@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/publishing/tasks/unpublish.js

@@ -0,0 +1,546 @@
+"use strict";
+/**
+ * `scai content publish unpublish` — composite verb.
+ *
+ * The SAI Publishing API has no per-version unpublish operation. The
+ * Sitecore-canonical mechanism is to change the item's publish-state
+ * fields via the Authoring API (so the next publish doesn't pick them
+ * up — or, for already-published items, the next publish removes them
+ * from Edge) and then submit a regular publish job.
+ *
+ * Three strategies:
+ *
+ *   - `never-publish` (default, reversible) — sets `__Never publish: true`
+ *     on the latest version per requested language. Reverse by writing
+ *     `__Never publish: false` (e.g. `scai content version
+ *     set-never-publish --value false`) and republishing.
+ *   - `expire-now` (reversible)             — sets `__Valid to: <now>`
+ *     on each targeted version. Reverse by writing `__Valid to` to a
+ *     future date.
+ *   - `delete` (destructive, NOT reversible from scai's side) — not yet
+ *     implemented; surfaces a clear error message.
+ *
+ * Safety model reuses the four PR 2b primitives: dry-run default,
+ * scope-token verification on production-tier envs, `--allow-write`
+ * to graduate from dry-run, audit log every mutation with before/after
+ * captures so an operator can reverse a mistaken toggle by reading the
+ * log.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPublishUnpublish = void 0;
+const logger_1 = require("../../shared/logger");
+const errors_1 = require("../../shared/errors");
+const environment_1 = require("../../policy/environment");
+const prompt_1 = require("../../shared/prompt");
+const client_1 = require("../../hygiene/api/client");
+const version_fields_1 = require("../../content/api/version-fields");
+const auth_1 = require("../api/auth");
+const client_2 = require("../api/client");
+const path_resolver_1 = require("../api/path-resolver");
+const languages_1 = require("../api/languages");
+const sites_1 = require("../api/sites");
+const env_tier_1 = require("../../shared/env-tier");
+const publish_consent_1 = require("../../shared/publish-consent");
+const publish_audit_1 = require("../../shared/publish-audit");
+const toLogger = (options) => new logger_1.Logger(Boolean(options.verbose), Boolean(options.trace), Boolean(options.json), Boolean(options.quiet), options.logFile ?? process.env.SITECOREAI_LOG_FILE);
+const printScope = (logger, scope) => {
+    logger.info(`Environment:   ${scope.envName}`, "cyan");
+    if (scope.resolvedTenantId) {
+        logger.info(`Tenant:        ${scope.resolvedTenantId}`, "gray");
+    }
+    logger.info(`Target:        ${scope.target}`, "gray");
+    logger.info(`Strategy:      ${scope.strategy ?? "(unset)"}`, "gray");
+    if (scope.itemIds && scope.itemIds.length > 0) {
+        logger.info(`Item IDs:      ${scope.itemIds.join(", ")}`, "gray");
+    }
+    logger.info(`Languages:     ${scope.languages && scope.languages.length > 0 ? scope.languages.join(", ") : "(default)"}`, "gray");
+    logger.info(`Include subs:  ${Boolean(scope.includeSubitems)}`, "gray");
+    logger.info(`Include rel.:  ${Boolean(scope.includeRelated)}`, "gray");
+};
+/**
+ * Apply the strategy to a single `(itemId, language)` pair. Returns
+ * the audit-log entries that should be recorded for the field write.
+ * Throws if a precondition fails (e.g. version missing for the
+ * language) — caller catches and records an error audit entry.
+ */
+const applyStrategy = async (environment, itemId, language, strategy, whatIf) => {
+    const snapshot = await (0, version_fields_1.readVersionFields)(environment, { itemId, language });
+    if (strategy === "never-publish") {
+        const before = (0, version_fields_1.findField)(snapshot, version_fields_1.FIELD_NEVER_PUBLISH);
+        const after = (0, version_fields_1.formatBoolean)(true);
+        if (!whatIf) {
+            await (0, version_fields_1.writeVersionFields)(environment, {
+                itemId: snapshot.itemId,
+                language: snapshot.language,
+                version: snapshot.version,
+                fields: [{ name: version_fields_1.FIELD_NEVER_PUBLISH, value: after }],
+            });
+        }
+        return [{ name: version_fields_1.FIELD_NEVER_PUBLISH, before, after }];
+    }
+    if (strategy === "expire-now") {
+        const before = (0, version_fields_1.findField)(snapshot, version_fields_1.FIELD_VALID_TO);
+        // Sitecore expects ISO 8601 in `__Valid to`; reuse JS toISOString
+        // and trim the trailing milliseconds so the wire shape matches
+        // what the Sitecore Authoring UI writes.
+        const after = new Date().toISOString();
+        if (!whatIf) {
+            await (0, version_fields_1.writeVersionFields)(environment, {
+                itemId: snapshot.itemId,
+                language: snapshot.language,
+                version: snapshot.version,
+                fields: [{ name: version_fields_1.FIELD_VALID_TO, value: after }],
+            });
+        }
+        return [{ name: version_fields_1.FIELD_VALID_TO, before, after }];
+    }
+    // Note: `delete` is not handled here — it's item-scoped (not
+    // version-scoped) and runs through `runDeleteUnpublish` below.
+    throw (0, errors_1.createScaiError)(`Unpublish strategy '${strategy}' is not implemented yet.`, "INPUT_INVALID", {
+        hint: "Use --strategy never-publish (default), --strategy expire-now, or --strategy delete.",
+    });
+};
+/**
+ * Read the resolved Sitecore path for an itemId via Authoring GraphQL.
+ * Used by the `delete` strategy to surface the path the operator must
+ * echo back at the typed-path confirmation gate. The path is also the
+ * value scai writes to the audit log so a "deleted X" entry is
+ * grep-able by path, not just GUID.
+ */
+const lookupItemPath = async (environment, itemId) => {
+    // readVersionFields throws if the item has no version in the requested
+    // language — that's a problem for delete (we want to delete regardless
+    // of language). Use a minimal GraphQL probe instead.
+    const { runAuthoringGraphQL } = await Promise.resolve().then(() => __importStar(require("../../recipe/api/graphql")));
+    const data = await runAuthoringGraphQL(environment, `query($id: String!) { item(where: { itemId: $id }) { itemId path } }`, { id: itemId });
+    return data.item?.path ?? null;
+};
+/**
+ * Execute `--strategy delete` end-to-end. Item-scoped (not
+ * version-scoped) — Sitecore's `deleteItem` removes the item across
+ * every version and language at once. Distinct flow from the
+ * reversible strategies because:
+ *
+ *   - typed-item-path confirmation gates each delete on production-tier
+ *     envs (mirrors `publish all`'s typed env-name confirmation, scaled
+ *     per-item)
+ *   - audit entries carry `risk: "high"` (delete is NOT reversible)
+ *   - the publish job follows the deletes so Edge sees the removals
+ *
+ * @internal
+ */
+const runDeleteUnpublish = async (ctx) => {
+    const { logger, envName, environment, timeoutMs, itemIds } = ctx;
+    const caller = { type: "human", via: "cli" };
+    const hygieneClient = (0, client_1.createHygieneApiClient)({ environment });
+    // Typed-item-path confirmation gate: one prompt per item. Operator
+    // sees the resolved path and types it back literally. `--yes`
+    // (alongside `--confirm-item-path`) skips the prompt for CI, but
+    // the supplied path MUST equal the resolved path — otherwise we
+    // refuse so accidental paste of the wrong path can't slip through.
+    const pathByItem = new Map();
+    for (const id of itemIds) {
+        const cached = ctx.resolvedPaths.get(id);
+        const resolved = cached ?? (await lookupItemPath(environment, id));
+        if (!resolved) {
+            throw (0, errors_1.createScaiError)(`Item ${id} not found in env '${envName}'; refusing to delete.`, "INPUT_INVALID");
+        }
+        pathByItem.set(id, resolved);
+    }
+    for (const id of itemIds) {
+        const resolvedPath = pathByItem.get(id);
+        if (ctx.yes && ctx.confirmItemPath) {
+            if (ctx.confirmItemPath !== resolvedPath) {
+                throw (0, errors_1.createScaiError)(`--confirm-item-path mismatch for ${id}: provided '${ctx.confirmItemPath}', resolved '${resolvedPath}'.`, "INPUT_INVALID", {
+                    hint: "Provide the exact resolved path, or omit --confirm-item-path and use the interactive prompt.",
+                });
+            }
+            logger.info(`  ${id} (${resolvedPath}): typed-path confirmation passed (--yes mode).`, "gray");
+        }
+        else {
+            if (ctx.nonInteractive) {
+                throw (0, errors_1.createScaiError)("Delete in non-interactive mode requires --yes AND --confirm-item-path.", "INPUT_INVALID");
+            }
+            const typed = await (0, prompt_1.promptText)(`Type the path '${resolvedPath}' to confirm permanent deletion of ${id}:`);
+            if (typed !== resolvedPath) {
+                throw (0, errors_1.createScaiError)(`Confirmation mismatch for ${id}: typed '${typed}', expected '${resolvedPath}'. Aborting; nothing deleted.`, "INPUT_INVALID");
+            }
+        }
+    }
+    // All confirmations passed. Issue the deletes; audit each one
+    // BEFORE moving to the next, so an interrupted run still has an
+    // accurate trail.
+    for (const id of itemIds) {
+        const resolvedPath = pathByItem.get(id);
+        try {
+            await hygieneClient.deleteItem({ itemId: id, permanently: true });
+            (0, publish_audit_1.recordPublishAudit)({
+                ts: new Date().toISOString(),
+                command: "publish unpublish",
+                caller,
+                scope: { ...ctx.scope, itemIds: [id], path: resolvedPath },
+                risk: "high",
+                scopeHash: ctx.scopeHash,
+                scopeToken: ctx.confirmToken,
+                outcome: "ok",
+                fieldChanges: [{ name: "__DELETED__", before: resolvedPath, after: null }],
+            });
+            logger.info(`  ${id} (${resolvedPath}): deleted permanently.`, "yellow");
+        }
+        catch (err) {
+            (0, publish_audit_1.recordPublishAudit)({
+                ts: new Date().toISOString(),
+                command: "publish unpublish",
+                caller,
+                scope: { ...ctx.scope, itemIds: [id], path: resolvedPath },
+                risk: "high",
+                scopeHash: ctx.scopeHash,
+                scopeToken: ctx.confirmToken,
+                outcome: "error",
+                errorCode: err instanceof Error && "code" in err
+                    ? String(err.code)
+                    : "UNKNOWN",
+                errorMessage: err instanceof Error ? err.message : String(err),
+            });
+            throw err;
+        }
+    }
+    // Submit a publish job so Edge sees the deletions. Smart mode picks
+    // up the missing items and removes them from Edge.
+    const accessToken = await (0, auth_1.acquirePublishingToken)({ envName, environment });
+    const client = { accessToken, timeoutMs };
+    const defaultName = `scai content publish unpublish [delete] ${itemIds.length} item(s) (${envName})`;
+    const request = {
+        name: ctx.name ?? defaultName,
+        source: ctx.source ?? "scai",
+        options: {
+            items: itemIds.map((id) => ({ id, type: "item" })),
+            xmc: {
+                locales: ctx.languages.length > 0 ? ctx.languages : undefined,
+                items: {
+                    mode: "Smart",
+                    publishChildren: ctx.includeSubitems,
+                    publishRelatedItems: ctx.includeRelated,
+                },
+            },
+        },
+    };
+    try {
+        const job = await (0, client_2.submitPublishJob)(client, request);
+        (0, publish_audit_1.recordPublishAudit)({
+            ts: new Date().toISOString(),
+            command: "publish unpublish",
+            caller,
+            scope: ctx.scope,
+            risk: "high",
+            scopeHash: ctx.scopeHash,
+            scopeToken: ctx.confirmToken,
+            jobId: job.id,
+            outcome: "ok",
+        });
+        if (logger.isJson()) {
+            process.stdout.write(`${JSON.stringify(job, null, 2)}\n`);
+            return;
+        }
+        logger.info(`Submitted publish job ${job.id} (${job.state}).`, "green");
+        logger.info(`Track with: scai content publish status ${job.id} -n ${envName}`, "gray");
+        logger.warn(`Delete is NOT reversible from scai. Restoring requires Sitecore archive recovery or re-creation from serialization.`, "yellow");
+    }
+    catch (err) {
+        (0, publish_audit_1.recordPublishAudit)({
+            ts: new Date().toISOString(),
+            command: "publish unpublish",
+            caller,
+            scope: ctx.scope,
+            risk: "high",
+            scopeHash: ctx.scopeHash,
+            scopeToken: ctx.confirmToken,
+            outcome: "error",
+            errorCode: err instanceof Error && "code" in err ? String(err.code) : "UNKNOWN",
+            errorMessage: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+};
+const runPublishUnpublish = async (options) => {
+    const logger = toLogger(options);
+    const directItemIds = options.itemIds ?? [];
+    const paths = options.paths ?? [];
+    if (directItemIds.length === 0 && paths.length === 0 && !options.site) {
+        throw (0, errors_1.createScaiError)("Unpublish requires at least one --items <guid>, --paths <path>, or --site <name>.", "INPUT_INVALID", {
+            hint: "Pass --items <guid>, --paths <path>, and/or --site <name>. --site resolves the site's content-tree root; add --include-subitems to unpublish the whole site.",
+        });
+    }
+    const strategy = options.strategy ?? "never-publish";
+    const { envName, environment, timeoutMs } = (0, environment_1.resolveEnvironment)(options);
+    const target = "Edge";
+    const languages = await (0, languages_1.resolvePublishingLocales)(logger, environment, options);
+    // Resolve paths → IDs up-front so the dry-run scope reflects the
+    // actual items the field-write + publish-job will see.
+    let resolvedFromPaths = [];
+    if (paths.length > 0) {
+        logger.info(`Resolving ${paths.length} path(s) via Authoring GraphQL...`, "gray");
+        const result = await (0, path_resolver_1.resolveItemPathsToIds)(environment, paths);
+        resolvedFromPaths = result.resolved;
+        for (const r of resolvedFromPaths) {
+            logger.info(`  ${r.path} → ${r.itemId}`, "gray");
+        }
+    }
+    // Site root resolution. Composable with --items / --paths.
+    let resolvedSite;
+    if (options.site) {
+        logger.info(`Resolving site '${options.site}' root via Sites + Authoring GraphQL...`, "gray");
+        resolvedSite = await (0, sites_1.resolveSiteRoot)(environment, options.site);
+        logger.info(`  → ${resolvedSite.path} (${resolvedSite.itemId})`, "gray");
+        if (!options.includeSubitems) {
+            logger.info(`Targeting only the site root. Pass --include-subitems for the whole site.`, "gray");
+        }
+    }
+    const itemIds = [
+        ...directItemIds,
+        ...resolvedFromPaths.map((r) => r.itemId),
+        ...(resolvedSite ? [resolvedSite.itemId] : []),
+    ];
+    // Default to the env's configured publish languages if the operator
+    // didn't pass any. We don't know those at this layer — leave the
+    // array empty in the scope (audit shows "(default)") and walk the
+    // env's authoring API which will infer. For the field-write loop
+    // we need a concrete list; if empty, fall back to ["en"] (the
+    // tenant default for most XM Cloud installs).
+    const writeLanguages = languages.length > 0 ? languages : ["en"];
+    const scope = {
+        envName,
+        resolvedTenantId: environment.tenantId,
+        target,
+        kind: "unpublish",
+        itemIds,
+        languages,
+        includeSubitems: options.includeSubitems,
+        includeRelated: options.includeRelated,
+        strategy,
+    };
+    const scopeHash = (0, publish_consent_1.computeScopeHash)(scope);
+    const whatIf = options.allowWrite ? Boolean(options.whatIf) : true;
+    const productionTier = (0, env_tier_1.isProductionTier)(environment);
+    if (whatIf) {
+        logger.warn(`What-if: would unpublish ${itemIds.length} item(s) via strategy '${strategy}'.`, "yellow");
+        printScope(logger, scope);
+        const token = (0, publish_consent_1.mintScopeToken)(scope);
+        logger.info("", "gray");
+        if (productionTier) {
+            logger.info(`Production-tier env. Real call requires --allow-write AND --confirm-token.`, "yellow");
+        }
+        logger.info(`Scope token (TTL ${publish_consent_1.SCOPE_TOKEN_TTL_MS / 1000}s):`, "gray");
+        process.stdout.write(`${token}\n`);
+        logger.info("", "gray");
+        logger.info(`To execute: rerun with --allow-write${productionTier ? ` --confirm-token ${token}` : ""}`, "gray");
+        return;
+    }
+    // Real call from here on. Layer the safety checks.
+    if (productionTier) {
+        if (!options.confirmToken) {
+            throw (0, errors_1.createScaiError)(`Production-tier env '${envName}' requires --confirm-token.`, "INPUT_INVALID", {
+                hint: "Run the same command without --allow-write to mint a scope token, then pass it back as --confirm-token <token>.",
+            });
+        }
+        const verification = (0, publish_consent_1.verifyScopeToken)(options.confirmToken, scope);
+        if (!verification.ok) {
+            throw (0, errors_1.createScaiError)(`Scope token rejected (${verification.reason}).`, "INPUT_INVALID", {
+                hint: "Re-run the dry-run to mint a fresh token; the scope or env may have changed since the token was issued.",
+            });
+        }
+    }
+    else if (!options.yes) {
+        if (options.nonInteractive) {
+            throw (0, errors_1.createScaiError)("Non-interactive mode requires --yes (or --confirm-token on prod envs).", "INPUT_INVALID");
+        }
+        logger.info(`About to unpublish ${itemIds.length} item(s) via strategy '${strategy}' in env '${envName}'.`, "yellow");
+        printScope(logger, scope);
+        const ok = await (0, prompt_1.promptConfirm)("Proceed with unpublish?", false);
+        if (!ok) {
+            logger.info("Aborted.", "yellow");
+            return;
+        }
+    }
+    // Delete strategy branches into its own flow — it's item-scoped
+    // (not version-scoped), requires typed-item-path confirmation, and
+    // emits high-risk audit entries.
+    if (strategy === "delete") {
+        // Build path-by-item map from the path resolution we already did
+        // when --paths was used; we'll re-resolve missing ones inside.
+        const resolvedPaths = new Map();
+        for (const r of resolvedFromPaths) {
+            resolvedPaths.set(r.itemId, r.path);
+        }
+        await runDeleteUnpublish({
+            envName,
+            environment,
+            timeoutMs,
+            logger,
+            itemIds,
+            resolvedPaths,
+            scope,
+            scopeHash,
+            productionTier,
+            confirmToken: options.confirmToken,
+            confirmItemPath: options.confirmItemPath,
+            yes: Boolean(options.yes),
+            nonInteractive: Boolean(options.nonInteractive),
+            includeSubitems: options.includeSubitems,
+            includeRelated: options.includeRelated,
+            languages,
+            name: options.name,
+            source: options.source,
+        });
+        return;
+    }
+    const caller = { type: "human", via: "cli" };
+    // Step 1: per-(item, language) field writes. Audit every mutation
+    // BEFORE issuing the publish job so the trail is durable even if
+    // the publish job submission fails afterward.
+    const allFieldChanges = [];
+    for (const itemId of itemIds) {
+        for (const language of writeLanguages) {
+            try {
+                const changes = await applyStrategy(environment, itemId, language, strategy, false);
+                allFieldChanges.push(...changes);
+                (0, publish_audit_1.recordPublishAudit)({
+                    ts: new Date().toISOString(),
+                    command: "publish unpublish",
+                    caller,
+                    scope: { ...scope, itemIds: [itemId], languages: [language] },
+                    // strategy narrowed to "never-publish" | "expire-now" (delete
+                    // was thrown earlier); both are reversible, so "normal" risk.
+                    risk: "normal",
+                    scopeHash,
+                    scopeToken: options.confirmToken,
+                    outcome: "ok",
+                    fieldChanges: changes,
+                });
+                logger.info(`  ${itemId} (${language}): ${strategy} applied.`, "gray");
+            }
+            catch (err) {
+                (0, publish_audit_1.recordPublishAudit)({
+                    ts: new Date().toISOString(),
+                    command: "publish unpublish",
+                    caller,
+                    scope: { ...scope, itemIds: [itemId], languages: [language] },
+                    // strategy narrowed to "never-publish" | "expire-now" (delete
+                    // was thrown earlier); both are reversible, so "normal" risk.
+                    risk: "normal",
+                    scopeHash,
+                    scopeToken: options.confirmToken,
+                    outcome: "error",
+                    errorCode: err instanceof Error && "code" in err
+                        ? String(err.code)
+                        : "UNKNOWN",
+                    errorMessage: err instanceof Error ? err.message : String(err),
+                });
+                throw err;
+            }
+        }
+    }
+    // Step 2: submit a publish job so Edge sees the state change. The
+    // Publishing API is the same one `scai content publish item` uses; we
+    // bundle every targeted itemId into a single job with the
+    // operator-supplied subitems/related flags.
+    const accessToken = await (0, auth_1.acquirePublishingToken)({ envName, environment });
+    const client = { accessToken, timeoutMs };
+    const defaultName = `scai content publish unpublish ${itemIds.length} item(s) (${envName})`;
+    const request = {
+        name: options.name ?? defaultName,
+        source: options.source ?? "scai",
+        options: {
+            items: itemIds.map((id) => ({ id, type: "item" })),
+            xmc: {
+                locales: languages.length > 0 ? languages : undefined,
+                items: {
+                    // Smart mode — the Publishing API picks up the
+                    // __Never publish / __Valid to mutation as a state change
+                    // and removes the item from Edge on its next pass. Republish
+                    // would be wrong: it forces re-emit, which contradicts the
+                    // intent here.
+                    mode: "Smart",
+                    publishChildren: options.includeSubitems,
+                    publishRelatedItems: options.includeRelated,
+                },
+            },
+        },
+    };
+    try {
+        const job = await (0, client_2.submitPublishJob)(client, request);
+        (0, publish_audit_1.recordPublishAudit)({
+            ts: new Date().toISOString(),
+            command: "publish unpublish",
+            caller,
+            scope,
+            // Strategy narrowed to "never-publish" | "expire-now" earlier;
+            // both reversible, so "normal" risk.
+            risk: "normal",
+            scopeHash,
+            scopeToken: options.confirmToken,
+            jobId: job.id,
+            outcome: "ok",
+            fieldChanges: allFieldChanges,
+        });
+        if (logger.isJson()) {
+            process.stdout.write(`${JSON.stringify(job, null, 2)}\n`);
+            return;
+        }
+        logger.info(`Submitted publish job ${job.id} (${job.state}).`, "green");
+        logger.info(`Track with: scai content publish status ${job.id} -n ${envName}`, "gray");
+        logger.info(`Reverse with: scai content version set-${strategy === "never-publish" ? "never-publish --value false" : "validity --clear-valid-to"} --item-id <id> -n ${envName}`, "gray");
+    }
+    catch (err) {
+        (0, publish_audit_1.recordPublishAudit)({
+            ts: new Date().toISOString(),
+            command: "publish unpublish",
+            caller,
+            scope,
+            // Strategy narrowed to "never-publish" | "expire-now" earlier;
+            // both reversible, so "normal" risk.
+            risk: "normal",
+            scopeHash,
+            scopeToken: options.confirmToken,
+            outcome: "error",
+            errorCode: err instanceof Error && "code" in err ? String(err.code) : "UNKNOWN",
+            errorMessage: err instanceof Error ? err.message : String(err),
+            fieldChanges: allFieldChanges,
+        });
+        throw err;
+    }
+};
+exports.runPublishUnpublish = runPublishUnpublish;

package/dist/recipe/api/auth.d.ts

@@ -5,5 +5,4 @@
  * `src/recipe/api/*` is self-contained and can be mocked at one
  * predictable seam in tests.
  */
-export { getAccessToken } from "../../serialization/sitecore-api/auth";
-//# sourceMappingURL=auth.d.ts.map
+export { getAccessToken } from "../../serialization/api/auth";

package/dist/recipe/api/auth.js

@@ -8,5 +8,5 @@ exports.getAccessToken = void 0;
  * `src/recipe/api/*` is self-contained and can be mocked at one
  * predictable seam in tests.
  */
-var auth_1 = require("../../serialization/sitecore-api/auth");
+var auth_1 = require("../../serialization/api/auth");
 Object.defineProperty(exports, "getAccessToken", { enumerable: true, get: function () { return auth_1.getAccessToken; } });

package/dist/recipe/api/authoring-client.d.ts

@@ -1,8 +1,15 @@
-import type { EnvironmentConfiguration } from "../../config";
+import type { SitecoreApiClientOptions } from "../../serialization/api/types";
 import { type AuthoringApiClient } from "./client";
 import { type AuthoringRequestOptions } from "./graphql";
 export interface AuthoringClientOptions {
-    environment: EnvironmentConfiguration;
+    /**
+     * Auth + host options for the Authoring API. The CLI passes its full
+     * resolved `EnvironmentConfiguration` (which structurally satisfies
+     * `SitecoreApiClientOptions`) — typically augmented with `orgClientId`
+     * from the root config's `orgClients` block so the auth layer can
+     * resolve the org-scoped automation client.
+     */
+    environment: SitecoreApiClientOptions;
     request?: AuthoringRequestOptions;
     /**
      * Optional shared path → itemId cache. When provided, the client uses
@@ -34,4 +41,3 @@ export interface AuthoringClientOptions {
     batchedReadConcurrency?: number;
 }
 export declare const createAuthoringClient: (options: AuthoringClientOptions) => AuthoringApiClient;
-//# sourceMappingURL=authoring-client.d.ts.map