@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/serialization/tasks/env/init/auth.js

@@ -5,11 +5,12 @@ const browser_1 = require("../../../../shared/browser");
 const validate_1 = require("../../../../shared/validate");
 const errors_1 = require("../../../../shared/errors");
 const keychain_1 = require("../../../../shared/keychain");
+const client_credential_1 = require("../../../../shared/client-credential");
 const prompt_1 = require("../../../../shared/prompt");
-const sitecore_api_1 = require("../../../../serialization/sitecore-api");
+const auth_1 = require("../../../../serialization/api/auth");
 const constants_1 = require("../constants");
 const resolveDeployAuth = async (input) => {
-    const { options, envName, existing, baseEnv, runWizard, isInteractive, needsDeployToken, updated, logger, } = input;
+    const { options, envName, existing, baseEnv, runWizard, isInteractive, needsDeployToken, logger, } = input;
     let deployToken = options.deployToken ?? existing.deployToken ?? (await (0, keychain_1.getDeployToken)(envName));
     let loginAuthority = baseEnv.authority ??
         existing.authority ??
@@ -18,10 +19,11 @@ const resolveDeployAuth = async (input) => {
     if (loginAuthority) {
         (0, validate_1.assertValidUrl)(loginAuthority, "Authority");
     }
-    let loginClientSecret = options.clientSecret ??
-        baseEnv.clientSecret ??
-        existing.clientSecret ??
-        process.env.SITECOREAI_CLIENT_SECRET;
+    // The secret never lives on the env profile: it comes from the
+    // `--client-secret` flag or the `SITECOREAI_ENV_<ENV>_CLIENT_SECRET`
+    // env var (resolved by `resolveEnvClientSecret`), else an interactive
+    // prompt below.
+    let loginClientSecret = options.clientSecret ?? (0, client_credential_1.resolveEnvClientSecret)(envName);
     let wantsClientCredentials = Boolean(options.useClientCredentials || baseEnv.useClientCredentials || existing.useClientCredentials);
     const deviceClientId = options.clientId ?? process.env.SITECOREAI_CLIENT_ID ?? constants_1.DEFAULT_PUBLIC_CLIENT_ID;
     const clientCredentialsClientId = options.clientId ?? baseEnv.clientId ?? existing.clientId ?? process.env.SITECOREAI_CLIENT_ID;
@@ -41,7 +43,7 @@ const resolveDeployAuth = async (input) => {
         : Boolean(options.clientId);
     if (needsDeployToken && wantsClientCredentials && !loginClientId) {
         if (!isInteractive) {
-            throw (0, errors_1.createCliError)("Client ID is required for client credentials.", "INPUT_INVALID", {
+            throw (0, errors_1.createScaiError)("Client ID is required for client credentials.", "INPUT_INVALID", {
                 hint: "Provide --client-id with --use-client-credentials, or set SITECOREAI_CLIENT_ID and SITECOREAI_CLIENT_SECRET.",
             });
         }
@@ -49,7 +51,7 @@ const resolveDeployAuth = async (input) => {
     }
     if (needsDeployToken && wantsClientCredentials && !loginClientSecret) {
         if (!isInteractive) {
-            throw (0, errors_1.createCliError)("Client ID and client secret are required for client credentials.", "INPUT_INVALID", {
+            throw (0, errors_1.createScaiError)("Client ID and client secret are required for client credentials.", "INPUT_INVALID", {
                 hint: "Provide --client-id/--client-secret with --use-client-credentials, or set SITECOREAI_CLIENT_ID and SITECOREAI_CLIENT_SECRET.",
             });
         }
@@ -57,32 +59,32 @@ const resolveDeployAuth = async (input) => {
         loginClientSecret = entered;
     }
     const deployAudience = "https://api.sitecorecloud.io";
+    let deployTokenMeta;
     if (needsDeployToken && !deployToken && wantsClientCredentials) {
         if (!loginAuthority || !loginClientId || !loginClientSecret) {
-            throw (0, errors_1.createCliError)("Client ID and client secret are required for client credentials.", "AUTH_REQUIRED", {
+            throw (0, errors_1.createScaiError)("Client ID and client secret are required for client credentials.", "AUTH_REQUIRED", {
                 hint: "Provide --client-id/--client-secret with --use-client-credentials, or set SITECOREAI_CLIENT_ID and SITECOREAI_CLIENT_SECRET.",
             });
         }
-        const token = await (0, sitecore_api_1.requestClientCredentialsToken)({
+        const token = await (0, auth_1.requestClientCredentialsToken)({
             authority: loginAuthority,
             clientId: loginClientId,
             clientSecret: loginClientSecret,
             audience: deployAudience,
         }, undefined);
         deployToken = token.accessToken;
-        updated.deployTokenExpiresIn = token.expiresIn ?? null;
-        updated.deployTokenLastUpdated = new Date().toISOString();
+        deployTokenMeta = { expiresIn: token.expiresIn ?? null, lastUpdated: new Date().toISOString() };
     }
     else if (needsDeployToken && !deployToken) {
         if (!loginAuthority || !loginClientId) {
-            throw (0, errors_1.createCliError)("Client ID is required for interactive login.", "AUTH_REQUIRED", {
+            throw (0, errors_1.createScaiError)("Client ID is required for interactive login.", "AUTH_REQUIRED", {
                 hint: "Provide --client-id or set SITECOREAI_CLIENT_ID.",
             });
         }
         if (!isInteractive) {
             (0, prompt_1.assertInteractive)("Interactive login requires a TTY. Use --use-client-credentials instead.", "Use --use-client-credentials for non-interactive authentication.");
         }
-        const device = await (0, sitecore_api_1.requestDeviceAuthorization)({
+        const device = await (0, auth_1.requestDeviceAuthorization)({
             authority: loginAuthority,
             clientId: loginClientId,
             clientSecret: loginClientSecret,
@@ -101,15 +103,14 @@ const resolveDeployAuth = async (input) => {
         if (!device.verificationUriComplete && device.userCode) {
             logger.info(`Enter code: ${device.userCode}`);
         }
-        const token = await (0, sitecore_api_1.pollDeviceToken)({
+        const token = await (0, auth_1.pollDeviceToken)({
             authority: loginAuthority,
             clientId: loginClientId,
             clientSecret: loginClientSecret,
             audience: deployAudience,
         }, device);
         deployToken = token.accessToken;
-        updated.deployTokenExpiresIn = token.expiresIn ?? null;
-        updated.deployTokenLastUpdated = new Date().toISOString();
+        deployTokenMeta = { expiresIn: token.expiresIn ?? null, lastUpdated: new Date().toISOString() };
     }
     return {
         deployToken,
@@ -117,6 +118,7 @@ const resolveDeployAuth = async (input) => {
         loginClientId,
         wantsClientCredentials,
         shouldPersistClientId,
+        deployTokenMeta,
     };
 };
 exports.resolveDeployAuth = resolveDeployAuth;

package/dist/serialization/tasks/env/init/deploy-lookup.d.ts

@@ -1,4 +1,4 @@
-import type { EnvironmentConfiguration } from "../../../../config";
+import type { EnvironmentConfiguration } from "../../../../config/types";
 import type { ConnectOptions } from "../../types";
 import type { Logger } from "../../../../shared/logger";
 type ResolveDeployLookupInput = {
@@ -19,4 +19,3 @@ type ResolveDeployLookupResult = {
 };
 export declare const resolveDeployLookup: (input: ResolveDeployLookupInput) => Promise<ResolveDeployLookupResult>;
 export {};
-//# sourceMappingURL=deploy-lookup.d.ts.map

package/dist/serialization/tasks/env/init/deploy-lookup.js

@@ -44,8 +44,8 @@ const hasProjectRepository = (value) => {
 const resolveDeployLookup = async (input) => {
     const { options, runWizard, deployToken, updated, existing, baseEnv, host, projectSelection, environmentSelection, logger, } = input;
     if (!deployToken) {
-        throw (0, errors_1.createCliError)("Deploy API access token is required. Provide --deploy-token or deploy credentials.", "AUTH_REQUIRED", {
-            hint: "Provide --deploy-token, or run 'scai login' to store credentials.",
+        throw (0, errors_1.createScaiError)("Deploy API access token is required. Provide --deploy-token or deploy credentials.", "AUTH_REQUIRED", {
+            hint: "Provide --deploy-token, or run 'scai setup login' to store credentials.",
         });
     }
     const deployOptions = { accessToken: deployToken };
@@ -86,7 +86,7 @@ const resolveDeployLookup = async (input) => {
                     projectDetails = await (0, api_1.fetchProject)(deployOptions, resolvedProjectId);
                 }
                 catch (error) {
-                    const cliError = (0, errors_1.toCliError)(error);
+                    const cliError = (0, errors_1.toScaiError)(error);
                     logger.warn(`Unable to verify repository linkage. ${cliError.message}`);
                 }
             }
@@ -150,7 +150,7 @@ const resolveDeployLookup = async (input) => {
                     break;
                 }
                 catch (error) {
-                    const cliError = (0, errors_1.toCliError)(error);
+                    const cliError = (0, errors_1.toScaiError)(error);
                     logger.warn(`Environment creation failed. ${cliError.message}`);
                     if (projects.length > 1) {
                         const chooseAnother = await (0, prompt_1.promptConfirm)("Select a different project?", true);
@@ -178,6 +178,19 @@ const resolveDeployLookup = async (input) => {
             if (!environmentSelection && runWizard && selectionPool.length > 1) {
                 resolvedEnvironment = await (0, cli_tasks_1.selectFromList)(logger, environmentLabel, selectionPool);
             }
+            else if (!environmentSelection && runWizard && selectionPool.length === 1) {
+                // Only one candidate. Auto-select it, but announce it by name —
+                // silently locking onto an environment the user never saw reads
+                // as "the project step just exited without asking anything".
+                resolvedEnvironment = selectionPool[0];
+                const autoName = resolvedEnvironment.name ??
+                    resolvedEnvironment.id ??
+                    resolvedEnvironment.environmentId ??
+                    "(unknown)";
+                const autoId = resolvedEnvironment.id ?? resolvedEnvironment.environmentId ?? "-";
+                const poolKind = cmEnvironments.length > 0 ? "CM environment" : "environment";
+                logger.info(`Using the only ${poolKind} in '${resolvedProjectLabel}': ${autoName} (${autoId})`, "cyan");
+            }
             else {
                 resolvedEnvironment = (0, cli_tasks_1.selectMatch)(selectionPool, "Environment", environmentSelection);
             }
@@ -209,7 +222,7 @@ const resolveDeployLookup = async (input) => {
         if (!runWizard) {
             throw error;
         }
-        const cliError = (0, errors_1.toCliError)(error);
+        const cliError = (0, errors_1.toScaiError)(error);
         const isEnvScoped = /environment[- ]scoped/i.test(cliError.message);
         const warning = isEnvScoped
             ? "Deploy lookup failed. Environment-scoped credentials require an environment ID."

package/dist/serialization/tasks/env/init.d.ts

@@ -1,3 +1,2 @@
 import type { ConnectOptions } from "../types";
 export declare const runInit: (options: ConnectOptions) => Promise<void>;
-//# sourceMappingURL=init.d.ts.map

package/dist/serialization/tasks/env/init.js

@@ -11,7 +11,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runInit = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
-const config_1 = require("../../../config");
+const root_config_1 = require("../../../config/root-config");
 const validate_1 = require("../../../shared/validate");
 const config_template_1 = require("../../../shared/config-template");
 const keychain_1 = require("../../../shared/keychain");
@@ -64,10 +64,10 @@ const runInit = async (options) => {
     }
     let rootConfigFile;
     try {
-        rootConfigFile = (0, config_1.readRootConfigurationFile)(configPath);
+        rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
     }
     catch (error) {
-        const cliError = (0, errors_1.toCliError)(error);
+        const cliError = (0, errors_1.toScaiError)(error);
         if (cliError.code === "CONFIG_INVALID" && runWizard && isInteractive) {
             const recreate = await (0, prompt_1.promptConfirm)(`Configuration file at ${targetPath} is invalid. Recreate it?`, false);
             if (!recreate) {
@@ -82,14 +82,14 @@ const runInit = async (options) => {
             }
             (0, config_template_1.writeConfigTemplate)(targetPath);
             logger.info(`Recreated ${targetPath}`, "green");
-            rootConfigFile = (0, config_1.readRootConfigurationFile)(configPath);
+            rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
         }
         else {
             throw error;
         }
     }
     const envProfiles = rootConfigFile.config.envProfiles ?? {};
-    let root = (0, config_1.readRootConfiguration)(configPath, envName);
+    let root = (0, root_config_1.readRootConfiguration)(configPath, envName);
     let existing = envProfiles[envName] ?? {};
     let envExists = Boolean(envProfiles[envName]);
     let baseEnv = root.environments[envName] ?? {};
@@ -106,7 +106,7 @@ const runInit = async (options) => {
                     return;
                 }
                 envName = newName;
-                root = (0, config_1.readRootConfiguration)(configPath, envName);
+                root = (0, root_config_1.readRootConfiguration)(configPath, envName);
                 existing = envProfiles[envName] ?? {};
                 envExists = Boolean(envProfiles[envName]);
                 baseEnv = root.environments[envName] ?? {};
@@ -122,7 +122,7 @@ const runInit = async (options) => {
                 return;
             }
             envName = newName;
-            root = (0, config_1.readRootConfiguration)(configPath, envName);
+            root = (0, root_config_1.readRootConfiguration)(configPath, envName);
             existing = envProfiles[envName] ?? {};
             envExists = Boolean(envProfiles[envName]);
             baseEnv = root.environments[envName] ?? {};
@@ -133,17 +133,17 @@ const runInit = async (options) => {
     }
     if (options.setDefault && !hasOtherChanges) {
         if (!envProfiles[envName]) {
-            throw (0, errors_1.createCliError)(`Environment '${envName}' does not exist. Configure it before setting default.`, "ENV_NOT_FOUND");
+            throw (0, errors_1.createScaiError)(`Environment '${envName}' does not exist. Configure it before setting default.`, "ENV_NOT_FOUND");
         }
         rootConfigFile.config.defaultEnvProfile = envName;
-        (0, config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+        (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
         logger.info(`Default environment set to '${envName}'.`, "green");
         return;
     }
     if (options.ref) {
         const refEnv = envProfiles[options.ref];
         if (!refEnv) {
-            throw (0, errors_1.createCliError)(`Referenced environment '${options.ref}' was not found.`, "ENV_NOT_FOUND");
+            throw (0, errors_1.createScaiError)(`Referenced environment '${options.ref}' was not found.`, "ENV_NOT_FOUND");
         }
         if (refEnv.ref) {
             throw (0, shared_1.inputError)(`Referenced environment '${options.ref}' cannot itself reference another environment.`);
@@ -173,7 +173,6 @@ const runInit = async (options) => {
         runWizard,
         isInteractive,
         needsDeployToken,
-        updated,
         logger,
     });
     let deployToken = auth.deployToken;
@@ -201,6 +200,13 @@ const runInit = async (options) => {
         if (!stored) {
             logger.warn("Unable to store the Deploy token in the OS keychain. Use SITECOREAI_DEPLOY_TOKEN if needed.");
         }
+        // Deploy-token freshness metadata lives on the env profile in the
+        // config file (see docs/credentials.md). Only present when this run
+        // actually performed a login.
+        if (auth.deployTokenMeta) {
+            updated.deployTokenExpiresIn = auth.deployTokenMeta.expiresIn;
+            updated.deployTokenLastUpdated = auth.deployTokenMeta.lastUpdated;
+        }
     }
     if (!host && runWizard) {
         host = await (0, prompt_1.promptText)("CM host (base URL)", host);
@@ -247,7 +253,7 @@ const runInit = async (options) => {
             rootConfigFile.config.defaultEnvProfile = envName;
         }
     }
-    (0, config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+    (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
     logger.info(`Initialized environment '${envName}' in sitecoreai.cli.json`, "green");
 };
 exports.runInit = runInit;

package/dist/serialization/tasks/env/logout.d.ts

@@ -1,3 +1,2 @@
 import type { LogoutOptions } from "../types";
 export declare const runLogout: (options: LogoutOptions) => Promise<void>;
-//# sourceMappingURL=logout.d.ts.map

package/dist/serialization/tasks/env/logout.js

@@ -1,19 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runLogout = void 0;
-const config_1 = require("../../../config");
+const root_config_1 = require("../../../config/root-config");
 const keychain_1 = require("../../../shared/keychain");
 const errors_1 = require("../../../shared/errors");
 const shared_1 = require("../shared");
 const runLogout = async (options) => {
     const logger = (0, shared_1.toLogger)(options);
     const configPath = options.config ?? process.cwd();
-    const rootConfigFile = (0, config_1.readRootConfigurationFile)(configPath);
+    const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
     const envProfiles = rootConfigFile.config.envProfiles ?? {};
     const names = Object.keys(envProfiles);
     if (options.all) {
         for (const name of names) {
             const env = envProfiles[name];
+            // Token-cache metadata is cleared: `deployToken` itself plus the
+            // `deployToken*` freshness fields. `clientId` and the
+            // `automationClient` block are left in place — they are non-secret
+            // identifiers, not tokens. A stale `clientSecret` from a legacy
+            // config is scrubbed via the cast below.
             envProfiles[name] = {
                 ...env,
                 accessToken: undefined,
@@ -24,22 +29,23 @@ const runLogout = async (options) => {
                 deployToken: undefined,
                 deployTokenExpiresIn: undefined,
                 deployTokenLastUpdated: undefined,
+                ...{ clientSecret: undefined },
             };
             await (0, keychain_1.clearCmTokens)(name);
             await (0, keychain_1.clearDeployToken)(name);
         }
         rootConfigFile.config.envProfiles = envProfiles;
-        (0, config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+        (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
         logger.info("Cleared stored tokens for all environments.", "green");
         return;
     }
     const envName = options.environmentName;
     if (!envName) {
-        throw (0, errors_1.createCliError)("Environment name is required. Use --environment-name or --all.", "INPUT_INVALID");
+        throw (0, errors_1.createScaiError)("Environment name is required. Use --environment-name or --all.", "INPUT_INVALID");
     }
     const env = envProfiles[envName];
     if (!env) {
-        throw (0, errors_1.createCliError)(`Environment '${envName}' does not exist.`, "ENV_NOT_FOUND");
+        throw (0, errors_1.createScaiError)(`Environment '${envName}' does not exist.`, "ENV_NOT_FOUND");
     }
     envProfiles[envName] = {
         ...env,
@@ -51,11 +57,12 @@ const runLogout = async (options) => {
         deployToken: undefined,
         deployTokenExpiresIn: undefined,
         deployTokenLastUpdated: undefined,
+        ...{ clientSecret: undefined },
     };
     await (0, keychain_1.clearCmTokens)(envName);
     await (0, keychain_1.clearDeployToken)(envName);
     rootConfigFile.config.envProfiles = envProfiles;
-    (0, config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+    (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
     logger.info(`Cleared stored tokens for environment '${envName}'.`, "green");
 };
 exports.runLogout = runLogout;

package/dist/serialization/tasks/env/onboard.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `runEnvironmentOnboard` — stand up a new environment profile.
+ *
+ * The agent-drivable half of environment setup: write the env profile
+ * into `sitecoreai.cli.json`, then run the access preflight so the
+ * caller sees exactly what is left — policy enrollment (agent-clearable)
+ * and credentials (human-terminal-only, see `HUMAN_ONLY_OPERATIONS`).
+ *
+ * It deliberately does NOT mint a client or log in — those are
+ * human-only — and does NOT discover the tenant: the caller supplies
+ * the organization / project / environment ids and host (resolve them
+ * first with the deploy tools or `scai_overview`).
+ */
+import type { EnvironmentConfiguration } from "../../../config/types";
+import { type AccessReport } from "../../../policy/access-check";
+export interface EnvironmentOnboardOptions {
+    /** Directory holding `sitecoreai.cli.json`, or a path to it. */
+    config?: string;
+    /** Local profile name for the new environment. */
+    environmentName: string;
+    organizationId: string;
+    projectId: string;
+    environmentId: string;
+    /** CM host, e.g. `xmc-org-env.sitecorecloud.io`. */
+    host: string;
+    environmentType?: "cm" | "eh";
+    authority?: string;
+}
+export interface EnvironmentOnboardResult {
+    environmentName: string;
+    /** The profile written to the config. */
+    profile: EnvironmentConfiguration;
+    /** Access preflight for the freshly-written environment — the steps that remain. */
+    access: AccessReport;
+}
+/**
+ * Add a new environment profile to the config, then preflight it.
+ * Throws `INPUT_INVALID` rather than clobbering an existing profile.
+ */
+export declare const runEnvironmentOnboard: (options: EnvironmentOnboardOptions) => Promise<EnvironmentOnboardResult>;

package/dist/serialization/tasks/env/onboard.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * `runEnvironmentOnboard` — stand up a new environment profile.
+ *
+ * The agent-drivable half of environment setup: write the env profile
+ * into `sitecoreai.cli.json`, then run the access preflight so the
+ * caller sees exactly what is left — policy enrollment (agent-clearable)
+ * and credentials (human-terminal-only, see `HUMAN_ONLY_OPERATIONS`).
+ *
+ * It deliberately does NOT mint a client or log in — those are
+ * human-only — and does NOT discover the tenant: the caller supplies
+ * the organization / project / environment ids and host (resolve them
+ * first with the deploy tools or `scai_overview`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runEnvironmentOnboard = void 0;
+const root_config_1 = require("../../../config/root-config");
+const errors_1 = require("../../../shared/errors");
+const validate_1 = require("../../../shared/validate");
+const access_check_1 = require("../../../policy/access-check");
+const DEFAULT_AUTHORITY = "https://auth.sitecorecloud.io";
+/**
+ * Add a new environment profile to the config, then preflight it.
+ * Throws `INPUT_INVALID` rather than clobbering an existing profile.
+ */
+const runEnvironmentOnboard = async (options) => {
+    const configPath = options.config ?? process.cwd();
+    const envName = options.environmentName.trim();
+    if (!envName) {
+        throw (0, errors_1.createScaiError)("An environment name is required.", "INPUT_INVALID");
+    }
+    (0, validate_1.assertValidHost)(options.host, "CM host");
+    const rootFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+    const envProfiles = rootFile.config.envProfiles ?? {};
+    if (envProfiles[envName]) {
+        throw (0, errors_1.createScaiError)(`Environment '${envName}' is already configured.`, "INPUT_INVALID", {
+            hint: "Pick a different name, or edit the existing profile directly.",
+        });
+    }
+    const profile = {
+        organizationId: options.organizationId,
+        projectId: options.projectId,
+        environmentId: options.environmentId,
+        environmentType: options.environmentType ?? "cm",
+        host: options.host,
+        authority: options.authority ?? DEFAULT_AUTHORITY,
+    };
+    rootFile.config.envProfiles = { ...envProfiles, [envName]: profile };
+    (0, root_config_1.writeRootConfigurationFile)(configPath, rootFile.config);
+    const access = await (0, access_check_1.checkAccess)({ configPath, environmentName: envName });
+    return { environmentName: envName, profile, access };
+};
+exports.runEnvironmentOnboard = runEnvironmentOnboard;

package/dist/serialization/tasks/env/setup-clients.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `scai setup clients [name]` — list, or with `--delete <id>` remove,
+ * the automation clients (credentials) in an environment's
+ * organization.
+ *
+ * The Deploy clients API is organization-scoped, so this covers every
+ * client in the org the named environment belongs to — both the
+ * environment-scoped clients (`cm`, `edge`, `ehbuild`) and the
+ * organization-scoped `deploy` clients. scai-minted clients (the
+ * `scai-*` naming convention) are flagged so an operator can tell
+ * what scai provisioned apart from anything created by hand.
+ *
+ * Pair with `scai setup env` (mint) and `scai setup status` (the
+ * yes/no credential matrix).
+ */
+import type { CommonOptions } from "../../../shared/cli-options";
+export type SetupClientsOptions = CommonOptions & {
+    environmentName?: string;
+    /** When set, delete the client with this id instead of listing. */
+    delete?: string;
+    /** Skip the delete confirmation prompt. */
+    force?: boolean;
+};
+export declare const runSetupClients: (options: SetupClientsOptions) => Promise<void>;

package/dist/serialization/tasks/env/setup-clients.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * `scai setup clients [name]` — list, or with `--delete <id>` remove,
+ * the automation clients (credentials) in an environment's
+ * organization.
+ *
+ * The Deploy clients API is organization-scoped, so this covers every
+ * client in the org the named environment belongs to — both the
+ * environment-scoped clients (`cm`, `edge`, `ehbuild`) and the
+ * organization-scoped `deploy` clients. scai-minted clients (the
+ * `scai-*` naming convention) are flagged so an operator can tell
+ * what scai provisioned apart from anything created by hand.
+ *
+ * Pair with `scai setup env` (mint) and `scai setup status` (the
+ * yes/no credential matrix).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSetupClients = void 0;
+const root_config_1 = require("../../../config/root-config");
+const keychain_1 = require("../../../shared/keychain");
+const api_1 = require("../../../deploy/api");
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const errors_1 = require("../../../shared/errors");
+const renderRow = (logger, name, id, clientId, scope) => {
+    const tag = (0, api_1.isScaiManagedClient)(name) ? "[scai]" : "      ";
+    logger.info(`  ${tag} ${name ?? "(unnamed)"}  ${id ?? "?"}${scope}`);
+    if (clientId) {
+        logger.info(`         clientId: ${clientId}`);
+    }
+};
+const runSetupClients = async (options) => {
+    const logger = (0, cli_tasks_1.toLogger)(options);
+    const configPath = options.config ?? process.cwd();
+    const { envName, env } = (0, root_config_1.resolveActiveEnvironment)(configPath, options.environmentName);
+    const organizationId = env.organizationId;
+    if (!organizationId) {
+        throw (0, cli_tasks_1.inputError)(`Environment '${envName}' has no organizationId.`, "Set organizationId on the env profile, or run `scai setup init`.");
+    }
+    const deployToken = (await (0, keychain_1.getDeployToken)(envName)) ?? env.deployToken ?? process.env.SITECOREAI_DEPLOY_TOKEN;
+    if (!deployToken) {
+        throw (0, errors_1.createScaiError)(`No deploy token is available for environment '${envName}'.`, "AUTH_REQUIRED", { hint: `Run \`scai setup login -n ${envName}\` first.` });
+    }
+    const deployClient = { accessToken: deployToken };
+    const environmentClients = (await (0, api_1.listEnvironmentClients)(deployClient, organizationId)).items ?? [];
+    const organizationClients = (await (0, api_1.listOrganizationClients)(deployClient, organizationId)).items ?? [];
+    // --- delete mode -------------------------------------------------------
+    if (options.delete) {
+        const targetId = options.delete;
+        const match = [...environmentClients, ...organizationClients].find((c) => c.id === targetId);
+        if (!match) {
+            throw (0, cli_tasks_1.inputError)(`No client with id '${targetId}' in organization ${organizationId}.`, "Run `scai setup clients` to see the available client ids.");
+        }
+        const scaiManaged = (0, api_1.isScaiManagedClient)(match.name);
+        const caveat = scaiManaged
+            ? ""
+            : " This client was NOT created by scai — deleting it may break another integration.";
+        const proceed = await (0, cli_tasks_1.confirmDestructive)(`Delete client '${match.name ?? "(unnamed)"}' (${targetId})?${caveat}`, options.force);
+        if (!proceed) {
+            logger.info("Aborted.");
+            return;
+        }
+        await (0, api_1.deleteClient)(deployClient, targetId, organizationId);
+        // If we just deleted a scai-minted automation client, drop the now-
+        // dead credential — the keychain secret AND the config-resident
+        // non-secret metadata — so `setup status` stays honest.
+        if (match.name === (0, api_1.buildScaiClientName)("cm", envName)) {
+            await (0, keychain_1.clearCmClientSecret)(envName);
+            const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+            const envProfiles = rootConfigFile.config.envProfiles ?? {};
+            if (envProfiles[envName]?.automationClient) {
+                const { automationClient: _removed, ...rest } = envProfiles[envName];
+                envProfiles[envName] = rest;
+                rootConfigFile.config.envProfiles = envProfiles;
+                (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+            }
+        }
+        else if (match.name === (0, api_1.buildScaiClientName)("deploy")) {
+            await (0, keychain_1.clearOrgClientSecret)(organizationId);
+            const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+            const orgClients = rootConfigFile.config.orgClients ?? {};
+            if (orgClients[organizationId]) {
+                delete orgClients[organizationId];
+                rootConfigFile.config.orgClients = orgClients;
+                (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+            }
+        }
+        if (logger.isJson()) {
+            logger.json({ deleted: targetId, name: match.name ?? null, organizationId });
+            return;
+        }
+        logger.info(`Deleted client '${match.name ?? targetId}' (${targetId}).`, "green");
+        return;
+    }
+    // --- list mode ---------------------------------------------------------
+    if (logger.isJson()) {
+        logger.json({ environment: envName, organizationId, environmentClients, organizationClients });
+        return;
+    }
+    logger.info(`Automation clients in organization ${organizationId} (via env '${envName}')`, "cyan");
+    logger.info(`\nEnvironment-scoped (${environmentClients.length}):`);
+    if (environmentClients.length === 0) {
+        logger.info("  (none)");
+    }
+    for (const client of environmentClients) {
+        const scope = client.environmentName
+            ? `  → ${client.projectName ?? "?"} / ${client.environmentName}`
+            : "";
+        renderRow(logger, client.name, client.id, client.clientId, scope);
+    }
+    logger.info(`\nOrganization-scoped (${organizationClients.length}):`);
+    if (organizationClients.length === 0) {
+        logger.info("  (none)");
+    }
+    for (const client of organizationClients) {
+        renderRow(logger, client.name, client.id, client.clientId, "");
+    }
+    logger.info("\n[scai] = minted by scai (scai setup env). Others were created elsewhere.");
+};
+exports.runSetupClients = runSetupClients;