@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/shared/keychain.js

@@ -33,44 +33,60 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearCmTokens = exports.setCmTokens = exports.getCmTokens = exports.clearDeployToken = exports.setDeployToken = exports.getDeployToken = void 0;
+exports.clearBrandToken = exports.setBrandToken = exports.getBrandToken = exports.clearBrandClientSecret = exports.setBrandClientSecret = exports.getBrandClientSecret = exports.clearOrgClientSecret = exports.setOrgClientSecret = exports.getOrgClientSecret = exports.clearCmClientSecret = exports.setCmClientSecret = exports.getCmClientSecret = exports.clearCmTokens = exports.setCmTokens = exports.getCmTokens = exports.clearAgentsCredential = exports.setAgentsCredential = exports.getAgentsCredential = exports.clearCampaignToken = exports.setCampaignToken = exports.getCampaignToken = exports.clearBriefToken = exports.setBriefToken = exports.getBriefToken = exports.clearPublishingToken = exports.setPublishingToken = exports.getPublishingToken = exports.clearDeployToken = exports.setDeployToken = exports.getDeployToken = void 0;
 const consola_1 = require("consola");
 const SERVICE_NAME = "SitecoreAI CLI";
 const DEPLOY_ACCOUNT_PREFIX = "deploy:";
 const CM_ACCOUNT_PREFIX = "cm:";
-let cachedKeytar;
-let warnedKeytarUnavailable = false;
-let warnedKeytarError = false;
+const CM_CLIENT_ACCOUNT_PREFIX = "cm-client:";
+const ORG_CLIENT_ACCOUNT_PREFIX = "org-client:";
+const PUBLISHING_ACCOUNT_PREFIX = "publishing:";
+const BRIEF_ACCOUNT_PREFIX = "brief:";
+const CAMPAIGN_ACCOUNT_PREFIX = "campaign:";
+const AGENTS_ACCOUNT_PREFIX = "agents:";
+// Brand credential keychain accounts. The string values stay
+// `ai-skills-*` on purpose: they are the opaque keychain account keys,
+// and changing them would strand secrets stored by older CLI versions
+// (forcing a re-login). The constant/function names use `brand`; the
+// storage keys are kept stable for back-compat.
+const BRAND_SECRET_ACCOUNT_PREFIX = "ai-skills-secret:";
+const BRAND_TOKEN_ACCOUNT_PREFIX = "ai-skills-token:";
+let cachedKeyring;
+let warnedKeyringUnavailable = false;
+let warnedKeyringError = false;
 const shouldWarn = () => process.env.SITECOREAI_JSON !== "1" && process.env.SITECOREAI_QUIET !== "1";
 const warnOnce = (message, type) => {
     if (!shouldWarn()) {
         return;
     }
-    if (type === "unavailable" && warnedKeytarUnavailable) {
+    if (type === "unavailable" && warnedKeyringUnavailable) {
         return;
     }
-    if (type === "error" && warnedKeytarError) {
+    if (type === "error" && warnedKeyringError) {
         return;
     }
     if (type === "unavailable") {
-        warnedKeytarUnavailable = true;
+        warnedKeyringUnavailable = true;
     }
     else {
-        warnedKeytarError = true;
+        warnedKeyringError = true;
     }
     consola_1.consola.warn(message);
 };
-const loadKeytar = async () => {
-    if (cachedKeytar !== undefined) {
-        return cachedKeytar;
+const loadKeyring = async () => {
+    if (cachedKeyring !== undefined) {
+        return cachedKeyring;
     }
     try {
-        const mod = (await Promise.resolve().then(() => __importStar(require("keytar"))));
-        cachedKeytar = (mod.default ?? mod);
-        return cachedKeytar;
+        const mod = (await Promise.resolve().then(() => __importStar(require("@napi-rs/keyring"))));
+        // CJS interop: @napi-rs/keyring is CJS so dynamic import wraps the
+        // exports under `default` on some Node versions. Try the namespace
+        // first (has AsyncEntry as a named export), fall back to default.
+        cachedKeyring = (mod.AsyncEntry ? mod : (mod.default ?? mod));
+        return cachedKeyring;
     }
     catch {
-        cachedKeytar = null;
+        cachedKeyring = null;
         warnOnce("Keychain support is unavailable. Tokens will not be stored in the OS keychain.", "unavailable");
         return null;
     }
@@ -84,28 +100,38 @@ const safeParse = (value) => {
         return undefined;
     }
 };
-const getDeployToken = async (envName) => {
-    const keytar = await loadKeytar();
-    if (!keytar) {
-        return undefined;
-    }
+/**
+ * Treat any read failure as "no token stored" — `@napi-rs/keyring` throws
+ * a NoEntry error when the credential doesn't exist (vs keytar which returned
+ * null). Distinguishing NoEntry from real errors requires platform-specific
+ * inspection; the conservative choice is to return undefined silently and
+ * surface real failures the next time a set/delete is attempted.
+ */
+const readPassword = async (ring, account) => {
     try {
-        return ((await keytar.getPassword(SERVICE_NAME, makeAccount(DEPLOY_ACCOUNT_PREFIX, envName))) ??
-            undefined);
+        const entry = new ring.AsyncEntry(SERVICE_NAME, account);
+        return (await entry.getPassword()) ?? undefined;
     }
     catch {
-        warnOnce("Unable to read deploy token from the OS keychain.", "error");
         return undefined;
     }
 };
+const getDeployToken = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return undefined;
+    }
+    return readPassword(ring, makeAccount(DEPLOY_ACCOUNT_PREFIX, envName));
+};
 exports.getDeployToken = getDeployToken;
 const setDeployToken = async (envName, token) => {
-    const keytar = await loadKeytar();
-    if (!keytar) {
+    const ring = await loadKeyring();
+    if (!ring) {
         return false;
     }
     try {
-        await keytar.setPassword(SERVICE_NAME, makeAccount(DEPLOY_ACCOUNT_PREFIX, envName), token);
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(DEPLOY_ACCOUNT_PREFIX, envName));
+        await entry.setPassword(token);
         return true;
     }
     catch {
@@ -115,44 +141,205 @@ const setDeployToken = async (envName, token) => {
 };
 exports.setDeployToken = setDeployToken;
 const clearDeployToken = async (envName) => {
-    const keytar = await loadKeytar();
-    if (!keytar) {
+    const ring = await loadKeyring();
+    if (!ring) {
         return false;
     }
     try {
-        return await keytar.deletePassword(SERVICE_NAME, makeAccount(DEPLOY_ACCOUNT_PREFIX, envName));
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(DEPLOY_ACCOUNT_PREFIX, envName));
+        return await entry.deleteCredential();
     }
     catch {
-        warnOnce("Unable to delete deploy token from the OS keychain.", "error");
+        // NoEntry on delete is idempotent success; other errors warn.
         return false;
     }
 };
 exports.clearDeployToken = clearDeployToken;
-const getCmTokens = async (envName) => {
-    const keytar = await loadKeytar();
-    if (!keytar) {
+const getPublishingToken = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return undefined;
+    }
+    return readPassword(ring, makeAccount(PUBLISHING_ACCOUNT_PREFIX, envName));
+};
+exports.getPublishingToken = getPublishingToken;
+const setPublishingToken = async (envName, token) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(PUBLISHING_ACCOUNT_PREFIX, envName));
+        await entry.setPassword(token);
+        return true;
+    }
+    catch {
+        warnOnce("Unable to write publishing token to the OS keychain.", "error");
+        return false;
+    }
+};
+exports.setPublishingToken = setPublishingToken;
+const clearPublishingToken = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(PUBLISHING_ACCOUNT_PREFIX, envName));
+        return await entry.deleteCredential();
+    }
+    catch {
+        return false;
+    }
+};
+exports.clearPublishingToken = clearPublishingToken;
+/**
+ * The cached Content Operations Brief API token, keyed by Sitecore
+ * `organizationId`. The Brief API is org-scoped — one minted token
+ * covers every env profile in the organization — so the cache key is
+ * the org id, not an env-profile name.
+ */
+const getBriefToken = async (orgId) => {
+    const ring = await loadKeyring();
+    if (!ring) {
         return undefined;
     }
+    return readPassword(ring, makeAccount(BRIEF_ACCOUNT_PREFIX, orgId));
+};
+exports.getBriefToken = getBriefToken;
+const setBriefToken = async (orgId, token) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
     try {
-        const raw = await keytar.getPassword(SERVICE_NAME, makeAccount(CM_ACCOUNT_PREFIX, envName));
-        if (!raw) {
-            return undefined;
-        }
-        return safeParse(raw);
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(BRIEF_ACCOUNT_PREFIX, orgId));
+        await entry.setPassword(token);
+        return true;
     }
     catch {
-        warnOnce("Unable to read CM tokens from the OS keychain.", "error");
+        warnOnce("Unable to write brief token to the OS keychain.", "error");
+        return false;
+    }
+};
+exports.setBriefToken = setBriefToken;
+const clearBriefToken = async (orgId) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(BRIEF_ACCOUNT_PREFIX, orgId));
+        return await entry.deleteCredential();
+    }
+    catch {
+        return false;
+    }
+};
+exports.clearBriefToken = clearBriefToken;
+const getCampaignToken = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return undefined;
+    }
+    return readPassword(ring, makeAccount(CAMPAIGN_ACCOUNT_PREFIX, envName));
+};
+exports.getCampaignToken = getCampaignToken;
+const setCampaignToken = async (envName, token) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(CAMPAIGN_ACCOUNT_PREFIX, envName));
+        await entry.setPassword(token);
+        return true;
+    }
+    catch {
+        warnOnce("Unable to write campaign token to the OS keychain.", "error");
+        return false;
+    }
+};
+exports.setCampaignToken = setCampaignToken;
+const clearCampaignToken = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(CAMPAIGN_ACCOUNT_PREFIX, envName));
+        return await entry.deleteCredential();
+    }
+    catch {
+        return false;
+    }
+};
+exports.clearCampaignToken = clearCampaignToken;
+/**
+ * The Agentic Studio browser session for an environment, stored as a
+ * JSON-serialized `AgentsCredential` (see `src/agents/session/types.ts`).
+ * Unlike the other entries here this is not an OAuth token — Agentic
+ * Studio has no machine-credential path yet, so scai captures a browser
+ * session cookie instead. Temporary; tracked in that file.
+ */
+const getAgentsCredential = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return undefined;
+    }
+    return readPassword(ring, makeAccount(AGENTS_ACCOUNT_PREFIX, envName));
+};
+exports.getAgentsCredential = getAgentsCredential;
+const setAgentsCredential = async (envName, credential) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(AGENTS_ACCOUNT_PREFIX, envName));
+        await entry.setPassword(credential);
+        return true;
+    }
+    catch {
+        warnOnce("Unable to write the Agentic Studio session to the OS keychain.", "error");
+        return false;
+    }
+};
+exports.setAgentsCredential = setAgentsCredential;
+const clearAgentsCredential = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(AGENTS_ACCOUNT_PREFIX, envName));
+        return await entry.deleteCredential();
+    }
+    catch {
+        return false;
+    }
+};
+exports.clearAgentsCredential = clearAgentsCredential;
+const getCmTokens = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return undefined;
+    }
+    const raw = await readPassword(ring, makeAccount(CM_ACCOUNT_PREFIX, envName));
+    if (!raw) {
         return undefined;
     }
+    return safeParse(raw);
 };
 exports.getCmTokens = getCmTokens;
 const setCmTokens = async (envName, tokens) => {
-    const keytar = await loadKeytar();
-    if (!keytar) {
+    const ring = await loadKeyring();
+    if (!ring) {
         return false;
     }
     try {
-        await keytar.setPassword(SERVICE_NAME, makeAccount(CM_ACCOUNT_PREFIX, envName), JSON.stringify(tokens));
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(CM_ACCOUNT_PREFIX, envName));
+        await entry.setPassword(JSON.stringify(tokens));
         return true;
     }
     catch {
@@ -162,16 +349,199 @@ const setCmTokens = async (envName, tokens) => {
 };
 exports.setCmTokens = setCmTokens;
 const clearCmTokens = async (envName) => {
-    const keytar = await loadKeytar();
-    if (!keytar) {
+    const ring = await loadKeyring();
+    if (!ring) {
         return false;
     }
     try {
-        return await keytar.deletePassword(SERVICE_NAME, makeAccount(CM_ACCOUNT_PREFIX, envName));
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(CM_ACCOUNT_PREFIX, envName));
+        return await entry.deleteCredential();
     }
     catch {
-        warnOnce("Unable to delete CM tokens from the OS keychain.", "error");
         return false;
     }
 };
 exports.clearCmTokens = clearCmTokens;
+/**
+ * The **secret** of the scai-minted env-scoped automation client for an
+ * environment. Stored under a distinct `cm-client:` prefix — separate
+ * from the `cm:` token bundle (which holds short-lived access/refresh
+ * tokens).
+ *
+ * Per `docs/credentials.md` the keychain holds only secrets: the
+ * client's non-secret metadata (`clientId`, `name`, `mintedAt`) lives in
+ * the env profile's `automationClient` block in `sitecoreai.cli.json`.
+ * `scai setup client create` writes the metadata to the config and the
+ * secret here.
+ */
+const getCmClientSecret = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return undefined;
+    }
+    return readPassword(ring, makeAccount(CM_CLIENT_ACCOUNT_PREFIX, envName));
+};
+exports.getCmClientSecret = getCmClientSecret;
+const setCmClientSecret = async (envName, secret) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(CM_CLIENT_ACCOUNT_PREFIX, envName));
+        await entry.setPassword(secret);
+        return true;
+    }
+    catch {
+        warnOnce("Unable to write the CM client secret to the OS keychain.", "error");
+        return false;
+    }
+};
+exports.setCmClientSecret = setCmClientSecret;
+const clearCmClientSecret = async (envName) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(CM_CLIENT_ACCOUNT_PREFIX, envName));
+        return await entry.deleteCredential();
+    }
+    catch {
+        return false;
+    }
+};
+exports.clearCmClientSecret = clearCmClientSecret;
+/**
+ * The **secret** of the scai-minted **org-level** automation client,
+ * keyed by Sitecore `organizationId`. This is the organization-scoped
+ * client `scai setup client create --org` provisions (the Deploy clients
+ * API `deploy` client type); one per org, shared by every env profile in
+ * that org.
+ *
+ * Per `docs/credentials.md` the keychain holds only secrets: the
+ * client's non-secret metadata (`clientId`, `name`, `mintedAt`) lives in
+ * the `orgClients[orgId]` block in `sitecoreai.cli.json`.
+ */
+const getOrgClientSecret = async (orgId) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return undefined;
+    }
+    return readPassword(ring, makeAccount(ORG_CLIENT_ACCOUNT_PREFIX, orgId));
+};
+exports.getOrgClientSecret = getOrgClientSecret;
+const setOrgClientSecret = async (orgId, secret) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(ORG_CLIENT_ACCOUNT_PREFIX, orgId));
+        await entry.setPassword(secret);
+        return true;
+    }
+    catch {
+        warnOnce("Unable to write the org automation client secret to the OS keychain.", "error");
+        return false;
+    }
+};
+exports.setOrgClientSecret = setOrgClientSecret;
+const clearOrgClientSecret = async (orgId) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(ORG_CLIENT_ACCOUNT_PREFIX, orgId));
+        return await entry.deleteCredential();
+    }
+    catch {
+        return false;
+    }
+};
+exports.clearOrgClientSecret = clearOrgClientSecret;
+/**
+ * Brand credentials are keyed by Sitecore `organizationId`, not by
+ * env profile. The AI APIs key is one-org-per-credential (Cloud Portal
+ * → Stream → Admin → AI APIs keys), so every env profile in the same
+ * org shares one credential. We store the client secret and the cached
+ * access token under separate entries to keep their lifecycles
+ * independent (token rotates ~daily; secret is long-lived).
+ */
+const getBrandClientSecret = async (orgId) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return undefined;
+    }
+    return readPassword(ring, makeAccount(BRAND_SECRET_ACCOUNT_PREFIX, orgId));
+};
+exports.getBrandClientSecret = getBrandClientSecret;
+const setBrandClientSecret = async (orgId, secret) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(BRAND_SECRET_ACCOUNT_PREFIX, orgId));
+        await entry.setPassword(secret);
+        return true;
+    }
+    catch {
+        warnOnce("Unable to write Brand client secret to the OS keychain.", "error");
+        return false;
+    }
+};
+exports.setBrandClientSecret = setBrandClientSecret;
+const clearBrandClientSecret = async (orgId) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(BRAND_SECRET_ACCOUNT_PREFIX, orgId));
+        return await entry.deleteCredential();
+    }
+    catch {
+        return false;
+    }
+};
+exports.clearBrandClientSecret = clearBrandClientSecret;
+const getBrandToken = async (orgId) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return undefined;
+    }
+    return readPassword(ring, makeAccount(BRAND_TOKEN_ACCOUNT_PREFIX, orgId));
+};
+exports.getBrandToken = getBrandToken;
+const setBrandToken = async (orgId, token) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(BRAND_TOKEN_ACCOUNT_PREFIX, orgId));
+        await entry.setPassword(token);
+        return true;
+    }
+    catch {
+        warnOnce("Unable to write Brand token to the OS keychain.", "error");
+        return false;
+    }
+};
+exports.setBrandToken = setBrandToken;
+const clearBrandToken = async (orgId) => {
+    const ring = await loadKeyring();
+    if (!ring) {
+        return false;
+    }
+    try {
+        const entry = new ring.AsyncEntry(SERVICE_NAME, makeAccount(BRAND_TOKEN_ACCOUNT_PREFIX, orgId));
+        return await entry.deleteCredential();
+    }
+    catch {
+        return false;
+    }
+};
+exports.clearBrandToken = clearBrandToken;

package/dist/shared/logger.d.ts

@@ -11,6 +11,8 @@ export declare class Logger {
     private writeToFile;
     private formatMessage;
     isJson(): boolean;
+    isVerbose(): boolean;
+    isQuiet(): boolean;
     info(message: string, color?: keyof typeof colors): void;
     warn(message: string, color?: keyof typeof colors): void;
     error(message: string, color?: keyof typeof colors): void;
@@ -21,4 +23,3 @@ export declare class Logger {
     log(level: LogLevel, message: string, color?: keyof typeof colors): void;
 }
 export {};
-//# sourceMappingURL=logger.d.ts.map

package/dist/shared/logger.js

@@ -58,6 +58,12 @@ class Logger {
     isJson() {
         return this.jsonEnabled;
     }
+    isVerbose() {
+        return this.verboseEnabled || this.traceEnabled;
+    }
+    isQuiet() {
+        return this.quietEnabled;
+    }
     info(message, color) {
         this.writeToFile("info", message);
         if (this.quietEnabled) {
@@ -125,7 +131,12 @@ class Logger {
     json(data) {
         const output = JSON.stringify(data, null, 2);
         this.writeToFile("info", output);
-        consola_1.consola.info(output);
+        // Write raw JSON to stdout — never through consola, which prefixes
+        // with `ℹ ` and would corrupt machine-readable output. This is the
+        // only Logger method that writes to stdout in --json mode; every
+        // other level (info/warn/error/verbose/debug/trace) is suppressed
+        // above when `jsonEnabled` is true.
+        process.stdout.write(`${output}\n`);
     }
     log(level, message, color) {
         switch (level) {

package/dist/shared/output.d.ts

@@ -4,4 +4,3 @@ export type OutputOptions = {
     logFile?: string;
 };
 export declare const resolveOutputOptionsFromArgs: (argv: string[]) => OutputOptions;
-//# sourceMappingURL=output.d.ts.map

package/dist/shared/prompt.d.ts

@@ -2,4 +2,3 @@ export declare const assertInteractive: (message: string, hint?: string) => void
 export declare const promptText: (label: string, defaultValue?: string) => Promise<string>;
 export declare const promptConfirm: (label: string, defaultValue?: boolean) => Promise<boolean>;
 export declare const promptSecret: (label: string, allowEmpty?: boolean) => Promise<string>;
-//# sourceMappingURL=prompt.d.ts.map

package/dist/shared/prompt.js

@@ -15,7 +15,7 @@ const assertInteractive = (message, hint) => {
             ? "Non-interactive mode: this command requires input. Provide flags or environment variables."
             : message;
         const finalHint = hint ?? "Provide required flags or environment variables for non-interactive use.";
-        throw (0, errors_1.createCliError)(finalMessage, "INPUT_INVALID", finalHint ? { hint: finalHint } : {});
+        throw (0, errors_1.createScaiError)(finalMessage, "INPUT_INVALID", finalHint ? { hint: finalHint } : {});
     }
 };
 exports.assertInteractive = assertInteractive;
@@ -56,7 +56,7 @@ const promptSecret = async (label, allowEmpty = false) => {
                 cleanup();
                 if (!allowEmpty && value.length === 0) {
                     const cleaned = label.trim().replace(/:$/, "");
-                    reject((0, errors_1.createCliError)(`${cleaned || "Secret"} is required.`, "INPUT_INVALID", {
+                    reject((0, errors_1.createScaiError)(`${cleaned || "Secret"} is required.`, "INPUT_INVALID", {
                         hint: "Provide a non-empty value.",
                     }));
                     return;