@salesforce/b2c-tooling-sdk 2.1.0 → 2.2.0

package/dist/esm/operations/mtls/index.js

@@ -0,0 +1,270 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+/**
+ * mTLS code upload certificate operations for B2C Commerce.
+ *
+ * Two-factor (mTLS) code upload to staging via eCDN works with a private
+ * certificate authority (CA):
+ *
+ * 1. Generate a CA certificate and key ({@link generateCaCertificate}).
+ * 2. Upload the CA to eCDN ({@link createCodeUploadCertificate}). The response
+ *    includes the code upload hostname associated with the staging zone.
+ * 3. Issue one or more client certificates signed by the CA, bundled as PKCS12
+ *    (`.p12`) files ({@link issueClientCertificate}). Each user (named after their
+ *    Business Manager username) or CI pipeline (named after its API client ID)
+ *    gets its own client certificate for WebDAV uploads; the CA itself is never
+ *    used as a client certificate.
+ *
+ * The CA certificate may be valid for at most {@link MAX_CODE_UPLOAD_CA_VALIDITY_DAYS}
+ * days. To rotate, upload a new CA before the old one expires, re-issue client
+ * certificates from it, then delete the old CA.
+ *
+ * ## Usage
+ *
+ * ```typescript
+ * import {createCdnZonesClient} from '@salesforce/b2c-tooling-sdk/clients';
+ * import {
+ *   createCodeUploadCertificate,
+ *   generateCaCertificate,
+ *   issueClientCertificate,
+ * } from '@salesforce/b2c-tooling-sdk/operations/mtls';
+ *
+ * const ca = generateCaCertificate({commonName: 'My Code Upload CA'});
+ * const client = createCdnZonesClient({shortCode, tenantId}, auth, {readWrite: true});
+ * const uploaded = await createCodeUploadCertificate(client, organizationId, {
+ *   name: 'code-upload',
+ *   certificatePem: ca.certificatePem,
+ *   privateKeyPem: ca.privateKeyPem,
+ * });
+ *
+ * const clientCert = issueClientCertificate({ca, commonName: 'build-server'});
+ * await fs.writeFile('build-server.p12', clientCert.pkcs12);
+ * // clientCert.passphrase protects the .p12; uploaded.mtlsAssociatedCodeUploadHostname
+ * // is the WebDAV hostname to use with it.
+ * ```
+ *
+ * @module operations/mtls
+ */
+import { generateKeyPairSync, randomBytes, X509Certificate } from 'node:crypto';
+import forge from 'node-forge';
+import { getApiErrorMessage } from '../../clients/error-utils.js';
+import { getLogger } from '../../logging/logger.js';
+/**
+ * Maximum validity eCDN accepts for an uploaded code upload CA certificate.
+ * Also the default validity for {@link generateCaCertificate}.
+ */
+export const MAX_CODE_UPLOAD_CA_VALIDITY_DAYS = 365;
+/** Default validity for a generated CA certificate. */
+export const DEFAULT_CA_VALIDITY_DAYS = MAX_CODE_UPLOAD_CA_VALIDITY_DAYS;
+/** Default validity for an issued client certificate (1 year). */
+export const DEFAULT_CLIENT_VALIDITY_DAYS = 365;
+/** Default RSA key size in bits. */
+export const DEFAULT_KEY_SIZE = 2048;
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+/**
+ * Generates a random passphrase suitable for protecting a PKCS12 bundle.
+ *
+ * @returns A 32-character URL-safe random string
+ */
+export function generatePassphrase() {
+    return randomBytes(24).toString('base64url');
+}
+// Backdate the start of validity slightly to tolerate clock skew between machines.
+function backdatedNow() {
+    return new Date(Date.now() - 5 * 60 * 1000);
+}
+function assertPositiveInteger(value, name) {
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new RangeError(`${name} must be a positive integer, got ${value}`);
+    }
+}
+// Node's native key generation is much faster than node-forge's pure JS implementation.
+function generateRsaKeyPair(keySize) {
+    assertPositiveInteger(keySize, 'keySize');
+    const { privateKey } = generateKeyPairSync('rsa', {
+        modulusLength: keySize,
+        privateKeyEncoding: { type: 'pkcs1', format: 'pem' },
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+    });
+    const forgeKey = forge.pki.privateKeyFromPem(privateKey);
+    return { privateKey: forgeKey, publicKey: forge.pki.setRsaPublicKey(forgeKey.n, forgeKey.e) };
+}
+// Positive 128-bit serial (RFC 5280 requires a positive integer of at most 20 octets).
+function randomSerialNumber() {
+    const bytes = randomBytes(16);
+    bytes[0] &= 0x7f;
+    bytes[0] |= 0x10;
+    return bytes.toString('hex');
+}
+function buildSubject(commonName, organization) {
+    const attrs = [{ name: 'commonName', value: commonName }];
+    if (organization) {
+        attrs.push({ name: 'organizationName', value: organization });
+    }
+    return attrs;
+}
+function formatSubject(cert) {
+    return cert.subject.attributes.map((a) => `${a.shortName ?? a.name}=${String(a.value)}`).join(', ');
+}
+function toGenerated(cert, privateKey) {
+    return {
+        certificatePem: forge.pki.certificateToPem(cert),
+        privateKeyPem: forge.pki.privateKeyToPem(privateKey),
+        serialNumber: cert.serialNumber,
+        subject: formatSubject(cert),
+        notBefore: cert.validity.notBefore,
+        notAfter: cert.validity.notAfter,
+    };
+}
+/**
+ * Generates a self-signed CA certificate for mTLS code upload.
+ *
+ * The CA is uploaded to eCDN with {@link createCodeUploadCertificate} and used
+ * to sign client certificates with {@link issueClientCertificate}. Keep the CA
+ * private key secret: anyone holding it can issue trusted client certificates.
+ *
+ * @param options - Subject, validity, and key size options
+ * @returns The CA certificate and private key as PEM strings
+ */
+export function generateCaCertificate(options = {}) {
+    const validityDays = options.validityDays ?? DEFAULT_CA_VALIDITY_DAYS;
+    assertPositiveInteger(validityDays, 'validityDays');
+    if (validityDays > MAX_CODE_UPLOAD_CA_VALIDITY_DAYS) {
+        throw new RangeError(`validityDays must be at most ${MAX_CODE_UPLOAD_CA_VALIDITY_DAYS}; eCDN allows a maximum CA expiry of 1 year`);
+    }
+    const keys = generateRsaKeyPair(options.keySize ?? DEFAULT_KEY_SIZE);
+    const cert = forge.pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = randomSerialNumber();
+    cert.validity.notBefore = backdatedNow();
+    cert.validity.notAfter = new Date(cert.validity.notBefore.getTime() + validityDays * MS_PER_DAY);
+    const subject = buildSubject(options.commonName ?? 'B2C Commerce Code Upload CA', options.organization);
+    cert.setSubject(subject);
+    cert.setIssuer(subject);
+    cert.setExtensions([
+        { name: 'basicConstraints', cA: true, critical: true },
+        { name: 'keyUsage', keyCertSign: true, cRLSign: true, critical: true },
+        { name: 'subjectKeyIdentifier' },
+    ]);
+    cert.sign(keys.privateKey, forge.md.sha256.create());
+    getLogger().debug({ subject: formatSubject(cert), notAfter: cert.validity.notAfter }, 'Generated mTLS CA certificate');
+    return toGenerated(cert, keys.privateKey);
+}
+/**
+ * Issues a client certificate signed by the given CA and bundles it as PKCS12.
+ *
+ * The resulting `.p12` is what the CLI, IDE extension, and other WebDAV clients
+ * use for two-factor code upload (`certificate` / `certificate-passphrase` in
+ * dw.json). This runs entirely locally; no API call is made.
+ *
+ * @param options - CA, subject, validity, and passphrase options
+ * @returns The client certificate, private key, and PKCS12 bundle
+ * @throws Error if the CA certificate/key are invalid, don't match, or the CA has expired
+ */
+export function issueClientCertificate(options) {
+    const caCert = forge.pki.certificateFromPem(options.ca.certificatePem);
+    const caKey = forge.pki.privateKeyFromPem(options.ca.privateKeyPem);
+    const caPublicKey = caCert.publicKey;
+    if (caPublicKey.n.compareTo(caKey.n) !== 0) {
+        throw new Error('CA private key does not match the CA certificate');
+    }
+    const now = new Date();
+    if (caCert.validity.notAfter <= now) {
+        throw new Error(`CA certificate expired on ${caCert.validity.notAfter.toISOString()}`);
+    }
+    const validityDays = options.validityDays ?? DEFAULT_CLIENT_VALIDITY_DAYS;
+    assertPositiveInteger(validityDays, 'validityDays');
+    const keys = generateRsaKeyPair(options.keySize ?? DEFAULT_KEY_SIZE);
+    const cert = forge.pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = randomSerialNumber();
+    cert.validity.notBefore = backdatedNow();
+    const requestedNotAfter = new Date(cert.validity.notBefore.getTime() + validityDays * MS_PER_DAY);
+    cert.validity.notAfter = requestedNotAfter < caCert.validity.notAfter ? requestedNotAfter : caCert.validity.notAfter;
+    cert.setSubject(buildSubject(options.commonName, options.organization));
+    cert.setIssuer(caCert.subject.attributes);
+    cert.setExtensions([
+        { name: 'basicConstraints', cA: false, critical: true },
+        { name: 'keyUsage', digitalSignature: true, keyEncipherment: true, critical: true },
+        { name: 'extKeyUsage', clientAuth: true },
+        { name: 'subjectKeyIdentifier' },
+        { name: 'authorityKeyIdentifier', keyIdentifier: caCert.generateSubjectKeyIdentifier().getBytes() },
+    ]);
+    cert.sign(caKey, forge.md.sha256.create());
+    const passphrase = options.passphrase ?? generatePassphrase();
+    // 3DES matches `openssl pkcs12 -export -legacy`, which Salesforce recommends so the
+    // bundle can be imported into macOS Keychain and other tools that lack AES PBES2 support.
+    const p12Asn1 = forge.pkcs12.toPkcs12Asn1(keys.privateKey, [cert, caCert], passphrase, {
+        algorithm: '3des',
+        friendlyName: options.commonName,
+    });
+    const pkcs12 = Buffer.from(forge.asn1.toDer(p12Asn1).getBytes(), 'binary');
+    getLogger().debug({ subject: formatSubject(cert), notAfter: cert.validity.notAfter }, 'Issued mTLS client certificate');
+    return { ...toGenerated(cert, keys.privateKey), pkcs12, passphrase };
+}
+/**
+ * Validates that a PEM certificate can be uploaded as a code upload CA.
+ *
+ * The CA certificate bundle is allowed a maximum expiry of 1 year
+ * ({@link MAX_CODE_UPLOAD_CA_VALIDITY_DAYS} days); before it expires it must be
+ * renewed to avoid disruption with code uploads.
+ *
+ * @param certificatePem - PEM-encoded CA certificate
+ * @throws Error if the certificate can't be parsed, isn't a CA, is expired, or is valid for more than 1 year
+ */
+export function validateCodeUploadCaCertificate(certificatePem) {
+    let cert;
+    try {
+        cert = new X509Certificate(certificatePem);
+    }
+    catch (error) {
+        throw new Error(`Invalid CA certificate: ${error instanceof Error ? error.message : String(error)}`, {
+            cause: error,
+        });
+    }
+    if (!cert.ca) {
+        throw new Error('Certificate is not a CA certificate. Upload the CA that signs your client certificates, not a client certificate. ' +
+            'If you generated it with OpenSSL, add -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign" ' +
+            '(the macOS default OpenSSL configuration omits them).');
+    }
+    const notBefore = new Date(cert.validFrom);
+    const notAfter = new Date(cert.validTo);
+    if (notAfter.getTime() <= Date.now()) {
+        throw new Error(`CA certificate expired on ${notAfter.toISOString()}`);
+    }
+    const validityDays = (notAfter.getTime() - notBefore.getTime()) / MS_PER_DAY;
+    if (validityDays > MAX_CODE_UPLOAD_CA_VALIDITY_DAYS) {
+        throw new Error(`CA certificate is valid for ${Math.floor(validityDays)} days; eCDN allows a maximum CA expiry of 1 year (${MAX_CODE_UPLOAD_CA_VALIDITY_DAYS} days).`);
+    }
+}
+/**
+ * Uploads a CA certificate to eCDN for two-factor (mTLS) code upload.
+ *
+ * Requires a read-write CDN Zones client (`sfcc.cdn-zones.rw` scope) for a
+ * staging organization. The certificate is checked locally first with
+ * {@link validateCodeUploadCaCertificate}.
+ *
+ * @param client - Read-write CDN Zones client
+ * @param organizationId - Organization ID (`f_ecom_<tenant>`)
+ * @param options - Certificate name and PEM contents
+ * @returns The created certificate, including `mtlsAssociatedCodeUploadHostname`
+ * @throws Error if the certificate is invalid or the API request fails
+ */
+export async function createCodeUploadCertificate(client, organizationId, options) {
+    validateCodeUploadCaCertificate(options.certificatePem);
+    const { data, error, response } = await client.POST('/organizations/{organizationId}/mtls/code-upload-certificates', {
+        params: { path: { organizationId } },
+        body: { name: options.name, certificate: options.certificatePem, privateKey: options.privateKeyPem },
+    });
+    if (error) {
+        throw new Error(`Failed to create mTLS certificate: ${getApiErrorMessage(error, response)}`, { cause: error });
+    }
+    if (!data?.data) {
+        throw new Error('No certificate data returned from API');
+    }
+    return data.data;
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/operations/mtls/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/operations/mtls/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAC,mBAAmB,EAAE,WAAW,EAAE,eAAe,EAAC,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,MAAM,YAAY,CAAC;AAE/B,OAAO,EAAC,kBAAkB,EAAC,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAC,SAAS,EAAC,MAAM,yBAAyB,CAAC;AAKlD;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAEpD,uDAAuD;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAC;AAEzE,kEAAkE;AAClE,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD,oCAAoC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AA2ErC,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY;IACnB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,IAAY;IACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,oCAAoC,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,kBAAkB,CAAC,OAAe;IACzC,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAC,UAAU,EAAC,GAAG,mBAAmB,CAAC,KAAK,EAAE;QAC9C,aAAa,EAAE,OAAO;QACtB,kBAAkB,EAAE,EAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAC;QAClD,iBAAiB,EAAE,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAC;KACjD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAA6B,CAAC;IACrF,OAAO,EAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAC,CAAC;AAC9F,CAAC;AAED,uFAAuF;AACvF,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACjB,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACjB,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB,EAAE,YAAqB;IAC7D,MAAM,KAAK,GAAiC,CAAC,EAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAC,CAAC,CAAC;IACtF,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAA2B;IAChD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,WAAW,CAAC,IAA2B,EAAE,UAAgC;IAChF,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAChD,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC;QAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAwC,EAAE;IAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,wBAAwB,CAAC;IACtE,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,YAAY,GAAG,gCAAgC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAClB,gCAAgC,gCAAgC,6CAA6C,CAC9G,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;IAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,YAAY,GAAG,kBAAkB,EAAE,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC;IAEjG,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,IAAI,6BAA6B,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxB,IAAI,CAAC,aAAa,CAAC;QACjB,EAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAC;QACpD,EAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAC;QACpE,EAAC,IAAI,EAAE,sBAAsB,EAAC;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAErD,SAAS,EAAE,CAAC,KAAK,CAAC,EAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAC,EAAE,+BAA+B,CAAC,CAAC;IACrH,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAsC;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAA6B,CAAC;IAChG,MAAM,WAAW,GAAG,MAAM,CAAC,SAAoC,CAAC;IAChE,IAAI,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,4BAA4B,CAAC;IAC1E,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;IAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,YAAY,GAAG,kBAAkB,EAAE,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;IACzC,MAAM,iBAAiB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC;IAClG,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAErH,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,aAAa,CAAC;QACjB,EAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAC;QACrD,EAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAC;QACjF,EAAC,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAC;QACvC,EAAC,IAAI,EAAE,sBAAsB,EAAC;QAC9B,EAAC,IAAI,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,CAAC,4BAA4B,EAAE,CAAC,QAAQ,EAAE,EAAC;KAClG,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,kBAAkB,EAAE,CAAC;IAC9D,oFAAoF;IACpF,0FAA0F;IAC1F,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE;QACrF,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,OAAO,CAAC,UAAU;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IAE3E,SAAS,EAAE,CAAC,KAAK,CAAC,EAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAC,EAAE,gCAAgC,CAAC,CAAC;IACtH,OAAO,EAAC,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,cAAsB;IACpE,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;YACnG,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,oHAAoH;YAClH,oIAAoI;YACpI,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC;IAC7E,IAAI,YAAY,GAAG,gCAAgC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,qDAAqD,gCAAgC,SAAS,CACtJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAsB,EACtB,cAAsB,EACtB,OAA2C;IAE3C,+BAA+B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,EAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;QACjH,MAAM,EAAE,EAAC,IAAI,EAAE,EAAC,cAAc,EAAC,EAAC;QAChC,IAAI,EAAE,EAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,aAAa,EAAC;KACnG,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,sCAAsC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAC,KAAK,EAAE,KAAK,EAAC,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@salesforce/b2c-tooling-sdk",
   "description": "Core tooling library for Salesforce B2C Commerce CLI",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "author": "Charles Lavery",
   "license": "Apache-2.0",
   "repository": "SalesforceCommerceCloud/b2c-developer-tooling",
@@ -108,6 +108,10 @@
       "types": "./dist/esm/operations/metrics/index.d.ts",
       "default": "./dist/esm/operations/metrics/index.js"
     },
+    "./operations/mtls": {
+      "types": "./dist/esm/operations/mtls/index.d.ts",
+      "default": "./dist/esm/operations/mtls/index.js"
+    },
     "./slas": {
       "types": "./dist/esm/slas/index.d.ts",
       "default": "./dist/esm/slas/index.js"
@@ -207,6 +211,7 @@
     "@types/js-yaml": "4.0.9",
     "@types/mocha": "^10",
     "@types/node": "^22",
+    "@types/node-forge": "1.3.14",
     "@types/sinon": "^21.0.0",
     "@types/tar-fs": "^2.0.4",
     "@types/xml2js": "^0.4.14",
@@ -251,6 +256,7 @@
     "jszip": "3.10.1",
     "minimatch": "10.2.4",
     "minisearch": "7.2.0",
+    "node-forge": "1.4.0",
     "open": "11.0.0",
     "openapi-fetch": "0.15.0",
     "pino": "10.1.0",