@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/commands/history.js

@@ -1,11 +1,7 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createHistoryCommand = void 0;
 const commander_1 = require("commander");
-const promises_1 = __importDefault(require("node:fs/promises"));
 const logger_1 = require("../shared/logger");
 const history_1 = require("../shared/history");
 const shared_1 = require("./shared");
@@ -29,7 +25,7 @@ const createHistoryCommand = () => {
         .addOption(new commander_1.Option("--reverse", "Show newest entries first"))
         .addOption(new commander_1.Option("--show-path", "Show the history log path and exit"));
     (0, shared_1.addVerbosityOptions)(command);
-    command.addHelpText("after", "\nExamples:\n  $ scai history --limit 20\n  $ scai history --show-path\n");
+    command.addHelpText("after", "\nExamples:\n  $ scai cli history --limit 20\n  $ scai cli history --show-path\n");
     command.action(async (options) => {
         const logger = new logger_1.Logger(Boolean(options.verbose), Boolean(options.trace), Boolean(options.json), Boolean(options.quiet), options.logFile);
         const filePath = options.path ?? (0, history_1.getHistoryPath)();
@@ -43,44 +39,17 @@ const createHistoryCommand = () => {
             return;
         }
         const limit = options.limit ?? 50;
-        try {
-            const content = await promises_1.default.readFile(filePath, "utf8");
-            const lines = content.split("\n").filter((line) => line.trim().length > 0);
-            const selected = limit > 0 ? lines.slice(-limit) : lines;
-            const output = options.reverse ? selected.reverse() : selected;
-            if (logger.isJson()) {
-                const parsed = output.map((line) => {
-                    try {
-                        return JSON.parse(line);
-                    }
-                    catch {
-                        return { raw: line };
-                    }
-                });
-                logger.json(parsed);
-                return;
-            }
-            for (const line of output) {
-                if (options.raw) {
-                    logger.info(line);
-                    continue;
-                }
-                try {
-                    logger.info(formatEntry(JSON.parse(line)));
-                }
-                catch {
-                    logger.info(line);
-                }
-            }
+        const entries = await (0, history_1.readHistory)({ path: options.path, limit, reverse: options.reverse });
+        if (logger.isJson()) {
+            logger.json(entries.map(({ raw, entry }) => entry ?? { raw }));
+            return;
         }
-        catch (error) {
-            if (error instanceof Error &&
-                "code" in error &&
-                error.code === "ENOENT") {
-                logger.warn(`No history file found at ${filePath}.`);
-                return;
-            }
-            throw error;
+        if (entries.length === 0) {
+            logger.info(`No CLI history recorded yet — log file: ${filePath}`);
+            return;
+        }
+        for (const { raw, entry } of entries) {
+            logger.info(options.raw || !entry ? raw : formatEntry(entry));
         }
     });
     return command;

package/dist/commands/init.d.ts

@@ -1,3 +1,2 @@
 import { Command } from "commander";
 export declare const createInitCommand: () => Command;
-//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createInitCommand = void 0;
 const commander_1 = require("commander");
 const shared_1 = require("./shared");
-const tasks_1 = require("../serialization/tasks");
+const init_1 = require("../serialization/tasks/env/init");
 const createInitCommand = () => {
     const command = new commander_1.Command("init").description("Create or update an environment with project selection and SitecoreAI credentials");
     (0, shared_1.addEnvironmentOption)(command);
@@ -15,18 +15,52 @@ const createInitCommand = () => {
         .addOption(new commander_1.Option("--allow-write", "Allow write operations for this environment"))
         .addOption(new commander_1.Option("--wizard", "Run the interactive setup wizard"))
         .addOption(new commander_1.Option("--skip-deploy-lookup", "Skip Deploy API lookups and prompt for the CM host directly"))
-        .addOption(new commander_1.Option("--organization-id <id>", "Sitecore organization ID"))
-        .addOption(new commander_1.Option("--tenant-id <id>", "Sitecore tenant ID"))
-        .addOption(new commander_1.Option("--organization <name>", "Organization name or ID (Deploy API)"))
-        .addOption(new commander_1.Option("--project <value>", "Project name or ID (Deploy API)"))
-        .addOption(new commander_1.Option("--environment <value>", "Environment name or ID (Deploy API)"))
+        .addOption(new commander_1.Option("--organization-id <id>", "Sitecore organization ID (written to the profile)"))
+        .addOption(new commander_1.Option("--tenant-id <id>", "Sitecore tenant ID (written to the profile)"))
+        .addOption(new commander_1.Option("--deploy-organization <value>", "Organization name or ID for the Deploy API environment lookup"))
+        .addOption(new commander_1.Option("--project <value>", "Project name or ID for the Deploy API lookup"))
+        .addOption(new commander_1.Option("--deploy-environment <value>", "Environment name or ID for the Deploy API environment lookup"))
+        // Back-compat hidden aliases. The bare `--organization` / `--environment`
+        // collided with `--organization-id` / `--environment-name`; the
+        // `--deploy-*` spellings are the documented names. Old scripts keep working.
+        .addOption(new commander_1.Option("--organization <value>", "Alias of --deploy-organization.").hideHelp())
+        .addOption(new commander_1.Option("--environment <value>", "Alias of --deploy-environment.").hideHelp())
         .addOption(new commander_1.Option("--deploy-token <token>", "SitecoreAI access token (Deploy + CM/admin scopes)"))
         .addOption(new commander_1.Option("--client-id <id>", "SitecoreAI client ID"))
         .addOption(new commander_1.Option("--client-secret <secret>", "SitecoreAI client secret"))
         .addOption(new commander_1.Option("--use-client-credentials", "Use client credentials instead of interactive login"))
         .addOption(new commander_1.Option("--set-default", "Set as default environment"));
-    command.addHelpText("after", '\nExamples:\n  $ scai init --wizard\n  $ scai init -n demo --project "My Project" --environment "Dev"\n');
-    command.action(async (options) => (0, tasks_1.runInit)(options));
+    command.addHelpText("after", [
+        "",
+        "Most setups should just run the wizard — it fills in everything below:",
+        "  $ scai setup init --wizard",
+        "",
+        "For scripted (non-interactive) setup, the flags fall into groups:",
+        "",
+        "  Identify the environment — via the Deploy API:",
+        "    --deploy-organization  --project  --deploy-environment",
+        "  ...or skip the Deploy API and point at a CM host directly:",
+        "    --cm <url>  --skip-deploy-lookup",
+        "",
+        "  Authentication — pick one:",
+        "    --deploy-token <token>",
+        "    --client-id <id>  --client-secret <secret>  --use-client-credentials",
+        "",
+        "  Identifiers written to the profile:",
+        "    --organization-id  --tenant-id",
+        "",
+        "Examples:",
+        '  $ scai setup init -n demo --project "My Project" --deploy-environment "Dev"',
+        "",
+    ].join("\n"));
+    // `--deploy-organization` / `--deploy-environment` are the documented
+    // flags; `--organization` / `--environment` remain as hidden aliases.
+    // The task layer (runInit) still reads `organization` / `environment`.
+    command.action(async (options) => (0, init_1.runInit)({
+        ...options,
+        organization: options.deployOrganization ?? options.organization,
+        environment: options.deployEnvironment ?? options.environment,
+    }));
     return command;
 };
 exports.createInitCommand = createInitCommand;

package/dist/commands/login.d.ts

@@ -1,3 +1,13 @@
 import { Command } from "commander";
+/**
+ * `scai setup login` — the one-time interactive device login that
+ * mints a deploy token (the bootstrap credential). The token is used
+ * to call the clients API and mint the automation client(s) via
+ * `scai setup client create`; after that the automation client is
+ * self-sufficient.
+ *
+ * `setup login brand` survives as a deprecated alias for
+ * `scai setup client register-brand` — the canonical brand verb now
+ * lives under `setup client`.
+ */
 export declare const createLoginCommand: () => Command;
-//# sourceMappingURL=login.d.ts.map

package/dist/commands/login.js

@@ -3,19 +3,50 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createLoginCommand = void 0;
 const commander_1 = require("commander");
 const shared_1 = require("./shared");
-const tasks_1 = require("../serialization/tasks");
+const deploy_token_1 = require("../serialization/tasks/env/deploy-token");
+const setup_client_1 = require("./setup-client");
+/**
+ * `scai setup login` — the one-time interactive device login that
+ * mints a deploy token (the bootstrap credential). The token is used
+ * to call the clients API and mint the automation client(s) via
+ * `scai setup client create`; after that the automation client is
+ * self-sufficient.
+ *
+ * `setup login brand` survives as a deprecated alias for
+ * `scai setup client register-brand` — the canonical brand verb now
+ * lives under `setup client`.
+ */
 const createLoginCommand = () => {
     const command = new commander_1.Command("login").description("Authenticate with SitecoreAI and store an access token (Deploy + CM/admin scopes)");
     (0, shared_1.addEnvironmentOption)(command);
     (0, shared_1.addConfigOption)(command);
-    (0, shared_1.addVerbosityOptions)(command);
+    // No `--non-interactive`: interactive login is a browser device flow
+    // that cannot run headless, and the client-credentials path is
+    // already non-interactive once --client-id/--client-secret are given.
+    (0, shared_1.addVerbosityOptions)(command, { nonInteractive: false });
     command
         .addOption(new commander_1.Option("--client-id <id>", "SitecoreAI client ID"))
         .addOption(new commander_1.Option("--client-secret <secret>", "SitecoreAI client secret"))
         .addOption(new commander_1.Option("--use-client-credentials", "Use client credentials instead of interactive login"))
         .addOption(new commander_1.Option("--print", "Print the access token to stdout"));
-    command.addHelpText("after", "\nExamples:\n  $ scai login -n demo\n  $ scai login -n demo --use-client-credentials\n");
-    command.action(async (options) => (0, tasks_1.runDeployToken)(options));
+    command.addHelpText("after", [
+        "",
+        "Two ways to authenticate:",
+        "  • interactive (default) — a browser device flow; a human signs in.",
+        "  • client credentials   — a machine credential (--use-client-credentials",
+        "    with --client-id/--client-secret); no browser, for CI and agents.",
+        "Both yield the same access token (it covers Deploy, CM/admin, and Brief).",
+        "",
+        "Examples:",
+        "  $ scai setup login -n demo",
+        "  $ scai setup login -n demo --use-client-credentials --client-id <id> --client-secret <secret>",
+        "",
+        "To register the brand credential, use `scai setup client register-brand`",
+        "(`scai setup login brand` still works as a deprecated alias).",
+        "",
+    ].join("\n"));
+    command.action(async (options) => (0, deploy_token_1.runDeployToken)(options));
+    command.addCommand((0, setup_client_1.createLoginBrandCommand)());
     return command;
 };
 exports.createLoginCommand = createLoginCommand;

package/dist/commands/logout.d.ts

@@ -1,3 +1,2 @@
 import { Command } from "commander";
 export declare const createLogoutCommand: () => Command;
-//# sourceMappingURL=logout.d.ts.map

package/dist/commands/logout.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createLogoutCommand = void 0;
 const commander_1 = require("commander");
 const shared_1 = require("./shared");
-const tasks_1 = require("../serialization/tasks");
+const logout_1 = require("../serialization/tasks/env/logout");
 const createLogoutCommand = () => {
     const command = new commander_1.Command("logout").description("Clear stored authentication tokens");
     (0, shared_1.addEnvironmentOption)(command);
@@ -11,8 +11,8 @@ const createLogoutCommand = () => {
     (0, shared_1.addVerbosityOptions)(command);
     command
         .addOption(new commander_1.Option("--all", "Clear tokens for all environments"))
-        .action(async (options) => (0, tasks_1.runLogout)(options));
-    command.addHelpText("after", "\nExamples:\n  $ scai logout -n demo\n  $ scai logout --all\n");
+        .action(async (options) => (0, logout_1.runLogout)(options));
+    command.addHelpText("after", "\nExamples:\n  $ scai setup logout -n demo\n  $ scai setup logout --all\n");
     return command;
 };
 exports.createLogoutCommand = createLogoutCommand;

package/dist/commands/mcp/serve.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `scai mcp serve` — launches the MCP server bound to a single Sitecore
+ * environment for the lifetime of the process.
+ *
+ * Two transports, selected with `--transport`:
+ *   - `stdio` (default) — a desktop MCP host spawns scai as a child
+ *     process and drives it over stdin/stdout.
+ *   - `http` — a Streamable HTTP listener at `http://<host>:<port>/mcp`
+ *     so URL-based clients (including browser-hosted ones) can connect.
+ *
+ * The handler's first job is `installMcpStdoutDiscipline()` — sets the
+ * SITECOREAI_* env vars BEFORE the heavier scai modules load, and
+ * redirects every consola log call to stderr. After that point it's
+ * safe to import the rest of the scai surface.
+ */
+import { Command } from "commander";
+interface McpServeOptions {
+    environmentName?: string;
+    config?: string;
+    transport?: string;
+    port?: number;
+    host?: string;
+    telemetry?: boolean;
+}
+export declare const runMcpServe: (options: McpServeOptions) => Promise<void>;
+export declare const createMcpServeCommand: () => Command;
+export {};

package/dist/commands/mcp/serve.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * `scai mcp serve` — launches the MCP server bound to a single Sitecore
+ * environment for the lifetime of the process.
+ *
+ * Two transports, selected with `--transport`:
+ *   - `stdio` (default) — a desktop MCP host spawns scai as a child
+ *     process and drives it over stdin/stdout.
+ *   - `http` — a Streamable HTTP listener at `http://<host>:<port>/mcp`
+ *     so URL-based clients (including browser-hosted ones) can connect.
+ *
+ * The handler's first job is `installMcpStdoutDiscipline()` — sets the
+ * SITECOREAI_* env vars BEFORE the heavier scai modules load, and
+ * redirects every consola log call to stderr. After that point it's
+ * safe to import the rest of the scai surface.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpServeCommand = exports.runMcpServe = void 0;
+const commander_1 = require("commander");
+const logging_1 = require("../../mcp/logging");
+const auth_1 = require("../../mcp/auth");
+const build_registry_1 = require("../../mcp/build-registry");
+const server_1 = require("../../mcp/server");
+const http_1 = require("../../mcp/http");
+const errors_1 = require("../../shared/errors");
+const policy_1 = require("../../policy");
+const DEFAULT_HTTP_PORT = 3399;
+const DEFAULT_HTTP_HOST = "127.0.0.1";
+const isLoopbackHost = (host) => host === "127.0.0.1" || host === "::1" || host === "localhost";
+const runMcpServe = async (options) => {
+    (0, logging_1.installMcpStdoutDiscipline)({ telemetry: options.telemetry });
+    try {
+        // Fail-fast on bad config (sync read, no keychain involved). Bad config
+        // is a setup error — surface it at startup, not buried in a tool result.
+        const resolved = (0, auth_1.resolveMcpEnv)({
+            configPath: options.config,
+            environmentName: options.environmentName,
+        });
+        const configPath = options.config ?? process.cwd();
+        // Enroll the bound environment into the workspace policy. Starting a
+        // server bound to an environment is the operator's deliberate choice,
+        // so the bound env is auto-allowed; agents still cannot retarget a
+        // tool call at any environment that is not enrolled.
+        try {
+            (0, policy_1.enrollEnvironment)({
+                envName: resolved.envName,
+                environment: resolved.environment,
+                via: "mcp-serve",
+            });
+        }
+        catch (error) {
+            process.stderr.write(`scai mcp: could not update the workspace policy — ${(0, errors_1.toScaiError)(error).message}\n`);
+        }
+        const getContext = (0, auth_1.createMcpContextProvider)(resolved, configPath);
+        const registry = (0, build_registry_1.buildScaiMcpRegistry)();
+        // Warm the context in the background. If the keychain prompts on macOS,
+        // the prompt happens here — concurrent with transport connect — instead
+        // of serializing before it, which is what made `initialize` time out
+        // ("still connecting") in some hosts.
+        void getContext().catch((error) => {
+            const scaiError = (0, errors_1.toScaiError)(error);
+            process.stderr.write(`scai mcp: deferred env binding failed; first tool call will retry. ${scaiError.message}\n`);
+        });
+        if (options.transport === "http") {
+            const host = options.host ?? DEFAULT_HTTP_HOST;
+            const port = options.port ?? DEFAULT_HTTP_PORT;
+            if (!isLoopbackHost(host)) {
+                process.stderr.write(`scai mcp: warning — binding to non-loopback host '${host}'. The MCP tool ` +
+                    `surface (environment reads + allowWrite-gated writes) becomes reachable ` +
+                    `from your network.\n`);
+            }
+            const handle = await (0, http_1.startHttpTransport)({ getContext, registry, host, port });
+            (0, logging_1.writeStartupLine)(`scai mcp serve listening on ${handle.url}, bound to environment '${resolved.envName}'`);
+            // The open listener keeps the process alive; close it cleanly on
+            // an interrupt so in-flight response streams aren't severed mid-frame.
+            const shutdown = () => {
+                void handle.close().finally(() => process.exit(0));
+            };
+            process.once("SIGINT", shutdown);
+            process.once("SIGTERM", shutdown);
+            return;
+        }
+        const server = (0, server_1.buildMcpServer)({ getContext, registry });
+        (0, logging_1.writeStartupLine)(`scai mcp serve listening on stdio, bound to environment '${resolved.envName}'`);
+        await (0, server_1.startStdioTransport)(server);
+    }
+    catch (error) {
+        const scaiError = (0, errors_1.toScaiError)(error);
+        process.stderr.write(`scai mcp serve failed: ${scaiError.message}\n`);
+        if (scaiError.hint) {
+            process.stderr.write(`hint: ${scaiError.hint}\n`);
+        }
+        process.exitCode = scaiError.exitCode;
+    }
+};
+exports.runMcpServe = runMcpServe;
+const parsePort = (value) => {
+    const port = Number(value);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new commander_1.InvalidArgumentError("Port must be an integer between 1 and 65535.");
+    }
+    return port;
+};
+const createMcpServeCommand = () => {
+    const command = new commander_1.Command("serve")
+        .description("Launch the scai MCP server (stdio or Streamable HTTP) bound to one environment.")
+        .addOption(new commander_1.Option("-n, --environment-name <name>", "Config environment name from sitecoreai.cli.json (defaults to defaultEnvProfile)."))
+        .addOption(new commander_1.Option("-c, --config <path>", "Path to sitecoreai.cli.json or a directory containing one.").default(process.cwd(), "current directory"))
+        .addOption(new commander_1.Option("--transport <kind>", "Transport: 'stdio' (default) or 'http' (Streamable HTTP).")
+        .choices(["stdio", "http"])
+        .default("stdio"))
+        .addOption(new commander_1.Option("--port <number>", "HTTP transport port (only used with --transport http).")
+        .argParser(parsePort)
+        .default(DEFAULT_HTTP_PORT))
+        .addOption(new commander_1.Option("--host <address>", "HTTP transport bind address (only used with --transport http).").default(DEFAULT_HTTP_HOST))
+        .addOption(new commander_1.Option("--no-telemetry", "Disable telemetry for this MCP session. Telemetry is enabled by default; the DO_NOT_TRACK env var is still honored."));
+    command.action(async (options) => (0, exports.runMcpServe)(options));
+    return command;
+};
+exports.createMcpServeCommand = createMcpServeCommand;

package/dist/commands/mcp/tools.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `scai mcp tools {list, schema}` — offline inspectors for the
+ * registered tool surface. Both commands instantiate the same registry
+ * `mcp serve` uses but without binding to a tenant, so the output is
+ * deterministic and safe to run anywhere.
+ */
+import { Command } from "commander";
+export declare const createMcpToolsCommand: () => Command;

package/dist/commands/mcp/tools.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * `scai mcp tools {list, schema}` — offline inspectors for the
+ * registered tool surface. Both commands instantiate the same registry
+ * `mcp serve` uses but without binding to a tenant, so the output is
+ * deterministic and safe to run anywhere.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpToolsCommand = void 0;
+const commander_1 = require("commander");
+const zod_1 = require("zod");
+const build_registry_1 = require("../../mcp/build-registry");
+const formatToolsList = (json, namesOnly) => {
+    const registry = (0, build_registry_1.buildScaiMcpRegistry)();
+    const tools = registry.listTools();
+    if (namesOnly) {
+        const names = tools.map((tool) => tool.name);
+        return json ? JSON.stringify({ tools: names }, null, 2) : names.join("\n");
+    }
+    const detailed = tools.map((tool) => ({
+        name: tool.name,
+        auth: tool.auth,
+        description: tool.description,
+        annotations: tool.annotations,
+    }));
+    if (json) {
+        return JSON.stringify({ tools: detailed }, null, 2);
+    }
+    return detailed.map((tool) => `${tool.name}\t[${tool.auth}]\t${tool.description}`).join("\n");
+};
+const formatToolsSchema = (name, json) => {
+    const registry = (0, build_registry_1.buildScaiMcpRegistry)();
+    if (name) {
+        const tool = registry.getTool(name);
+        if (!tool) {
+            const known = registry
+                .listTools()
+                .map((t) => t.name)
+                .join(", ");
+            throw new Error(`Unknown tool '${name}'. Known tools: ${known}`);
+        }
+        const schema = zod_1.z.toJSONSchema(zod_1.z.object({ ...tool.inputSchema }));
+        if (json) {
+            return JSON.stringify({ name: tool.name, schema }, null, 2);
+        }
+        return `${tool.name}\n${JSON.stringify(schema, null, 2)}`;
+    }
+    const schemas = registry.listTools().map((tool) => ({
+        name: tool.name,
+        schema: zod_1.z.toJSONSchema(zod_1.z.object({ ...tool.inputSchema })),
+    }));
+    return JSON.stringify({ schemas }, null, 2);
+};
+const createMcpToolsCommand = () => {
+    const tools = new commander_1.Command("tools").description("Inspect the scai MCP tool surface (offline).");
+    tools
+        .command("list")
+        .description("List every registered tool with its description and auth class.")
+        .addOption(new commander_1.Option("--json", "Emit JSON instead of TSV."))
+        .addOption(new commander_1.Option("--names", "List tool names only — one per line, no auth or description."))
+        .action((options) => {
+        process.stdout.write(`${formatToolsList(Boolean(options.json), Boolean(options.names))}\n`);
+    });
+    tools
+        .command("schema")
+        .description("Print the Zod-derived JSON schema for one tool (--name) or all tools.")
+        .addOption(new commander_1.Option("--name <name>", "Tool name. When omitted, returns every tool's schema."))
+        .addOption(new commander_1.Option("--json", "Emit JSON (always JSON for schema output; flag retained for parity)."))
+        .action((options) => {
+        void options.json;
+        process.stdout.write(`${formatToolsSchema(options.name, true)}\n`);
+    });
+    return tools;
+};
+exports.createMcpToolsCommand = createMcpToolsCommand;

package/dist/commands/mcp.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const createMcpCommand: () => Command;

package/dist/commands/mcp.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpCommand = void 0;
+const commander_1 = require("commander");
+const serve_1 = require("./mcp/serve");
+const tools_1 = require("./mcp/tools");
+const createMcpCommand = () => {
+    const command = new commander_1.Command("mcp").description("Model Context Protocol — run an MCP server exposing scai's developer-side surface to agents.");
+    command.addCommand((0, serve_1.createMcpServeCommand)());
+    command.addCommand((0, tools_1.createMcpToolsCommand)());
+    command.addHelpText("after", [
+        "",
+        "Examples:",
+        "  $ scai mcp serve --environment-name dev          # launch stdio server bound to env 'dev'",
+        "  $ scai mcp serve --transport http --port 3399    # Streamable HTTP at http://127.0.0.1:3399/mcp",
+        "  $ scai mcp tools list                            # list every registered tool (TSV)",
+        "  $ scai mcp tools list --names                    # list tool names only, one per line",
+        "  $ scai mcp tools schema --name recipe_push      # print one tool's JSON schema",
+        "",
+    ].join("\n"));
+    return command;
+};
+exports.createMcpCommand = createMcpCommand;

package/dist/commands/policy.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `scai policy …` — inspect and manage the workspace environment-policy
+ * guardrails. See docs/policy-and-guardrails.md.
+ *
+ * The workspace policy is an operator-owned, deny-by-default allowlist of
+ * the Sitecore environments scai may operate against. It is normally
+ * auto-populated (`scai setup login`, `scai mcp serve`); these commands
+ * are for inspecting it and for the deliberate acts — enrolling a second
+ * environment, re-pinning after a legitimate tenant change, revoking one.
+ *
+ * These commands deliberately read the config directly rather than going
+ * through `resolveEnvironment`: they run before/around enrollment and
+ * must not trip the very gate they manage.
+ */
+import { Command } from "commander";
+export declare const createPolicyCommand: () => Command;