@celonis/content-cli 1.7.0 → 1.8.1

package/README.md

@@ -72,8 +72,8 @@ Example, if you want to push a package from zipped file "interesting-package.zip
 content-cli push package -p my-dev-profile --spaceKey my-cool-space -f interesting-package.zip
 ```
 
-A more comprehensive list of Content CLI capabilities can be found on the following 
-[documentation](https://github.com/celonis/content-cli/blob/master/DOCUMENTATION.md). 
+A comprehensive list of Content CLI capabilities can be found in the 
+[documentation](https://github.com/celonis/content-cli/tree/main/docs).
 
 You can still explore the full capabilities of Content CLI and the list of options for the different commands 
 by using the `-h` option in your command.
@@ -159,14 +159,14 @@ npm i -g @celonis/content-cli
 ## Contributing
 
 We encourage public contributions! Please check 
-[CONTRIBUTING.md](https://github.com/celonis/content-cli/blob/master/CONTRIBUTING.md) for details on our 
+[CONTRIBUTING.md](https://github.com/celonis/content-cli/blob/main/CONTRIBUTING.md) for details on our 
 code of conduct.
 
-For details on command development, refer to the [How to Add a Command](https://github.com/celonis/content-cli/blob/master/docs/how-to-add-command.md) guide.
+For details on command development, refer to the [How to Add a Command](https://github.com/celonis/content-cli/blob/main/docs/how-to-add-command.md) guide.
 
 ## License
 
 Copyright (c) 2021 Celonis SE
 
 This project is licensed under the MIT License - 
-see [LICENSE](https://github.com/celonis/content-cli/blob/master/LICENSE) file for details.
+see [LICENSE](https://github.com/celonis/content-cli/blob/main/LICENSE) file for details.

package/commands/configuration-management/api/package-version-api.js

@@ -33,6 +33,15 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 });
             });
         }
+        createVersion(packageKey, request) {
+            return __awaiter(this, void 0, void 0, function* () {
+                return this.httpClient()
+                    .post(`/pacman/api/core/packages/${packageKey}/versions`, request)
+                    .catch(e => {
+                    throw new logger_1.FatalError(`Problem creating version for package '${packageKey}': ${e}`);
+                });
+            });
+        }
     }
     exports.PackageVersionApi = PackageVersionApi;
 });

package/commands/configuration-management/api/staging-package-variables-api.js

@@ -0,0 +1,39 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "../../../core/utils/logger"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.StagingPackageVariablesApi = void 0;
+    const logger_1 = require("../../../core/utils/logger");
+    class StagingPackageVariablesApi {
+        constructor(context) {
+            this.httpClient = () => context.httpClient;
+        }
+        findAllByPackageKeys(packageKeys) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const path = `/pacman/api/core/staging/packages/variables/by-package-keys`;
+                return yield this.httpClient()
+                    .post(path, packageKeys)
+                    .catch(e => {
+                    throw new logger_1.FatalError(`Problem listing staging variables for packages: ${e}`);
+                });
+            });
+        }
+    }
+    exports.StagingPackageVariablesApi = StagingPackageVariablesApi;
+});

package/commands/configuration-management/config-command.service.js

@@ -46,9 +46,17 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 }
             });
         }
-        listVariables(jsonResponse, keysByVersion, keysByVersionFile) {
+        listVariables(jsonResponse, keysByVersion, keysByVersionFile, packageKeys) {
             return __awaiter(this, void 0, void 0, function* () {
-                if (jsonResponse) {
+                if (packageKeys.length > 0) {
+                    if (jsonResponse) {
+                        yield this.variableService.exportStagingVariables(packageKeys);
+                    }
+                    else {
+                        yield this.variableService.listStagingVariables(packageKeys);
+                    }
+                }
+                else if (jsonResponse) {
                     yield this.variableService.exportVariables(keysByVersion, keysByVersionFile);
                 }
                 else {

package/commands/configuration-management/interfaces/package-version.interfaces.js

@@ -9,4 +9,10 @@
 })(function (require, exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
+    exports.VersionBumpOption = void 0;
+    var VersionBumpOption;
+    (function (VersionBumpOption) {
+        VersionBumpOption["NONE"] = "NONE";
+        VersionBumpOption["PATCH"] = "PATCH";
+    })(VersionBumpOption || (exports.VersionBumpOption = VersionBumpOption = {}));
 });

package/commands/configuration-management/module.js

@@ -79,12 +79,22 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 .requiredOption("--packageVersion <packageVersion>", "Version of the package. Can be a specific version or \"LATEST\" keyword, which will return the most recently created version.")
                 .option("--json", "Return the response as a JSON file")
                 .action(this.getPackageVersion);
+            configVersionCommand.command("create")
+                .description("Create a new version for a package")
+                .requiredOption("--packageKey <packageKey>", "Identifier of the package")
+                .option("--packageVersion <packageVersion>", "Version string (required if versionBumpOption is NONE)")
+                .option("--versionBumpOption <versionBumpOption>", "Version bump option: NONE or PATCH", "NONE")
+                .option("--summaryOfChanges <summaryOfChanges>", "Summary of changes for this version")
+                .option("--nodeFilterKeys <nodeFilterKeys...>", "Node keys to include in the version. If omitted, all nodes of the package are included.")
+                .option("--json", "Return the response as a JSON file")
+                .action(this.createPackageVersion);
             const variablesCommand = configCommand.command("variables")
                 .description("Commands related to variable configs");
             variablesCommand.command("list")
-                .description("Command to list versioned variables of packages")
+                .description("List package variables: use --packageKeys for unversioned, or --keysByVersion / --keysByVersionFile for versioned packages")
                 .option("--json", "Return response as json type", "")
-                .option("--keysByVersion <keysByVersion...>", "Mapping of package keys and versions", "")
+                .option("--packageKeys <packageKeys...>", "Package keys (unversioned variables only; mutually exclusive with versioned options)", [])
+                .option("--keysByVersion <keysByVersion...>", "Mapping of package keys and versions", [])
                 .option("--keysByVersionFile <keysByVersionFile>", "Package keys by version mappings file path.", "")
                 .action(this.listVariables);
             const nodesCommand = configCommand.command("nodes")
@@ -162,6 +172,19 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 yield new package_version_command_service_1.PackageVersionCommandService(context).getPackageVersion(options.packageKey, options.packageVersion, options.json);
             });
         }
+        createPackageVersion(context, command, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const hasExplicitVersion = !!options.packageVersion;
+                const hasVersionBump = options.versionBumpOption && options.versionBumpOption !== "NONE";
+                if (hasExplicitVersion && hasVersionBump) {
+                    throw new Error("Please provide either --packageVersion or --versionBumpOption, but not both.");
+                }
+                if (!hasExplicitVersion && !hasVersionBump) {
+                    throw new Error("Please provide either --packageVersion or --versionBumpOption PATCH.");
+                }
+                yield new package_version_command_service_1.PackageVersionCommandService(context).createPackageVersion(options.packageKey, options.packageVersion, options.versionBumpOption, options.summaryOfChanges, options.nodeFilterKeys, options.json);
+            });
+        }
         batchImportPackages(context, command, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 if (options.gitProfile && !options.gitBranch) {
@@ -177,7 +200,15 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         }
         listVariables(context, command, options) {
             return __awaiter(this, void 0, void 0, function* () {
-                yield new config_command_service_1.ConfigCommandService(context).listVariables(options.json, options.keysByVersion, options.keysByVersionFile);
+                const hasStagingKeys = options.packageKeys.length > 0;
+                const hasVersioned = options.keysByVersion.length > 0 || options.keysByVersionFile !== "";
+                if (hasStagingKeys && hasVersioned) {
+                    throw new Error("Please provide either --packageKeys or --keysByVersion/--keysByVersionFile, but not both.");
+                }
+                if (!hasStagingKeys && !hasVersioned) {
+                    throw new Error("Please provide --packageKeys for staging, or --keysByVersion / --keysByVersionFile for versioned packages.");
+                }
+                yield new config_command_service_1.ConfigCommandService(context).listVariables(options.json, options.keysByVersion, options.keysByVersionFile, options.packageKeys);
             });
         }
         listAssignments(context, command, options) {

package/commands/configuration-management/package-version-command.service.js

@@ -29,6 +29,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 yield this.packageVersionService.findPackageVersion(packageKey, version, jsonResponse);
             });
         }
+        createPackageVersion(packageKey, version, versionBumpOption, summaryOfChanges, nodeFilterKeys, jsonResponse) {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield this.packageVersionService.createPackageVersion(packageKey, version, versionBumpOption, summaryOfChanges, nodeFilterKeys, jsonResponse);
+            });
+        }
     }
     exports.PackageVersionCommandService = PackageVersionCommandService;
 });

package/commands/configuration-management/package-version.service.js

@@ -40,6 +40,30 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 }
             });
         }
+        createPackageVersion(packageKey, version, versionBumpOption, summaryOfChanges, nodeFilterKeys, jsonResponse) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const request = {
+                    version: version,
+                    versionBumpOption: versionBumpOption,
+                    summaryOfChanges: summaryOfChanges,
+                };
+                if (nodeFilterKeys && nodeFilterKeys.length > 0) {
+                    request.nodeFilter = {
+                        filterType: "INCLUDE",
+                        keys: nodeFilterKeys,
+                    };
+                }
+                const created = yield this.packageVersionApi.createVersion(packageKey, request);
+                if (jsonResponse) {
+                    const filename = (0, uuid_1.v4)() + ".json";
+                    file_service_1.fileService.writeToFileWithGivenName(JSON.stringify(created, null, 2), filename);
+                    logger_1.logger.info(file_service_1.FileService.fileDownloadedMessage + filename);
+                }
+                else {
+                    this.printPackageVersionCreatedTransport(created);
+                }
+            });
+        }
         printPackageVersionTransport(packageVersionTransport) {
             logger_1.logger.info(`Package Key: ${packageVersionTransport.packageKey}`);
             logger_1.logger.info(`Version: ${packageVersionTransport.version}`);
@@ -50,6 +74,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             logger_1.logger.info(`Deployed: ${packageVersionTransport.deployed}`);
             logger_1.logger.info(`Published By: ${packageVersionTransport.publishedBy}`);
         }
+        printPackageVersionCreatedTransport(transport) {
+            logger_1.logger.info(`Successfully created version ${transport.version} for package ${transport.packageKey}`);
+            logger_1.logger.info(`Version: ${transport.version}`);
+            logger_1.logger.info(`Package Key: ${transport.packageKey}`);
+            logger_1.logger.info(`Summary of Changes: ${transport.summaryOfChanges}`);
+            logger_1.logger.info(`Creation Date: ${new Date(transport.creationDate).toISOString()}`);
+            logger_1.logger.info(`Created By: ${transport.createdBy}`);
+        }
     }
     exports.PackageVersionService = PackageVersionService;
 });

package/commands/configuration-management/variable.service.js

@@ -13,7 +13,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         if (v !== undefined) module.exports = v;
     }
     else if (typeof define === "function" && define.amd) {
-        define(["require", "exports", "uuid", "../../core/utils/logger", "./studio.service", "../../core/utils/file-service", "./api/batch-import-export-api", "url", "./api/variable-assignment-candidates-api"], factory);
+        define(["require", "exports", "uuid", "../../core/utils/logger", "./studio.service", "../../core/utils/file-service", "./api/batch-import-export-api", "url", "./api/variable-assignment-candidates-api", "./api/staging-package-variables-api"], factory);
     }
 })(function (require, exports) {
     "use strict";
@@ -26,10 +26,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     const batch_import_export_api_1 = require("./api/batch-import-export-api");
     const url_1 = require("url");
     const variable_assignment_candidates_api_1 = require("./api/variable-assignment-candidates-api");
+    const staging_package_variables_api_1 = require("./api/staging-package-variables-api");
     class VariableService {
         constructor(context) {
             this.batchImportExportApi = new batch_import_export_api_1.BatchImportExportApi(context);
             this.variableAssignmentCandidatesApi = new variable_assignment_candidates_api_1.VariableAssignmentCandidatesApi(context);
+            this.stagingPackageVariablesApi = new staging_package_variables_api_1.StagingPackageVariablesApi(context);
             this.studioService = new studio_service_1.StudioService(context);
         }
         listVariables(keysByVersion, keysByVersionFile) {
@@ -62,6 +64,25 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 this.exportToJson(variableManifests);
             });
         }
+        listStagingVariables(packageKeys) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const byPackage = yield this.fetchStagingVariablesByPackageKeys(packageKeys);
+                byPackage.forEach(entry => {
+                    logger_1.logger.info(JSON.stringify(entry));
+                });
+            });
+        }
+        exportStagingVariables(packageKeys) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const byPackage = yield this.fetchStagingVariablesByPackageKeys(packageKeys);
+                this.exportToJson(byPackage);
+            });
+        }
+        fetchStagingVariablesByPackageKeys(packageKeys) {
+            return __awaiter(this, void 0, void 0, function* () {
+                return yield this.stagingPackageVariablesApi.findAllByPackageKeys(packageKeys);
+            });
+        }
         getVersionedVariablesByKeyVersionPairs(keysByVersion, keysByVersionFile) {
             return __awaiter(this, void 0, void 0, function* () {
                 const variablesExportRequest = yield this.buildKeyVersionPairs(keysByVersion, keysByVersionFile);

package/commands/profile/module.js

@@ -37,6 +37,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             command.command("default <profile>")
                 .description("Command to set a profile as default")
                 .action(this.defaultProfile);
+            command.command("secure <profile>")
+                .description("Migrate a profile's secrets to secure system keychain storage")
+                .action(this.secureProfile);
         }
         defaultProfile(context, command) {
             return __awaiter(this, void 0, void 0, function* () {
@@ -55,6 +58,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 yield new profile_command_service_1.ProfileCommandService().listProfiles();
             });
         }
+        secureProfile(context, command) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const profile = command.args[0];
+                yield new profile_command_service_1.ProfileCommandService().secureProfile(profile);
+            });
+        }
     }
     return Module;
 });

package/commands/profile/profile-command.service.js

@@ -55,7 +55,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                     }
                     profile.authenticationType = yield profile_validator_1.ProfileValidator.validateProfile(profile);
                     yield this.profileService.authorizeProfile(profile);
-                    this.profileService.storeProfile(profile);
+                    yield this.profileService.storeProfile(profile);
                     if (setAsDefault) {
                         yield this.makeDefaultProfile(profile.name);
                     }
@@ -89,6 +89,23 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 logger_1.logger.info("Default profile: " + profile);
             });
         }
+        secureProfile(profileName) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const profile = yield this.profileService.findProfile(profileName);
+                if (profile.secretsStoredSecurely) {
+                    logger_1.logger.info(`Profile "${profileName}" is already using secure storage.`);
+                    return;
+                }
+                yield this.profileService.storeProfile(profile);
+                const updatedProfile = yield this.profileService.findProfile(profileName);
+                if (updatedProfile.secretsStoredSecurely) {
+                    logger_1.logger.info(`Profile "${profileName}" secrets have been migrated to secure storage.`);
+                }
+                else {
+                    logger_1.logger.warn(`Failed to migrate profile "${profileName}" to secure storage. Secrets remain in plaintext.`);
+                }
+            });
+        }
     }
     exports.ProfileCommandService = ProfileCommandService;
 });

package/core/profile/profile.service.js

@@ -13,12 +13,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         if (v !== undefined) module.exports = v;
     }
     else if (typeof define === "function" && define.amd) {
-        define(["require", "exports", "./profile.interface", "./profile.validator", "path", "fs", "../utils/logger", "openid-client", "axios", "os"], factory);
+        define(["require", "exports", "./profile.interface", "./profile.validator", "path", "fs", "../utils/logger", "openid-client", "axios", "os", "./secret-storage.service"], factory);
     }
 })(function (require, exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.profileService = exports.ProfileService = void 0;
+    exports.ProfileService = void 0;
     const profile_interface_1 = require("./profile.interface");
     const profile_validator_1 = require("./profile.validator");
     const path = require("path");
@@ -27,6 +27,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     const openid_client_1 = require("openid-client");
     const axios_1 = require("axios");
     const os = require("os");
+    const secret_storage_service_1 = require("./secret-storage.service");
     const homedir = os.homedir();
     // use 5 seconds buffer to avoid rare cases when accessToken is just about to expire before the command is sent
     const expiryBuffer = 5000;
@@ -38,6 +39,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         constructor() {
             this.profileContainerPath = path.resolve(homedir, ".celonis-content-cli-profiles");
             this.configContainer = path.resolve(this.profileContainerPath, "config.json");
+            this.secureSecretStorageService = new secret_storage_service_1.SecureSecretStorageService();
         }
         findProfile(profileName) {
             return __awaiter(this, void 0, void 0, function* () {
@@ -46,8 +48,28 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                         if (!this.checkIfMissingProfile(profileName)) {
                             const file = fs.readFileSync(path.resolve(this.profileContainerPath, this.constructProfileFileName(profileName)), { encoding: "utf-8" });
                             const profile = JSON.parse(file);
-                            this.refreshProfile(profile)
-                                .then(() => resolve(profile));
+                            if (profile.secretsStoredSecurely) {
+                                this.secureSecretStorageService.getSecrets(profileName)
+                                    .then(profileSecureSecrets => {
+                                    if (profileSecureSecrets) {
+                                        profile.apiToken = profileSecureSecrets.apiToken;
+                                        profile.refreshToken = profileSecureSecrets.refreshToken;
+                                        profile.clientSecret = profileSecureSecrets.clientSecret;
+                                        this.refreshProfile(profile)
+                                            .then(() => resolve(profile))
+                                            .catch(() => reject(`The profile ${profileName} couldn't be resolved.`));
+                                    }
+                                    else {
+                                        reject("Failed to read secrets from system keychain.");
+                                    }
+                                })
+                                    .catch(() => reject(`The profile ${profileName} couldn't be resolved.`));
+                            }
+                            else {
+                                this.refreshProfile(profile)
+                                    .then(() => resolve(profile))
+                                    .catch(() => reject(`The profile ${profileName} couldn't be resolved.`));
+                            }
                         }
                         else if (process.env.TEAM_URL && process.env.API_TOKEN) {
                             resolve(this.buildProfileFromEnvVariables());
@@ -92,11 +114,24 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             }
         }
         storeProfile(profile) {
-            this.createProfileContainerIfNotExists();
-            const newProfileFileName = this.constructProfileFileName(profile.name);
-            profile.team = this.getBaseTeamUrl(profile.team);
-            fs.writeFileSync(path.resolve(this.profileContainerPath, newProfileFileName), JSON.stringify(profile), {
-                encoding: "utf-8",
+            return __awaiter(this, void 0, void 0, function* () {
+                this.createProfileContainerIfNotExists();
+                const newProfileFileName = this.constructProfileFileName(profile.name);
+                profile.team = this.getBaseTeamUrl(profile.team);
+                const secretsStoredInKeychain = yield this.secureSecretStorageService.storeSecrets(profile);
+                const profileToStore = Object.assign({}, profile);
+                if (secretsStoredInKeychain) {
+                    profileToStore.secretsStoredSecurely = true;
+                    delete profileToStore.apiToken;
+                    delete profileToStore.refreshToken;
+                    delete profileToStore.clientSecret;
+                }
+                else {
+                    profileToStore.secretsStoredSecurely = false;
+                }
+                fs.writeFileSync(path.resolve(this.profileContainerPath, newProfileFileName), JSON.stringify(profileToStore), {
+                    encoding: "utf-8",
+                });
             });
         }
         buildProfileFromEnvVariables() {
@@ -263,7 +298,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                         logger_1.logger.error(new logger_1.FatalError("The profile cannot be refreshed. Please retry or recreate profile."));
                     }
                 }
-                this.storeProfile(profile);
+                yield this.storeProfile(profile);
             });
         }
         getProfileEnvVariables() {
@@ -394,5 +429,4 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         }
     }
     exports.ProfileService = ProfileService;
-    exports.profileService = new ProfileService();
 });

package/core/profile/secret-storage.service.js

@@ -0,0 +1,115 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+(function (factory) {
+    if (typeof module === "object" && typeof module.exports === "object") {
+        var v = factory(require, exports);
+        if (v !== undefined) module.exports = v;
+    }
+    else if (typeof define === "function" && define.amd) {
+        define(["require", "exports", "../utils/logger"], factory);
+    }
+})(function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SecureSecretStorageService = void 0;
+    const logger_1 = require("../utils/logger");
+    var PROFILE_SECRET_TYPE;
+    (function (PROFILE_SECRET_TYPE) {
+        PROFILE_SECRET_TYPE["API_TOKEN"] = "apiToken";
+        PROFILE_SECRET_TYPE["CLIENT_SECRET"] = "clientSecret";
+        PROFILE_SECRET_TYPE["REFRESH_TOKEN"] = "refreshToken";
+    })(PROFILE_SECRET_TYPE || (PROFILE_SECRET_TYPE = {}));
+    const CONTENT_CLI_SERVICE_NAME = "celonis-content-cli";
+    // Lazy load keytar to handle cases where native dependencies are not available
+    let keytar = null;
+    let keytarLoadError = null;
+    function getKeytar() {
+        if (keytar !== null) {
+            return keytar;
+        }
+        if (keytarLoadError !== null) {
+            return null;
+        }
+        try {
+            keytar = require("@github/keytar");
+            return keytar;
+        }
+        catch (error) {
+            keytarLoadError = error;
+            return null;
+        }
+    }
+    class SecureSecretStorageService {
+        storeSecrets(profile) {
+            return __awaiter(this, void 0, void 0, function* () {
+                let secretsStoredInKeychain = true;
+                const secretEntries = [
+                    { type: PROFILE_SECRET_TYPE.API_TOKEN, value: profile.apiToken },
+                    { type: PROFILE_SECRET_TYPE.CLIENT_SECRET, value: profile.clientSecret },
+                    { type: PROFILE_SECRET_TYPE.REFRESH_TOKEN, value: profile.refreshToken },
+                ];
+                for (const secretEntry of secretEntries) {
+                    if (secretEntry.value) {
+                        const stored = yield this.storeSecret(this.getSecretServiceName(profile.name), secretEntry.type, secretEntry.value);
+                        if (!stored) {
+                            secretsStoredInKeychain = false;
+                        }
+                    }
+                }
+                if (!secretsStoredInKeychain) {
+                    logger_1.logger.warn("⚠️ Failed to store secrets securely. They will be stored in plain text file.");
+                    return false;
+                }
+                return true;
+            });
+        }
+        getSecrets(profileName) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const keytarModule = getKeytar();
+                if (!keytarModule) {
+                    return undefined;
+                }
+                try {
+                    const secrets = yield keytarModule.findCredentials(this.getSecretServiceName(profileName));
+                    if (!secrets.length) {
+                        return undefined;
+                    }
+                    const profileSecrets = {};
+                    for (const secret of secrets) {
+                        profileSecrets[secret.account] = secret.password;
+                    }
+                    return profileSecrets;
+                }
+                catch (err) {
+                    return undefined;
+                }
+            });
+        }
+        getSecretServiceName(profileName) {
+            return `${CONTENT_CLI_SERVICE_NAME}:${profileName}`;
+        }
+        storeSecret(service, account, secret) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const keytarModule = getKeytar();
+                if (!keytarModule) {
+                    return false;
+                }
+                try {
+                    yield keytarModule.setPassword(service, account, secret);
+                    return true;
+                }
+                catch (err) {
+                    return false;
+                }
+            });
+        }
+    }
+    exports.SecureSecretStorageService = SecureSecretStorageService;
+});

package/lib/commands/configuration-management/api/package-version-api.d.ts

@@ -1,7 +1,8 @@
 import { Context } from "../../../core/command/cli-context";
-import { PackageVersionTransport } from "../interfaces/package-version.interfaces";
+import { PackageVersionCreatedTransport, PackageVersionTransport, SavePackageVersionTransport } from "../interfaces/package-version.interfaces";
 export declare class PackageVersionApi {
     private httpClient;
     constructor(context: Context);
     findOne(packageKey: string, version: string): Promise<PackageVersionTransport>;
+    createVersion(packageKey: string, request: SavePackageVersionTransport): Promise<PackageVersionCreatedTransport>;
 }

package/lib/commands/configuration-management/api/staging-package-variables-api.d.ts

@@ -0,0 +1,7 @@
+import { Context } from "../../../core/command/cli-context";
+import { StagingVariableManifestTransport } from "../interfaces/package-export.interfaces";
+export declare class StagingPackageVariablesApi {
+    private readonly httpClient;
+    constructor(context: Context);
+    findAllByPackageKeys(packageKeys: string[]): Promise<StagingVariableManifestTransport[]>;
+}

package/lib/commands/configuration-management/config-command.service.d.ts

@@ -5,7 +5,7 @@ export declare class ConfigCommandService {
     private diffService;
     constructor(context: Context);
     listPackages(jsonResponse: boolean, flavors: string[], withDependencies: boolean, packageKeys: string[], keysByVersion: string[], variableValue: string, variableType: string): Promise<void>;
-    listVariables(jsonResponse: boolean, keysByVersion: string[], keysByVersionFile: string): Promise<void>;
+    listVariables(jsonResponse: boolean, keysByVersion: string[], keysByVersionFile: string, packageKeys: string[]): Promise<void>;
     batchExportPackages(packageKeys: string[], packageKeysByVersion: string[], withDependencies: boolean, gitBranch: string, unzip: boolean): Promise<void>;
     batchExportPackagesMetadata(packageKeys: string[], jsonResponse: boolean): Promise<void>;
     batchImportPackages(file: string, directory: string, overwrite: boolean, gitBranch: string): Promise<void>;

package/lib/commands/configuration-management/interfaces/package-export.interfaces.d.ts

@@ -39,6 +39,10 @@ export interface VariableManifestTransport {
     version: string;
     variables?: VariableExportTransport[];
 }
+export interface StagingVariableManifestTransport {
+    packageKey: string;
+    variables?: VariableExportTransport[];
+}
 export interface PackageKeyAndVersionPair {
     packageKey: string;
     version: string;

package/lib/commands/configuration-management/interfaces/package-version.interfaces.d.ts

@@ -8,3 +8,24 @@ export interface PackageVersionTransport {
     deployed: boolean;
     publishedBy: string;
 }
+export interface SavePackageVersionTransport {
+    version?: string;
+    versionBumpOption?: VersionBumpOption;
+    summaryOfChanges?: string;
+    nodeFilter?: NodeFilterTransport;
+}
+export declare enum VersionBumpOption {
+    NONE = "NONE",
+    PATCH = "PATCH"
+}
+export interface NodeFilterTransport {
+    filterType: "INCLUDE";
+    keys: string[];
+}
+export interface PackageVersionCreatedTransport {
+    packageKey: string;
+    version: string;
+    summaryOfChanges: string;
+    creationDate: string;
+    createdBy: string;
+}

package/lib/commands/configuration-management/module.d.ts

@@ -9,6 +9,7 @@ declare class Module extends IModule {
     private batchExportPackages;
     private batchExportPackagesMetadata;
     private getPackageVersion;
+    private createPackageVersion;
     private batchImportPackages;
     private diffPackages;
     private listVariables;

package/lib/commands/configuration-management/package-version-command.service.d.ts

@@ -3,4 +3,5 @@ export declare class PackageVersionCommandService {
     private packageVersionService;
     constructor(context: Context);
     getPackageVersion(packageKey: string, version: string, jsonResponse: boolean): Promise<void>;
+    createPackageVersion(packageKey: string, version: string | undefined, versionBumpOption: string, summaryOfChanges: string | undefined, nodeFilterKeys: string[] | undefined, jsonResponse: boolean): Promise<void>;
 }

package/lib/commands/configuration-management/package-version.service.d.ts

@@ -3,5 +3,7 @@ export declare class PackageVersionService {
     private packageVersionApi;
     constructor(context: Context);
     findPackageVersion(packageKey: string, version: string, jsonResponse: boolean): Promise<void>;
+    createPackageVersion(packageKey: string, version: string | undefined, versionBumpOption: string, summaryOfChanges: string | undefined, nodeFilterKeys: string[] | undefined, jsonResponse: boolean): Promise<void>;
     private printPackageVersionTransport;
+    private printPackageVersionCreatedTransport;
 }

package/lib/commands/configuration-management/variable.service.d.ts

@@ -2,12 +2,16 @@ import { Context } from "../../core/command/cli-context";
 export declare class VariableService {
     private batchImportExportApi;
     private variableAssignmentCandidatesApi;
+    private readonly stagingPackageVariablesApi;
     private studioService;
     constructor(context: Context);
     listVariables(keysByVersion: string[], keysByVersionFile: string): Promise<void>;
     listCandidateAssignments(type: string, params: string): Promise<void>;
     findAndExportCandidateAssignments(type: string, params: string): Promise<void>;
     exportVariables(keysByVersion: string[], keysByVersionFile: string): Promise<void>;
+    listStagingVariables(packageKeys: string[]): Promise<void>;
+    exportStagingVariables(packageKeys: string[]): Promise<void>;
+    private fetchStagingVariablesByPackageKeys;
     private getVersionedVariablesByKeyVersionPairs;
     private buildKeyVersionPairs;
     private buildKeyAndVersionPairsFromArrayInput;

package/lib/commands/profile/module.d.ts

@@ -8,5 +8,6 @@ declare class Module extends IModule {
     private defaultProfile;
     private createProfile;
     private listProfiles;
+    private secureProfile;
 }
 export = Module;

package/lib/commands/profile/profile-command.service.d.ts

@@ -3,4 +3,5 @@ export declare class ProfileCommandService {
     createProfile(setAsDefault: boolean): Promise<void>;
     listProfiles(): Promise<void>;
     makeDefaultProfile(profile: string): Promise<void>;
+    secureProfile(profileName: string): Promise<void>;
 }

package/lib/core/profile/profile.interface.d.ts

@@ -1,14 +1,17 @@
-export interface Profile {
+export interface ProfileSecrets {
+    apiToken: string;
+    clientSecret?: string;
+    refreshToken?: string;
+    secretsStoredSecurely?: boolean;
+}
+export interface Profile extends ProfileSecrets {
     name: string;
     team: string;
     type: ProfileType;
-    apiToken: string;
     authenticationType: AuthenticationType;
     clientId?: string;
-    clientSecret?: string;
     scopes?: string[];
     clientAuthenticationMethod?: ClientAuthenticationMethod;
-    refreshToken?: string;
     expiresAt?: number;
 }
 export type AuthenticationType = "Bearer" | "AppKey";

package/lib/core/profile/profile.service.d.ts

@@ -5,10 +5,11 @@ export interface Config {
 export declare class ProfileService {
     private profileContainerPath;
     private configContainer;
+    private secureSecretStorageService;
     findProfile(profileName: string): Promise<Profile>;
     makeDefaultProfile(profileName: string): Promise<Profile>;
     getDefaultProfile(): string;
-    storeProfile(profile: Profile): void;
+    storeProfile(profile: Profile): Promise<void>;
     private buildProfileFromEnvVariables;
     private storeConfig;
     private createProfileContainerIfNotExists;
@@ -40,4 +41,3 @@ export declare class ProfileService {
      */
     private extractScopesFromTokenSet;
 }
-export declare const profileService: ProfileService;

package/lib/core/profile/secret-storage.service.d.ts

@@ -0,0 +1,7 @@
+import { Profile, ProfileSecrets } from "./profile.interface";
+export declare class SecureSecretStorageService {
+    storeSecrets(profile: Profile): Promise<boolean>;
+    getSecrets(profileName: string): Promise<ProfileSecrets | undefined>;
+    private getSecretServiceName;
+    private storeSecret;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celonis/content-cli",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "CLI Tool to help manage content in Celonis Platform",
   "main": "content-cli.js",
   "bin": {
@@ -26,11 +26,12 @@
     "form-data": "4.0.4",
     "openid-client": "5.6.1",
     "hpagent": "1.2.0",
+    "@github/keytar": "7.10.6",
     "semver": "7.6.3",
-    "simple-git": "3.28.0",
+    "simple-git": "3.32.3",
     "valid-url": "1.0.9",
     "winston": "3.17.0",
-    "yaml": "2.7.0"
+    "yaml": "2.8.3"
   },
   "devDependencies": {
     "@types/adm-zip": "0.5.7",