@scupit/mcp-ecosystem 0.1.0 → 0.2.0

package/dist/commands/env-root-validation.js

@@ -0,0 +1,27 @@
+import { join } from "node:path";
+import { isManagedClientCredentialEnvKey } from "../config/index.js";
+export function assertNoManagedClientCredentialsOutsideManagedBlock(ctx) {
+    const invalidAssignments = ctx.envManager.getOuterAssignments(isManagedClientCredentialEnvKey);
+    if (invalidAssignments.length === 0) {
+        return;
+    }
+    const envPath = join(ctx.rootDir, ".env");
+    const entries = invalidAssignments.map((assignment) => `    ${maskSecretAssignment(assignment.rawLine)}`);
+    throw new Error(`Invalid tool-managed client credentials in root .env at ${envPath}\n\n` +
+        `  These variables are managed by mcp-ecosystem and must appear only inside\n` +
+        `  the auto-generated block marked by:\n` +
+        `    # <automatically-generated>\n` +
+        `    # </automatically-generated>\n\n` +
+        `  Remove these user-authored assignments from outside the managed block:\n` +
+        `${entries.join("\n")}\n\n` +
+        `  Then re-run reconcile-client or reconcile-all so the CLI can regenerate\n` +
+        `  the managed entries safely.`);
+}
+function maskSecretAssignment(line) {
+    const eqIdx = line.indexOf("=");
+    if (eqIdx === -1)
+        return line;
+    const key = line.slice(0, eqIdx).trim();
+    return key.includes("_SECRET") ? `${key}=********` : line;
+}
+//# sourceMappingURL=env-root-validation.js.map

package/dist/commands/env-root-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-root-validation.js","sourceRoot":"","sources":["../../src/commands/env-root-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAGrE,MAAM,UAAU,mDAAmD,CACjE,GAAmD;IAEnD,MAAM,kBAAkB,GAAG,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAC3D,+BAA+B,CAChC,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CACpC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,oBAAoB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAClE,CAAC;IAEF,MAAM,IAAI,KAAK,CACb,2DAA2D,OAAO,MAAM;QACtE,8EAA8E;QAC9E,yCAAyC;QACzC,mCAAmC;QACnC,sCAAsC;QACtC,4EAA4E;QAC5E,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;QAC3B,6EAA6E;QAC7E,+BAA+B,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC"}

package/dist/commands/generate-artifacts.d.ts

@@ -3,7 +3,7 @@ export interface GenerateArtifactsResult {
     filesWritten: string[];
 }
 /**
- * Generates or refreshes the .env.example and per-server runtime config files.
+ * Generates or refreshes the .env.example file.
  * Never writes live secrets.
  */
 export declare function generateArtifacts(ctx: CommandContext): Promise<GenerateArtifactsResult>;

package/dist/commands/generate-artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-artifacts.d.ts","sourceRoot":"","sources":["../../src/commands/generate-artifacts.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAUxD,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,uBAAuB,CAAC,CAiGlC"}
+{"version":3,"file":"generate-artifacts.d.ts","sourceRoot":"","sources":["../../src/commands/generate-artifacts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQxD,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,uBAAuB,CAAC,CA4ClC"}

package/dist/commands/generate-artifacts.js

@@ -1,91 +1,65 @@
-import { writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
-import { logger } from "../utils/index.js";
-import { deriveCanonicalResourceUri, deriveHostname, deriveMcpEndpoint, deriveProtectedResourceMetadataUrl, resolveScopes, } from "../config/index.js";
+import { logger, ManagedEnvFile } from "../utils/index.js";
+import { ECOSYSTEM_ENV, AUTH0_ENV, getEnvPlaceholder, } from "../config/index.js";
 /**
- * Generates or refreshes the .env.example and per-server runtime config files.
+ * Generates or refreshes the .env.example file.
  * Never writes live secrets.
  */
 export async function generateArtifacts(ctx) {
-    const { config, rootDir, dryRun } = ctx;
-    const ecosystem = config.ecosystem;
+    const { rootDir, dryRun } = ctx;
     const written = [];
-    // ── .env.example ──
     const envLines = [
-        "# Auth0 Management API credentials (required)",
-        `${ecosystem.auth0.management_client_id_env}=__REQUIRED__`,
-        `${ecosystem.auth0.management_client_secret_env}=__REQUIRED__`,
-        `AUTH0_TENANT_DOMAIN=${ecosystem.auth0.tenant_domain}`,
+        "# Ecosystem base domain (required)",
+        `${ECOSYSTEM_ENV.baseDomain}=${getEnvPlaceholder(ECOSYSTEM_ENV.baseDomain) ?? "example.com"}`,
+        "",
+        "# Auth0 tenant and Management API credentials (required for provisioning)",
+        `${AUTH0_ENV.tenantDomain}=${getEnvPlaceholder(AUTH0_ENV.tenantDomain) ?? "your-tenant.auth0.com"}`,
+        `${AUTH0_ENV.clientId}=${getEnvPlaceholder(AUTH0_ENV.clientId) ?? "__REQUIRED__"}`,
+        `${AUTH0_ENV.clientSecret}=${getEnvPlaceholder(AUTH0_ENV.clientSecret) ?? "__REQUIRED__"}`,
+        "",
+        "# Client IDs and secrets are automatically written to .env by",
+        "# reconcile-client and reconcile-all. Do not set them manually.",
         "",
     ];
-    for (const [key, client] of config.clientConfigs) {
-        const envPrefix = `AUTH0_${key.toUpperCase().replace(/-/g, "_")}`;
-        envLines.push(`# Client: ${client.display_name}`);
-        envLines.push(`${envPrefix}_CLIENT_ID=__GENERATED_OR_EXISTING__`);
-        const isPublic = client.profile === "native_interactive" ||
-            client.profile === "spa_interactive";
-        if (client.credentials?.client_secret_env) {
-            envLines.push(`${client.credentials.client_secret_env}=__FILL_SECRET__`);
-        }
-        else if (!isPublic) {
-            envLines.push(`${envPrefix}_CLIENT_SECRET=__GENERATED__`);
-        }
-        else {
-            envLines.push(`# ${envPrefix}_CLIENT_SECRET=__ONLY_IF_CONFIDENTIAL__`);
-        }
-        envLines.push("");
-    }
-    for (const [slug, server] of config.serverConfigs) {
-        const identifier = deriveCanonicalResourceUri(ecosystem, slug);
-        const envPrefix = `AUTH0_${slug.toUpperCase().replace(/-/g, "_")}_MCP`;
-        envLines.push(`# Server: ${server.name}`);
-        envLines.push(`${envPrefix}_AUDIENCE=${identifier}`);
-        envLines.push("");
-    }
     const envExamplePath = join(rootDir, ".env.example");
-    if (!dryRun) {
-        await writeFile(envExamplePath, envLines.join("\n"), "utf-8");
-        written.push(envExamplePath);
-        logger.success(`Generated: ${envExamplePath}`);
+    const envExample = await ManagedEnvFile.load(envExamplePath, {
+        displayName: ".env.example",
+        blockHeaderLines: [
+            "# Managed by @scupit/mcp-ecosystem -- placeholders only.",
+            "# Add your own notes or extra example variables outside this block.",
+        ],
+    });
+    if (!envExample.hasManagedBlock && isLegacyGeneratedEnvExample(envExample.getOuterContent())) {
+        envExample.replaceOuterContent("");
     }
-    else {
-        logger.info(`[DRY RUN] Would generate: ${envExamplePath}`);
+    envExample.setManagedLines(envLines);
+    const changed = await envExample.flush(dryRun, {
+        dryRunLabel: "[DRY RUN] Would update .env.example managed block:",
+        successMessage: `Generated: ${envExamplePath}`,
+    });
+    if (changed && !dryRun) {
+        written.push(envExamplePath);
     }
-    // ── Per-server runtime config ──
-    for (const [slug, server] of config.serverConfigs) {
-        const hostname = deriveHostname(ecosystem, slug);
-        const resourceUri = deriveCanonicalResourceUri(ecosystem, slug);
-        const mcpEndpoint = deriveMcpEndpoint(ecosystem, slug);
-        const metadataUrl = deriveProtectedResourceMetadataUrl(ecosystem, slug);
-        const scopes = resolveScopes(ecosystem, server);
-        const runtimeConfig = {
-            server: {
-                name: server.name,
-                slug: server.slug,
-                hostname,
-                resource_uri: resourceUri,
-                mcp_endpoint: mcpEndpoint,
-            },
-            auth: {
-                issuer: `https://${ecosystem.auth0.tenant_domain}/`,
-                audience: resourceUri,
-                jwks_uri: `https://${ecosystem.auth0.tenant_domain}/.well-known/jwks.json`,
-                protected_resource_metadata_url: metadataUrl,
-            },
-            scopes,
-        };
-        const serverDir = join(rootDir, "mcps", slug);
-        await mkdir(serverDir, { recursive: true });
-        const runtimeConfigPath = join(serverDir, "runtime-config.generated.json");
-        if (!dryRun) {
-            await writeFile(runtimeConfigPath, JSON.stringify(runtimeConfig, null, 2) + "\n", "utf-8");
-            written.push(runtimeConfigPath);
-            logger.success(`Generated: ${runtimeConfigPath}`);
-        }
-        else {
-            logger.info(`[DRY RUN] Would generate: ${runtimeConfigPath}`);
-        }
+    else if (!changed) {
+        logger.info(`No changes needed: ${envExamplePath}`);
     }
     return { filesWritten: written };
 }
+function isLegacyGeneratedEnvExample(content) {
+    const lines = content.split(/\r?\n/);
+    while (lines.length > 0 && lines[lines.length - 1] === "") {
+        lines.pop();
+    }
+    return (lines.length === 10 &&
+        lines[0] === "# Ecosystem base domain (required)" &&
+        /^ECOSYSTEM_BASE_DOMAIN=/.test(lines[1] ?? "") &&
+        lines[2] === "" &&
+        lines[3] === "# Auth0 tenant and Management API credentials (required for provisioning)" &&
+        /^AUTH0_TENANT_DOMAIN=/.test(lines[4] ?? "") &&
+        /^AUTH0_MGMT_CLIENT_ID=/.test(lines[5] ?? "") &&
+        /^AUTH0_MGMT_CLIENT_SECRET=/.test(lines[6] ?? "") &&
+        lines[7] === "" &&
+        lines[8] === "# Client IDs and secrets are automatically written to .env by" &&
+        lines[9] === "# reconcile-client and reconcile-all. Do not set them manually.");
+}
 //# sourceMappingURL=generate-artifacts.js.map

package/dist/commands/generate-artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate-artifacts.js","sourceRoot":"","sources":["../../src/commands/generate-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,iBAAiB,EACjB,kCAAkC,EAClC,aAAa,GACd,MAAM,oBAAoB,CAAC;AAM5B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,qBAAqB;IAErB,MAAM,QAAQ,GAAa;QACzB,+CAA+C;QAC/C,GAAG,SAAS,CAAC,KAAK,CAAC,wBAAwB,eAAe;QAC1D,GAAG,SAAS,CAAC,KAAK,CAAC,4BAA4B,eAAe;QAC9D,uBAAuB,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE;QACtD,EAAE;KACH,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,sCAAsC,CAAC,CAAC;QAElE,MAAM,QAAQ,GACZ,MAAM,CAAC,OAAO,KAAK,oBAAoB;YACvC,MAAM,CAAC,OAAO,KAAK,iBAAiB,CAAC;QAEvC,IAAI,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,kBAAkB,CAC1D,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,8BAA8B,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,yCAAyC,CAAC,CAAC;QACzE,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,0BAA0B,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,aAAa,UAAU,EAAE,CAAC,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7B,MAAM,CAAC,OAAO,CAAC,cAAc,cAAc,EAAE,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,6BAA6B,cAAc,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,kCAAkC;IAElC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,0BAA0B,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,kCAAkC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAEhD,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ;gBACR,YAAY,EAAE,WAAW;gBACzB,YAAY,EAAE,WAAW;aAC1B;YACD,IAAI,EAAE;gBACJ,MAAM,EAAE,WAAW,SAAS,CAAC,KAAK,CAAC,aAAa,GAAG;gBACnD,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,WAAW,SAAS,CAAC,KAAK,CAAC,aAAa,wBAAwB;gBAC1E,+BAA+B,EAAE,WAAW;aAC7C;YACD,MAAM;SACP,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;QAE3E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,CACb,iBAAiB,EACjB,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAC7C,OAAO,CACR,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,cAAc,iBAAiB,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,6BAA6B,iBAAiB,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC"}
+{"version":3,"file":"generate-artifacts.js","sourceRoot":"","sources":["../../src/commands/generate-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,SAAS,EACT,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAM5B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAmB;IAEnB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAa;QACzB,oCAAoC;QACpC,GAAG,aAAa,CAAC,UAAU,IAAI,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,aAAa,EAAE;QAC7F,EAAE;QACF,2EAA2E;QAC3E,GAAG,SAAS,CAAC,YAAY,IAAI,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,uBAAuB,EAAE;QACnG,GAAG,SAAS,CAAC,QAAQ,IAAI,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,cAAc,EAAE;QAClF,GAAG,SAAS,CAAC,YAAY,IAAI,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,cAAc,EAAE;QAC1F,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,EAAE;KACH,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE;QAC3D,WAAW,EAAE,cAAc;QAC3B,gBAAgB,EAAE;YAChB,0DAA0D;YAC1D,qEAAqE;SACtE;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,2BAA2B,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;QAC7F,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE;QAC7C,WAAW,EAAE,oDAAoD;QACjE,cAAc,EAAE,cAAc,cAAc,EAAE;KAC/C,CAAC,CAAC;IAEH,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,CAAC;IAED,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,EAAE;QACnB,KAAK,CAAC,CAAC,CAAC,KAAK,oCAAoC;QACjD,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QACf,KAAK,CAAC,CAAC,CAAC,KAAK,2EAA2E;QACxF,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QACf,KAAK,CAAC,CAAC,CAAC,KAAK,+DAA+D;QAC5E,KAAK,CAAC,CAAC,CAAC,KAAK,iEAAiE,CAC/E,CAAC;AACJ,CAAC"}

package/dist/commands/grant-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-client.d.ts","sourceRoot":"","sources":["../../src/commands/grant-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAKxD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IACxD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAwI5B"}
+{"version":3,"file":"grant-client.d.ts","sourceRoot":"","sources":["../../src/commands/grant-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAYxD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IACxD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,iBAAiB,CAAC,CA0J5B"}

package/dist/commands/grant-client.js

@@ -1,8 +1,11 @@
 import { logger } from "../utils/index.js";
-import { deriveCanonicalResourceUri, resolveScopes } from "../config/index.js";
+import { assertRequiredEcosystemEnv, deriveCanonicalResourceUri, resolveClientAccessPolicy, resolveScopes, } from "../config/index.js";
 import { reconcileClient } from "./reconcile-client.js";
+import { assertNoManagedClientCredentialsOutsideManagedBlock } from "./env-root-validation.js";
+import { loadValidatedCachedClientApplication } from "./validated-client-cache.js";
 export async function grantClient(ctx, serverSlug, clientKey, scopes) {
     const { config, auth0, dryRun } = ctx;
+    assertNoManagedClientCredentialsOutsideManagedBlock(ctx);
     const serverConfig = config.serverConfigs.get(serverSlug);
     if (!serverConfig) {
         throw new Error(`Unknown server slug: "${serverSlug}"`);
@@ -11,13 +14,25 @@ export async function grantClient(ctx, serverSlug, clientKey, scopes) {
     if (!clientConfig) {
         throw new Error(`Unknown client key: "${clientKey}"`);
     }
+    assertRequiredEcosystemEnv(config.ecosystem, {
+        context: `grant access to server "${serverSlug}"`,
+        requireBaseDomain: true,
+    });
     const audience = deriveCanonicalResourceUri(config.ecosystem, serverConfig.slug);
     const grantScopes = scopes && scopes.length > 0
         ? scopes
         : resolveScopes(config.ecosystem, serverConfig);
     const profileDef = config.ecosystem.defaults.client_profiles?.[clientConfig.profile];
     const subjectType = profileDef?.access_mode === "machine" ? "client" : "user";
-    let clientId = clientConfig.auth0.existing_client_id;
+    if (subjectType === "client" &&
+        resolveClientAccessPolicy(config.ecosystem, serverConfig) === "deny_all") {
+        throw new Error(`Server "${serverSlug}" has effective client access policy deny_all.\n\n` +
+            `  Machine-to-machine grants are disabled for this server.\n` +
+            `  Set access_policy.client or defaults.api.client_access_policy to "require_client_grant"\n` +
+            `  before creating a client grant for "${clientKey}".`);
+    }
+    let clientId = (await loadValidatedCachedClientApplication(ctx, clientKey))
+        ?.client_id;
     if (!clientId) {
         logger.info(`Ensuring client "${clientKey}" exists...`);
         const result = await reconcileClient(ctx, clientKey);

package/dist/commands/grant-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-client.js","sourceRoot":"","sources":["../../src/commands/grant-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAYxD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAmB,EACnB,UAAkB,EAClB,SAAiB,EACjB,MAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAEtC,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CACzC,MAAM,CAAC,SAAS,EAChB,YAAY,CAAC,IAAI,CAClB,CAAC;IAEF,MAAM,WAAW,GACf,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEpD,MAAM,UAAU,GACd,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,WAAW,GACf,UAAU,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAE5D,IAAI,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,oBAAoB,SAAS,aAAa,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC5C,OAAO;YACL,UAAU;YACV,SAAS;YACT,QAAQ,EAAE,QAAQ,IAAI,aAAa;YACnC,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CACT,sBAAsB,SAAS,OAAO,UAAU,KAAK,WAAW,GAAG,CACpE,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,aAAa,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAC1C,QAAQ,EACR,QAAQ,EACR,WAAW,CACZ,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,KAAK,GACT,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;YACpC,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC/C,OAAO;gBACL,UAAU;gBACV,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,WAAW;gBACnB,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC7C,OAAO;gBACL,UAAU;gBACV,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,WAAW;gBACnB,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACjC,OAAO;YACL,UAAU;YACV,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7C,OAAO;YACL,UAAU;YACV,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,iBAAiB,CAAC;QAC5B,SAAS,EAAE,QAAQ;QACnB,QAAQ;QACR,KAAK,EAAE,WAAW;QAClB,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEjC,OAAO;QACL,UAAU;QACV,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,WAAW;QACnB,WAAW;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"grant-client.js","sourceRoot":"","sources":["../../src/commands/grant-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,mDAAmD,EAAE,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAAE,MAAM,6BAA6B,CAAC;AAYnF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAmB,EACnB,UAAkB,EAClB,SAAiB,EACjB,MAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACtC,mDAAmD,CAAC,GAAG,CAAC,CAAC;IAEzD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,0BAA0B,CAAC,MAAM,CAAC,SAAS,EAAE;QAC3C,OAAO,EAAE,2BAA2B,UAAU,GAAG;QACjD,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,0BAA0B,CACzC,MAAM,CAAC,SAAS,EAChB,YAAY,CAAC,IAAI,CAClB,CAAC;IAEF,MAAM,WAAW,GACf,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEpD,MAAM,UAAU,GACd,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,WAAW,GACf,UAAU,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAE5D,IACE,WAAW,KAAK,QAAQ;QACxB,yBAAyB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,KAAK,UAAU,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,UAAU,oDAAoD;YACvE,6DAA6D;YAC7D,6FAA6F;YAC7F,yCAAyC,SAAS,IAAI,CACzD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,MAAM,oCAAoC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACzE,EAAE,SAAS,CAAC;IAEd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,oBAAoB,SAAS,aAAa,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC5C,OAAO;YACL,UAAU;YACV,SAAS;YACT,QAAQ,EAAE,QAAQ,IAAI,aAAa;YACnC,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CACT,sBAAsB,SAAS,OAAO,UAAU,KAAK,WAAW,GAAG,CACpE,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,aAAa,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAC1C,QAAQ,EACR,QAAQ,EACR,WAAW,CACZ,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,KAAK,GACT,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;YACpC,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC/C,OAAO;gBACL,UAAU;gBACV,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,WAAW;gBACnB,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC7C,OAAO;gBACL,UAAU;gBACV,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,WAAW;gBACnB,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACjC,OAAO;YACL,UAAU;YACV,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7C,OAAO;YACL,UAAU;YACV,SAAS;YACT,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,iBAAiB,CAAC;QAC5B,SAAS,EAAE,QAAQ;QACnB,QAAQ;QACR,KAAK,EAAE,WAAW;QAClB,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEjC,OAAO;QACL,UAAU;QACV,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,WAAW;QACnB,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/commands/reconcile-all.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-all.d.ts","sourceRoot":"","sources":["../../src/commands/reconcile-all.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAsE7B"}
+{"version":3,"file":"reconcile-all.d.ts","sourceRoot":"","sources":["../../src/commands/reconcile-all.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA8E7B"}

package/dist/commands/reconcile-all.js

@@ -1,9 +1,12 @@
 import { logger } from "../utils/index.js";
+import { assertRequiredEcosystemEnv } from "../config/index.js";
 import { verifyTenant } from "./verify-tenant.js";
 import { reconcileClient } from "./reconcile-client.js";
 import { reconcileServer } from "./reconcile-server.js";
+import { assertNoManagedClientCredentialsOutsideManagedBlock } from "./env-root-validation.js";
 export async function reconcileAll(ctx) {
     const { config } = ctx;
+    assertNoManagedClientCredentialsOutsideManagedBlock(ctx);
     logger.info("=== Full Ecosystem Reconciliation ===");
     logger.blank();
     // Phase 1: Verify tenant
@@ -28,6 +31,12 @@ export async function reconcileAll(ctx) {
     }
     logger.info("=== Phase 3: Reconcile MCP Servers ===");
     logger.blank();
+    if (config.serverConfigs.size > 0) {
+        assertRequiredEcosystemEnv(config.ecosystem, {
+            context: "reconcile MCP servers",
+            requireBaseDomain: true,
+        });
+    }
     const serverResults = [];
     for (const slug of config.serverConfigs.keys()) {
         try {

package/dist/commands/reconcile-all.js.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-all.js","sourceRoot":"","sources":["../../src/commands/reconcile-all.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAA8B,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,eAAe,EAA8B,MAAM,uBAAuB,CAAC;AAQpF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAEvB,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,yBAAyB;IACzB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,YAAY,CAAC,oBAAoB,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,MAAM,aAAa,GAA4B,EAAE,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACrD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,+BAA+B,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,MAAM,aAAa,GAA4B,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,+BAA+B,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,UAAU;IACV,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,aAAa,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,QAAQ,GAAG,CAC5D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,aAAa,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,aAAa,GAAG,CAChE,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACT,aAAa,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAEhD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"reconcile-all.js","sourceRoot":"","sources":["../../src/commands/reconcile-all.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAA8B,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,eAAe,EAA8B,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,mDAAmD,EAAE,MAAM,0BAA0B,CAAC;AAQ/F,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvB,mDAAmD,CAAC,GAAG,CAAC,CAAC;IAEzD,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,yBAAyB;IACzB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,YAAY,CAAC,oBAAoB,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,MAAM,aAAa,GAA4B,EAAE,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACrD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,+BAA+B,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAClC,0BAA0B,CAAC,MAAM,CAAC,SAAS,EAAE;YAC3C,OAAO,EAAE,uBAAuB;YAChC,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAA4B,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,+BAA+B,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,UAAU;IACV,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,aAAa,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,QAAQ,GAAG,CAC5D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,aAAa,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,aAAa,GAAG,CAChE,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACT,aAAa,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAEhD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AAC5E,CAAC"}

package/dist/commands/reconcile-client.d.ts

@@ -1,11 +1,13 @@
 import type { CommandContext } from "../utils/index.js";
+export type ClientSecretStatus = "not_applicable" | "dry_run" | "written" | "matched_existing_managed" | "skipped_existing_managed";
 export interface ReconcileClientResult {
     clientKey: string;
     clientId: string;
     action: "created" | "reused" | "patched" | "dry_run";
     applicationType: string;
     tokenEndpointAuthMethod: string;
-    secretPlaceholderRequired: boolean;
+    secretWritten: boolean;
+    secretStatus: ClientSecretStatus;
 }
 export declare function reconcileClient(ctx: CommandContext, clientKey: string): Promise<ReconcileClientResult>;
 //# sourceMappingURL=reconcile-client.d.ts.map

package/dist/commands/reconcile-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile-client.d.ts","sourceRoot":"","sources":["../../src/commands/reconcile-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAWxD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACrD,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,yBAAyB,EAAE,OAAO,CAAC;CACpC;AAcD,wBAAsB,eAAe,CACnC,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CA6KhC"}
+{"version":3,"file":"reconcile-client.d.ts","sourceRoot":"","sources":["../../src/commands/reconcile-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAiBxD,MAAM,MAAM,kBAAkB,GAC1B,gBAAgB,GAChB,SAAS,GACT,SAAS,GACT,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACrD,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAcD,wBAAsB,eAAe,CACnC,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CA0QhC"}

package/dist/commands/reconcile-client.js

@@ -1,6 +1,10 @@
-import { logger } from "../utils/index.js";
+import { join } from "node:path";
+import { logger, clientIdEnvVar, clientSecretEnvVar } from "../utils/index.js";
+import { assertNoManagedClientCredentialsOutsideManagedBlock } from "./env-root-validation.js";
+import { expectedManagedClientMetadata, loadValidatedCachedClientApplication, MANAGED_BY, } from "./validated-client-cache.js";
 export async function reconcileClient(ctx, clientKey) {
-    const { config, auth0, dryRun } = ctx;
+    const { config, auth0, envManager, dryRun } = ctx;
+    assertNoManagedClientCredentialsOutsideManagedBlock(ctx);
     const clientConfig = config.clientConfigs.get(clientKey);
     if (!clientConfig) {
         throw new Error(`Unknown client key: "${clientKey}"`);
@@ -13,51 +17,77 @@ export async function reconcileClient(ctx, clientKey) {
     logger.debug(`  Profile: ${clientConfig.profile}`);
     logger.debug(`  App type: ${settings.appType}`);
     logger.debug(`  Auth method: ${settings.tokenEndpointAuthMethod}`);
-    if (clientConfig.auth0.existing_client_id) {
-        logger.info(`  Using existing client_id: ${clientConfig.auth0.existing_client_id}`);
-        const existing = await auth0.getApplication(clientConfig.auth0.existing_client_id);
+    const idEnvKey = clientIdEnvVar(clientKey);
+    const expectedMetadata = expectedManagedClientMetadata(config.ecosystem, clientConfig);
+    const existing = await loadValidatedCachedClientApplication(ctx, clientKey);
+    if (existing) {
+        logger.info(`  Using existing client_id from ${idEnvKey}: ${existing.client_id}`);
         const reuse = checkCompatibility(existing, settings);
         if (!reuse.compatible) {
             logger.warn(`  Existing application is NOT fully compatible: ${reuse.reason}`);
-            const policy = descriptor?.reuse_policy ?? "share_if_exact_match";
-            if (policy === "patch_if_safe" && !dryRun) {
+            const policy = resolveReusePolicy(clientConfig, descriptor);
+            if (policy === "patch_if_safe") {
+                if (dryRun) {
+                    logger.info("  [DRY RUN] Would patch existing application.");
+                    return {
+                        clientKey,
+                        clientId: existing.client_id,
+                        action: "dry_run",
+                        applicationType: settings.appType,
+                        tokenEndpointAuthMethod: settings.tokenEndpointAuthMethod,
+                        secretWritten: false,
+                        secretStatus: "not_applicable",
+                    };
+                }
                 logger.info("  Attempting safe patch...");
                 await patchApplication(auth0, existing, settings, config.ecosystem, clientConfig);
                 logger.success("  Application patched.");
+                assertManagedClientEnvWrite(envManager.set(idEnvKey, existing.client_id, {
+                    rejectOuterCollision: true,
+                }), ctx.rootDir);
                 return {
                     clientKey,
                     clientId: existing.client_id,
                     action: "patched",
                     applicationType: settings.appType,
                     tokenEndpointAuthMethod: settings.tokenEndpointAuthMethod,
-                    secretPlaceholderRequired: isConfidential(settings),
+                    secretWritten: false,
+                    secretStatus: "not_applicable",
                 };
             }
             logger.warn("  Reusing as-is (policy does not allow patching).");
         }
+        assertManagedClientEnvWrite(envManager.set(idEnvKey, existing.client_id, {
+            rejectOuterCollision: true,
+        }), ctx.rootDir);
         return {
             clientKey,
             clientId: existing.client_id,
             action: "reused",
             applicationType: settings.appType,
             tokenEndpointAuthMethod: settings.tokenEndpointAuthMethod,
-            secretPlaceholderRequired: isConfidential(settings),
+            secretWritten: false,
+            secretStatus: "not_applicable",
         };
     }
     logger.info("  Searching for existing Auth0 application by metadata...");
-    const existingApp = await auth0.findApplicationByMetadata("client_key", clientKey);
+    const existingApp = await auth0.findApplicationByMetadataEntries(expectedMetadata);
     if (existingApp) {
         logger.info(`  Found existing application: ${existingApp.name} (${existingApp.client_id})`);
         const reuse = checkCompatibility(existingApp, settings);
         if (reuse.compatible) {
             logger.success("  Application is compatible. Reusing.");
+            assertManagedClientEnvWrite(envManager.set(idEnvKey, existingApp.client_id, {
+                rejectOuterCollision: true,
+            }), ctx.rootDir);
             return {
                 clientKey,
                 clientId: existingApp.client_id,
                 action: "reused",
                 applicationType: settings.appType,
                 tokenEndpointAuthMethod: settings.tokenEndpointAuthMethod,
-                secretPlaceholderRequired: isConfidential(settings),
+                secretWritten: false,
+                secretStatus: "not_applicable",
             };
         }
         logger.warn(`  Existing application is not compatible: ${reuse.reason}`);
@@ -71,19 +101,24 @@ export async function reconcileClient(ctx, clientKey) {
                     action: "dry_run",
                     applicationType: settings.appType,
                     tokenEndpointAuthMethod: settings.tokenEndpointAuthMethod,
-                    secretPlaceholderRequired: isConfidential(settings),
+                    secretWritten: false,
+                    secretStatus: "not_applicable",
                 };
             }
             logger.info("  Patching existing application...");
             await patchApplication(auth0, existingApp, settings, config.ecosystem, clientConfig);
             logger.success("  Application patched.");
+            assertManagedClientEnvWrite(envManager.set(idEnvKey, existingApp.client_id, {
+                rejectOuterCollision: true,
+            }), ctx.rootDir);
             return {
                 clientKey,
                 clientId: existingApp.client_id,
                 action: "patched",
                 applicationType: settings.appType,
                 tokenEndpointAuthMethod: settings.tokenEndpointAuthMethod,
-                secretPlaceholderRequired: isConfidential(settings),
+                secretWritten: false,
+                secretStatus: "not_applicable",
             };
         }
         if (policy === "share_if_exact_match") {
@@ -104,13 +139,15 @@ export async function reconcileClient(ctx, clientKey) {
             action: "dry_run",
             applicationType: settings.appType,
             tokenEndpointAuthMethod: settings.tokenEndpointAuthMethod,
-            secretPlaceholderRequired: isConfidential(settings),
+            secretWritten: false,
+            secretStatus: isConfidential(settings) ? "dry_run" : "not_applicable",
         };
     }
     logger.info("  Creating new Auth0 Application...");
     const newApp = await auth0.createApplication({
         name: clientConfig.display_name,
         app_type: settings.appType,
+        oidc_conformant: true,
         token_endpoint_auth_method: settings.tokenEndpointAuthMethod,
         grant_types: settings.grantTypes,
         callbacks: settings.callbackUrls.length > 0 ? settings.callbackUrls : undefined,
@@ -121,7 +158,7 @@ export async function reconcileClient(ctx, clientKey) {
             client_key: clientKey,
             descriptor: clientConfig.descriptor ?? "",
             profile: clientConfig.profile,
-            managed_by: "@scupit/mcp-ecosystem",
+            managed_by: MANAGED_BY,
         },
         ...(settings.useRefreshTokens && {
             refresh_token: {
@@ -133,13 +170,45 @@ export async function reconcileClient(ctx, clientKey) {
         }),
     });
     logger.success(`  Application created: ${newApp.name} (${newApp.client_id})`);
+    assertManagedClientEnvWrite(envManager.set(idEnvKey, newApp.client_id, {
+        rejectOuterCollision: true,
+    }), ctx.rootDir);
+    let secretWritten = false;
+    let secretStatus = "not_applicable";
+    if (isConfidential(settings) && newApp.client_secret) {
+        const secretEnvKey = clientSecretEnvVar(clientKey);
+        const secretWriteResult = envManager.set(secretEnvKey, newApp.client_secret, {
+            writeOnce: true,
+            rejectOuterCollision: true,
+        });
+        switch (secretWriteResult.status) {
+            case "created":
+            case "updated":
+                secretWritten = true;
+                secretStatus = "written";
+                logger.success(`  Client secret captured in ${secretEnvKey}.`);
+                break;
+            case "matched_existing_managed":
+                secretStatus = "matched_existing_managed";
+                logger.info(`  Client secret already present in managed ${secretEnvKey}.`);
+                break;
+            case "skipped_existing_managed":
+                secretStatus = "skipped_existing_managed";
+                logger.warn(`  Client secret already exists in managed ${secretEnvKey}. ` +
+                    `Preserving the existing write-once value.`);
+                break;
+            case "rejected_outer_collision":
+                throw new Error(buildUnexpectedOuterCollisionError(secretEnvKey, ctx.rootDir, secretWriteResult.outerAssignments?.map((assignment) => assignment.rawLine) ?? []));
+        }
+    }
     return {
         clientKey,
         clientId: newApp.client_id,
         action: "created",
         applicationType: settings.appType,
         tokenEndpointAuthMethod: settings.tokenEndpointAuthMethod,
-        secretPlaceholderRequired: isConfidential(settings),
+        secretWritten,
+        secretStatus,
     };
 }
 function resolveSettings(ecosystem, client, descriptor) {
@@ -280,7 +349,7 @@ async function patchApplication(auth0, existing, settings, ecosystem, clientConf
         client_key: clientConfig.client_key,
         descriptor: clientConfig.descriptor ?? "",
         profile: clientConfig.profile,
-        managed_by: "mcp-ecosystem-script",
+        managed_by: MANAGED_BY,
     };
     if (Object.keys(patch).length > 0) {
         await auth0.updateApplication(existing.client_id, patch);
@@ -292,4 +361,27 @@ function mergeArrays(existing, desired) {
         set.add(item);
     return [...set];
 }
+function assertManagedClientEnvWrite(result, rootDir) {
+    if (result.status !== "rejected_outer_collision") {
+        return;
+    }
+    throw new Error(buildUnexpectedOuterCollisionError(result.key, rootDir, result.outerAssignments?.map((assignment) => assignment.rawLine) ?? []));
+}
+function buildUnexpectedOuterCollisionError(envKey, rootDir, rawAssignments) {
+    const envPath = join(rootDir, ".env");
+    const entries = rawAssignments.length > 0
+        ? rawAssignments.map((line) => `    ${maskSecretAssignment(line)}`)
+        : [`    ${maskSecretAssignment(`${envKey}=<user-authored-value>`)}`];
+    return (`Invalid tool-managed client credential in ${envPath}\n\n` +
+        `  ${envKey} exists outside the managed block, so the CLI refused to write a managed value.\n\n` +
+        `  Remove the outer assignment and re-run reconciliation:\n` +
+        `${entries.join("\n")}`);
+}
+function maskSecretAssignment(line) {
+    const eqIdx = line.indexOf("=");
+    if (eqIdx === -1)
+        return line;
+    const key = line.slice(0, eqIdx).trim();
+    return key.includes("_SECRET") ? `${key}=********` : line;
+}
 //# sourceMappingURL=reconcile-client.js.map