@raisenow/tamaro-cli 1.8.0 → 1.9.0-dev.2

package/README.md

@@ -185,7 +185,9 @@ Deploy a pre-built _Tamaro Core_ or customer configuration bundle to AWS S3.
 
 ### Options
 
+- `--dryrun` – Displays the operations that would be performed without actually running them
 - `--tag <tag>` – Tag which should be used for the deployment of the bundle (default: "latest")
+- `--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired` – Skip the EPMS sync entirely. Only use this in emergencies.
 
 Make sure you have built the bundle before deploying it with this command, otherwise you may mistakenly deploy the
 bundle from a previous build.
@@ -287,6 +289,15 @@ cd /path/to/tamaro-configurations/configs/example-02-typical-customisations
 npx -y @raisenow/tamaro-cli undeploy-email-config
 ```
 
+## `update-epms`
+
+Sync the Tamaro configuration with EPMS (without deploying it). 
+
+## Options
+
+- `--dryrun` – Displays the operations that would be performed without actually running them
+- `--tag <tag>` – Tag which should be used for the deployment of the bundle (default: "latest")
+
 ## `archive`
 
 Archive a customer configuration. This moves the configuration folder into the `_archived` folder.

package/dist/cli.js

@@ -1,15 +1,23 @@
 #!/usr/bin/env node
-import { C as promptConfirmation, D as logError, E as logDataTable, O as logSuccess, S as halt, T as logCommand, _ as getWidgetUuid, a as AWS_S3_BUCKET_TAMARO, c as CORE_CONFIG_NAME, d as HTTPS_CRT_FILE, f as HTTPS_KEY_FILE, h as getPaths, i as AWS_CLOUDFRONT_DISTRIBUTION_ID, k as logTitle, l as DEFAULT_PORT, m as getIfCoreFns, n as assertEnvValid, o as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD, s as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE, t as applyEnv, u as DEFAULT_TAG, w as runCommandSync, x as resolveOwn, y as resolveBin } from "./env-CSg7BrvF.js";
+import { A as HTTPS_CRT_FILE, B as logSuccess, C as DEFAULT_PORT, D as EPMS_AUTH_BASE_URL_PROD, E as EPMS_API_BASE_URL_STAGE, F as createTerminalLink, I as logCommand, L as logDataTable, M as halt, N as promptConfirmation, O as EPMS_AUTH_BASE_URL_STAGE, P as runCommandSync, R as logError, S as DEFAULT_HTTP_TIMEOUT, T as EPMS_API_BASE_URL_PROD, V as logTitle, _ as AWS_S3_BUCKET_TAMARO, a as getIfCoreFns, b as CACHE_DIR, c as getWidgetUuid, d as resolveBin, f as resolveCoreVersion, g as AWS_CLOUDFRONT_DISTRIBUTION_ID, h as AUTH_PORT, j as HTTPS_KEY_FILE, k as EPMS_OAUTH_CLIENT_ID, l as resolveAccountUuidFromConfig, m as resolveOwn, n as assertEnvValid, o as getPaths, t as applyEnv, v as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD, w as DEFAULT_TAG, x as CORE_CONFIG_NAME, y as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE, z as logInfo } from "./env-DBP70I1v.js";
 import { createCommand } from "commander";
-import fs, { existsSync, mkdirSync, renameSync } from "node:fs";
+import fs, { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import { S3 } from "@aws-sdk/client-s3";
 import { execaCommandSync } from "execa";
 import prompts from "prompts";
 import stripIndent from "strip-indent";
+import columnify from "columnify";
 import notifier from "node-notifier";
+import { z } from "zod";
 import { globSync } from "glob";
 import Handlebars from "handlebars";
 import helpers from "handlebars-helpers";
+import { config } from "dotenv";
+import * as yaml from "js-yaml";
+import ky from "ky";
+import { createServer } from "node:http";
+import open from "open";
 import { getPortPromise } from "portfinder";
 //#region src/lib/aws.ts
 const awsAuthenticate = (options) => {
@@ -83,6 +91,28 @@ const promptProfile = async () => {
 	}], { onCancel: () => halt() });
 	return profile;
 };
+const s3 = new S3({});
+const getConfigDeployments = async (configName) => {
+	const widgetJs = (await s3.listObjectsV2({
+		Bucket: "tamaro.raisenow.com",
+		Prefix: `${configName}/`
+	})).Contents?.filter((file) => file.Key?.endsWith(`/index.html`)) ?? [];
+	const deployments = [];
+	for (const file of widgetJs) {
+		const key = file.Key ?? "";
+		const parts = key.split("/");
+		if (parts.length < 2 || !file.LastModified) continue;
+		const tag = parts.at(-2);
+		const date = file.LastModified.toISOString();
+		const fullUrl = `https://${AWS_S3_BUCKET_TAMARO}/${key}`;
+		deployments.push({
+			date,
+			fullUrl,
+			tag
+		});
+	}
+	return deployments;
+};
 //#endregion
 //#region src/lib/notifier.ts
 const notify = (args) => {
@@ -98,7 +128,7 @@ const notify = (args) => {
 //#region src/commands/archive.ts
 const archive = (options) => {
 	const { ifCore } = getIfCoreFns();
-	assertIsNotCore$3(ifCore);
+	assertIsNotCore$4(ifCore);
 	assertIsNotArchived();
 	const configName = getWidgetUuid();
 	const cwd = process.cwd();
@@ -124,7 +154,7 @@ const assertOptionsValid$9 = (options) => {
 	const { profile } = options;
 	if (profile) assertProfileValid(profile);
 };
-const assertIsNotCore$3 = (ifCore) => {
+const assertIsNotCore$4 = (ifCore) => {
 	if (ifCore()) halt("You cannot archive Tamaro Core.");
 };
 const assertIsNotArchived = () => {
@@ -324,6 +354,383 @@ const assertTagValid = (tag) => {
 	if (!regex.test(tag)) halt(`Flag "--tag" has forbidden format. Allowed format: ${regex.toString()}.`);
 };
 //#endregion
+//#region src/lib/epms/auth/util.ts
+const CachedTokenSchema = z.object({
+	expirationTime: z.number(),
+	token: z.string()
+});
+const AuthResponseSchema = z.object({
+	access_token: z.string(),
+	expires_in: z.number(),
+	token_type: z.string()
+});
+const getCacheFilePath = (key) => {
+	const cacheKey = Buffer.from(key).toString("base64url");
+	return path.join(CACHE_DIR, `token-${cacheKey}.json`);
+};
+const getTokenCacheKey = (baseUrl, clientId) => {
+	return `${baseUrl}|${clientId}`;
+};
+const readCachedToken = (key) => {
+	try {
+		const filePath = getCacheFilePath(key);
+		if (!existsSync(filePath)) return;
+		const data = JSON.parse(readFileSync(filePath, "utf8"));
+		const parsed = CachedTokenSchema.safeParse(data);
+		if (parsed.success) return parsed.data;
+	} catch {}
+};
+const writeCachedToken = (key, cached) => {
+	try {
+		const filePath = getCacheFilePath(key);
+		mkdirSync(path.dirname(filePath), { recursive: true });
+		writeFileSync(filePath, JSON.stringify(cached), { mode: 384 });
+	} catch {}
+};
+const removeCachedToken = (key) => {
+	try {
+		const filePath = getCacheFilePath(key);
+		if (existsSync(filePath)) writeFileSync(filePath, "", { flag: "w" });
+	} catch {}
+};
+//#endregion
+//#region src/lib/epms/auth/apiClient.ts
+const createAuthorizer = (baseUrl, clientId, clientSecret) => {
+	const apiUnauthorized = ky.extend({
+		headers: { "Access-Control-Allow-Origin": "*" },
+		prefixUrl: baseUrl,
+		retry: { limit: 3 },
+		timeout: DEFAULT_HTTP_TIMEOUT
+	});
+	let expirationTime = void 0;
+	let token = void 0;
+	const cacheKey = getTokenCacheKey(baseUrl, clientId);
+	const cached = readCachedToken(cacheKey);
+	if (cached) {
+		token = cached.token;
+		expirationTime = cached.expirationTime;
+	}
+	const authorize = async () => {
+		const isExpired = (expirationTime ?? 0) - Date.now() < 300 * 1e3;
+		if (token && !isExpired) return token;
+		const data = await apiUnauthorized.post("oauth2/token", { json: {
+			client_id: clientId,
+			client_secret: clientSecret,
+			grant_type: "client_credentials"
+		} }).json();
+		token = `${data.token_type} ${data.access_token}`;
+		expirationTime = Date.now() + data.expires_in * 1e3;
+		writeCachedToken(cacheKey, {
+			expirationTime,
+			token
+		});
+		return token;
+	};
+	return apiUnauthorized.extend({ hooks: { beforeRequest: [async (request) => {
+		const authToken = await authorize();
+		request.headers.set("Authorization", authToken);
+	}] } });
+};
+//#endregion
+//#region src/lib/epms/auth/authCallback.html
+var authCallback_default = "<!doctype html>\n<html>\n  <head\n    ><title>Authenticating</title></head\n  >\n  <body>\n    <p>Authenticating</p>\n    <script>\n      const hash = window.location.hash.substring(1)\n      const params = new URLSearchParams(hash)\n      const data = {\n        access_token: params.get('access_token'),\n        token_type: params.get('token_type'),\n        expires_in: parseInt(params.get('expires_in') || '0', 10),\n      }\n      fetch('/token', {\n        method: 'POST',\n        headers: {'Content-Type': 'application/json'},\n        body: JSON.stringify(data),\n      })\n        .then(() => {\n          document.querySelector('p').textContent =\n            'Authentication successful! You can close this tab.'\n        })\n        .catch(() => {\n          document.querySelector('p').textContent =\n            'Authentication failed. Please try again.'\n        })\n    <\/script>\n  </body>\n</html>\n";
+//#endregion
+//#region src/lib/epms/auth/browser.ts
+/**
+* The following authentication method is a browser-based OAuth flow.
+* A very similar flow is used by tools like AWS CLI when running `aws sso login` or Claude Code.
+*
+* The flow works as follows:
+* 1. The CLI starts a temporary local HTTP server that listens for the OAuth callback.
+* 2. The CLI opens the user's default web browser and navigates to the EPMS authorization URL, passing the local server's callback URL as the redirect_uri.
+* 3. The user authenticates in the browser, and the OAuth server redirects back to the local server with the authorization token.
+* 4. The local server captures the token and resolves the promise, completing the authentication flow.
+*
+*
+* We also implement a simple caching mechanism that stores the token in a file in the user's home directory.
+* This allows us to reuse the token for subsequent requests until it expires, at which point we automatically trigger a new authentication flow.
+*/
+const doBrowserOAuthFlow = (authBaseUrl, clientId, port) => {
+	return new Promise((resolve, reject) => {
+		const server = createServer((req, res) => {
+			if (req.method === "POST" && req.url === "/token") {
+				let body = "";
+				req.on("data", (chunk) => {
+					body += chunk.toString();
+				});
+				req.on("end", () => {
+					try {
+						const data = AuthResponseSchema.parse(JSON.parse(body));
+						res.writeHead(200);
+						res.end();
+						server.close();
+						resolve(data);
+					} catch (error) {
+						res.writeHead(400);
+						res.end();
+						reject(error instanceof Error ? error : new Error(String(error)));
+					}
+				});
+			} else {
+				res.writeHead(200, { "Content-Type": "text/html" });
+				res.end(authCallback_default);
+			}
+		});
+		server.on("error", reject);
+		server.listen(port, () => {
+			const redirectUri = `http://localhost:${port}`;
+			const authUrl = `${authBaseUrl}/oauth2/authorize?client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&response_type=token`;
+			logInfo("\nℹ️  Log in with your super admin account in the browser to continue.");
+			console.log(`Opening browser for authentication...`);
+			console.log(createTerminalLink(authUrl, authUrl));
+			open(authUrl).catch((error) => {
+				reject(error instanceof Error ? error : new Error(String(error)));
+			});
+		});
+	});
+};
+const createBrowserAuthorizer = (authBaseUrl, clientId, epmsBaseUrl) => {
+	const apiBase = ky.extend({
+		prefixUrl: epmsBaseUrl,
+		retry: { limit: 3 },
+		timeout: DEFAULT_HTTP_TIMEOUT
+	});
+	let expirationTime = void 0;
+	let token = void 0;
+	const cacheKey = getTokenCacheKey(authBaseUrl, clientId);
+	const cached = readCachedToken(cacheKey);
+	if (cached) {
+		token = cached.token;
+		expirationTime = cached.expirationTime;
+	}
+	const resetAuth = () => {
+		token = void 0;
+		expirationTime = void 0;
+		removeCachedToken(cacheKey);
+	};
+	const authorize = async () => {
+		const isExpired = (expirationTime ?? 0) - Date.now() < 300 * 1e3;
+		if (token && !isExpired) return token;
+		const data = await doBrowserOAuthFlow(authBaseUrl, clientId, AUTH_PORT);
+		token = `${data.token_type} ${data.access_token}`;
+		expirationTime = Date.now() + data.expires_in * 1e3;
+		writeCachedToken(cacheKey, {
+			expirationTime,
+			token
+		});
+		return token;
+	};
+	return apiBase.extend({ hooks: {
+		afterResponse: [async (request, options, response) => {
+			if (response.status === 401) {
+				resetAuth();
+				const newToken = await authorize();
+				const newRequest = new Request(request, { headers: new Headers(request.headers) });
+				newRequest.headers.set("Authorization", newToken);
+				return ky(newRequest, options);
+			}
+			return response;
+		}],
+		beforeRequest: [async (request) => {
+			const authToken = await authorize();
+			request.headers.set("Authorization", authToken);
+		}]
+	} });
+};
+//#endregion
+//#region src/lib/epms/myselfSchema.ts
+const myselfSchema = z.object({
+	email: z.string(),
+	identity_roles: z.array(z.object({
+		identity_uuid: z.string(),
+		role: z.object({
+			name: z.string(),
+			uuid: z.string()
+		})
+	})),
+	uuid: z.string()
+});
+//#endregion
+//#region src/lib/epms/epmsClient.ts
+/**
+* Manages authentication and API interactions with EPMS.
+* It provides factory methods for creating instances based on different authentication flows (client credentials or browser-based) and handles token caching and renewal transparently.
+*/
+var EpmsClient = class EpmsClient {
+	#cacheKey;
+	#epmsClient;
+	#authType;
+	/**
+	* Creates an instance of EpmsClient.
+	*
+	* @param authType The type of authentication used by the client.
+	* @param cacheKey They key used for caching the token so that the client can manage the cache (e.g. clear it on logout). It should be unique per EPMS environment and client ID.
+	* @param epmsClient The underlying KyInstance used for making API requests.
+	*/
+	constructor(authType, cacheKey, epmsClient) {
+		this.#authType = authType;
+		this.#cacheKey = cacheKey;
+		this.#epmsClient = epmsClient;
+	}
+	static fromClientCredentials(baseUrl, clientId, clientSecret) {
+		return new EpmsClient("client_credentials", getTokenCacheKey(baseUrl, clientId), createAuthorizer(baseUrl, clientId, clientSecret));
+	}
+	static fromBrowserAuth(epmsBaseUrl, authBaseUrl, clientId) {
+		return new EpmsClient("browser", getTokenCacheKey(authBaseUrl, clientId), createBrowserAuthorizer(authBaseUrl, clientId, epmsBaseUrl));
+	}
+	get authType() {
+		return this.#authType;
+	}
+	logout() {
+		removeCachedToken(this.#cacheKey);
+	}
+	async myself() {
+		return this.#epmsClient.get("users/myself").json().then((response) => myselfSchema.parse(response));
+	}
+	async getOrganisationIdByAccountUuid(accountUuid) {
+		const query = {
+			from: 0,
+			query: { $and: [{ $term: { object_uuid: accountUuid } }, { $term: { object: "account" } }] },
+			size: 1
+		};
+		const response = await this.#epmsClient.post("search/events", { json: query }).json();
+		if (response.hits.length === 0) throw new Error(`No organisation found for account UUID: ${accountUuid}`);
+		const organisationId = response.hits[0].organisation_uuid;
+		if (!organisationId) throw new Error(`Organisation UUID not found for account UUID: ${accountUuid}`);
+		return organisationId;
+	}
+	async updateTamaro(configName, tag, json) {
+		return this.#epmsClient.put(`products/tamaro/${configName}/tags/${tag}`, { json }).json();
+	}
+	async archiveTamaro(configName, tag) {
+		return this.#epmsClient.post(`products/tamaro/${configName}/tags/${tag}/archive`).json();
+	}
+};
+//#endregion
+//#region src/lib/epms/helpers.ts
+const epmsAuthenticate = (env) => {
+	const { authBaseUrl, baseUrl, clientId, clientSecret } = {
+		prod: {
+			authBaseUrl: EPMS_AUTH_BASE_URL_PROD,
+			baseUrl: EPMS_API_BASE_URL_PROD,
+			clientId: process.env.EPMS_CLIENT_ID,
+			clientSecret: process.env.EPMS_CLIENT_SECRET
+		},
+		stage: {
+			authBaseUrl: EPMS_AUTH_BASE_URL_STAGE,
+			baseUrl: EPMS_API_BASE_URL_STAGE,
+			clientId: process.env.EPMS_CLIENT_ID_STAGE,
+			clientSecret: process.env.EPMS_CLIENT_SECRET_STAGE
+		}
+	}[env];
+	if (clientId && clientSecret) return EpmsClient.fromClientCredentials(baseUrl, clientId, clientSecret);
+	return EpmsClient.fromBrowserAuth(baseUrl, authBaseUrl, EPMS_OAUTH_CLIENT_ID);
+};
+const loadAccountUuidsFromConfig = (paths) => {
+	if (!("configYml" in paths)) {
+		halt("Fatal error, this should never happen");
+		throw new Error("Fatal error");
+	}
+	const configContent = yaml.load(readFileSync(paths.configYml, "utf8"));
+	const accountUuidStage = resolveAccountUuidFromConfig(configContent, "epms_stage");
+	return {
+		accountUuidProd: resolveAccountUuidFromConfig(configContent, "epms"),
+		accountUuidStage
+	};
+};
+const assertUserIsSuperAdmin = async (epmsClient) => {
+	if (epmsClient.authType === "client_credentials") return;
+	const myself = await epmsClient.myself();
+	if (!myself.identity_roles.some(({ role }) => role.name === "super_admin")) {
+		epmsClient.logout();
+		logError("\nYou must be a super admin to perform this action.");
+		logTitle("\nYour EPMS user details:");
+		logDataTable({
+			email: myself.email,
+			roles: myself.identity_roles.map(({ role }) => role.name).join(", "),
+			uuid: myself.uuid
+		});
+		logError("If this keeps happening, go to Configurator / Hub and logout before trying again.");
+		halt();
+	}
+};
+//#endregion
+//#region src/commands/update-epms.ts
+const updateEpms = async (options) => {
+	const { ifCore } = getIfCoreFns();
+	assertIsNotCore$3(ifCore);
+	if (!options.profile && !options.ci) {
+		assertProfilesPresent();
+		options.profile = await promptProfile();
+	}
+	if (options.profile) {
+		assertProfileValid(options.profile);
+		process.env.AWS_PROFILE = options.profile;
+	}
+	awsAuthenticate(options);
+	const paths = getPaths(ifCore);
+	const { dryrun, tag } = options;
+	const configName = getWidgetUuid();
+	loadEnv(paths);
+	const { accountUuidProd, accountUuidStage } = loadAccountUuidsFromConfig(paths);
+	if (!accountUuidProd && !accountUuidStage) {
+		logTitle("No EPMS account UUIDs found in config.yml. Skipping EPMS update.");
+		return;
+	}
+	if (dryrun) logTitle("🧪 DRY RUN MODE - No actual changes will be made 🧪");
+	const configuredVersion = resolveCoreVersion();
+	if (!configuredVersion) {
+		logTitle("⚠️ Could not determine the configured Tamaro version. Please ensure that the CORE_VERSION environment variable is set or that the CORE_URL environment variable contains a valid Tamaro version.");
+		logTitle("This may be expected behaviour if you are using a custom build of Tamaro Core. If so, you can safely ignore this warning. ⚠️");
+	}
+	const baseInfo = {
+		configured_version: configuredVersion ?? "unknown",
+		last_deployment: Math.trunc(Date.now() / 1e3),
+		read_only: false
+	};
+	const environments = [{
+		accountUuid: accountUuidStage,
+		env: "stage",
+		label: "Stage"
+	}, {
+		accountUuid: accountUuidProd,
+		env: "prod",
+		label: "Prod"
+	}];
+	for (const { accountUuid, env, label } of environments) {
+		if (!accountUuid) continue;
+		const epmsClient = epmsAuthenticate(env);
+		await assertUserIsSuperAdmin(epmsClient);
+		const organisationUuid = await epmsClient.getOrganisationIdByAccountUuid(accountUuid);
+		const body = {
+			...baseInfo,
+			account_uuid: accountUuid,
+			organisation_uuid: organisationUuid
+		};
+		logTitle(`\nUpdating EPMS ${label}:`);
+		logDataTable({
+			name: configName,
+			tag,
+			...body
+		});
+		if (!dryrun) {
+			await epmsClient.updateTamaro(configName, tag, body);
+			logSuccess(`✅ EPMS ${label} is updated.`);
+		} else logSuccess(`⏭️ EPMS ${label} would be updated (dry run).`);
+	}
+};
+const loadEnv = (paths) => {
+	const filePath = globSync(paths.appEnv).find((file) => path.basename(file) === ".env");
+	if (!filePath) halt("No \".env\" file found. Are you in the folder of the Tamaro configuration?");
+	config({
+		path: filePath,
+		quiet: true
+	});
+};
+const assertIsNotCore$3 = (ifCore) => {
+	if (ifCore()) halt("You cannot update EPMS in the context of Tamaro Core.");
+};
+//#endregion
 //#region src/commands/deploy.ts
 const deploy = async (options) => {
 	const { ifCore } = getIfCoreFns();
@@ -395,6 +802,8 @@ const deploy = async (options) => {
 			halt(error.stderr);
 		}
 	}
+	if (options.skipEpmsSyncOnlyUseInEmergenciesOrYouWillBeFired) logTitle("⚠️  EPMS sync skipped. You better know what you are doing.");
+	else await updateEpms(options);
 	const demoPage = `https://${AWS_S3_BUCKET_TAMARO}/${configName}/${tag}/index.html`;
 	const entryPoint = `https://${AWS_S3_BUCKET_TAMARO}/${configName}/${tag}/${entryFilename}`;
 	logTitle(`\nBundle for "${configName}" is deployed with tag "${tag}".`);
@@ -543,26 +952,32 @@ const listDeployed = async (options) => {
 	}
 	assertOptionsValid$4(options);
 	awsAuthenticate(options);
-	const flags = prepareFlags$3(options);
-	const { config } = options;
+	const { config, profile } = options;
 	const { ifCore } = getIfCoreFns();
 	const configName = config ?? ifCore("tamaro-core", getWidgetUuid());
-	const title = !config && ifCore() ? `Listing deployments of Tamaro Core …` : `Listing deployments of "${configName}" customer configuration …`;
-	const cmd = `aws s3 ls ${`s3://${AWS_S3_BUCKET_TAMARO}/${configName}/`} ${flags}`;
-	let out = "";
-	logTitle(title);
-	logCommand(cmd);
-	try {
-		out = runCommandSync(cmd).stdout;
-	} catch (error) {
-		out = error.stdout;
-		if (error.stderr) halt(error.stderr);
+	logTitle(!config && ifCore() ? `Listing deployments of Tamaro Core …` : `Listing deployments of "${configName}" customer configuration …`);
+	if (profile) process.env.AWS_PROFILE = profile;
+	const deployments = await getConfigDeployments(configName);
+	if (deployments.length === 0) {
+		console.log("\nNo deployments found.\n");
+		return;
 	}
-	const tags = parseTags(out.split("\n"));
-	const text = tags.length === 0 ? "No deployments found." : tags.map((tag, idx) => {
-		return `${idx + 1}. https://${AWS_S3_BUCKET_TAMARO}/${configName}/${tag}/index.html`;
-	}).join("\n");
-	console.log(`${text}\n`);
+	const table = columnify(deployments.map((deployment, idx) => ({
+		"#": `${idx + 1}`,
+		"Deployed At": deployment.date,
+		Tag: deployment.tag,
+		Preview: createTerminalLink("🔍 Live Preview", deployment.fullUrl)
+	})), {
+		columnSplitter: "  |  ",
+		config: {
+			"#": { minWidth: 2 },
+			"Deployed At": { minWidth: 20 },
+			Preview: { minWidth: 16 },
+			Tag: { minWidth: 14 }
+		},
+		minWidth: 10
+	});
+	console.log(`\n${table}\n`);
 };
 const assertOptionsValid$4 = (options) => {
 	const { config, profile } = options;
@@ -574,10 +989,6 @@ const assertConfigValid = (config) => {
 	const regex = /^[\w-]+$/;
 	if (!regex.test(config)) halt(`Flag "--config" has forbidden format. Allowed format: ${regex.toString()}.`);
 };
-const parseTags = (lines) => {
-	const regex = /^\s*PRE\s*/;
-	return lines.filter((line) => regex.test(line)).map((line) => line.replace(regex, "").replace(/\/$/, ""));
-};
 //#endregion
 //#region src/commands/serve.ts
 const serve = async (options) => {
@@ -669,7 +1080,7 @@ const undeploy = async (options) => {
 	const deployUrl = all ? `s3://${AWS_S3_BUCKET_TAMARO}/${configName}/` : `s3://${AWS_S3_BUCKET_TAMARO}/${configName}/${tag}/`;
 	const description = all ? `all tags of "${configName}"` : `tag "${tag}" of "${configName}"`;
 	if (dryRunFlag) logTitle("🧪 DRY RUN MODE - No actual changes will be made 🧪");
-	await promptConfirmation(`Are you sure you want to undeploy ${description}?`, options.yes);
+	await promptConfirmation(`Are you sure you want to undeploy ${description}?`, options.ci);
 	const cmd = `
     aws s3 rm ${deployUrl}
       --recursive
@@ -698,6 +1109,8 @@ const undeploy = async (options) => {
 			halt(error.stderr);
 		}
 	}
+	if (!dryRunFlag && !all && !ifCore() && !options.skipEpmsSyncOnlyUseInEmergenciesOrYouWillBeFired) await archiveEpms(configName, tag, false);
+	else if (all && !ifCore()) logTitle("⚠️  EPMS archive skipped: --all flag used. Archive entries in EPMS manually if needed.");
 	logTitle(`\n${description} has been undeployed.`);
 	logDataTable({ "Removed URL:": deployUrl });
 	process.on("exit", () => {
@@ -707,6 +1120,33 @@ const undeploy = async (options) => {
 		});
 	});
 };
+const archiveEpms = async (configName, tag, dryrun) => {
+	const { ifCore } = getIfCoreFns();
+	const { accountUuidProd, accountUuidStage } = loadAccountUuidsFromConfig(getPaths(ifCore));
+	if (!accountUuidProd && !accountUuidStage) {
+		logTitle("No EPMS account UUIDs found in config.yml. Skipping EPMS archive.");
+		return;
+	}
+	const environments = [{
+		accountUuid: accountUuidStage,
+		env: "stage",
+		label: "Stage"
+	}, {
+		accountUuid: accountUuidProd,
+		env: "prod",
+		label: "Prod"
+	}];
+	for (const { accountUuid, env, label } of environments) {
+		if (!accountUuid) continue;
+		const epmsClient = epmsAuthenticate(env);
+		await assertUserIsSuperAdmin(epmsClient);
+		logTitle(`\nArchiving EPMS ${label}: ${configName}/${tag}`);
+		if (!dryrun) {
+			await epmsClient.archiveTamaro(configName, tag);
+			logSuccess(`✅ EPMS ${label} entry archived.`);
+		} else logSuccess(`⏭️ EPMS ${label} entry would be archived (dry run).`);
+	}
+};
 const assertOptionsValid$1 = (options) => {
 	const { all, profile, tag } = options;
 	const { ifCore } = getIfCoreFns();
@@ -789,7 +1229,7 @@ const promptBucketTamaroEmailConfig = async () => {
 //#endregion
 //#region package.json
 var name = "@raisenow/tamaro-cli";
-var version = "1.8.0";
+var version = "1.9.0-dev.2";
 //#endregion
 //#region src/cli.ts
 /**
@@ -807,7 +1247,7 @@ const cli = createCommand().name(name).version(version, "-v, --version");
 cli.command("dev").description("Run the local development server for Tamaro Core or a particular customer configuration").option("--local-core", "Load Tamaro Core from localhost:1234 instead of the CDN", false).option("--https", "Let local web server serve Tamaro with SSL encryption", false).option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--env <env>", "Environment (dev, stage, prod)").option("--nolint", "Disable ESLint", false).option("--debug", "Enable debug mode", false).action(async (options) => {
 	await dev(options);
 });
-cli.command("build").description("Build an optimised (minified) bundle of Tamaro Core or a customer configuration").option("--local-core", "Load Tamaro Core from localhost:1234 instead of the CDN", false).option("--analyze", "Generate bundle statistics to \"reports\" folder", false).option("--serve", "Run the generated bundle with a local web server", false).option("--https", "Let local web server serve Tamaro with SSL encryption", false).option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--env <env>", "Environment (dev, stage, prod)").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--deploy", "Deploy Tamaro Core or a customer configuration bundle to AWS S3", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--nolint", "Disable ESLint", false).option("--debug", "Enable debug mode", false).action(async (options) => {
+cli.command("build").description("Build an optimised (minified) bundle of Tamaro Core or a customer configuration").option("--local-core", "Load Tamaro Core from localhost:1234 instead of the CDN", false).option("--analyze", "Generate bundle statistics to \"reports\" folder", false).option("--serve", "Run the generated bundle with a local web server", false).option("--https", "Let local web server serve Tamaro with SSL encryption", false).option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--env <env>", "Environment (dev, stage, prod)").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--deploy", "Deploy Tamaro Core or a customer configuration bundle to AWS S3", false).option("--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired", "Skip the EPMS sync entirely. Only use this in emergencies.", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--nolint", "Disable ESLint", false).option("--debug", "Enable debug mode", false).action(async (options) => {
 	await build(options);
 	if (options.serve) await serve(options);
 	if (options.deploy) await deploy(options);
@@ -815,7 +1255,7 @@ cli.command("build").description("Build an optimised (minified) bundle of Tamaro
 cli.command("serve").description("Run a local web server for pre-built bundle").option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--https", "Let local web server serve Tamaro with SSL encryption", false).action(async (options) => {
 	await serve(options);
 });
-cli.command("deploy").description("Deploy a pre-built Tamaro Core or customer configuration bundle to AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--dryrun", "Displays the operations that would be performed without actually running them", false).action(async (options) => {
+cli.command("deploy").description("Deploy a pre-built Tamaro Core or customer configuration bundle to AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired", "Skip the EPMS sync entirely. Only use this in emergencies.", false).action(async (options) => {
 	await deploy(options);
 });
 cli.command("list-deployed").description("List deployments of Tamaro Core or a particular customer configuration").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--config <config>", "Configuration name (default: current customer configuration)").action(async (options) => {
@@ -824,7 +1264,7 @@ cli.command("list-deployed").description("List deployments of Tamaro Core or a p
 cli.command("deploy-email-config").description("Deploy a widget's email configuration to AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--bucket <bucket>", "AWS bucket for email configs").option("--dryrun", "Displays the operations that would be performed without actually running them", false).action(async (options) => {
 	await deployEmailConfig(options);
 });
-cli.command("undeploy").description("Undeploy a Tamaro Core or customer configuration bundle from AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be undeployed").option("--all", "Undeploy all tags", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).action(async (options) => {
+cli.command("undeploy").description("Undeploy a Tamaro Core or customer configuration bundle from AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be undeployed").option("--all", "Undeploy all tags", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired", "Skip EPMS archive sync (emergency use only)", false).action(async (options) => {
 	await undeploy(options);
 });
 cli.command("undeploy-email-config").description("Undeploy a widget's email configuration from AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--bucket <bucket>", "AWS bucket for email configs").option("--stage", "Undeploy from stage environment (alternative to --bucket)").option("--prod", "Undeploy from prod environment (alternative to --bucket)").option("--dryrun", "Displays the operations that would be performed without actually running them", false).action(async (options) => {
@@ -836,6 +1276,9 @@ cli.command("archive").description("Archive a customer configuration by moving i
 cli.command("unarchive").description("Unarchive a customer configuration by restoring it from the _archived folder").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).action((options) => {
 	unarchive(options);
 });
+cli.command("update-epms").description("Update EPMS with the currently deployed widget tags.").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--tag <tag>", "Tag which should be set for the deployment", DEFAULT_TAG).action(async (options) => {
+	await updateEpms(options);
+});
 cli.command("validate").description("Validate the current Tamaro configuration to avoid common errors").action(async () => {
 	await validate();
 });