@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/mcp/tools/workflow.js

@@ -0,0 +1,436 @@
+"use strict";
+/**
+ * Workflow domain — inspect + lifecycle.
+ *
+ * Two tools, workflow-shaped:
+ *
+ *   - `workflow_inspect` (read) discriminates on `verb` so a single
+ *     entry point covers state inspection, available-command lookup,
+ *     workflow-definition enumeration, per-site rollup (XM Apps REST),
+ *     and workflow-state search ("assigned to me" queries).
+ *
+ *   - `workflow_lifecycle` (write) currently exposes a single `verb`
+ *     (`advance`) but is shaped as a discriminated input so future
+ *     mutations (reset to initial, bulk-advance) slot in without
+ *     forcing a tool-name change.
+ *
+ * Each handler delegates to the `runWorkflow*` task function shared
+ * with the CLI; the MCP layer adds only the discriminator routing
+ * and the structured-content envelope.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerWorkflowTools = void 0;
+const zod_1 = require("zod");
+const advance_1 = require("../../workflow/tasks/advance");
+const apply_1 = require("../../workflow/tasks/apply");
+const assigned_1 = require("../../workflow/tasks/assigned");
+const inspect_1 = require("../../workflow/tasks/inspect");
+const list_commands_1 = require("../../workflow/tasks/list-commands");
+const list_defs_1 = require("../../workflow/tasks/list-defs");
+const reset_1 = require("../../workflow/tasks/reset");
+const status_1 = require("../../workflow/tasks/status");
+const workflow_advance_1 = require("../../hygiene/tasks/cleanup/workflow-advance");
+const workflow_apply_1 = require("../../hygiene/tasks/cleanup/workflow-apply");
+const allow_write_1 = require("../../policy/allow-write");
+const errors_1 = require("../../shared/errors");
+const auth_1 = require("../auth");
+const descriptions_1 = require("../descriptions");
+const common_1 = require("../schemas/common");
+const baseTaskOptions = (config, envName, overrides = {}) => ({
+    config,
+    environmentName: envName,
+    quiet: true,
+    json: false,
+    ...overrides,
+});
+const registerWorkflowTools = (registry) => {
+    registry.registerTool({
+        name: "workflow_inspect",
+        description: descriptions_1.TOOL_DESCRIPTIONS.workflow_inspect,
+        auth: "read",
+        annotations: {
+            title: "Inspect Sitecore workflows",
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: true,
+        },
+        inputSchema: {
+            verb: zod_1.z
+                .enum(["inspect", "list-commands", "list-defs", "status", "assigned"])
+                .describe("Which read operation to run."),
+            item: zod_1.z
+                .string()
+                .optional()
+                .describe("Item reference. Required for verb='inspect' and verb='list-commands'. Accepts one of: a Sitecore item GUID (with or without braces/hyphens), a content-tree path starting with /sitecore/, OR a workflow display name / item name (case-insensitive, matched against `Workflow`-templated items under /sitecore/system/Workflows). For verb='inspect', the result is a discriminated `{ kind: 'item' | 'definition', ... }` envelope — `definition` for Workflow-templated refs (returns states/commands/actions tree), `item` for items under workflow (returns current state + available commands). Branch on `result.kind` before reading further fields."),
+            root: zod_1.z
+                .string()
+                .optional()
+                .describe("Content-tree root for verb='list-defs' (defaults to /sitecore/system/Workflows)."),
+            site: zod_1.z.string().optional().describe("Site identifier. Required for verb='status'."),
+            contentEnvironmentId: zod_1.z
+                .string()
+                .optional()
+                .describe("Optional Content Services environment ID for verb='status' (e.g. 'main')."),
+            state: zod_1.z.string().optional().describe("Workflow state GUID. Required for verb='assigned'."),
+            field: zod_1.z
+                .string()
+                .optional()
+                .describe("Search field override for verb='assigned' (default: '__workflow state'). Use '__workflow_state' if the default returns no hits."),
+            index: zod_1.z.string().optional().describe("Override the search index (verb='assigned')."),
+            limit: zod_1.z
+                .number()
+                .int()
+                .positive()
+                .max(2000)
+                .optional()
+                .describe("Cap on items returned (verb='assigned'; default 500)."),
+            ...common_1.environmentBindingShape,
+        },
+        handler: async (input, context) => {
+            const taskOpts = baseTaskOptions(context.configPath, input.environmentName ?? context.envName);
+            switch (input.verb) {
+                case "inspect": {
+                    if (!input.item) {
+                        throw (0, errors_1.createScaiError)("verb='inspect' requires `item`.", "INPUT_INVALID");
+                    }
+                    const result = await (0, inspect_1.runWorkflowInspect)({
+                        ...taskOpts,
+                        item: input.item,
+                    });
+                    // `result` is a discriminated union — `kind: "item"` for items
+                    // under workflow, `kind: "definition"` for Workflow-templated
+                    // items, `null` when neither resolves.
+                    let text;
+                    if (!result) {
+                        text = `Item '${input.item}' is not under workflow and isn't a workflow definition.`;
+                    }
+                    else if (result.kind === "definition") {
+                        text = `Workflow definition '${result.definition.displayName ?? result.definition.name}' (${result.definition.path}) — ${result.definition.states.length} state(s).`;
+                    }
+                    else {
+                        const i = result.item;
+                        text = `Workflow '${i.workflow.workflowName}' state '${i.state.stateName ?? "?"}' on ${i.path ?? i.itemId}; ${i.availableCommands.length} command(s) available.`;
+                    }
+                    return {
+                        content: [{ type: "text", text }],
+                        structuredContent: { verb: input.verb, result },
+                    };
+                }
+                case "list-commands": {
+                    if (!input.item) {
+                        throw (0, errors_1.createScaiError)("verb='list-commands' requires `item`.", "INPUT_INVALID");
+                    }
+                    const result = await (0, list_commands_1.runWorkflowListCommands)({
+                        ...taskOpts,
+                        item: input.item,
+                    });
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: result
+                                    ? `${result.commands.length} command(s) available on ${result.path ?? result.itemId}.`
+                                    : `Item ${input.item} is not under workflow.`,
+                            },
+                        ],
+                        structuredContent: { verb: input.verb, result },
+                    };
+                }
+                case "list-defs": {
+                    const result = await (0, list_defs_1.runWorkflowListDefs)({
+                        ...taskOpts,
+                        ...(input.root !== undefined && { root: input.root }),
+                    });
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `${result.workflows.length} workflow definition(s) under ${result.rootPath}.`,
+                            },
+                        ],
+                        structuredContent: { verb: input.verb, result },
+                    };
+                }
+                case "status": {
+                    if (!input.site) {
+                        throw (0, errors_1.createScaiError)("verb='status' requires `site`.", "INPUT_INVALID");
+                    }
+                    const result = await (0, status_1.runWorkflowStatus)({
+                        ...taskOpts,
+                        site: input.site,
+                        ...(input.contentEnvironmentId !== undefined && {
+                            contentEnvironmentId: input.contentEnvironmentId,
+                        }),
+                    });
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Workflow status for site ${result.siteId}: ${(result.statistics.workflows ?? []).length} workflow(s).`,
+                            },
+                        ],
+                        structuredContent: { verb: input.verb, result },
+                    };
+                }
+                case "assigned": {
+                    if (!input.state) {
+                        throw (0, errors_1.createScaiError)("verb='assigned' requires `state`.", "INPUT_INVALID");
+                    }
+                    const result = await (0, assigned_1.runWorkflowAssigned)({
+                        ...taskOpts,
+                        state: input.state,
+                        ...(input.field !== undefined && { field: input.field }),
+                        ...(input.index !== undefined && { index: input.index }),
+                        ...(input.limit !== undefined && { limit: input.limit }),
+                    });
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `${result.items.length} item(s) in state ${result.stateId}.`,
+                            },
+                        ],
+                        structuredContent: { verb: input.verb, result },
+                    };
+                }
+            }
+        },
+    });
+    registry.registerTool({
+        name: "workflow_lifecycle",
+        description: descriptions_1.TOOL_DESCRIPTIONS.workflow_lifecycle,
+        auth: "write",
+        annotations: {
+            title: "Mutate workflow state (advance / reset / bulk-advance / apply)",
+            readOnlyHint: false,
+            // Every verb writes server-side state and/or triggers attached
+            // webhooks. Surface as destructive so the host's confirmation
+            // UX kicks in.
+            destructiveHint: true,
+            openWorldHint: true,
+        },
+        inputSchema: {
+            verb: zod_1.z
+                .enum(["advance", "reset", "bulk-advance", "apply-workflow", "bulk-apply"])
+                .describe("Which mutation to run. `advance` moves one item through one command. `reset` force-writes one item back to its workflow's initial state (bypasses validation + submit actions). `bulk-advance` sweeps stale items under a root and advances each via a named command (wraps `scai hygiene cleanup workflow advance`). `apply-workflow` attaches a workflow to an item not yet under one (sets `__Workflow` + `__Workflow state` directly). `bulk-apply` does the same as `apply-workflow` but sweeps every item under a root, optionally filtered by template — wraps `scai hygiene cleanup workflow apply`."),
+            // advance / reset / apply-workflow target
+            item: zod_1.z
+                .string()
+                .optional()
+                .describe("Item GUID or content-tree path. Required for `advance`, `reset`, `apply-workflow`."),
+            // advance
+            command: zod_1.z
+                .string()
+                .optional()
+                .describe("Workflow command display name (advance only). Matched case-insensitively against commands available at the item's current state."),
+            comments: zod_1.z
+                .string()
+                .optional()
+                .describe("Comment recorded with the transition (advance only; audit trail)."),
+            // apply-workflow + bulk-apply
+            workflow: zod_1.z
+                .string()
+                .optional()
+                .describe("Workflow GUID, content-tree path, or display/item name (apply-workflow / bulk-apply). Same resolver as workflow_inspect verb=inspect."),
+            state: zod_1.z
+                .string()
+                .optional()
+                .describe("Target state (state GUID or name) for apply-workflow / bulk-apply. Defaults to the workflow's `__Initial state`."),
+            // bulk-apply
+            template: zod_1.z
+                .string()
+                .optional()
+                .describe("bulk-apply: only attach to items conforming to this template (GUID or absolute /sitecore/templates path). Omit to attach to every item under `root`."),
+            reattach: zod_1.z
+                .boolean()
+                .optional()
+                .describe("bulk-apply: overwrite items already attached to a different workflow. Off by default — already-attached items are skipped."),
+            maxApplies: zod_1.z
+                .number()
+                .int()
+                .positive()
+                .max(10000)
+                .optional()
+                .describe("bulk-apply blast-radius cap. Default 100."),
+            // bulk-advance + bulk-apply
+            root: zod_1.z
+                .string()
+                .optional()
+                .describe("Content-tree root to scan for bulk-advance / bulk-apply. Default `/sitecore/content`."),
+            commandName: zod_1.z
+                .string()
+                .optional()
+                .describe("Workflow command name for bulk-advance (e.g. 'Approve'). Required for bulk-advance."),
+            fromState: zod_1.z
+                .string()
+                .optional()
+                .describe("Limit bulk-advance to items currently in this state name."),
+            staleDays: zod_1.z
+                .number()
+                .int()
+                .nonnegative()
+                .optional()
+                .describe("Eligibility window: only items not updated for at least this many days. Bulk-advance defaults to 30; bulk-apply has no default (omit to attach to every match)."),
+            maxAdvances: zod_1.z
+                .number()
+                .int()
+                .positive()
+                .max(10000)
+                .optional()
+                .describe("Bulk-advance blast-radius cap. Default 100."),
+            ...common_1.whatIfShape,
+            ...common_1.environmentBindingShape,
+            ...common_1.allowWriteShape,
+        },
+        handler: async (input, context) => {
+            // Resolve the target environment (bound default unless retargeted
+            // via `environmentName`). The per-env `denyMcpElevation` opt-out
+            // must be checked against the TARGET env, not the bound one.
+            const binding = await (0, auth_1.resolveToolBinding)(context, input.environmentName);
+            (0, allow_write_1.ensureMcpElevationAllowed)(binding.resolved.root, binding.envName);
+            const taskOpts = baseTaskOptions(context.configPath, binding.envName);
+            switch (input.verb) {
+                case "advance": {
+                    if (!input.item || !input.command) {
+                        throw (0, errors_1.createScaiError)("verb='advance' requires `item` and `command`.", "INPUT_INVALID");
+                    }
+                    const result = await (0, advance_1.runWorkflowAdvance)({
+                        ...taskOpts,
+                        item: input.item,
+                        command: input.command,
+                        ...(input.comments !== undefined && { comments: input.comments }),
+                        ...(input.whatIf !== undefined && { whatIf: input.whatIf }),
+                        ...(input.allowWrite !== undefined && { allowWrite: input.allowWrite }),
+                    });
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: result.status === "advanced"
+                                    ? `Advanced ${result.path ?? result.itemId} via '${result.commandUsed}' → ${result.toState ?? "(unspecified)"}.`
+                                    : result.status === "what-if"
+                                        ? `Would execute '${result.commandUsed}' on ${result.path ?? result.itemId}.`
+                                        : `${result.status}: ${result.message ?? ""}`,
+                            },
+                        ],
+                        structuredContent: { verb: input.verb, result },
+                    };
+                }
+                case "reset": {
+                    if (!input.item) {
+                        throw (0, errors_1.createScaiError)("verb='reset' requires `item`.", "INPUT_INVALID");
+                    }
+                    const result = await (0, reset_1.runWorkflowReset)({
+                        ...taskOpts,
+                        item: input.item,
+                        ...(input.whatIf !== undefined && { whatIf: input.whatIf }),
+                        ...(input.allowWrite !== undefined && { allowWrite: input.allowWrite }),
+                    });
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: result.message ?? `reset → ${result.status}`,
+                            },
+                        ],
+                        structuredContent: { verb: input.verb, result },
+                    };
+                }
+                case "apply-workflow": {
+                    if (!input.item || !input.workflow) {
+                        throw (0, errors_1.createScaiError)("verb='apply-workflow' requires `item` and `workflow`.", "INPUT_INVALID");
+                    }
+                    const result = await (0, apply_1.runWorkflowApply)({
+                        ...taskOpts,
+                        item: input.item,
+                        workflow: input.workflow,
+                        ...(input.state !== undefined && { state: input.state }),
+                        ...(input.whatIf !== undefined && { whatIf: input.whatIf }),
+                        ...(input.allowWrite !== undefined && { allowWrite: input.allowWrite }),
+                    });
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: result.message ?? `apply-workflow → ${result.status}`,
+                            },
+                        ],
+                        structuredContent: { verb: input.verb, result },
+                    };
+                }
+                case "bulk-advance": {
+                    if (!input.commandName) {
+                        throw (0, errors_1.createScaiError)("verb='bulk-advance' requires `commandName`.", "INPUT_INVALID");
+                    }
+                    // Delegates to the existing `runCleanupWorkflowAdvance` task
+                    // — same semantics as `scai hygiene cleanup workflow advance`. Kept
+                    // MCP-only (no `scai content workflow bulk-advance` CLI alias) per
+                    // the "leave cleanup verbs in place" decision.
+                    const actions = await (0, workflow_advance_1.runCleanupWorkflowAdvance)({
+                        ...taskOpts,
+                        commandName: input.commandName,
+                        ...(input.fromState !== undefined && { fromState: input.fromState }),
+                        ...(input.root !== undefined && { root: input.root }),
+                        ...(input.staleDays !== undefined && { staleDays: input.staleDays }),
+                        ...(input.maxAdvances !== undefined && { maxAdvances: input.maxAdvances }),
+                        ...(input.comments !== undefined && { comments: input.comments }),
+                        ...(input.whatIf !== undefined && { whatIf: input.whatIf }),
+                        ...(input.allowWrite !== undefined && { allowWrite: input.allowWrite }),
+                    });
+                    const advanced = actions.filter((a) => a.status === "advanced").length;
+                    const failed = actions.filter((a) => a.status === "failed").length;
+                    const skipped = actions.filter((a) => a.status === "skipped-no-command").length;
+                    const whatIfCount = actions.filter((a) => a.status === "what-if").length;
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: input.whatIf === true
+                                    ? `bulk-advance plan: ${whatIfCount} item(s) would advance.`
+                                    : `bulk-advance: advanced ${advanced}, failed ${failed}, skipped ${skipped}.`,
+                            },
+                        ],
+                        structuredContent: { verb: input.verb, actions },
+                    };
+                }
+                case "bulk-apply": {
+                    if (!input.workflow) {
+                        throw (0, errors_1.createScaiError)("verb='bulk-apply' requires `workflow`.", "INPUT_INVALID");
+                    }
+                    // Delegates to `runCleanupWorkflowApply` — same semantics as
+                    // `scai hygiene cleanup workflow apply`. Workflow-shaped here for
+                    // discovery; the cleanup tool also exposes it as
+                    // `verb: 'workflow-apply'` for symmetry with `workflow-advance`.
+                    const actions = await (0, workflow_apply_1.runCleanupWorkflowApply)({
+                        ...taskOpts,
+                        workflow: input.workflow,
+                        ...(input.state !== undefined && { state: input.state }),
+                        ...(input.template !== undefined && { template: input.template }),
+                        ...(input.reattach !== undefined && { reattach: input.reattach }),
+                        ...(input.root !== undefined && { root: input.root }),
+                        ...(input.staleDays !== undefined && { staleDays: input.staleDays }),
+                        ...(input.maxApplies !== undefined && { maxApplies: input.maxApplies }),
+                        ...(input.whatIf !== undefined && { whatIf: input.whatIf }),
+                        ...(input.allowWrite !== undefined && { allowWrite: input.allowWrite }),
+                    });
+                    const applied = actions.filter((a) => a.status === "applied").length;
+                    const failed = actions.filter((a) => a.status === "failed").length;
+                    const skippedAttached = actions.filter((a) => a.status === "skipped-already-attached").length;
+                    const whatIfCount = actions.filter((a) => a.status === "what-if").length;
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: input.whatIf === true
+                                    ? `bulk-apply plan: ${whatIfCount} item(s) would attach to '${input.workflow}'.`
+                                    : `bulk-apply: attached ${applied}, failed ${failed}, ${skippedAttached} already attached.`,
+                            },
+                        ],
+                        structuredContent: { verb: input.verb, actions },
+                    };
+                }
+            }
+        },
+    });
+};
+exports.registerWorkflowTools = registerWorkflowTools;

package/dist/policy/access-check.d.ts

@@ -0,0 +1,56 @@
+/**
+ * `checkAccess` — the access preflight.
+ *
+ * Answers "can I operate against environment X, and if not, what is the
+ * one thing blocking me?" in a single offline call. It aggregates the
+ * three gates an operation must clear — config, workspace policy, and
+ * credentials — so an agent learns every blocker at once instead of
+ * discovering them one failed call at a time.
+ *
+ * Offline by design: config read + policy resolution + credential
+ * presence, no network. A fast preflight, not a health probe. The MCP
+ * `access_check` tool is the thin wrapper over this.
+ */
+import { type Remediation } from "../shared/errors";
+import { type HumanOnlyOperation } from "../shared/human-only-operations";
+/** Per-gate verdict. `warn` is non-blocking — informational only. */
+export type GateStatus = "ok" | "blocked" | "warn";
+/** One gate in the access preflight. */
+export interface AccessGate {
+    id: "config" | "policy" | "credentials";
+    status: GateStatus;
+    /** One-line human summary of the gate's verdict. */
+    summary: string;
+    /** Structured remediation — present iff `status` is `blocked`. */
+    remediation?: Remediation;
+}
+/** The full preflight result. */
+export interface AccessReport {
+    environment: string;
+    /** True when no gate is `blocked` — the environment is ready to use. */
+    ready: boolean;
+    gates: AccessGate[];
+    /**
+     * The first blocking gate's remediation, hoisted so a caller can act
+     * on the single next step without scanning `gates`.
+     */
+    nextStep?: Remediation;
+    /**
+     * Operations no agent can perform regardless of gate state — a human
+     * must run them. Surfaced so the caller never mistakes one for an
+     * agent-clearable blocker.
+     */
+    humanOnlyOperations: readonly HumanOnlyOperation[];
+}
+export interface CheckAccessOptions {
+    /** Directory holding `sitecoreai.cli.json`, or a path to it. */
+    configPath: string;
+    /** Environment profile name to preflight. */
+    environmentName: string;
+}
+/**
+ * Run the three-gate preflight for one environment. Never throws — every
+ * failure mode (missing config, denied policy, absent credential) is
+ * reported as a `blocked` gate with a structured remediation.
+ */
+export declare const checkAccess: (options: CheckAccessOptions) => Promise<AccessReport>;

package/dist/policy/access-check.js

@@ -0,0 +1,160 @@
+"use strict";
+/**
+ * `checkAccess` — the access preflight.
+ *
+ * Answers "can I operate against environment X, and if not, what is the
+ * one thing blocking me?" in a single offline call. It aggregates the
+ * three gates an operation must clear — config, workspace policy, and
+ * credentials — so an agent learns every blocker at once instead of
+ * discovering them one failed call at a time.
+ *
+ * Offline by design: config read + policy resolution + credential
+ * presence, no network. A fast preflight, not a health probe. The MCP
+ * `access_check` tool is the thin wrapper over this.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAccess = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+const root_config_1 = require("../config/root-config");
+const errors_1 = require("../shared/errors");
+const credential_matrix_1 = require("../shared/credential-matrix");
+const human_only_operations_1 = require("../shared/human-only-operations");
+const identity_1 = require("./identity");
+const resolve_1 = require("./resolve");
+/**
+ * Run the three-gate preflight for one environment. Never throws — every
+ * failure mode (missing config, denied policy, absent credential) is
+ * reported as a `blocked` gate with a structured remediation.
+ */
+const checkAccess = async (options) => {
+    const { configPath, environmentName: envName } = options;
+    const gates = [];
+    // --- Gate 1: config -----------------------------------------------------
+    let environment;
+    let configRootDir;
+    let brandPresent = false;
+    let orgClientMetadata = false;
+    try {
+        const root = (0, root_config_1.readRootConfiguration)(configPath, envName);
+        configRootDir = root.physicalPath ? node_path_1.default.dirname(root.physicalPath) : undefined;
+        environment = root.environments[envName];
+        if (environment) {
+            const orgId = environment.organizationId;
+            brandPresent = Boolean(orgId && root.brand?.[orgId]);
+            orgClientMetadata = Boolean(orgId && root.orgClients?.[orgId]?.clientId);
+            gates.push({
+                id: "config",
+                status: "ok",
+                summary: `Environment '${envName}' is configured in sitecoreai.cli.json.`,
+            });
+        }
+        else {
+            gates.push({
+                id: "config",
+                status: "blocked",
+                summary: `Environment '${envName}' is not in sitecoreai.cli.json.`,
+                remediation: {
+                    actor: "agent",
+                    fix: `scai setup init -n ${envName}`,
+                    detail: "Adds the environment profile to the config.",
+                },
+            });
+        }
+    }
+    catch (error) {
+        gates.push({
+            id: "config",
+            status: "blocked",
+            summary: `Configuration could not be read: ${(0, errors_1.toScaiError)(error).message}`,
+            remediation: {
+                actor: "agent",
+                fix: "scai setup init",
+                detail: "Creates a sitecoreai.cli.json in the working tree.",
+            },
+        });
+    }
+    // --- Gate 2: workspace policy ------------------------------------------
+    const policy = (0, resolve_1.resolveEffectivePolicy)(envName, configRootDir);
+    if (!policy.managed) {
+        gates.push({
+            id: "policy",
+            status: "ok",
+            summary: "Unmanaged mode — no workspace-policy allowlist; every configured environment is permitted.",
+        });
+    }
+    else if (!policy.enrolled) {
+        gates.push({
+            id: "policy",
+            status: "blocked",
+            summary: `Environment '${envName}' is not on the workspace-policy allowlist.`,
+            remediation: {
+                actor: "agent",
+                fix: `scai policy allow ${envName}`,
+                detail: "Enrolls the environment in the workspace-policy allowlist.",
+            },
+        });
+    }
+    else if (environment &&
+        policy.identity &&
+        (0, identity_1.describeIdentityDrift)(policy.identity, (0, identity_1.extractIdentity)(environment)).length > 0) {
+        gates.push({
+            id: "policy",
+            status: "blocked",
+            summary: `Environment '${envName}' tenant identity has drifted from what was pinned at enrollment.`,
+            remediation: {
+                actor: "agent",
+                fix: `scai policy trust ${envName}`,
+                detail: "Re-pins the tenant identity to the current config — only if the change is expected.",
+            },
+        });
+    }
+    else {
+        gates.push({
+            id: "policy",
+            status: "ok",
+            summary: `Enrolled — ceiling '${policy.ceiling}', minting ${policy.mintCredentials ? "permitted" : "not permitted"}.`,
+        });
+    }
+    // --- Gate 3: credentials -----------------------------------------------
+    if (!environment) {
+        gates.push({
+            id: "credentials",
+            status: "warn",
+            summary: "Cannot evaluate credentials — the environment is not configured.",
+        });
+    }
+    else {
+        const matrix = await (0, credential_matrix_1.resolveCredentialMatrix)(envName, environment, brandPresent, orgClientMetadata);
+        if (matrix.envClient || matrix.orgClient) {
+            gates.push({
+                id: "credentials",
+                status: "ok",
+                summary: `CM automation client present (${matrix.envClient ? "env-scoped" : "org-scoped"}).`,
+            });
+        }
+        else {
+            gates.push({
+                id: "credentials",
+                status: "blocked",
+                summary: `No CM automation client for '${envName}' — content reads fail with AUTH_REQUIRED until one is provisioned.`,
+                remediation: {
+                    actor: "needs-human-terminal",
+                    fix: `scai setup client create ${envName}`,
+                    detail: "Credential minting requires an interactive human terminal; agents and CI callers are refused.",
+                },
+            });
+        }
+    }
+    const blocking = gates.find((gate) => gate.status === "blocked");
+    return {
+        environment: envName,
+        ready: !blocking,
+        gates,
+        nextStep: blocking?.remediation,
+        humanOnlyOperations: human_only_operations_1.HUMAN_ONLY_OPERATIONS,
+    };
+};
+exports.checkAccess = checkAccess;