@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/serialization/tasks/env/setup-env.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `scai setup env <name>` — provision the environment-scoped CM
+ * automation client for one environment.
+ *
+ * The flow is list-or-mint, keyed on the stable `scai-cm-<env>` client
+ * name so re-runs are idempotent:
+ *
+ *   1. Resolve the env profile — needs organizationId + projectId +
+ *      environmentId.
+ *   2. Use the env's deploy token (it carries `xmclouddeploy.clients:manage`,
+ *      requested at `scai setup login`) as the clients-API credential.
+ *   3. List the org's environment clients; look for `scai-cm-<env>`.
+ *   4. Reconcile:
+ *        - keychain has the secret AND the server lists it  → done.
+ *        - server lists it but the keychain has no secret    → orphan
+ *          (lost secret — unrecoverable); delete it, then mint fresh.
+ *        - `--rotate`                                        → delete +
+ *          re-mint regardless.
+ *        - neither                                           → mint.
+ *   5. Persist the minted client: its non-secret metadata (clientId,
+ *      name, mintedAt) into the env profile's `automationClient` block in
+ *      the config file, and only the secret into the OS keychain.
+ */
+import type { SitecoreApiClientOptions } from "../../../serialization/api/types";
+import type { CommonOptions } from "../../../shared/cli-options";
+import type { Logger } from "../../../shared/logger";
+/** Timing knobs for {@link waitForClientActivation} — overridable for tests. */
+export interface ClientActivationOptions {
+    /** Give up after this long (default 120_000 ms). */
+    timeoutMs?: number;
+    /** First backoff delay (default 2_000 ms). */
+    initialDelayMs?: number;
+    /** Backoff ceiling (default 15_000 ms). */
+    maxDelayMs?: number;
+}
+/**
+ * Poll a client-credentials grant until a freshly-minted automation
+ * client activates.
+ *
+ * A just-created Sitecore automation client is not immediately usable —
+ * the identity provider takes up to ~2 min to propagate it, and the
+ * grant fails until it has. Returns `true` once a token is obtained,
+ * `false` if the window elapses first (the client is minted regardless
+ * and usually becomes usable shortly after).
+ */
+export declare const waitForClientActivation: (credential: SitecoreApiClientOptions, logger: Logger, options?: ClientActivationOptions) => Promise<boolean>;
+export type SetupEnvOptions = CommonOptions & {
+    environmentName?: string;
+    /** Preview the action without minting or deleting anything. */
+    whatIf?: boolean;
+    /** Delete and re-mint the client even if one is already provisioned. */
+    rotate?: boolean;
+};
+export declare const runSetupEnv: (options: SetupEnvOptions) => Promise<void>;

package/dist/serialization/tasks/env/setup-env.js

@@ -0,0 +1,216 @@
+"use strict";
+/**
+ * `scai setup env <name>` — provision the environment-scoped CM
+ * automation client for one environment.
+ *
+ * The flow is list-or-mint, keyed on the stable `scai-cm-<env>` client
+ * name so re-runs are idempotent:
+ *
+ *   1. Resolve the env profile — needs organizationId + projectId +
+ *      environmentId.
+ *   2. Use the env's deploy token (it carries `xmclouddeploy.clients:manage`,
+ *      requested at `scai setup login`) as the clients-API credential.
+ *   3. List the org's environment clients; look for `scai-cm-<env>`.
+ *   4. Reconcile:
+ *        - keychain has the secret AND the server lists it  → done.
+ *        - server lists it but the keychain has no secret    → orphan
+ *          (lost secret — unrecoverable); delete it, then mint fresh.
+ *        - `--rotate`                                        → delete +
+ *          re-mint regardless.
+ *        - neither                                           → mint.
+ *   5. Persist the minted client: its non-secret metadata (clientId,
+ *      name, mintedAt) into the env profile's `automationClient` block in
+ *      the config file, and only the secret into the OS keychain.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSetupEnv = exports.waitForClientActivation = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+const root_config_1 = require("../../../config/root-config");
+const keychain_1 = require("../../../shared/keychain");
+const api_1 = require("../../../deploy/api");
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const errors_1 = require("../../../shared/errors");
+const policy_1 = require("../../../policy");
+const auth_1 = require("../../../serialization/api/auth");
+const package_json_1 = __importDefault(require("../../../../package.json"));
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Poll a client-credentials grant until a freshly-minted automation
+ * client activates.
+ *
+ * A just-created Sitecore automation client is not immediately usable —
+ * the identity provider takes up to ~2 min to propagate it, and the
+ * grant fails until it has. Returns `true` once a token is obtained,
+ * `false` if the window elapses first (the client is minted regardless
+ * and usually becomes usable shortly after).
+ */
+const waitForClientActivation = async (credential, logger, options = {}) => {
+    const timeoutMs = options.timeoutMs ?? 120000;
+    const maxDelayMs = options.maxDelayMs ?? 15000;
+    let delayMs = options.initialDelayMs ?? 2000;
+    const deadline = Date.now() + timeoutMs;
+    let attempt = 0;
+    for (;;) {
+        attempt += 1;
+        try {
+            await (0, auth_1.requestClientCredentialsToken)(credential);
+            if (attempt > 1) {
+                logger.info("  Client is active.", "green");
+            }
+            return true;
+        }
+        catch (error) {
+            if (Date.now() + delayMs >= deadline) {
+                logger.warn(`The minted client did not activate within ${Math.round(timeoutMs / 1000)}s. ` +
+                    "It usually becomes usable within a minute or two — retry your command then.");
+                return false;
+            }
+            if (attempt === 1) {
+                logger.info("  Waiting for the new client to activate…");
+            }
+            logger.verbose(`Client not active yet (attempt ${attempt}): ${(0, errors_1.toScaiError)(error).message}. ` +
+                `Retrying in ${Math.round(delayMs / 1000)}s.`);
+            await sleep(delayMs);
+            delayMs = Math.min(Math.round(delayMs * 1.5), maxDelayMs);
+        }
+    }
+};
+exports.waitForClientActivation = waitForClientActivation;
+const runSetupEnv = async (options) => {
+    const logger = (0, cli_tasks_1.toLogger)(options);
+    const configPath = options.config ?? process.cwd();
+    const { envName, env, root } = (0, root_config_1.resolveActiveEnvironment)(configPath, options.environmentName);
+    // Phase 2 mint gate — minting an automation client requires an
+    // interactive human operator on a mint-eligible environment. A no-op
+    // in unmanaged mode. See docs/policy-and-guardrails.md.
+    (0, policy_1.authorizeOperation)({
+        envName,
+        configRootDir: root.physicalPath ? node_path_1.default.dirname(root.physicalPath) : undefined,
+        tier: "mint",
+    });
+    const { organizationId, projectId, environmentId } = env;
+    if (!organizationId || !projectId || !environmentId) {
+        throw (0, cli_tasks_1.inputError)(`Environment '${envName}' is missing organizationId, projectId, or environmentId.`, "All three are required to mint an environment-scoped CM client. Run `scai setup init`.");
+    }
+    const deployToken = (await (0, keychain_1.getDeployToken)(envName)) ?? env.deployToken ?? process.env.SITECOREAI_DEPLOY_TOKEN;
+    if (!deployToken) {
+        throw (0, errors_1.createScaiError)(`No deploy token is available for environment '${envName}'.`, "AUTH_REQUIRED", {
+            hint: `Run \`scai setup login -n ${envName}\` first — minting a CM client needs a token with the xmclouddeploy.clients:manage scope.`,
+        });
+    }
+    const deployClient = { accessToken: deployToken };
+    const clientName = (0, api_1.buildScaiClientName)("cm", envName);
+    // Read-side reconciliation — safe to run even under --what-if. A
+    // provisioned client means both halves are present: the non-secret
+    // metadata in the config (`automationClient`) AND the secret in the
+    // keychain. Either alone is incomplete.
+    const storedSecret = await (0, keychain_1.getCmClientSecret)(envName);
+    const stored = Boolean(env.automationClient?.clientId) && Boolean(storedSecret);
+    let existingId;
+    try {
+        const listed = await (0, api_1.listEnvironmentClients)(deployClient, organizationId);
+        existingId = (listed.items ?? []).find((client) => client.name === clientName)?.id;
+    }
+    catch (error) {
+        const scaiError = (0, errors_1.toScaiError)(error);
+        throw (0, errors_1.createScaiError)(`Could not list environment clients for organization '${organizationId}'.`, "DEPLOY_FAILED", {
+            hint: `The deploy token may lack the xmclouddeploy.clients:manage scope. Re-run \`scai setup login -n ${envName}\`. Underlying error: ${scaiError.message}`,
+        });
+    }
+    const alreadyProvisioned = Boolean(stored) && Boolean(existingId);
+    if (alreadyProvisioned && !options.rotate) {
+        if (logger.isJson()) {
+            logger.json({ environment: envName, client: clientName, action: "none", provisioned: true });
+            return;
+        }
+        logger.info(`Environment '${envName}' already has its CM client (${clientName}).`, "green");
+        logger.info("  Nothing to do. Pass --rotate to delete and re-mint.");
+        return;
+    }
+    // An existing server-side client with no keychain secret is an
+    // orphan — the secret is unrecoverable, so it must be replaced.
+    const replaceExisting = Boolean(existingId) && (!stored || Boolean(options.rotate));
+    if (options.whatIf) {
+        const verb = replaceExisting ? "delete the existing client and re-mint" : "mint";
+        if (logger.isJson()) {
+            logger.json({
+                environment: envName,
+                client: clientName,
+                action: replaceExisting ? "replace" : "mint",
+                whatIf: true,
+            });
+            return;
+        }
+        logger.info(`[what-if] Would ${verb} CM client '${clientName}' for '${envName}'.`);
+        return;
+    }
+    if (replaceExisting && existingId) {
+        const reason = options.rotate ? "rotating" : "orphaned — secret not in keychain";
+        logger.info(`Removing the existing '${clientName}' client (${reason})…`);
+        await (0, api_1.deleteClient)(deployClient, existingId, organizationId);
+    }
+    const minted = await (0, api_1.mintCmClient)(deployClient, {
+        name: clientName,
+        description: (0, api_1.buildScaiClientDescription)("cm", {
+            surface: "CLI",
+            version: package_json_1.default.version,
+            envName,
+        }),
+        projectId,
+        environmentId,
+    }, organizationId);
+    if (!minted.clientId || !minted.clientSecret) {
+        throw (0, errors_1.createScaiError)("The clients API did not return a clientId/clientSecret.", "DEPLOY_FAILED", { hint: "Re-run the command; if it persists, mint the client in the Cloud Portal." });
+    }
+    // The keychain holds only the secret; the non-secret metadata
+    // (clientId, name, mintedAt) goes into the env profile's
+    // `automationClient` block in the config file — a readable inventory
+    // of what's configured. See docs/credentials.md.
+    const persisted = await (0, keychain_1.setCmClientSecret)(envName, minted.clientSecret);
+    const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+    const envProfiles = rootConfigFile.config.envProfiles ?? {};
+    envProfiles[envName] = {
+        ...(envProfiles[envName] ?? {}),
+        automationClient: {
+            clientId: minted.clientId,
+            name: clientName,
+            mintedAt: new Date().toISOString(),
+        },
+    };
+    rootConfigFile.config.envProfiles = envProfiles;
+    (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+    if (!logger.isJson()) {
+        logger.info(`Minted CM client '${clientName}' for '${envName}'.`, "green");
+        logger.info(`  clientId: ${minted.clientId}`);
+        if (!persisted) {
+            logger.warn("Keychain unavailable — the client secret was NOT persisted. The minted client is unusable; re-run when the keychain is available.");
+        }
+    }
+    // A freshly-minted client is not usable until the identity provider
+    // activates it (~1-2 min), during which a client-credentials grant
+    // still fails. Poll so the command does not report success on a client
+    // an immediate follow-up call would be rejected by — the race an agent
+    // hits when it uses the credential right after the mint.
+    const active = env.authority
+        ? await (0, exports.waitForClientActivation)({
+            authority: env.authority,
+            clientId: minted.clientId,
+            clientSecret: minted.clientSecret,
+            audience: env.audience,
+        }, logger)
+        : true;
+    if (logger.isJson()) {
+        logger.json({
+            environment: envName,
+            client: clientName,
+            action: replaceExisting ? "replace" : "mint",
+            clientId: minted.clientId,
+            persisted,
+            active,
+        });
+    }
+};
+exports.runSetupEnv = runSetupEnv;

package/dist/serialization/tasks/env/setup-org-client.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `scai setup client create --org <env>` — provision the organization-
+ * scoped automation client for the org behind one environment.
+ *
+ * Mirrors `runSetupEnv` (the env-scoped CM client) but mints the
+ * org-scoped `deploy` client type: it carries only a name (no project /
+ * environment binding) and is stored in the keychain keyed by
+ * `organizationId` — one per org, shared by every env profile in it.
+ *
+ * The flow is list-or-mint, keyed on the stable `scai-deploy` client
+ * name so re-runs are idempotent.
+ */
+import type { CommonOptions } from "../../../shared/cli-options";
+export type SetupOrgClientOptions = CommonOptions & {
+    environmentName?: string;
+    /** Preview the action without minting or deleting anything. */
+    whatIf?: boolean;
+    /** Delete and re-mint the client even if one is already provisioned. */
+    rotate?: boolean;
+};
+export declare const runSetupOrgClient: (options: SetupOrgClientOptions) => Promise<void>;

package/dist/serialization/tasks/env/setup-org-client.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * `scai setup client create --org <env>` — provision the organization-
+ * scoped automation client for the org behind one environment.
+ *
+ * Mirrors `runSetupEnv` (the env-scoped CM client) but mints the
+ * org-scoped `deploy` client type: it carries only a name (no project /
+ * environment binding) and is stored in the keychain keyed by
+ * `organizationId` — one per org, shared by every env profile in it.
+ *
+ * The flow is list-or-mint, keyed on the stable `scai-deploy` client
+ * name so re-runs are idempotent.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSetupOrgClient = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+const root_config_1 = require("../../../config/root-config");
+const keychain_1 = require("../../../shared/keychain");
+const api_1 = require("../../../deploy/api");
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const errors_1 = require("../../../shared/errors");
+const policy_1 = require("../../../policy");
+const package_json_1 = __importDefault(require("../../../../package.json"));
+const runSetupOrgClient = async (options) => {
+    const logger = (0, cli_tasks_1.toLogger)(options);
+    const configPath = options.config ?? process.cwd();
+    const { envName, env, root } = (0, root_config_1.resolveActiveEnvironment)(configPath, options.environmentName);
+    // Phase 2 mint gate — minting an automation client requires an
+    // interactive human operator on a mint-eligible environment. A no-op
+    // in unmanaged mode. See docs/policy-and-guardrails.md.
+    (0, policy_1.authorizeOperation)({
+        envName,
+        configRootDir: root.physicalPath ? node_path_1.default.dirname(root.physicalPath) : undefined,
+        tier: "mint",
+    });
+    const { organizationId } = env;
+    if (!organizationId) {
+        throw (0, cli_tasks_1.inputError)(`Environment '${envName}' has no organizationId.`, "Set organizationId on the env profile, or run `scai setup init`.");
+    }
+    const deployToken = (await (0, keychain_1.getDeployToken)(envName)) ?? env.deployToken ?? process.env.SITECOREAI_DEPLOY_TOKEN;
+    if (!deployToken) {
+        throw (0, errors_1.createScaiError)(`No deploy token is available for environment '${envName}'.`, "AUTH_REQUIRED", {
+            hint: `Run \`scai setup login -n ${envName}\` first — minting a client needs a token with the xmclouddeploy.clients:manage scope.`,
+        });
+    }
+    const deployClient = { accessToken: deployToken };
+    const clientName = (0, api_1.buildScaiClientName)("deploy");
+    // Read-side reconciliation — safe to run even under --what-if. A
+    // provisioned client means both halves are present: the non-secret
+    // metadata in the config (`orgClients[orgId]`) AND the secret in the
+    // keychain. Either alone is incomplete.
+    const rootFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+    const storedSecret = await (0, keychain_1.getOrgClientSecret)(organizationId);
+    const stored = Boolean(rootFile.config.orgClients?.[organizationId]?.clientId) && Boolean(storedSecret);
+    let existingId;
+    try {
+        const listed = await (0, api_1.listOrganizationClients)(deployClient, organizationId);
+        existingId = (listed.items ?? []).find((client) => client.name === clientName)?.id;
+    }
+    catch (error) {
+        const scaiError = (0, errors_1.toScaiError)(error);
+        throw (0, errors_1.createScaiError)(`Could not list organization clients for organization '${organizationId}'.`, "DEPLOY_FAILED", {
+            hint: `The deploy token may lack the xmclouddeploy.clients:manage scope. Re-run \`scai setup login -n ${envName}\`. Underlying error: ${scaiError.message}`,
+        });
+    }
+    const alreadyProvisioned = Boolean(stored) && Boolean(existingId);
+    if (alreadyProvisioned && !options.rotate) {
+        if (logger.isJson()) {
+            logger.json({
+                organization: organizationId,
+                client: clientName,
+                action: "none",
+                provisioned: true,
+            });
+            return;
+        }
+        logger.info(`Organization '${organizationId}' already has its automation client (${clientName}).`, "green");
+        logger.info("  Nothing to do. Pass --rotate to delete and re-mint.");
+        return;
+    }
+    // An existing server-side client with no keychain secret is an orphan —
+    // the secret is unrecoverable, so it must be replaced.
+    const replaceExisting = Boolean(existingId) && (!stored || Boolean(options.rotate));
+    if (options.whatIf) {
+        const verb = replaceExisting ? "delete the existing client and re-mint" : "mint";
+        if (logger.isJson()) {
+            logger.json({
+                organization: organizationId,
+                client: clientName,
+                action: replaceExisting ? "replace" : "mint",
+                whatIf: true,
+            });
+            return;
+        }
+        logger.info(`[what-if] Would ${verb} org client '${clientName}' for organization '${organizationId}'.`);
+        return;
+    }
+    if (replaceExisting && existingId) {
+        const reason = options.rotate ? "rotating" : "orphaned — secret not in keychain";
+        logger.info(`Removing the existing '${clientName}' client (${reason})…`);
+        await (0, api_1.deleteClient)(deployClient, existingId, organizationId);
+    }
+    const minted = await (0, api_1.mintDeployClient)(deployClient, {
+        name: clientName,
+        description: (0, api_1.buildScaiClientDescription)("deploy", {
+            surface: "CLI",
+            version: package_json_1.default.version,
+        }),
+    }, organizationId);
+    if (!minted.clientId || !minted.clientSecret) {
+        throw (0, errors_1.createScaiError)("The clients API did not return a clientId/clientSecret.", "DEPLOY_FAILED", { hint: "Re-run the command; if it persists, mint the client in the Cloud Portal." });
+    }
+    // The keychain holds only the secret; the non-secret metadata
+    // (clientId, name, mintedAt) goes into the `orgClients[orgId]` block
+    // in the config file — a readable inventory of what's configured. See
+    // docs/credentials.md.
+    const persisted = await (0, keychain_1.setOrgClientSecret)(organizationId, minted.clientSecret);
+    const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+    const orgClients = rootConfigFile.config.orgClients ?? {};
+    orgClients[organizationId] = {
+        clientId: minted.clientId,
+        name: clientName,
+        mintedAt: new Date().toISOString(),
+    };
+    rootConfigFile.config.orgClients = orgClients;
+    (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+    if (logger.isJson()) {
+        logger.json({
+            organization: organizationId,
+            client: clientName,
+            action: replaceExisting ? "replace" : "mint",
+            clientId: minted.clientId,
+            persisted,
+        });
+        return;
+    }
+    logger.info(`Minted org automation client '${clientName}' for organization '${organizationId}'.`, "green");
+    logger.info(`  clientId: ${minted.clientId}`);
+    if (!persisted) {
+        logger.warn("Keychain unavailable — the client secret was NOT persisted. The minted client is unusable; re-run when the keychain is available.");
+    }
+};
+exports.runSetupOrgClient = runSetupOrgClient;

package/dist/serialization/tasks/env/status.d.ts

@@ -1,3 +1,2 @@
 import type { CommonOptions } from "../types";
 export declare const runStatus: (options: CommonOptions) => Promise<void>;
-//# sourceMappingURL=status.d.ts.map

package/dist/serialization/tasks/env/status.js

@@ -1,26 +1,44 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runStatus = void 0;
-const config_1 = require("../../../config");
+const root_config_1 = require("../../../config/root-config");
 const keychain_1 = require("../../../shared/keychain");
+const credential_matrix_1 = require("../../../shared/credential-matrix");
 const shared_1 = require("../shared");
+/**
+ * Resolve the deploy token's freshness metadata. Per `docs/credentials.md`
+ * the config file holds every token's non-secret metadata: the
+ * `deployTokenExpiresIn` / `deployTokenLastUpdated` fields live on the
+ * env profile.
+ */
+const resolveDeployTokenMeta = (env) => ({
+    expiresIn: env.deployTokenExpiresIn ?? null,
+    lastUpdated: env.deployTokenLastUpdated ?? null,
+});
 const runStatus = async (options) => {
     const logger = (0, shared_1.toLogger)(options);
     const configPath = options.config ?? process.cwd();
-    const rootConfigFile = (0, config_1.readRootConfigurationFile)(configPath);
+    const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
     const defaultName = rootConfigFile.config.defaultEnvProfile;
-    const root = (0, config_1.readRootConfiguration)(configPath, defaultName);
+    const root = (0, root_config_1.readRootConfiguration)(configPath, defaultName);
     const envProfiles = rootConfigFile.config.envProfiles ?? {};
     const reservedName = "default";
     const names = Object.keys(envProfiles)
         .filter((name) => name !== reservedName)
         .sort((a, b) => a.localeCompare(b));
+    /** Resolve the credential matrix (env client / org client / brand) for one environment. */
+    const resolveCredentials = (name, env) => {
+        const orgId = env.organizationId;
+        return (0, credential_matrix_1.resolveCredentialMatrix)(name, env, Boolean(orgId && root.brand?.[orgId]), Boolean(orgId && root.orgClients?.[orgId]?.clientId));
+    };
     if (logger.isJson()) {
         const results = [];
         for (const name of names) {
             const env = root.environments[name] ?? envProfiles[name];
             const cachedCmTokens = env.cacheAuthenticationToken === false ? undefined : await (0, keychain_1.getCmTokens)(name);
             const deployToken = (await (0, keychain_1.getDeployToken)(name)) ?? env.deployToken;
+            const deployTokenMeta = resolveDeployTokenMeta(env);
+            const credentials = await resolveCredentials(name, env);
             results.push({
                 name,
                 isDefault: name === defaultName,
@@ -36,7 +54,7 @@ const runStatus = async (options) => {
                 },
                 editingHostEnvironmentIds: env.editingHostEnvironmentIds ?? [],
                 cmAuth: env.useClientCredentials
-                    ? env.clientId && env.clientSecret
+                    ? credentials.envClient || credentials.orgClient
                         ? "client-credentials"
                         : "client-credentials (incomplete)"
                     : cachedCmTokens?.accessToken || cachedCmTokens?.refreshToken
@@ -48,8 +66,9 @@ const runStatus = async (options) => {
                                 : "missing",
                 deployToken: Boolean(deployToken),
                 allowWrite: Boolean(env.allowWrite),
-                deployTokenExpiresIn: env.deployTokenExpiresIn ?? null,
-                deployTokenLastUpdated: env.deployTokenLastUpdated ?? null,
+                deployTokenExpiresIn: deployTokenMeta.expiresIn,
+                deployTokenLastUpdated: deployTokenMeta.lastUpdated,
+                credentials,
             });
         }
         logger.json({
@@ -77,6 +96,7 @@ const runStatus = async (options) => {
         const cachedCmTokens = env.cacheAuthenticationToken === false ? undefined : await (0, keychain_1.getCmTokens)(name);
         const hasCachedCmTokens = Boolean(cachedCmTokens?.accessToken || cachedCmTokens?.refreshToken);
         const deployToken = (await (0, keychain_1.getDeployToken)(name)) ?? env.deployToken;
+        const credentials = await resolveCredentials(name, env);
         const hasConfig = Boolean(env.host ||
             env.authority ||
             env.ref ||
@@ -86,13 +106,12 @@ const runStatus = async (options) => {
             env.environmentId ||
             env.deployToken ||
             env.clientId ||
-            env.clientSecret ||
             env.audience ||
             env.useClientCredentials !== undefined ||
             env.allowWrite !== undefined ||
             (env.variables && Object.keys(env.variables).length > 0));
         const cmAuth = env.useClientCredentials
-            ? env.clientId && env.clientSecret
+            ? credentials.envClient || credentials.orgClient
                 ? "client-credentials"
                 : "client-credentials (incomplete)"
             : hasCachedCmTokens
@@ -133,10 +152,11 @@ const runStatus = async (options) => {
         }
         logger.info(`  cmAuth: ${cmAuth}`);
         logger.info(`  deployToken: ${hasDeployToken ? "set" : "missing"}`);
-        if (env.deployTokenExpiresIn && env.deployTokenLastUpdated) {
-            const last = Date.parse(env.deployTokenLastUpdated);
+        const deployTokenMeta = resolveDeployTokenMeta(env);
+        if (deployTokenMeta.expiresIn && deployTokenMeta.lastUpdated) {
+            const last = Date.parse(deployTokenMeta.lastUpdated);
             if (!Number.isNaN(last)) {
-                const expiresAt = last + env.deployTokenExpiresIn * 1000;
+                const expiresAt = last + deployTokenMeta.expiresIn * 1000;
                 const msRemaining = expiresAt - Date.now();
                 if (msRemaining <= 10 * 60 * 1000) {
                     logger.warn("  deployToken: expiring soon", "yellow");
@@ -144,6 +164,11 @@ const runStatus = async (options) => {
             }
         }
         logger.info(`  allowWrite: ${env.allowWrite ? "true" : "false"}`);
+        const mark = (present) => (present ? "ok" : "missing");
+        logger.info("  credentials:");
+        logger.info(`    env client: ${mark(credentials.envClient)}`);
+        logger.info(`    org client: ${mark(credentials.orgClient)}`);
+        logger.info(`    brand:      ${mark(credentials.brand)}`);
     }
 };
 exports.runStatus = runStatus;

package/dist/serialization/tasks/helpers/collect.d.ts

@@ -1,8 +1,7 @@
-import { readRootConfiguration } from "../../../config";
+import { readRootConfiguration } from "../../../config/root-config";
 import { FilesystemTreeSpec } from "../../tree-spec";
 import { ItemData, ItemMetadata } from "../../types";
 export declare const collectItemData: (environmentName: string, root: ReturnType<typeof readRootConfiguration>, subtrees: FilesystemTreeSpec[], useDebugSignatures: boolean) => Promise<{
     items: ItemData[];
     metadata: ItemMetadata[];
 }>;
-//# sourceMappingURL=collect.d.ts.map

package/dist/serialization/tasks/helpers/collect.js

@@ -2,28 +2,35 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectItemData = void 0;
 const field_filter_1 = require("../../field-filter");
-const sitecore_api_1 = require("../../sitecore-api");
+const items_1 = require("../../api/items");
 const shared_1 = require("../shared");
 const errors_1 = require("../../../shared/errors");
+const concurrency_1 = require("../../../shared/concurrency");
 const collectItemData = async (environmentName, root, subtrees, useDebugSignatures) => {
     const env = root.environments[environmentName];
     if (!env) {
-        throw (0, errors_1.createCliError)(`Environment ${environmentName} was not defined.`, "ENV_NOT_FOUND");
+        throw (0, errors_1.createScaiError)(`Environment ${environmentName} was not defined.`, "ENV_NOT_FOUND");
     }
     const apiTimeoutMs = (0, shared_1.resolveApiTimeoutMs)(root);
-    const items = [];
-    const metadata = [];
-    for (const subtree of subtrees) {
-        const filter = (0, field_filter_1.createFieldFilterSet)(root.serialization.excludedFields, []);
-        const subtreeMetadata = await (0, sitecore_api_1.fetchItemMetadata)(env, subtree.database, subtree.path.toPathString(), subtree.scope, filter, useDebugSignatures, { timeoutMs: apiTimeoutMs });
-        const filtered = subtreeMetadata.filter((item) => subtree.includesPath(item.path));
-        metadata.push(...filtered);
-    }
-    for (const meta of metadata) {
-        const filter = (0, field_filter_1.createFieldFilterSet)(root.serialization.excludedFields, []);
-        const itemData = await (0, sitecore_api_1.fetchItemData)(env, meta.database ?? "master", meta.id, "SingleItem", filter, { timeoutMs: apiTimeoutMs });
-        items.push(...itemData);
-    }
+    // Hoist filter creation: `excludedFields` is invariant across this call,
+    // so the same filter instance is safe to share across every fetch.
+    const filter = (0, field_filter_1.createFieldFilterSet)(root.serialization.excludedFields, []);
+    // Subtree metadata fetches are independent — run concurrently with a
+    // bounded fan-out. Result ordering is preserved by mapWithConcurrency,
+    // matching the previous sequential behaviour.
+    const perSubtreeMetadata = await (0, concurrency_1.mapWithConcurrency)(subtrees, async (subtree) => {
+        const subtreeMetadata = await (0, items_1.fetchItemMetadata)(env, subtree.database, subtree.path.toPathString(), subtree.scope, filter, useDebugSignatures, { timeoutMs: apiTimeoutMs });
+        return subtreeMetadata.filter((item) => subtree.includesPath(item.path));
+    });
+    const metadata = perSubtreeMetadata.flat();
+    // Item-body fetches were sequential — the biggest perf hit in the
+    // diff/push/pull path. For N items at ~100 ms each, sequential was N *
+    // 100 ms; parallel with concurrency 8 is roughly N/8 * 100 ms. Order
+    // preserved so downstream callers see the same shape they always did.
+    const perItemData = await (0, concurrency_1.mapWithConcurrency)(metadata, async (meta) => (0, items_1.fetchItemData)(env, meta.database ?? "master", meta.id, "SingleItem", filter, {
+        timeoutMs: apiTimeoutMs,
+    }));
+    const items = perItemData.flat();
     return { items, metadata };
 };
 exports.collectItemData = collectItemData;

package/dist/serialization/tasks/helpers/commands.d.ts

@@ -2,4 +2,3 @@ import { FilesystemTreeSpec } from "../../tree-spec";
 import { ItemMetadata } from "../../types";
 import { ItemCommand } from "../../commands";
 export declare const buildCommandsForDatabase: (subtrees: FilesystemTreeSpec[], sourceMetadata: ItemMetadata[], destinationMetadata: ItemMetadata[], applyAllowedPushOperations: boolean) => ItemCommand[];
-//# sourceMappingURL=commands.d.ts.map

package/dist/serialization/tasks/helpers/filesystem.d.ts

@@ -3,4 +3,3 @@ import { ItemData } from "../../types";
 import { Logger } from "../../../shared/logger";
 import { ItemCommand } from "../../commands";
 export declare const applyFilesystemCommands: (commands: ItemCommand[], pathProvider: FilesystemPathProvider, sourceData: Map<string, ItemData>, logger: Logger) => Promise<string[]>;
-//# sourceMappingURL=filesystem.d.ts.map