@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/shared/region.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * Region resolution — the single place scai derives a Sitecore
+ * organization's region code (e.g. `euw`) and builds a regional API host.
+ *
+ * Sitecore's regional services share one region per organization and
+ * differ only in hostname:
+ *   - Agentic Studio  `agentic-studio-{region}.sitecorecloud.io`
+ *   - Orchestrate     `ai-workflows-{region}.sitecorecloud.io`
+ *   - Brief           `co-brief-api-{region}.sitecorecloud.io`
+ *
+ * The region itself is read from `platform-inventory` — a versioned
+ * (`v1`), legitimate platform service — keyed by the org id scai already
+ * holds. Three layers, smallest first:
+ *
+ *   - `resolveRegion(orgId, token)` — the leaf primitive: one
+ *     `platform-inventory` call with a caller-supplied access token.
+ *   - `resolveRegionCode({ organizationId, acquireToken })` — env-aware:
+ *     mints the token lazily (only on a cache miss) through an injected
+ *     callback, so this module depends on nothing but `fetch`.
+ *   - `resolveRegionalBaseUrl({ …, hostTemplate, override })` — the
+ *     convenience every regional area calls: honour an explicit per-env
+ *     host override, else resolve the region and fill a host template.
+ *
+ * The token must carry `platform.tenants:listall` (scai's automation
+ * client is provisioned with it; see `SCAI_API_SCOPES`). The caller owns
+ * how that token is obtained — campaign reuses its no-scope Orchestrate
+ * token, brief/agents mint a fresh no-scope M2M token — which is why the
+ * token enters through a callback rather than a hard dependency.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearRegionCache = exports.resolveRegionalBaseUrl = exports.regionalHost = exports.resolveRegionCode = exports.resolveRegion = exports.DEFAULT_REGION = void 0;
+const PLATFORM_INVENTORY_BASE = "https://platform-inventory.sitecorecloud.io";
+/** Region code used when resolution is unavailable — EU West. */
+exports.DEFAULT_REGION = "euw";
+/** Resolved regions, cached per organization for the process lifetime. */
+const regionCache = new Map();
+/** A tenant carries the region directly, or under `labels.RegionCode`. */
+const regionOf = (tenant) => tenant.region ?? tenant.labels?.RegionCode ?? undefined;
+/**
+ * Resolve a Sitecore organization's region code from `platform-inventory`.
+ *
+ * **Best-effort.** Any failure — no/invalid token, wrong audience,
+ * network, an org with no regioned tenant — falls back to
+ * `DEFAULT_REGION`, so a caller always gets a usable region and a
+ * regional host is always buildable. Cached per organization.
+ *
+ * `accessToken` must carry `platform.tenants:listall`; scai's automation
+ * client is provisioned with it.
+ */
+const resolveRegion = async (organizationId, accessToken) => {
+    const cached = regionCache.get(organizationId);
+    if (cached)
+        return cached;
+    let region = exports.DEFAULT_REGION;
+    try {
+        const url = `${PLATFORM_INVENTORY_BASE}/api/inventory/v1/tenants` +
+            `?organizationId=${encodeURIComponent(organizationId)}&state=Active&pagesize=100`;
+        const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/json" },
+        });
+        if (response.ok) {
+            const body = (await response.json());
+            for (const tenant of body.data ?? []) {
+                const found = regionOf(tenant);
+                if (found) {
+                    region = found;
+                    break;
+                }
+            }
+        }
+    }
+    catch {
+        /* best-effort — fall back to DEFAULT_REGION */
+    }
+    regionCache.set(organizationId, region);
+    return region;
+};
+exports.resolveRegion = resolveRegion;
+/**
+ * Resolve a region code env-aware: org id → token → `platform-inventory`.
+ *
+ * **Best-effort**, like `resolveRegion`. The `acquireToken` callback is
+ * invoked only when the region isn't already cached for the org and no
+ * id-less short-circuit applies, so a token is never minted needlessly.
+ */
+const resolveRegionCode = async (options) => {
+    const { organizationId } = options;
+    if (!organizationId)
+        return exports.DEFAULT_REGION;
+    const cached = regionCache.get(organizationId);
+    if (cached)
+        return cached;
+    let token;
+    try {
+        token = await options.acquireToken();
+    }
+    catch {
+        /* best-effort — a missing/failing token resolver yields DEFAULT_REGION */
+    }
+    if (!token)
+        return exports.DEFAULT_REGION;
+    return (0, exports.resolveRegion)(organizationId, token);
+};
+exports.resolveRegionCode = resolveRegionCode;
+/**
+ * Fill a regional host template — the `{region}` placeholder is replaced
+ * with the region code. e.g. `regionalHost("https://ai-workflows-{region}.sitecorecloud.io", "euw")`.
+ */
+const regionalHost = (template, region) => template.replace("{region}", region);
+exports.regionalHost = regionalHost;
+/**
+ * Resolve a regional API base URL — the single entry point regional
+ * areas (campaign, brief) call to pick their host.
+ *
+ * An `override` (a per-env pinned host) wins outright. Otherwise the
+ * region is resolved from the org id and `hostTemplate` is filled.
+ * Best-effort throughout — an unresolvable region yields the
+ * `DEFAULT_REGION` host, never an error.
+ */
+const resolveRegionalBaseUrl = async (options) => {
+    if (options.override)
+        return options.override;
+    return (0, exports.regionalHost)(options.hostTemplate, await (0, exports.resolveRegionCode)(options));
+};
+exports.resolveRegionalBaseUrl = resolveRegionalBaseUrl;
+/** Drop a cached region — used by tests; the cache is otherwise permanent. */
+const clearRegionCache = () => regionCache.clear();
+exports.clearRegionCache = clearRegionCache;

package/dist/shared/rwlock.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Async read/write lock.
+ *
+ * Many concurrent readers OR one exclusive writer. Used by the MCP
+ * dispatcher to let read tools (`*_inspect`, `environment_status`, …)
+ * run in parallel while still serializing writes against everything.
+ *
+ * **Writer preference.** Queued writers are admitted before queued
+ * readers when a write releases. This is the right default for scai:
+ * an agent issuing a steady stream of reads must not starve a queued
+ * `recipe_push` waiting to grab the exclusive slot.
+ *
+ * **Cancellation.** This primitive does not unwind a queued acquire when
+ * its caller is cancelled. Callers that care should check their
+ * AbortSignal immediately after `withRead`/`withWrite` admits them and
+ * bail before doing real work. Holding the lock for the duration of a
+ * no-op bail is negligible.
+ */
+export interface RwLockSnapshot {
+    readers: number;
+    writerActive: boolean;
+    waitingReaders: number;
+    waitingWriters: number;
+}
+export declare class RwLock {
+    private readers;
+    private writerActive;
+    private waitingReaders;
+    private waitingWriters;
+    withRead<T>(task: () => Promise<T>): Promise<T>;
+    withWrite<T>(task: () => Promise<T>): Promise<T>;
+    private acquireRead;
+    private releaseRead;
+    private acquireWrite;
+    private releaseWrite;
+    /** Snapshot of internal state — for tests and diagnostics. */
+    snapshot(): RwLockSnapshot;
+    /**
+     * Drop all state. Used by tests to ensure no Promise-chain residue
+     * carries across `describe` blocks. Production callers don't need this.
+     */
+    reset(): void;
+}

package/dist/shared/rwlock.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * Async read/write lock.
+ *
+ * Many concurrent readers OR one exclusive writer. Used by the MCP
+ * dispatcher to let read tools (`*_inspect`, `environment_status`, …)
+ * run in parallel while still serializing writes against everything.
+ *
+ * **Writer preference.** Queued writers are admitted before queued
+ * readers when a write releases. This is the right default for scai:
+ * an agent issuing a steady stream of reads must not starve a queued
+ * `recipe_push` waiting to grab the exclusive slot.
+ *
+ * **Cancellation.** This primitive does not unwind a queued acquire when
+ * its caller is cancelled. Callers that care should check their
+ * AbortSignal immediately after `withRead`/`withWrite` admits them and
+ * bail before doing real work. Holding the lock for the duration of a
+ * no-op bail is negligible.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RwLock = void 0;
+class RwLock {
+    constructor() {
+        this.readers = 0;
+        this.writerActive = false;
+        this.waitingReaders = [];
+        this.waitingWriters = [];
+    }
+    async withRead(task) {
+        await this.acquireRead();
+        try {
+            return await task();
+        }
+        finally {
+            this.releaseRead();
+        }
+    }
+    async withWrite(task) {
+        await this.acquireWrite();
+        try {
+            return await task();
+        }
+        finally {
+            this.releaseWrite();
+        }
+    }
+    acquireRead() {
+        // Block new readers when a writer is queued so writes don't starve
+        // under a steady read load.
+        if (!this.writerActive && this.waitingWriters.length === 0) {
+            this.readers += 1;
+            return Promise.resolve();
+        }
+        return new Promise((resolve) => {
+            this.waitingReaders.push(resolve);
+        });
+    }
+    releaseRead() {
+        this.readers -= 1;
+        if (this.readers === 0 && this.waitingWriters.length > 0) {
+            this.writerActive = true;
+            const next = this.waitingWriters.shift();
+            next?.();
+        }
+    }
+    acquireWrite() {
+        if (!this.writerActive && this.readers === 0) {
+            this.writerActive = true;
+            return Promise.resolve();
+        }
+        return new Promise((resolve) => {
+            this.waitingWriters.push(resolve);
+        });
+    }
+    releaseWrite() {
+        this.writerActive = false;
+        if (this.waitingWriters.length > 0) {
+            this.writerActive = true;
+            const next = this.waitingWriters.shift();
+            next?.();
+            return;
+        }
+        if (this.waitingReaders.length > 0) {
+            const waiters = this.waitingReaders.splice(0);
+            this.readers += waiters.length;
+            for (const w of waiters)
+                w();
+        }
+    }
+    /** Snapshot of internal state — for tests and diagnostics. */
+    snapshot() {
+        return {
+            readers: this.readers,
+            writerActive: this.writerActive,
+            waitingReaders: this.waitingReaders.length,
+            waitingWriters: this.waitingWriters.length,
+        };
+    }
+    /**
+     * Drop all state. Used by tests to ensure no Promise-chain residue
+     * carries across `describe` blocks. Production callers don't need this.
+     */
+    reset() {
+        this.readers = 0;
+        this.writerActive = false;
+        this.waitingReaders = [];
+        this.waitingWriters = [];
+    }
+}
+exports.RwLock = RwLock;

package/dist/shared/spinner.d.ts

@@ -2,4 +2,3 @@ export declare const startSpinner: (text: string) => Promise<{
     succeed: (text?: string) => void;
     fail: (text?: string) => void;
 } | null>;
-//# sourceMappingURL=spinner.d.ts.map

package/dist/shared/style.d.ts

@@ -1,2 +1 @@
 export declare const showBanner: (version: string) => void;
-//# sourceMappingURL=style.d.ts.map

package/dist/shared/telemetry.d.ts

@@ -7,7 +7,15 @@ type TelemetryEvent = {
     error?: string;
     configPath?: string;
 };
-export declare const ensureTelemetryConsent: (configPath?: string) => Promise<void>;
+/**
+ * Telemetry is opt-out: enabled by default, disabled only by an explicit
+ * signal — the persisted `telemetryEnabled` preference (set via
+ * `scai cli telemetry disable`), the `SITECOREAI_TELEMETRY` env override,
+ * or the cross-tool `DO_NOT_TRACK` standard. On the first interactive run
+ * this surfaces a one-time notice instead of a consent prompt, then
+ * persists `telemetryEnabled: true` so the notice shows exactly once.
+ */
+export declare const ensureTelemetryNotice: (configPath?: string) => Promise<void>;
 export declare const setTelemetryVersion: (version: string) => void;
 export declare const resolveConfigPathFromArgs: (argv: string[]) => string | undefined;
 export declare const formatTelemetryCommand: (args: string[]) => string;
@@ -17,5 +25,10 @@ export declare const getTelemetryStatus: (configPath?: string) => {
     source: string;
     url: string;
 };
+/**
+ * Persist `settings.telemetryEnabled` to the root config. Telemetry is
+ * opt-out (on by default), so disabling is the primary use; enabling
+ * exists for symmetry and to undo a prior disable.
+ */
+export declare const setTelemetryEnabled: (configPath: string, enabled: boolean) => void;
 export {};
-//# sourceMappingURL=telemetry.d.ts.map

package/dist/shared/telemetry.js

@@ -3,12 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getTelemetryStatus = exports.recordTelemetry = exports.formatTelemetryCommand = exports.resolveConfigPathFromArgs = exports.setTelemetryVersion = exports.ensureTelemetryConsent = void 0;
+exports.setTelemetryEnabled = exports.getTelemetryStatus = exports.recordTelemetry = exports.formatTelemetryCommand = exports.resolveConfigPathFromArgs = exports.setTelemetryVersion = exports.ensureTelemetryNotice = void 0;
 const consola_1 = require("consola");
 const node_crypto_1 = require("node:crypto");
-const promises_1 = __importDefault(require("node:readline/promises"));
 const ajv_draft_04_1 = __importDefault(require("ajv-draft-04"));
-const config_1 = require("../config");
+const root_config_1 = require("../config/root-config");
 const telemetry_schema_json_1 = __importDefault(require("../config/telemetry.schema.json"));
 const redact_1 = require("./redact");
 let cliVersion = null;
@@ -39,18 +38,26 @@ const isCI = () => Boolean(process.env.CI ||
     process.env.TEAMCITY_VERSION);
 const tryReadRootConfigurationFile = (configPath) => {
     try {
-        return (0, config_1.readRootConfigurationFile)(configPath);
+        return (0, root_config_1.readRootConfigurationFile)(configPath);
     }
     catch {
         return null;
     }
 };
-const ensureTelemetryConsent = async (configPath) => {
+/**
+ * Telemetry is opt-out: enabled by default, disabled only by an explicit
+ * signal — the persisted `telemetryEnabled` preference (set via
+ * `scai cli telemetry disable`), the `SITECOREAI_TELEMETRY` env override,
+ * or the cross-tool `DO_NOT_TRACK` standard. On the first interactive run
+ * this surfaces a one-time notice instead of a consent prompt, then
+ * persists `telemetryEnabled: true` so the notice shows exactly once.
+ */
+const ensureTelemetryNotice = async (configPath) => {
     const override = toBoolean(process.env.SITECOREAI_TELEMETRY);
     if (override !== undefined) {
         return;
     }
-    if (process.env.DISABLE_TELEMETRY || process.env.DO_NOT_TRACK) {
+    if (process.env.DO_NOT_TRACK) {
         return;
     }
     if (!configPath) {
@@ -64,60 +71,62 @@ const ensureTelemetryConsent = async (configPath) => {
     if (typeof existing === "boolean") {
         return;
     }
+    // No notice in non-interactive contexts (CI, MCP, piped output).
+    // Telemetry still defaults on via resolveTelemetryStatus; the notice
+    // is shown the first time scai runs in a real terminal.
     if (isCI() || !process.stdin.isTTY || !process.stdout.isTTY) {
         return;
     }
-    const rl = promises_1.default.createInterface({
-        input: process.stdin,
-        output: process.stdout,
-    });
+    consola_1.consola.info("scai sends anonymous usage telemetry — command names and timings only, " +
+        "never code, arguments, or credentials — to help improve the CLI. " +
+        "It is enabled by default.\n" +
+        "Opt out anytime with `scai cli telemetry disable`, or set DO_NOT_TRACK=1. " +
+        "Details: docs/telemetry-and-privacy.md");
+    // Persist the default so the notice shows exactly once.
     try {
-        const answer = await rl.question("Allow anonymous telemetry to improve the SitecoreAI CLI? (y/N) ");
-        const accepted = ["y", "yes"].includes(answer.trim().toLowerCase());
         const nextConfig = {
             ...root.config,
             settings: {
                 ...(root.config.settings ?? {}),
-                telemetryEnabled: accepted,
+                telemetryEnabled: true,
             },
         };
-        (0, config_1.writeRootConfigurationFile)(root.rootPath, nextConfig);
-        if (accepted) {
-            consola_1.consola.info("Telemetry enabled. Thank you!");
-        }
-        else {
-            consola_1.consola.info("Telemetry disabled. You can re-enable it later.");
-        }
+        (0, root_config_1.writeRootConfigurationFile)(root.rootPath, nextConfig);
     }
     catch (error) {
-        consola_1.consola.debug(`Telemetry consent prompt failed: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    finally {
-        rl.close();
+        consola_1.consola.debug(`Telemetry notice persist failed: ${error instanceof Error ? error.message : String(error)}`);
     }
 };
-exports.ensureTelemetryConsent = ensureTelemetryConsent;
+exports.ensureTelemetryNotice = ensureTelemetryNotice;
 const resolveTelemetryStatus = (configPath) => {
     const override = toBoolean(process.env.SITECOREAI_TELEMETRY);
     if (override !== undefined) {
         return { enabled: override, source: "env SITECOREAI_TELEMETRY" };
     }
-    if (process.env.DISABLE_TELEMETRY || process.env.DO_NOT_TRACK) {
-        return { enabled: false, source: "env DISABLE_TELEMETRY/DO_NOT_TRACK" };
+    if (process.env.DO_NOT_TRACK) {
+        return { enabled: false, source: "env DO_NOT_TRACK" };
     }
+    // Opt-out model: with no explicit signal, telemetry is on. A missing
+    // root config therefore resolves to enabled, not disabled.
     if (!configPath) {
-        return { enabled: false, source: "config not found" };
+        return { enabled: true, source: "default (opt-out)" };
     }
     const root = tryReadRootConfigurationFile(configPath);
     if (!root) {
-        return { enabled: false, source: "config not found" };
+        return { enabled: true, source: "default (opt-out)" };
     }
-    return {
-        enabled: root.config.settings?.telemetryEnabled ?? false,
-        source: "config settings.telemetryEnabled",
-    };
+    const configured = root.config.settings?.telemetryEnabled;
+    if (typeof configured === "boolean") {
+        return { enabled: configured, source: "config settings.telemetryEnabled" };
+    }
+    return { enabled: true, source: "default (opt-out)" };
 };
-const DEFAULT_TELEMETRY_URL = "https://telemetry-api-ten.vercel.app/v1/t";
+// Hostname under a domain the project controls (cf. the $id schema URL at
+// https://schemas.sitecoreai.dev/v1/telemetry.schema.json — DNS is in the
+// same zone). Replaces the previous telemetry-api-ten.vercel.app default,
+// which was a Vercel preview-style subdomain and therefore squattable.
+// Override per-invocation with SITECOREAI_TELEMETRY_URL.
+const DEFAULT_TELEMETRY_URL = "https://cli-telemetry.sitecoreai.dev/v1/t";
 const getTelemetryUrl = () => process.env.SITECOREAI_TELEMETRY_URL ?? DEFAULT_TELEMETRY_URL;
 const setTelemetryVersion = (version) => {
     cliVersion = version;
@@ -224,3 +233,19 @@ const getTelemetryStatus = (configPath) => {
     return { ...status, url: getTelemetryUrl() };
 };
 exports.getTelemetryStatus = getTelemetryStatus;
+/**
+ * Persist `settings.telemetryEnabled` to the root config. Telemetry is
+ * opt-out (on by default), so disabling is the primary use; enabling
+ * exists for symmetry and to undo a prior disable.
+ */
+const setTelemetryEnabled = (configPath, enabled) => {
+    const root = (0, root_config_1.readRootConfigurationFile)(configPath);
+    (0, root_config_1.writeRootConfigurationFile)(root.rootPath, {
+        ...root.config,
+        settings: {
+            ...(root.config.settings ?? {}),
+            telemetryEnabled: enabled,
+        },
+    });
+};
+exports.setTelemetryEnabled = setTelemetryEnabled;

package/dist/shared/topics.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The intent-based command index — `scai`'s curated map of "what am I
+ * trying to do" → "which commands to run, in order".
+ *
+ * The `--help` tree is alphabetical; this list groups commands by
+ * *workflow* ("why won't this delete?", "clean up after a site
+ * removal") so operators and agents reinventing an existing primitive
+ * because they didn't know what to grep for is the discoverability bug
+ * this addresses.
+ *
+ * Curated, hand-edited data — not auto-generated. It lives in `shared/`
+ * (a leaf, no imports) so both surfaces consume ONE copy: the CLI
+ * `scai cli topics` command renders it as text/JSON, and the MCP
+ * `scai://help/topics` resource renders it as markdown. Keeping a single
+ * source is the point — a topic list that drifts between the CLI and
+ * the agent surface is worse than none.
+ *
+ * The cost is keeping this in sync when commands move; the payoff is
+ * groupings that reflect workflows, not the command-tree layout.
+ */
+export interface TopicCommand {
+    command: string;
+    description: string;
+}
+export interface Topic {
+    /** Short slug for `scai cli topics <name>`. */
+    name: string;
+    /** One-line description shown in the index. */
+    description: string;
+    /** Commands grouped under the topic, in recommended-run order. */
+    commands: TopicCommand[];
+}
+export declare const TOPICS: Topic[];

package/dist/shared/topics.js

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * The intent-based command index — `scai`'s curated map of "what am I
+ * trying to do" → "which commands to run, in order".
+ *
+ * The `--help` tree is alphabetical; this list groups commands by
+ * *workflow* ("why won't this delete?", "clean up after a site
+ * removal") so operators and agents reinventing an existing primitive
+ * because they didn't know what to grep for is the discoverability bug
+ * this addresses.
+ *
+ * Curated, hand-edited data — not auto-generated. It lives in `shared/`
+ * (a leaf, no imports) so both surfaces consume ONE copy: the CLI
+ * `scai cli topics` command renders it as text/JSON, and the MCP
+ * `scai://help/topics` resource renders it as markdown. Keeping a single
+ * source is the point — a topic list that drifts between the CLI and
+ * the agent surface is worse than none.
+ *
+ * The cost is keeping this in sync when commands move; the payoff is
+ * groupings that reflect workflows, not the command-tree layout.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOPICS = void 0;
+exports.TOPICS = [
+    {
+        name: "diagnose-blocked-delete",
+        description: "Find out why a Sitecore item won't delete — what references hold it.",
+        commands: [
+            {
+                command: "scai hygiene explain why-blocked <itemId>",
+                description: "One-shot: run audit references + audit template-dependencies and merge the findings, sorted by kind",
+            },
+            {
+                command: "scai hygiene audit references --to <itemId>",
+                description: "Walk content fields for items whose value mentions the target (slow but broad)",
+            },
+            {
+                command: "scai hygiene audit template-dependencies --template-id <itemId>",
+                description: "Index-driven check for the five structural reference shapes (base-template, insert-options, …)",
+            },
+        ],
+    },
+    {
+        name: "clean-orphan-content",
+        description: "Delete the residue left after a Sites-API site delete or a subtree-removal mistake.",
+        commands: [
+            {
+                command: "scai hygiene explain orphan-site <site>",
+                description: "One-shot: list orphan trees for a deleted site and flag the ones still referenced by live content",
+            },
+            {
+                command: "scai hygiene audit site-residue list",
+                description: "Find orphan tenant/site folders in /sitecore/templates, /layout, /media library",
+            },
+            {
+                command: "scai hygiene cleanup site-residue purge --apply",
+                description: "Delete the orphans flagged by the audit; honors a pre-flight ref scan",
+            },
+            {
+                command: "scai hygiene cleanup subtree delete --path <root> --apply",
+                description: "Bottom-up cascade delete of a subtree; hard-blocks on external inbound references",
+            },
+        ],
+    },
+    {
+        name: "manage-known-debt",
+        description: "Accept known-good findings into a per-env baseline so CI only flags new regressions.",
+        commands: [
+            {
+                command: "scai hygiene audit X list",
+                description: "Every audit shows the baseline count under its headline (since 2026-05-14)",
+            },
+            {
+                command: "scai hygiene audit X list --baseline",
+                description: "Filter out findings already in the baseline (CI / drift mode)",
+            },
+            {
+                command: "scai hygiene audit X list --json | scai hygiene audit baseline accept --audit X",
+                description: "Pipe an audit envelope into the baseline (idempotent)",
+            },
+            {
+                command: "scai hygiene audit baseline show / remove / reset",
+                description: "Inspect and edit the baseline file (.scai/audit-baseline-<env>.json)",
+            },
+        ],
+    },
+    {
+        name: "deduplicate-content",
+        description: "Find and merge items with identical content hashes.",
+        commands: [
+            {
+                command: "scai hygiene audit duplicates list",
+                description: "Group items by content hash (excluding system fields by default)",
+            },
+            {
+                command: "scai hygiene audit duplicates list --json | scai hygiene cleanup duplicates purge --from-stdin --apply",
+                description: "Pipeline: skip the cleanup's internal audit re-run by piping the audit's findings in",
+            },
+            {
+                command: "scai hygiene cleanup duplicates purge --apply",
+                description: "Pick a survivor per group (--keep-rule) and delete the rest; pre-flight ref scan blocks unsafe deletes",
+            },
+        ],
+    },
+    {
+        name: "pipeline-audit-cleanup",
+        description: "Compose an audit + its cleanup in one shell pipeline to avoid running the same scan twice.",
+        commands: [
+            {
+                command: "scai hygiene audit X list --json | scai hygiene cleanup X --from-stdin --apply",
+                description: "Cleanup reads findings from stdin instead of re-running the audit; supported on duplicates today, more cleanups in follow-ups",
+            },
+            {
+                command: "scai hygiene audit X list --json | scai hygiene audit baseline accept --audit X",
+                description: "Pipe an audit envelope into the baseline (same shape — composes naturally)",
+            },
+        ],
+    },
+    {
+        name: "sync-recipes-across-domains",
+        description: "Capture, diff, and converge every brand kit and brief type as recipe files.",
+        commands: [
+            {
+                command: "scai sync pull",
+                description: "Enumerate every brand kit + brief type and capture each as a recipe file",
+            },
+            {
+                command: "scai sync status",
+                description: "Diff every recipe file in the workspace against the environment",
+            },
+            {
+                command: "scai sync push --allow-write",
+                description: "Converge every recipe file onto the environment (dry-run without the flag)",
+            },
+        ],
+    },
+    {
+        name: "automate-with-agents",
+        description: "Run scai from an MCP-compatible agent host (Claude Code, Cursor, Windsurf, …).",
+        commands: [
+            {
+                command: "scai mcp serve",
+                description: "Launch the stdio MCP server bound to a single environment; defers keychain access to first tool call",
+            },
+            {
+                command: "scai mcp tools list / schema",
+                description: "Offline inspector for the workflow-shaped tools the server exposes",
+            },
+        ],
+    },
+];

package/dist/shared/validate.d.ts

@@ -1,3 +1,2 @@
 export declare const assertValidUrl: (value: string, label: string) => void;
 export declare const assertValidHost: (value: string, label: string) => void;
-//# sourceMappingURL=validate.d.ts.map