@raisenow/tamaro-cli 1.9.0-dev.2 → 2.0.0

package/README.md

@@ -187,7 +187,7 @@ Deploy a pre-built _Tamaro Core_ or customer configuration bundle to AWS S3.
 
 - `--dryrun` – Displays the operations that would be performed without actually running them
 - `--tag <tag>` – Tag which should be used for the deployment of the bundle (default: "latest")
-- `--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired` – Skip the EPMS sync entirely. Only use this in emergencies.
+- `--force-skip-epms-sync` – Skip the EPMS sync entirely. Only use this in emergencies.
 
 Make sure you have built the bundle before deploying it with this command, otherwise you may mistakenly deploy the
 bundle from a previous build.

package/dist/cli.js

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
-import { A as HTTPS_CRT_FILE, B as logSuccess, C as DEFAULT_PORT, D as EPMS_AUTH_BASE_URL_PROD, E as EPMS_API_BASE_URL_STAGE, F as createTerminalLink, I as logCommand, L as logDataTable, M as halt, N as promptConfirmation, O as EPMS_AUTH_BASE_URL_STAGE, P as runCommandSync, R as logError, S as DEFAULT_HTTP_TIMEOUT, T as EPMS_API_BASE_URL_PROD, V as logTitle, _ as AWS_S3_BUCKET_TAMARO, a as getIfCoreFns, b as CACHE_DIR, c as getWidgetUuid, d as resolveBin, f as resolveCoreVersion, g as AWS_CLOUDFRONT_DISTRIBUTION_ID, h as AUTH_PORT, j as HTTPS_KEY_FILE, k as EPMS_OAUTH_CLIENT_ID, l as resolveAccountUuidFromConfig, m as resolveOwn, n as assertEnvValid, o as getPaths, t as applyEnv, v as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD, w as DEFAULT_TAG, x as CORE_CONFIG_NAME, y as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE, z as logInfo } from "./env-DBP70I1v.js";
+import { A as EPMS_OAUTH_CLIENT_ID, B as logInfo, C as DEFAULT_HTTP_TIMEOUT, D as EPMS_API_BASE_URL_STAGE, E as EPMS_API_BASE_URL_PROD, F as runCommandSync, H as logTitle, I as createTerminalLink, L as logCommand, M as HTTPS_KEY_FILE, N as halt, O as EPMS_AUTH_BASE_URL_PROD, P as promptConfirmation, R as logDataTable, S as CORE_CONFIG_NAME, T as DEFAULT_TAG, V as logSuccess, _ as AWS_CLOUDFRONT_DISTRIBUTION_ID, a as getIfCoreFns, b as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE, c as getWidgetUuid, d as resolveBin, f as resolveCoreVersion, g as AUTH_PORT, h as resolveOwn, j as HTTPS_CRT_FILE, k as EPMS_AUTH_BASE_URL_STAGE, l as resolveAccountUuidFromConfig, m as resolveManagedByFromConfig, n as assertEnvValid, o as getPaths, t as applyEnv, v as AWS_S3_BUCKET_TAMARO, w as DEFAULT_PORT, x as CACHE_DIR, y as AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD, z as logError } from "./env-DZ3cWM6p.js";
 import { createCommand } from "commander";
 import fs, { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import stripIndent from "strip-indent";
 import { S3 } from "@aws-sdk/client-s3";
 import { execaCommandSync } from "execa";
 import prompts from "prompts";
-import stripIndent from "strip-indent";
 import columnify from "columnify";
-import notifier from "node-notifier";
+import * as yaml from "js-yaml";
 import { z } from "zod";
+import ky from "ky";
+import { createServer } from "node:http";
+import open from "open";
+import notifier from "node-notifier";
 import { globSync } from "glob";
 import Handlebars from "handlebars";
 import helpers from "handlebars-helpers";
 import { config } from "dotenv";
-import * as yaml from "js-yaml";
-import ky from "ky";
-import { createServer } from "node:http";
-import open from "open";
 import { getPortPromise } from "portfinder";
 //#region src/lib/aws.ts
 const awsAuthenticate = (options) => {
@@ -114,246 +114,6 @@ const getConfigDeployments = async (configName) => {
 	return deployments;
 };
 //#endregion
-//#region src/lib/notifier.ts
-const notify = (args) => {
-	const { message = "", title } = args;
-	notifier.notify({
-		contentImage: "https://assets.raisenow.io/favicon.png",
-		message: stripIndent(message).trim(),
-		sound: "Funk",
-		title
-	});
-};
-//#endregion
-//#region src/commands/archive.ts
-const archive = (options) => {
-	const { ifCore } = getIfCoreFns();
-	assertIsNotCore$4(ifCore);
-	assertIsNotArchived();
-	const configName = getWidgetUuid();
-	const cwd = process.cwd();
-	const parentDir = path.dirname(cwd);
-	const archiveDir = path.resolve(parentDir, "_archived");
-	const archiveTarget = path.resolve(archiveDir, configName);
-	assertArchiveTargetDoesNotExist(archiveTarget);
-	assertOptionsValid$9(options);
-	if (options.dryrun) logTitle("🧪 DRY RUN MODE - No actual changes will be made 🧪");
-	if (!options.dryrun) {
-		if (!existsSync(archiveDir)) mkdirSync(archiveDir, { recursive: true });
-		renameSync(cwd, archiveTarget);
-	} else logTitle(`Would move ${cwd} → ${archiveTarget}`);
-	logSuccess(`\n✅ "${configName}" has been archived and moved to ${archiveTarget}`);
-	process.on("exit", () => {
-		notify({
-			message: `"${configName}" has been archived.`,
-			title: "archive"
-		});
-	});
-};
-const assertOptionsValid$9 = (options) => {
-	const { profile } = options;
-	if (profile) assertProfileValid(profile);
-};
-const assertIsNotCore$4 = (ifCore) => {
-	if (ifCore()) halt("You cannot archive Tamaro Core.");
-};
-const assertIsNotArchived = () => {
-	if (path.basename(path.dirname(process.cwd())) === "_archived") halt("This configuration is already archived.");
-};
-const assertArchiveTargetDoesNotExist = (archiveTarget) => {
-	if (existsSync(archiveTarget)) halt(`Archive target already exists: ${archiveTarget}. Please remove it first.`);
-};
-//#endregion
-//#region src/lib/validators/validateEmailTemplates.ts
-/**
-* Register custom Handlebars helpers - the same, which are used in the Email Service.
-* Make sure to update it if new helpers are added in the Email Service.
-*/
-helpers.comparison({ handlebars: Handlebars });
-/**
-* Recurse through the expected email templates folder and attempt to parse
-* handlebars template to validate their syntax.
-*/
-const validateEmailTemplates = (templatePaths) => {
-	const errors = [];
-	for (const templatePath of templatePaths) try {
-		const template = fs.readFileSync(templatePath, "utf8");
-		assureOnlySupportedHelpers(template);
-		compileEmailTemplate(template);
-		console.log(`${templatePath} is a valid email template`);
-	} catch (error) {
-		errors.push(`${templatePath} is invalid`);
-		errors.push(error);
-	}
-	return errors;
-};
-/**
-* Validate that only supported Handlebars helpers are used in the template.
-* This function extracts helpers from the template AST and checks them
-* against a predefined set of supported helpers.
-*/
-const assureOnlySupportedHelpers = (template) => {
-	/**
-	* Recursively extract helpers from the AST
-	*/
-	const extractHelpers = (ast) => {
-		const usedHelpers = /* @__PURE__ */ new Set();
-		const extractHelperName = (node) => {
-			if (node.path?.type === "PathExpression" && (node.params?.length > 0 || node.hash?.pairs?.length > 0)) return node.path?.original;
-		};
-		const visit = (node) => {
-			if (!node) return;
-			switch (node.type) {
-				case "BlockStatement":
-				case "MustacheStatement": {
-					const name = extractHelperName(node);
-					if (name) usedHelpers.add(name);
-					break;
-				}
-			}
-			/**
-			* Recursively visit children of the AST node.
-			*/
-			for (const key in node) {
-				const value = node[key];
-				if (Array.isArray(value)) value.forEach((v) => visit(v));
-				else if (value && typeof value === "object" && value.type) visit(value);
-			}
-		};
-		visit(ast);
-		return usedHelpers;
-	};
-	const usedHelpers = extractHelpers(Handlebars.parse(template));
-	const supportedHelpers = new Set([
-		"if",
-		"unless",
-		"each",
-		"with",
-		"log",
-		"lookup",
-		"and",
-		"compare",
-		"contains",
-		"default",
-		"eq",
-		"gt",
-		"gte",
-		"has",
-		"isFalsey",
-		"isTruthy",
-		"ifEven",
-		"ifNth",
-		"ifOdd",
-		"is",
-		"isnt",
-		"lt",
-		"lte",
-		"neither",
-		"not",
-		"or",
-		"unlessEq",
-		"unlessGt",
-		"unlessLt",
-		"unlessGteq",
-		"unlessLteq"
-	]);
-	const unsupportedHelpers = [...usedHelpers].filter((h) => !supportedHelpers.has(h));
-	if (unsupportedHelpers.length > 0) throw new Error(`Email template uses unsupported Handlebars helpers: ${unsupportedHelpers.join(", ")}`);
-};
-/**
-* Compile Email template and pass an empty context to validate syntax.
-*/
-const compileEmailTemplate = (template) => {
-	Handlebars.compile(template)({});
-};
-//#endregion
-//#region src/commands/validate.ts
-/**
-* Validates the current Tamaro configuration to avoid common errors.
-*
-* The command description is kept generic on purpose. We check for a number
-* of mistakes observed when tamaro configurations are manually edited and
-* deployed.
-*/
-const validate = async () => {
-	const errors = validateEmailTemplates(globSync("email-config/templates/**/*.hbs").toSorted());
-	if (errors.length > 0) halt(errors.map((el) => el.toString()).join("\n"));
-	logTitle("Validated successfully");
-};
-//#endregion
-//#region src/lib/https.ts
-const assertCrtExists = () => {
-	const { ifCore } = getIfCoreFns();
-	const paths = getPaths(ifCore);
-	const certFile = path.resolve(paths.root, HTTPS_CRT_FILE);
-	const keyFile = path.resolve(paths.root, HTTPS_KEY_FILE);
-	if (existsSync(certFile) && existsSync(keyFile)) return;
-	halt(stripIndent(`
-      Flag "--https" is used, but "${HTTPS_CRT_FILE}" and/or "${HTTPS_KEY_FILE}" files are not found.
-      You need to generate certificate first.
-      Check docs: https://unpkg.com/@raisenow/tamaro-cli/readme.html#/?id=use-transport-level-security-https
-    `));
-};
-//#endregion
-//#region src/commands/build.ts
-const build = async (options) => {
-	const { env } = options;
-	applyEnv(env);
-	if (options.deploy && !options.profile && !options.ci) {
-		assertProfilesPresent();
-		options.profile = await promptProfile();
-	}
-	assertOptionsValid$8(options);
-	await validate();
-	const flags = prepareFlags$2(options);
-	const { ifCore } = getIfCoreFns();
-	const paths = getPaths(ifCore);
-	const configName = ifCore(CORE_CONFIG_NAME, getWidgetUuid());
-	const title = ifCore("Building optimised (minified) bundle of Tamaro Core …", `Building optimised (minified) bundle of "${configName}" customer configuration …`);
-	const cmd = `
-    ${resolveBin("webpack")}
-      --config ${resolveOwn("dist/webpack.config.js")}
-      --env min
-      ${flags}
-  `;
-	logTitle(title);
-	logCommand(cmd);
-	runCommandSync(cmd, { stdio: "inherit" });
-	logTitle(`\nBundle for "${configName}" customer configuration is done.`);
-	console.log(`Path: ${paths.appDist}\n`);
-	process.on("exit", () => {
-		notify({
-			message: `Bundle for "${configName}" customer configuration is done.`,
-			title: "build"
-		});
-	});
-};
-const assertOptionsValid$8 = (options) => {
-	const { deploy, env, https, localCore, profile } = options;
-	const { ifCore } = getIfCoreFns();
-	if (ifCore() && localCore) halt("Flag \"--local-core\" is redundant if running in Tamaro Core context.");
-	if (localCore && deploy) halt("Flags \"--local-core\" and \"--deploy\" must not be used together.");
-	if (https) assertCrtExists();
-	if (profile) assertProfileValid(profile);
-	assertEnvValid(env);
-};
-const prepareFlags$2 = (options) => {
-	const flags = [];
-	const { analyze, debug, https, localCore, nolint } = options;
-	if (localCore) flags.push("--env localCore");
-	if (analyze) flags.push("--env analyze");
-	if (https) flags.push("--env https");
-	if (nolint) flags.push("--env nolint");
-	if (debug) flags.push("--env debug");
-	return flags.join(" ");
-};
-//#endregion
-//#region src/lib/validators/assertTagValid.ts
-const assertTagValid = (tag) => {
-	const regex = /^[\w.-]+$/;
-	if (!regex.test(tag)) halt(`Flag "--tag" has forbidden format. Allowed format: ${regex.toString()}.`);
-};
-//#endregion
 //#region src/lib/epms/auth/util.ts
 const CachedTokenSchema = z.object({
 	expirationTime: z.number(),
@@ -538,121 +298,396 @@ const createBrowserAuthorizer = (authBaseUrl, clientId, epmsBaseUrl) => {
 	} });
 };
 //#endregion
-//#region src/lib/epms/myselfSchema.ts
-const myselfSchema = z.object({
-	email: z.string(),
-	identity_roles: z.array(z.object({
-		identity_uuid: z.string(),
-		role: z.object({
-			name: z.string(),
-			uuid: z.string()
-		})
-	})),
-	uuid: z.string()
-});
-//#endregion
-//#region src/lib/epms/epmsClient.ts
+//#region src/lib/epms/myselfSchema.ts
+const myselfSchema = z.object({
+	email: z.string(),
+	identity_roles: z.array(z.object({
+		identity_uuid: z.string(),
+		role: z.object({
+			name: z.string(),
+			uuid: z.string()
+		})
+	})),
+	uuid: z.string()
+});
+//#endregion
+//#region src/lib/epms/epmsClient.ts
+/**
+* Manages authentication and API interactions with EPMS.
+* It provides factory methods for creating instances based on different authentication flows (client credentials or browser-based) and handles token caching and renewal transparently.
+*/
+var EpmsClient = class EpmsClient {
+	#cacheKey;
+	#epmsClient;
+	#authType;
+	/**
+	* Creates an instance of EpmsClient.
+	*
+	* @param authType The type of authentication used by the client.
+	* @param cacheKey They key used for caching the token so that the client can manage the cache (e.g. clear it on logout). It should be unique per EPMS environment and client ID.
+	* @param epmsClient The underlying KyInstance used for making API requests.
+	*/
+	constructor(authType, cacheKey, epmsClient) {
+		this.#authType = authType;
+		this.#cacheKey = cacheKey;
+		this.#epmsClient = epmsClient;
+	}
+	static fromClientCredentials(baseUrl, clientId, clientSecret) {
+		return new EpmsClient("client_credentials", getTokenCacheKey(baseUrl, clientId), createAuthorizer(baseUrl, clientId, clientSecret));
+	}
+	static fromBrowserAuth(epmsBaseUrl, authBaseUrl, clientId) {
+		return new EpmsClient("browser", getTokenCacheKey(authBaseUrl, clientId), createBrowserAuthorizer(authBaseUrl, clientId, epmsBaseUrl));
+	}
+	get authType() {
+		return this.#authType;
+	}
+	logout() {
+		removeCachedToken(this.#cacheKey);
+	}
+	async myself() {
+		return this.#epmsClient.get("users/myself").json().then((response) => myselfSchema.parse(response));
+	}
+	async getOrganisationIdByAccountUuid(accountUuid) {
+		try {
+			const organisationUuid = (await this.#epmsClient.get(`accounts/${accountUuid}`).json()).organisation.uuid;
+			if (!organisationUuid) throw new Error("Organisation UUID not found in response");
+			return organisationUuid;
+		} catch (error) {
+			throw new Error(`Organisation UUID not found for account UUID: ${accountUuid}`, { cause: error });
+		}
+	}
+	async updateTamaro(configName, tag, json) {
+		return this.#epmsClient.put(`products/tamaro/${configName}/tags/${tag}`, { json }).json();
+	}
+	async archiveTamaro(configName) {
+		return this.#epmsClient.post(`products/tamaro/${configName}/archive`).json();
+	}
+	async unarchiveTamaro(configName) {
+		return this.#epmsClient.post(`products/tamaro/${configName}/unarchive`).json();
+	}
+};
+//#endregion
+//#region src/lib/epms/helpers.ts
+const epmsAuthenticate = (env) => {
+	const { authBaseUrl, baseUrl, clientId, clientSecret } = {
+		prod: {
+			authBaseUrl: EPMS_AUTH_BASE_URL_PROD,
+			baseUrl: EPMS_API_BASE_URL_PROD,
+			clientId: process.env.EPMS_CLIENT_ID,
+			clientSecret: process.env.EPMS_CLIENT_SECRET
+		},
+		stage: {
+			authBaseUrl: EPMS_AUTH_BASE_URL_STAGE,
+			baseUrl: EPMS_API_BASE_URL_STAGE,
+			clientId: process.env.EPMS_CLIENT_ID_STAGE,
+			clientSecret: process.env.EPMS_CLIENT_SECRET_STAGE
+		}
+	}[env];
+	if (clientId && clientSecret) return EpmsClient.fromClientCredentials(baseUrl, clientId, clientSecret);
+	return EpmsClient.fromBrowserAuth(baseUrl, authBaseUrl, EPMS_OAUTH_CLIENT_ID);
+};
+const loadTamaroMetadataFromConfig = (paths) => {
+	if (!("configYml" in paths)) {
+		halt("Fatal error, this should never happen");
+		throw new Error("Fatal error");
+	}
+	const configContent = yaml.load(readFileSync(paths.configYml, "utf8"));
+	const accountUuidStage = resolveAccountUuidFromConfig(configContent, "epms_stage");
+	return {
+		accountUuidProd: resolveAccountUuidFromConfig(configContent, "epms"),
+		accountUuidStage,
+		managedBy: resolveManagedByFromConfig(configContent)
+	};
+};
+const assertUserIsSuperAdmin = async (epmsClient) => {
+	if (epmsClient.authType === "client_credentials") return;
+	const myself = await epmsClient.myself();
+	if (!myself.identity_roles.some(({ role }) => role.name === "super_admin")) {
+		epmsClient.logout();
+		logError("\nYou must be a super admin to perform this action.");
+		logTitle("\nYour EPMS user details:");
+		logDataTable({
+			email: myself.email,
+			roles: myself.identity_roles.map(({ role }) => role.name).join(", "),
+			uuid: myself.uuid
+		});
+		logError("If this keeps happening, go to Configurator / Hub and logout before trying again.");
+		halt();
+	}
+};
+//#endregion
+//#region src/lib/notifier.ts
+const notify = (args) => {
+	const { message = "", title } = args;
+	notifier.notify({
+		contentImage: "https://assets.raisenow.io/favicon.png",
+		message: stripIndent(message).trim(),
+		sound: "Funk",
+		title
+	});
+};
+//#endregion
+//#region src/commands/archive.ts
+const archive = async (options) => {
+	const { ifCore } = getIfCoreFns();
+	assertIsNotCore$4(ifCore);
+	assertIsNotArchived();
+	const configName = getWidgetUuid();
+	const cwd = process.cwd();
+	const parentDir = path.dirname(cwd);
+	const archiveDir = path.resolve(parentDir, "_archived");
+	const archiveTarget = path.resolve(archiveDir, configName);
+	assertArchiveTargetDoesNotExist(archiveTarget);
+	assertOptionsValid$9(options);
+	if (options.dryrun) logTitle("🧪 DRY RUN MODE - No actual changes will be made 🧪");
+	if (!ifCore() && !options.forceSkipEpmsSync) await archiveEpms(configName, !!options.dryrun);
+	if (!options.dryrun) {
+		if (!existsSync(archiveDir)) mkdirSync(archiveDir, { recursive: true });
+		renameSync(cwd, archiveTarget);
+	} else logTitle(`Would move ${cwd} → ${archiveTarget}`);
+	logSuccess(`\n✅ "${configName}" has been archived and moved to ${archiveTarget}`);
+	process.on("exit", () => {
+		notify({
+			message: `"${configName}" has been archived.`,
+			title: "archive"
+		});
+	});
+};
+const archiveEpms = async (configName, dryrun) => {
+	const { ifCore } = getIfCoreFns();
+	const { accountUuidProd, accountUuidStage } = loadTamaroMetadataFromConfig(getPaths(ifCore));
+	if (!accountUuidProd && !accountUuidStage) halt(stripIndent(`
+        No EPMS account UUIDs found in config.yml.
+        Add them to your config.yml, for example:
+          epms:
+            account_uuid: <UUID>
+          epms_stage:
+            account_uuid: <UUID>
+
+        Or re-run with --force-skip-epms-sync to skip the EPMS sync entirely - ONLY use in emergencies / or if you know what you're doing.
+      `));
+	const environments = [{
+		accountUuid: accountUuidStage,
+		env: "stage",
+		label: "Stage"
+	}, {
+		accountUuid: accountUuidProd,
+		env: "prod",
+		label: "Prod"
+	}];
+	for (const { accountUuid, env, label } of environments) {
+		if (!accountUuid) continue;
+		const epmsClient = epmsAuthenticate(env);
+		await assertUserIsSuperAdmin(epmsClient);
+		logTitle(`\nArchiving EPMS ${label}: ${configName}`);
+		if (!dryrun) {
+			await epmsClient.archiveTamaro(configName);
+			logSuccess(`✅ EPMS ${label} entry archived.`);
+		} else logSuccess(`⏭️ EPMS ${label} entry would be archived (dry run).`);
+	}
+};
+const assertOptionsValid$9 = (options) => {
+	const { profile } = options;
+	if (profile) assertProfileValid(profile);
+};
+const assertIsNotCore$4 = (ifCore) => {
+	if (ifCore()) halt("You cannot archive Tamaro Core.");
+};
+const assertIsNotArchived = () => {
+	if (path.basename(path.dirname(process.cwd())) === "_archived") halt("This configuration is already archived.");
+};
+const assertArchiveTargetDoesNotExist = (archiveTarget) => {
+	if (existsSync(archiveTarget)) halt(`Archive target already exists: ${archiveTarget}. Please remove it first.`);
+};
+//#endregion
+//#region src/lib/validators/validateEmailTemplates.ts
+/**
+* Register custom Handlebars helpers - the same, which are used in the Email Service.
+* Make sure to update it if new helpers are added in the Email Service.
+*/
+helpers.comparison({ handlebars: Handlebars });
+/**
+* Recurse through the expected email templates folder and attempt to parse
+* handlebars template to validate their syntax.
+*/
+const validateEmailTemplates = (templatePaths) => {
+	const errors = [];
+	for (const templatePath of templatePaths) try {
+		const template = fs.readFileSync(templatePath, "utf8");
+		assureOnlySupportedHelpers(template);
+		compileEmailTemplate(template);
+		console.log(`${templatePath} is a valid email template`);
+	} catch (error) {
+		errors.push(`${templatePath} is invalid`);
+		errors.push(error);
+	}
+	return errors;
+};
+/**
+* Validate that only supported Handlebars helpers are used in the template.
+* This function extracts helpers from the template AST and checks them
+* against a predefined set of supported helpers.
+*/
+const assureOnlySupportedHelpers = (template) => {
+	/**
+	* Recursively extract helpers from the AST
+	*/
+	const extractHelpers = (ast) => {
+		const usedHelpers = /* @__PURE__ */ new Set();
+		const extractHelperName = (node) => {
+			if (node.path?.type === "PathExpression" && (node.params?.length > 0 || node.hash?.pairs?.length > 0)) return node.path?.original;
+		};
+		const visit = (node) => {
+			if (!node) return;
+			switch (node.type) {
+				case "BlockStatement":
+				case "MustacheStatement": {
+					const name = extractHelperName(node);
+					if (name) usedHelpers.add(name);
+					break;
+				}
+			}
+			/**
+			* Recursively visit children of the AST node.
+			*/
+			for (const key in node) {
+				const value = node[key];
+				if (Array.isArray(value)) value.forEach((v) => visit(v));
+				else if (value && typeof value === "object" && value.type) visit(value);
+			}
+		};
+		visit(ast);
+		return usedHelpers;
+	};
+	const usedHelpers = extractHelpers(Handlebars.parse(template));
+	const supportedHelpers = new Set([
+		"if",
+		"unless",
+		"each",
+		"with",
+		"log",
+		"lookup",
+		"and",
+		"compare",
+		"contains",
+		"default",
+		"eq",
+		"gt",
+		"gte",
+		"has",
+		"isFalsey",
+		"isTruthy",
+		"ifEven",
+		"ifNth",
+		"ifOdd",
+		"is",
+		"isnt",
+		"lt",
+		"lte",
+		"neither",
+		"not",
+		"or",
+		"unlessEq",
+		"unlessGt",
+		"unlessLt",
+		"unlessGteq",
+		"unlessLteq"
+	]);
+	const unsupportedHelpers = [...usedHelpers].filter((h) => !supportedHelpers.has(h));
+	if (unsupportedHelpers.length > 0) throw new Error(`Email template uses unsupported Handlebars helpers: ${unsupportedHelpers.join(", ")}`);
+};
+/**
+* Compile Email template and pass an empty context to validate syntax.
+*/
+const compileEmailTemplate = (template) => {
+	Handlebars.compile(template)({});
+};
+//#endregion
+//#region src/commands/validate.ts
 /**
-* Manages authentication and API interactions with EPMS.
-* It provides factory methods for creating instances based on different authentication flows (client credentials or browser-based) and handles token caching and renewal transparently.
+* Validates the current Tamaro configuration to avoid common errors.
+*
+* The command description is kept generic on purpose. We check for a number
+* of mistakes observed when tamaro configurations are manually edited and
+* deployed.
 */
-var EpmsClient = class EpmsClient {
-	#cacheKey;
-	#epmsClient;
-	#authType;
-	/**
-	* Creates an instance of EpmsClient.
-	*
-	* @param authType The type of authentication used by the client.
-	* @param cacheKey They key used for caching the token so that the client can manage the cache (e.g. clear it on logout). It should be unique per EPMS environment and client ID.
-	* @param epmsClient The underlying KyInstance used for making API requests.
-	*/
-	constructor(authType, cacheKey, epmsClient) {
-		this.#authType = authType;
-		this.#cacheKey = cacheKey;
-		this.#epmsClient = epmsClient;
-	}
-	static fromClientCredentials(baseUrl, clientId, clientSecret) {
-		return new EpmsClient("client_credentials", getTokenCacheKey(baseUrl, clientId), createAuthorizer(baseUrl, clientId, clientSecret));
-	}
-	static fromBrowserAuth(epmsBaseUrl, authBaseUrl, clientId) {
-		return new EpmsClient("browser", getTokenCacheKey(authBaseUrl, clientId), createBrowserAuthorizer(authBaseUrl, clientId, epmsBaseUrl));
-	}
-	get authType() {
-		return this.#authType;
-	}
-	logout() {
-		removeCachedToken(this.#cacheKey);
-	}
-	async myself() {
-		return this.#epmsClient.get("users/myself").json().then((response) => myselfSchema.parse(response));
-	}
-	async getOrganisationIdByAccountUuid(accountUuid) {
-		const query = {
-			from: 0,
-			query: { $and: [{ $term: { object_uuid: accountUuid } }, { $term: { object: "account" } }] },
-			size: 1
-		};
-		const response = await this.#epmsClient.post("search/events", { json: query }).json();
-		if (response.hits.length === 0) throw new Error(`No organisation found for account UUID: ${accountUuid}`);
-		const organisationId = response.hits[0].organisation_uuid;
-		if (!organisationId) throw new Error(`Organisation UUID not found for account UUID: ${accountUuid}`);
-		return organisationId;
-	}
-	async updateTamaro(configName, tag, json) {
-		return this.#epmsClient.put(`products/tamaro/${configName}/tags/${tag}`, { json }).json();
-	}
-	async archiveTamaro(configName, tag) {
-		return this.#epmsClient.post(`products/tamaro/${configName}/tags/${tag}/archive`).json();
-	}
+const validate = async () => {
+	const errors = validateEmailTemplates(globSync("email-config/templates/**/*.hbs").toSorted());
+	if (errors.length > 0) halt(errors.map((el) => el.toString()).join("\n"));
+	logTitle("Validated successfully");
 };
 //#endregion
-//#region src/lib/epms/helpers.ts
-const epmsAuthenticate = (env) => {
-	const { authBaseUrl, baseUrl, clientId, clientSecret } = {
-		prod: {
-			authBaseUrl: EPMS_AUTH_BASE_URL_PROD,
-			baseUrl: EPMS_API_BASE_URL_PROD,
-			clientId: process.env.EPMS_CLIENT_ID,
-			clientSecret: process.env.EPMS_CLIENT_SECRET
-		},
-		stage: {
-			authBaseUrl: EPMS_AUTH_BASE_URL_STAGE,
-			baseUrl: EPMS_API_BASE_URL_STAGE,
-			clientId: process.env.EPMS_CLIENT_ID_STAGE,
-			clientSecret: process.env.EPMS_CLIENT_SECRET_STAGE
-		}
-	}[env];
-	if (clientId && clientSecret) return EpmsClient.fromClientCredentials(baseUrl, clientId, clientSecret);
-	return EpmsClient.fromBrowserAuth(baseUrl, authBaseUrl, EPMS_OAUTH_CLIENT_ID);
+//#region src/lib/https.ts
+const assertCrtExists = () => {
+	const { ifCore } = getIfCoreFns();
+	const paths = getPaths(ifCore);
+	const certFile = path.resolve(paths.root, HTTPS_CRT_FILE);
+	const keyFile = path.resolve(paths.root, HTTPS_KEY_FILE);
+	if (existsSync(certFile) && existsSync(keyFile)) return;
+	halt(stripIndent(`
+      Flag "--https" is used, but "${HTTPS_CRT_FILE}" and/or "${HTTPS_KEY_FILE}" files are not found.
+      You need to generate certificate first.
+      Check docs: https://unpkg.com/@raisenow/tamaro-cli/readme.html#/?id=use-transport-level-security-https
+    `));
 };
-const loadAccountUuidsFromConfig = (paths) => {
-	if (!("configYml" in paths)) {
-		halt("Fatal error, this should never happen");
-		throw new Error("Fatal error");
+//#endregion
+//#region src/commands/build.ts
+const build = async (options) => {
+	const { env } = options;
+	applyEnv(env);
+	if (options.deploy && !options.profile && !options.ci) {
+		assertProfilesPresent();
+		options.profile = await promptProfile();
 	}
-	const configContent = yaml.load(readFileSync(paths.configYml, "utf8"));
-	const accountUuidStage = resolveAccountUuidFromConfig(configContent, "epms_stage");
-	return {
-		accountUuidProd: resolveAccountUuidFromConfig(configContent, "epms"),
-		accountUuidStage
-	};
-};
-const assertUserIsSuperAdmin = async (epmsClient) => {
-	if (epmsClient.authType === "client_credentials") return;
-	const myself = await epmsClient.myself();
-	if (!myself.identity_roles.some(({ role }) => role.name === "super_admin")) {
-		epmsClient.logout();
-		logError("\nYou must be a super admin to perform this action.");
-		logTitle("\nYour EPMS user details:");
-		logDataTable({
-			email: myself.email,
-			roles: myself.identity_roles.map(({ role }) => role.name).join(", "),
-			uuid: myself.uuid
+	assertOptionsValid$8(options);
+	await validate();
+	const flags = prepareFlags$2(options);
+	const { ifCore } = getIfCoreFns();
+	const paths = getPaths(ifCore);
+	const configName = ifCore(CORE_CONFIG_NAME, getWidgetUuid());
+	const title = ifCore("Building optimised (minified) bundle of Tamaro Core …", `Building optimised (minified) bundle of "${configName}" customer configuration …`);
+	const cmd = `
+    ${resolveBin("webpack")}
+      --config ${resolveOwn("dist/webpack.config.js")}
+      --env min
+      ${flags}
+  `;
+	logTitle(title);
+	logCommand(cmd);
+	runCommandSync(cmd, { stdio: "inherit" });
+	logTitle(`\nBundle for "${configName}" customer configuration is done.`);
+	console.log(`Path: ${paths.appDist}\n`);
+	process.on("exit", () => {
+		notify({
+			message: `Bundle for "${configName}" customer configuration is done.`,
+			title: "build"
 		});
-		logError("If this keeps happening, go to Configurator / Hub and logout before trying again.");
-		halt();
-	}
+	});
+};
+const assertOptionsValid$8 = (options) => {
+	const { deploy, env, https, localCore, profile } = options;
+	const { ifCore } = getIfCoreFns();
+	if (ifCore() && localCore) halt("Flag \"--local-core\" is redundant if running in Tamaro Core context.");
+	if (localCore && deploy) halt("Flags \"--local-core\" and \"--deploy\" must not be used together.");
+	if (https) assertCrtExists();
+	if (profile) assertProfileValid(profile);
+	assertEnvValid(env);
+};
+const prepareFlags$2 = (options) => {
+	const flags = [];
+	const { analyze, debug, https, localCore, nolint } = options;
+	if (localCore) flags.push("--env localCore");
+	if (analyze) flags.push("--env analyze");
+	if (https) flags.push("--env https");
+	if (nolint) flags.push("--env nolint");
+	if (debug) flags.push("--env debug");
+	return flags.join(" ");
+};
+//#endregion
+//#region src/lib/validators/assertTagValid.ts
+const assertTagValid = (tag) => {
+	const regex = /^[\w.-]+$/;
+	if (!regex.test(tag)) halt(`Flag "--tag" has forbidden format. Allowed format: ${regex.toString()}.`);
 };
 //#endregion
 //#region src/commands/update-epms.ts
@@ -672,7 +707,7 @@ const updateEpms = async (options) => {
 	const { dryrun, tag } = options;
 	const configName = getWidgetUuid();
 	loadEnv(paths);
-	const { accountUuidProd, accountUuidStage } = loadAccountUuidsFromConfig(paths);
+	const { accountUuidProd, accountUuidStage, managedBy } = loadTamaroMetadataFromConfig(paths);
 	if (!accountUuidProd && !accountUuidStage) {
 		logTitle("No EPMS account UUIDs found in config.yml. Skipping EPMS update.");
 		return;
@@ -686,6 +721,7 @@ const updateEpms = async (options) => {
 	const baseInfo = {
 		configured_version: configuredVersion ?? "unknown",
 		last_deployment: Math.trunc(Date.now() / 1e3),
+		managed_by: managedBy,
 		read_only: false
 	};
 	const environments = [{
@@ -721,8 +757,7 @@ const updateEpms = async (options) => {
 };
 const loadEnv = (paths) => {
 	const filePath = globSync(paths.appEnv).find((file) => path.basename(file) === ".env");
-	if (!filePath) halt("No \".env\" file found. Are you in the folder of the Tamaro configuration?");
-	config({
+	if (filePath) config({
 		path: filePath,
 		quiet: true
 	});
@@ -802,8 +837,8 @@ const deploy = async (options) => {
 			halt(error.stderr);
 		}
 	}
-	if (options.skipEpmsSyncOnlyUseInEmergenciesOrYouWillBeFired) logTitle("⚠️  EPMS sync skipped. You better know what you are doing.");
-	else await updateEpms(options);
+	if (options.forceSkipEpmsSync) logTitle("⚠️  EPMS sync skipped. You better know what you are doing.");
+	else if (!ifCore()) await updateEpms(options);
 	const demoPage = `https://${AWS_S3_BUCKET_TAMARO}/${configName}/${tag}/index.html`;
 	const entryPoint = `https://${AWS_S3_BUCKET_TAMARO}/${configName}/${tag}/${entryFilename}`;
 	logTitle(`\nBundle for "${configName}" is deployed with tag "${tag}".`);
@@ -1026,7 +1061,7 @@ const prepareFlags = async (options) => {
 };
 //#endregion
 //#region src/commands/unarchive.ts
-const unarchive = (options) => {
+const unarchive = async (options) => {
 	const { ifCore } = getIfCoreFns({ allowArchived: true });
 	assertIsNotCore$1(ifCore);
 	assertIsArchived();
@@ -1037,12 +1072,13 @@ const unarchive = (options) => {
 	const restoreTarget = path.resolve(configsDir, configName);
 	assertRestoreTargetDoesNotExist(restoreTarget);
 	assertOptionsValid$2(options);
+	if (!ifCore() && !options.forceSkipEpmsSync) await unarchiveEpms(configName, !!options.dryrun);
 	if (options.dryrun) logTitle("🧪 DRY RUN MODE - No actual changes will be made 🧪");
 	if (!options.dryrun) {
 		renameSync(cwd, restoreTarget);
 		process.chdir(restoreTarget);
 	} else logTitle(`Would move ${cwd} → ${restoreTarget}`);
-	logTitle(`✅ "${configName}" has been unarchived and moved to ${restoreTarget}`);
+	logSuccess(`\n✅ "${configName}" has been unarchived and moved to ${restoreTarget}`);
 	process.on("exit", () => {
 		notify({
 			message: `"${configName}" has been unarchived.`,
@@ -1050,6 +1086,39 @@ const unarchive = (options) => {
 		});
 	});
 };
+const unarchiveEpms = async (configName, dryrun) => {
+	const { ifCore } = getIfCoreFns({ allowArchived: true });
+	const { accountUuidProd, accountUuidStage } = loadTamaroMetadataFromConfig(getPaths(ifCore));
+	if (!accountUuidProd && !accountUuidStage) halt(stripIndent(`
+        No EPMS account UUIDs found in config.yml.
+        Add them to your config.yml, for example:
+          epms:
+            account_uuid: <UUID>
+          epms_stage:
+            account_uuid: <UUID>
+
+        Or re-run with --force-skip-epms-sync to skip the EPMS sync entirely - ONLY use in emergencies / or if you know what you're doing.
+      `));
+	const environments = [{
+		accountUuid: accountUuidStage,
+		env: "stage",
+		label: "Stage"
+	}, {
+		accountUuid: accountUuidProd,
+		env: "prod",
+		label: "Prod"
+	}];
+	for (const { accountUuid, env, label } of environments) {
+		if (!accountUuid) continue;
+		const epmsClient = epmsAuthenticate(env);
+		await assertUserIsSuperAdmin(epmsClient);
+		logTitle(`\nUnarchiving EPMS ${label}: ${configName}`);
+		if (!dryrun) {
+			await epmsClient.unarchiveTamaro(configName);
+			logSuccess(`✅ EPMS ${label} entry unarchived.`);
+		} else logSuccess(`⏭️ EPMS ${label} entry would be unarchived (dry run).`);
+	}
+};
 const assertOptionsValid$2 = (options) => {
 	const { profile } = options;
 	if (profile) assertProfileValid(profile);
@@ -1109,8 +1178,6 @@ const undeploy = async (options) => {
 			halt(error.stderr);
 		}
 	}
-	if (!dryRunFlag && !all && !ifCore() && !options.skipEpmsSyncOnlyUseInEmergenciesOrYouWillBeFired) await archiveEpms(configName, tag, false);
-	else if (all && !ifCore()) logTitle("⚠️  EPMS archive skipped: --all flag used. Archive entries in EPMS manually if needed.");
 	logTitle(`\n${description} has been undeployed.`);
 	logDataTable({ "Removed URL:": deployUrl });
 	process.on("exit", () => {
@@ -1120,33 +1187,6 @@ const undeploy = async (options) => {
 		});
 	});
 };
-const archiveEpms = async (configName, tag, dryrun) => {
-	const { ifCore } = getIfCoreFns();
-	const { accountUuidProd, accountUuidStage } = loadAccountUuidsFromConfig(getPaths(ifCore));
-	if (!accountUuidProd && !accountUuidStage) {
-		logTitle("No EPMS account UUIDs found in config.yml. Skipping EPMS archive.");
-		return;
-	}
-	const environments = [{
-		accountUuid: accountUuidStage,
-		env: "stage",
-		label: "Stage"
-	}, {
-		accountUuid: accountUuidProd,
-		env: "prod",
-		label: "Prod"
-	}];
-	for (const { accountUuid, env, label } of environments) {
-		if (!accountUuid) continue;
-		const epmsClient = epmsAuthenticate(env);
-		await assertUserIsSuperAdmin(epmsClient);
-		logTitle(`\nArchiving EPMS ${label}: ${configName}/${tag}`);
-		if (!dryrun) {
-			await epmsClient.archiveTamaro(configName, tag);
-			logSuccess(`✅ EPMS ${label} entry archived.`);
-		} else logSuccess(`⏭️ EPMS ${label} entry would be archived (dry run).`);
-	}
-};
 const assertOptionsValid$1 = (options) => {
 	const { all, profile, tag } = options;
 	const { ifCore } = getIfCoreFns();
@@ -1229,7 +1269,7 @@ const promptBucketTamaroEmailConfig = async () => {
 //#endregion
 //#region package.json
 var name = "@raisenow/tamaro-cli";
-var version = "1.9.0-dev.2";
+var version = "2.0.0";
 //#endregion
 //#region src/cli.ts
 /**
@@ -1247,7 +1287,7 @@ const cli = createCommand().name(name).version(version, "-v, --version");
 cli.command("dev").description("Run the local development server for Tamaro Core or a particular customer configuration").option("--local-core", "Load Tamaro Core from localhost:1234 instead of the CDN", false).option("--https", "Let local web server serve Tamaro with SSL encryption", false).option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--env <env>", "Environment (dev, stage, prod)").option("--nolint", "Disable ESLint", false).option("--debug", "Enable debug mode", false).action(async (options) => {
 	await dev(options);
 });
-cli.command("build").description("Build an optimised (minified) bundle of Tamaro Core or a customer configuration").option("--local-core", "Load Tamaro Core from localhost:1234 instead of the CDN", false).option("--analyze", "Generate bundle statistics to \"reports\" folder", false).option("--serve", "Run the generated bundle with a local web server", false).option("--https", "Let local web server serve Tamaro with SSL encryption", false).option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--env <env>", "Environment (dev, stage, prod)").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--deploy", "Deploy Tamaro Core or a customer configuration bundle to AWS S3", false).option("--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired", "Skip the EPMS sync entirely. Only use this in emergencies.", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--nolint", "Disable ESLint", false).option("--debug", "Enable debug mode", false).action(async (options) => {
+cli.command("build").description("Build an optimised (minified) bundle of Tamaro Core or a customer configuration").option("--local-core", "Load Tamaro Core from localhost:1234 instead of the CDN", false).option("--analyze", "Generate bundle statistics to \"reports\" folder", false).option("--serve", "Run the generated bundle with a local web server", false).option("--https", "Let local web server serve Tamaro with SSL encryption", false).option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--env <env>", "Environment (dev, stage, prod)").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--deploy", "Deploy Tamaro Core or a customer configuration bundle to AWS S3", false).option("--force-skip-epms-sync", "Skip the EPMS sync entirely. Only use this in emergencies.", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--nolint", "Disable ESLint", false).option("--debug", "Enable debug mode", false).action(async (options) => {
 	await build(options);
 	if (options.serve) await serve(options);
 	if (options.deploy) await deploy(options);
@@ -1255,7 +1295,7 @@ cli.command("build").description("Build an optimised (minified) bundle of Tamaro
 cli.command("serve").description("Run a local web server for pre-built bundle").option("--port <port>", "Web server port", `${DEFAULT_PORT}`).option("--https", "Let local web server serve Tamaro with SSL encryption", false).action(async (options) => {
 	await serve(options);
 });
-cli.command("deploy").description("Deploy a pre-built Tamaro Core or customer configuration bundle to AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired", "Skip the EPMS sync entirely. Only use this in emergencies.", false).action(async (options) => {
+cli.command("deploy").description("Deploy a pre-built Tamaro Core or customer configuration bundle to AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be used for the deployment of the bundle", DEFAULT_TAG).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--force-skip-epms-sync", "Skip the EPMS sync entirely. Only use this in emergencies.", false).action(async (options) => {
 	await deploy(options);
 });
 cli.command("list-deployed").description("List deployments of Tamaro Core or a particular customer configuration").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--config <config>", "Configuration name (default: current customer configuration)").action(async (options) => {
@@ -1264,17 +1304,17 @@ cli.command("list-deployed").description("List deployments of Tamaro Core or a p
 cli.command("deploy-email-config").description("Deploy a widget's email configuration to AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--bucket <bucket>", "AWS bucket for email configs").option("--dryrun", "Displays the operations that would be performed without actually running them", false).action(async (options) => {
 	await deployEmailConfig(options);
 });
-cli.command("undeploy").description("Undeploy a Tamaro Core or customer configuration bundle from AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be undeployed").option("--all", "Undeploy all tags", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--skip-epms-sync-only-use-in-emergencies-or-you-will-be-fired", "Skip EPMS archive sync (emergency use only)", false).action(async (options) => {
+cli.command("undeploy").description("Undeploy a Tamaro Core or customer configuration bundle from AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--tag <tag>", "Tag which should be undeployed").option("--all", "Undeploy all tags", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).action(async (options) => {
 	await undeploy(options);
 });
 cli.command("undeploy-email-config").description("Undeploy a widget's email configuration from AWS S3").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--bucket <bucket>", "AWS bucket for email configs").option("--stage", "Undeploy from stage environment (alternative to --bucket)").option("--prod", "Undeploy from prod environment (alternative to --bucket)").option("--dryrun", "Displays the operations that would be performed without actually running them", false).action(async (options) => {
 	await undeployEmailConfig(options);
 });
-cli.command("archive").description("Archive a customer configuration by moving it to the _archived folder").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).action((options) => {
-	archive(options);
+cli.command("archive").description("Archive a customer configuration by moving it to the _archived folder").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--force-skip-epms-sync", "Skip EPMS archive sync (emergency use only)", false).action(async (options) => {
+	await archive(options);
 });
-cli.command("unarchive").description("Unarchive a customer configuration by restoring it from the _archived folder").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).action((options) => {
-	unarchive(options);
+cli.command("unarchive").description("Unarchive a customer configuration by restoring it from the _archived folder").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--force-skip-epms-sync", "Skip EPMS unarchive sync (emergency use only)", false).action(async (options) => {
+	await unarchive(options);
 });
 cli.command("update-epms").description("Update EPMS with the currently deployed widget tags.").option("--profile <profile>", "AWS profile").option("--ci", "CI environment", false).option("--dryrun", "Displays the operations that would be performed without actually running them", false).option("--tag <tag>", "Tag which should be set for the deployment", DEFAULT_TAG).action(async (options) => {
 	await updateEpms(options);

package/dist/{env-DBP70I1v.js → env-DZ3cWM6p.js}

@@ -1,9 +1,9 @@
 import { createRequire } from "node:module";
 import { existsSync, realpathSync } from "node:fs";
 import path from "node:path";
+import stripIndent from "strip-indent";
 import { execaCommandSync } from "execa";
 import prompts from "prompts";
-import stripIndent from "strip-indent";
 import chalk from "chalk";
 import columnify from "columnify";
 import envPaths from "env-paths";
@@ -76,8 +76,9 @@ const AWS_CLOUDFRONT_DISTRIBUTION_ID = "EHJ1OM458YQ0I";
 const HTTPS_CRT_FILE = "localhost.crt";
 const HTTPS_KEY_FILE = "localhost.key";
 const CACHE_DIR = envPaths("tamaro-cli", { suffix: "" }).cache;
+const TAMARO_VERSION_IN_URL_REGEX = /tamaro-core\/(.*)\/index.js/;
 //#endregion
-//#region node_modules/.pnpm/tsdown@0.21.10_synckit@0.11.11_typescript@6.0.3/node_modules/tsdown/esm-shims.js
+//#region node_modules/.pnpm/tsdown@0.22.0_tsx@4.19.1_typescript@6.0.3_unrun@0.2.37_synckit@0.11.11_/node_modules/tsdown/esm-shims.js
 const getFilename = () => fileURLToPath(import.meta.url);
 const getDirname = () => path.dirname(getFilename());
 const __dirname = /* @__PURE__ */ getDirname();
@@ -215,7 +216,11 @@ const resolveAccountUuidFromConfig = (rawConfig, field) => {
       `));
 	return accountUuidValidation.data;
 };
-const TAMARO_VERSION_IN_URL_REGEX = /tamaro-core\/(.*)\/index.js/;
+const resolveManagedByFromConfig = (rawConfig) => {
+	const managedByConfig = z.object({ managed_by: z.string().trim().min(1).max(255).optional() }).safeParse(rawConfig);
+	if (!managedByConfig.success) halt("Could not extract \"managed_by\" from config.yml. Please ensure it is a non-empty string.");
+	return managedByConfig.data?.managed_by ?? "RaiseNow";
+};
 const extractTamaroVersionFromUrl = (url) => {
 	const match = url.match(TAMARO_VERSION_IN_URL_REGEX);
 	if (match) return match[1].toString();
@@ -339,4 +344,4 @@ const applyEnv = (env) => {
 	if (filePath) config({ path: filePath });
 };
 //#endregion
-export { HTTPS_CRT_FILE as A, logSuccess as B, DEFAULT_PORT as C, EPMS_AUTH_BASE_URL_PROD as D, EPMS_API_BASE_URL_STAGE as E, createTerminalLink as F, logCommand as I, logDataTable as L, halt as M, promptConfirmation as N, EPMS_AUTH_BASE_URL_STAGE as O, runCommandSync as P, logError as R, DEFAULT_HTTP_TIMEOUT as S, EPMS_API_BASE_URL_PROD as T, logTitle as V, AWS_S3_BUCKET_TAMARO as _, getIfCoreFns as a, CACHE_DIR as b, getWidgetUuid as c, resolveBin as d, resolveCoreVersion as f, AWS_CLOUDFRONT_DISTRIBUTION_ID as g, AUTH_PORT as h, extensions as i, HTTPS_KEY_FILE as j, EPMS_OAUTH_CLIENT_ID as k, resolveAccountUuidFromConfig as l, resolveOwn as m, assertEnvValid as n, getPaths as o, resolveEslintPluginConfig as p, getEnvVars as r, getRelativePaths as s, applyEnv as t, resolveApp as u, AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD as v, DEFAULT_TAG as w, CORE_CONFIG_NAME as x, AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE as y, logInfo as z };
+export { EPMS_OAUTH_CLIENT_ID as A, logInfo as B, DEFAULT_HTTP_TIMEOUT as C, EPMS_API_BASE_URL_STAGE as D, EPMS_API_BASE_URL_PROD as E, runCommandSync as F, logTitle as H, createTerminalLink as I, logCommand as L, HTTPS_KEY_FILE as M, halt as N, EPMS_AUTH_BASE_URL_PROD as O, promptConfirmation as P, logDataTable as R, CORE_CONFIG_NAME as S, DEFAULT_TAG as T, logSuccess as V, AWS_CLOUDFRONT_DISTRIBUTION_ID as _, getIfCoreFns as a, AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_STAGE as b, getWidgetUuid as c, resolveBin as d, resolveCoreVersion as f, AUTH_PORT as g, resolveOwn as h, extensions as i, HTTPS_CRT_FILE as j, EPMS_AUTH_BASE_URL_STAGE as k, resolveAccountUuidFromConfig as l, resolveManagedByFromConfig as m, assertEnvValid as n, getPaths as o, resolveEslintPluginConfig as p, getEnvVars as r, getRelativePaths as s, applyEnv as t, resolveApp as u, AWS_S3_BUCKET_TAMARO as v, DEFAULT_PORT as w, CACHE_DIR as x, AWS_S3_BUCKET_TAMARO_EMAIL_CONFIG_PROD as y, logError as z };

package/dist/webpack.config.js

@@ -1,4 +1,4 @@
-import { A as HTTPS_CRT_FILE, L as logDataTable, V as logTitle, a as getIfCoreFns, i as extensions, j as HTTPS_KEY_FILE, o as getPaths, p as resolveEslintPluginConfig, r as getEnvVars, s as getRelativePaths, u as resolveApp } from "./env-DBP70I1v.js";
+import { H as logTitle, M as HTTPS_KEY_FILE, R as logDataTable, a as getIfCoreFns, i as extensions, j as HTTPS_CRT_FILE, o as getPaths, p as resolveEslintPluginConfig, r as getEnvVars, s as getRelativePaths, u as resolveApp } from "./env-DZ3cWM6p.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import path from "node:path";

package/package.json

@@ -1,15 +1,14 @@
 {
   "name": "@raisenow/tamaro-cli",
-  "version": "1.9.0-dev.2",
+  "version": "2.0.0",
   "author": {
     "name": "RaiseNow",
     "email": "development@raisenow.com"
   },
   "type": "module",
-  "bin": "dist/cli.js",
   "engines": {
     "node": ">=22.22.2",
-    "pnpm": ">=10.33.2",
+    "pnpm": ">=11.0.9",
     "npm": "please-use-pnpm",
     "yarn": "please-use-pnpm"
   },
@@ -18,7 +17,7 @@
     "@babel/cli": "^7.28.6",
     "@babel/core": "^7.29.0",
     "@babel/plugin-syntax-dynamic-import": "^7.8.3",
-    "@babel/preset-env": "^7.29.3",
+    "@babel/preset-env": "^7.29.5",
     "@babel/preset-react": "^7.28.5",
     "@babel/preset-typescript": "^7.28.5",
     "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
@@ -26,7 +25,7 @@
     "@types/columnify": "^1.5.4",
     "@types/handlebars-helpers": "^0.5.6",
     "@types/lodash": "^4.17.24",
-    "@types/node": "^22.19.17",
+    "@types/node": "^22.19.18",
     "@types/node-notifier": "^8.0.5",
     "@types/prompts": "^2.4.9",
     "@types/resolve-bin": "^0.4.3",
@@ -63,7 +62,7 @@
     "node-notifier": "^10.0.1",
     "open": "^11.0.0",
     "portfinder": "^1.0.38",
-    "postcss": "^8.5.13",
+    "postcss": "^8.5.14",
     "postcss-import": "^16.1.1",
     "postcss-loader": "^8.2.1",
     "postcss-nested": "^7.0.2",
@@ -71,12 +70,12 @@
     "react-refresh": "^0.18.0",
     "resolve-url-loader": "^5.0.0",
     "sass": "^1.99.0",
-    "sass-loader": "^16.0.7",
+    "sass-loader": "^16.0.8",
     "strip-indent": "^4.1.1",
     "style-loader": "^4.0.0",
-    "terser-webpack-plugin": "^5.5.0",
+    "terser-webpack-plugin": "^5.6.0",
     "tsconfig-paths-webpack-plugin": "^4.2.0",
-    "tsdown": "^0.21.10",
+    "tsdown": "^0.22.0",
     "typescript": "^6.0.3",
     "url-loader": "^4.1.1",
     "vitest": "^4.1.5",
@@ -111,5 +110,8 @@
     "lint": "DEBUG=eslint:eslint-helpers eslint .",
     "format": "prettier . --write --ignore-path ./.prettierignore",
     "test": "vitest"
+  },
+  "bin": {
+    "tamaro-cli": "dist/cli.js"
   }
 }

package/pnpm-workspace.yaml

@@ -1,11 +1,11 @@
 minimumReleaseAge: 1440
-
 minimumReleaseAgeExclude:
   - '@raisenow/*'
   - '@rnw-npm/*'
-
-onlyBuiltDependencies:
-  - core-js
-  - core-js-pure
-  - esbuild
-  - unrs-resolver
+engineStrict: true
+allowBuilds:
+  core-js: true
+  core-js-pure: true
+  esbuild: true
+  highlight.js: true
+  unrs-resolver: true