@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/shared/concurrency.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Bounded-concurrency async iteration helper. Used to parallelize
+ * I/O-bound network calls (e.g. `fetchItemData` for each item in a
+ * serialization pull) without blasting unbounded request fans out at
+ * Sitecore — which would hit rate limits, exhaust local sockets, or
+ * blow up memory holding too many in-flight Response bodies.
+ *
+ * Results preserve input order. The first failure aborts: pending
+ * tasks are not started, in-flight tasks are awaited then their
+ * results discarded.
+ *
+ * Default concurrency is 8 (conservative for typical XM Cloud rate
+ * limits). Override via `SITECOREAI_HTTP_CONCURRENCY`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapWithConcurrency = exports.resolveDefaultConcurrency = exports.DEFAULT_CONCURRENCY = void 0;
+exports.DEFAULT_CONCURRENCY = 8;
+const resolveDefaultConcurrency = () => {
+    const raw = process.env.SITECOREAI_HTTP_CONCURRENCY;
+    if (!raw)
+        return exports.DEFAULT_CONCURRENCY;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed < 1)
+        return exports.DEFAULT_CONCURRENCY;
+    return Math.floor(parsed);
+};
+exports.resolveDefaultConcurrency = resolveDefaultConcurrency;
+const mapWithConcurrency = async (items, worker, options = {}) => {
+    const limit = Math.max(1, options.concurrency ?? (0, exports.resolveDefaultConcurrency)());
+    if (items.length === 0)
+        return [];
+    if (limit >= items.length) {
+        return Promise.all(items.map((item, index) => worker(item, index)));
+    }
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    let aborted = false;
+    let firstError = undefined;
+    const run = async () => {
+        while (!aborted) {
+            const index = nextIndex++;
+            if (index >= items.length)
+                return;
+            try {
+                results[index] = await worker(items[index], index);
+            }
+            catch (error) {
+                if (!aborted) {
+                    aborted = true;
+                    firstError = error;
+                }
+                return;
+            }
+        }
+    };
+    const workers = [];
+    for (let i = 0; i < limit; i++) {
+        workers.push(run());
+    }
+    await Promise.all(workers);
+    if (aborted) {
+        throw firstError;
+    }
+    return results;
+};
+exports.mapWithConcurrency = mapWithConcurrency;

package/dist/shared/config-template.d.ts

@@ -20,4 +20,3 @@ export declare const DEFAULT_CONFIG: {
 };
 export declare const resolveTargetPath: (value?: string) => string;
 export declare const writeConfigTemplate: (targetPath: string) => void;
-//# sourceMappingURL=config-template.d.ts.map

package/dist/shared/credential-matrix.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Per-environment credential presence — the matrix surfaced by
+ * `scai setup status` (text + JSON) and the `scai_overview` MCP tool's
+ * discovery output.
+ *
+ * Per `docs/credentials.md` scai has exactly two kinds of credential:
+ * the automation client (provisioned at env scope and/or org scope) and
+ * the brand / AI APIs key. A scai-minted automation client is fully
+ * present only when both halves agree: the non-secret metadata in the
+ * config file (`automationClient` / `orgClients[orgId]`) AND the secret
+ * in the OS keychain. This matrix reports the presence of each:
+ *
+ *   - `envClient` — the env-scoped automation client (config metadata +
+ *     keychain secret), or the operator's bring-your-own-client escape
+ *     hatch (`clientId` + `useClientCredentials` on the profile; the
+ *     secret is supplied via `SITECOREAI_ENV_<ENV>_CLIENT_SECRET`, never
+ *     the config file).
+ *   - `orgClient` — the org-scoped automation client (config metadata +
+ *     keychain secret), shared by every env profile in the organization.
+ *   - `brand`     — the brand / AI APIs key for the env's organization.
+ *
+ * Short-lived tokens (deploy, cm, brief, campaign, …) are NOT
+ * credentials and are not reported here.
+ *
+ * Lives in `shared/` (a leaf module) and takes an already-resolved env
+ * profile plus precomputed `hasBrand` / org-client-metadata flags, so it
+ * never imports `config/` — the caller does the config read and passes
+ * the minimal shape in.
+ */
+/** Which of scai's credentials an environment currently has. */
+export type CredentialMatrix = {
+    /**
+     * Env-scoped automation client — the scai-minted client (its
+     * `automationClient` metadata in the config plus the `cm-client:<env>`
+     * keychain secret), or the bring-your-own-client escape hatch
+     * (`clientId` + `useClientCredentials` on the env profile; the secret
+     * is supplied via `SITECOREAI_ENV_<ENV>_CLIENT_SECRET`).
+     */
+    envClient: boolean;
+    /**
+     * Org-scoped automation client — its `orgClients[orgId]` metadata in
+     * the config plus the `org-client:<orgId>` keychain secret.
+     */
+    orgClient: boolean;
+    /** Brand / AI APIs key for the env's organization. */
+    brand: boolean;
+};
+/**
+ * Minimal env-profile shape `resolveCredentialMatrix` needs. A subset of
+ * the config's environment type — kept local so this leaf module has no
+ * `config/` dependency.
+ */
+export type CredentialEnvProfile = {
+    /** Bring-your-own-client id (escape hatch). */
+    clientId?: string;
+    /**
+     * Bring-your-own-client toggle (escape hatch). When set with a
+     * `clientId`, the operator supplies their own automation client; the
+     * secret comes from `SITECOREAI_ENV_<ENV>_CLIENT_SECRET`.
+     */
+    useClientCredentials?: boolean;
+    /**
+     * Non-secret metadata of the scai-minted env-scoped automation client
+     * (`automationClient` block on the env profile). Presence of its
+     * `clientId` is the config half of the env-client presence check.
+     */
+    automationClient?: {
+        clientId?: string;
+    };
+    /** Organization the env belongs to — keys the org-scoped client. */
+    organizationId?: string;
+};
+/**
+ * Resolve the credential matrix for one environment. Each scai-minted
+ * automation client is present only when both halves agree: the
+ * non-secret metadata in the config AND the secret in the keychain.
+ * `hasBrand` and `hasOrgClientMetadata` are taken precomputed (the
+ * caller checks `root.brand[orgId]` / `root.orgClients[orgId]`).
+ *
+ * `resolveCredentialMatrix` is a pure presence-reporter — it never
+ * mints, never writes, and never throws on a missing credential.
+ */
+export declare const resolveCredentialMatrix: (envName: string, env: CredentialEnvProfile, hasBrand: boolean, hasOrgClientMetadata: boolean) => Promise<CredentialMatrix>;

package/dist/shared/credential-matrix.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Per-environment credential presence — the matrix surfaced by
+ * `scai setup status` (text + JSON) and the `scai_overview` MCP tool's
+ * discovery output.
+ *
+ * Per `docs/credentials.md` scai has exactly two kinds of credential:
+ * the automation client (provisioned at env scope and/or org scope) and
+ * the brand / AI APIs key. A scai-minted automation client is fully
+ * present only when both halves agree: the non-secret metadata in the
+ * config file (`automationClient` / `orgClients[orgId]`) AND the secret
+ * in the OS keychain. This matrix reports the presence of each:
+ *
+ *   - `envClient` — the env-scoped automation client (config metadata +
+ *     keychain secret), or the operator's bring-your-own-client escape
+ *     hatch (`clientId` + `useClientCredentials` on the profile; the
+ *     secret is supplied via `SITECOREAI_ENV_<ENV>_CLIENT_SECRET`, never
+ *     the config file).
+ *   - `orgClient` — the org-scoped automation client (config metadata +
+ *     keychain secret), shared by every env profile in the organization.
+ *   - `brand`     — the brand / AI APIs key for the env's organization.
+ *
+ * Short-lived tokens (deploy, cm, brief, campaign, …) are NOT
+ * credentials and are not reported here.
+ *
+ * Lives in `shared/` (a leaf module) and takes an already-resolved env
+ * profile plus precomputed `hasBrand` / org-client-metadata flags, so it
+ * never imports `config/` — the caller does the config read and passes
+ * the minimal shape in.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCredentialMatrix = void 0;
+const keychain_1 = require("./keychain");
+/**
+ * Resolve the credential matrix for one environment. Each scai-minted
+ * automation client is present only when both halves agree: the
+ * non-secret metadata in the config AND the secret in the keychain.
+ * `hasBrand` and `hasOrgClientMetadata` are taken precomputed (the
+ * caller checks `root.brand[orgId]` / `root.orgClients[orgId]`).
+ *
+ * `resolveCredentialMatrix` is a pure presence-reporter — it never
+ * mints, never writes, and never throws on a missing credential.
+ */
+const resolveCredentialMatrix = async (envName, env, hasBrand, hasOrgClientMetadata) => {
+    // Env-scoped client: config metadata (`automationClient.clientId`)
+    // plus the keychain secret. Both halves required.
+    const cmSecret = await (0, keychain_1.getCmClientSecret)(envName);
+    const hasMintedEnvClient = Boolean(env.automationClient?.clientId) && Boolean(cmSecret);
+    // Org-scoped client: config metadata (`orgClients[orgId]`) plus the
+    // keychain secret.
+    const orgSecret = env.organizationId ? await (0, keychain_1.getOrgClientSecret)(env.organizationId) : undefined;
+    const hasOrgClient = hasOrgClientMetadata && Boolean(orgSecret);
+    // The bring-your-own-client escape hatch: the operator declares their
+    // own `clientId` + `useClientCredentials` on the profile and feeds the
+    // secret in via `SITECOREAI_ENV_<ENV>_CLIENT_SECRET`. The matrix is a
+    // presence reporter and never reads secrets, so it reports the BYO
+    // intent (id + toggle) rather than checking the env var.
+    const hasByoClient = Boolean(env.clientId && env.useClientCredentials);
+    return {
+        envClient: hasMintedEnvClient || hasByoClient,
+        orgClient: hasOrgClient,
+        brand: hasBrand,
+    };
+};
+exports.resolveCredentialMatrix = resolveCredentialMatrix;

package/dist/shared/env-tier.d.ts

@@ -0,0 +1,2 @@
+import type { EnvironmentConfiguration } from "../config/types";
+export declare const isProductionTier: (env: EnvironmentConfiguration) => boolean;

package/dist/shared/env-tier.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isProductionTier = void 0;
+/**
+ * Whether an environment is "production-tier" for publish gating.
+ * Tier 1 (`scai content publish item`) uses this to decide between a simple
+ * `[y/N]` prompt and the two-step typed-scope-token flow. Tier 2
+ * (`scai content publish all`) always treats every env as max-risk regardless
+ * of this signal.
+ *
+ * Order of precedence:
+ *   1. Explicit `production: true` / `false` in the env config wins.
+ *   2. Otherwise, the env name is matched against /prod/i or /^live/i.
+ *
+ * The heuristic exists so the common-case naming ("prod", "production",
+ * "live") doesn't need explicit opt-in. The explicit flag exists to
+ * override the heuristic in either direction (`prod-test` that isn't
+ * really production; an oddly-named tenant that IS).
+ */
+const PRODUCTION_NAME_HEURISTICS = [/prod/i, /^live/i];
+const isProductionTier = (env) => {
+    if (env.production === false) {
+        return false;
+    }
+    if (env.production === true) {
+        return true;
+    }
+    const name = env.name ?? "";
+    return PRODUCTION_NAME_HEURISTICS.some((rx) => rx.test(name));
+};
+exports.isProductionTier = isProductionTier;

package/dist/shared/envelope.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Canonical scai output envelope.
+ *
+ * Every CLI command emits this shape under `--json` (with optional keys
+ * absent when N/A). Agents and downstream automation branch on `data`
+ * regardless of which surface produced the output; the rest of the
+ * keys carry structured metadata (counts, pagination, plan-only flag,
+ * baseline ignore count, etc.) in canonical slots.
+ *
+ *   {
+ *     "command": "deploy.environments.list",
+ *     "environment": "demo",
+ *     "data": <T>,            // primary result (object, array, scalar, or null)
+ *     "count"?: number,       // present when data is an array
+ *     "totalCount"?: number,  // present when paginated and known
+ *     "pageSize"?: number,    // present when paginated
+ *     "whatIf"?: true,        // present iff plan-only
+ *     "ignoredCount"?: number,// present when baseline filtering applied
+ *     "summary"?: string,     // human-readable headline
+ *     "meta"?: Record<string, unknown>  // command-specific extras
+ *   }
+ *
+ * Prior to 2026-05-14, three different keys held the same slot:
+ * `result` (deploy commands), `results` (hygiene audit/cleanup), and
+ * `request` (deploy what-if). Agents parsing scai output had to branch
+ * on shape per-command. The unification renames all three to `data`.
+ *
+ * The module lives in `src/shared/` so any task surface (deploy,
+ * hygiene, serialization, recipe, workflow, webhook) can import it
+ * without crossing layer boundaries.
+ */
+export interface ScaiEnvelope<T = unknown> {
+    command: string;
+    environment: string | null;
+    data: T;
+    count?: number;
+    totalCount?: number;
+    pageSize?: number;
+    whatIf?: true;
+    ignoredCount?: number;
+    summary?: string;
+    meta?: Record<string, unknown>;
+}
+/**
+ * Build a `ScaiEnvelope` from a primary `data` value plus an `extra`
+ * bag. Keys in `extra` that match canonical envelope fields are
+ * hoisted to envelope-level; everything else collects under `meta`.
+ * Auto-computes `count` when `data` is an array (overridable via
+ * `extra.count`).
+ */
+export declare const buildScaiEnvelope: <T>(params: {
+    command: string;
+    environment: string | null | undefined;
+    data: T;
+    extra?: Record<string, unknown>;
+}) => ScaiEnvelope<T>;
+/**
+ * Read the entire stdin to a string, then parse a `ScaiEnvelope`.
+ * Used by cleanup commands that accept `--from-stdin` to consume an
+ * audit's `--json` output directly, skipping their internal re-run of
+ * the audit. The contract: callers expect a single JSON object that
+ * matches the canonical envelope. Extra keys are tolerated;
+ * `command`, `data` are required.
+ *
+ * Returns the parsed envelope cast to the expected `data` shape (no
+ * structural validation beyond key presence — the cleanup task layer
+ * runs its own zod validation on the items in `data`).
+ */
+export declare const readScaiEnvelopeFromStdin: <T = unknown>() => Promise<ScaiEnvelope<T>>;

package/dist/shared/envelope.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readScaiEnvelopeFromStdin = exports.buildScaiEnvelope = void 0;
+const CANONICAL_ENVELOPE_KEYS = new Set([
+    "count",
+    "totalCount",
+    "pageSize",
+    "whatIf",
+    "ignoredCount",
+    "summary",
+]);
+/**
+ * Build a `ScaiEnvelope` from a primary `data` value plus an `extra`
+ * bag. Keys in `extra` that match canonical envelope fields are
+ * hoisted to envelope-level; everything else collects under `meta`.
+ * Auto-computes `count` when `data` is an array (overridable via
+ * `extra.count`).
+ */
+const buildScaiEnvelope = (params) => {
+    const envelope = {
+        command: params.command,
+        environment: params.environment ?? null,
+        data: params.data,
+    };
+    if (Array.isArray(params.data)) {
+        envelope.count = params.data.length;
+    }
+    const meta = {};
+    const envelopeBag = envelope;
+    for (const [key, value] of Object.entries(params.extra ?? {})) {
+        if (CANONICAL_ENVELOPE_KEYS.has(key)) {
+            envelopeBag[key] = value;
+        }
+        else {
+            meta[key] = value;
+        }
+    }
+    if (Object.keys(meta).length > 0) {
+        envelope.meta = meta;
+    }
+    return envelope;
+};
+exports.buildScaiEnvelope = buildScaiEnvelope;
+/**
+ * Read the entire stdin to a string, then parse a `ScaiEnvelope`.
+ * Used by cleanup commands that accept `--from-stdin` to consume an
+ * audit's `--json` output directly, skipping their internal re-run of
+ * the audit. The contract: callers expect a single JSON object that
+ * matches the canonical envelope. Extra keys are tolerated;
+ * `command`, `data` are required.
+ *
+ * Returns the parsed envelope cast to the expected `data` shape (no
+ * structural validation beyond key presence — the cleanup task layer
+ * runs its own zod validation on the items in `data`).
+ */
+const readScaiEnvelopeFromStdin = async () => {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    }
+    const text = Buffer.concat(chunks).toString("utf8").trim();
+    if (text.length === 0) {
+        throw new Error("--from-stdin: stdin was empty. Pipe an audit's --json output in.");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error(`--from-stdin: stdin was not valid JSON (${error instanceof Error ? error.message : String(error)}).`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("--from-stdin: expected a JSON object (a ScaiEnvelope), got something else.");
+    }
+    const obj = parsed;
+    if (typeof obj.command !== "string") {
+        throw new Error("--from-stdin: envelope is missing the required `command` field.");
+    }
+    if (!("data" in obj)) {
+        throw new Error("--from-stdin: envelope is missing the required `data` field.");
+    }
+    return obj;
+};
+exports.readScaiEnvelopeFromStdin = readScaiEnvelopeFromStdin;

package/dist/shared/errors.d.ts

@@ -1,21 +1,91 @@
-export type CliErrorCode = "CONFIG_NOT_FOUND" | "CONFIG_INVALID" | "INPUT_INVALID" | "AUTH_REQUIRED" | "NETWORK" | "ENV_NOT_FOUND" | "DEPLOY_FAILED" | "SITES_API_FAILED" | "UNKNOWN";
-export declare class CliError extends Error {
-    code: CliErrorCode;
+/**
+ * scai's typed error envelope.
+ *
+ * `ScaiError` is the canonical class. `CliError` is a deprecated alias
+ * kept for one major version so consumers of `@sitecoreai-labs/cli/errors`
+ * (added in 0.x) can migrate without breakage. The factory + converter +
+ * code type follow the same convention:
+ *
+ *   - `ScaiError` ← was `CliError`
+ *   - `ScaiErrorCode` ← was `CliErrorCode`
+ *   - `createScaiError(...)` ← was `createCliError(...)`
+ *   - `toScaiError(...)` ← was `toCliError(...)`
+ *
+ * The legacy `Cli*` names re-export the new symbols and will be removed
+ * in the next major version.
+ */
+export type ScaiErrorCode = "CONFIG_NOT_FOUND" | "CONFIG_INVALID" | "INPUT_INVALID" | "AUTH_REQUIRED" | "AUTH_BRAND_REQUIRED" | "AUTH_DENIED" | "POLICY_DENIED" | "NETWORK" | "ENV_NOT_FOUND" | "DEPLOY_FAILED" | "SITES_API_FAILED" | "BRAND_API_FAILED" | "BRIEF_API_FAILED" | "CAMPAIGN_API_FAILED" | "AGENTS_API_FAILED" | "CANCELLED" | "UNKNOWN";
+/**
+ * Who can clear a failure — the classification an agent reads to decide
+ * whether to act itself, hand off to a human, or retry.
+ *
+ * - `agent` — fixable without a human: enroll an environment, pass a
+ *   flag, correct an input.
+ * - `needs-human-terminal` — a human must run a command in an
+ *   interactive terminal; scai refuses the operation for non-human
+ *   callers (credential provisioning: `setup login`, `setup env`).
+ * - `transient-retry` — a transient failure; wait briefly and retry.
+ */
+export type RemediationActor = "agent" | "needs-human-terminal" | "transient-retry";
+/**
+ * Machine-actionable remediation attached to a {@link ScaiError}. Where
+ * `hint` is prose for a human, `remediation` is structured so an agent
+ * (CLI JSON consumer, MCP client) can route the failure without parsing
+ * free text.
+ */
+export interface Remediation {
+    /** Who can clear this failure. */
+    actor: RemediationActor;
+    /** The concrete fix — a command to run, or a short imperative action. */
+    fix: string;
+    /** Optional extra context: why a human is needed, what to retry, etc. */
+    detail?: string;
+}
+export declare class ScaiError extends Error {
+    code: ScaiErrorCode;
     exitCode: number;
     hint?: string;
     details?: string[];
+    remediation?: Remediation;
     constructor(message: string, options?: {
-        code?: CliErrorCode;
+        code?: ScaiErrorCode;
         exitCode?: number;
         hint?: string;
         details?: string[];
+        remediation?: Remediation;
         cause?: unknown;
     });
 }
-export declare const toCliError: (error: unknown) => CliError;
-export declare const withHint: (error: CliError, hint: string) => CliError;
-export declare const createCliError: (message: string, code: CliErrorCode, options?: {
+export declare const toScaiError: (error: unknown) => ScaiError;
+export declare const withHint: (error: ScaiError, hint: string) => ScaiError;
+export declare const createScaiError: (message: string, code: ScaiErrorCode, options?: {
+    hint?: string;
+    details?: string[];
+    remediation?: Remediation;
+}) => ScaiError;
+/**
+ * @deprecated Use {@link ScaiErrorCode}. Removed in the next major.
+ */
+export type CliErrorCode = ScaiErrorCode;
+/**
+ * @deprecated Use {@link ScaiError}. Removed in the next major.
+ *
+ * `CliError` and `ScaiError` reference the **same class** — they're not
+ * separate types — so `instanceof CliError` and `instanceof ScaiError`
+ * both work against any thrown error from scai, regardless of which
+ * name the throwing code used. The single `export { ... as CliError }`
+ * form binds both the value (constructor) and the type at once.
+ */
+export { ScaiError as CliError };
+/**
+ * @deprecated Use {@link createScaiError}. Removed in the next major.
+ */
+export declare const createCliError: (message: string, code: ScaiErrorCode, options?: {
     hint?: string;
     details?: string[];
-}) => CliError;
-//# sourceMappingURL=errors.d.ts.map
+    remediation?: Remediation;
+}) => ScaiError;
+/**
+ * @deprecated Use {@link toScaiError}. Removed in the next major.
+ */
+export declare const toCliError: (error: unknown) => ScaiError;

package/dist/shared/errors.js

@@ -1,20 +1,38 @@
 "use strict";
+/**
+ * scai's typed error envelope.
+ *
+ * `ScaiError` is the canonical class. `CliError` is a deprecated alias
+ * kept for one major version so consumers of `@sitecoreai-labs/cli/errors`
+ * (added in 0.x) can migrate without breakage. The factory + converter +
+ * code type follow the same convention:
+ *
+ *   - `ScaiError` ← was `CliError`
+ *   - `ScaiErrorCode` ← was `CliErrorCode`
+ *   - `createScaiError(...)` ← was `createCliError(...)`
+ *   - `toScaiError(...)` ← was `toCliError(...)`
+ *
+ * The legacy `Cli*` names re-export the new symbols and will be removed
+ * in the next major version.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCliError = exports.withHint = exports.toCliError = exports.CliError = void 0;
-class CliError extends Error {
+exports.toCliError = exports.createCliError = exports.CliError = exports.createScaiError = exports.withHint = exports.toScaiError = exports.ScaiError = void 0;
+class ScaiError extends Error {
     constructor(message, options = {}) {
         super(message);
-        this.name = "CliError";
+        this.name = "ScaiError";
         this.code = options.code ?? "UNKNOWN";
         this.exitCode = options.exitCode ?? 1;
         this.hint = options.hint;
         this.details = options.details;
+        this.remediation = options.remediation;
         if (options.cause !== undefined) {
             this.cause = options.cause;
         }
     }
 }
-exports.CliError = CliError;
+exports.ScaiError = ScaiError;
+exports.CliError = ScaiError;
 const exitCodeFor = (code) => {
     switch (code) {
         case "CONFIG_NOT_FOUND":
@@ -22,6 +40,9 @@ const exitCodeFor = (code) => {
         case "INPUT_INVALID":
             return 2;
         case "AUTH_REQUIRED":
+        case "AUTH_BRAND_REQUIRED":
+        case "AUTH_DENIED":
+        case "POLICY_DENIED":
             return 3;
         case "NETWORK":
             return 4;
@@ -30,30 +51,47 @@ const exitCodeFor = (code) => {
         case "DEPLOY_FAILED":
             return 6;
         case "SITES_API_FAILED":
+        case "BRAND_API_FAILED":
             return 7;
+        case "BRIEF_API_FAILED":
+        case "CAMPAIGN_API_FAILED":
+        case "AGENTS_API_FAILED":
+            return 8;
+        case "CANCELLED":
+            return 130;
         default:
             return 1;
     }
 };
-const toCliError = (error) => {
-    if (error instanceof CliError) {
+const toScaiError = (error) => {
+    if (error instanceof ScaiError) {
         return error;
     }
     const message = error instanceof Error ? error.message : String(error);
-    return new CliError(message, { code: "UNKNOWN", exitCode: exitCodeFor("UNKNOWN") });
+    return new ScaiError(message, { code: "UNKNOWN", exitCode: exitCodeFor("UNKNOWN") });
 };
-exports.toCliError = toCliError;
-const withHint = (error, hint) => new CliError(error.message, {
+exports.toScaiError = toScaiError;
+const withHint = (error, hint) => new ScaiError(error.message, {
     code: error.code,
     exitCode: error.exitCode,
     hint,
     details: error.details,
+    remediation: error.remediation,
 });
 exports.withHint = withHint;
-const createCliError = (message, code, options = {}) => new CliError(message, {
+const createScaiError = (message, code, options = {}) => new ScaiError(message, {
     code,
     exitCode: exitCodeFor(code),
     hint: options.hint,
     details: options.details,
+    remediation: options.remediation,
 });
-exports.createCliError = createCliError;
+exports.createScaiError = createScaiError;
+/**
+ * @deprecated Use {@link createScaiError}. Removed in the next major.
+ */
+exports.createCliError = exports.createScaiError;
+/**
+ * @deprecated Use {@link toScaiError}. Removed in the next major.
+ */
+exports.toCliError = exports.toScaiError;

package/dist/shared/graphql.d.ts

@@ -10,10 +10,10 @@
  * required vs optional was duplicated.
  *
  * This module owns the wire protocol; `recipe/api/graphql.ts` and
- * `serialization/sitecore-api/graphql.ts` are thin wrappers that supply
+ * `serialization/api/graphql.ts` are thin wrappers that supply
  * the per-API constants.
  */
-import type { EnvironmentConfiguration } from "../config";
+import type { EnvironmentConfiguration } from "../config/types";
 type GetAccessToken = (environment: EnvironmentConfiguration) => Promise<string | undefined>;
 export interface GraphQLRequestOptions {
     timeoutMs?: number;
@@ -73,4 +73,3 @@ export interface GraphQLTransportConfig {
 }
 export declare const runSitecoreGraphQL: <T>(environment: EnvironmentConfiguration, query: string, variables: Record<string, unknown> | undefined, transport: GraphQLTransportConfig, options?: GraphQLRequestOptions) => Promise<T>;
 export {};
-//# sourceMappingURL=graphql.d.ts.map