@celonis/content-cli 1.6.0 → 1.8.0

package/README.md

@@ -9,10 +9,11 @@ teams and execute commands in a profile's context.
 
 1. [Getting Started](#getting-started)
 2. [About the Project](#about-the-project)
-3. [Building the Project](#building-the-project)
-4. [Release Process](#release-process)
-5. [Contributing](#contributing)
-6. [License](#license)
+3. [Building the Project](#building-and-using-the-project-locally)
+4. [Troubleshooting](#troubleshooting)
+5. [Release Process](#release-process)
+6. [Contributing](#contributing)
+7. [License](#license)
 
 ## Getting Started
 
@@ -71,8 +72,8 @@ Example, if you want to push a package from zipped file "interesting-package.zip
 content-cli push package -p my-dev-profile --spaceKey my-cool-space -f interesting-package.zip
 ```
 
-A more comprehensive list of Content CLI capabilities can be found on the following 
-[documentation](https://github.com/celonis/content-cli/blob/master/DOCUMENTATION.md). 
+A comprehensive list of Content CLI capabilities can be found in the 
+[documentation](https://github.com/celonis/content-cli/tree/main/docs).
 
 You can still explore the full capabilities of Content CLI and the list of options for the different commands 
 by using the `-h` option in your command.
@@ -85,16 +86,65 @@ content-cli pull package -h
 ## Building and Using the Project locally 
 
 This tool is tightly connected with the Celonis Platform and all capabilities require to have access to a Celonis Platform Team. 
-After cloning the project, the next step is to install the project dependencies. We use `yarn` as our package manager, 
-so running `yarn install` on the project root folder should install all the necessary dependencies. After installing 
-the project dependencies, you can run `yarn build` to build the project artifact. To use the built artifact, you can 
-run `node content-cli.js` in the generated `dist` folder.
 
-If we want to use a specific local build of the tool globally, we can do this by:
-- Move to the root directory of the project.
-- Execute `cd dist`, to move to the `dist` directory.
-- Execute the `npm link` command. 
-This will create a symbolic link in the global `node_modules` directory, allowing you to run the CLI from anywhere on your machine.
+### Prerequisites
+
+- **Node.js** `>=18.20.5` (LTS recommended). Check with `node -v`.
+- **yarn** package manager. Install with `npm install -g yarn` if not already available.
+
+### Build steps
+
+```bash
+git clone https://github.com/celonis/content-cli.git
+cd content-cli
+yarn install
+yarn build
+```
+
+The build compiles TypeScript into the `dist/` folder and copies `package.json` there.
+
+### Running the built CLI
+
+You can run the built artifact directly from the `dist` folder:
+
+```bash
+node dist/content-cli.js -h
+```
+
+### Installing the local build globally
+
+To use your local build as the global `content-cli` command:
+
+```bash
+cd dist
+npm link
+```
+
+This creates a symbolic link in the global `node_modules` directory, allowing you to run `content-cli` from anywhere on your machine. To unlink later, run `npm unlink -g @celonis/content-cli`.
+
+## Troubleshooting
+
+### `Error: Cannot find module '...'`
+
+If you see a `Cannot find module` error when running `content-cli`, dependencies may not be installed correctly:
+
+- **Global install:** Try updating to the latest version: `npm install -g @celonis/content-cli@latest`.
+- **Local development:** Run `yarn install` from the project root before building.
+
+### `content-cli: command not found`
+
+- Ensure Node.js is installed and on your `PATH` (`node -v`).
+- If installed via `npm install -g`, check that npm's global `bin` directory is in your `PATH`. You can find it with `npm bin -g`.
+- If using `npm link`, make sure you ran it from the `dist/` directory (not the project root).
+
+### Node.js version errors
+
+Content CLI requires Node.js `>=18.20.5`. If you see compatibility errors, upgrade your Node.js installation. We recommend using [nvm](https://github.com/nvm-sh/nvm) to manage Node.js versions:
+
+```bash
+nvm install --lts
+nvm use --lts
+```
 
 ## Release Process
 
@@ -109,14 +159,14 @@ npm i -g @celonis/content-cli
 ## Contributing
 
 We encourage public contributions! Please check 
-[CONTRIBUTING.md](https://github.com/celonis/content-cli/blob/master/CONTRIBUTING.md) for details on our 
+[CONTRIBUTING.md](https://github.com/celonis/content-cli/blob/main/CONTRIBUTING.md) for details on our 
 code of conduct.
 
-For details on command development, refer to the [How to Add a Command](https://github.com/celonis/content-cli/blob/master/docs/how-to-add-command.md) guide.
+For details on command development, refer to the [How to Add a Command](https://github.com/celonis/content-cli/blob/main/docs/how-to-add-command.md) guide.
 
 ## License
 
 Copyright (c) 2021 Celonis SE
 
 This project is licensed under the MIT License - 
-see [LICENSE](https://github.com/celonis/content-cli/blob/master/LICENSE) file for details.
+see [LICENSE](https://github.com/celonis/content-cli/blob/main/LICENSE) file for details.

package/commands/configuration-management/api/package-version-api.js

@@ -33,6 +33,15 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 });
             });
         }
+        createVersion(packageKey, request) {
+            return __awaiter(this, void 0, void 0, function* () {
+                return this.httpClient()
+                    .post(`/pacman/api/core/packages/${packageKey}/versions`, request)
+                    .catch(e => {
+                    throw new logger_1.FatalError(`Problem creating version for package '${packageKey}': ${e}`);
+                });
+            });
+        }
     }
     exports.PackageVersionApi = PackageVersionApi;
 });

package/commands/configuration-management/batch-import-export.service.js

@@ -141,7 +141,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 const variablesManifests = this.parseEntryData(configs, batch_export_import_constants_1.BatchExportImportConstants.VARIABLES_FILE_NAME);
                 configs = yield this.studioService.mapSpaces(configs, studioManifests);
                 const existingStudioPackages = yield this.studioPackageApi.findAllPackages();
-                const formData = this.buildBodyForImport(configs, variablesManifests);
+                const formData = this.buildBodyForImport(configs, sourceToBeImported, variablesManifests);
                 const postPackageImportData = yield this.batchImportExportApi.importPackages(formData, overwrite);
                 yield this.studioService.processImportedPackages(configs, existingStudioPackages, studioManifests);
                 if (gitBranch) {
@@ -196,8 +196,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             file_service_1.fileService.writeToFileWithGivenName(JSON.stringify(packagesMetadata), filename);
             logger_1.logger.info(file_service_1.FileService.fileDownloadedMessage + filename);
         }
-        buildBodyForImport(configs, variablesManifests) {
+        buildBodyForImport(configs, sourcePath, variablesManifests) {
             const formData = new FormData();
+            this.assertUncompressedSizeWithinLimit(configs, sourcePath);
             const readableStream = this.getReadableStream(configs);
             formData.append("file", readableStream, { filename: "configs.zip" });
             if (variablesManifests) {
@@ -207,6 +208,13 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             }
             return formData;
         }
+        assertUncompressedSizeWithinLimit(configs, sourcePath) {
+            const MAX_ZIP_SIZE = 4 * 1024 * 1024 * 1024;
+            const totalUncompressedBytes = configs.getEntries().reduce((sum, entry) => sum + entry.header.size, 0);
+            if (totalUncompressedBytes > MAX_ZIP_SIZE) {
+                throw new Error(`Failed to handle zip file "${sourcePath}": uncompressed size ${(totalUncompressedBytes / (Math.pow(1024, 3))).toFixed(2)} GB exceeds the 4 GB limit.`);
+            }
+        }
         getReadableStream(configs) {
             return new stream_1.Readable({
                 read() {

package/commands/configuration-management/interfaces/package-version.interfaces.js

@@ -9,4 +9,10 @@
 })(function (require, exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
+    exports.VersionBumpOption = void 0;
+    var VersionBumpOption;
+    (function (VersionBumpOption) {
+        VersionBumpOption["NONE"] = "NONE";
+        VersionBumpOption["PATCH"] = "PATCH";
+    })(VersionBumpOption || (exports.VersionBumpOption = VersionBumpOption = {}));
 });

package/commands/configuration-management/module.js

@@ -79,6 +79,15 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 .requiredOption("--packageVersion <packageVersion>", "Version of the package. Can be a specific version or \"LATEST\" keyword, which will return the most recently created version.")
                 .option("--json", "Return the response as a JSON file")
                 .action(this.getPackageVersion);
+            configVersionCommand.command("create")
+                .description("Create a new version for a package")
+                .requiredOption("--packageKey <packageKey>", "Identifier of the package")
+                .option("--packageVersion <packageVersion>", "Version string (required if versionBumpOption is NONE)")
+                .option("--versionBumpOption <versionBumpOption>", "Version bump option: NONE or PATCH", "NONE")
+                .option("--summaryOfChanges <summaryOfChanges>", "Summary of changes for this version")
+                .option("--nodeFilterKeys <nodeFilterKeys...>", "Node keys to include in the version. If omitted, all nodes of the package are included.")
+                .option("--json", "Return the response as a JSON file")
+                .action(this.createPackageVersion);
             const variablesCommand = configCommand.command("variables")
                 .description("Commands related to variable configs");
             variablesCommand.command("list")
@@ -162,6 +171,19 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 yield new package_version_command_service_1.PackageVersionCommandService(context).getPackageVersion(options.packageKey, options.packageVersion, options.json);
             });
         }
+        createPackageVersion(context, command, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const hasExplicitVersion = !!options.packageVersion;
+                const hasVersionBump = options.versionBumpOption && options.versionBumpOption !== "NONE";
+                if (hasExplicitVersion && hasVersionBump) {
+                    throw new Error("Please provide either --packageVersion or --versionBumpOption, but not both.");
+                }
+                if (!hasExplicitVersion && !hasVersionBump) {
+                    throw new Error("Please provide either --packageVersion or --versionBumpOption PATCH.");
+                }
+                yield new package_version_command_service_1.PackageVersionCommandService(context).createPackageVersion(options.packageKey, options.packageVersion, options.versionBumpOption, options.summaryOfChanges, options.nodeFilterKeys, options.json);
+            });
+        }
         batchImportPackages(context, command, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 if (options.gitProfile && !options.gitBranch) {

package/commands/configuration-management/package-version-command.service.js

@@ -29,6 +29,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 yield this.packageVersionService.findPackageVersion(packageKey, version, jsonResponse);
             });
         }
+        createPackageVersion(packageKey, version, versionBumpOption, summaryOfChanges, nodeFilterKeys, jsonResponse) {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield this.packageVersionService.createPackageVersion(packageKey, version, versionBumpOption, summaryOfChanges, nodeFilterKeys, jsonResponse);
+            });
+        }
     }
     exports.PackageVersionCommandService = PackageVersionCommandService;
 });

package/commands/configuration-management/package-version.service.js

@@ -40,6 +40,30 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 }
             });
         }
+        createPackageVersion(packageKey, version, versionBumpOption, summaryOfChanges, nodeFilterKeys, jsonResponse) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const request = {
+                    version: version,
+                    versionBumpOption: versionBumpOption,
+                    summaryOfChanges: summaryOfChanges,
+                };
+                if (nodeFilterKeys && nodeFilterKeys.length > 0) {
+                    request.nodeFilter = {
+                        filterType: "INCLUDE",
+                        keys: nodeFilterKeys,
+                    };
+                }
+                const created = yield this.packageVersionApi.createVersion(packageKey, request);
+                if (jsonResponse) {
+                    const filename = (0, uuid_1.v4)() + ".json";
+                    file_service_1.fileService.writeToFileWithGivenName(JSON.stringify(created, null, 2), filename);
+                    logger_1.logger.info(file_service_1.FileService.fileDownloadedMessage + filename);
+                }
+                else {
+                    this.printPackageVersionCreatedTransport(created);
+                }
+            });
+        }
         printPackageVersionTransport(packageVersionTransport) {
             logger_1.logger.info(`Package Key: ${packageVersionTransport.packageKey}`);
             logger_1.logger.info(`Version: ${packageVersionTransport.version}`);
@@ -50,6 +74,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             logger_1.logger.info(`Deployed: ${packageVersionTransport.deployed}`);
             logger_1.logger.info(`Published By: ${packageVersionTransport.publishedBy}`);
         }
+        printPackageVersionCreatedTransport(transport) {
+            logger_1.logger.info(`Successfully created version ${transport.version} for package ${transport.packageKey}`);
+            logger_1.logger.info(`Version: ${transport.version}`);
+            logger_1.logger.info(`Package Key: ${transport.packageKey}`);
+            logger_1.logger.info(`Summary of Changes: ${transport.summaryOfChanges}`);
+            logger_1.logger.info(`Creation Date: ${new Date(transport.creationDate).toISOString()}`);
+            logger_1.logger.info(`Created By: ${transport.createdBy}`);
+        }
     }
     exports.PackageVersionService = PackageVersionService;
 });

package/commands/profile/module.js

@@ -37,6 +37,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             command.command("default <profile>")
                 .description("Command to set a profile as default")
                 .action(this.defaultProfile);
+            command.command("secure <profile>")
+                .description("Migrate a profile's secrets to secure system keychain storage")
+                .action(this.secureProfile);
         }
         defaultProfile(context, command) {
             return __awaiter(this, void 0, void 0, function* () {
@@ -55,6 +58,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 yield new profile_command_service_1.ProfileCommandService().listProfiles();
             });
         }
+        secureProfile(context, command) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const profile = command.args[0];
+                yield new profile_command_service_1.ProfileCommandService().secureProfile(profile);
+            });
+        }
     }
     return Module;
 });

package/commands/profile/profile-command.service.js

@@ -55,7 +55,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                     }
                     profile.authenticationType = yield profile_validator_1.ProfileValidator.validateProfile(profile);
                     yield this.profileService.authorizeProfile(profile);
-                    this.profileService.storeProfile(profile);
+                    yield this.profileService.storeProfile(profile);
                     if (setAsDefault) {
                         yield this.makeDefaultProfile(profile.name);
                     }
@@ -89,6 +89,23 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 logger_1.logger.info("Default profile: " + profile);
             });
         }
+        secureProfile(profileName) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const profile = yield this.profileService.findProfile(profileName);
+                if (profile.secretsStoredSecurely) {
+                    logger_1.logger.info(`Profile "${profileName}" is already using secure storage.`);
+                    return;
+                }
+                yield this.profileService.storeProfile(profile);
+                const updatedProfile = yield this.profileService.findProfile(profileName);
+                if (updatedProfile.secretsStoredSecurely) {
+                    logger_1.logger.info(`Profile "${profileName}" secrets have been migrated to secure storage.`);
+                }
+                else {
+                    logger_1.logger.warn(`Failed to migrate profile "${profileName}" to secure storage. Secrets remain in plaintext.`);
+                }
+            });
+        }
     }
     exports.ProfileCommandService = ProfileCommandService;
 });

package/core/profile/profile.service.js

@@ -13,12 +13,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         if (v !== undefined) module.exports = v;
     }
     else if (typeof define === "function" && define.amd) {
-        define(["require", "exports", "./profile.interface", "./profile.validator", "path", "fs", "../utils/logger", "openid-client", "axios", "os"], factory);
+        define(["require", "exports", "./profile.interface", "./profile.validator", "path", "fs", "../utils/logger", "openid-client", "axios", "os", "./secret-storage.service"], factory);
     }
 })(function (require, exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.profileService = exports.ProfileService = void 0;
+    exports.ProfileService = void 0;
     const profile_interface_1 = require("./profile.interface");
     const profile_validator_1 = require("./profile.validator");
     const path = require("path");
@@ -27,6 +27,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     const openid_client_1 = require("openid-client");
     const axios_1 = require("axios");
     const os = require("os");
+    const secret_storage_service_1 = require("./secret-storage.service");
     const homedir = os.homedir();
     // use 5 seconds buffer to avoid rare cases when accessToken is just about to expire before the command is sent
     const expiryBuffer = 5000;
@@ -38,6 +39,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         constructor() {
             this.profileContainerPath = path.resolve(homedir, ".celonis-content-cli-profiles");
             this.configContainer = path.resolve(this.profileContainerPath, "config.json");
+            this.secureSecretStorageService = new secret_storage_service_1.SecureSecretStorageService();
         }
         findProfile(profileName) {
             return __awaiter(this, void 0, void 0, function* () {
@@ -46,8 +48,28 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                         if (!this.checkIfMissingProfile(profileName)) {
                             const file = fs.readFileSync(path.resolve(this.profileContainerPath, this.constructProfileFileName(profileName)), { encoding: "utf-8" });
                             const profile = JSON.parse(file);
-                            this.refreshProfile(profile)
-                                .then(() => resolve(profile));
+                            if (profile.secretsStoredSecurely) {
+                                this.secureSecretStorageService.getSecrets(profileName)
+                                    .then(profileSecureSecrets => {
+                                    if (profileSecureSecrets) {
+                                        profile.apiToken = profileSecureSecrets.apiToken;
+                                        profile.refreshToken = profileSecureSecrets.refreshToken;
+                                        profile.clientSecret = profileSecureSecrets.clientSecret;
+                                        this.refreshProfile(profile)
+                                            .then(() => resolve(profile))
+                                            .catch(() => reject(`The profile ${profileName} couldn't be resolved.`));
+                                    }
+                                    else {
+                                        reject("Failed to read secrets from system keychain.");
+                                    }
+                                })
+                                    .catch(() => reject(`The profile ${profileName} couldn't be resolved.`));
+                            }
+                            else {
+                                this.refreshProfile(profile)
+                                    .then(() => resolve(profile))
+                                    .catch(() => reject(`The profile ${profileName} couldn't be resolved.`));
+                            }
                         }
                         else if (process.env.TEAM_URL && process.env.API_TOKEN) {
                             resolve(this.buildProfileFromEnvVariables());
@@ -92,11 +114,24 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             }
         }
         storeProfile(profile) {
-            this.createProfileContainerIfNotExists();
-            const newProfileFileName = this.constructProfileFileName(profile.name);
-            profile.team = this.getBaseTeamUrl(profile.team);
-            fs.writeFileSync(path.resolve(this.profileContainerPath, newProfileFileName), JSON.stringify(profile), {
-                encoding: "utf-8",
+            return __awaiter(this, void 0, void 0, function* () {
+                this.createProfileContainerIfNotExists();
+                const newProfileFileName = this.constructProfileFileName(profile.name);
+                profile.team = this.getBaseTeamUrl(profile.team);
+                const secretsStoredInKeychain = yield this.secureSecretStorageService.storeSecrets(profile);
+                const profileToStore = Object.assign({}, profile);
+                if (secretsStoredInKeychain) {
+                    profileToStore.secretsStoredSecurely = true;
+                    delete profileToStore.apiToken;
+                    delete profileToStore.refreshToken;
+                    delete profileToStore.clientSecret;
+                }
+                else {
+                    profileToStore.secretsStoredSecurely = false;
+                }
+                fs.writeFileSync(path.resolve(this.profileContainerPath, newProfileFileName), JSON.stringify(profileToStore), {
+                    encoding: "utf-8",
+                });
             });
         }
         buildProfileFromEnvVariables() {
@@ -263,7 +298,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                         logger_1.logger.error(new logger_1.FatalError("The profile cannot be refreshed. Please retry or recreate profile."));
                     }
                 }
-                this.storeProfile(profile);
+                yield this.storeProfile(profile);
             });
         }
         getProfileEnvVariables() {
@@ -394,5 +429,4 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         }
     }
     exports.ProfileService = ProfileService;
-    exports.profileService = new ProfileService();
 });

package/core/profile/secret-storage.service.js

@@ -0,0 +1,115 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "../utils/logger"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SecureSecretStorageService = void 0;
+    const logger_1 = require("../utils/logger");
+    var PROFILE_SECRET_TYPE;
+    (function (PROFILE_SECRET_TYPE) {
+        PROFILE_SECRET_TYPE["API_TOKEN"] = "apiToken";
+        PROFILE_SECRET_TYPE["CLIENT_SECRET"] = "clientSecret";
+        PROFILE_SECRET_TYPE["REFRESH_TOKEN"] = "refreshToken";
+    })(PROFILE_SECRET_TYPE || (PROFILE_SECRET_TYPE = {}));
+    const CONTENT_CLI_SERVICE_NAME = "celonis-content-cli";
+    // Lazy load keytar to handle cases where native dependencies are not available
+    let keytar = null;
+    let keytarLoadError = null;
+    function getKeytar() {
+        if (keytar !== null) {
+            return keytar;
+        }
+        if (keytarLoadError !== null) {
+            return null;
+        }
+        try {
+            keytar = require("@github/keytar");
+            return keytar;
+        }
+        catch (error) {
+            keytarLoadError = error;
+            return null;
+        }
+    }
+    class SecureSecretStorageService {
+        storeSecrets(profile) {
+            return __awaiter(this, void 0, void 0, function* () {
+                let secretsStoredInKeychain = true;
+                const secretEntries = [
+                    { type: PROFILE_SECRET_TYPE.API_TOKEN, value: profile.apiToken },
+                    { type: PROFILE_SECRET_TYPE.CLIENT_SECRET, value: profile.clientSecret },
+                    { type: PROFILE_SECRET_TYPE.REFRESH_TOKEN, value: profile.refreshToken },
+                ];
+                for (const secretEntry of secretEntries) {
+                    if (secretEntry.value) {
+                        const stored = yield this.storeSecret(this.getSecretServiceName(profile.name), secretEntry.type, secretEntry.value);
+                        if (!stored) {
+                            secretsStoredInKeychain = false;
+                        }
+                    }
+                }
+                if (!secretsStoredInKeychain) {
+                    logger_1.logger.warn("⚠️ Failed to store secrets securely. They will be stored in plain text file.");
+                    return false;
+                }
+                return true;
+            });
+        }
+        getSecrets(profileName) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const keytarModule = getKeytar();
+                if (!keytarModule) {
+                    return undefined;
+                }
+                try {
+                    const secrets = yield keytarModule.findCredentials(this.getSecretServiceName(profileName));
+                    if (!secrets.length) {
+                        return undefined;
+                    }
+                    const profileSecrets = {};
+                    for (const secret of secrets) {
+                        profileSecrets[secret.account] = secret.password;
+                    }
+                    return profileSecrets;
+                }
+                catch (err) {
+                    return undefined;
+                }
+            });
+        }
+        getSecretServiceName(profileName) {
+            return `${CONTENT_CLI_SERVICE_NAME}:${profileName}`;
+        }
+        storeSecret(service, account, secret) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const keytarModule = getKeytar();
+                if (!keytarModule) {
+                    return false;
+                }
+                try {
+                    yield keytarModule.setPassword(service, account, secret);
+                    return true;
+                }
+                catch (err) {
+                    return false;
+                }
+            });
+        }
+    }
+    exports.SecureSecretStorageService = SecureSecretStorageService;
+});

package/lib/commands/configuration-management/api/package-version-api.d.ts

@@ -1,7 +1,8 @@
 import { Context } from "../../../core/command/cli-context";
-import { PackageVersionTransport } from "../interfaces/package-version.interfaces";
+import { PackageVersionCreatedTransport, PackageVersionTransport, SavePackageVersionTransport } from "../interfaces/package-version.interfaces";
 export declare class PackageVersionApi {
     private httpClient;
     constructor(context: Context);
     findOne(packageKey: string, version: string): Promise<PackageVersionTransport>;
+    createVersion(packageKey: string, request: SavePackageVersionTransport): Promise<PackageVersionCreatedTransport>;
 }

package/lib/commands/configuration-management/batch-import-export.service.d.ts

@@ -18,6 +18,7 @@ export declare class BatchImportExportService {
     private getVersionedVariablesForPackagesWithKeys;
     private exportListOfPackagesMetadata;
     private buildBodyForImport;
+    private assertUncompressedSizeWithinLimit;
     private getReadableStream;
     private parseEntryData;
     private downloadZip;

package/lib/commands/configuration-management/interfaces/package-version.interfaces.d.ts

@@ -8,3 +8,24 @@ export interface PackageVersionTransport {
     deployed: boolean;
     publishedBy: string;
 }
+export interface SavePackageVersionTransport {
+    version?: string;
+    versionBumpOption?: VersionBumpOption;
+    summaryOfChanges?: string;
+    nodeFilter?: NodeFilterTransport;
+}
+export declare enum VersionBumpOption {
+    NONE = "NONE",
+    PATCH = "PATCH"
+}
+export interface NodeFilterTransport {
+    filterType: "INCLUDE";
+    keys: string[];
+}
+export interface PackageVersionCreatedTransport {
+    packageKey: string;
+    version: string;
+    summaryOfChanges: string;
+    creationDate: string;
+    createdBy: string;
+}

package/lib/commands/configuration-management/module.d.ts

@@ -9,6 +9,7 @@ declare class Module extends IModule {
     private batchExportPackages;
     private batchExportPackagesMetadata;
     private getPackageVersion;
+    private createPackageVersion;
     private batchImportPackages;
     private diffPackages;
     private listVariables;

package/lib/commands/configuration-management/package-version-command.service.d.ts

@@ -3,4 +3,5 @@ export declare class PackageVersionCommandService {
     private packageVersionService;
     constructor(context: Context);
     getPackageVersion(packageKey: string, version: string, jsonResponse: boolean): Promise<void>;
+    createPackageVersion(packageKey: string, version: string | undefined, versionBumpOption: string, summaryOfChanges: string | undefined, nodeFilterKeys: string[] | undefined, jsonResponse: boolean): Promise<void>;
 }

package/lib/commands/configuration-management/package-version.service.d.ts

@@ -3,5 +3,7 @@ export declare class PackageVersionService {
     private packageVersionApi;
     constructor(context: Context);
     findPackageVersion(packageKey: string, version: string, jsonResponse: boolean): Promise<void>;
+    createPackageVersion(packageKey: string, version: string | undefined, versionBumpOption: string, summaryOfChanges: string | undefined, nodeFilterKeys: string[] | undefined, jsonResponse: boolean): Promise<void>;
     private printPackageVersionTransport;
+    private printPackageVersionCreatedTransport;
 }

package/lib/commands/profile/module.d.ts

@@ -8,5 +8,6 @@ declare class Module extends IModule {
     private defaultProfile;
     private createProfile;
     private listProfiles;
+    private secureProfile;
 }
 export = Module;

package/lib/commands/profile/profile-command.service.d.ts

@@ -3,4 +3,5 @@ export declare class ProfileCommandService {
     createProfile(setAsDefault: boolean): Promise<void>;
     listProfiles(): Promise<void>;
     makeDefaultProfile(profile: string): Promise<void>;
+    secureProfile(profileName: string): Promise<void>;
 }

package/lib/core/profile/profile.interface.d.ts

@@ -1,14 +1,17 @@
-export interface Profile {
+export interface ProfileSecrets {
+    apiToken: string;
+    clientSecret?: string;
+    refreshToken?: string;
+    secretsStoredSecurely?: boolean;
+}
+export interface Profile extends ProfileSecrets {
     name: string;
     team: string;
     type: ProfileType;
-    apiToken: string;
     authenticationType: AuthenticationType;
     clientId?: string;
-    clientSecret?: string;
     scopes?: string[];
     clientAuthenticationMethod?: ClientAuthenticationMethod;
-    refreshToken?: string;
     expiresAt?: number;
 }
 export type AuthenticationType = "Bearer" | "AppKey";

package/lib/core/profile/profile.service.d.ts

@@ -5,10 +5,11 @@ export interface Config {
 export declare class ProfileService {
     private profileContainerPath;
     private configContainer;
+    private secureSecretStorageService;
     findProfile(profileName: string): Promise<Profile>;
     makeDefaultProfile(profileName: string): Promise<Profile>;
     getDefaultProfile(): string;
-    storeProfile(profile: Profile): void;
+    storeProfile(profile: Profile): Promise<void>;
     private buildProfileFromEnvVariables;
     private storeConfig;
     private createProfileContainerIfNotExists;
@@ -40,4 +41,3 @@ export declare class ProfileService {
      */
     private extractScopesFromTokenSet;
 }
-export declare const profileService: ProfileService;

package/lib/core/profile/secret-storage.service.d.ts

@@ -0,0 +1,7 @@
+import { Profile, ProfileSecrets } from "./profile.interface";
+export declare class SecureSecretStorageService {
+    storeSecrets(profile: Profile): Promise<boolean>;
+    getSecrets(profileName: string): Promise<ProfileSecrets | undefined>;
+    private getSecretServiceName;
+    private storeSecret;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celonis/content-cli",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "CLI Tool to help manage content in Celonis Platform",
   "main": "content-cli.js",
   "bin": {
@@ -19,14 +19,16 @@
   },
   "dependencies": {
     "adm-zip": "0.5.14",
+    "chalk": "4.1.2",
     "uuid": "9.0.1",
     "axios": "1.13.5",
     "commander": "13.1.0",
     "form-data": "4.0.4",
     "openid-client": "5.6.1",
     "hpagent": "1.2.0",
+    "@github/keytar": "7.10.6",
     "semver": "7.6.3",
-    "simple-git": "3.28.0",
+    "simple-git": "3.32.3",
     "valid-url": "1.0.9",
     "winston": "3.17.0",
     "yaml": "2.7.0"