@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.1

package/dist/serialization/filesystem-store/items.d.ts

@@ -7,4 +7,3 @@ export declare const loadFilesystemItems: (subtrees: FilesystemTreeSpec[]) => Pr
 }>;
 export declare const writeItemToFilesystem: (pathProvider: FilesystemPathProvider, item: ItemData) => Promise<string>;
 export declare const removeItemFromFilesystem: (pathProvider: FilesystemPathProvider, item: ItemMetadata) => Promise<void>;
-//# sourceMappingURL=items.d.ts.map

package/dist/serialization/filesystem-store/items.js

@@ -46,7 +46,7 @@ exports.loadFilesystemItems = loadFilesystemItems;
 const writeItemToFilesystem = async (pathProvider, item) => {
     const targetPath = pathProvider.getPhysicalPathForItemPath(item.path, ".yml");
     if (!targetPath) {
-        throw (0, errors_1.createCliError)(`Unable to resolve file path for ${item.path}`, "INPUT_INVALID");
+        throw (0, errors_1.createScaiError)(`Unable to resolve file path for ${item.path}`, "INPUT_INVALID");
     }
     await promises_1.default.mkdir(node_path_1.default.dirname(targetPath), { recursive: true });
     const content = (0, yaml_1.writeItemYaml)(item);

package/dist/serialization/filesystem-store/roles.d.ts

@@ -1,6 +1,5 @@
 import { RoleData } from "../types";
-import { RootConfiguration, SerializationModuleConfiguration } from "../../config";
+import type { RootConfiguration, SerializationModuleConfiguration } from "../../config/types";
 export declare const readRolesFromFilesystem: (rootConfig: RootConfiguration, moduleConfig: SerializationModuleConfiguration) => Promise<RoleData[]>;
 export declare const writeRoleToFilesystem: (rootConfig: RootConfiguration, moduleConfig: SerializationModuleConfiguration, role: RoleData) => Promise<string>;
 export declare const removeRoleFromFilesystem: (rolePath?: string) => Promise<void>;
-//# sourceMappingURL=roles.d.ts.map

package/dist/serialization/filesystem-store/users.d.ts

@@ -1,6 +1,5 @@
 import { UserData } from "../types";
-import { RootConfiguration, SerializationModuleConfiguration } from "../../config";
+import type { RootConfiguration, SerializationModuleConfiguration } from "../../config/types";
 export declare const readUsersFromFilesystem: (rootConfig: RootConfiguration, moduleConfig: SerializationModuleConfiguration) => Promise<UserData[]>;
 export declare const writeUserToFilesystem: (rootConfig: RootConfiguration, moduleConfig: SerializationModuleConfiguration, user: UserData) => Promise<string>;
 export declare const removeUserFromFilesystem: (userPath?: string) => Promise<void>;
-//# sourceMappingURL=users.d.ts.map

package/dist/serialization/filesystem-store/utils.d.ts

@@ -1,2 +1 @@
 export declare const exists: (value: string) => Promise<boolean>;
-//# sourceMappingURL=utils.d.ts.map

package/dist/serialization/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Public entry for `@sitecoreai-labs/sitecoreai-cli/serialization`.
+ *
+ * `./api/index.ts` is itself a curated, explicit barrel (zero `export *`)
+ * and stays the source of truth for the Sitecore Management + Authoring
+ * GraphQL client surface — it is re-exported wholesale. `./context` is a
+ * plain module, so its public symbols are enumerated explicitly below: a
+ * new intra-area `export` in `context.ts` must be added here deliberately
+ * to widen the SDK surface.
+ */
+export * from "./api";
+export { loadConfigAndModules, groupSubtreesByDatabase, ensureAllowWrite, type LoadSerializationModulesOptions, } from "./context";

package/dist/serialization/index.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * Public entry for `@sitecoreai-labs/sitecoreai-cli/serialization`.
+ *
+ * `./api/index.ts` is itself a curated, explicit barrel (zero `export *`)
+ * and stays the source of truth for the Sitecore Management + Authoring
+ * GraphQL client surface — it is re-exported wholesale. `./context` is a
+ * plain module, so its public symbols are enumerated explicitly below: a
+ * new intra-area `export` in `context.ts` must be added here deliberately
+ * to widen the SDK surface.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureAllowWrite = exports.groupSubtreesByDatabase = exports.loadConfigAndModules = void 0;
+__exportStar(require("./api"), exports);
+var context_1 = require("./context");
+Object.defineProperty(exports, "loadConfigAndModules", { enumerable: true, get: function () { return context_1.loadConfigAndModules; } });
+Object.defineProperty(exports, "groupSubtreesByDatabase", { enumerable: true, get: function () { return context_1.groupSubtreesByDatabase; } });
+Object.defineProperty(exports, "ensureAllowWrite", { enumerable: true, get: function () { return context_1.ensureAllowWrite; } });

package/dist/serialization/item-path.d.ts

@@ -29,4 +29,3 @@ export declare class ItemPathMatch implements ItemPathMatchLike {
     toPathString(): string;
     toString(): string;
 }
-//# sourceMappingURL=item-path.d.ts.map

package/dist/serialization/item-path.js

@@ -10,7 +10,7 @@ class ItemPath {
     }
     static fromPathString(pathString) {
         if (!pathString || !pathString.startsWith("/")) {
-            throw (0, errors_1.createCliError)(`Item path '${pathString}' did not start with /.`, "INPUT_INVALID");
+            throw (0, errors_1.createScaiError)(`Item path '${pathString}' did not start with /.`, "INPUT_INVALID");
         }
         const segments = pathString.split("/").filter(Boolean);
         return new ItemPath(segments, pathString.replace(/\/+$/, ""));
@@ -55,14 +55,14 @@ class ItemPath {
     }
     prepend(segment) {
         if (!segment || segment.includes("/")) {
-            throw (0, errors_1.createCliError)("Cannot prepend multiple segments.", "INPUT_INVALID");
+            throw (0, errors_1.createScaiError)("Cannot prepend multiple segments.", "INPUT_INVALID");
         }
         return new ItemPath([segment, ...this.segments]);
     }
     concatenate(segment) {
         if (typeof segment === "string") {
             if (!segment || segment.includes("/")) {
-                throw (0, errors_1.createCliError)("Cannot concatenate multiple segments using string.", "INPUT_INVALID");
+                throw (0, errors_1.createScaiError)("Cannot concatenate multiple segments using string.", "INPUT_INVALID");
             }
             return new ItemPath([...this.segments, segment]);
         }

package/dist/serialization/path-provider.d.ts

@@ -9,4 +9,3 @@ export declare class FilesystemPathProvider {
     toString(): string;
     private invokeUnique;
 }
-//# sourceMappingURL=path-provider.d.ts.map

package/dist/serialization/path-provider.js

@@ -89,7 +89,7 @@ class SubtreeFilesystemPathProvider {
     }
     getPhysicalPathForItemPath(itemPath, extension) {
         if (!extension.startsWith(".")) {
-            throw (0, errors_1.createCliError)("Extension must start with a period.", "INPUT_INVALID");
+            throw (0, errors_1.createScaiError)("Extension must start with a period.", "INPUT_INVALID");
         }
         const childPath = this.getChildrenPathForItemPath(itemPath);
         if (!childPath) {
@@ -211,7 +211,7 @@ class SubtreeFilesystemPathProvider {
             return relativePath;
         }
         if (maxLength < 16) {
-            throw (0, errors_1.createCliError)(`MaxRelativePathLength ${maxLength} is below minimum value of 16.`, "CONFIG_INVALID");
+            throw (0, errors_1.createScaiError)(`MaxRelativePathLength ${maxLength} is below minimum value of 16.`, "CONFIG_INVALID");
         }
         let currentPath = relativeItemPath;
         const targetMultiple = Math.floor(relativeItemPath.pathLength / maxLength);
@@ -223,7 +223,7 @@ class SubtreeFilesystemPathProvider {
             }
         }
         if (!currentPath || currentPath.count === 0) {
-            throw (0, errors_1.createCliError)(`The path ${relativeItemPath} could not be stored because its length could not be reduced below the maximum path length ${maxLength}.`, "INPUT_INVALID");
+            throw (0, errors_1.createScaiError)(`The path ${relativeItemPath} could not be stored because its length could not be reduced below the maximum path length ${maxLength}.`, "INPUT_INVALID");
         }
         const relative = relativeItemPath.createRelativePathFrom(currentPath);
         if (!relative) {
@@ -258,7 +258,7 @@ class FilesystemPathProvider {
         for (const subtree of this.subtrees.getAncestorAndSelfPathData(itemPath)) {
             const subtreeResult = fn(subtree);
             if (subtreeResult != null && result != null) {
-                throw (0, errors_1.createCliError)(`The item path ${itemPath} was included in multiple places. Found valid file paths within these modules: ${resultFoundOn} and ${subtree}`, "CONFIG_INVALID");
+                throw (0, errors_1.createScaiError)(`The item path ${itemPath} was included in multiple places. Found valid file paths within these modules: ${resultFoundOn} and ${subtree}`, "CONFIG_INVALID");
             }
             if (subtreeResult != null) {
                 resultFoundOn = subtree;

package/dist/serialization/signature.d.ts

@@ -1,4 +1,3 @@
 import { ItemData } from "./types";
 export declare const createDataSignatureBase: (item: ItemData, forceBlobRestore?: boolean) => string;
 export declare const createSignature: (signatureBase: string | null) => string | null;
-//# sourceMappingURL=signature.d.ts.map

package/dist/serialization/tasks/diff.d.ts

@@ -1,3 +1,2 @@
 import type { DiffOptions } from "./types";
 export declare const runDiff: (options: DiffOptions) => Promise<void>;
-//# sourceMappingURL=diff.d.ts.map

package/dist/serialization/tasks/diff.js

@@ -8,25 +8,153 @@ const node_path_1 = __importDefault(require("node:path"));
 const item_path_1 = require("../item-path");
 const tree_spec_1 = require("../tree-spec");
 const field_filter_1 = require("../field-filter");
-const sitecore_api_1 = require("../sitecore-api");
+const items_1 = require("../api/items");
 const commands_1 = require("../commands");
 const shared_1 = require("./shared");
-const helpers_1 = require("./helpers");
+const sitecore_1 = require("./helpers/sitecore");
+const commands_2 = require("./helpers/commands");
+const items_2 = require("./helpers/items");
+const collect_1 = require("./helpers/collect");
+const cli_tasks_1 = require("../../shared/cli-tasks");
+const concurrency_1 = require("../../shared/concurrency");
+const summarizeChanges = (commands) => {
+    const out = {
+        create: [],
+        update: [],
+        recycle: [],
+        move: [],
+        rename: [],
+    };
+    for (const cmd of commands) {
+        const entry = {
+            id: cmd.source.id,
+            path: cmd.source.path.toPathString(),
+        };
+        out[cmd.type].push(entry);
+    }
+    return out;
+};
+/**
+ * Fetch metadata for every subtree in a database, parallel-bounded.
+ * Result preserves the (subtree, item) order of the input subtrees so
+ * downstream `buildCommandsForDatabase` sees the same shape sequential
+ * code produced.
+ */
+const fetchSubtreesMetadata = async (env, subtrees, database, filter, apiTimeoutMs) => {
+    const perSubtree = await (0, concurrency_1.mapWithConcurrency)(subtrees, async (subtree) => {
+        const data = await (0, items_1.fetchItemMetadata)(env, database, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
+        return data.filter((item) => subtree.includesPath(item.path));
+    });
+    return perSubtree.flat();
+};
+/**
+ * Run diff (and optional push) for one database against two
+ * environments. Source and destination are fetched concurrently; on
+ * --push, item-data collection for both sides also runs concurrently.
+ */
+const diffDatabase = async ({ root, sourceName, destName, database, subtrees, filter, apiTimeoutMs, options, }) => {
+    const sourceEnv = root.environments[sourceName];
+    const destEnv = root.environments[destName];
+    const [sourceMetadata, destinationMetadata] = await Promise.all([
+        fetchSubtreesMetadata(sourceEnv, subtrees, database, filter, apiTimeoutMs),
+        fetchSubtreesMetadata(destEnv, subtrees, database, filter, apiTimeoutMs),
+    ]);
+    const commands = (0, commands_2.buildCommandsForDatabase)(subtrees, sourceMetadata, destinationMetadata, true);
+    const differences = commands.length;
+    const whatIf = Boolean(options.push && options.whatIf);
+    const applied = Boolean(options.push) && !whatIf;
+    const summary = {
+        database,
+        differences,
+        applied,
+        whatIf,
+    };
+    if (options.verbose) {
+        summary.changes = summarizeChanges(commands);
+    }
+    return { commands, summary };
+};
+/**
+ * Apply a planned diff to the destination environment for one
+ * database. Source + destination item-body fetches run concurrently.
+ */
+const pushDatabase = async (args, commands, logger) => {
+    const { root, sourceName, destName, database, subtrees, options } = args;
+    // Guard: an empty source against a populated target would recycle
+    // every item in the database. Require --force to confirm intent.
+    if (commands.some((cmd) => cmd.type === "recycle")) {
+        const recycles = commands.filter((cmd) => cmd.type === "recycle").length;
+        const sourceMeta = await fetchSubtreesMetadata(root.environments[sourceName], subtrees, database, args.filter, args.apiTimeoutMs);
+        // Re-check on the cached side: if source has zero items but destination has many,
+        // that's the catastrophic-stomp scenario the dotnet CLI quietly executes.
+        if (sourceMeta.length === 0 && recycles > 0) {
+            const confirmed = await (0, cli_tasks_1.confirmDestructive)(`Source environment '${sourceName}' is empty for database '${database}'. ` +
+                `Push would recycle ${recycles} items in '${destName}'. Proceed?`, options.force);
+            if (!confirmed) {
+                logger.info("Push cancelled.", "yellow");
+                return;
+            }
+        }
+    }
+    const [sourceData, destData] = await Promise.all([
+        (0, collect_1.collectItemData)(sourceName, root, subtrees, false),
+        (0, collect_1.collectItemData)(destName, root, subtrees, false),
+    ]);
+    const sourceDataMap = (0, items_2.buildItemDataMap)(sourceData.items);
+    const destDataMap = (0, items_2.buildItemDataMap)(destData.items);
+    (0, commands_1.enrichCreateCommands)(commands, sourceDataMap);
+    (0, commands_1.enrichUpdateCommands)(commands, sourceDataMap, destDataMap, true);
+    await (0, sitecore_1.applySitecoreCommands)(root, destName, database, commands, logger, Boolean(options.whatIf));
+};
 const runDiff = async (options) => {
     const logger = (0, shared_1.toLogger)(options);
     const { root, modules } = await (0, shared_1.loadConfigAndModules)(options);
     const sourceName = options.source ?? root.defaultEnvironment;
     const destName = options.destination ?? root.defaultEnvironment;
     const apiTimeoutMs = (0, shared_1.resolveApiTimeoutMs)(root);
+    if (!root.environments[sourceName]) {
+        throw (0, cli_tasks_1.inputError)(`Source environment '${sourceName}' is not defined in sitecoreai.cli.json.`);
+    }
+    if (!root.environments[destName]) {
+        throw (0, cli_tasks_1.inputError)(`Target environment '${destName}' is not defined in sitecoreai.cli.json.`);
+    }
+    const mode = sourceName === destName ? "local-vs-instance" : "instance-vs-instance";
+    // Same-env diff is a legacy/legitimate no-op (both default to
+    // root.defaultEnvironment). Surface a friendly note in non-JSON mode
+    // so users aren't confused by zero differences.
+    if (mode === "local-vs-instance" && !logger.isJson()) {
+        if (options.source && options.destination) {
+            logger.info(`Source and target are the same environment ('${sourceName}'). Diff will report zero differences. ` +
+                "Pass distinct --source-env / --target-env to diff two environments.", "yellow");
+        }
+    }
+    if (options.push) {
+        // Mirror push.ts: --allow-write flag mutates the in-memory env so
+        // ensureAllowWrite passes; --what-if skips the write gate entirely.
+        if (options.allowWrite) {
+            const destEnvCfg = root.environments[destName];
+            if (destEnvCfg) {
+                destEnvCfg.allowWrite = true;
+            }
+        }
+        if (!options.whatIf) {
+            (0, shared_1.ensureAllowWrite)(root, destName);
+        }
+    }
+    // Hoist filter: excludedFields is invariant across all subtrees and dbs.
+    const filter = (0, field_filter_1.createFieldFilterSet)(root.serialization.excludedFields, []);
     const summary = {
         command: "serialization.diff",
+        mode,
         source: sourceName,
         destination: destName,
         path: options.path ?? null,
         push: Boolean(options.push),
+        whatIf: Boolean(options.push && options.whatIf),
         totalDifferences: 0,
         databases: [],
     };
+    // Path mode: a single subtree explicitly requested via -p.
     if (options.path) {
         const sourceDatabase = options.sourceDatabase ?? "master";
         const destinationDatabase = options.destinationDatabase ?? sourceDatabase;
@@ -37,70 +165,70 @@ const runDiff = async (options) => {
         subtree.scope = tree_spec_1.TreeScope.ItemAndChildren;
         subtree.allowedPushOperations = tree_spec_1.AllowedPushOperations.CreateUpdateAndDelete;
         subtree.physicalPath = node_path_1.default.join(process.cwd(), "diff");
-        const filter = (0, field_filter_1.createFieldFilterSet)(root.serialization.excludedFields, []);
-        const sourceMetadata = await (0, sitecore_api_1.fetchItemMetadata)(root.environments[sourceName], sourceDatabase, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
-        const destMetadata = await (0, sitecore_api_1.fetchItemMetadata)(root.environments[destName], destinationDatabase, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
-        const sourceFiltered = sourceMetadata.filter((item) => subtree.includesPath(item.path));
-        const destFiltered = destMetadata.filter((item) => subtree.includesPath(item.path));
-        const commands = (0, helpers_1.buildCommandsForDatabase)([subtree], sourceFiltered, destFiltered, true);
-        const differences = commands.length;
-        summary.totalDifferences += differences;
-        summary.databases.push({
+        const args = {
+            root,
+            sourceName,
+            destName,
             database: destinationDatabase,
-            differences,
-            applied: Boolean(options.push),
-        });
+            subtrees: [subtree],
+            filter,
+            apiTimeoutMs,
+            options,
+        };
+        const { commands, summary: dbSummary } = await diffDatabase(args);
+        summary.databases.push(dbSummary);
+        summary.totalDifferences += dbSummary.differences;
         if (!logger.isJson()) {
-            logger.info(`Discovered ${differences} differences for ${destinationDatabase}.`, "green");
+            logger.info(`Discovered ${dbSummary.differences} differences for ${destinationDatabase}.`, "green");
         }
         if (options.push) {
-            (0, shared_1.ensureAllowWrite)(root, destName);
-            const sourceData = await (0, helpers_1.collectItemData)(sourceName, root, [subtree], false);
-            const destData = await (0, helpers_1.collectItemData)(destName, root, [subtree], false);
-            const sourceDataMap = (0, helpers_1.buildItemDataMap)(sourceData.items);
-            const destDataMap = (0, helpers_1.buildItemDataMap)(destData.items);
-            (0, commands_1.enrichCreateCommands)(commands, sourceDataMap);
-            (0, commands_1.enrichUpdateCommands)(commands, sourceDataMap, destDataMap, true);
-            await (0, helpers_1.applySitecoreCommands)(root, destName, destinationDatabase, commands, logger, false);
+            await pushDatabase(args, commands, logger);
         }
         if (logger.isJson()) {
             logger.json(summary);
         }
         return;
     }
+    // Module mode: walk subtrees grouped by database. Databases stay
+    // sequential — typically only master+core, and serializing them
+    // keeps spinner output / partial-failure semantics predictable.
     const subtreesByDb = (0, shared_1.groupSubtreesByDatabase)(modules);
     for (const [database, subtrees] of subtreesByDb) {
-        const sourceMetadata = [];
-        const destinationMetadata = [];
-        for (const subtree of subtrees) {
-            const filter = (0, field_filter_1.createFieldFilterSet)(root.serialization.excludedFields, []);
-            const source = await (0, sitecore_api_1.fetchItemMetadata)(root.environments[sourceName], database, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
-            const dest = await (0, sitecore_api_1.fetchItemMetadata)(root.environments[destName], database, subtree.path.toPathString(), subtree.scope, filter, false, { timeoutMs: apiTimeoutMs });
-            sourceMetadata.push(...source.filter((item) => subtree.includesPath(item.path)));
-            destinationMetadata.push(...dest.filter((item) => subtree.includesPath(item.path)));
+        if (options.signal?.aborted) {
+            options.emit?.({ kind: "database-skipped", database, reason: "cancelled-by-client" });
+            break;
         }
-        const commands = (0, helpers_1.buildCommandsForDatabase)(subtrees, sourceMetadata, destinationMetadata, true);
-        const differences = commands.length;
-        summary.totalDifferences += differences;
-        summary.databases.push({
+        options.emit?.({ kind: "database-start", database, subtreeCount: subtrees.length });
+        const args = {
+            root,
+            sourceName,
+            destName,
             database,
-            differences,
-            applied: Boolean(options.push),
+            subtrees,
+            filter,
+            apiTimeoutMs,
+            options,
+        };
+        const { commands, summary: dbSummary } = await diffDatabase(args);
+        summary.databases.push(dbSummary);
+        summary.totalDifferences += dbSummary.differences;
+        options.emit?.({
+            kind: "database-changes-detected",
+            database,
+            changes: dbSummary.differences,
         });
         if (!logger.isJson()) {
-            logger.info(`Discovered ${differences} differences for ${database}.`, "green");
+            logger.info(`Discovered ${dbSummary.differences} differences for ${database}.`, "green");
         }
-        if (!options.push) {
-            continue;
+        if (options.push) {
+            await pushDatabase(args, commands, logger);
+            options.emit?.({
+                kind: "database-applied",
+                database,
+                changes: dbSummary.differences,
+                whatIf: Boolean(options.whatIf),
+            });
         }
-        (0, shared_1.ensureAllowWrite)(root, destName);
-        const sourceData = await (0, helpers_1.collectItemData)(sourceName, root, subtrees, false);
-        const destData = await (0, helpers_1.collectItemData)(destName, root, subtrees, false);
-        const sourceDataMap = (0, helpers_1.buildItemDataMap)(sourceData.items);
-        const destDataMap = (0, helpers_1.buildItemDataMap)(destData.items);
-        (0, commands_1.enrichCreateCommands)(commands, sourceDataMap);
-        (0, commands_1.enrichUpdateCommands)(commands, sourceDataMap, destDataMap, true);
-        await (0, helpers_1.applySitecoreCommands)(root, destName, database, commands, logger, false);
     }
     if (logger.isJson()) {
         logger.json(summary);

package/dist/serialization/tasks/env/constants.d.ts

@@ -1,2 +1,14 @@
 export declare const DEFAULT_PUBLIC_CLIENT_ID = "Chi8EwfFnEejksk3Sed9hlalGiM9B2v7";
-//# sourceMappingURL=constants.d.ts.map
+/**
+ * Scope set for the interactive device-code flow. Adds the OIDC user-
+ * context scopes plus `offline_access` so we get a refresh token back.
+ * Joining with spaces is the OAuth/OIDC standard separator for the
+ * `scope` parameter.
+ */
+export declare const SCAI_DEVICE_FLOW_SCOPES: string;
+/**
+ * Scope set for the client_credentials (m2m) flow. OIDC user-context
+ * scopes (openid/profile/email) and `offline_access` don't apply to
+ * machine clients; restrict to the API scopes only.
+ */
+export declare const SCAI_CLIENT_CREDENTIALS_SCOPES: string;

package/dist/serialization/tasks/env/constants.js

@@ -1,4 +1,67 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_PUBLIC_CLIENT_ID = void 0;
+exports.SCAI_CLIENT_CREDENTIALS_SCOPES = exports.SCAI_DEVICE_FLOW_SCOPES = exports.DEFAULT_PUBLIC_CLIENT_ID = void 0;
 exports.DEFAULT_PUBLIC_CLIENT_ID = "Chi8EwfFnEejksk3Sed9hlalGiM9B2v7";
+/**
+ * Auth0 only includes scopes in a token if the request asks for them
+ * (or the client has them as a "default" grant). When `scope` is omitted
+ * on a device-code or client_credentials request, the issuer hands back
+ * the client's default grant only — which for the public scai CLI
+ * client is the `xmclouddeploy.*` family. That leaves Authoring API
+ * calls (any `xmcloud.cm:admin`-gated path: recipes, workflow, webhook)
+ * with no usable token even after a "successful" login.
+ *
+ * Below: the full scope set scai requests at login. Mirrors what an
+ * operator could plausibly need across the CLI's surface — Deploy
+ * lifecycle, Authoring API writes (`xmcloud.cm:admin`), platform
+ * inventory, IAM read. Tokens are issued for the intersection of this
+ * list and the client's allow-list in Auth0, so misconfigured clients
+ * still mint *something* — just without the missing scope, which then
+ * surfaces as a clean upstream 401 rather than a silently-empty scope.
+ */
+const SCAI_API_SCOPES = [
+    // Authoring + Management GraphQL — the missing-link scope that lets
+    // recipes, workflow, and webhook tools call api.sitecorecloud.io's
+    // Authoring API.
+    "xmcloud.cm:admin",
+    // Deploy API — projects, environments, deployments, repos, monitoring.
+    "xmclouddeploy.clients:manage",
+    "xmclouddeploy.deployments:manage",
+    "xmclouddeploy.environments:manage",
+    "xmclouddeploy.monitoring.deployments:read",
+    "xmclouddeploy.organizations:manage",
+    "xmclouddeploy.projects:manage",
+    "xmclouddeploy.rh:mng",
+    "xmclouddeploy.site:mng",
+    "xmclouddeploy.sourcecontrol:manage",
+    // Platform inventory + IAM read — needed by scai setup status / org
+    // inspectors when an agent walks the tenancy tree.
+    "platform.tenants:listall",
+    "iam.usr_roles:r",
+    // SAI Publishing API — tenant-tier scopes used by `scai content publish`.
+    // Granted only on environment-level automation clients per the
+    // Publishing API architect (org-level clients won't get them, and
+    // the issued token will just omit them in that case — harmless).
+    "xmcpub.jobs.t:r",
+    "xmcpub.jobs.t:w",
+    "xmcpub.queue:r",
+];
+/**
+ * Scope set for the interactive device-code flow. Adds the OIDC user-
+ * context scopes plus `offline_access` so we get a refresh token back.
+ * Joining with spaces is the OAuth/OIDC standard separator for the
+ * `scope` parameter.
+ */
+exports.SCAI_DEVICE_FLOW_SCOPES = [
+    "openid",
+    "profile",
+    "email",
+    "offline_access",
+    ...SCAI_API_SCOPES,
+].join(" ");
+/**
+ * Scope set for the client_credentials (m2m) flow. OIDC user-context
+ * scopes (openid/profile/email) and `offline_access` don't apply to
+ * machine clients; restrict to the API scopes only.
+ */
+exports.SCAI_CLIENT_CREDENTIALS_SCOPES = SCAI_API_SCOPES.join(" ");

package/dist/serialization/tasks/env/deploy-token.d.ts

@@ -1,3 +1,2 @@
 import type { DeployTokenOptions } from "../../../deploy/tasks/types";
 export declare const runDeployToken: (options: DeployTokenOptions) => Promise<void>;
-//# sourceMappingURL=deploy-token.d.ts.map