@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/serialization/tasks/diff.js

@@ -8,25 +8,153 @@ const node_path_1 = __importDefault(require("node:path"));
 const item_path_1 = require("../item-path");
 const tree_spec_1 = require("../tree-spec");
 const field_filter_1 = require("../field-filter");
-const sitecore_api_1 = require("../sitecore-api");
+const items_1 = require("../api/items");
 const commands_1 = require("../commands");
 const shared_1 = require("./shared");
-const helpers_1 = require("./helpers");
+const sitecore_1 = require("./helpers/sitecore");
+const commands_2 = require("./helpers/commands");
+const items_2 = require("./helpers/items");
+const collect_1 = require("./helpers/collect");
+const cli_tasks_1 = require("../../shared/cli-tasks");
+const concurrency_1 = require("../../shared/concurrency");
+const summarizeChanges = (commands) => {
+    const out = {
+        create: [],
+        update: [],
+        recycle: [],
+        move: [],
+        rename: [],
+    };
+    for (const cmd of commands) {
+        const entry = {
+            id: cmd.source.id,
+            path: cmd.source.path.toPathString(),
+        };
+        out[cmd.type].push(entry);
+    }
+    return out;
+};
+/**
+ * Fetch metadata for every subtree in a database, parallel-bounded.
+ * Result preserves the (subtree, item) order of the input subtrees so
+ * downstream `buildCommandsForDatabase` sees the same shape sequential
+ * code produced.
+ */
+const fetchSubtreesMetadata = async (env, subtrees, database, filter, apiTimeoutMs) => {
+    const perSubtree = await (0, concurrency_1.mapWithConcurrency)(subtrees, async (subtree) => {
+        const data = await (0, items_1.fetchItemMetadata)(env, database, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
+        return data.filter((item) => subtree.includesPath(item.path));
+    });
+    return perSubtree.flat();
+};
+/**
+ * Run diff (and optional push) for one database against two
+ * environments. Source and destination are fetched concurrently; on
+ * --push, item-data collection for both sides also runs concurrently.
+ */
+const diffDatabase = async ({ root, sourceName, destName, database, subtrees, filter, apiTimeoutMs, options, }) => {
+    const sourceEnv = root.environments[sourceName];
+    const destEnv = root.environments[destName];
+    const [sourceMetadata, destinationMetadata] = await Promise.all([
+        fetchSubtreesMetadata(sourceEnv, subtrees, database, filter, apiTimeoutMs),
+        fetchSubtreesMetadata(destEnv, subtrees, database, filter, apiTimeoutMs),
+    ]);
+    const commands = (0, commands_2.buildCommandsForDatabase)(subtrees, sourceMetadata, destinationMetadata, true);
+    const differences = commands.length;
+    const whatIf = Boolean(options.push && options.whatIf);
+    const applied = Boolean(options.push) && !whatIf;
+    const summary = {
+        database,
+        differences,
+        applied,
+        whatIf,
+    };
+    if (options.verbose) {
+        summary.changes = summarizeChanges(commands);
+    }
+    return { commands, summary };
+};
+/**
+ * Apply a planned diff to the destination environment for one
+ * database. Source + destination item-body fetches run concurrently.
+ */
+const pushDatabase = async (args, commands, logger) => {
+    const { root, sourceName, destName, database, subtrees, options } = args;
+    // Guard: an empty source against a populated target would recycle
+    // every item in the database. Require --force to confirm intent.
+    if (commands.some((cmd) => cmd.type === "recycle")) {
+        const recycles = commands.filter((cmd) => cmd.type === "recycle").length;
+        const sourceMeta = await fetchSubtreesMetadata(root.environments[sourceName], subtrees, database, args.filter, args.apiTimeoutMs);
+        // Re-check on the cached side: if source has zero items but destination has many,
+        // that's the catastrophic-stomp scenario the dotnet CLI quietly executes.
+        if (sourceMeta.length === 0 && recycles > 0) {
+            const confirmed = await (0, cli_tasks_1.confirmDestructive)(`Source environment '${sourceName}' is empty for database '${database}'. ` +
+                `Push would recycle ${recycles} items in '${destName}'. Proceed?`, options.force);
+            if (!confirmed) {
+                logger.info("Push cancelled.", "yellow");
+                return;
+            }
+        }
+    }
+    const [sourceData, destData] = await Promise.all([
+        (0, collect_1.collectItemData)(sourceName, root, subtrees, false),
+        (0, collect_1.collectItemData)(destName, root, subtrees, false),
+    ]);
+    const sourceDataMap = (0, items_2.buildItemDataMap)(sourceData.items);
+    const destDataMap = (0, items_2.buildItemDataMap)(destData.items);
+    (0, commands_1.enrichCreateCommands)(commands, sourceDataMap);
+    (0, commands_1.enrichUpdateCommands)(commands, sourceDataMap, destDataMap, true);
+    await (0, sitecore_1.applySitecoreCommands)(root, destName, database, commands, logger, Boolean(options.whatIf));
+};
 const runDiff = async (options) => {
     const logger = (0, shared_1.toLogger)(options);
     const { root, modules } = await (0, shared_1.loadConfigAndModules)(options);
     const sourceName = options.source ?? root.defaultEnvironment;
     const destName = options.destination ?? root.defaultEnvironment;
     const apiTimeoutMs = (0, shared_1.resolveApiTimeoutMs)(root);
+    if (!root.environments[sourceName]) {
+        throw (0, cli_tasks_1.inputError)(`Source environment '${sourceName}' is not defined in sitecoreai.cli.json.`);
+    }
+    if (!root.environments[destName]) {
+        throw (0, cli_tasks_1.inputError)(`Target environment '${destName}' is not defined in sitecoreai.cli.json.`);
+    }
+    const mode = sourceName === destName ? "local-vs-instance" : "instance-vs-instance";
+    // Same-env diff is a legacy/legitimate no-op (both default to
+    // root.defaultEnvironment). Surface a friendly note in non-JSON mode
+    // so users aren't confused by zero differences.
+    if (mode === "local-vs-instance" && !logger.isJson()) {
+        if (options.source && options.destination) {
+            logger.info(`Source and target are the same environment ('${sourceName}'). Diff will report zero differences. ` +
+                "Pass distinct --source-env / --target-env to diff two environments.", "yellow");
+        }
+    }
+    if (options.push) {
+        // Mirror push.ts: --allow-write flag mutates the in-memory env so
+        // ensureAllowWrite passes; --what-if skips the write gate entirely.
+        if (options.allowWrite) {
+            const destEnvCfg = root.environments[destName];
+            if (destEnvCfg) {
+                destEnvCfg.allowWrite = true;
+            }
+        }
+        if (!options.whatIf) {
+            (0, shared_1.ensureAllowWrite)(root, destName);
+        }
+    }
+    // Hoist filter: excludedFields is invariant across all subtrees and dbs.
+    const filter = (0, field_filter_1.createFieldFilterSet)(root.serialization.excludedFields, []);
     const summary = {
         command: "serialization.diff",
+        mode,
         source: sourceName,
         destination: destName,
         path: options.path ?? null,
         push: Boolean(options.push),
+        whatIf: Boolean(options.push && options.whatIf),
         totalDifferences: 0,
         databases: [],
     };
+    // Path mode: a single subtree explicitly requested via -p.
     if (options.path) {
         const sourceDatabase = options.sourceDatabase ?? "master";
         const destinationDatabase = options.destinationDatabase ?? sourceDatabase;
@@ -37,70 +165,70 @@ const runDiff = async (options) => {
         subtree.scope = tree_spec_1.TreeScope.ItemAndChildren;
         subtree.allowedPushOperations = tree_spec_1.AllowedPushOperations.CreateUpdateAndDelete;
         subtree.physicalPath = node_path_1.default.join(process.cwd(), "diff");
-        const filter = (0, field_filter_1.createFieldFilterSet)(root.serialization.excludedFields, []);
-        const sourceMetadata = await (0, sitecore_api_1.fetchItemMetadata)(root.environments[sourceName], sourceDatabase, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
-        const destMetadata = await (0, sitecore_api_1.fetchItemMetadata)(root.environments[destName], destinationDatabase, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
-        const sourceFiltered = sourceMetadata.filter((item) => subtree.includesPath(item.path));
-        const destFiltered = destMetadata.filter((item) => subtree.includesPath(item.path));
-        const commands = (0, helpers_1.buildCommandsForDatabase)([subtree], sourceFiltered, destFiltered, true);
-        const differences = commands.length;
-        summary.totalDifferences += differences;
-        summary.databases.push({
+        const args = {
+            root,
+            sourceName,
+            destName,
             database: destinationDatabase,
-            differences,
-            applied: Boolean(options.push),
-        });
+            subtrees: [subtree],
+            filter,
+            apiTimeoutMs,
+            options,
+        };
+        const { commands, summary: dbSummary } = await diffDatabase(args);
+        summary.databases.push(dbSummary);
+        summary.totalDifferences += dbSummary.differences;
         if (!logger.isJson()) {
-            logger.info(`Discovered ${differences} differences for ${destinationDatabase}.`, "green");
+            logger.info(`Discovered ${dbSummary.differences} differences for ${destinationDatabase}.`, "green");
         }
         if (options.push) {
-            (0, shared_1.ensureAllowWrite)(root, destName);
-            const sourceData = await (0, helpers_1.collectItemData)(sourceName, root, [subtree], false);
-            const destData = await (0, helpers_1.collectItemData)(destName, root, [subtree], false);
-            const sourceDataMap = (0, helpers_1.buildItemDataMap)(sourceData.items);
-            const destDataMap = (0, helpers_1.buildItemDataMap)(destData.items);
-            (0, commands_1.enrichCreateCommands)(commands, sourceDataMap);
-            (0, commands_1.enrichUpdateCommands)(commands, sourceDataMap, destDataMap, true);
-            await (0, helpers_1.applySitecoreCommands)(root, destName, destinationDatabase, commands, logger, false);
+            await pushDatabase(args, commands, logger);
         }
         if (logger.isJson()) {
             logger.json(summary);
         }
         return;
     }
+    // Module mode: walk subtrees grouped by database. Databases stay
+    // sequential — typically only master+core, and serializing them
+    // keeps spinner output / partial-failure semantics predictable.
     const subtreesByDb = (0, shared_1.groupSubtreesByDatabase)(modules);
     for (const [database, subtrees] of subtreesByDb) {
-        const sourceMetadata = [];
-        const destinationMetadata = [];
-        for (const subtree of subtrees) {
-            const filter = (0, field_filter_1.createFieldFilterSet)(root.serialization.excludedFields, []);
-            const source = await (0, sitecore_api_1.fetchItemMetadata)(root.environments[sourceName], database, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
-            const dest = await (0, sitecore_api_1.fetchItemMetadata)(root.environments[destName], database, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
-            sourceMetadata.push(...source.filter((item) => subtree.includesPath(item.path)));
-            destinationMetadata.push(...dest.filter((item) => subtree.includesPath(item.path)));
+        if (options.signal?.aborted) {
+            options.emit?.({ kind: "database-skipped", database, reason: "cancelled-by-client" });
+            break;
         }
-        const commands = (0, helpers_1.buildCommandsForDatabase)(subtrees, sourceMetadata, destinationMetadata, true);
-        const differences = commands.length;
-        summary.totalDifferences += differences;
-        summary.databases.push({
+        options.emit?.({ kind: "database-start", database, subtreeCount: subtrees.length });
+        const args = {
+            root,
+            sourceName,
+            destName,
             database,
-            differences,
-            applied: Boolean(options.push),
+            subtrees,
+            filter,
+            apiTimeoutMs,
+            options,
+        };
+        const { commands, summary: dbSummary } = await diffDatabase(args);
+        summary.databases.push(dbSummary);
+        summary.totalDifferences += dbSummary.differences;
+        options.emit?.({
+            kind: "database-changes-detected",
+            database,
+            changes: dbSummary.differences,
         });
         if (!logger.isJson()) {
-            logger.info(`Discovered ${differences} differences for ${database}.`, "green");
+            logger.info(`Discovered ${dbSummary.differences} differences for ${database}.`, "green");
         }
-        if (!options.push) {
-            continue;
+        if (options.push) {
+            await pushDatabase(args, commands, logger);
+            options.emit?.({
+                kind: "database-applied",
+                database,
+                changes: dbSummary.differences,
+                whatIf: Boolean(options.whatIf),
+            });
         }
-        (0, shared_1.ensureAllowWrite)(root, destName);
-        const sourceData = await (0, helpers_1.collectItemData)(sourceName, root, subtrees, false);
-        const destData = await (0, helpers_1.collectItemData)(destName, root, subtrees, false);
-        const sourceDataMap = (0, helpers_1.buildItemDataMap)(sourceData.items);
-        const destDataMap = (0, helpers_1.buildItemDataMap)(destData.items);
-        (0, commands_1.enrichCreateCommands)(commands, sourceDataMap);
-        (0, commands_1.enrichUpdateCommands)(commands, sourceDataMap, destDataMap, true);
-        await (0, helpers_1.applySitecoreCommands)(root, destName, database, commands, logger, false);
     }
     if (logger.isJson()) {
         logger.json(summary);

package/dist/serialization/tasks/env/constants.d.ts

@@ -1,2 +1,14 @@
 export declare const DEFAULT_PUBLIC_CLIENT_ID = "Chi8EwfFnEejksk3Sed9hlalGiM9B2v7";
-//# sourceMappingURL=constants.d.ts.map
+/**
+ * Scope set for the interactive device-code flow. Adds the OIDC user-
+ * context scopes plus `offline_access` so we get a refresh token back.
+ * Joining with spaces is the OAuth/OIDC standard separator for the
+ * `scope` parameter.
+ */
+export declare const SCAI_DEVICE_FLOW_SCOPES: string;
+/**
+ * Scope set for the client_credentials (m2m) flow. OIDC user-context
+ * scopes (openid/profile/email) and `offline_access` don't apply to
+ * machine clients; restrict to the API scopes only.
+ */
+export declare const SCAI_CLIENT_CREDENTIALS_SCOPES: string;

package/dist/serialization/tasks/env/constants.js

@@ -1,4 +1,67 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_PUBLIC_CLIENT_ID = void 0;
+exports.SCAI_CLIENT_CREDENTIALS_SCOPES = exports.SCAI_DEVICE_FLOW_SCOPES = exports.DEFAULT_PUBLIC_CLIENT_ID = void 0;
 exports.DEFAULT_PUBLIC_CLIENT_ID = "Chi8EwfFnEejksk3Sed9hlalGiM9B2v7";
+/**
+ * Auth0 only includes scopes in a token if the request asks for them
+ * (or the client has them as a "default" grant). When `scope` is omitted
+ * on a device-code or client_credentials request, the issuer hands back
+ * the client's default grant only — which for the public scai CLI
+ * client is the `xmclouddeploy.*` family. That leaves Authoring API
+ * calls (any `xmcloud.cm:admin`-gated path: recipes, workflow, webhook)
+ * with no usable token even after a "successful" login.
+ *
+ * Below: the full scope set scai requests at login. Mirrors what an
+ * operator could plausibly need across the CLI's surface — Deploy
+ * lifecycle, Authoring API writes (`xmcloud.cm:admin`), platform
+ * inventory, IAM read. Tokens are issued for the intersection of this
+ * list and the client's allow-list in Auth0, so misconfigured clients
+ * still mint *something* — just without the missing scope, which then
+ * surfaces as a clean upstream 401 rather than a silently-empty scope.
+ */
+const SCAI_API_SCOPES = [
+    // Authoring + Management GraphQL — the missing-link scope that lets
+    // recipes, workflow, and webhook tools call api.sitecorecloud.io's
+    // Authoring API.
+    "xmcloud.cm:admin",
+    // Deploy API — projects, environments, deployments, repos, monitoring.
+    "xmclouddeploy.clients:manage",
+    "xmclouddeploy.deployments:manage",
+    "xmclouddeploy.environments:manage",
+    "xmclouddeploy.monitoring.deployments:read",
+    "xmclouddeploy.organizations:manage",
+    "xmclouddeploy.projects:manage",
+    "xmclouddeploy.rh:mng",
+    "xmclouddeploy.site:mng",
+    "xmclouddeploy.sourcecontrol:manage",
+    // Platform inventory + IAM read — needed by scai setup status / org
+    // inspectors when an agent walks the tenancy tree.
+    "platform.tenants:listall",
+    "iam.usr_roles:r",
+    // SAI Publishing API — tenant-tier scopes used by `scai content publish`.
+    // Granted only on environment-level automation clients per the
+    // Publishing API architect (org-level clients won't get them, and
+    // the issued token will just omit them in that case — harmless).
+    "xmcpub.jobs.t:r",
+    "xmcpub.jobs.t:w",
+    "xmcpub.queue:r",
+];
+/**
+ * Scope set for the interactive device-code flow. Adds the OIDC user-
+ * context scopes plus `offline_access` so we get a refresh token back.
+ * Joining with spaces is the OAuth/OIDC standard separator for the
+ * `scope` parameter.
+ */
+exports.SCAI_DEVICE_FLOW_SCOPES = [
+    "openid",
+    "profile",
+    "email",
+    "offline_access",
+    ...SCAI_API_SCOPES,
+].join(" ");
+/**
+ * Scope set for the client_credentials (m2m) flow. OIDC user-context
+ * scopes (openid/profile/email) and `offline_access` don't apply to
+ * machine clients; restrict to the API scopes only.
+ */
+exports.SCAI_CLIENT_CREDENTIALS_SCOPES = SCAI_API_SCOPES.join(" ");

package/dist/serialization/tasks/env/deploy-token.d.ts

@@ -1,3 +1,2 @@
 import type { DeployTokenOptions } from "../../../deploy/tasks/types";
 export declare const runDeployToken: (options: DeployTokenOptions) => Promise<void>;
-//# sourceMappingURL=deploy-token.d.ts.map

package/dist/serialization/tasks/env/deploy-token.js

@@ -1,15 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runDeployToken = void 0;
-const config_1 = require("../../../config");
+const root_config_1 = require("../../../config/root-config");
 const browser_1 = require("../../../shared/browser");
 const validate_1 = require("../../../shared/validate");
 const errors_1 = require("../../../shared/errors");
+const policy_1 = require("../../../policy");
 const keychain_1 = require("../../../shared/keychain");
+const client_credential_1 = require("../../../shared/client-credential");
 const prompt_1 = require("../../../shared/prompt");
-const sitecore_api_1 = require("../../../serialization/sitecore-api");
+const auth_1 = require("../../../serialization/api/auth");
 const cli_tasks_1 = require("../../../shared/cli-tasks");
 const constants_1 = require("./constants");
+/**
+ * Read an env var, treating an empty / whitespace-only value as unset.
+ * `process.env.X` is `""` for an exported-but-blank var (common in CI and
+ * sourced `.env` files); a plain `?? fallback` would keep that `""` and
+ * shadow the default, so normalize to `undefined` first.
+ */
+const envValue = (key) => {
+    const value = process.env[key]?.trim();
+    return value ? value : undefined;
+};
 const runDeployToken = async (options) => {
     const logger = (0, cli_tasks_1.toLogger)(options);
     const envName = options.environmentName;
@@ -17,18 +29,18 @@ const runDeployToken = async (options) => {
         throw (0, cli_tasks_1.inputError)("Environment name is required. Use --environment-name.");
     }
     const configPath = options.config ?? process.cwd();
-    const rootConfigFile = (0, config_1.readRootConfigurationFile)(configPath);
-    const root = (0, config_1.readRootConfiguration)(configPath, envName);
+    const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+    const root = (0, root_config_1.readRootConfiguration)(configPath, envName);
     const envProfiles = rootConfigFile.config.envProfiles ?? {};
     const existing = envProfiles[envName] ?? {};
     const baseEnv = root.environments[envName] ?? {};
     const isInteractive = process.stdin.isTTY && process.stdout.isTTY && process.env.SITECOREAI_NON_INTERACTIVE !== "1";
-    const baseAuthority = baseEnv.authority ?? process.env.SITECOREAI_AUTHORITY ?? "https://auth.sitecorecloud.io";
+    const baseAuthority = baseEnv.authority ?? envValue("SITECOREAI_AUTHORITY") ?? "https://auth.sitecorecloud.io";
     if (baseAuthority) {
         (0, validate_1.assertValidUrl)(baseAuthority, "Authority");
     }
-    const deviceDefaultClientId = options.clientId ?? process.env.SITECOREAI_CLIENT_ID ?? constants_1.DEFAULT_PUBLIC_CLIENT_ID;
-    const clientCredentialsDefaultClientId = options.clientId ?? baseEnv.clientId ?? process.env.SITECOREAI_CLIENT_ID;
+    const deviceDefaultClientId = options.clientId ?? envValue("SITECOREAI_CLIENT_ID") ?? constants_1.DEFAULT_PUBLIC_CLIENT_ID;
+    const clientCredentialsDefaultClientId = options.clientId ?? baseEnv.clientId ?? envValue("SITECOREAI_CLIENT_ID");
     let wantsClientCredentials = Boolean(options.useClientCredentials || baseEnv.useClientCredentials);
     if (options.useClientCredentials === undefined &&
         baseEnv.useClientCredentials === undefined &&
@@ -38,14 +50,18 @@ const runDeployToken = async (options) => {
     }
     const authority = baseAuthority;
     let clientId = wantsClientCredentials ? clientCredentialsDefaultClientId : deviceDefaultClientId;
-    let clientSecret = options.clientSecret ?? baseEnv.clientSecret;
+    // The secret never lives on the env profile: it comes from the
+    // `--client-secret` flag or the `SITECOREAI_ENV_<ENV>_CLIENT_SECRET`
+    // env var (resolved by `resolveEnvClientSecret`), else an interactive
+    // prompt below.
+    let clientSecret = options.clientSecret ?? (0, client_credential_1.resolveEnvClientSecret)(envName);
     if (wantsClientCredentials) {
         if (!clientId && isInteractive) {
             clientId = await (0, prompt_1.promptText)("Client ID");
         }
         if (!clientSecret) {
             if (!isInteractive) {
-                throw (0, errors_1.createCliError)("Client ID and client secret are required for client credentials.", "INPUT_INVALID", {
+                throw (0, errors_1.createScaiError)("Client ID and client secret are required for client credentials.", "INPUT_INVALID", {
                     hint: "Provide --client-id/--client-secret with --use-client-credentials, or set SITECOREAI_CLIENT_ID and SITECOREAI_CLIENT_SECRET.",
                 });
             }
@@ -57,32 +73,32 @@ const runDeployToken = async (options) => {
     let token;
     if (wantsClientCredentials) {
         if (!authority || !clientId || !clientSecret) {
-            throw (0, errors_1.createCliError)("Client ID and client secret are required for client credentials.", "AUTH_REQUIRED", {
+            throw (0, errors_1.createScaiError)("Client ID and client secret are required for client credentials.", "AUTH_REQUIRED", {
                 hint: "Provide --client-id/--client-secret with --use-client-credentials, or set SITECOREAI_CLIENT_ID and SITECOREAI_CLIENT_SECRET.",
             });
         }
-        token = await (0, sitecore_api_1.requestClientCredentialsToken)({
+        token = await (0, auth_1.requestClientCredentialsToken)({
             authority: authority ?? "",
             clientId,
             clientSecret: clientSecret ?? "",
             audience,
-        }, undefined);
+        }, constants_1.SCAI_CLIENT_CREDENTIALS_SCOPES);
     }
     else {
         if (!authority || !clientId) {
-            throw (0, errors_1.createCliError)("Client ID is required for interactive login.", "AUTH_REQUIRED", {
+            throw (0, errors_1.createScaiError)("Client ID is required for interactive login.", "AUTH_REQUIRED", {
                 hint: "Provide --client-id or set SITECOREAI_CLIENT_ID.",
             });
         }
         if (!isInteractive) {
             (0, prompt_1.assertInteractive)("Interactive login requires a TTY. Use --use-client-credentials instead.", "Use --use-client-credentials for non-interactive authentication.");
         }
-        const device = await (0, sitecore_api_1.requestDeviceAuthorization)({
+        const device = await (0, auth_1.requestDeviceAuthorization)({
             authority,
             clientId,
             clientSecret,
             audience,
-        }, undefined);
+        }, constants_1.SCAI_DEVICE_FLOW_SCOPES);
         const verifyUrl = device.verificationUriComplete ?? device.verificationUri;
         if (device.message) {
             logger.info(device.message);
@@ -96,7 +112,7 @@ const runDeployToken = async (options) => {
         if (!device.verificationUriComplete && device.userCode) {
             logger.info(`Enter code: ${device.userCode}`);
         }
-        token = await (0, sitecore_api_1.pollDeviceToken)({
+        token = await (0, auth_1.pollDeviceToken)({
             authority,
             clientId,
             clientSecret,
@@ -107,18 +123,54 @@ const runDeployToken = async (options) => {
     if (!stored) {
         logger.warn("Unable to store the Deploy token in the OS keychain. Use SITECOREAI_DEPLOY_TOKEN if needed.", "yellow");
     }
+    // Mirror the same token into the CM keychain slot. The token's scope
+    // claim covers both Deploy AND `xmcloud.cm:admin`-gated paths (per the
+    // explicit scope set we requested above), so one mint serves both
+    // surfaces. Without this mirror, `getAccessToken` (Authoring API
+    // reader) reads an empty CM slot and surfaces AUTH_REQUIRED even
+    // though the equivalent token sits one slot over.
+    const cmStored = await (0, keychain_1.setCmTokens)(envName, {
+        accessToken: token.accessToken,
+        refreshToken: token.refreshToken,
+        expiresIn: token.expiresIn,
+        lastUpdated: new Date().toISOString(),
+    });
+    if (!cmStored && stored) {
+        // Deploy slot wrote, CM didn't — unusual; warn but proceed since
+        // Deploy commands still work without the mirror.
+        logger.warn("Stored the Deploy token but couldn't mirror it into the CM keychain slot. Authoring API calls (recipe/workflow/webhook) may fail until the next login retries.", "yellow");
+    }
+    // Deploy-token freshness metadata lives on the env profile in the
+    // config file — the config holds every token's non-secret metadata
+    // (see docs/credentials.md). `deployToken` is cleared as legacy
+    // token-cache metadata; a stale `clientSecret` field from an older
+    // config is scrubbed via the cast.
     const updated = {
         ...existing,
         deployToken: undefined,
         deployTokenExpiresIn: token.expiresIn ?? null,
         deployTokenLastUpdated: new Date().toISOString(),
+        ...{ clientSecret: undefined },
     };
     if (wantsClientCredentials && clientId) {
         updated.clientId = clientId;
     }
     envProfiles[envName] = updated;
     rootConfigFile.config.envProfiles = envProfiles;
-    (0, config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+    (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+    // Enroll this environment into the workspace policy. `scai setup login`
+    // is the operator interactively choosing this environment, so it is
+    // auto-allowed and its tenant identity is pinned for tamper detection.
+    // See docs/policy-and-guardrails.md.
+    try {
+        const enrollment = (0, policy_1.enrollEnvironment)({ envName, environment: updated, via: "setup-login" });
+        if (enrollment.created) {
+            logger.info("Workspace policy created — environment guardrails are now active. Manage with 'scai policy'.", "cyan");
+        }
+    }
+    catch (error) {
+        logger.warn(`Could not update the workspace policy: ${(0, errors_1.toScaiError)(error).message}`, "yellow");
+    }
     logger.info(`SitecoreAI access token saved to the OS keychain for environment '${envName}' (Deploy + CM/admin scopes).`, "green");
     if (options.print) {
         // Intentional: allows piping token in automated environments.

package/dist/serialization/tasks/env/init/auth.d.ts

@@ -1,4 +1,4 @@
-import type { EnvironmentConfiguration } from "../../../../config";
+import type { EnvironmentConfiguration } from "../../../../config/types";
 import type { ConnectOptions } from "../../types";
 import type { Logger } from "../../../../shared/logger";
 type ResolveDeployAuthInput = {
@@ -9,7 +9,6 @@ type ResolveDeployAuthInput = {
     runWizard: boolean;
     isInteractive: boolean;
     needsDeployToken: boolean;
-    updated: EnvironmentConfiguration;
     logger: Logger;
 };
 type ResolveDeployAuthResult = {
@@ -18,7 +17,16 @@ type ResolveDeployAuthResult = {
     loginClientId?: string;
     wantsClientCredentials: boolean;
     shouldPersistClientId: boolean;
+    /**
+     * Freshness metadata for a freshly minted deploy token. Present only
+     * when this call performed a login; the caller writes it onto the env
+     * profile in the config file (`deployTokenExpiresIn` /
+     * `deployTokenLastUpdated`) — see docs/credentials.md.
+     */
+    deployTokenMeta?: {
+        expiresIn: number | null;
+        lastUpdated: string;
+    };
 };
 export declare const resolveDeployAuth: (input: ResolveDeployAuthInput) => Promise<ResolveDeployAuthResult>;
 export {};
-//# sourceMappingURL=auth.d.ts.map