@salesforce/b2c-tooling-sdk 2.1.0 → 2.3.0

package/dist/esm/openshell/setup.js

@@ -0,0 +1,307 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+/**
+ * Builds the OpenShell provider profiles, providers, network policy, and
+ * sandbox environment for running the B2C tooling inside an OpenShell sandbox.
+ *
+ * @module openshell/setup
+ */
+import yaml from 'js-yaml';
+import { Minimatch } from 'minimatch';
+import { DEFAULT_ACCOUNT_MANAGER_HOST, DEFAULT_ODS_HOST } from '../defaults.js';
+import { DEFAULT_CIP_HOST, DEFAULT_CIP_STAGING_HOST } from '../clients/cip.js';
+import { DEFAULT_MRT_ORIGIN } from '../clients/mrt.js';
+import { getLogsWebSocketUrl } from '../operations/mrt/tail-logs.js';
+/** All supported sandbox access levels. */
+export const OPENSHELL_ACCESS_LEVELS = [
+    'NONE',
+    'NO_DELETE',
+    'NO_UPDATE',
+    'READ_ONLY',
+];
+/** Path of the forwarded Safety Mode configuration inside the sandbox. */
+export const OPENSHELL_SAFETY_CONFIG_PATH = '/sandbox/.b2c/safety.json';
+const TOKEN_PATH = '/dwsso/oauth2/access_token';
+const AM_API_PATH = '/dw/rest/**';
+const MRT_LOG_TOKEN_PATH = '/api/projects/*/target/*/jwt/';
+/** Documentation hosts read by `b2c docs read` and the MCP `docs_read` tool. */
+const DOCS_HOSTS = ['developer.salesforce.com', 'salesforcecommercecloud.github.io'];
+const WEBDAV_PATH = '/on/demandware.servlet/webdav/**';
+const NODE_BINARY = '/usr/local/bin/node';
+const READ_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+const WRITE_METHODS = ['POST', 'PUT', 'PATCH'];
+const WEBDAV_READ_METHODS = ['PROPFIND'];
+const WEBDAV_WRITE_METHODS = ['MKCOL', 'MOVE', 'COPY'];
+const ALL_METHODS = [...READ_METHODS, ...WRITE_METHODS, 'DELETE', ...WEBDAV_READ_METHODS, ...WEBDAV_WRITE_METHODS];
+/**
+ * Profiles declare no endpoints: each provider is bound to hosts in the
+ * sandbox policy instead. OpenShell releases every credential of a provider to
+ * every host it is bound to, so each secret gets its own profile and provider.
+ */
+const PROFILES = {
+    clientSecret: {
+        id: 'b2c-client-secret',
+        displayName: 'B2C Commerce API client secret',
+        description: 'Account Manager API client secret for client credentials authentication',
+        credential: 'client_secret',
+        envVar: 'SFCC_CLIENT_SECRET',
+    },
+    password: {
+        id: 'b2c-webdav-access-key',
+        displayName: 'B2C Commerce WebDAV access key',
+        description: 'Business Manager user access key for WebDAV',
+        credential: 'access_key',
+        envVar: 'SFCC_PASSWORD',
+        authStyle: 'basic',
+    },
+    mrtApiKey: {
+        id: 'b2c-mrt-api-key',
+        displayName: 'Managed Runtime API key',
+        description: 'Managed Runtime API key',
+        credential: 'api_key',
+        envVar: 'MRT_API_KEY',
+        authStyle: 'bearer',
+    },
+};
+function renderProfile(def) {
+    return yaml.dump({
+        id: def.id,
+        display_name: def.displayName,
+        description: def.description,
+        category: 'other',
+        credentials: [
+            {
+                name: def.credential,
+                description: def.description,
+                env_vars: [def.envVar],
+                required: true,
+                ...(def.authStyle ? { auth_style: def.authStyle } : {}),
+                ...(def.authStyle === 'bearer' ? { header_name: 'Authorization' } : {}),
+            },
+        ],
+        discovery: { credentials: [def.credential] },
+    }, { lineWidth: -1 });
+}
+/**
+ * Returns true when a secret sent in an unencoded Basic header would reach
+ * Account Manager altered (it form-decodes `+` and `%xx`).
+ */
+export function secretNeedsBodyAuth(secret) {
+    return /[+%]/.test(secret);
+}
+function toSandboxName(value) {
+    const slug = value
+        .toLowerCase()
+        .replaceAll(/[^a-z0-9-]+/g, '-')
+        .replaceAll(/^-+|-+$/g, '');
+    return slug.startsWith('b2c') ? slug : `b2c-${slug}`;
+}
+function hostOf(value) {
+    return value.includes('://') ? new URL(value).hostname : value;
+}
+// NO_UPDATE is enforced like NO_DELETE on the network. Safety Mode in the
+// sandbox blocks its reset, stop, and restart operations.
+function methodRules(level, webdav, path = '/**') {
+    const methods = [...READ_METHODS];
+    if (level !== 'READ_ONLY')
+        methods.push(...WRITE_METHODS);
+    if (level === 'NONE')
+        methods.push('DELETE');
+    const rules = methods.map((method) => ({ allow: { method, path } }));
+    if (webdav) {
+        const webdavMethods = [...WEBDAV_READ_METHODS];
+        if (level !== 'READ_ONLY')
+            webdavMethods.push(...WEBDAV_WRITE_METHODS);
+        rules.push(...webdavMethods.map((method) => ({ allow: { method, path: WEBDAV_PATH } })));
+    }
+    return rules;
+}
+/**
+ * Converts Safety Mode rules that permit HTTP requests or jobs into network
+ * rules, so exceptions to the level also work in the sandbox. Command rules
+ * can't be expressed as network rules.
+ */
+function safetyNetworkRules(rules) {
+    const result = [];
+    for (const rule of rules) {
+        if (rule.action === 'block' || rule.command !== undefined)
+            continue;
+        if (rule.job !== undefined) {
+            result.push({ allow: { method: 'POST', path: `/**/jobs/${rule.job}/executions` } });
+        }
+        else if (rule.path !== undefined || rule.method !== undefined) {
+            const matcher = rule.method ? new Minimatch(rule.method, { nocase: true }) : undefined;
+            for (const method of ALL_METHODS.filter((m) => !matcher || matcher.match(m))) {
+                result.push({ allow: { method, path: rule.path ?? '/**' } });
+            }
+        }
+    }
+    return result;
+}
+function endpoint(host, rules, extra = {}) {
+    return { host, port: 443, protocol: 'rest', enforcement: 'enforce', ...extra, rules };
+}
+/**
+ * Builds the OpenShell setup for a resolved B2C configuration.
+ *
+ * Only secrets present in the configuration get a provider. The API client
+ * secret is released only to the Account Manager token endpoint, the WebDAV
+ * access key only to the instance host, and the MRT API key only to the MRT
+ * host. B2C hosts are limited to the HTTP methods of the access level.
+ *
+ * @param config - The resolved configuration (secrets are read but never included in the result)
+ * @param options - Sandbox name, access level, and extra hosts
+ */
+export function buildOpenShellSetup(config, options = {}) {
+    const accessLevel = options.accessLevel ?? 'NONE';
+    const safetyRules = options.safety?.rules ?? [];
+    const forwardSafety = safetyRules.length > 0 || options.safety?.confirm === true;
+    const extraRules = accessLevel === 'NONE' ? [] : safetyNetworkRules(safetyRules);
+    const sandboxName = toSandboxName(options.sandboxName ?? config.instanceName ?? config.hostname?.split('.')[0] ?? 'sandbox');
+    const providers = [];
+    const addProvider = (source, suffix) => {
+        const name = `${sandboxName}-${suffix}`;
+        providers.push({ name, type: PROFILES[source].id, envVar: PROFILES[source].envVar, source });
+        return name;
+    };
+    const env = {};
+    const setEnv = (key, value) => {
+        if (value)
+            env[key] = value;
+    };
+    const policies = {};
+    const hosts = [];
+    const addPolicy = (key, name, endpoints) => {
+        policies[key] = { name, endpoints, binaries: [{ path: NODE_BINARY }] };
+        hosts.push(...endpoints.map((e) => e.host));
+    };
+    // Account Manager: the client secret may only be sent to the token endpoint.
+    // The Account Manager API (`b2c am`) uses the OAuth token.
+    const accountManagerHost = config.accountManagerHost ?? DEFAULT_ACCOUNT_MANAGER_HOST;
+    if (config.clientId && config.clientSecret) {
+        const provider = addProvider('clientSecret', 'client-secret');
+        // Inside the sandbox the secret is a placeholder, which defaults to an
+        // unencoded Basic header. Secrets that Account Manager would misread
+        // there go in the body instead, which the proxy re-encodes.
+        const clientAuthMethod = config.clientAuthMethod === 'body' || secretNeedsBodyAuth(config.clientSecret) ? 'body' : undefined;
+        const bodyRewrite = clientAuthMethod === 'body' ? { request_body_credential_rewrite: true } : {};
+        addPolicy('b2c_account_manager', 'b2c-account-manager', [
+            endpoint(accountManagerHost, [{ allow: { method: 'POST', path: TOKEN_PATH } }, ...methodRules(accessLevel, false, AM_API_PATH)], { ...bodyRewrite, credential_binding: { provider } }),
+        ]);
+        setEnv('SFCC_CLIENT_ID', config.clientId);
+        setEnv('SFCC_ACCOUNT_MANAGER_HOST', config.accountManagerHost);
+        setEnv('SFCC_CLIENT_AUTH_METHOD', clientAuthMethod);
+    }
+    // Instance: OCAPI and WebDAV. The WebDAV access key is bound here only.
+    if (config.hostname) {
+        const provider = config.username && config.password ? addProvider('password', 'webdav') : undefined;
+        const binding = provider ? { credential_binding: { provider } } : {};
+        const instanceHosts = [...new Set([config.hostname, config.webdavHostname].filter(Boolean))];
+        addPolicy('b2c_instance', 'b2c-instance', instanceHosts.map((host) => endpoint(host, [...methodRules(accessLevel, true), ...extraRules], binding)));
+        setEnv('SFCC_SERVER', config.hostname);
+        setEnv('SFCC_WEBDAV_SERVER', config.webdavHostname);
+        setEnv('SFCC_USERNAME', provider ? config.username : undefined);
+        setEnv('SFCC_CODE_VERSION', config.codeVersion);
+    }
+    // SCAPI Admin APIs use the OAuth access token; no stored secret.
+    if (config.shortCode) {
+        addPolicy('b2c_scapi', 'b2c-scapi', [
+            endpoint(`${config.shortCode}.api.commercecloud.salesforce.com`, [
+                ...methodRules(accessLevel, false),
+                ...extraRules,
+            ]),
+        ]);
+        setEnv('SFCC_SHORTCODE', config.shortCode);
+    }
+    setEnv('SFCC_TENANT_ID', config.tenantId);
+    setEnv('SFCC_SITE_ID', config.siteId);
+    if (config.clientId && config.clientSecret) {
+        // On-demand sandboxes (`b2c sandbox`) use the OAuth token.
+        addPolicy('b2c_sandbox_api', 'b2c-sandbox-api', [
+            endpoint(config.sandboxApiHost ?? DEFAULT_ODS_HOST, methodRules(accessLevel, false)),
+        ]);
+        setEnv('SFCC_SANDBOX_API_HOST', config.sandboxApiHost);
+        // CIP analytics queries are read-only SQL, but the protocol sends every
+        // request as a POST, so POST is allowed at every access level.
+        const cipHosts = config.cipHost ? [config.cipHost] : [DEFAULT_CIP_HOST, DEFAULT_CIP_STAGING_HOST];
+        addPolicy('b2c_cip', 'b2c-cip', cipHosts.map((host) => endpoint(host, [{ allow: { method: 'POST', path: '/**' } }])));
+        setEnv('SFCC_CIP_HOST', config.cipHost);
+    }
+    // Managed Runtime: the API key is bound to the MRT host only.
+    if (config.mrtApiKey) {
+        const provider = addProvider('mrtApiKey', 'mrt');
+        const mrtOrigin = config.mrtOrigin ?? DEFAULT_MRT_ORIGIN;
+        // Tailing logs requests a short-lived log token (a POST), then opens a
+        // WebSocket to the log host with that token.
+        const logTokenRule = accessLevel === 'READ_ONLY' ? [{ allow: { method: 'POST', path: MRT_LOG_TOKEN_PATH } }] : [];
+        addPolicy('b2c_mrt', 'b2c-mrt', [
+            endpoint(hostOf(mrtOrigin), [...methodRules(accessLevel, false), ...logTokenRule], {
+                credential_binding: { provider },
+            }),
+            { host: hostOf(getLogsWebSocketUrl(mrtOrigin)), port: 443 },
+        ]);
+        setEnv('MRT_PROJECT', config.mrtProject);
+        setEnv('MRT_ENVIRONMENT', config.mrtEnvironment);
+        setEnv('MRT_CLOUD_ORIGIN', config.mrtOrigin);
+    }
+    if (options.allowHosts && options.allowHosts.length > 0) {
+        addPolicy('b2c_additional', 'b2c-additional-hosts', options.allowHosts.map((host) => endpoint(hostOf(host), methodRules(accessLevel, false))));
+    }
+    // Documentation pages for `b2c docs read`: read only.
+    addPolicy('b2c_docs', 'b2c-docs', DOCS_HOSTS.map((host) => endpoint(host, methodRules('READ_ONLY', false))));
+    // Match Safety Mode to the network policy so blocked operations fail early
+    // with a clear message. Telemetry and update checks would only be denied.
+    env.SFCC_SAFETY_LEVEL = accessLevel;
+    if (forwardSafety)
+        env.SFCC_SAFETY_CONFIG = OPENSHELL_SAFETY_CONFIG_PATH;
+    env.SFCC_DISABLE_TELEMETRY = 'true';
+    env.B2C_SKIP_NEW_VERSION_CHECK = 'true';
+    const policy = yaml.dump({
+        version: 1,
+        filesystem_policy: {
+            include_workdir: true,
+            read_only: ['/bin', '/usr', '/opt', '/lib', '/proc', '/dev/urandom', '/etc'],
+            read_write: ['/sandbox', '/tmp', '/dev/null', '/home/sandbox'],
+        },
+        landlock: { compatibility: 'best_effort' },
+        network_policies: policies,
+    }, { lineWidth: -1, flowLevel: 6, noRefs: true });
+    const profileSources = [...new Set(providers.map((p) => p.source))];
+    return {
+        sandboxName,
+        profiles: profileSources.map((source) => ({ id: PROFILES[source].id, content: renderProfile(PROFILES[source]) })),
+        providers,
+        policy,
+        env,
+        hosts,
+        safetyConfig: forwardSafety
+            ? `${JSON.stringify({ level: accessLevel, confirm: options.safety?.confirm, rules: safetyRules }, null, 2)}\n`
+            : undefined,
+        unmappedSafetyRules: accessLevel === 'NONE' ? [] : safetyRules.filter((r) => r.action !== 'block' && r.command !== undefined),
+    };
+}
+/**
+ * Returns the Dockerfile for a sandbox image with the B2C CLI (and optionally
+ * the MCP server) installed.
+ *
+ * @param options - Package versions to install; defaults to `latest`
+ */
+export function buildOpenShellDockerfile(options = {}) {
+    const packages = [`@salesforce/b2c-cli@${options.cliVersion ?? 'latest'}`];
+    if (options.mcp)
+        packages.push(`@salesforce/b2c-dx-mcp@${options.mcpVersion ?? 'latest'}`);
+    return `FROM node:22-bookworm-slim
+RUN apt-get update \\
+ && apt-get install -y --no-install-recommends ca-certificates iproute2 \\
+ && rm -rf /var/lib/apt/lists/*
+RUN npm install -g ${packages.join(' ')} && npm cache clean --force
+RUN useradd --create-home --shell /bin/bash sandbox \\
+ && install -d -o sandbox -g sandbox /sandbox
+USER sandbox
+WORKDIR /sandbox
+`;
+}
+//# sourceMappingURL=setup.js.map

package/dist/esm/openshell/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/openshell/setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;GAKG;AACH,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAC,SAAS,EAAC,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAC,4BAA4B,EAAE,gBAAgB,EAAC,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAC,gBAAgB,EAAE,wBAAwB,EAAC,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAC,kBAAkB,EAAC,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAC,mBAAmB,EAAC,MAAM,gCAAgC,CAAC;AASnE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,MAAM;IACN,WAAW;IACX,WAAW;IACX,WAAW;CACuC,CAAC;AAErD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AA4DxE,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAChD,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D,gFAAgF;AAChF,MAAM,UAAU,GAAG,CAAC,0BAA0B,EAAE,mCAAmC,CAAC,CAAC;AACrF,MAAM,WAAW,GAAG,kCAAkC,CAAC;AACvD,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAE1C,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC/C,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,CAAC;AACzC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,GAAG,oBAAoB,CAAC,CAAC;AAWnH;;;;GAIG;AACH,MAAM,QAAQ,GAA2D;IACvE,YAAY,EAAE;QACZ,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,yEAAyE;QACtF,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,oBAAoB;KAC7B;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,6CAA6C;QAC1D,UAAU,EAAE,YAAY;QACxB,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,OAAO;KACnB;IACD,SAAS,EAAE;QACT,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,yBAAyB;QACtC,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,QAAQ;KACpB;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,GAAsB;IAC3C,OAAO,IAAI,CAAC,IAAI,CACd;QACE,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,YAAY,EAAE,GAAG,CAAC,WAAW;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,GAAG,CAAC,UAAU;gBACpB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;gBACtB,QAAQ,EAAE,IAAI;gBACd,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,UAAU,EAAE,GAAG,CAAC,SAAS,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAC,WAAW,EAAE,eAAe,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE;SACF;QACD,SAAS,EAAE,EAAC,WAAW,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAC;KAC3C,EACD,EAAC,SAAS,EAAE,CAAC,CAAC,EAAC,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,IAAI,GAAG,KAAK;SACf,WAAW,EAAE;SACb,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC;SAC/B,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAID,0EAA0E;AAC1E,0DAA0D;AAC1D,SAAS,WAAW,CAAC,KAA2B,EAAE,MAAe,EAAE,IAAI,GAAG,KAAK;IAC7E,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAC,KAAK,EAAE,EAAC,MAAM,EAAE,IAAI,EAAC,EAAC,CAAC,CAAC,CAAC;IACjE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,aAAa,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,WAAW;YAAE,aAAa,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAC,KAAK,EAAE,EAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAC,EAAC,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAmB;IAC7C,MAAM,MAAM,GAAW,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACpE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,IAAI,CAAC,GAAG,aAAa,EAAC,EAAC,CAAC,CAAC;QAClF,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAC,MAAM,EAAE,IAAI,EAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrF,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,EAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,EAAC,EAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAgB,EAAE,QAAiC,EAAE;IACnF,OAAO,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,KAAK,EAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAwB,EAAE,UAAiC,EAAE;IAC/F,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;IAClD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IACjF,MAAM,UAAU,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,WAAW,GAAG,aAAa,CAC/B,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAC1F,CAAC;IAEF,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,MAAM,WAAW,GAAG,CAAC,MAAmC,EAAE,MAAc,EAAU,EAAE;QAClF,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAC,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,KAAyB,EAAQ,EAAE;QAC9D,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC,CAAC;IACF,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,SAAyC,EAAQ,EAAE;QAC/F,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAC,IAAI,EAAE,WAAW,EAAC,CAAC,EAAC,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,6EAA6E;IAC7E,2DAA2D;IAC3D,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;IACrF,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC9D,uEAAuE;QACvE,qEAAqE;QACrE,4DAA4D;QAC5D,MAAM,gBAAgB,GACpB,MAAM,CAAC,gBAAgB,KAAK,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,MAAM,WAAW,GAAG,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,EAAC,+BAA+B,EAAE,IAAI,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,SAAS,CAAC,qBAAqB,EAAE,qBAAqB,EAAE;YACtD,QAAQ,CACN,kBAAkB,EAClB,CAAC,EAAC,KAAK,EAAE,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAC,EAAC,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,EAC9F,EAAC,GAAG,WAAW,EAAE,kBAAkB,EAAE,EAAC,QAAQ,EAAC,EAAC,CACjD;SACF,CAAC,CAAC;QACH,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC/D,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACtD,CAAC;IAED,wEAAwE;IACxE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAC,kBAAkB,EAAE,EAAC,QAAQ,EAAC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC,CAAC;QACzG,SAAS,CACP,cAAc,EACd,cAAc,EACd,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,CACzG,CAAC;QACF,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,iEAAiE;IACjE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE;YAClC,QAAQ,CAAC,GAAG,MAAM,CAAC,SAAS,mCAAmC,EAAE;gBAC/D,GAAG,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC;gBAClC,GAAG,UAAU;aACd,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEtC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC3C,2DAA2D;QAC3D,SAAS,CAAC,iBAAiB,EAAE,iBAAiB,EAAE;YAC9C,QAAQ,CAAC,MAAM,CAAC,cAAc,IAAI,gBAAgB,EAAE,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;SACrF,CAAC,CAAC;QACH,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAEvD,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;QAClG,SAAS,CACP,SAAS,EACT,SAAS,EACT,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAC,KAAK,EAAE,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAC,EAAC,CAAC,CAAC,CAAC,CACjF,CAAC;QACF,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,uEAAuE;QACvE,6CAA6C;QAC7C,MAAM,YAAY,GAAG,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAC,EAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;YAC9B,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,EAAE;gBACjF,kBAAkB,EAAE,EAAC,QAAQ,EAAC;aAC/B,CAAC;YACF,EAAC,IAAI,EAAE,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAC;SAC1D,CAAC,CAAC;QACH,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,SAAS,CACP,gBAAgB,EAChB,sBAAsB,EACtB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAC1F,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,SAAS,CACP,UAAU,EACV,UAAU,EACV,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAC1E,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,GAAG,CAAC,iBAAiB,GAAG,WAAW,CAAC;IACpC,IAAI,aAAa;QAAE,GAAG,CAAC,kBAAkB,GAAG,4BAA4B,CAAC;IACzE,GAAG,CAAC,sBAAsB,GAAG,MAAM,CAAC;IACpC,GAAG,CAAC,0BAA0B,GAAG,MAAM,CAAC;IAExC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CACtB;QACE,OAAO,EAAE,CAAC;QACV,iBAAiB,EAAE;YACjB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC;YAC5E,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC;SAC/D;QACD,QAAQ,EAAE,EAAC,aAAa,EAAE,aAAa,EAAC;QACxC,gBAAgB,EAAE,QAAQ;KAC3B,EACD,EAAC,SAAS,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAC,CAC5C,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO;QACL,WAAW;QACX,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC,CAAC;QAC/G,SAAS;QACT,MAAM;QACN,GAAG;QACH,KAAK;QACL,YAAY,EAAE,aAAa;YACzB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;YAC5G,CAAC,CAAC,SAAS;QACb,mBAAmB,EACjB,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;KAC3G,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAqE,EAAE;IAEvE,MAAM,QAAQ,GAAG,CAAC,uBAAuB,OAAO,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,OAAO,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC3F,OAAO;;;;qBAIY,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;CAKtC,CAAC;AACF,CAAC"}

package/dist/esm/operations/mtls/index.d.ts

@@ -0,0 +1,135 @@
+import type { CdnZonesClient, CdnZonesComponents } from '../../clients/index.js';
+/** eCDN mTLS certificate as returned by the CDN Zones API. */
+export type MtlsCertificate = CdnZonesComponents['schemas']['MtlsCertificateResponse'];
+/**
+ * Maximum validity eCDN accepts for an uploaded code upload CA certificate.
+ * Also the default validity for {@link generateCaCertificate}.
+ */
+export declare const MAX_CODE_UPLOAD_CA_VALIDITY_DAYS = 365;
+/** Default validity for a generated CA certificate. */
+export declare const DEFAULT_CA_VALIDITY_DAYS = 365;
+/** Default validity for an issued client certificate (1 year). */
+export declare const DEFAULT_CLIENT_VALIDITY_DAYS = 365;
+/** Default RSA key size in bits. */
+export declare const DEFAULT_KEY_SIZE = 2048;
+/** A PEM-encoded certificate and its private key. */
+export interface CertificateKeyPair {
+    /** PEM-encoded X.509 certificate */
+    certificatePem: string;
+    /** PEM-encoded private key */
+    privateKeyPem: string;
+}
+/** A generated certificate with metadata. */
+export interface GeneratedCertificate extends CertificateKeyPair {
+    /** Hex-encoded serial number */
+    serialNumber: string;
+    /** Certificate subject distinguished name (e.g. `CN=My CA`) */
+    subject: string;
+    /** Start of validity */
+    notBefore: Date;
+    /** End of validity */
+    notAfter: Date;
+}
+/** Options for {@link generateCaCertificate}. */
+export interface GenerateCaCertificateOptions {
+    /**
+     * Subject common name. Salesforce recommends the staging Business Manager
+     * hostname (`staging-<realm>-<customer>.demandware.net`).
+     * Default: `B2C Commerce Code Upload CA`
+     */
+    commonName?: string;
+    /** Optional subject organization (O) */
+    organization?: string;
+    /**
+     * Validity in days. Default: {@link DEFAULT_CA_VALIDITY_DAYS}. eCDN rejects CA
+     * certificates valid for more than {@link MAX_CODE_UPLOAD_CA_VALIDITY_DAYS} days.
+     */
+    validityDays?: number;
+    /** RSA key size in bits. Default: {@link DEFAULT_KEY_SIZE} */
+    keySize?: number;
+}
+/** Options for {@link issueClientCertificate}. */
+export interface IssueClientCertificateOptions {
+    /** CA certificate and private key used to sign the client certificate */
+    ca: CertificateKeyPair;
+    /** Subject common name identifying the client; Salesforce recommends the Business Manager username or API client ID */
+    commonName: string;
+    /** Optional subject organization (O) */
+    organization?: string;
+    /** Validity in days. Default: {@link DEFAULT_CLIENT_VALIDITY_DAYS}; capped at the CA's expiry */
+    validityDays?: number;
+    /** RSA key size in bits. Default: {@link DEFAULT_KEY_SIZE} */
+    keySize?: number;
+    /** Passphrase protecting the PKCS12 bundle. Default: a random passphrase */
+    passphrase?: string;
+}
+/** An issued client certificate, including the PKCS12 bundle. */
+export interface IssuedClientCertificate extends GeneratedCertificate {
+    /** PKCS12 (`.p12`) bundle containing the client key, certificate, and CA certificate */
+    pkcs12: Buffer;
+    /** Passphrase protecting {@link pkcs12} */
+    passphrase: string;
+}
+/** Options for {@link createCodeUploadCertificate}. */
+export interface CreateCodeUploadCertificateOptions {
+    /** Certificate name for identification */
+    name: string;
+    /** PEM-encoded CA certificate */
+    certificatePem: string;
+    /** PEM-encoded CA private key */
+    privateKeyPem: string;
+}
+/**
+ * Generates a random passphrase suitable for protecting a PKCS12 bundle.
+ *
+ * @returns A 32-character URL-safe random string
+ */
+export declare function generatePassphrase(): string;
+/**
+ * Generates a self-signed CA certificate for mTLS code upload.
+ *
+ * The CA is uploaded to eCDN with {@link createCodeUploadCertificate} and used
+ * to sign client certificates with {@link issueClientCertificate}. Keep the CA
+ * private key secret: anyone holding it can issue trusted client certificates.
+ *
+ * @param options - Subject, validity, and key size options
+ * @returns The CA certificate and private key as PEM strings
+ */
+export declare function generateCaCertificate(options?: GenerateCaCertificateOptions): GeneratedCertificate;
+/**
+ * Issues a client certificate signed by the given CA and bundles it as PKCS12.
+ *
+ * The resulting `.p12` is what the CLI, IDE extension, and other WebDAV clients
+ * use for two-factor code upload (`certificate` / `certificate-passphrase` in
+ * dw.json). This runs entirely locally; no API call is made.
+ *
+ * @param options - CA, subject, validity, and passphrase options
+ * @returns The client certificate, private key, and PKCS12 bundle
+ * @throws Error if the CA certificate/key are invalid, don't match, or the CA has expired
+ */
+export declare function issueClientCertificate(options: IssueClientCertificateOptions): IssuedClientCertificate;
+/**
+ * Validates that a PEM certificate can be uploaded as a code upload CA.
+ *
+ * The CA certificate bundle is allowed a maximum expiry of 1 year
+ * ({@link MAX_CODE_UPLOAD_CA_VALIDITY_DAYS} days); before it expires it must be
+ * renewed to avoid disruption with code uploads.
+ *
+ * @param certificatePem - PEM-encoded CA certificate
+ * @throws Error if the certificate can't be parsed, isn't a CA, is expired, or is valid for more than 1 year
+ */
+export declare function validateCodeUploadCaCertificate(certificatePem: string): void;
+/**
+ * Uploads a CA certificate to eCDN for two-factor (mTLS) code upload.
+ *
+ * Requires a read-write CDN Zones client (`sfcc.cdn-zones.rw` scope) for a
+ * staging organization. The certificate is checked locally first with
+ * {@link validateCodeUploadCaCertificate}.
+ *
+ * @param client - Read-write CDN Zones client
+ * @param organizationId - Organization ID (`f_ecom_<tenant>`)
+ * @param options - Certificate name and PEM contents
+ * @returns The created certificate, including `mtlsAssociatedCodeUploadHostname`
+ * @throws Error if the certificate is invalid or the API request fails
+ */
+export declare function createCodeUploadCertificate(client: CdnZonesClient, organizationId: string, options: CreateCodeUploadCertificateOptions): Promise<MtlsCertificate>;