(key))) {
+                return null;
+            }
+            if (new Date(x509.validTo).getTime() - now.getTime() <= DAY_MS) {
+                return null;
+            }
+            return { key, cert };
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+});

package/commands/sdk/preview-headers.js

@@ -0,0 +1,25 @@
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.LOCAL_PREVIEW_HEADERS = void 0;
+    /**
+     * Copied from `localPreviewHeaders()` in ems-frontend `libs/common/fragments/sandbox/src/lib/policy.ts`,
+     * whose spec fails when the gateway policy drifts. Update both together.
+     */
+    exports.LOCAL_PREVIEW_HEADERS = {
+        "content-security-policy": "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; media-src 'self' blob:; connect-src 'none'; worker-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'none'; frame-ancestors https://*.celonis.cloud http://localhost:*; sandbox allow-scripts",
+        "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), hid=(), clipboard-read=(), clipboard-write=(), display-capture=()",
+        "access-control-allow-origin": "*",
+        "referrer-policy": "no-referrer",
+        "x-content-type-options": "nosniff",
+        "cache-control": "no-store",
+    };
+});

package/commands/sdk/preview-inline-scripts.js

@@ -0,0 +1,50 @@
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "node:crypto"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.allowInlineScripts = exports.inlineScriptHashes = void 0;
+    const node_crypto_1 = require("node:crypto");
+    const SCRIPT_ELEMENT = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
+    const SRC_ATTRIBUTE = /(?:^|[\s/])src(?=[\s=/]|$)/i;
+    const EXCERPT_LENGTH = 60;
+    /**
+     * The inline scripts (`<script>` without `src`) of an HTML document, distinct by hash and in document order.
+     * Each hash covers the script text as the browser parses it for CSP (line endings normalized to LF).
+     */
+    function inlineScriptHashes(html) {
+        const scripts = new Map();
+        for (const [, attributes, text] of html.matchAll(SCRIPT_ELEMENT)) {
+            if (SRC_ATTRIBUTE.test(attributes) || text.length === 0) {
+                continue;
+            }
+            // Browsers hash the parsed text, and the HTML parser turns CRLF and lone CR into LF.
+            const parsedText = text.replace(/\r\n?/g, "\n");
+            const hash = `'sha256-${(0, node_crypto_1.createHash)("sha256").update(parsedText, "utf8").digest("base64")}'`;
+            if (!scripts.has(hash)) {
+                scripts.set(hash, { hash, excerpt: text.replace(/\s+/g, " ").trim().slice(0, EXCERPT_LENGTH) });
+            }
+        }
+        return [...scripts.values()];
+    }
+    exports.inlineScriptHashes = inlineScriptHashes;
+    /** Appends the hashes to the policy's `script-src` directive and leaves every other directive unchanged. */
+    function allowInlineScripts(csp, hashes) {
+        if (hashes.length === 0) {
+            return csp;
+        }
+        return csp
+            .split(";")
+            .map(directive => /^\s*script-src(\s|$)/i.test(directive)
+            ? `${directive.trimEnd()} ${hashes.join(" ")}`
+            : directive)
+            .join(";");
+    }
+    exports.allowInlineScripts = allowInlineScripts;
+});

package/commands/sdk/preview-proxy.js

@@ -0,0 +1,182 @@
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "node:http", "node:https", "node:net", "node:tls", "../../core/utils/logger", "./preview-inline-scripts"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.startPreviewProxy = void 0;
+    const http = require("node:http");
+    const https = require("node:https");
+    const net = require("node:net");
+    const tls = require("node:tls");
+    const logger_1 = require("../../core/utils/logger");
+    const preview_inline_scripts_1 = require("./preview-inline-scripts");
+    const REPLACED_HEADERS = ["content-security-policy", "content-security-policy-report-only", "x-frame-options"];
+    const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+    const BODILESS_STATUSES = new Set([204, 304]);
+    function inlineScriptWarning(path, excerpt, allowed) {
+        return allowed
+            ? `Allowing an inline script in ${path} for the local preview: "${excerpt}". ` +
+                "Inline scripts are disabled for published apps, so they can only be used during development."
+            : `Blocking an inline script in ${path}: "${excerpt}". Inline scripts are disabled for published apps. You can allow inline scripts during development by passing --allow-inline-scripts.`;
+    }
+    function startPreviewProxy(options) {
+        const { target, port, certificate, headers, allowInlineScripts: allowInline } = options;
+        const secureTarget = target.protocol === "https:";
+        const targetHostname = target.hostname.replace(/^\[(.*)\]$/, "$1");
+        const targetPort = Number(target.port) || (secureTarget ? 443 : 80);
+        const rejectUnauthorized = !LOOPBACK_HOSTNAMES.has(target.hostname);
+        const agent = secureTarget
+            ? new https.Agent({ keepAlive: true, rejectUnauthorized })
+            : new http.Agent({ keepAlive: true });
+        const removedHeaders = new Set([...REPLACED_HEADERS, ...Object.keys(headers).map(name => name.toLowerCase())]);
+        const unreachableMessage = `content-cli sdk preview can't reach ${target.origin}. Start your dev server or pass --target.`;
+        const openSockets = new Set();
+        const warnedInlineScripts = new Set();
+        let warnedUnreachable = false;
+        function track(socket) {
+            openSockets.add(socket);
+            socket.once("close", () => openSockets.delete(socket));
+        }
+        function forwardRequest(req, res) {
+            const proxyReq = (secureTarget ? https : http).request({
+                protocol: target.protocol,
+                hostname: targetHostname,
+                port: targetPort,
+                method: req.method,
+                path: req.url,
+                headers: Object.assign(Object.assign({}, req.headers), { host: target.host, "accept-encoding": "identity" }),
+                agent,
+            });
+            let responded = false;
+            proxyReq.on("response", proxyRes => {
+                var _a;
+                responded = true;
+                warnedUnreachable = false;
+                const responseHeaders = {};
+                for (const [name, value] of Object.entries(proxyRes.headers)) {
+                    if (!removedHeaders.has(name.toLowerCase())) {
+                        responseHeaders[name] = value;
+                    }
+                }
+                proxyRes.on("error", () => res.destroy());
+                proxyRes.on("aborted", () => res.destroy());
+                const isHtml = /^text\/html\b/i.test((_a = proxyRes.headers["content-type"]) !== null && _a !== void 0 ? _a : "");
+                const hasBody = req.method !== "HEAD" && !BODILESS_STATUSES.has(proxyRes.statusCode);
+                if (!isHtml || !hasBody) {
+                    res.writeHead(proxyRes.statusCode, Object.assign(Object.assign({}, responseHeaders), headers));
+                    proxyRes.pipe(res);
+                    return;
+                }
+                const chunks = [];
+                proxyRes.on("data", (chunk) => chunks.push(chunk));
+                proxyRes.on("end", () => {
+                    if (res.destroyed) {
+                        return;
+                    }
+                    const body = Buffer.concat(chunks);
+                    const scripts = (0, preview_inline_scripts_1.inlineScriptHashes)(body.toString("utf8"));
+                    for (const { hash, excerpt } of scripts) {
+                        if (!warnedInlineScripts.has(hash)) {
+                            warnedInlineScripts.add(hash);
+                            logger_1.logger.warn(inlineScriptWarning(req.url, excerpt, allowInline));
+                        }
+                    }
+                    if (proxyRes.headers["content-length"] !== undefined) {
+                        responseHeaders["content-length"] = body.length;
+                    }
+                    const csp = headers["content-security-policy"];
+                    res.writeHead(proxyRes.statusCode, Object.assign(Object.assign(Object.assign({}, responseHeaders), headers), (csp === undefined || !allowInline ? {} : {
+                        "content-security-policy": (0, preview_inline_scripts_1.allowInlineScripts)(csp, scripts.map(script => script.hash)),
+                    })));
+                    res.end(body);
+                });
+            });
+            proxyReq.on("error", () => {
+                if (res.destroyed) {
+                    return;
+                }
+                if (responded || res.headersSent) {
+                    res.destroy();
+                    return;
+                }
+                if (!warnedUnreachable) {
+                    warnedUnreachable = true;
+                    logger_1.logger.warn(unreachableMessage);
+                }
+                res.writeHead(502, Object.assign(Object.assign({}, headers), { "content-type": "text/plain" }));
+                res.end(unreachableMessage);
+            });
+            res.on("close", () => {
+                if (!res.writableFinished) {
+                    proxyReq.destroy();
+                }
+            });
+            req.pipe(proxyReq);
+        }
+        function forwardUpgrade(req, socket, head) {
+            const targetSocket = secureTarget
+                ? tls.connect({
+                    host: targetHostname,
+                    port: targetPort,
+                    servername: net.isIP(targetHostname) ? undefined : targetHostname,
+                    rejectUnauthorized,
+                })
+                : net.connect({ host: targetHostname, port: targetPort });
+            track(targetSocket);
+            const destroyBoth = () => {
+                socket.destroy();
+                targetSocket.destroy();
+            };
+            socket.on("error", destroyBoth);
+            targetSocket.on("error", destroyBoth);
+            socket.on("close", () => targetSocket.destroy());
+            targetSocket.on("close", () => socket.destroy());
+            targetSocket.once(secureTarget ? "secureConnect" : "connect", () => {
+                const lines = [`${req.method} ${req.url} HTTP/${req.httpVersion}`];
+                for (let i = 0; i < req.rawHeaders.length; i += 2) {
+                    const name = req.rawHeaders[i];
+                    lines.push(`${name}: ${name.toLowerCase() === "host" ? target.host : req.rawHeaders[i + 1]}`);
+                }
+                targetSocket.write(`${lines.join("\r\n")}\r\n\r\n`);
+                if (head.length > 0) {
+                    targetSocket.write(head);
+                }
+                targetSocket.pipe(socket);
+                socket.pipe(targetSocket);
+            });
+        }
+        const server = https.createServer({ key: certificate.key, cert: certificate.cert }, forwardRequest);
+        server.on("connection", track);
+        server.on("upgrade", forwardUpgrade);
+        function close() {
+            return new Promise(closed => {
+                server.close(() => closed());
+                openSockets.forEach(socket => socket.destroy());
+                agent.destroy();
+            });
+        }
+        return new Promise((resolve, reject) => {
+            const onListenError = (error) => {
+                agent.destroy();
+                reject(new logger_1.FatalError(error.code === "EADDRINUSE"
+                    ? `Port ${port} is already in use. Stop the other process or pass --port.`
+                    : `Could not start the preview proxy on port ${port}: ${error.message}`));
+            };
+            server.once("error", onListenError);
+            server.listen({ port, host: "localhost" }, () => {
+                server.off("error", onListenError);
+                resolve({
+                    url: `https://localhost:${server.address().port}`,
+                    close,
+                });
+            });
+        });
+    }
+    exports.startPreviewProxy = startPreviewProxy;
+});

package/commands/sdk/sdk-api.js

@@ -24,21 +24,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         constructor(context) {
             this.httpClient = () => context.httpClient;
         }
-        downloadSdk(appId) {
+        publishApp(appId, bundle, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 return this.httpClient()
-                    .getFile(`/pro-code-app-manager/api/npm/@celonis-sdk/${appId}/-/${appId}-latest.tgz`)
-                    .catch((e) => {
-                    const problem = `Problem downloading SDK for app ${appId}`;
-                    throw new logger_1.FatalError(e ? `${problem}: ${e}` : problem);
-                });
-            });
-        }
-        publishApp(appId, bundle) {
-            return __awaiter(this, void 0, void 0, function* () {
-                return this.httpClient()
-                    .postBinary(`/pro-code-app-manager/api/codespace/apps/${appId}/publish`, bundle, "application/zip")
-                    .catch((e) => {
+                    .postBinary(`/pro-code-app-manager/api/codespace/apps/${appId}/publish`, bundle, "application/zip", options)
+                    .catch(e => {
                     throw new logger_1.FatalError(`Problem publishing app ${appId}: ${e}`);
                 });
             });

package/commands/sdk/sdk-preview.service.js

@@ -0,0 +1,98 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "node:os", "node:path", "../../core/utils/logger", "./preview-certificate", "./preview-headers", "./preview-proxy"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SdkPreviewService = void 0;
+    const os = require("node:os");
+    const path = require("node:path");
+    const logger_1 = require("../../core/utils/logger");
+    const preview_certificate_1 = require("./preview-certificate");
+    const preview_headers_1 = require("./preview-headers");
+    const preview_proxy_1 = require("./preview-proxy");
+    class SdkPreviewService {
+        constructor(certificateDirectory = SdkPreviewService.CERTIFICATE_DIRECTORY) {
+            this.certificateDirectory = certificateDirectory;
+        }
+        preview(target, port, allowInlineScripts = false) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const targetUrl = this.parseTarget(target);
+                const portNumber = this.parsePort(port);
+                const certificate = yield (0, preview_certificate_1.loadOrCreatePreviewCertificate)(this.certificateDirectory);
+                const proxy = yield (0, preview_proxy_1.startPreviewProxy)({
+                    target: targetUrl,
+                    port: portNumber,
+                    certificate,
+                    headers: preview_headers_1.LOCAL_PREVIEW_HEADERS,
+                    allowInlineScripts,
+                });
+                logger_1.logger.info(`Local preview running on https://localhost:${portNumber}, forwarding to ${target}.`);
+                logger_1.logger.info(`Open the Local preview in your Codehub. If it stays blank, open https://localhost:${portNumber} in a browser tab and accept the certificate, then reload the preview.`);
+                logger_1.logger.info("Press Ctrl+C to stop.");
+                return proxy;
+            });
+        }
+        previewUntilStopped(target, port, allowInlineScripts = false) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const proxy = yield this.preview(target, port, allowInlineScripts);
+                yield this.waitForShutdownSignal();
+                yield proxy.close();
+            });
+        }
+        waitForShutdownSignal() {
+            return new Promise(resolve => {
+                const stop = () => {
+                    process.removeListener("SIGINT", stop);
+                    process.removeListener("SIGTERM", stop);
+                    resolve();
+                };
+                process.once("SIGINT", stop);
+                process.once("SIGTERM", stop);
+            });
+        }
+        parseTarget(target) {
+            const message = "--target must be an http or https origin, for example http://localhost:4200";
+            let url;
+            try {
+                url = new URL(target);
+            }
+            catch (_a) {
+                throw new logger_1.FatalError(message);
+            }
+            const isOrigin = (url.protocol === "http:" || url.protocol === "https:") &&
+                !url.username &&
+                !url.password &&
+                url.pathname === "/" &&
+                !url.search &&
+                !url.hash;
+            if (!isOrigin) {
+                throw new logger_1.FatalError(message);
+            }
+            return url;
+        }
+        parsePort(port) {
+            const value = typeof port === "number" || /^\d+$/.test(port) ? Number(port) : Number.NaN;
+            if (!Number.isInteger(value) || value < 1 || value > 65535) {
+                throw new logger_1.FatalError("--port must be a number between 1 and 65535");
+            }
+            return value;
+        }
+    }
+    exports.SdkPreviewService = SdkPreviewService;
+    SdkPreviewService.CERTIFICATE_DIRECTORY = path.resolve(os.homedir(), ".celonis-content-cli-preview");
+});

package/commands/sdk/sdk.service.js

@@ -13,7 +13,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         if (v !== undefined) module.exports = v;
     }
     else if (typeof define === "function" && define.amd) {
-        define(["require", "exports", "node:fs", "node:path", "adm-zip", "./sdk-api", "../../core/utils/logger"], factory);
+        define(["require", "exports", "node:fs", "node:path", "adm-zip", "./sdk-api", "../../core/utils/logger", "../../core/profile/profile.service"], factory);
     }
 })(function (require, exports) {
     "use strict";
@@ -24,30 +24,34 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     const AdmZip = require("adm-zip");
     const sdk_api_1 = require("./sdk-api");
     const logger_1 = require("../../core/utils/logger");
+    const profile_service_1 = require("../../core/profile/profile.service");
     class SdkService {
         constructor(context) {
+            this.context = context;
             this.sdkApi = new sdk_api_1.SdkApi(context);
         }
-        downloadSdk(appId) {
-            return __awaiter(this, void 0, void 0, function* () {
-                const sdk = yield this.sdkApi.downloadSdk(appId);
-                const sdkDirectory = path.resolve(process.cwd(), SdkService.SDK_DIRECTORY);
-                fs.rmSync(sdkDirectory, { recursive: true, force: true });
-                fs.mkdirSync(sdkDirectory, { recursive: true });
-                const sdkFile = path.join(SdkService.SDK_DIRECTORY, `${appId}.tgz`);
-                fs.writeFileSync(path.resolve(process.cwd(), sdkFile), sdk);
-                logger_1.logger.info(`SDK downloaded successfully: ${sdkFile}`);
-            });
-        }
-        publishApp(appId, dist) {
+        publishApp(appId, dist, buildVersion, message) {
             return __awaiter(this, void 0, void 0, function* () {
                 const distDirectory = path.resolve(process.cwd(), dist);
                 this.requireDirectory(distDirectory);
                 const bundle = this.compressDirectory(distDirectory);
-                const { version } = yield this.sdkApi.publishApp(appId, bundle);
+                const { version } = yield this.sdkApi.publishApp(appId, bundle, { version: buildVersion, message });
                 logger_1.logger.info(`App published successfully as version '${version}'`);
             });
         }
+        printToken() {
+            return __awaiter(this, void 0, void 0, function* () {
+                const profile = this.requireProfile();
+                const token = yield new profile_service_1.ProfileService().acquireSdkToken(profile);
+                process.stdout.write(`${token}\n`);
+            });
+        }
+        requireProfile() {
+            if (!this.context.profile) {
+                throw new logger_1.FatalError("No profile provided. Please provide a profile to acquire a token for");
+            }
+            return this.context.profile;
+        }
         requireDirectory(directory) {
             if (!fs.existsSync(directory) || !fs.statSync(directory).isDirectory()) {
                 throw new logger_1.FatalError(`The dist directory ${directory} does not exist or is no directory`);
@@ -60,5 +64,4 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         }
     }
     exports.SdkService = SdkService;
-    SdkService.SDK_DIRECTORY = ".celonis-sdk";
 });

package/content-cli.js

@@ -102,8 +102,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             bootstrapProgram.parseOptions(process.argv);
             const globalOpts = bootstrapProgram.opts();
             if (!globalOpts.quietmode) {
-                console.log(`Content CLI - (C) Copyright 2025 - Celonis SE - Version ${version_1.VersionUtils.getCurrentCliVersion()}`);
-                console.log();
+                console.error(`Content CLI - (C) Copyright 2025 - Celonis SE - Version ${version_1.VersionUtils.getCurrentCliVersion()}`);
+                console.error();
             }
             if (globalOpts.debug) {
                 logger_1.logger.transports.forEach(t => {

package/core/command/module-handler.js

@@ -236,7 +236,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         }
         printBetaNoticeIfBetaCommand() {
             if (this.cmd.isBeta) {
-                logger_1.logger.info(chalk.yellow("This command is in beta and may change in future releases."));
+                logger_1.logger.warn(chalk.yellow("This command is in beta and may change in future releases."));
             }
         }
         printBetaNoticeIfBetaOptions() {
@@ -244,12 +244,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 return;
             }
             const providedOptions = this.cmd.optsWithGlobals();
-            for (const option of this.cmd.options) {
-                const optionName = option.attributeName();
-                if (option.isBeta && Object.hasOwn(providedOptions, optionName)) {
-                    logger_1.logger.info(chalk.yellow(`The option '${option.long}' is in beta and may change in future releases.`));
-                }
-            }
+            this.cmd.options
+                .filter(option => option.isBeta && Object.hasOwn(providedOptions, option.attributeName()))
+                .forEach(option => logger_1.logger.warn(chalk.yellow(`The option '${option.long}' is in beta and may change in future releases.`)));
         }
     }
     exports.CommandConfig = CommandConfig;

package/core/http/http-client.js

@@ -133,11 +133,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 });
             });
         }
-        postBinary(url, body, contentType) {
+        postBinary(url, body, contentType, parameters) {
             return __awaiter(this, void 0, void 0, function* () {
                 return new Promise((resolve, reject) => {
                     this.axios.post(this.resolveUrl(url), body, {
-                        headers: this.buildHeaders(contentType)
+                        headers: this.buildHeaders(contentType),
+                        params: parameters
                     }).then(response => {
                         this.handleResponse(response, resolve, reject);
                     }).catch(err => {

package/core/profile/profile.service.js

@@ -36,8 +36,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     const OAUTH_SCOPES = ["studio", "package-manager", "integration.data-pools", "action-engine.projects"];
     /** Device code fallback: try without action-engine.projects if all 4 scopes fail. */
     const DEVICE_CODE_SCOPES_WITHOUT_ACTION_ENGINE = ["studio", "package-manager", "integration.data-pools"];
+    const SDK_SCOPE = "pro-code-app-manager.sdk";
     /** First attempt for both auth flows: all scopes plus the pro-code-app-manager scopes, which are not yet available on every environment. */
-    const OAUTH_SCOPES_WITH_PRO_CODE = [...OAUTH_SCOPES, "pro-code-app-manager.sdk:read", "pro-code-app-manager.publish"];
+    const OAUTH_SCOPES_WITH_PRO_CODE = [...OAUTH_SCOPES, SDK_SCOPE, "pro-code-app-manager.publish"];
     class ProfileService {
         constructor() {
             this.profileContainerPath = path.resolve(homedir, ".celonis-content-cli-profiles");
@@ -318,6 +319,49 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 yield this.storeProfile(profile);
             });
         }
+        acquireSdkToken(profile) {
+            return __awaiter(this, void 0, void 0, function* () {
+                switch (profile.type) {
+                    case profile_interface_1.ProfileType.DEVICE_CODE:
+                        return this.acquireDeviceCodeSdkToken(profile);
+                    case profile_interface_1.ProfileType.CLIENT_CREDENTIALS:
+                        return this.acquireClientCredentialsSdkToken(profile);
+                    default:
+                        throw new logger_1.FatalError("An SDK token cannot be acquired for API key profiles. Use the API key directly for authentication.");
+                }
+            });
+        }
+        acquireDeviceCodeSdkToken(profile) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const issuer = yield openid_client_1.Issuer.discover(profile.team);
+                const oauthClient = new issuer.Client({
+                    client_id: "content-cli",
+                    token_endpoint_auth_method: "none",
+                });
+                const tokenSet = yield oauthClient.refresh(profile.refreshToken, {
+                    exchangeBody: { scope: SDK_SCOPE },
+                });
+                profile.refreshToken = tokenSet.refresh_token;
+                profile.expiresAt = 0;
+                yield this.storeProfile(profile);
+                return tokenSet.access_token;
+            });
+        }
+        acquireClientCredentialsSdkToken(profile) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const issuer = yield openid_client_1.Issuer.discover(profile.team);
+                const oauthClient = new issuer.Client({
+                    client_id: profile.clientId,
+                    client_secret: profile.clientSecret,
+                    token_endpoint_auth_method: profile.clientAuthenticationMethod,
+                });
+                const tokenSet = yield oauthClient.grant({
+                    grant_type: "client_credentials",
+                    scope: SDK_SCOPE,
+                });
+                return tokenSet.access_token;
+            });
+        }
         unrefreshableProfile(profileName, err) {
             const cause = err instanceof Error ? err.message : "an unrecognised error";
             logger_1.logger.debug(`Refreshing the profile ${profileName} failed: ${cause}`);

package/core/utils/logger.js

@@ -56,6 +56,7 @@
         transports: [
             new winston.transports.Console({
                 level: "info",
+                stderrLevels: ["error", "warn"],
                 format: winston.format.combine(winston.format.colorize()),
             }),
             new winston.transports.File({

package/lib/commands/sdk/module.d.ts

@@ -2,7 +2,8 @@ import { Configurator, IModule } from "../../core/command/module-handler";
 import { Context } from "../../core/command/cli-context";
 declare class Module extends IModule {
     register(context: Context, configurator: Configurator): void;
-    private downloadSdk;
     private publishApp;
+    private previewApp;
+    private printToken;
 }
 export = Module;

package/lib/commands/sdk/preview-certificate.d.ts

@@ -0,0 +1,5 @@
+export interface PreviewCertificate {
+    key: string;
+    cert: string;
+}
+export declare function loadOrCreatePreviewCertificate(directory: string, now?: Date): Promise<PreviewCertificate>;

package/lib/commands/sdk/preview-headers.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Copied from `localPreviewHeaders()` in ems-frontend `libs/common/fragments/sandbox/src/lib/policy.ts`,
+ * whose spec fails when the gateway policy drifts. Update both together.
+ */
+export declare const LOCAL_PREVIEW_HEADERS: Readonly<Record<string, string>>;

package/lib/commands/sdk/preview-inline-scripts.d.ts

@@ -0,0 +1,13 @@
+export interface InlineScript {
+    /** `'sha256-<base64>'`, quoted and ready for a CSP source list. */
+    hash: string;
+    /** The first 60 characters of the script text, with whitespace collapsed. */
+    excerpt: string;
+}
+/**
+ * The inline scripts (`<script>` without `src`) of an HTML document, distinct by hash and in document order.
+ * Each hash covers the script text as the browser parses it for CSP (line endings normalized to LF).
+ */
+export declare function inlineScriptHashes(html: string): InlineScript[];
+/** Appends the hashes to the policy's `script-src` directive and leaves every other directive unchanged. */
+export declare function allowInlineScripts(csp: string, hashes: readonly string[]): string;

package/lib/commands/sdk/preview-proxy.d.ts

@@ -0,0 +1,14 @@
+import { PreviewCertificate } from "./preview-certificate";
+export interface PreviewProxyOptions {
+    target: URL;
+    port: number;
+    certificate: PreviewCertificate;
+    headers: Readonly<Record<string, string>>;
+    /** Adds a hash of each inline script in proxied HTML to `script-src`. Published apps block inline scripts. */
+    allowInlineScripts: boolean;
+}
+export interface PreviewProxy {
+    url: string;
+    close(): Promise<void>;
+}
+export declare function startPreviewProxy(options: PreviewProxyOptions): Promise<PreviewProxy>;

package/lib/commands/sdk/sdk-api.d.ts

@@ -1,11 +1,14 @@
 /// <reference types="node" />
 import { Context } from "../../core/command/cli-context";
+export interface SdkPublishOptions {
+    version?: string;
+    message?: string;
+}
 export interface SdkPublishResponse {
     version: string;
 }
 export declare class SdkApi {
     private readonly httpClient;
     constructor(context: Context);
-    downloadSdk(appId: string): Promise<Buffer>;
-    publishApp(appId: string, bundle: Buffer): Promise<SdkPublishResponse>;
+    publishApp(appId: string, bundle: Buffer, options: SdkPublishOptions): Promise<SdkPublishResponse>;
 }

package/lib/commands/sdk/sdk-preview.service.d.ts

@@ -0,0 +1,11 @@
+import { PreviewProxy } from "./preview-proxy";
+export declare class SdkPreviewService {
+    private readonly certificateDirectory;
+    static readonly CERTIFICATE_DIRECTORY: string;
+    constructor(certificateDirectory?: string);
+    preview(target: string, port: string | number, allowInlineScripts?: boolean): Promise<PreviewProxy>;
+    previewUntilStopped(target: string, port: string | number, allowInlineScripts?: boolean): Promise<void>;
+    private waitForShutdownSignal;
+    private parseTarget;
+    private parsePort;
+}

package/lib/commands/sdk/sdk.service.d.ts

@@ -1,10 +1,11 @@
 import { Context } from "../../core/command/cli-context";
 export declare class SdkService {
-    static readonly SDK_DIRECTORY = ".celonis-sdk";
+    private readonly context;
     private readonly sdkApi;
     constructor(context: Context);
-    downloadSdk(appId: string): Promise<void>;
-    publishApp(appId: string, dist: string): Promise<void>;
+    publishApp(appId: string, dist: string, buildVersion?: string, message?: string): Promise<void>;
+    printToken(): Promise<void>;
+    private requireProfile;
     private requireDirectory;
     private compressDirectory;
 }

package/lib/core/http/http-client.d.ts

@@ -17,7 +17,7 @@ export declare class HttpClient {
     getFile(url: string): Promise<any>;
     postFile(url: string, formData: FormData, parameters?: {}): Promise<any>;
     post(url: string, body: any): Promise<any>;
-    postBinary(url: string, body: Buffer, contentType: string): Promise<any>;
+    postBinary(url: string, body: Buffer, contentType: string, parameters?: {}): Promise<any>;
     put(url: string, body: object): Promise<any>;
     delete(url: string): Promise<any>;
     downloadFile(url: string): Promise<any>;

package/lib/core/profile/profile.service.d.ts

@@ -19,6 +19,9 @@ export declare class ProfileService {
     getAllFilesInDirectory(): string[];
     authorizeProfile(profile: Profile): Promise<void>;
     refreshProfile(profile: Profile): Promise<void>;
+    acquireSdkToken(profile: Profile): Promise<string>;
+    private acquireDeviceCodeSdkToken;
+    private acquireClientCredentialsSdkToken;
     private unrefreshableProfile;
     private getProfileEnvVariables;
     private getBaseTeamUrl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celonis/content-cli",
-  "version": "1.18.0",
+  "version": "1.18.1",
   "description": "CLI Tool to help manage content in Celonis Platform",
   "main": "content-cli.js",
   "bin": {
@@ -18,17 +18,18 @@
     "node": ">=18.20.5"
   },
   "dependencies": {
+    "@github/keytar": "7.10.6",
     "adm-zip": "0.6.0",
-    "chalk": "4.1.2",
-    "uuid": "9.0.1",
     "axios": "1.18.0",
+    "chalk": "4.1.2",
     "commander": "13.1.0",
     "form-data": "4.0.6",
-    "openid-client": "5.6.1",
     "hpagent": "1.2.0",
-    "@github/keytar": "7.10.6",
+    "openid-client": "5.6.1",
+    "selfsigned": "5.5.0",
     "semver": "7.6.3",
     "simple-git": "3.36.0",
+    "uuid": "9.0.1",
     "valid-url": "1.0.9",
     "winston": "3.17.0",
     "yaml": "2.8.3"