@salesforce/b2c-cli 2.1.0 → 2.2.1

package/dist/commands/ecdn/mtls/create.d.ts

@@ -1,11 +1,17 @@
-import type { CdnZonesComponents } from '@salesforce/b2c-tooling-sdk/clients';
+import { type MtlsCertificate } from '@salesforce/b2c-tooling-sdk/operations/mtls';
 import { EcdnCommand } from '../../../utils/ecdn/index.js';
-type MtlsCertificateResponse = CdnZonesComponents['schemas']['MtlsCertificateResponse'];
+import { type CodeUploadCertificateFiles } from '../../../utils/ecdn/mtls.js';
 /**
  * Response type for the create command.
  */
 interface CreateOutput {
-    certificate: MtlsCertificateResponse;
+    /** Expiry of the generated CA (only with --generate) */
+    caExpiresOn?: string;
+    certificate: MtlsCertificate;
+    /** Passphrase for the generated client certificate (only with --generate) */
+    clientPassphrase?: string;
+    /** Generated files (only with --generate) */
+    files?: CodeUploadCertificateFiles;
 }
 /**
  * Command to create an mTLS certificate for code upload.
@@ -16,8 +22,16 @@ export default class EcdnMtlsCreate extends EcdnCommand<typeof EcdnMtlsCreate> {
     static examples: string[];
     static flags: {
         name: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'certificate-file': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'private-key-file': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'certificate-file': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'private-key-file': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        generate: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'out-dir': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'client-name': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'p12-passphrase': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'ca-common-name': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'ca-days': import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        'client-days': import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'client-id': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'client-secret': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'auth-scope': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -42,5 +56,7 @@ export default class EcdnMtlsCreate extends EcdnCommand<typeof EcdnMtlsCreate> {
         'extra-headers': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<CreateOutput>;
+    private generate;
+    private upload;
 }
 export {};

package/dist/commands/ecdn/mtls/create.js

@@ -6,65 +6,80 @@
 import { Flags, ux } from '@oclif/core';
 import cliui from 'cliui';
 import * as fs from 'node:fs';
-import { EcdnCommand, formatApiError } from '../../../utils/ecdn/index.js';
+import { createCodeUploadCertificate, MAX_CODE_UPLOAD_CA_VALIDITY_DAYS, } from '@salesforce/b2c-tooling-sdk/operations/mtls';
+import { EcdnCommand } from '../../../utils/ecdn/index.js';
+import { caKeySecurityNotice, clientCertificateNotice, defaultCaCommonName, generateAndUploadCodeUploadCertificate, stagingOrganizationWarning, } from '../../../utils/ecdn/mtls.js';
 import { t, withDocs } from '../../../i18n/index.js';
 /**
  * Command to create an mTLS certificate for code upload.
  */
 export default class EcdnMtlsCreate extends EcdnCommand {
-    static description = withDocs(t('commands.ecdn.mtls.create.description', 'Create an mTLS certificate for code upload authentication'), '/cli/ecdn.html#b2c-ecdn-mtls-create');
+    static description = withDocs(t('commands.ecdn.mtls.create.description', 'Register a CA certificate for two-factor (mTLS) code upload; with --generate, also create the CA and issue a first client certificate'), '/cli/ecdn.html#b2c-ecdn-mtls-create');
     static enableJsonFlag = true;
     static examples = [
         '<%= config.bin %> <%= command.id %> --tenant-id zzxy_prd --name my-cert --certificate-file cert.pem --private-key-file key.pem',
+        '<%= config.bin %> <%= command.id %> --tenant-id zzxy_prd --name my-cert --generate',
+        '<%= config.bin %> <%= command.id %> --tenant-id zzxy_prd --name my-cert --generate --out-dir ./certs --client-name build-server',
     ];
     static flags = {
         ...EcdnCommand.baseFlags,
         name: Flags.string({
-            description: t('flags.name.description', 'Certificate name for identification'),
+            description: t('flags.name.description', 'Name (label) for the registered CA certificate'),
             required: true,
         }),
         'certificate-file': Flags.string({
-            description: t('flags.certificateFile.description', 'Path to PEM-encoded certificate file'),
-            required: true,
+            description: t('flags.certificateFile.description', 'Path to PEM-encoded CA certificate file'),
+            exactlyOne: ['certificate-file', 'generate'],
+            dependsOn: ['private-key-file'],
         }),
         'private-key-file': Flags.string({
-            description: t('flags.privateKeyFile.description', 'Path to PEM-encoded private key file'),
-            required: true,
+            description: t('flags.privateKeyFile.description', 'Path to PEM-encoded CA private key file'),
+            dependsOn: ['certificate-file'],
+        }),
+        generate: Flags.boolean({
+            description: t('flags.generate.description', 'Generate a new CA, upload it, and issue a client certificate (.p12) for code upload'),
+            exactlyOne: ['certificate-file', 'generate'],
+        }),
+        'out-dir': Flags.string({
+            description: t('flags.outDir.description', 'Directory for generated files (with --generate)'),
+            default: 'mtls-certs',
+        }),
+        'client-name': Flags.string({
+            description: t('flags.clientName.description', 'Name of the client certificate (.p12) issued from the new CA, used for code upload (with --generate; default: <name>-client)'),
+        }),
+        'p12-passphrase': Flags.string({
+            description: t('flags.p12Passphrase.description', 'Passphrase for the generated .p12 (with --generate; default: random)'),
+            env: 'SFCC_MTLS_P12_PASSPHRASE',
+        }),
+        'ca-common-name': Flags.string({
+            description: t('flags.caCommonName.description', 'Common name for the generated CA (with --generate; default: the staging hostname if configured, else "<name> CA")'),
+        }),
+        'ca-days': Flags.integer({
+            description: t('flags.caDays.description', 'Validity of the generated CA certificate in days (with --generate; eCDN allows at most 365)'),
+            default: MAX_CODE_UPLOAD_CA_VALIDITY_DAYS,
+            min: 1,
+            max: MAX_CODE_UPLOAD_CA_VALIDITY_DAYS,
+        }),
+        'client-days': Flags.integer({
+            description: t('flags.clientDays.description', 'Validity of the generated client certificate in days (with --generate; capped at the CA expiry)'),
+            default: 365,
+            min: 1,
+        }),
+        force: Flags.boolean({
+            description: t('flags.force.description', 'Overwrite existing generated files'),
+            default: false,
         }),
     };
     async run() {
         this.requireOAuthCredentials();
-        if (!this.jsonEnabled()) {
-            this.log(t('commands.ecdn.mtls.create.creating', 'Creating mTLS certificate...'));
-        }
-        const certificate = fs.readFileSync(this.flags['certificate-file'], 'utf8');
-        const privateKey = fs.readFileSync(this.flags['private-key-file'], 'utf8');
-        const body = {
-            name: this.flags.name,
-            certificate,
-            privateKey,
-        };
-        const client = this.getCdnZonesRwClient();
-        const organizationId = this.getOrganizationId();
-        const { data, error } = await client.POST('/organizations/{organizationId}/mtls/code-upload-certificates', {
-            params: {
-                path: { organizationId },
-            },
-            body,
-        });
-        if (error) {
-            this.error(t('commands.ecdn.mtls.create.error', 'Failed to create mTLS certificate: {{message}}', {
-                message: formatApiError(error),
-            }));
-        }
-        const cert = data?.data;
-        if (!cert) {
-            this.error(t('commands.ecdn.mtls.create.noData', 'No certificate data returned from API'));
-        }
-        const output = { certificate: cert };
+        const stagingWarning = stagingOrganizationWarning(this.getOrganizationId());
+        if (stagingWarning)
+            this.warn(stagingWarning);
+        const output = this.flags.generate ? await this.generate() : await this.upload();
         if (this.jsonEnabled()) {
             return output;
         }
+        const cert = output.certificate;
         const ui = cliui({ width: process.stdout.columns || 80 });
         const labelWidth = 20;
         ui.div('');
@@ -78,7 +93,63 @@ export default class EcdnMtlsCreate extends EcdnCommand {
             ui.div({ text: 'Hostname:', width: labelWidth }, { text: cert.mtlsAssociatedCodeUploadHostname });
         }
         ux.stdout(ui.toString());
+        if (output.files && output.clientPassphrase) {
+            ux.stdout(`CA certificate (uploaded to eCDN): ${output.files.caCertificate}`);
+            ux.stdout('');
+            ux.stdout(caKeySecurityNotice(output.files.caPrivateKey, output.caExpiresOn));
+            ux.stdout('');
+            ux.stdout(clientCertificateNotice({
+                file: output.files.clientCertificate,
+                hostname: cert.mtlsAssociatedCodeUploadHostname,
+                passphrase: output.clientPassphrase,
+            }));
+        }
+        else {
+            ux.stdout(t('commands.ecdn.mtls.create.issueHint', 'Issue client certificates (.p12) signed by this CA for code upload with "b2c ecdn mtls issue".'));
+        }
         return output;
     }
+    async generate() {
+        const { flags } = this;
+        try {
+            return await generateAndUploadCodeUploadCertificate({
+                client: this.getCdnZonesRwClient(),
+                organizationId: this.getOrganizationId(),
+                name: flags.name,
+                caCommonName: flags['ca-common-name'] ?? defaultCaCommonName(flags.name, this.resolvedConfig.values.hostname),
+                clientName: flags['client-name'] ?? `${flags.name}-client`,
+                outDir: flags['out-dir'],
+                passphrase: flags['p12-passphrase'],
+                caValidityDays: flags['ca-days'],
+                clientValidityDays: flags['client-days'],
+                force: flags.force,
+                onProgress: (message) => {
+                    if (!this.jsonEnabled())
+                        this.log(message);
+                },
+            });
+        }
+        catch (error) {
+            this.error(error instanceof Error ? error.message : String(error));
+        }
+    }
+    async upload() {
+        if (!this.jsonEnabled()) {
+            this.log(t('commands.ecdn.mtls.create.creating', 'Creating mTLS certificate...'));
+        }
+        const certificatePem = fs.readFileSync(this.flags['certificate-file'], 'utf8');
+        const privateKeyPem = fs.readFileSync(this.flags['private-key-file'], 'utf8');
+        try {
+            const certificate = await createCodeUploadCertificate(this.getCdnZonesRwClient(), this.getOrganizationId(), {
+                name: this.flags.name,
+                certificatePem,
+                privateKeyPem,
+            });
+            return { certificate };
+        }
+        catch (error) {
+            this.error(error instanceof Error ? error.message : String(error));
+        }
+    }
 }
 //# sourceMappingURL=create.js.map

package/dist/commands/ecdn/mtls/create.js.map

@@ -1 +1 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../../src/commands/ecdn/mtls/create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,KAAK,EAAE,EAAE,EAAC,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAC,WAAW,EAAE,cAAc,EAAC,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAC,CAAC,EAAE,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AAYnD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,WAAkC;IAC5E,MAAM,CAAC,WAAW,GAAG,QAAQ,CAC3B,CAAC,CAAC,uCAAuC,EAAE,2DAA2D,CAAC,EACvG,qCAAqC,CACtC,CAAC;IAEF,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAE7B,MAAM,CAAC,QAAQ,GAAG;QAChB,gIAAgI;KACjI,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,WAAW,CAAC,SAAS;QACxB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,WAAW,EAAE,CAAC,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;YAC/E,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/B,WAAW,EAAE,CAAC,CAAC,mCAAmC,EAAE,sCAAsC,CAAC;YAC3F,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/B,WAAW,EAAE,CAAC,CAAC,kCAAkC,EAAE,sCAAsC,CAAC;YAC1F,QAAQ,EAAE,IAAI;SACf,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAE/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,oCAAoC,EAAE,8BAA8B,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;QAE3E,MAAM,IAAI,GAA2B;YACnC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YACrB,WAAW;YACX,UAAU;SACX,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;YACvG,MAAM,EAAE;gBACN,IAAI,EAAE,EAAC,cAAc,EAAC;aACvB;YACD,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CACR,CAAC,CAAC,iCAAiC,EAAE,gDAAgD,EAAE;gBACrF,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC;aAC/B,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,kCAAkC,EAAE,uCAAuC,CAAC,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,MAAM,GAAiB,EAAC,WAAW,EAAE,IAAI,EAAC,CAAC;QAEjD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,EAAE,GAAG,KAAK,CAAC,EAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAC,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,EAAE,CAAC;QAEtB,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,CAAC,CAAC,mCAAmC,EAAE,wCAAwC,CAAC,EAAC,CAAC,CAAC;QACjG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,IAAI,GAAG,EAAC,CAAC,CAAC;QAC5F,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,mBAAmB,IAAI,GAAG,EAAC,CAAC,CAAC;QACpF,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,EAAC,CAAC,CAAC;QACzE,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,EAAC,CAAC,CAAC;QAE7E,IAAI,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAC1C,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,gCAAgC,EAAC,CAAC,CAAC;QAChG,CAAC;QAED,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEzB,OAAO,MAAM,CAAC;IAChB,CAAC"}
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../../src/commands/ecdn/mtls/create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,KAAK,EAAE,EAAE,EAAC,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GAEjC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAC,WAAW,EAAC,MAAM,8BAA8B,CAAC;AACzD,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,sCAAsC,EACtC,0BAA0B,GAE3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAC,CAAC,EAAE,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AAenD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,WAAkC;IAC5E,MAAM,CAAC,WAAW,GAAG,QAAQ,CAC3B,CAAC,CACC,uCAAuC,EACvC,uIAAuI,CACxI,EACD,qCAAqC,CACtC,CAAC;IAEF,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAE7B,MAAM,CAAC,QAAQ,GAAG;QAChB,gIAAgI;QAChI,oFAAoF;QACpF,iIAAiI;KAClI,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,WAAW,CAAC,SAAS;QACxB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,WAAW,EAAE,CAAC,CAAC,wBAAwB,EAAE,gDAAgD,CAAC;YAC1F,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/B,WAAW,EAAE,CAAC,CAAC,mCAAmC,EAAE,yCAAyC,CAAC;YAC9F,UAAU,EAAE,CAAC,kBAAkB,EAAE,UAAU,CAAC;YAC5C,SAAS,EAAE,CAAC,kBAAkB,CAAC;SAChC,CAAC;QACF,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/B,WAAW,EAAE,CAAC,CAAC,kCAAkC,EAAE,yCAAyC,CAAC;YAC7F,SAAS,EAAE,CAAC,kBAAkB,CAAC;SAChC,CAAC;QACF,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;YACtB,WAAW,EAAE,CAAC,CACZ,4BAA4B,EAC5B,qFAAqF,CACtF;YACD,UAAU,EAAE,CAAC,kBAAkB,EAAE,UAAU,CAAC;SAC7C,CAAC;QACF,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,CAAC,CAAC,0BAA0B,EAAE,iDAAiD,CAAC;YAC7F,OAAO,EAAE,YAAY;SACtB,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC;YAC1B,WAAW,EAAE,CAAC,CACZ,8BAA8B,EAC9B,8HAA8H,CAC/H;SACF,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC;YAC7B,WAAW,EAAE,CAAC,CACZ,iCAAiC,EACjC,sEAAsE,CACvE;YACD,GAAG,EAAE,0BAA0B;SAChC,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC;YAC7B,WAAW,EAAE,CAAC,CACZ,gCAAgC,EAChC,mHAAmH,CACpH;SACF,CAAC;QACF,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;YACvB,WAAW,EAAE,CAAC,CACZ,0BAA0B,EAC1B,6FAA6F,CAC9F;YACD,OAAO,EAAE,gCAAgC;YACzC,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,gCAAgC;SACtC,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC;YAC3B,WAAW,EAAE,CAAC,CACZ,8BAA8B,EAC9B,iGAAiG,CAClG;YACD,OAAO,EAAE,GAAG;YACZ,GAAG,EAAE,CAAC;SACP,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACnB,WAAW,EAAE,CAAC,CAAC,yBAAyB,EAAE,oCAAoC,CAAC;YAC/E,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAE/B,MAAM,cAAc,GAAG,0BAA0B,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC5E,IAAI,cAAc;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAEjF,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAC,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,EAAE,CAAC;QAEtB,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,CAAC,CAAC,mCAAmC,EAAE,wCAAwC,CAAC,EAAC,CAAC,CAAC;QACjG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,IAAI,GAAG,EAAC,CAAC,CAAC;QAC5F,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,mBAAmB,IAAI,GAAG,EAAC,CAAC,CAAC;QACpF,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,EAAC,CAAC,CAAC;QACzE,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,EAAC,CAAC,CAAC;QAE7E,IAAI,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAC1C,EAAE,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAC,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,gCAAgC,EAAC,CAAC,CAAC;QAChG,CAAC;QAED,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEzB,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5C,EAAE,CAAC,MAAM,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;YAC9E,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACd,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC9E,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACd,EAAE,CAAC,MAAM,CACP,uBAAuB,CAAC;gBACtB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB;gBACpC,QAAQ,EAAE,IAAI,CAAC,gCAAgC;gBAC/C,UAAU,EAAE,MAAM,CAAC,gBAAgB;aACpC,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,MAAM,CACP,CAAC,CACC,qCAAqC,EACrC,gGAAgG,CACjG,CACF,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,EAAC,KAAK,EAAC,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,sCAAsC,CAAC;gBAClD,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE;gBAClC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE;gBACxC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC7G,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,SAAS;gBAC1D,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC;gBACxB,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC;gBACnC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC;gBAChC,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC;gBACxC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE;oBACtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;wBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC7C,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,oCAAoC,EAAE,8BAA8B,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAE,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAE,EAAE,MAAM,CAAC,CAAC;QAE/E,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE,EAAE;gBAC1G,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;gBACrB,cAAc;gBACd,aAAa;aACd,CAAC,CAAC;YACH,OAAO,EAAC,WAAW,EAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC"}

package/dist/commands/ecdn/mtls/issue.d.ts

@@ -0,0 +1,46 @@
+import { BaseCommand } from '@salesforce/b2c-tooling-sdk/cli';
+/**
+ * Response type for the issue command.
+ */
+interface IssueOutput {
+    /** Path to the written PKCS12 file */
+    file: string;
+    /** Certificate expiry */
+    notAfter: string;
+    /** Passphrase protecting the PKCS12 file */
+    passphrase: string;
+    /** Hex serial number */
+    serialNumber: string;
+    /** Certificate subject */
+    subject: string;
+}
+/**
+ * Command to issue a client certificate (.p12) for mTLS code upload from an existing CA.
+ */
+export default class EcdnMtlsIssue extends BaseCommand<typeof EcdnMtlsIssue> {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        'ca-cert-file': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'ca-key-file': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        name: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'p12-passphrase': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        days: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'log-level': import("@oclif/core/interfaces").OptionFlag<"trace" | "debug" | "info" | "warn" | "error" | "silent" | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        jsonl: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        lang: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        instance: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'project-directory': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'extra-query': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'extra-body': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'extra-headers': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<IssueOutput>;
+}
+export {};

package/dist/commands/ecdn/mtls/issue.js

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+import { Flags, ux } from '@oclif/core';
+import * as fs from 'node:fs';
+import path from 'node:path';
+import { BaseCommand } from '@salesforce/b2c-tooling-sdk/cli';
+import { issueClientCertificate } from '@salesforce/b2c-tooling-sdk/operations/mtls';
+import { assertFilesWritable, clientCertificateNotice, toFileStem, writePrivateFile } from '../../../utils/ecdn/mtls.js';
+import { t, withDocs } from '../../../i18n/index.js';
+/**
+ * Command to issue a client certificate (.p12) for mTLS code upload from an existing CA.
+ */
+export default class EcdnMtlsIssue extends BaseCommand {
+    static description = withDocs(t('commands.ecdn.mtls.issue.description', 'Issue a client certificate (.p12) for mTLS code upload, signed by an existing CA (runs locally)'), '/cli/ecdn.html#b2c-ecdn-mtls-issue');
+    static enableJsonFlag = true;
+    static examples = [
+        '<%= config.bin %> <%= command.id %> --ca-cert-file mtls-certs/ca.pem --ca-key-file mtls-certs/ca.key --name jane.doe',
+        '<%= config.bin %> <%= command.id %> --ca-cert-file ca.pem --ca-key-file ca.key --name ci --output ci.p12 --days 90',
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        'ca-cert-file': Flags.string({
+            description: t('flags.caCertFile.description', 'Path to PEM-encoded CA certificate file'),
+            required: true,
+        }),
+        'ca-key-file': Flags.string({
+            description: t('flags.caKeyFile.description', 'Path to PEM-encoded CA private key file'),
+            required: true,
+        }),
+        name: Flags.string({
+            description: t('flags.clientCommonName.description', 'Common name identifying the client (user or pipeline)'),
+            required: true,
+        }),
+        output: Flags.string({
+            char: 'o',
+            description: t('flags.p12Output.description', 'Output path for the .p12 file (default: <name>.p12 next to the CA)'),
+        }),
+        'p12-passphrase': Flags.string({
+            description: t('flags.p12Passphrase.description', 'Passphrase for the .p12 (default: random)'),
+            env: 'SFCC_MTLS_P12_PASSPHRASE',
+        }),
+        days: Flags.integer({
+            description: t('flags.clientDays.description', 'Validity of the client certificate in days'),
+            default: 365,
+            min: 1,
+        }),
+        force: Flags.boolean({
+            description: t('flags.force.description', 'Overwrite an existing output file'),
+            default: false,
+        }),
+    };
+    async run() {
+        const { flags } = this;
+        const file = path.resolve(flags.output ?? path.join(path.dirname(flags['ca-cert-file']), `${toFileStem(flags.name)}.p12`));
+        let issued;
+        try {
+            assertFilesWritable([file], flags.force);
+            issued = issueClientCertificate({
+                ca: {
+                    certificatePem: fs.readFileSync(flags['ca-cert-file'], 'utf8'),
+                    privateKeyPem: fs.readFileSync(flags['ca-key-file'], 'utf8'),
+                },
+                commonName: flags.name,
+                validityDays: flags.days,
+                passphrase: flags['p12-passphrase'],
+            });
+            writePrivateFile(file, issued.pkcs12);
+        }
+        catch (error) {
+            this.error(error instanceof Error ? error.message : String(error));
+        }
+        const output = {
+            file,
+            passphrase: issued.passphrase,
+            subject: issued.subject,
+            serialNumber: issued.serialNumber,
+            notAfter: issued.notAfter.toISOString(),
+        };
+        if (this.jsonEnabled()) {
+            return output;
+        }
+        ux.stdout(t('commands.ecdn.mtls.issue.success', 'Client certificate issued successfully!'));
+        ux.stdout(`  Subject:     ${output.subject}`);
+        ux.stdout(`  Expires:     ${output.notAfter}`);
+        ux.stdout('');
+        ux.stdout(clientCertificateNotice({ file: output.file, passphrase: output.passphrase }));
+        ux.stdout('');
+        ux.stdout(t('commands.ecdn.mtls.issue.caReminder', 'Reminder: return the CA private key to secure storage when you are done issuing certificates.'));
+        return output;
+    }
+}
+//# sourceMappingURL=issue.js.map

package/dist/commands/ecdn/mtls/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../../../src/commands/ecdn/mtls/issue.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,KAAK,EAAE,EAAE,EAAC,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,WAAW,EAAC,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EAAC,sBAAsB,EAAC,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAC,mBAAmB,EAAE,uBAAuB,EAAE,UAAU,EAAE,gBAAgB,EAAC,MAAM,6BAA6B,CAAC;AACvH,OAAO,EAAC,CAAC,EAAE,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AAkBnD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAiC;IAC1E,MAAM,CAAC,WAAW,GAAG,QAAQ,CAC3B,CAAC,CACC,sCAAsC,EACtC,iGAAiG,CAClG,EACD,oCAAoC,CACrC,CAAC;IAEF,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAE7B,MAAM,CAAC,QAAQ,GAAG;QAChB,sHAAsH;QACtH,oHAAoH;KACrH,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,WAAW,CAAC,SAAS;QACxB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC;YAC3B,WAAW,EAAE,CAAC,CAAC,8BAA8B,EAAE,yCAAyC,CAAC;YACzF,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC;YAC1B,WAAW,EAAE,CAAC,CAAC,6BAA6B,EAAE,yCAAyC,CAAC;YACxF,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,WAAW,EAAE,CAAC,CAAC,oCAAoC,EAAE,uDAAuD,CAAC;YAC7G,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,CAAC,CACZ,6BAA6B,EAC7B,oEAAoE,CACrE;SACF,CAAC;QACF,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC;YAC7B,WAAW,EAAE,CAAC,CAAC,iCAAiC,EAAE,2CAA2C,CAAC;YAC9F,GAAG,EAAE,0BAA0B;SAChC,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,CAAC,CAAC,8BAA8B,EAAE,4CAA4C,CAAC;YAC5F,OAAO,EAAE,GAAG;YACZ,GAAG,EAAE,CAAC;SACP,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACnB,WAAW,EAAE,CAAC,CAAC,yBAAyB,EAAE,mCAAmC,CAAC;YAC9E,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAC,KAAK,EAAC,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CACvB,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAChG,CAAC;QAEF,IAAI,MAAiD,CAAC;QACtD,IAAI,CAAC;YACH,mBAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,GAAG,sBAAsB,CAAC;gBAC9B,EAAE,EAAE;oBACF,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;oBAC9D,aAAa,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;iBAC7D;gBACD,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,YAAY,EAAE,KAAK,CAAC,IAAI;gBACxB,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC;aACpC,CAAC,CAAC;YACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,IAAI;YACJ,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;SACxC,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,kCAAkC,EAAE,yCAAyC,CAAC,CAAC,CAAC;QAC5F,EAAE,CAAC,MAAM,CAAC,kBAAkB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,EAAE,CAAC,MAAM,CAAC,kBAAkB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAC,CAAC,CAAC,CAAC;QACvF,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACd,EAAE,CAAC,MAAM,CACP,CAAC,CACC,qCAAqC,EACrC,+FAA+F,CAChG,CACF,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC"}

package/dist/commands/ecdn/mtls/setup.d.ts

@@ -0,0 +1,55 @@
+import type { MtlsCertificate } from '@salesforce/b2c-tooling-sdk/operations/mtls';
+import { EcdnCommand } from '../../../utils/ecdn/index.js';
+import { type CodeUploadCertificateFiles } from '../../../utils/ecdn/mtls.js';
+/**
+ * Response type for the setup command.
+ */
+interface SetupOutput {
+    certificate?: MtlsCertificate;
+    clientPassphrase?: string;
+    /** Path of dw.json if it was updated */
+    configUpdated?: string;
+    created: boolean;
+    files?: CodeUploadCertificateFiles;
+}
+/**
+ * Interactive wizard for end-to-end mTLS code upload certificate setup.
+ */
+export default class EcdnMtlsSetup extends EcdnCommand<typeof EcdnMtlsSetup> {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        'p12-passphrase': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'client-id': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'client-secret': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'auth-scope': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'short-code': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'tenant-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'auth-methods': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'user-auth': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'account-manager-host': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'jwt-cert': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'jwt-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'jwt-passphrase': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'log-level': import("@oclif/core/interfaces").OptionFlag<"trace" | "debug" | "info" | "warn" | "error" | "silent" | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        jsonl: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        lang: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        instance: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'project-directory': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'extra-query': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'extra-body': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'extra-headers': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<SetupOutput>;
+    /**
+     * Returns `false` if no generated files exist, `true` if the user agreed to overwrite, or `undefined` to cancel.
+     */
+    private confirmOverwrite;
+    private listExisting;
+    private maybeUpdateConfig;
+}
+export {};

package/dist/commands/ecdn/mtls/setup.js

@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+import { Flags, ux } from '@oclif/core';
+import { confirm, input } from '@inquirer/prompts';
+import * as fs from 'node:fs';
+import path from 'node:path';
+import { updateInstanceConfig } from '@salesforce/b2c-tooling-sdk/config';
+import { EcdnCommand } from '../../../utils/ecdn/index.js';
+import { caKeySecurityNotice, clientCertificateNotice, defaultCaCommonName, generateAndUploadCodeUploadCertificate, stagingOrganizationWarning, } from '../../../utils/ecdn/mtls.js';
+import { t, withDocs } from '../../../i18n/index.js';
+/**
+ * Interactive wizard for end-to-end mTLS code upload certificate setup.
+ */
+export default class EcdnMtlsSetup extends EcdnCommand {
+    static description = withDocs(t('commands.ecdn.mtls.setup.description', 'Guided version of "ecdn mtls create --generate": prompts for names with defaults, generates and registers a CA, issues a client certificate, and optionally configures dw.json'), '/cli/ecdn.html#b2c-ecdn-mtls-setup');
+    static enableJsonFlag = true;
+    static examples = ['<%= config.bin %> <%= command.id %> --tenant-id zzxy_prd'];
+    static flags = {
+        ...EcdnCommand.baseFlags,
+        'p12-passphrase': Flags.string({
+            description: t('flags.p12Passphrase.description', 'Passphrase for the generated .p12 (default: random)'),
+            env: 'SFCC_MTLS_P12_PASSPHRASE',
+        }),
+    };
+    async run() {
+        if (!process.stdin.isTTY || !process.stdout.isTTY) {
+            this.error(t('commands.ecdn.mtls.setup.notInteractive', 'This command is interactive. For non-interactive use, run "b2c ecdn mtls create --generate".'));
+        }
+        this.requireOAuthCredentials();
+        const stagingWarning = stagingOrganizationWarning(this.getOrganizationId());
+        if (stagingWarning)
+            this.warn(stagingWarning);
+        const existing = await this.listExisting();
+        if (existing.length > 0) {
+            ux.stdout(t('commands.ecdn.mtls.setup.existing', 'Existing code upload certificates:'));
+            for (const cert of existing) {
+                ux.stdout(`  - ${cert.mtlsCertificateName ?? cert.mtlsCertificateId} (expires ${cert.expiresOn ?? '-'}, hostname ${cert.mtlsAssociatedCodeUploadHostname ?? '-'})`);
+            }
+            ux.stdout('');
+            ux.stdout(t('commands.ecdn.mtls.setup.rotationHint', 'Create a new CA to rotate an expiring or compromised one: keep the old CA until every client certificate is re-issued from the new CA, then remove it with "b2c ecdn mtls delete".'));
+            const proceed = await confirm({
+                message: t('commands.ecdn.mtls.setup.createAnother', 'Create a new CA certificate?'),
+                default: false,
+            });
+            if (!proceed) {
+                ux.stdout(t('commands.ecdn.mtls.setup.useIssue', 'To add a client certificate for an existing CA, use "b2c ecdn mtls issue".'));
+                return { created: false };
+            }
+        }
+        const name = await input({
+            message: t('commands.ecdn.mtls.setup.namePrompt', 'CA name (a label shown in eCDN and Business Manager):'),
+            default: 'code-upload',
+            validate: (v) => v.trim().length > 0 || 'Name is required',
+        });
+        const clientName = await input({
+            message: t('commands.ecdn.mtls.setup.clientNamePrompt', 'Client certificate name, for the .p12 you upload with (e.g. github-actions for a CI pipeline, or your Business Manager username):'),
+            default: 'ci',
+            validate: (v) => v.trim().length > 0 || 'Name is required',
+        });
+        const outDir = await input({
+            message: t('commands.ecdn.mtls.setup.outDirPrompt', 'Directory for generated files:'),
+            default: 'mtls-certs',
+        });
+        const force = await this.confirmOverwrite(outDir);
+        if (force === undefined) {
+            return { created: false };
+        }
+        const result = await generateAndUploadCodeUploadCertificate({
+            client: this.getCdnZonesRwClient(),
+            organizationId: this.getOrganizationId(),
+            name: name.trim(),
+            caCommonName: defaultCaCommonName(name.trim(), this.resolvedConfig.values.hostname),
+            clientName: clientName.trim(),
+            outDir,
+            passphrase: this.flags['p12-passphrase'],
+            force,
+            onProgress: (message) => {
+                if (!this.jsonEnabled())
+                    this.log(message);
+            },
+        }).catch((error) => this.error(error instanceof Error ? error.message : String(error)));
+        const output = { created: true, ...result };
+        output.configUpdated = await this.maybeUpdateConfig(result.files, result.clientPassphrase);
+        const cert = result.certificate;
+        ux.stdout('');
+        ux.stdout(ux.colorize('green', t('commands.ecdn.mtls.setup.success', 'Two-factor code upload is set up.')));
+        ux.stdout(`  Certificate ID:  ${cert.mtlsCertificateId ?? '-'}`);
+        ux.stdout(`  Hostname:        ${cert.mtlsAssociatedCodeUploadHostname ?? '-'}`);
+        ux.stdout(`  CA certificate:  ${result.files.caCertificate}`);
+        ux.stdout('');
+        ux.stdout(caKeySecurityNotice(result.files.caPrivateKey, result.caExpiresOn));
+        ux.stdout('');
+        ux.stdout(clientCertificateNotice({
+            file: result.files.clientCertificate,
+            hostname: cert.mtlsAssociatedCodeUploadHostname,
+            passphrase: result.clientPassphrase,
+        }));
+        if (output.configUpdated) {
+            ux.stdout('');
+            ux.stdout(t('commands.ecdn.mtls.setup.configNote', 'dw.json now contains the .p12 passphrase; make sure dw.json is not committed to your repository.'));
+        }
+        return output;
+    }
+    /**
+     * Returns `false` if no generated files exist, `true` if the user agreed to overwrite, or `undefined` to cancel.
+     */
+    async confirmOverwrite(outDir) {
+        const existing = ['ca.pem', 'ca.key'].map((f) => path.resolve(outDir, f)).filter((f) => fs.existsSync(f));
+        if (existing.length === 0) {
+            return false;
+        }
+        const overwrite = await confirm({
+            message: t('commands.ecdn.mtls.setup.overwrite', 'Overwrite existing files ({{files}})?', {
+                files: existing.join(', '),
+            }),
+            default: false,
+        });
+        return overwrite ? true : undefined;
+    }
+    async listExisting() {
+        const { data, error } = await this.getCdnZonesClient().GET('/organizations/{organizationId}/mtls/code-upload-certificates', { params: { path: { organizationId: this.getOrganizationId() } } });
+        if (error) {
+            this.logger.debug({ error }, 'Failed to list existing mTLS certificates');
+            return [];
+        }
+        return data?.data ?? [];
+    }
+    async maybeUpdateConfig(files, passphrase) {
+        // Prefer the dw.json the configuration was actually loaded from (it may be in a parent directory).
+        const loadedFrom = this.resolvedConfig.sources.find((s) => s.name === 'DwJsonSource' && s.location)?.location;
+        const dwJsonPath = path.resolve(loadedFrom ?? this.flags.config ?? path.join(this.flags['project-directory'] ?? process.cwd(), 'dw.json'));
+        if (!fs.existsSync(dwJsonPath)) {
+            ux.stdout(t('commands.ecdn.mtls.setup.noConfig', 'No dw.json found; to upload from this machine, configure "certificate" and "certificate-passphrase" manually.'));
+            return undefined;
+        }
+        const update = await confirm({
+            message: t('commands.ecdn.mtls.setup.updateConfig', 'Also use this certificate for code upload from this machine (updates {{path}})?', { path: dwJsonPath }),
+            default: false,
+        });
+        if (!update) {
+            return undefined;
+        }
+        try {
+            const result = await updateInstanceConfig({
+                certificate: files.clientCertificate,
+                certificatePassphrase: passphrase,
+            }, { path: dwJsonPath, instance: this.flags.instance });
+            ux.stdout(t('commands.ecdn.mtls.setup.configUpdated', 'Updated instance "{{name}}" in {{path}}', {
+                name: result.name ?? 'root',
+                path: result.path,
+            }));
+            return result.path;
+        }
+        catch (error) {
+            this.warn(t('commands.ecdn.mtls.setup.configUpdateFailed', 'Could not update dw.json: {{message}}', {
+                message: error instanceof Error ? error.message : String(error),
+            }));
+            return undefined;
+        }
+    }
+}
+//# sourceMappingURL=setup.js.map