@salesforce/b2c-tooling-sdk 1.9.0 → 1.11.0

package/dist/cjs/cli/am-command.js

@@ -1,199 +0,0 @@
-import { OAuthCommand } from './oauth-command.js';
-import { createAccountManagerClient } from '../clients/am-api.js';
-import { ImplicitOAuthStrategy } from '../auth/oauth-implicit.js';
-import { JwtOAuthStrategy } from '../auth/oauth-jwt.js';
-import { StatefulOAuthStrategy } from '../auth/stateful-oauth-strategy.js';
-import { getDefaultPublicClientId } from '../defaults.js';
-/** Account Manager role: User Administrator */
-const AM_USER_ADMIN = 'User Administrator';
-/** Account Manager role: Account Administrator */
-const AM_ACCOUNT_ADMIN = 'Account Administrator';
-/** Account Manager role: API Administrator */
-const AM_API_ADMIN = 'API Administrator';
-/** Patterns that indicate an authentication/authorization error */
-const AUTH_ERROR_PATTERNS = [
-    'access is denied',
-    'accessdeniedexception',
-    'authentication invalid',
-    'operation forbidden',
-    '401',
-    '403',
-    'failed to get access token',
-    'unauthorized',
-];
-/**
- * Base command for Account Manager operations.
- *
- * Extends OAuthCommand with Account Manager client setup for users, roles, and organizations.
- * Provides enhanced error messages with role-specific guidance when authentication fails.
- *
- * @example
- * export default class UserList extends AmCommand<typeof UserList> {
- *   async run(): Promise<void> {
- *     const users = await this.accountManagerClient.listUsers({});
- *     // ...
- *   }
- * }
- *
- * @example
- * export default class OrgList extends AmCommand<typeof OrgList> {
- *   async run(): Promise<void> {
- *     const orgs = await this.accountManagerClient.listOrgs();
- *     // ...
- *   }
- * }
- */
-export class AmCommand extends OAuthCommand {
-    getDefaultClientId() {
-        return getDefaultPublicClientId(this.accountManagerHost);
-    }
-    _accountManagerClient;
-    _authStrategy;
-    /**
-     * Gets the auth method type that was used, based on the stored strategy.
-     */
-    get authMethodUsed() {
-        if (!this._authStrategy)
-            return undefined;
-        if (this._authStrategy instanceof ImplicitOAuthStrategy)
-            return 'implicit';
-        if (this._authStrategy instanceof StatefulOAuthStrategy)
-            return 'stateful';
-        if (this._authStrategy instanceof JwtOAuthStrategy)
-            return 'jwt';
-        return 'client-credentials';
-    }
-    /**
-     * Gets the unified Account Manager client, creating it if necessary.
-     * This provides direct access to all Account Manager API methods (users, roles, orgs).
-     *
-     * @example
-     * const client = this.accountManagerClient;
-     * const users = await client.listUsers({});
-     * const roles = await client.listRoles({});
-     * const orgs = await client.listOrgs();
-     * const user = await client.getUser('user-id');
-     * const role = await client.getRole('bm-admin');
-     * const org = await client.getOrg('org-id');
-     */
-    get accountManagerClient() {
-        if (!this._accountManagerClient) {
-            this.requireOAuthCredentials();
-            const authStrategy = this.getOAuthStrategy();
-            this._authStrategy = authStrategy;
-            this._accountManagerClient = createAccountManagerClient({
-                hostname: this.accountManagerHost,
-            }, authStrategy);
-        }
-        return this._accountManagerClient;
-    }
-    /**
-     * Override catch() to detect auth errors and append contextual AM role guidance.
-     */
-    async catch(err) {
-        const message = err.message?.toLowerCase() ?? '';
-        const isAuthError = AUTH_ERROR_PATTERNS.some((pattern) => message.includes(pattern));
-        if (isAuthError) {
-            const suggestion = this.getAuthErrorSuggestion();
-            if (suggestion) {
-                err.message = `${err.message}\n\n${suggestion}`;
-            }
-        }
-        return super.catch(err);
-    }
-    /**
-     * Builds a contextual suggestion message based on the auth method and AM subtopic.
-     */
-    getAuthErrorSuggestion() {
-        const subtopic = this.getAmSubtopic();
-        const authMethod = this.authMethodUsed;
-        if (!subtopic)
-            return undefined;
-        // Try to get current JWT roles for client-credentials / stateful (avoid triggering browser for implicit)
-        let rolesInfo = '';
-        if ((authMethod === 'client-credentials' || authMethod === 'stateful') && this._authStrategy) {
-            try {
-                // getJWT() is async but we only want cached token info — use synchronous check
-                // The token should already be cached if we got far enough to receive an auth error
-                rolesInfo = this.getJwtRolesInfo();
-            }
-            catch {
-                // Token may be expired or unavailable, skip roles info
-            }
-        }
-        if (authMethod === 'client-credentials' || authMethod === 'stateful') {
-            return this.getClientCredentialsSuggestion(subtopic, rolesInfo);
-        }
-        if (authMethod === 'implicit') {
-            return this.getImplicitSuggestion(subtopic);
-        }
-        return undefined;
-    }
-    /**
-     * Gets the AM subtopic from the command ID (e.g., 'am:users:list' → 'users').
-     */
-    getAmSubtopic() {
-        if (!this.id)
-            return undefined;
-        const parts = this.id.split(':');
-        // Command IDs are like 'am:users:list', 'am:roles:get', 'am:orgs:list', 'am:clients:list'
-        const amIndex = parts.indexOf('am');
-        if (amIndex >= 0 && amIndex + 1 < parts.length) {
-            return parts[amIndex + 1];
-        }
-        return undefined;
-    }
-    /**
-     * Attempts to extract roles from the cached JWT token synchronously.
-     */
-    getJwtRolesInfo() {
-        // Access the strategy's internal token cache via getJWT()
-        // This is best-effort — if no token is cached, we skip
-        if (!this._authStrategy)
-            return '';
-        // We can't call async getJWT() here, but we can check if OAuthStrategy has a cached token
-        // by looking at the strategy type. For now, we'll return empty and let the suggestion
-        // work without role details.
-        return '';
-    }
-    /**
-     * Suggestion for client-credentials auth failures.
-     */
-    getClientCredentialsSuggestion(subtopic, rolesInfo) {
-        const suffix = rolesInfo ? `\n${rolesInfo}` : '';
-        switch (subtopic) {
-            case 'users':
-            case 'roles':
-                return (`Suggestion: Add the "${AM_USER_ADMIN}" role to your API client, ` +
-                    `or use --user-auth to authenticate as a user with the appropriate role.${suffix}`);
-            case 'orgs':
-                return (`Suggestion: Use --user-auth to authenticate as a user with the "${AM_ACCOUNT_ADMIN}" role. ` +
-                    `Organization management requires user authentication.${suffix}`);
-            case 'clients':
-                return (`Suggestion: Use --user-auth to authenticate as a user with the ` +
-                    `"${AM_ACCOUNT_ADMIN}" or "${AM_API_ADMIN}" role. ` +
-                    `API client management requires user authentication.${suffix}`);
-            default:
-                return `Suggestion: Try using --user-auth for browser-based authentication.${suffix}`;
-        }
-    }
-    /**
-     * Suggestion for implicit auth failures.
-     */
-    getImplicitSuggestion(subtopic) {
-        switch (subtopic) {
-            case 'users':
-            case 'roles':
-                return (`Suggestion: Your user account needs the "${AM_ACCOUNT_ADMIN}" or "${AM_USER_ADMIN}" role ` +
-                    `to manage users and roles.`);
-            case 'clients':
-                return (`Suggestion: Your user account needs the "${AM_ACCOUNT_ADMIN}" or "${AM_API_ADMIN}" role ` +
-                    `to manage API clients.`);
-            case 'orgs':
-                return `Suggestion: Your user account needs the "${AM_ACCOUNT_ADMIN}" role to manage organizations.`;
-            default:
-                return `Suggestion: Verify your user account has the appropriate Account Manager role.`;
-        }
-    }
-}
-//# sourceMappingURL=am-command.js.map

package/dist/cjs/cli/am-command.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"am-command.js","sourceRoot":"","sources":["../../../src/cli/am-command.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,YAAY,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAC,0BAA0B,EAAC,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EAAC,qBAAqB,EAAC,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAC,qBAAqB,EAAC,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAC,wBAAwB,EAAC,MAAM,gBAAgB,CAAC;AAExD,+CAA+C;AAC/C,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,kDAAkD;AAClD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,8CAA8C;AAC9C,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC,mEAAmE;AACnE,MAAM,mBAAmB,GAAG;IAC1B,kBAAkB;IAClB,uBAAuB;IACvB,wBAAwB;IACxB,qBAAqB;IACrB,KAAK;IACL,KAAK;IACL,4BAA4B;IAC5B,cAAc;CACf,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAgB,SAAoC,SAAQ,YAAe;IAC5D,kBAAkB;QACnC,OAAO,wBAAwB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IAEO,qBAAqB,CAAwB;IAC7C,aAAa,CAAoF;IAEzG;;OAEG;IACH,IAAc,cAAc;QAC1B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,aAAa,YAAY,qBAAqB;YAAE,OAAO,UAAU,CAAC;QAC3E,IAAI,IAAI,CAAC,aAAa,YAAY,qBAAqB;YAAE,OAAO,UAAU,CAAC;QAC3E,IAAI,IAAI,CAAC,aAAa,YAAY,gBAAgB;YAAE,OAAO,KAAK,CAAC;QACjE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,IAAc,oBAAoB;QAChC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7C,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;YAClC,IAAI,CAAC,qBAAqB,GAAG,0BAA0B,CACrD;gBACE,QAAQ,EAAE,IAAI,CAAC,kBAAkB;aAClC,EACD,YAAY,CACb,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,KAAK,CAAC,GAAgC;QACpD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAErF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,OAAO,GAAG,GAAG,GAAG,CAAC,OAAO,OAAO,UAAU,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,sBAAsB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC;QAEvC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhC,yGAAyG;QACzG,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,UAAU,KAAK,oBAAoB,IAAI,UAAU,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC7F,IAAI,CAAC;gBACH,+EAA+E;gBAC/E,mFAAmF;gBACnF,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;QAED,IAAI,UAAU,KAAK,oBAAoB,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,0FAA0F;QAC1F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,0DAA0D;QAC1D,uDAAuD;QACvD,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,EAAE,CAAC;QAEnC,0FAA0F;QAC1F,sFAAsF;QACtF,6BAA6B;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,8BAA8B,CAAC,QAAgB,EAAE,SAAiB;QACxE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjD,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,OAAO,CAAC;YACb,KAAK,OAAO;gBACV,OAAO,CACL,wBAAwB,aAAa,6BAA6B;oBAClE,0EAA0E,MAAM,EAAE,CACnF,CAAC;YACJ,KAAK,MAAM;gBACT,OAAO,CACL,mEAAmE,gBAAgB,UAAU;oBAC7F,wDAAwD,MAAM,EAAE,CACjE,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,CACL,iEAAiE;oBACjE,IAAI,gBAAgB,SAAS,YAAY,UAAU;oBACnD,sDAAsD,MAAM,EAAE,CAC/D,CAAC;YACJ;gBACE,OAAO,sEAAsE,MAAM,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,QAAgB;QAC5C,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,OAAO,CAAC;YACb,KAAK,OAAO;gBACV,OAAO,CACL,4CAA4C,gBAAgB,SAAS,aAAa,SAAS;oBAC3F,4BAA4B,CAC7B,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,CACL,4CAA4C,gBAAgB,SAAS,YAAY,SAAS;oBAC1F,wBAAwB,CACzB,CAAC;YACJ,KAAK,MAAM;gBACT,OAAO,4CAA4C,gBAAgB,iCAAiC,CAAC;YACvG;gBACE,OAAO,gFAAgF,CAAC;QAC5F,CAAC;IACH,CAAC;CACF"}

package/dist/cjs/cli/base-command.d.ts

@@ -1,232 +0,0 @@
-import { Command, type Interfaces } from '@oclif/core';
-import type { LoadConfigOptions } from './config.js';
-import type { ResolvedB2CConfig } from '../config/index.js';
-import { type Logger } from '../logging/index.js';
-import { type ExtraParamsConfig } from '../clients/middleware.js';
-import { SafetyGuard } from '../safety/safety-guard.js';
-import type { SafetyEvaluation } from '../safety/types.js';
-import { Telemetry, type TelemetryAttributes } from '../telemetry/index.js';
-export type Flags<T extends typeof Command> = Interfaces.InferredFlags<(typeof BaseCommand)['baseFlags'] & T['flags']>;
-export type Args<T extends typeof Command> = Interfaces.InferredArgs<T['args']>;
-/**
- * Base command class for B2C CLI tools.
- *
- * Environment variables for logging:
- * - SFCC_JSON_LOGS: Output log messages as JSON lines (for log aggregation)
- * - SFCC_LOG_TO_STDOUT: Send logs to stdout instead of stderr
- * - SFCC_LOG_COLORIZE: Force colors on/off (default: auto-detect TTY)
- * - SFCC_REDACT_SECRETS: Set to 'false' to disable secret redaction
- * - NO_COLOR: Industry standard to disable colors
- *
- * Environment variables for telemetry:
- * - SF_DISABLE_TELEMETRY: Set to 'true' to disable telemetry (sf CLI standard)
- * - SFCC_DISABLE_TELEMETRY: Set to 'true' to disable telemetry
- * - SFCC_APP_INSIGHTS_KEY: Override connection string from package.json
- */
-export declare abstract class BaseCommand<T extends typeof Command> extends Command {
-    static baseFlags: {
-        'log-level': Interfaces.OptionFlag<"trace" | "debug" | "info" | "warn" | "error" | "silent" | undefined, Interfaces.CustomOptions>;
-        debug: Interfaces.BooleanFlag<boolean>;
-        json: Interfaces.BooleanFlag<boolean>;
-        jsonl: Interfaces.BooleanFlag<boolean>;
-        lang: Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
-        config: Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
-        instance: Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
-        'project-directory': Interfaces.OptionFlag<string, Interfaces.CustomOptions>;
-        'extra-query': Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
-        'extra-body': Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
-        'extra-headers': Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
-    };
-    protected flags: Flags<T>;
-    protected args: Args<T>;
-    protected resolvedConfig: ResolvedB2CConfig;
-    protected logger: Logger;
-    /** Safety guard for evaluating operations against safety rules and levels. */
-    protected safetyGuard: SafetyGuard;
-    /** Telemetry instance for tracking command events */
-    protected telemetry?: Telemetry;
-    /** Start time for command duration tracking */
-    private commandStartTime?;
-    init(): Promise<void>;
-    /**
-     * Auto-initialize telemetry from package.json oclif.telemetry config.
-     * Called during init() to enable automatic telemetry for all commands.
-     */
-    private initTelemetryFromConfig;
-    /**
-     * Manual telemetry initialization for non-pjson usage (e.g., MCP server with additional attributes).
-     * Use this when you need to pass custom initial attributes or use a different connection string.
-     *
-     * @param options - Telemetry options
-     * @returns The telemetry instance, or undefined if telemetry is disabled
-     */
-    protected initTelemetry(options: {
-        appInsightsKey?: string;
-        initialAttributes?: TelemetryAttributes;
-    }): Promise<Telemetry | undefined>;
-    /**
-     * Determine colorize setting based on env vars and TTY.
-     * Priority: NO_COLOR > SFCC_LOG_COLORIZE > TTY detection
-     */
-    private shouldColorize;
-    protected configureLogging(): void;
-    /**
-     * Override oclif's log() to use pino.
-     */
-    log(message?: string, ...args: unknown[]): void;
-    /**
-     * Override oclif's warn() to use pino.
-     */
-    warn(input: string | Error): string | Error;
-    /**
-     * Gets base configuration options from common flags.
-     *
-     * Subclasses should spread these options when overriding loadConfiguration()
-     * to ensure common options like projectDirectory are always included.
-     *
-     * @example
-     * ```typescript
-     * protected override loadConfiguration(): ResolvedB2CConfig {
-     *   const options: LoadConfigOptions = {
-     *     ...this.getBaseConfigOptions(),
-     *     // Add subclass-specific options here
-     *   };
-     *   return loadConfig(extractMyFlags(this.flags), options);
-     * }
-     * ```
-     */
-    protected getBaseConfigOptions(): LoadConfigOptions;
-    protected loadConfiguration(): Promise<ResolvedB2CConfig>;
-    /**
-     * Enrich telemetry with realm/tenant context from the resolved configuration.
-     * Called after loadConfiguration() in init() so that COMMAND_SUCCESS and
-     * COMMAND_EXCEPTION events include organizational context.
-     */
-    protected addTelemetryContext(): void;
-    /**
-     * Collects config sources from plugins via the `b2c:config-sources` hook.
-     *
-     * This method is called during command initialization, after flags are parsed
-     * but before configuration is resolved. It allows CLI plugins to provide
-     * custom ConfigSource implementations.
-     *
-     * Plugin sources are registered with the global config source registry
-     * and automatically included in all subsequent `resolveConfig()` calls.
-     *
-     * Priority mapping:
-     * - 'before' → -1 (higher priority than defaults)
-     * - 'after' → 10 (lower priority than defaults)
-     * - number → used directly
-     */
-    protected collectPluginConfigSources(): Promise<void>;
-    /**
-     * Collects HTTP middleware from plugins via the `b2c:http-middleware` hook.
-     *
-     * This method is called during command initialization, after flags are parsed
-     * but before any API clients are created. It allows CLI plugins to provide
-     * custom middleware that will be applied to all HTTP clients.
-     *
-     * Plugin middleware is registered with the global middleware registry.
-     */
-    protected collectPluginHttpMiddleware(): Promise<void>;
-    /**
-     * Collects auth middleware from plugins via the `b2c:auth-middleware` hook.
-     *
-     * This method is called during command initialization, after flags are parsed
-     * but before any authentication is performed. It allows CLI plugins to provide
-     * custom middleware that will be applied to OAuth token requests.
-     *
-     * Plugin middleware is registered with the global auth middleware registry.
-     */
-    protected collectPluginAuthMiddleware(): Promise<void>;
-    /**
-     * Handle errors thrown during command execution.
-     *
-     * Logs the error using the structured logger (including cause if available).
-     * In JSON mode, outputs a JSON error object to stdout instead of oclif's default format.
-     * Sends exception to telemetry if initialized.
-     */
-    protected catch(err: Error & {
-        exitCode?: number;
-    }): Promise<never>;
-    /**
-     * Called after run() completes (whether successfully or via catch()).
-     * Tracks COMMAND_SUCCESS and stops telemetry.
-     */
-    protected finally(err: Error | undefined): Promise<void>;
-    baseCommandTest(): void;
-    /**
-     * Check if destructive operations are allowed based on safety level.
-     * Provides early, user-friendly error messages before HTTP requests are attempted.
-     *
-     * This is a command-level check that complements the HTTP middleware safety guard.
-     * While the middleware provides unbypassable protection, this method offers better
-     * error messages and early detection.
-     *
-     * Destructive operations include:
-     * - Deleting resources (sandboxes, users, API clients, etc.)
-     * - Resetting or wiping data
-     * - Force operations that overwrite data
-     * - Revoking access or permissions
-     *
-     * NOTE: This is optional - the HTTP middleware will catch any operations that bypass
-     * this check. Use this method for better UX when you know an operation is destructive.
-     *
-     * @param operationDescription - Description of the operation (e.g., "delete sandbox", "reset user password")
-     * @throws Error if safety level blocks the operation
-     *
-     * @example
-     * ```typescript
-     * async run() {
-     *   this.assertDestructiveOperationAllowed('delete sandbox');
-     *   // ... proceed with deletion
-     * }
-     * ```
-     */
-    protected assertDestructiveOperationAllowed(operationDescription?: string): void;
-    /**
-     * Parse extra params from --extra-query, --extra-body, and --extra-headers flags.
-     * Returns undefined if no extra params are specified.
-     *
-     * @returns ExtraParamsConfig or undefined
-     */
-    protected getExtraParams(): ExtraParamsConfig | undefined;
-    /**
-     * Register safety middleware that evaluates all HTTP requests against the SafetyGuard.
-     *
-     * The middleware reads `this.safetyGuard` lazily (via arrow function closure), so it
-     * picks up the full config after `initializeSafetyGuard()` runs. This allows the
-     * middleware to be registered early in init() before config resolution completes.
-     */
-    private registerSafetyMiddleware;
-    /**
-     * Update the safety guard with config-provided safety settings.
-     * Called after loadConfiguration() to merge env vars, global safety config,
-     * and per-instance dw.json config.
-     */
-    private initializeSafetyGuard;
-    /**
-     * Evaluate command-level safety rules for the current command.
-     *
-     * This runs at the end of init() so every command is evaluated against
-     * command rules (e.g., `{ command: "code:deploy", action: "block" }`).
-     * If no command rule matches, this is a no-op — level-based blocking
-     * is handled by the HTTP middleware and assertDestructiveOperationAllowed().
-     */
-    private evaluateCommandSafety;
-    /**
-     * Require interactive confirmation for a safety-guarded operation.
-     *
-     * If stdin is a TTY, prompts the user. Otherwise, blocks with an error message.
-     * The error message clearly indicates the block is from the user's own safety configuration.
-     *
-     * @param evaluation - The safety evaluation that triggered confirmation
-     * @throws Error if confirmation is denied or not possible
-     */
-    protected confirmOrBlock(evaluation: SafetyEvaluation): Promise<void>;
-    /**
-     * Register extra params (query, body, headers) as global middleware.
-     * This applies to ALL HTTP clients created during command execution.
-     */
-    private registerExtraParamsMiddleware;
-}