@raisenow/tamaro-cli 1.9.0-dev.1 → 1.9.0-dev.3

package/README.md

@@ -187,7 +187,7 @@ Deploy a pre-built _Tamaro Core_ or customer configuration bundle to AWS S3.
 
 - `--dryrun` – Displays the operations that would be performed without actually running them
 - `--tag <tag>` – Tag which should be used for the deployment of the bundle (default: "latest")
-- `--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired` – Skip the EPMS sync entirely. Only use this in emergencies.
+- `--force-skip-epms-sync` – Skip the EPMS sync entirely. Only use this in emergencies.
 
 Make sure you have built the bundle before deploying it with this command, otherwise you may mistakenly deploy the
 bundle from a previous build.

package/dist/cli.js

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
-import { A as EPMS_AUTH_CLIENT_ID_STAGE, B as logSuccess, C as DEFAULT_PORT, D as EPMS_AUTH_BASE_URL_PROD, E as EPMS_API_BASE_URL_STAGE, F as runCommandSync, I as createTerminalLink, L as logCommand, M as HTTPS_KEY_FILE, N as halt, O as EPMS_AUTH_BASE_URL_STAGE, P as promptConfirmation, R as logDataTable, S as DEFAULT_HTTP_TIMEOUT, T as EPMS_API_BASE_URL_PROD, V as logTitle, _ as AWS_S3_BUCKET_TAMARO, a as getIfCoreFns, b as CACHE_DIR, c as getWidgetUuid, d as resolveBin, f as resolveCoreVersion, g as AWS_CLOUDFRONT_DISTRIBUTION_ID, h as AUTH_PORT, j as HTTPS_CRT_FILE, k as EPMS_AUTH_CLIENT_ID_PROD, l as resolveAccountUuidFromConfig, m as resolveOwn, n as assertEnvValid, o as getPaths, t as applyEnv, v as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD, w as DEFAULT_TAG, x as CORE_CONFIG_NAME, y as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE, z as logError } from "./env-JzPIlctP.js";
+import { A as EPMS_OAUTH_CLIENT_ID, B as logInfo, C as DEFAULT_HTTP_TIMEOUT, D as EPMS_API_BASE_URL_STAGE, E as EPMS_API_BASE_URL_PROD, F as runCommandSync, H as logTitle, I as createTerminalLink, L as logCommand, M as HTTPS_KEY_FILE, N as halt, O as EPMS_AUTH_BASE_URL_PROD, P as promptConfirmation, R as logDataTable, S as CORE_CONFIG_NAME, T as DEFAULT_TAG, V as logSuccess, _ as AWS_CLOUDFRONT_DISTRIBUTION_ID, a as getIfCoreFns, b as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE, c as getWidgetUuid, d as resolveBin, f as resolveCoreVersion, g as AUTH_PORT, h as resolveOwn, j as HTTPS_CRT_FILE, k as EPMS_AUTH_BASE_URL_STAGE, l as resolveAccountUuidFromConfig, m as resolveManagedByFromConfig, n as assertEnvValid, o as getPaths, t as applyEnv, v as AWS_S3_BUCKET_TAMARO, w as DEFAULT_PORT, x as CACHE_DIR, y as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD, z as logError } from "./env-DZ3cWM6p.js";
 import { createCommand } from "commander";
 import fs, { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import stripIndent from "strip-indent";
 import { S3 } from "@aws-sdk/client-s3";
 import { execaCommandSync } from "execa";
 import prompts from "prompts";
-import stripIndent from "strip-indent";
 import columnify from "columnify";
-import notifier from "node-notifier";
+import * as yaml from "js-yaml";
 import { z } from "zod";
+import ky from "ky";
+import { createServer } from "node:http";
+import open from "open";
+import notifier from "node-notifier";
 import { globSync } from "glob";
 import Handlebars from "handlebars";
 import helpers from "handlebars-helpers";
 import { config } from "dotenv";
-import * as yaml from "js-yaml";
-import ky from "ky";
-import { createServer } from "node:http";
-import open from "open";
 import { getPortPromise } from "portfinder";
 //#region src/lib/aws.ts
 const awsAuthenticate = (options) => {
@@ -114,6 +114,308 @@ const getConfigDeployments = async (configName) => {
 	return deployments;
 };
 //#endregion
+//#region src/lib/epms/auth/util.ts
+const CachedTokenSchema = z.object({
+	expirationTime: z.number(),
+	token: z.string()
+});
+const AuthResponseSchema = z.object({
+	access_token: z.string(),
+	expires_in: z.number(),
+	token_type: z.string()
+});
+const getCacheFilePath = (key) => {
+	const cacheKey = Buffer.from(key).toString("base64url");
+	return path.join(CACHE_DIR, `token-${cacheKey}.json`);
+};
+const getTokenCacheKey = (baseUrl, clientId) => {
+	return `${baseUrl}|${clientId}`;
+};
+const readCachedToken = (key) => {
+	try {
+		const filePath = getCacheFilePath(key);
+		if (!existsSync(filePath)) return;
+		const data = JSON.parse(readFileSync(filePath, "utf8"));
+		const parsed = CachedTokenSchema.safeParse(data);
+		if (parsed.success) return parsed.data;
+	} catch {}
+};
+const writeCachedToken = (key, cached) => {
+	try {
+		const filePath = getCacheFilePath(key);
+		mkdirSync(path.dirname(filePath), { recursive: true });
+		writeFileSync(filePath, JSON.stringify(cached), { mode: 384 });
+	} catch {}
+};
+const removeCachedToken = (key) => {
+	try {
+		const filePath = getCacheFilePath(key);
+		if (existsSync(filePath)) writeFileSync(filePath, "", { flag: "w" });
+	} catch {}
+};
+//#endregion
+//#region src/lib/epms/auth/apiClient.ts
+const createAuthorizer = (baseUrl, clientId, clientSecret) => {
+	const apiUnauthorized = ky.extend({
+		headers: { "Access-Control-Allow-Origin": "*" },
+		prefixUrl: baseUrl,
+		retry: { limit: 3 },
+		timeout: DEFAULT_HTTP_TIMEOUT
+	});
+	let expirationTime = void 0;
+	let token = void 0;
+	const cacheKey = getTokenCacheKey(baseUrl, clientId);
+	const cached = readCachedToken(cacheKey);
+	if (cached) {
+		token = cached.token;
+		expirationTime = cached.expirationTime;
+	}
+	const authorize = async () => {
+		const isExpired = (expirationTime ?? 0) - Date.now() < 300 * 1e3;
+		if (token && !isExpired) return token;
+		const data = await apiUnauthorized.post("oauth2/token", { json: {
+			client_id: clientId,
+			client_secret: clientSecret,
+			grant_type: "client_credentials"
+		} }).json();
+		token = `${data.token_type} ${data.access_token}`;
+		expirationTime = Date.now() + data.expires_in * 1e3;
+		writeCachedToken(cacheKey, {
+			expirationTime,
+			token
+		});
+		return token;
+	};
+	return apiUnauthorized.extend({ hooks: { beforeRequest: [async (request) => {
+		const authToken = await authorize();
+		request.headers.set("Authorization", authToken);
+	}] } });
+};
+//#endregion
+//#region src/lib/epms/auth/authCallback.html
+var authCallback_default = "<!doctype html>\n<html>\n  <head\n    ><title>Authenticating</title></head\n  >\n  <body>\n    <p>Authenticating</p>\n    <script>\n      const hash = window.location.hash.substring(1)\n      const params = new URLSearchParams(hash)\n      const data = {\n        access_token: params.get('access_token'),\n        token_type: params.get('token_type'),\n        expires_in: parseInt(params.get('expires_in') || '0', 10),\n      }\n      fetch('/token', {\n        method: 'POST',\n        headers: {'Content-Type': 'application/json'},\n        body: JSON.stringify(data),\n      })\n        .then(() => {\n          document.querySelector('p').textContent =\n            'Authentication successful! You can close this tab.'\n        })\n        .catch(() => {\n          document.querySelector('p').textContent =\n            'Authentication failed. Please try again.'\n        })\n    <\/script>\n  </body>\n</html>\n";
+//#endregion
+//#region src/lib/epms/auth/browser.ts
+/**
+* The following authentication method is a browser-based OAuth flow.
+* A very similar flow is used by tools like AWS CLI when running `aws sso login` or Claude Code.
+*
+* The flow works as follows:
+* 1. The CLI starts a temporary local HTTP server that listens for the OAuth callback.
+* 2. The CLI opens the user's default web browser and navigates to the EPMS authorization URL, passing the local server's callback URL as the redirect_uri.
+* 3. The user authenticates in the browser, and the OAuth server redirects back to the local server with the authorization token.
+* 4. The local server captures the token and resolves the promise, completing the authentication flow.
+*
+*
+* We also implement a simple caching mechanism that stores the token in a file in the user's home directory.
+* This allows us to reuse the token for subsequent requests until it expires, at which point we automatically trigger a new authentication flow.
+*/
+const doBrowserOAuthFlow = (authBaseUrl, clientId, port) => {
+	return new Promise((resolve, reject) => {
+		const server = createServer((req, res) => {
+			if (req.method === "POST" && req.url === "/token") {
+				let body = "";
+				req.on("data", (chunk) => {
+					body += chunk.toString();
+				});
+				req.on("end", () => {
+					try {
+						const data = AuthResponseSchema.parse(JSON.parse(body));
+						res.writeHead(200);
+						res.end();
+						server.close();
+						resolve(data);
+					} catch (error) {
+						res.writeHead(400);
+						res.end();
+						reject(error instanceof Error ? error : new Error(String(error)));
+					}
+				});
+			} else {
+				res.writeHead(200, { "Content-Type": "text/html" });
+				res.end(authCallback_default);
+			}
+		});
+		server.on("error", reject);
+		server.listen(port, () => {
+			const redirectUri = `http://localhost:${port}`;
+			const authUrl = `${authBaseUrl}/oauth2/authorize?client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&response_type=token`;
+			logInfo("\nℹ️  Log in with your super admin account in the browser to continue.");
+			console.log(`Opening browser for authentication...`);
+			console.log(createTerminalLink(authUrl, authUrl));
+			open(authUrl).catch((error) => {
+				reject(error instanceof Error ? error : new Error(String(error)));
+			});
+		});
+	});
+};
+const createBrowserAuthorizer = (authBaseUrl, clientId, epmsBaseUrl) => {
+	const apiBase = ky.extend({
+		prefixUrl: epmsBaseUrl,
+		retry: { limit: 3 },
+		timeout: DEFAULT_HTTP_TIMEOUT
+	});
+	let expirationTime = void 0;
+	let token = void 0;
+	const cacheKey = getTokenCacheKey(authBaseUrl, clientId);
+	const cached = readCachedToken(cacheKey);
+	if (cached) {
+		token = cached.token;
+		expirationTime = cached.expirationTime;
+	}
+	const resetAuth = () => {
+		token = void 0;
+		expirationTime = void 0;
+		removeCachedToken(cacheKey);
+	};
+	const authorize = async () => {
+		const isExpired = (expirationTime ?? 0) - Date.now() < 300 * 1e3;
+		if (token && !isExpired) return token;
+		const data = await doBrowserOAuthFlow(authBaseUrl, clientId, AUTH_PORT);
+		token = `${data.token_type} ${data.access_token}`;
+		expirationTime = Date.now() + data.expires_in * 1e3;
+		writeCachedToken(cacheKey, {
+			expirationTime,
+			token
+		});
+		return token;
+	};
+	return apiBase.extend({ hooks: {
+		afterResponse: [async (request, options, response) => {
+			if (response.status === 401) {
+				resetAuth();
+				const newToken = await authorize();
+				const newRequest = new Request(request, { headers: new Headers(request.headers) });
+				newRequest.headers.set("Authorization", newToken);
+				return ky(newRequest, options);
+			}
+			return response;
+		}],
+		beforeRequest: [async (request) => {
+			const authToken = await authorize();
+			request.headers.set("Authorization", authToken);
+		}]
+	} });
+};
+//#endregion
+//#region src/lib/epms/myselfSchema.ts
+const myselfSchema = z.object({
+	email: z.string(),
+	identity_roles: z.array(z.object({
+		identity_uuid: z.string(),
+		role: z.object({
+			name: z.string(),
+			uuid: z.string()
+		})
+	})),
+	uuid: z.string()
+});
+//#endregion
+//#region src/lib/epms/epmsClient.ts
+/**
+* Manages authentication and API interactions with EPMS.
+* It provides factory methods for creating instances based on different authentication flows (client credentials or browser-based) and handles token caching and renewal transparently.
+*/
+var EpmsClient = class EpmsClient {
+	#cacheKey;
+	#epmsClient;
+	#authType;
+	/**
+	* Creates an instance of EpmsClient.
+	*
+	* @param authType The type of authentication used by the client.
+	* @param cacheKey They key used for caching the token so that the client can manage the cache (e.g. clear it on logout). It should be unique per EPMS environment and client ID.
+	* @param epmsClient The underlying KyInstance used for making API requests.
+	*/
+	constructor(authType, cacheKey, epmsClient) {
+		this.#authType = authType;
+		this.#cacheKey = cacheKey;
+		this.#epmsClient = epmsClient;
+	}
+	static fromClientCredentials(baseUrl, clientId, clientSecret) {
+		return new EpmsClient("client_credentials", getTokenCacheKey(baseUrl, clientId), createAuthorizer(baseUrl, clientId, clientSecret));
+	}
+	static fromBrowserAuth(epmsBaseUrl, authBaseUrl, clientId) {
+		return new EpmsClient("browser", getTokenCacheKey(authBaseUrl, clientId), createBrowserAuthorizer(authBaseUrl, clientId, epmsBaseUrl));
+	}
+	get authType() {
+		return this.#authType;
+	}
+	logout() {
+		removeCachedToken(this.#cacheKey);
+	}
+	async myself() {
+		return this.#epmsClient.get("users/myself").json().then((response) => myselfSchema.parse(response));
+	}
+	async getOrganisationIdByAccountUuid(accountUuid) {
+		try {
+			const organisationUuid = (await this.#epmsClient.get(`accounts/${accountUuid}`).json()).organisation.uuid;
+			if (!organisationUuid) throw new Error("Organisation UUID not found in response");
+			return organisationUuid;
+		} catch (error) {
+			throw new Error(`Organisation UUID not found for account UUID: ${accountUuid}`, { cause: error });
+		}
+	}
+	async updateTamaro(configName, tag, json) {
+		return this.#epmsClient.put(`products/tamaro/${configName}/tags/${tag}`, { json }).json();
+	}
+	async archiveTamaro(configName) {
+		return this.#epmsClient.post(`products/tamaro/${configName}/archive`).json();
+	}
+	async unarchiveTamaro(configName) {
+		return this.#epmsClient.post(`products/tamaro/${configName}/unarchive`).json();
+	}
+};
+//#endregion
+//#region src/lib/epms/helpers.ts
+const epmsAuthenticate = (env) => {
+	const { authBaseUrl, baseUrl, clientId, clientSecret } = {
+		prod: {
+			authBaseUrl: EPMS_AUTH_BASE_URL_PROD,
+			baseUrl: EPMS_API_BASE_URL_PROD,
+			clientId: process.env.EPMS_CLIENT_ID,
+			clientSecret: process.env.EPMS_CLIENT_SECRET
+		},
+		stage: {
+			authBaseUrl: EPMS_AUTH_BASE_URL_STAGE,
+			baseUrl: EPMS_API_BASE_URL_STAGE,
+			clientId: process.env.EPMS_CLIENT_ID_STAGE,
+			clientSecret: process.env.EPMS_CLIENT_SECRET_STAGE
+		}
+	}[env];
+	if (clientId && clientSecret) return EpmsClient.fromClientCredentials(baseUrl, clientId, clientSecret);
+	return EpmsClient.fromBrowserAuth(baseUrl, authBaseUrl, EPMS_OAUTH_CLIENT_ID);
+};
+const loadTamaroMetadataFromConfig = (paths) => {
+	if (!("configYml" in paths)) {
+		halt("Fatal error, this should never happen");
+		throw new Error("Fatal error");
+	}
+	const configContent = yaml.load(readFileSync(paths.configYml, "utf8"));
+	const accountUuidStage = resolveAccountUuidFromConfig(configContent, "epms_stage");
+	return {
+		accountUuidProd: resolveAccountUuidFromConfig(configContent, "epms"),
+		accountUuidStage,
+		managedBy: resolveManagedByFromConfig(configContent)
+	};
+};
+const assertUserIsSuperAdmin = async (epmsClient) => {
+	if (epmsClient.authType === "client_credentials") return;
+	const myself = await epmsClient.myself();
+	if (!myself.identity_roles.some(({ role }) => role.name === "super_admin")) {
+		epmsClient.logout();
+		logError("\nYou must be a super admin to perform this action.");
+		logTitle("\nYour EPMS user details:");
+		logDataTable({
+			email: myself.email,
+			roles: myself.identity_roles.map(({ role }) => role.name).join(", "),
+			uuid: myself.uuid
+		});
+		logError("If this keeps happening, go to Configurator / Hub and logout before trying again.");
+		halt();
+	}
+};
+//#endregion
 //#region src/lib/notifier.ts
 const notify = (args) => {
 	const { message = "", title } = args;
@@ -126,7 +428,7 @@ const notify = (args) => {
 };
 //#endregion
 //#region src/commands/archive.ts
-const archive = (options) => {
+const archive = async (options) => {
 	const { ifCore } = getIfCoreFns();
 	assertIsNotCore$4(ifCore);
 	assertIsNotArchived();
@@ -138,6 +440,7 @@ const archive = (options) => {
 	assertArchiveTargetDoesNotExist(archiveTarget);
 	assertOptionsValid$9(options);
 	if (options.dryrun) logTitle("🧪 DRY RUN MODE - No actual changes will be made 🧪");
+	if (!ifCore() && !options.forceSkipEpmsSync) await archiveEpms(configName, !!options.dryrun);
 	if (!options.dryrun) {
 		if (!existsSync(archiveDir)) mkdirSync(archiveDir, { recursive: true });
 		renameSync(cwd, archiveTarget);
@@ -150,6 +453,39 @@ const archive = (options) => {
 		});
 	});
 };
+const archiveEpms = async (configName, dryrun) => {
+	const { ifCore } = getIfCoreFns();
+	const { accountUuidProd, accountUuidStage } = loadTamaroMetadataFromConfig(getPaths(ifCore));
+	if (!accountUuidProd && !accountUuidStage) halt(stripIndent(`
+        No EPMS account UUIDs found in config.yml.
+        Add them to your config.yml, for example:
+          epms:
+            account_uuid: <UUID>
+          epms_stage:
+            account_uuid: <UUID>
+
+        Or re-run with --force-skip-epms-sync to skip the EPMS sync entirely - ONLY use in emergencies / or if you know what you're doing.
+      `));
+	const environments = [{
+		accountUuid: accountUuidStage,
+		env: "stage",
+		label: "Stage"
+	}, {
+		accountUuid: accountUuidProd,
+		env: "prod",
+		label: "Prod"
+	}];
+	for (const { accountUuid, env, label } of environments) {
+		if (!accountUuid) continue;
+		const epmsClient = epmsAuthenticate(env);
+		await assertUserIsSuperAdmin(epmsClient);
+		logTitle(`\nArchiving EPMS ${label}: ${configName}`);
+		if (!dryrun) {
+			await epmsClient.archiveTamaro(configName);
+			logSuccess(`✅ EPMS ${label} entry archived.`);
+		} else logSuccess(`⏭️ EPMS ${label} entry would be archived (dry run).`);
+	}
+};
 const assertOptionsValid$9 = (options) => {
 	const { profile } = options;
 	if (profile) assertProfileValid(profile);
@@ -354,211 +690,6 @@ const assertTagValid = (tag) => {
 	if (!regex.test(tag)) halt(`Flag "--tag" has forbidden format. Allowed format: ${regex.toString()}.`);
 };
 //#endregion
-//#region src/lib/epms/auth/util.ts
-const CachedTokenSchema = z.object({
-	expirationTime: z.number(),
-	token: z.string()
-});
-const AuthResponseSchema = z.object({
-	access_token: z.string(),
-	expires_in: z.number(),
-	token_type: z.string()
-});
-const getCacheFilePath = (baseUrl, clientId) => {
-	const cacheKey = Buffer.from(`${baseUrl}|${clientId}`).toString("base64url");
-	return path.join(CACHE_DIR, `token-${cacheKey}.json`);
-};
-const readCachedToken = (baseUrl, clientId) => {
-	try {
-		const filePath = getCacheFilePath(baseUrl, clientId);
-		if (!existsSync(filePath)) return;
-		const data = JSON.parse(readFileSync(filePath, "utf8"));
-		const parsed = CachedTokenSchema.safeParse(data);
-		if (parsed.success) return parsed.data;
-	} catch {}
-};
-const writeCachedToken = (baseUrl, clientId, cached) => {
-	try {
-		const filePath = getCacheFilePath(baseUrl, clientId);
-		mkdirSync(path.dirname(filePath), { recursive: true });
-		writeFileSync(filePath, JSON.stringify(cached), { mode: 384 });
-	} catch {}
-};
-const removeCachedToken = (baseUrl, clientId) => {
-	try {
-		const filePath = getCacheFilePath(baseUrl, clientId);
-		if (existsSync(filePath)) writeFileSync(filePath, "", { flag: "w" });
-	} catch {}
-};
-//#endregion
-//#region src/lib/epms/auth/apiClient.ts
-const createAuthorizer = (baseUrl, clientId, clientSecret) => {
-	const apiUnauthorized = ky.extend({
-		headers: { "Access-Control-Allow-Origin": "*" },
-		prefixUrl: baseUrl,
-		timeout: DEFAULT_HTTP_TIMEOUT
-	});
-	let expirationTime = void 0;
-	let token = void 0;
-	const cached = readCachedToken(baseUrl, clientId);
-	if (cached) {
-		token = cached.token;
-		expirationTime = cached.expirationTime;
-	}
-	const authorize = async () => {
-		const isExpired = (expirationTime ?? 0) - Date.now() < 300 * 1e3;
-		if (token && !isExpired) return token;
-		const data = await apiUnauthorized.post("oauth2/token", { json: {
-			client_id: clientId,
-			client_secret: clientSecret,
-			grant_type: "client_credentials"
-		} }).json();
-		token = `${data.token_type} ${data.access_token}`;
-		expirationTime = Date.now() + data.expires_in * 1e3;
-		writeCachedToken(baseUrl, clientId, {
-			expirationTime,
-			token
-		});
-		return token;
-	};
-	return apiUnauthorized.extend({ hooks: { beforeRequest: [async (request) => {
-		const authToken = await authorize();
-		request.headers.set("Authorization", authToken);
-	}] } });
-};
-//#endregion
-//#region src/lib/epms/auth/authCallback.html
-var authCallback_default = "<!doctype html>\n<html>\n  <head\n    ><title>Authenticating</title></head\n  >\n  <body>\n    <p>Authenticating</p>\n    <script>\n      const hash = window.location.hash.substring(1)\n      const params = new URLSearchParams(hash)\n      const data = {\n        access_token: params.get('access_token'),\n        token_type: params.get('token_type'),\n        expires_in: parseInt(params.get('expires_in') || '0', 10),\n      }\n      fetch('/token', {\n        method: 'POST',\n        headers: {'Content-Type': 'application/json'},\n        body: JSON.stringify(data),\n      })\n        .then(() => {\n          document.querySelector('p').textContent =\n            'Authentication successful! You can close this tab.'\n        })\n        .catch(() => {\n          document.querySelector('p').textContent =\n            'Authentication failed. Please try again.'\n        })\n    <\/script>\n  </body>\n</html>\n";
-//#endregion
-//#region src/lib/epms/auth/browser.ts
-/**
-* The following authentication method is a browser-based OAuth flow.
-* A very similar flow is used by tools like AWS CLI when running `aws sso login` or Claude Code.
-*
-* The flow works as follows:
-* 1. The CLI starts a temporary local HTTP server that listens for the OAuth callback.
-* 2. The CLI opens the user's default web browser and navigates to the EPMS authorization URL, passing the local server's callback URL as the redirect_uri.
-* 3. The user authenticates in the browser, and the OAuth server redirects back to the local server with the authorization token.
-* 4. The local server captures the token and resolves the promise, completing the authentication flow.
-*
-*
-* We also implement a simple caching mechanism that stores the token in a file in the user's home directory.
-* This allows us to reuse the token for subsequent requests until it expires, at which point we automatically trigger a new authentication flow.
-*/
-const doBrowserOAuthFlow = (authBaseUrl, clientId, port) => {
-	return new Promise((resolve, reject) => {
-		const server = createServer((req, res) => {
-			if (req.method === "POST" && req.url === "/token") {
-				let body = "";
-				req.on("data", (chunk) => {
-					body += chunk.toString();
-				});
-				req.on("end", () => {
-					try {
-						const data = AuthResponseSchema.parse(JSON.parse(body));
-						res.writeHead(200);
-						res.end();
-						server.close();
-						resolve(data);
-					} catch (error) {
-						res.writeHead(400);
-						res.end();
-						reject(error instanceof Error ? error : new Error(String(error)));
-					}
-				});
-			} else {
-				res.writeHead(200, { "Content-Type": "text/html" });
-				res.end(authCallback_default);
-			}
-		});
-		server.on("error", reject);
-		server.listen(port, () => {
-			const redirectUri = `http://localhost:${port}`;
-			const authUrl = `${authBaseUrl}/oauth2/authorize?client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&response_type=token`;
-			console.log(`Opening browser for authentication: ${authUrl}`);
-			open(authUrl).catch((error) => {
-				reject(error instanceof Error ? error : new Error(String(error)));
-			});
-		});
-	});
-};
-const createBrowserAuthorizer = (authBaseUrl, clientId, epmsBaseUrl) => {
-	const apiBase = ky.extend({
-		prefixUrl: epmsBaseUrl,
-		timeout: DEFAULT_HTTP_TIMEOUT
-	});
-	let expirationTime = void 0;
-	let token = void 0;
-	const cacheBaseUrl = `browser|${authBaseUrl}`;
-	const cached = readCachedToken(cacheBaseUrl, clientId);
-	if (cached) {
-		token = cached.token;
-		expirationTime = cached.expirationTime;
-	}
-	const resetAuth = () => {
-		token = void 0;
-		expirationTime = void 0;
-		removeCachedToken(cacheBaseUrl, clientId);
-	};
-	const authorize = async () => {
-		const isExpired = (expirationTime ?? 0) - Date.now() < 300 * 1e3;
-		if (token && !isExpired) return token;
-		const data = await doBrowserOAuthFlow(authBaseUrl, clientId, AUTH_PORT);
-		token = `${data.token_type} ${data.access_token}`;
-		expirationTime = Date.now() + data.expires_in * 1e3;
-		writeCachedToken(cacheBaseUrl, clientId, {
-			expirationTime,
-			token
-		});
-		return token;
-	};
-	return apiBase.extend({ hooks: {
-		afterResponse: [async (request, options, response) => {
-			if (response.status === 401) {
-				resetAuth();
-				const newToken = await authorize();
-				const newRequest = new Request(request, { headers: new Headers(request.headers) });
-				newRequest.headers.set("Authorization", newToken);
-				return ky(newRequest, options);
-			}
-			return response;
-		}],
-		beforeRequest: [async (request) => {
-			const authToken = await authorize();
-			request.headers.set("Authorization", authToken);
-		}]
-	} });
-};
-//#endregion
-//#region src/lib/epms/client.ts
-var EpmsClient = class EpmsClient {
-	#epmsClient;
-	constructor(epmsClient) {
-		this.#epmsClient = epmsClient;
-	}
-	static fromClientCredentials(baseUrl, clientId, clientSecret) {
-		return new EpmsClient(createAuthorizer(baseUrl, clientId, clientSecret));
-	}
-	static fromBrowserAuth(epmsBaseUrl, authBaseUrl, clientId) {
-		return new EpmsClient(createBrowserAuthorizer(authBaseUrl, clientId, epmsBaseUrl));
-	}
-	async getOrganisationIdByAccountUuid(accountUuid) {
-		const query = {
-			from: 0,
-			query: { $and: [{ $term: { object_uuid: accountUuid } }, { $term: { object: "account" } }] },
-			size: 1
-		};
-		const response = await this.#epmsClient.post("search/events", { json: query }).json();
-		if (response.hits.length === 0) throw new Error(`No events found for account UUID: ${accountUuid}`);
-		const organisationId = response.hits[0].organisation_uuid;
-		if (!organisationId) throw new Error(`Organisation UUID not found for account UUID: ${accountUuid}`);
-		return organisationId;
-	}
-	async updateTamaro(configName, tag, json) {
-		return this.#epmsClient.put(`products/tamaro/${configName}/tags/${tag}`, { json }).json();
-	}
-};
-//#endregion
 //#region src/commands/update-epms.ts
 const updateEpms = async (options) => {
 	const { ifCore } = getIfCoreFns();
@@ -576,7 +707,11 @@ const updateEpms = async (options) => {
 	const { dryrun, tag } = options;
 	const configName = getWidgetUuid();
 	loadEnv(paths);
-	const { accountUuidsProd, accountUuidsStage } = loadAccountUuidsFromConfig(paths);
+	const { accountUuidProd, accountUuidStage, managedBy } = loadTamaroMetadataFromConfig(paths);
+	if (!accountUuidProd && !accountUuidStage) {
+		logTitle("No EPMS account UUIDs found in config.yml. Skipping EPMS update.");
+		return;
+	}
 	if (dryrun) logTitle("🧪 DRY RUN MODE - No actual changes will be made 🧪");
 	const configuredVersion = resolveCoreVersion();
 	if (!configuredVersion) {
@@ -586,36 +721,29 @@ const updateEpms = async (options) => {
 	const baseInfo = {
 		configured_version: configuredVersion ?? "unknown",
 		last_deployment: Math.trunc(Date.now() / 1e3),
+		managed_by: managedBy,
 		read_only: false
 	};
-	for (const accountUuidStage of accountUuidsStage) if (accountUuidStage) {
-		const epmsClient = epmsAuthenticate("stage");
-		const organisationUuid = await epmsClient.getOrganisationIdByAccountUuid(accountUuidStage);
-		const body = {
-			...baseInfo,
-			account_uuid: accountUuidStage,
-			organisation_uuid: organisationUuid
-		};
-		logTitle(`Updating EPMS Stage for tag "${tag}":`);
-		logDataTable({
-			name: configName,
-			tag,
-			...body
-		});
-		if (!dryrun) {
-			await epmsClient.updateTamaro(configName, tag, body);
-			logSuccess("✅ EPMS Stage is updated.");
-		} else logSuccess("⏭️ EPMS Stage would be updated (dry run).");
-	}
-	for (const accountUuidProd of accountUuidsProd) if (accountUuidProd) {
-		const epmsClient = epmsAuthenticate("prod");
-		const organisationUuid = await epmsClient.getOrganisationIdByAccountUuid(accountUuidProd);
-		logTitle(`Updating EPMS Prod for tag "${tag}":`);
+	const environments = [{
+		accountUuid: accountUuidStage,
+		env: "stage",
+		label: "Stage"
+	}, {
+		accountUuid: accountUuidProd,
+		env: "prod",
+		label: "Prod"
+	}];
+	for (const { accountUuid, env, label } of environments) {
+		if (!accountUuid) continue;
+		const epmsClient = epmsAuthenticate(env);
+		await assertUserIsSuperAdmin(epmsClient);
+		const organisationUuid = await epmsClient.getOrganisationIdByAccountUuid(accountUuid);
 		const body = {
 			...baseInfo,
-			account_uuid: accountUuidProd,
+			account_uuid: accountUuid,
 			organisation_uuid: organisationUuid
 		};
+		logTitle(`\nUpdating EPMS ${label}:`);
 		logDataTable({
 			name: configName,
 			tag,
@@ -623,34 +751,13 @@ const updateEpms = async (options) => {
 		});
 		if (!dryrun) {
 			await epmsClient.updateTamaro(configName, tag, body);
-			logSuccess("✅ EPMS Prod is updated.");
-		} else logSuccess("⏭️ EPMS Prod would be updated (dry run).");
-	}
-};
-const epmsAuthenticate = (env) => {
-	if (env === "stage") {
-		if (process.env.EPMS_CLIENT_ID_STAGE && process.env.EPMS_CLIENT_SECRET_STAGE) return EpmsClient.fromClientCredentials(EPMS_API_BASE_URL_STAGE, process.env.EPMS_CLIENT_ID_STAGE, process.env.EPMS_CLIENT_SECRET_STAGE);
-		return EpmsClient.fromBrowserAuth(EPMS_API_BASE_URL_STAGE, EPMS_AUTH_BASE_URL_STAGE, EPMS_AUTH_CLIENT_ID_STAGE);
+			logSuccess(`✅ EPMS ${label} is updated.`);
+		} else logSuccess(`⏭️ EPMS ${label} would be updated (dry run).`);
 	}
-	if (process.env.EPMS_CLIENT_ID && process.env.EPMS_CLIENT_SECRET) return EpmsClient.fromClientCredentials(EPMS_API_BASE_URL_PROD, process.env.EPMS_CLIENT_ID, process.env.EPMS_CLIENT_SECRET);
-	return EpmsClient.fromBrowserAuth(EPMS_API_BASE_URL_PROD, EPMS_AUTH_BASE_URL_PROD, EPMS_AUTH_CLIENT_ID_PROD);
-};
-const loadAccountUuidsFromConfig = (paths) => {
-	if (!("configYml" in paths)) {
-		halt("Fatal error, this should never happen");
-		throw new Error("Fatal error");
-	}
-	const configContent = yaml.load(readFileSync(paths.configYml, "utf8"));
-	const accountUuidsStage = resolveAccountUuidFromConfig(configContent, "epms_stage");
-	return {
-		accountUuidsProd: resolveAccountUuidFromConfig(configContent, "epms"),
-		accountUuidsStage
-	};
 };
 const loadEnv = (paths) => {
 	const filePath = globSync(paths.appEnv).find((file) => path.basename(file) === ".env");
-	if (!filePath) halt("No \".env\" file found. Are you in the folder of the Tamaro configuration?");
-	config({
+	if (filePath) config({
 		path: filePath,
 		quiet: true
 	});
@@ -730,8 +837,8 @@ const deploy = async (options) => {
 			halt(error.stderr);
 		}
 	}
-	if (options.skipEpmsSyncOnlyUseInEmergenciesOrYouWillBeFired) logTitle("⚠️  EPMS sync skipped. You better know what you are doing.");
-	else await updateEpms(options);
+	if (options.forceSkipEpmsSync) logTitle("⚠️  EPMS sync skipped. You better know what you are doing.");
+	else if (!ifCore()) await updateEpms(options);
 	const demoPage = `https://${AWS_S3_BUCKET_TAMARO}/${configName}/${tag}/index.html`;
 	const entryPoint = `https://${AWS_S3_BUCKET_TAMARO}/${configName}/${tag}/${entryFilename}`;
 	logTitle(`\nBundle for "${configName}" is deployed with tag "${tag}".`);
@@ -954,7 +1061,7 @@ const prepareFlags = async (options) => {
 };
 //#endregion
 //#region src/commands/unarchive.ts
-const unarchive = (options) => {
+const unarchive = async (options) => {
 	const { ifCore } = getIfCoreFns({ allowArchived: true });
 	assertIsNotCore$1(ifCore);
 	assertIsArchived();
@@ -965,12 +1072,13 @@ const unarchive = (options) => {
 	const restoreTarget = path.resolve(configsDir, configName);
 	assertRestoreTargetDoesNotExist(restoreTarget);
 	assertOptionsValid$2(options);
+	if (!ifCore() && !options.forceSkipEpmsSync) await unarchiveEpms(configName, !!options.dryrun);
 	if (options.dryrun) logTitle("🧪 DRY RUN MODE - No actual changes will be made 🧪");
 	if (!options.dryrun) {
 		renameSync(cwd, restoreTarget);
 		process.chdir(restoreTarget);
 	} else logTitle(`Would move ${cwd} → ${restoreTarget}`);
-	logTitle(`✅ "${configName}" has been unarchived and moved to ${restoreTarget}`);
+	logSuccess(`\n✅ "${configName}" has been unarchived and moved to ${restoreTarget}`);
 	process.on("exit", () => {
 		notify({
 			message: `"${configName}" has been unarchived.`,
@@ -978,6 +1086,39 @@ const unarchive = (options) => {
 		});
 	});
 };
+const unarchiveEpms = async (configName, dryrun) => {
+	const { ifCore } = getIfCoreFns({ allowArchived: true });
+	const { accountUuidProd, accountUuidStage } = loadTamaroMetadataFromConfig(getPaths(ifCore));
+	if (!accountUuidProd && !accountUuidStage) halt(stripIndent(`
+        No EPMS account UUIDs found in config.yml.
+        Add them to your config.yml, for example:
+          epms:
+            account_uuid: <UUID>
+          epms_stage:
+            account_uuid: <UUID>
+
+        Or re-run with --force-skip-epms-sync to skip the EPMS sync entirely - ONLY use in emergencies / or if you know what you're doing.
+      `));
+	const environments = [{
+		accountUuid: accountUuidStage,
+		env: "stage",
+		label: "Stage"
+	}, {
+		accountUuid: accountUuidProd,
+		env: "prod",
+		label: "Prod"
+	}];
+	for (const { accountUuid, env, label } of environments) {
+		if (!accountUuid) continue;
+		const epmsClient = epmsAuthenticate(env);
+		await assertUserIsSuperAdmin(epmsClient);
+		logTitle(`\nUnarchiving EPMS ${label}: ${configName}`);
+		if (!dryrun) {
+			await epmsClient.unarchiveTamaro(configName);
+			logSuccess(`✅ EPMS ${label} entry unarchived.`);
+		} else logSuccess(`⏭️ EPMS ${label} entry would be unarchived (dry run).`);
+	}
+};
 const assertOptionsValid$2 = (options) => {
 	const { profile } = options;
 	if (profile) assertProfileValid(profile);
@@ -1128,7 +1269,7 @@ const promptBucketTamaroEmailConfig = async () => {
 //#endregion
 //#region package.json
 var name = "@raisenow/tamaro-cli";
-var version = "1.9.0-dev.1";
+var version = "1.9.0-dev.3";
 //#endregion
 //#region src/cli.ts
 /**
@@ -1146,7 +1287,7 @@ const cli = createCommand().name(name).version(version, "-v, --version");
 cli.command("dev").description("Run the local development server for Tamaro Core or a particular customer configuration").option("--local-core", "Load Tamaro Core from localhost:1234 instead of the CDN", false).option("--https", "Let local web server serve Tamaro with SSL encryption", false).option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--env <env>", "Environment (dev, stage, prod)").option("--nolint", "Disable ESLint", false).option("--debug", "Enable debug mode", false).action(async (options) => {
 	await dev(options);
 });
-cli.command("build").description("Build an optimised (minified) bundle of Tamaro Core or a customer configuration").option("--local-core", "Load Tamaro Core from localhost:1234 instead of the CDN", false).option("--analyze", "Generate bundle statistics to \"reports\" folder", false).option("--serve", "Run the generated bundle with a local web server", false).option("--https", "Let local web server serve Tamaro with SSL encryption", false).option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--env <env>", "Environment (dev, stage, prod)").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--deploy", "Deploy Tamaro Core or a customer configuration bundle to AWS S3", false).option("--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired", "Skip the EPMS sync entirely. Only use this in emergencies.", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--nolint", "Disable ESLint", false).option("--debug", "Enable debug mode", false).action(async (options) => {
+cli.command("build").description("Build an optimised (minified) bundle of Tamaro Core or a customer configuration").option("--local-core", "Load Tamaro Core from localhost:1234 instead of the CDN", false).option("--analyze", "Generate bundle statistics to \"reports\" folder", false).option("--serve", "Run the generated bundle with a local web server", false).option("--https", "Let local web server serve Tamaro with SSL encryption", false).option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--env <env>", "Environment (dev, stage, prod)").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--deploy", "Deploy Tamaro Core or a customer configuration bundle to AWS S3", false).option("--force-skip-epms-sync", "Skip the EPMS sync entirely. Only use this in emergencies.", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--nolint", "Disable ESLint", false).option("--debug", "Enable debug mode", false).action(async (options) => {
 	await build(options);
 	if (options.serve) await serve(options);
 	if (options.deploy) await deploy(options);
@@ -1154,7 +1295,7 @@ cli.command("build").description("Build an optimised (minified) bundle of Tamaro
 cli.command("serve").description("Run a local web server for pre-built bundle").option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--https", "Let local web server serve Tamaro with SSL encryption", false).action(async (options) => {
 	await serve(options);
 });
-cli.command("deploy").description("Deploy a pre-built Tamaro Core or customer configuration bundle to AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired", "Skip the EPMS sync entirely. Only use this in emergencies.", false).action(async (options) => {
+cli.command("deploy").description("Deploy a pre-built Tamaro Core or customer configuration bundle to AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--force-skip-epms-sync", "Skip the EPMS sync entirely. Only use this in emergencies.", false).action(async (options) => {
 	await deploy(options);
 });
 cli.command("list-deployed").description("List deployments of Tamaro Core or a particular customer configuration").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--config <config>", "Configuration name (default: current customer configuration)").action(async (options) => {
@@ -1169,11 +1310,11 @@ cli.command("undeploy").description("Undeploy a Tamaro Core or customer configur
 cli.command("undeploy-email-config").description("Undeploy a widget's email configuration from AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--bucket <bucket>", "AWS bucket for email configs").option("--stage", "Undeploy from stage environment (alternative to --bucket)").option("--prod", "Undeploy from prod environment (alternative to --bucket)").option("--dryrun", "Displays the operations that would be performed without actually running them", false).action(async (options) => {
 	await undeployEmailConfig(options);
 });
-cli.command("archive").description("Archive a customer configuration by moving it to the _archived folder").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).action((options) => {
-	archive(options);
+cli.command("archive").description("Archive a customer configuration by moving it to the _archived folder").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--force-skip-epms-sync", "Skip EPMS archive sync (emergency use only)", false).action(async (options) => {
+	await archive(options);
 });
-cli.command("unarchive").description("Unarchive a customer configuration by restoring it from the _archived folder").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).action((options) => {
-	unarchive(options);
+cli.command("unarchive").description("Unarchive a customer configuration by restoring it from the _archived folder").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--force-skip-epms-sync", "Skip EPMS unarchive sync (emergency use only)", false).action(async (options) => {
+	await unarchive(options);
 });
 cli.command("update-epms").description("Update EPMS with the currently deployed widget tags.").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--tag <tag>", "Tag which should be set for the deployment", DEFAULT_TAG).action(async (options) => {
 	await updateEpms(options);

package/dist/{env-JzPIlctP.js → env-DZ3cWM6p.js}

@@ -1,9 +1,9 @@
 import { createRequire } from "node:module";
 import { existsSync, realpathSync } from "node:fs";
 import path from "node:path";
+import stripIndent from "strip-indent";
 import { execaCommandSync } from "execa";
 import prompts from "prompts";
-import stripIndent from "strip-indent";
 import chalk from "chalk";
 import columnify from "columnify";
 import envPaths from "env-paths";
@@ -22,6 +22,9 @@ const logError = (message) => {
 const logSuccess = (message) => {
 	if (message) console.log(chalk.green(message));
 };
+const logInfo = (message) => {
+	if (message) console.log(chalk.blue(message));
+};
 const logCommand = (cmd) => {
 	console.log(`\n${chalk.dim(stripIndent(cmd).trim())}\n`);
 };
@@ -66,16 +69,16 @@ const EPMS_API_BASE_URL_STAGE = "https://api.stage.mesos.raisenow.net";
 const EPMS_API_BASE_URL_PROD = "https://api.raisenow.io";
 const EPMS_AUTH_BASE_URL_STAGE = "https://login.stage.mesos.raisenow.net";
 const EPMS_AUTH_BASE_URL_PROD = "https://login.raisenow.com";
-const EPMS_AUTH_CLIENT_ID_STAGE = "luna-stage-local";
-const EPMS_AUTH_CLIENT_ID_PROD = "luna-local";
+const EPMS_OAUTH_CLIENT_ID = "tamaro-cli";
 const CORE_CONFIG_NAME = "tamaro-core";
-const AUTH_PORT = 8080;
+const AUTH_PORT = 4571;
 const AWS_CLOUDFRONT_DISTRIBUTION_ID = "EHJ1OM458YQ0I";
 const HTTPS_CRT_FILE = "localhost.crt";
 const HTTPS_KEY_FILE = "localhost.key";
 const CACHE_DIR = envPaths("tamaro-cli", { suffix: "" }).cache;
+const TAMARO_VERSION_IN_URL_REGEX = /tamaro-core\/(.*)\/index.js/;
 //#endregion
-//#region node_modules/.pnpm/tsdown@0.21.8_synckit@0.11.11_typescript@6.0.2/node_modules/tsdown/esm-shims.js
+//#region node_modules/.pnpm/tsdown@0.22.0_tsx@4.19.1_typescript@6.0.3_unrun@0.2.37_synckit@0.11.11_/node_modules/tsdown/esm-shims.js
 const getFilename = () => fileURLToPath(import.meta.url);
 const getDirname = () => path.dirname(getFilename());
 const __dirname = /* @__PURE__ */ getDirname();
@@ -199,27 +202,25 @@ const getIfCoreFns = ({ allowArchived = false } = {}) => {
 };
 const resolveAccountUuidFromConfig = (rawConfig, field) => {
 	const epmsConfig = z.object({ [field]: z.record(z.string(), z.unknown()) }).safeParse(rawConfig);
-	if (!epmsConfig.success) return [];
+	if (!epmsConfig.success) return;
 	const configContent = epmsConfig.data[field];
 	const accountUuid = configContent.account_mapping ?? configContent.account_uuid;
 	const accountUuidValidation = z.uuid().safeParse(accountUuid);
-	const accontUuidArrayValidation = z.array(z.uuid()).safeParse(accountUuid);
-	if (!accountUuidValidation.success && !accontUuidArrayValidation.success) halt(stripIndent(`Could not extract EPMS account UUID(s) from config.yml. Please ensure that the "${field}" field is correctly formatted. Expected formats:
+	if (!accountUuidValidation.success) halt(stripIndent(`Could not extract EPMS account UUID from config.yml. Please ensure that the "${field}" field is correctly formatted. Expected formats:
       1. ${field}:
            account_uuid: <UUID>
-      
+
       Alternatively, if the account_uuid is conditional using "if" / "then" / "else" statements, it must be provided using the "account_mapping" format:
       2. ${field}:
-           account_mapping:
-            - <UUID_1>
-            - <UUID_2>
-            - <UUID_N>
+           account_mapping: <UUID>
       `));
-	if (accontUuidArrayValidation.success) return accontUuidArrayValidation.data;
-	if (accountUuidValidation.success) return [accountUuidValidation.data];
-	throw new Error("This should never happen");
+	return accountUuidValidation.data;
+};
+const resolveManagedByFromConfig = (rawConfig) => {
+	const managedByConfig = z.object({ managed_by: z.string().trim().min(1).max(255).optional() }).safeParse(rawConfig);
+	if (!managedByConfig.success) halt("Could not extract \"managed_by\" from config.yml. Please ensure it is a non-empty string.");
+	return managedByConfig.data?.managed_by ?? "RaiseNow";
 };
-const TAMARO_VERSION_IN_URL_REGEX = /tamaro-core\/(.*)\/index.js/;
 const extractTamaroVersionFromUrl = (url) => {
 	const match = url.match(TAMARO_VERSION_IN_URL_REGEX);
 	if (match) return match[1].toString();
@@ -343,4 +344,4 @@ const applyEnv = (env) => {
 	if (filePath) config({ path: filePath });
 };
 //#endregion
-export { EPMS_AUTH_CLIENT_ID_STAGE as A, logSuccess as B, DEFAULT_PORT as C, EPMS_AUTH_BASE_URL_PROD as D, EPMS_API_BASE_URL_STAGE as E, runCommandSync as F, createTerminalLink as I, logCommand as L, HTTPS_KEY_FILE as M, halt as N, EPMS_AUTH_BASE_URL_STAGE as O, promptConfirmation as P, logDataTable as R, DEFAULT_HTTP_TIMEOUT as S, EPMS_API_BASE_URL_PROD as T, logTitle as V, AWS_S3_BUCKET_TAMARO as _, getIfCoreFns as a, CACHE_DIR as b, getWidgetUuid as c, resolveBin as d, resolveCoreVersion as f, AWS_CLOUDFRONT_DISTRIBUTION_ID as g, AUTH_PORT as h, extensions as i, HTTPS_CRT_FILE as j, EPMS_AUTH_CLIENT_ID_PROD as k, resolveAccountUuidFromConfig as l, resolveOwn as m, assertEnvValid as n, getPaths as o, resolveEslintPluginConfig as p, getEnvVars as r, getRelativePaths as s, applyEnv as t, resolveApp as u, AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD as v, DEFAULT_TAG as w, CORE_CONFIG_NAME as x, AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE as y, logError as z };
+export { EPMS_OAUTH_CLIENT_ID as A, logInfo as B, DEFAULT_HTTP_TIMEOUT as C, EPMS_API_BASE_URL_STAGE as D, EPMS_API_BASE_URL_PROD as E, runCommandSync as F, logTitle as H, createTerminalLink as I, logCommand as L, HTTPS_KEY_FILE as M, halt as N, EPMS_AUTH_BASE_URL_PROD as O, promptConfirmation as P, logDataTable as R, CORE_CONFIG_NAME as S, DEFAULT_TAG as T, logSuccess as V, AWS_CLOUDFRONT_DISTRIBUTION_ID as _, getIfCoreFns as a, AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE as b, getWidgetUuid as c, resolveBin as d, resolveCoreVersion as f, AUTH_PORT as g, resolveOwn as h, extensions as i, HTTPS_CRT_FILE as j, EPMS_AUTH_BASE_URL_STAGE as k, resolveAccountUuidFromConfig as l, resolveManagedByFromConfig as m, assertEnvValid as n, getPaths as o, resolveEslintPluginConfig as p, getEnvVars as r, getRelativePaths as s, applyEnv as t, resolveApp as u, AWS_S3_BUCKET_TAMARO as v, DEFAULT_PORT as w, CACHE_DIR as x, AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD as y, logError as z };

package/dist/webpack.config.js

@@ -1,4 +1,4 @@
-import { M as HTTPS_KEY_FILE, R as logDataTable, V as logTitle, a as getIfCoreFns, i as extensions, j as HTTPS_CRT_FILE, o as getPaths, p as resolveEslintPluginConfig, r as getEnvVars, s as getRelativePaths, u as resolveApp } from "./env-JzPIlctP.js";
+import { H as logTitle, M as HTTPS_KEY_FILE, R as logDataTable, a as getIfCoreFns, i as extensions, j as HTTPS_CRT_FILE, o as getPaths, p as resolveEslintPluginConfig, r as getEnvVars, s as getRelativePaths, u as resolveApp } from "./env-DZ3cWM6p.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import path from "node:path";
@@ -164,6 +164,22 @@ const getWebpackConfig = (env) => {
 							debug: ifDebug(),
 							modules: false,
 							useBuiltIns: "usage",
+							/**
+							* Exclude plugins that interfere with MobX flow inference via makeAutoObservable.
+							*
+							* MobX detects generator methods on the prototype and wraps them as `flow` automatically.
+							* Several Babel transforms break this detection:
+							*
+							* - transform-parameters: rewrites generator methods with default params (e.g. `*update(data, skip = false)`)
+							*   into plain functions returning an IIFE generator. makeAutoObservable then sees a regular function
+							*   and wraps it as `action` instead of `flow`.
+							*
+							* - async-to-generator / regenerator / async-generator-functions: downcompile async/generator syntax
+							*   to state-machine helpers, again making the methods invisible to MobX flow inference.
+							*
+							* All of these transforms are unnecessary — our browser targets support default parameters,
+							* generators, and async functions natively.
+							*/
 							exclude: [
 								"@babel/plugin-transform-async-to-generator",
 								"@babel/plugin-transform-regenerator",

package/package.json

@@ -1,15 +1,14 @@
 {
   "name": "@raisenow/tamaro-cli",
-  "version": "1.9.0-dev.1",
+  "version": "1.9.0-dev.3",
   "author": {
     "name": "RaiseNow",
     "email": "development@raisenow.com"
   },
   "type": "module",
-  "bin": "dist/cli.js",
   "engines": {
     "node": ">=22.22.2",
-    "pnpm": ">=10.33.0",
+    "pnpm": ">=11.0.9",
     "npm": "please-use-pnpm",
     "yarn": "please-use-pnpm"
   },
@@ -18,7 +17,7 @@
     "@babel/cli": "^7.28.6",
     "@babel/core": "^7.29.0",
     "@babel/plugin-syntax-dynamic-import": "^7.8.3",
-    "@babel/preset-env": "^7.29.2",
+    "@babel/preset-env": "^7.29.5",
     "@babel/preset-react": "^7.28.5",
     "@babel/preset-typescript": "^7.28.5",
     "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
@@ -26,7 +25,7 @@
     "@types/columnify": "^1.5.4",
     "@types/handlebars-helpers": "^0.5.6",
     "@types/lodash": "^4.17.24",
-    "@types/node": "^22.19.17",
+    "@types/node": "^22.19.18",
     "@types/node-notifier": "^8.0.5",
     "@types/prompts": "^2.4.9",
     "@types/resolve-bin": "^0.4.3",
@@ -54,7 +53,7 @@
     "handlebars": "^4.7.9",
     "handlebars-helpers": "^0.10.0",
     "html-loader": "^5.1.0",
-    "html-webpack-plugin": "^5.6.6",
+    "html-webpack-plugin": "^5.6.7",
     "js-yaml": "^4.1.1",
     "json-loader": "^0.5.7",
     "ky": "^1.14.3",
@@ -63,7 +62,7 @@
     "node-notifier": "^10.0.1",
     "open": "^11.0.0",
     "portfinder": "^1.0.38",
-    "postcss": "^8.5.9",
+    "postcss": "^8.5.14",
     "postcss-import": "^16.1.1",
     "postcss-loader": "^8.2.1",
     "postcss-nested": "^7.0.2",
@@ -71,16 +70,16 @@
     "react-refresh": "^0.18.0",
     "resolve-url-loader": "^5.0.0",
     "sass": "^1.99.0",
-    "sass-loader": "^16.0.7",
+    "sass-loader": "^16.0.8",
     "strip-indent": "^4.1.1",
     "style-loader": "^4.0.0",
-    "terser-webpack-plugin": "^5.4.0",
+    "terser-webpack-plugin": "^5.6.0",
     "tsconfig-paths-webpack-plugin": "^4.2.0",
-    "tsdown": "^0.21.8",
-    "typescript": "^6.0.2",
+    "tsdown": "^0.22.0",
+    "typescript": "^6.0.3",
     "url-loader": "^4.1.1",
-    "vitest": "^4.1.4",
-    "webpack": "^5.106.1",
+    "vitest": "^4.1.5",
+    "webpack": "^5.106.2",
     "webpack-cli": "^7.0.2",
     "webpack-config-utils": "^2.3.1",
     "webpack-dev-server": "^5.2.3",
@@ -90,11 +89,11 @@
   "devDependencies": {
     "@rnw-npm/eslint-config": "^2.0.0",
     "@rnw-npm/prettier-config": "^1.0.0",
+    "eslint": "^10.3.0",
     "@types/js-yaml": "^4.0.9",
-    "eslint": "^10.2.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",
-    "prettier": "^3.8.2"
+    "prettier": "^3.8.3"
   },
   "prettier": "@rnw-npm/prettier-config",
   "lint-staged": {
@@ -111,5 +110,8 @@
     "lint": "DEBUG=eslint:eslint-helpers eslint .",
     "format": "prettier . --write --ignore-path ./.prettierignore",
     "test": "vitest"
+  },
+  "bin": {
+    "tamaro-cli": "dist/cli.js"
   }
 }

package/pnpm-workspace.yaml

@@ -1,11 +1,11 @@
 minimumReleaseAge: 1440
-
 minimumReleaseAgeExclude:
   - '@raisenow/*'
   - '@rnw-npm/*'
-
-onlyBuiltDependencies:
-  - core-js
-  - core-js-pure
-  - esbuild
-  - unrs-resolver
+engineStrict: true
+allowBuilds:
+  core-js: true
+  core-js-pure: true
+  esbuild: true
+  highlight.js: true
+  unrs-resolver: true

package/eslint.config.ts

@@ -1,30 +0,0 @@
-import {
-  baseConfig,
-  defineConfig,
-  GLOB_MARKDOWN,
-  GLOB_SRC,
-  OFF,
-} from '@rnw-npm/eslint-config'
-
-export default defineConfig([
-  ...baseConfig,
-
-  /**
-   * "tamaro-cli" specific overrides.
-   */
-  {
-    files: [GLOB_SRC],
-    name: 'tamaro-cli/overrides/ts',
-    rules: {
-      'jsdoc/convert-to-jsdoc-comments': OFF,
-      'no-useless-assignment': OFF,
-    },
-  },
-  {
-    files: [GLOB_MARKDOWN],
-    name: 'tamaro-cli/overrides/md',
-    rules: {
-      'markdown/no-multiple-h1': OFF,
-    },
-  },
-])