@jtl-software/create-cloud-app 0.0.15 → 0.0.17

package/README.md

@@ -2,6 +2,10 @@
 
 Scaffold a [JTL Platform](https://www.jtl-software.com/) cloud app in seconds.
 
+## Requirements
+
+Node.js **24** (current LTS) or newer. The scaffolded project sets the same floor via `engines.node`.
+
 ## Quick start
 
 ```bash

package/dist/index.js

@@ -1,13 +1,935 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import * as p from "@clack/prompts";
-import pc from "picocolors";
+import * as p2 from "@clack/prompts";
+import pc2 from "picocolors";
 
-// src/scaffold.ts
+// src/register.ts
+import * as p from "@clack/prompts";
+import { spawn } from "child_process";
 import crypto from "crypto";
 import fs from "fs";
+import http from "http";
+import os from "os";
 import path from "path";
+import { parseArgs } from "util";
+import pc from "picocolors";
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+var CALLBACK_PORT = 9876;
+var REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/callback`;
+var DEFAULT_SCOPE = "openid offline_access";
+var DEFAULT_API_HOST = "https://api.jtl-cloud.com";
+var DEFAULT_AUTH_HOST = "https://auth.jtl-cloud.com";
+var CLIENT_IDS_BY_AUTH_HOST = {
+  "auth.jtl-cloud.com": "b6aca875-c9a3-4010-9fd7-7f8d2e0b0333",
+  "auth.dev.jtl-cloud.com": "9c230937-6a52-48d6-9a39-e97edd8ef511",
+  "auth.qa.jtl-cloud.com": "fdf8ec1d-b0d3-4f16-9f29-a2ebbbf62951"
+};
+var TOKEN_EXPIRY_MARGIN_S = 60;
+function tokenCacheFile() {
+  return process.env.JTL_CLI_TOKEN_CACHE_FILE ?? path.join(os.homedir(), ".config", "jtl-cli", "tokens.json");
+}
+var BailError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BailError";
+  }
+};
+function bail(message) {
+  p.cancel(message);
+  throw new BailError(message);
+}
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generatePkce() {
+  const verifier = base64url(crypto.randomBytes(32));
+  const challenge = base64url(
+    crypto.createHash("sha256").update(verifier).digest()
+  );
+  return { verifier, challenge };
+}
+function parseEnv(content) {
+  const result = {};
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    result[key] = value;
+  }
+  return result;
+}
+function pickFirstLocaleEntry(entries) {
+  if (!entries || typeof entries !== "object") return void 0;
+  const keys = Object.keys(entries);
+  if (!keys.length) return void 0;
+  return entries[keys[0]];
+}
+function summarizeManifest(manifest) {
+  const m = manifest.manifest ?? {};
+  const listing = manifest.listing ?? {};
+  const nameEntry = pickFirstLocaleEntry(listing.name);
+  const descEntry = pickFirstLocaleEntry(listing.description);
+  return {
+    name: nameEntry?.short ?? nameEntry?.full ?? m.technicalName ?? "(unnamed)",
+    technicalName: m.technicalName ?? "(unset)",
+    version: m.version ?? "(unset)",
+    description: descEntry?.short ?? descEntry?.full
+  };
+}
+function readEnvFile(filePath) {
+  if (!fs.existsSync(filePath)) return {};
+  return parseEnv(fs.readFileSync(filePath, "utf-8"));
+}
+function upsertEnv(filePath, updates) {
+  const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf-8") : "";
+  const lines = existing.split(/\r?\n/);
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const remaining = new Map(Object.entries(updates));
+  const next = lines.map((line) => {
+    const eq = line.indexOf("=");
+    if (eq === -1) return line;
+    const key = line.slice(0, eq).trim();
+    if (remaining.has(key)) {
+      const value = remaining.get(key);
+      remaining.delete(key);
+      return `${key}=${value}`;
+    }
+    return line;
+  });
+  for (const [key, value] of remaining) {
+    next.push(`${key}=${value}`);
+  }
+  fs.writeFileSync(filePath, next.join("\n") + "\n");
+}
+function findDotnetProject(backendDir) {
+  if (!fs.existsSync(backendDir)) return null;
+  for (const entry of fs.readdirSync(backendDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const exampleFile = path.join(
+      backendDir,
+      entry.name,
+      "appsettings.Local.json.example"
+    );
+    const csproj = path.join(backendDir, entry.name, `${entry.name}.csproj`);
+    if (fs.existsSync(exampleFile) || fs.existsSync(csproj)) {
+      return path.join(backendDir, entry.name);
+    }
+  }
+  return null;
+}
+function detectBackend(root) {
+  const backendDir = path.join(root, "packages", "backend");
+  const envFile = path.join(backendDir, ".env");
+  const envExample = path.join(backendDir, ".env.example");
+  if (fs.existsSync(envFile) || fs.existsSync(envExample)) {
+    return { kind: "node", envFile };
+  }
+  const dotnetDir = findDotnetProject(backendDir);
+  if (dotnetDir) {
+    return {
+      kind: "dotnet",
+      settingsFile: path.join(dotnetDir, "appsettings.Local.json")
+    };
+  }
+  return { kind: "node", envFile: path.join(root, ".env") };
+}
+function readExistingCredentials(backend) {
+  if (backend.kind === "node") {
+    const values = readEnvFile(backend.envFile);
+    return { clientId: values.CLIENT_ID, clientSecret: values.CLIENT_SECRET };
+  }
+  if (!fs.existsSync(backend.settingsFile)) return {};
+  try {
+    const settings = JSON.parse(fs.readFileSync(backend.settingsFile, "utf-8"));
+    return {
+      clientId: settings?.JtlPlatform?.ClientId,
+      clientSecret: settings?.JtlPlatform?.ClientSecret
+    };
+  } catch {
+    return {};
+  }
+}
+function writeBackendCredentials(backend, clientId, clientSecret) {
+  if (backend.kind === "node") {
+    upsertEnv(backend.envFile, {
+      CLIENT_ID: clientId,
+      CLIENT_SECRET: clientSecret
+    });
+    return backend.envFile;
+  }
+  let settings = {};
+  if (fs.existsSync(backend.settingsFile)) {
+    try {
+      settings = JSON.parse(fs.readFileSync(backend.settingsFile, "utf-8"));
+    } catch {
+      settings = {};
+    }
+  }
+  settings.JtlPlatform = {
+    ...settings.JtlPlatform ?? {},
+    ClientId: clientId,
+    ClientSecret: clientSecret
+  };
+  fs.writeFileSync(
+    backend.settingsFile,
+    JSON.stringify(settings, null, 2) + "\n"
+  );
+  return backend.settingsFile;
+}
+function readManifest(manifestPath) {
+  if (!fs.existsSync(manifestPath)) {
+    bail(
+      `manifest.json not found at ${manifestPath}. Run this from the project root.`
+    );
+  }
+  try {
+    return JSON.parse(fs.readFileSync(manifestPath, "utf-8"));
+  } catch (err) {
+    bail(`manifest.json is not valid JSON: ${err.message}`);
+  }
+}
+function readTokenCache() {
+  const file = tokenCacheFile();
+  if (!fs.existsSync(file)) return {};
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writeTokenCache(cache) {
+  const file = tokenCacheFile();
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 448 });
+  fs.writeFileSync(file, JSON.stringify(cache, null, 2), { mode: 384 });
+}
+function cacheKey(authBaseUrl) {
+  return new URL(authBaseUrl).host;
+}
+function getCachedToken(authBaseUrl, clientId, scope) {
+  const entry = readTokenCache()[cacheKey(authBaseUrl)];
+  if (!entry || entry.client_id !== clientId) return null;
+  if (scope !== void 0 && entry.scope !== void 0 && entry.scope !== scope) {
+    return null;
+  }
+  return entry;
+}
+function saveCachedToken(authBaseUrl, token) {
+  const cache = readTokenCache();
+  cache[cacheKey(authBaseUrl)] = token;
+  writeTokenCache(cache);
+}
+function makeCachedToken(clientId, tokens, fallbackRefreshToken, scope) {
+  return {
+    client_id: clientId,
+    access_token: tokens.access_token,
+    expires_at: Math.floor(Date.now() / 1e3) + Math.max(60, tokens.expires_in ?? 3600),
+    refresh_token: tokens.refresh_token ?? fallbackRefreshToken,
+    scope
+  };
+}
+var defaultOpener = (url) => {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open";
+  const args = platform === "win32" ? ["", url] : [url];
+  try {
+    spawn(cmd, args, {
+      stdio: "ignore",
+      detached: true,
+      shell: platform === "win32"
+    }).unref();
+  } catch {
+  }
+};
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function callbackPage(title, message, isError = false) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>JTL Cloud Apps CLI</title>
+  <style>
+    body { font-family: -apple-system, system-ui, sans-serif; max-width: 480px; margin: 80px auto; padding: 0 24px; color: #1f2937; }
+    h1 { font-size: 20px; margin-bottom: 8px; }
+    p { color: ${isError ? "#b91c1c" : "#6b7280"}; line-height: 1.5; }
+  </style>
+</head>
+<body>
+  <h1>${escapeHtml(title)}</h1>
+  <p>${escapeHtml(message)}</p>
+</body>
+</html>`;
+}
+function captureAuthCode(authorizeUrl, expectedState, verifier, options = {}) {
+  const opener = options.opener ?? defaultOpener;
+  const port = options.port ?? CALLBACK_PORT;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const closeAndSettle = (res, next) => {
+      if (settled) return;
+      settled = true;
+      const finish = () => server.close(() => next());
+      if (res.writableEnded) {
+        finish();
+      } else {
+        res.once("finish", finish);
+      }
+    };
+    const server = http.createServer(
+      (req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== "/callback" || req.method !== "GET") {
+          res.writeHead(404);
+          res.end();
+          return;
+        }
+        const error = url.searchParams.get("error");
+        const description = url.searchParams.get("error_description") ?? "";
+        const code = url.searchParams.get("code");
+        const state = url.searchParams.get("state");
+        if (error) {
+          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(
+            callbackPage("Sign-in failed", `${error}: ${description}`, true)
+          );
+          closeAndSettle(
+            res,
+            () => reject(new Error(`${error}: ${description || "no description"}`))
+          );
+          return;
+        }
+        if (state !== expectedState) {
+          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(callbackPage("Sign-in failed", "state mismatch", true));
+          closeAndSettle(res, () => reject(new Error("OAuth state mismatch")));
+          return;
+        }
+        if (!code) {
+          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(
+            callbackPage(
+              "Sign-in failed",
+              "no authorization code in response",
+              true
+            )
+          );
+          closeAndSettle(
+            res,
+            () => reject(new Error("OAuth callback missing code"))
+          );
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(
+          callbackPage(
+            "Signed in",
+            "You can close this window and return to your terminal."
+          )
+        );
+        closeAndSettle(res, () => resolve({ code, verifier }));
+      }
+    );
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      server.close(
+        () => reject(new Error(`login timed out after ${LOGIN_TIMEOUT_MS / 1e3}s`))
+      );
+    }, LOGIN_TIMEOUT_MS);
+    timer.unref();
+    server.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      if (err.code === "EADDRINUSE") {
+        reject(
+          new Error(
+            `port ${port} is already in use \u2014 stop whatever is bound to it and try again`
+          )
+        );
+        return;
+      }
+      reject(err);
+    });
+    server.listen(port, () => {
+      if (!options.silent) {
+        console.log(`
+Opening browser to sign in.`);
+        console.log(
+          `If it doesn't open, visit:
+  ${pc.cyan(authorizeUrl.toString())}
+`
+        );
+      }
+      opener(authorizeUrl.toString());
+    });
+  });
+}
+async function postTokenRequest(authBaseUrl, body) {
+  const res = await fetch(`${authBaseUrl}/oauth2/token`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: body.toString()
+  });
+  const text2 = await res.text();
+  if (!res.ok) {
+    throw new Error(`token endpoint returned ${res.status}: ${text2}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch {
+    throw new Error(`token endpoint returned non-JSON: ${text2}`);
+  }
+  if (!parsed.access_token) {
+    throw new Error(`token endpoint response missing access_token: ${text2}`);
+  }
+  return parsed;
+}
+async function exchangeCodeForToken(authBaseUrl, clientId, code, verifier) {
+  return postTokenRequest(
+    authBaseUrl,
+    new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: REDIRECT_URI,
+      client_id: clientId,
+      code_verifier: verifier
+    })
+  );
+}
+async function refreshAccessToken(authBaseUrl, clientId, refreshToken) {
+  return postTokenRequest(
+    authBaseUrl,
+    new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: clientId
+    })
+  );
+}
+async function acquireAccessToken(opts) {
+  const { auth, clientId, scope, reauth, spinner: spinner3, captureOptions } = opts;
+  const now = Math.floor(Date.now() / 1e3);
+  const cached = reauth ? null : getCachedToken(auth, clientId, scope);
+  if (cached && cached.expires_at > now + TOKEN_EXPIRY_MARGIN_S) {
+    spinner3?.start("Using cached session");
+    spinner3?.stop("Signed in (cached)");
+    return cached.access_token;
+  }
+  if (cached?.refresh_token) {
+    spinner3?.start("Refreshing session");
+    try {
+      const refreshed = await refreshAccessToken(
+        auth,
+        clientId,
+        cached.refresh_token
+      );
+      saveCachedToken(
+        auth,
+        makeCachedToken(clientId, refreshed, cached.refresh_token, scope)
+      );
+      spinner3?.stop("Signed in (refreshed)");
+      return refreshed.access_token;
+    } catch {
+      spinner3?.stop("Refresh failed, opening browser");
+    }
+  }
+  const pkce = generatePkce();
+  const state = base64url(crypto.randomBytes(16));
+  const authorizeUrl = new URL("/oauth2/auth", auth);
+  authorizeUrl.searchParams.set("response_type", "code");
+  authorizeUrl.searchParams.set("client_id", clientId);
+  authorizeUrl.searchParams.set("redirect_uri", REDIRECT_URI);
+  authorizeUrl.searchParams.set("scope", scope);
+  authorizeUrl.searchParams.set("state", state);
+  authorizeUrl.searchParams.set("code_challenge", pkce.challenge);
+  authorizeUrl.searchParams.set("code_challenge_method", "S256");
+  spinner3?.start("Waiting for browser login");
+  try {
+    const { code, verifier } = await captureAuthCode(
+      authorizeUrl,
+      state,
+      pkce.verifier,
+      captureOptions
+    );
+    spinner3?.message("Exchanging authorization code");
+    const tokens = await exchangeCodeForToken(auth, clientId, code, verifier);
+    saveCachedToken(auth, makeCachedToken(clientId, tokens, void 0, scope));
+    spinner3?.stop("Signed in");
+    return tokens.access_token;
+  } catch (err) {
+    spinner3?.stop("Login failed");
+    throw err;
+  }
+}
+async function apiCall(url, init) {
+  const res = await fetch(url, init);
+  const text2 = await res.text();
+  let body;
+  try {
+    body = text2 ? JSON.parse(text2) : {};
+  } catch {
+    body = text2;
+  }
+  if (!res.ok) {
+    const detail = typeof body === "string" ? body : JSON.stringify(body);
+    throw new Error(
+      `${init.method ?? "GET"} ${url} returned ${res.status}: ${detail}`
+    );
+  }
+  return body;
+}
+async function fetchTenants(apiBaseUrl, jwt) {
+  const tenants = await apiCall(`${apiBaseUrl}/account/tenants`, {
+    headers: { Authorization: `Bearer ${jwt}`, Accept: "application/json" }
+  });
+  if (!Array.isArray(tenants)) {
+    throw new Error(
+      `unexpected /account/tenants response: ${JSON.stringify(tenants)}`
+    );
+  }
+  return tenants;
+}
+async function listTenantApps(apiBaseUrl, jwt, tenantId) {
+  const res = await apiCall(
+    `${apiBaseUrl}/app-service/tenants/apps?onlyAppsOfTenant=true&returnAll=true`,
+    {
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        "X-Tenant-Id": tenantId,
+        Accept: "application/json"
+      }
+    }
+  );
+  const items = Array.isArray(res) ? res : res.items ?? [];
+  return items.map((entry) => {
+    const id = entry.appId ?? entry.app?.id;
+    const technicalName = entry.app?.technicalName;
+    if (!id || !technicalName) return null;
+    return {
+      id,
+      technicalName,
+      clientId: entry.app?.clientId,
+      provisioningStatus: entry.app?.activeVersion?.provisioningStatus
+    };
+  }).filter((a) => a !== null);
+}
+function validateHost(input, flag) {
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    bail(`invalid --${flag} value: ${input}`);
+  }
+  if (!/^https?:$/.test(url.protocol)) {
+    bail(`--${flag} must use http(s): ${input}`);
+  }
+  return `${url.protocol}//${url.host}`;
+}
+function parseCollisionAction(input) {
+  if (input === "overwrite" || input === "print" || input === "cancel") {
+    return input;
+  }
+  bail(
+    `--on-collision must be one of: overwrite, print, cancel (got "${input}")`
+  );
+}
+function resolveOptions(args) {
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args,
+      options: {
+        "api-host": { type: "string" },
+        "auth-host": { type: "string" },
+        "client-id": { type: "string" },
+        scope: { type: "string" },
+        reauth: { type: "boolean" },
+        yes: { type: "boolean", short: "y" },
+        tenant: { type: "string" },
+        "existing-app-id": { type: "string" },
+        new: { type: "boolean" },
+        "on-collision": { type: "string" }
+      },
+      strict: true,
+      allowPositionals: false
+    });
+  } catch (err) {
+    bail(err.message);
+  }
+  const api = parsed.values["api-host"] ? validateHost(parsed.values["api-host"], "api-host") : DEFAULT_API_HOST;
+  const auth = parsed.values["auth-host"] ? validateHost(parsed.values["auth-host"], "auth-host") : DEFAULT_AUTH_HOST;
+  const clientIdArg = parsed.values["client-id"];
+  const clientId = clientIdArg ?? CLIENT_IDS_BY_AUTH_HOST[new URL(auth).hostname] ?? "";
+  if (!clientId) {
+    bail(
+      `no OAuth client_id registered for ${auth}. Pass --client-id <id> or add an entry to CLIENT_IDS_BY_AUTH_HOST.`
+    );
+  }
+  const existingAppId = parsed.values["existing-app-id"];
+  const forceNew = parsed.values.new ?? false;
+  if (existingAppId && forceNew) {
+    bail("--existing-app-id and --new are mutually exclusive");
+  }
+  const onCollisionRaw = parsed.values["on-collision"];
+  const onCollision = onCollisionRaw ? parseCollisionAction(onCollisionRaw) : void 0;
+  return {
+    api,
+    auth,
+    clientId,
+    scope: parsed.values.scope ?? DEFAULT_SCOPE,
+    reauth: parsed.values.reauth ?? false,
+    yes: parsed.values.yes ?? false,
+    tenant: parsed.values.tenant,
+    existingAppId,
+    forceNew,
+    onCollision
+  };
+}
+function ensureContinue(value) {
+  if (p.isCancel(value)) {
+    bail("Cancelled.");
+  }
+  return value;
+}
+async function selectTenant(tenants, opts) {
+  if (tenants.length === 0) {
+    bail(
+      "your account has no tenants. Create one on the Partner Portal first."
+    );
+  }
+  if (opts.tenant) {
+    const needle = opts.tenant.toLowerCase();
+    const matches = tenants.filter(
+      (t) => t.id === opts.tenant || t.slug.toLowerCase() === needle
+    );
+    if (matches.length === 0) {
+      bail(`no tenant matched --tenant "${opts.tenant}"`);
+    }
+    if (matches.length > 1) {
+      bail(
+        `--tenant "${opts.tenant}" matched ${matches.length} tenants \u2014 be more specific`
+      );
+    }
+    return matches[0];
+  }
+  if (tenants.length === 1) {
+    return tenants[0];
+  }
+  if (opts.yes) {
+    bail(
+      `multiple tenants available; pass --tenant <id|slug> in non-interactive mode`
+    );
+  }
+  const tenantId = ensureContinue(
+    await p.select({
+      message: "Register the app in which tenant?",
+      options: tenants.map((t) => ({
+        value: t.id,
+        label: t.name,
+        hint: t.slug
+      }))
+    })
+  );
+  return tenants.find((t) => t.id === tenantId);
+}
+async function selectExistingOrNew(matches, opts) {
+  if (opts.existingAppId) {
+    const match = matches.find((a) => a.id === opts.existingAppId);
+    if (!match) {
+      bail(
+        `--existing-app-id "${opts.existingAppId}" not found among apps matching this manifest`
+      );
+    }
+    return match;
+  }
+  if (opts.forceNew) return null;
+  if (matches.length === 0) return null;
+  if (opts.yes) {
+    bail(
+      `${matches.length} existing app(s) match this manifest; pass --existing-app-id <id> or --new in non-interactive mode`
+    );
+  }
+  const CREATE_NEW = "__create_new__";
+  const choice = ensureContinue(
+    await p.select({
+      message: "Update an existing app or create a new one?",
+      options: [
+        ...matches.map((a) => ({
+          value: a.id,
+          label: `${a.technicalName} (${a.id})`,
+          hint: a.provisioningStatus
+        })),
+        { value: CREATE_NEW, label: "Create a new app" }
+      ]
+    })
+  );
+  if (choice === CREATE_NEW) return null;
+  return matches.find((a) => a.id === choice);
+}
+async function confirmAction(opts, message, defaultValue) {
+  if (opts.yes) return true;
+  return ensureContinue(
+    await p.confirm({ message, initialValue: defaultValue })
+  );
+}
+async function resolveCollision(targetLabel, credentialPair, opts) {
+  if (opts.onCollision) return opts.onCollision;
+  if (opts.yes) {
+    bail(
+      `${targetLabel} already has ${credentialPair}; pass --on-collision <overwrite|print|cancel> in non-interactive mode`
+    );
+  }
+  return ensureContinue(
+    await p.select({
+      message: `${targetLabel} already has ${credentialPair}. What now?`,
+      options: [
+        { value: "overwrite", label: "Overwrite the file" },
+        { value: "print", label: "Print to console, don't touch the file" },
+        { value: "cancel", label: "Cancel" }
+      ]
+    })
+  );
+}
+async function updateAppManifest(apiBaseUrl, jwt, tenantId, appId, manifest) {
+  await apiCall(`${apiBaseUrl}/app-service/store/apps/${appId}/manifest`, {
+    method: "PUT",
+    headers: {
+      Authorization: `Bearer ${jwt}`,
+      "Content-Type": "application/json",
+      "X-Tenant-Id": tenantId
+    },
+    body: JSON.stringify({ manifest: manifest.manifest, tcAccepted: true })
+  });
+}
+async function createDraftApp(apiBaseUrl, jwt, tenantId, manifest) {
+  const created = await apiCall(
+    `${apiBaseUrl}/app-service/store/apps`,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        "Content-Type": "application/json",
+        "X-Tenant-Id": tenantId
+      },
+      body: JSON.stringify({
+        manifest: manifest.manifest,
+        tcAccepted: true
+      })
+    }
+  );
+  if (!created.appId) {
+    throw new Error(
+      `/store/apps did not return appId: ${JSON.stringify(created)}`
+    );
+  }
+  return created.appId;
+}
+async function provisionApp(apiBaseUrl, jwt, tenantId, appId) {
+  const provisioned = await apiCall(
+    `${apiBaseUrl}/app-service/store/apps/${appId}/provision`,
+    {
+      method: "PUT",
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        "Content-Type": "application/json",
+        "X-Tenant-Id": tenantId
+      },
+      body: JSON.stringify({ appId })
+    }
+  );
+  const clientId = provisioned.app?.clientId;
+  const clientSecret = provisioned.clientSecret;
+  if (!clientId || !clientSecret) {
+    throw new Error(
+      `provision response missing app.clientId or clientSecret: ${JSON.stringify(provisioned)}`
+    );
+  }
+  return { clientId, clientSecret };
+}
+function credentialLabels(backend) {
+  if (backend.kind === "node") {
+    return {
+      id: "CLIENT_ID",
+      secret: "CLIENT_SECRET",
+      pair: "CLIENT_ID/CLIENT_SECRET"
+    };
+  }
+  return {
+    id: "JtlPlatform:ClientId",
+    secret: "JtlPlatform:ClientSecret",
+    pair: "JtlPlatform:ClientId/ClientSecret"
+  };
+}
+async function persistCredentials(backend, clientId, clientSecret, root, opts) {
+  const targetPath = backend.kind === "node" ? backend.envFile : backend.settingsFile;
+  const relPath = path.relative(root, targetPath) || targetPath;
+  const labels = credentialLabels(backend);
+  const existing = readExistingCredentials(backend);
+  const collision = !!(existing.clientId && existing.clientSecret);
+  let action = "overwrite";
+  if (collision) {
+    action = await resolveCollision(relPath, labels.pair, opts);
+  }
+  if (action === "cancel") bail("Cancelled.");
+  if (action === "print") {
+    console.log();
+    console.log(pc.cyan(labels.id) + "     = " + clientId);
+    console.log(pc.cyan(labels.secret) + " = " + clientSecret);
+    console.log();
+    p.outro(pc.green("Done. Credentials printed above; file left untouched."));
+    return;
+  }
+  const written = writeBackendCredentials(backend, clientId, clientSecret);
+  p.outro(
+    pc.green(
+      `Done. Wrote ${labels.pair} to ${pc.cyan(path.relative(root, written) || written)}.`
+    )
+  );
+}
+async function register(argv = [], runOpts = {}) {
+  const root = runOpts.cwd ?? process.cwd();
+  const manifestPath = path.join(root, "manifest.json");
+  console.log();
+  p.intro(pc.bgCyan(pc.black(" register cloud app ")));
+  const opts = resolveOptions(argv);
+  const manifest = readManifest(manifestPath);
+  const summary = summarizeManifest(manifest);
+  const backend = detectBackend(root);
+  p.note(
+    [
+      `${pc.dim("API")}        ${opts.api}`,
+      `${pc.dim("Auth")}       ${opts.auth}`,
+      `${pc.dim("Client ID")}  ${opts.clientId}`,
+      `${pc.dim("Scope")}      ${opts.scope}`
+    ].join("\n"),
+    "Target"
+  );
+  const spinner3 = p.spinner();
+  let jwt;
+  try {
+    jwt = await acquireAccessToken({
+      auth: opts.auth,
+      clientId: opts.clientId,
+      scope: opts.scope,
+      reauth: opts.reauth,
+      spinner: spinner3,
+      captureOptions: runOpts.captureOptions
+    });
+  } catch (err) {
+    bail(err.message);
+  }
+  spinner3.start("Fetching tenants");
+  let tenants;
+  try {
+    tenants = await fetchTenants(opts.api, jwt);
+    spinner3.stop(
+      `Found ${tenants.length} tenant${tenants.length === 1 ? "" : "s"}`
+    );
+  } catch (err) {
+    spinner3.stop("Failed to fetch tenants");
+    bail(err.message);
+  }
+  const tenant = await selectTenant(tenants, opts);
+  spinner3.start("Looking for apps matching this manifest");
+  let matches;
+  try {
+    const apps = await listTenantApps(opts.api, jwt, tenant.id);
+    matches = apps.filter((a) => a.technicalName === summary.technicalName);
+    spinner3.stop(
+      `Found ${matches.length} app${matches.length === 1 ? "" : "s"} with technical name ${pc.cyan(summary.technicalName)}`
+    );
+  } catch (err) {
+    spinner3.stop("Failed to look up tenant apps");
+    bail(err.message);
+  }
+  const existing = await selectExistingOrNew(matches, opts);
+  const reviewLines = [
+    `${pc.dim("App name")}        ${summary.name}`,
+    `${pc.dim("Technical name")}  ${summary.technicalName}`,
+    `${pc.dim("Version")}         ${summary.version}`,
+    summary.description ? `${pc.dim("Description")}     ${summary.description}` : null,
+    `${pc.dim("Tenant")}          ${tenant.name} (${tenant.slug})`,
+    existing ? `${pc.dim("Updating")}        ${existing.technicalName} (${existing.id}) [${existing.provisioningStatus ?? "?"}]` : `${pc.dim("Action")}          create new`
+  ].filter(Boolean);
+  p.note(reviewLines.join("\n"), "Review");
+  const confirmMessage = existing ? `Update app "${existing.technicalName}" in tenant "${tenant.name}"?` : `Create app "${summary.name}" in tenant "${tenant.name}"?`;
+  const confirm2 = await confirmAction(opts, confirmMessage, existing !== null);
+  if (!confirm2) bail("Cancelled.");
+  if (existing) {
+    spinner3.start("Updating manifest");
+    try {
+      await updateAppManifest(opts.api, jwt, tenant.id, existing.id, manifest);
+      spinner3.stop("Manifest updated");
+    } catch (err) {
+      spinner3.stop("Failed to update manifest");
+      bail(err.message);
+    }
+    if (existing.clientId) {
+      const labels = credentialLabels(backend);
+      const envFile = backend.kind === "node" ? backend.envFile : backend.settingsFile;
+      const localCreds = readExistingCredentials(backend);
+      const hasLocalCreds = !!(localCreds.clientId && localCreds.clientSecret);
+      if (!hasLocalCreds) {
+        p.outro(
+          pc.yellow(
+            `Manifest updated. Your backend config is missing ${labels.pair} \u2014 they can't be recovered. Re-create the app to get a fresh secret.`
+          )
+        );
+        return;
+      }
+      p.outro(
+        pc.green(
+          `Manifest updated. Existing ${labels.pair} in ${pc.cyan(path.relative(root, envFile))} kept as-is.`
+        )
+      );
+    } else {
+      p.outro(pc.green("Manifest updated."));
+    }
+    return;
+  }
+  spinner3.start("Creating draft app");
+  let appId;
+  try {
+    appId = await createDraftApp(opts.api, jwt, tenant.id, manifest);
+    spinner3.stop(`Created app ${pc.cyan(appId)}`);
+  } catch (err) {
+    spinner3.stop("Failed to create app");
+    bail(err.message);
+  }
+  spinner3.start("Provisioning app");
+  let clientId;
+  let clientSecret;
+  try {
+    ({ clientId, clientSecret } = await provisionApp(
+      opts.api,
+      jwt,
+      tenant.id,
+      appId
+    ));
+    spinner3.stop("Provisioned");
+  } catch (err) {
+    spinner3.stop("Failed to provision app");
+    bail(err.message);
+  }
+  await persistCredentials(backend, clientId, clientSecret, root, opts);
+}
+
+// src/scaffold.ts
+import crypto2 from "crypto";
+import fs2 from "fs";
+import path2 from "path";
 function toPascalCase(kebab) {
   return kebab.split("-").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
 }
@@ -15,7 +937,7 @@ function slugify(input) {
   return input.toLowerCase().normalize("NFKD").replace(/[̀-ͯ]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function buildTechnicalName(appName) {
-  const hash = crypto.randomBytes(3).toString("hex");
+  const hash = crypto2.randomBytes(3).toString("hex");
   return `${slugify(appName)}-${hash}`;
 }
 var SHORT_DESCRIPTION_MAX_LENGTH = 150;
@@ -53,9 +975,9 @@ function transformPackageJson(content, appName, templateType, replacements) {
   return result + "\n";
 }
 function copyDir(src, dest, replacements, templateType, appName) {
-  fs.mkdirSync(dest, { recursive: true });
-  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path.join(src, entry.name);
+  fs2.mkdirSync(dest, { recursive: true });
+  for (const entry of fs2.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path2.join(src, entry.name);
     let destName = entry.name;
     if (destName.startsWith("_git")) {
       destName = `.${destName.slice(1)}`;
@@ -63,25 +985,25 @@ function copyDir(src, dest, replacements, templateType, appName) {
     for (const [key, value] of Object.entries(replacements)) {
       destName = destName.replaceAll(key, value);
     }
-    const destPath = path.join(dest, destName);
+    const destPath = path2.join(dest, destName);
     if (entry.isDirectory()) {
       copyDir(srcPath, destPath, replacements);
     } else if (entry.name === "package.json" && templateType && appName) {
-      const content = fs.readFileSync(srcPath, "utf-8");
-      fs.writeFileSync(
+      const content = fs2.readFileSync(srcPath, "utf-8");
+      fs2.writeFileSync(
         destPath,
         transformPackageJson(content, appName, templateType, replacements)
       );
     } else {
-      const ext = path.extname(entry.name).toLowerCase();
+      const ext = path2.extname(entry.name).toLowerCase();
       if (BINARY_EXTENSIONS.has(ext)) {
-        fs.copyFileSync(srcPath, destPath);
+        fs2.copyFileSync(srcPath, destPath);
       } else {
-        let content = fs.readFileSync(srcPath, "utf-8");
+        let content = fs2.readFileSync(srcPath, "utf-8");
         for (const [key, value] of Object.entries(replacements)) {
           content = content.replaceAll(key, value);
         }
-        fs.writeFileSync(destPath, content);
+        fs2.writeFileSync(destPath, content);
       }
     }
   }
@@ -106,7 +1028,7 @@ async function scaffold({
   shared,
   targetDir: customTargetDir
 }) {
-  const targetDir = customTargetDir ?? path.resolve(process.cwd(), appName);
+  const targetDir = customTargetDir ?? path2.resolve(process.cwd(), appName);
   const pascalName = toPascalCase(appName);
   const baseReplacements = {
     "{{APP_NAME}}": appName,
@@ -115,12 +1037,12 @@ async function scaffold({
     "{{APP_DESCRIPTION}}": description,
     "{{APP_DESCRIPTION_SHORT}}": buildShortDescription(description)
   };
-  if (fs.existsSync(targetDir)) {
+  if (fs2.existsSync(targetDir)) {
     throw new Error(`Directory "${appName}" already exists`);
   }
-  fs.mkdirSync(targetDir, { recursive: true });
+  fs2.mkdirSync(targetDir, { recursive: true });
   copyDir(shared.dir, targetDir, baseReplacements);
-  const frontendDest = path.join(targetDir, "packages", "frontend");
+  const frontendDest = path2.join(targetDir, "packages", "frontend");
   const frontendReplacements = buildReplacements(baseReplacements, frontend);
   copyDir(
     frontend.dir,
@@ -129,7 +1051,7 @@ async function scaffold({
     frontend.meta.type,
     appName
   );
-  const backendDest = path.join(targetDir, "packages", "backend");
+  const backendDest = path2.join(targetDir, "packages", "backend");
   const backendReplacements = buildReplacements(baseReplacements, backend);
   copyDir(
     backend.dir,
@@ -141,8 +1063,8 @@ async function scaffold({
   const runtimeVersions = backend.meta.runtimeVersions ?? {};
   if (Object.keys(runtimeVersions).length > 0) {
     const toolVersions = Object.entries(runtimeVersions).map(([tool, version]) => `${tool} ${version}`).join("\n");
-    fs.writeFileSync(
-      path.join(targetDir, ".tool-versions"),
+    fs2.writeFileSync(
+      path2.join(targetDir, ".tool-versions"),
       toolVersions + "\n"
     );
   }
@@ -150,44 +1072,48 @@ async function scaffold({
     name: appName,
     version: "1.0.0",
     private: true,
+    engines: {
+      node: ">=24"
+    },
     workspaces: ["packages/*"],
     scripts: {
       dev: "turbo dev",
       build: "turbo build",
       lint: "turbo lint",
-      test: "turbo test"
+      test: "turbo test",
+      register: "npx -y @jtl-software/create-cloud-app@latest register"
     },
     packageManager: "npm@10.8.2",
     devDependencies: {
       turbo: "^2.5.5"
     }
   };
-  fs.writeFileSync(
-    path.join(targetDir, "package.json"),
+  fs2.writeFileSync(
+    path2.join(targetDir, "package.json"),
     JSON.stringify(rootPackageJson, null, 2) + "\n"
   );
 }
 
 // src/templates.ts
-import fs2 from "fs";
-import path2 from "path";
+import fs3 from "fs";
+import path3 from "path";
 import { createRequire } from "module";
 var require2 = createRequire(import.meta.url);
 function discoverTemplates() {
   const cliPkgPath = require2.resolve("@jtl-software/create-cloud-app/package.json");
-  const cliPkg = JSON.parse(fs2.readFileSync(cliPkgPath, "utf-8"));
+  const cliPkg = JSON.parse(fs3.readFileSync(cliPkgPath, "utf-8"));
   const deps = cliPkg.dependencies ?? {};
   const templates = [];
   for (const packageName of Object.keys(deps)) {
     if (!packageName.startsWith("@jtl-software/cloud-app-template-")) continue;
     try {
       const pkgJsonPath = require2.resolve(`${packageName}/package.json`);
-      const pkg = JSON.parse(fs2.readFileSync(pkgJsonPath, "utf-8"));
+      const pkg = JSON.parse(fs3.readFileSync(pkgJsonPath, "utf-8"));
       const meta = pkg.cloudAppTemplate;
       if (!meta?.type) continue;
       templates.push({
         packageName,
-        dir: path2.dirname(pkgJsonPath),
+        dir: path3.dirname(pkgJsonPath),
         meta
       });
     } catch {
@@ -200,20 +1126,20 @@ function getTemplatesByType(templates, type) {
 }
 
 // src/index.ts
-async function main() {
+async function runScaffold() {
   console.log();
-  p.intro(pc.bgCyan(pc.black(" create-cloud-app ")));
+  p2.intro(pc2.bgCyan(pc2.black(" create-cloud-app ")));
   const templates = discoverTemplates();
   const backends = getTemplatesByType(templates, "backend");
   const frontends = getTemplatesByType(templates, "frontend");
   const shared = templates.find((t) => t.meta.type === "shared");
   if (!backends.length || !frontends.length || !shared) {
-    p.cancel("No templates found. Ensure template packages are installed.");
+    p2.cancel("No templates found. Ensure template packages are installed.");
     process.exit(1);
   }
-  const answers = await p.group(
+  const answers = await p2.group(
     {
-      appName: () => p.text({
+      appName: () => p2.text({
         message: "App name",
         placeholder: "my-jtl-app",
         validate: (value) => {
@@ -222,11 +1148,11 @@ async function main() {
             return "Use lowercase letters, numbers, and hyphens only";
         }
       }),
-      description: () => p.text({
+      description: () => p2.text({
         message: "Description",
         placeholder: "A JTL Platform app"
       }),
-      backend: () => p.select({
+      backend: () => p2.select({
         message: "Backend",
         options: backends.map((t) => ({
           value: t.packageName,
@@ -234,7 +1160,7 @@ async function main() {
           hint: t.meta.hint
         }))
       }),
-      frontend: () => p.select({
+      frontend: () => p2.select({
         message: "Frontend",
         options: frontends.map((t) => ({
           value: t.packageName,
@@ -245,7 +1171,7 @@ async function main() {
     },
     {
       onCancel: () => {
-        p.cancel("Cancelled.");
+        p2.cancel("Cancelled.");
         process.exit(0);
       }
     }
@@ -256,7 +1182,7 @@ async function main() {
   const selectedFrontend = templates.find(
     (t) => t.packageName === answers.frontend
   );
-  const s = p.spinner();
+  const s = p2.spinner();
   s.start("Scaffolding project");
   await scaffold({
     appName: answers.appName,
@@ -266,16 +1192,28 @@ async function main() {
     shared
   });
   s.stop("Project scaffolded");
-  p.note(
+  p2.note(
     [
-      `${pc.cyan("cd")} ${answers.appName}`,
-      `${pc.cyan("npm install")}`,
-      `${pc.cyan("npm run dev")}`,
-      "",
-      pc.dim("Then register your manifest in the Partner Portal.")
+      `${pc2.cyan("cd")} ${answers.appName}`,
+      `${pc2.cyan("npm install")}`,
+      `${pc2.cyan("npm run register")}`,
+      `${pc2.cyan("npm run dev")}`
     ].join("\n"),
     "Next steps"
   );
-  p.outro(pc.green("Done! Happy building."));
+  p2.outro(pc2.green("Done! Happy building."));
+}
+async function main() {
+  if (process.argv[2] === "register") {
+    await register(process.argv.slice(3));
+    return;
+  }
+  await runScaffold();
 }
-main().catch(console.error);
+main().catch((err) => {
+  if (err instanceof BailError) {
+    process.exit(1);
+  }
+  console.error(err);
+  process.exit(1);
+});

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@jtl-software/create-cloud-app",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "type": "module",
   "description": "CLI tool for scaffolding JTL Platform cloud apps",
   "bin": {
     "create-cloud-app": "./dist/index.js"
   },
+  "engines": {
+    "node": ">=24"
+  },
   "files": [
     "dist"
   ],
@@ -15,14 +18,15 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.2.0",
-    "@jtl-software/cloud-app-template-frontend-react": "0.0.12",
-    "@jtl-software/cloud-app-template-backend-node": "0.0.10",
-    "@jtl-software/cloud-app-template-backend-dotnet": "0.0.8",
-    "@jtl-software/cloud-app-template-shared": "0.0.3",
+    "@jtl-software/cloud-app-template-backend-dotnet": "0.0.10",
+    "@jtl-software/cloud-app-template-backend-node": "0.0.12",
+    "@jtl-software/cloud-app-template-frontend-react": "0.0.14",
+    "@jtl-software/cloud-app-template-shared": "0.0.5",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
     "@types/node": "^22.14.0",
+    "msw": "^2.14.6",
     "tsup": "^8.4.0",
     "tsx": "^4.19.3",
     "typescript": "^6.0.2"