@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.1

package/dist/serialization/tasks/env/onboard.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * `runEnvironmentOnboard` — stand up a new environment profile.
+ *
+ * The agent-drivable half of environment setup: write the env profile
+ * into `sitecoreai.cli.json`, then run the access preflight so the
+ * caller sees exactly what is left — policy enrollment (agent-clearable)
+ * and credentials (human-terminal-only, see `HUMAN_ONLY_OPERATIONS`).
+ *
+ * It deliberately does NOT mint a client or log in — those are
+ * human-only — and does NOT discover the tenant: the caller supplies
+ * the organization / project / environment ids and host (resolve them
+ * first with the deploy tools or `scai_overview`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runEnvironmentOnboard = void 0;
+const root_config_1 = require("../../../config/root-config");
+const errors_1 = require("../../../shared/errors");
+const validate_1 = require("../../../shared/validate");
+const access_check_1 = require("../../../policy/access-check");
+const DEFAULT_AUTHORITY = "https://auth.sitecorecloud.io";
+/**
+ * Add a new environment profile to the config, then preflight it.
+ * Throws `INPUT_INVALID` rather than clobbering an existing profile.
+ */
+const runEnvironmentOnboard = async (options) => {
+    const configPath = options.config ?? process.cwd();
+    const envName = options.environmentName.trim();
+    if (!envName) {
+        throw (0, errors_1.createScaiError)("An environment name is required.", "INPUT_INVALID");
+    }
+    (0, validate_1.assertValidHost)(options.host, "CM host");
+    const rootFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+    const envProfiles = rootFile.config.envProfiles ?? {};
+    if (envProfiles[envName]) {
+        throw (0, errors_1.createScaiError)(`Environment '${envName}' is already configured.`, "INPUT_INVALID", {
+            hint: "Pick a different name, or edit the existing profile directly.",
+        });
+    }
+    const profile = {
+        organizationId: options.organizationId,
+        projectId: options.projectId,
+        environmentId: options.environmentId,
+        environmentType: options.environmentType ?? "cm",
+        host: options.host,
+        authority: options.authority ?? DEFAULT_AUTHORITY,
+    };
+    rootFile.config.envProfiles = { ...envProfiles, [envName]: profile };
+    (0, root_config_1.writeRootConfigurationFile)(configPath, rootFile.config);
+    const access = await (0, access_check_1.checkAccess)({ configPath, environmentName: envName });
+    return { environmentName: envName, profile, access };
+};
+exports.runEnvironmentOnboard = runEnvironmentOnboard;

package/dist/serialization/tasks/env/setup-clients.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `scai setup clients [name]` — list, or with `--delete <id>` remove,
+ * the automation clients (credentials) in an environment's
+ * organization.
+ *
+ * The Deploy clients API is organization-scoped, so this covers every
+ * client in the org the named environment belongs to — both the
+ * environment-scoped clients (`cm`, `edge`, `ehbuild`) and the
+ * organization-scoped `deploy` clients. scai-minted clients (the
+ * `scai-*` naming convention) are flagged so an operator can tell
+ * what scai provisioned apart from anything created by hand.
+ *
+ * Pair with `scai setup env` (mint) and `scai setup status` (the
+ * yes/no credential matrix).
+ */
+import type { CommonOptions } from "../../../shared/cli-options";
+export type SetupClientsOptions = CommonOptions & {
+    environmentName?: string;
+    /** When set, delete the client with this id instead of listing. */
+    delete?: string;
+    /** Skip the delete confirmation prompt. */
+    force?: boolean;
+};
+export declare const runSetupClients: (options: SetupClientsOptions) => Promise<void>;

package/dist/serialization/tasks/env/setup-clients.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * `scai setup clients [name]` — list, or with `--delete <id>` remove,
+ * the automation clients (credentials) in an environment's
+ * organization.
+ *
+ * The Deploy clients API is organization-scoped, so this covers every
+ * client in the org the named environment belongs to — both the
+ * environment-scoped clients (`cm`, `edge`, `ehbuild`) and the
+ * organization-scoped `deploy` clients. scai-minted clients (the
+ * `scai-*` naming convention) are flagged so an operator can tell
+ * what scai provisioned apart from anything created by hand.
+ *
+ * Pair with `scai setup env` (mint) and `scai setup status` (the
+ * yes/no credential matrix).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSetupClients = void 0;
+const root_config_1 = require("../../../config/root-config");
+const keychain_1 = require("../../../shared/keychain");
+const api_1 = require("../../../deploy/api");
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const errors_1 = require("../../../shared/errors");
+const renderRow = (logger, name, id, clientId, scope) => {
+    const tag = (0, api_1.isScaiManagedClient)(name) ? "[scai]" : "      ";
+    logger.info(`  ${tag} ${name ?? "(unnamed)"}  ${id ?? "?"}${scope}`);
+    if (clientId) {
+        logger.info(`         clientId: ${clientId}`);
+    }
+};
+const runSetupClients = async (options) => {
+    const logger = (0, cli_tasks_1.toLogger)(options);
+    const configPath = options.config ?? process.cwd();
+    const { envName, env } = (0, root_config_1.resolveActiveEnvironment)(configPath, options.environmentName);
+    const organizationId = env.organizationId;
+    if (!organizationId) {
+        throw (0, cli_tasks_1.inputError)(`Environment '${envName}' has no organizationId.`, "Set organizationId on the env profile, or run `scai setup init`.");
+    }
+    const deployToken = (await (0, keychain_1.getDeployToken)(envName)) ?? env.deployToken ?? process.env.SITECOREAI_DEPLOY_TOKEN;
+    if (!deployToken) {
+        throw (0, errors_1.createScaiError)(`No deploy token is available for environment '${envName}'.`, "AUTH_REQUIRED", { hint: `Run \`scai setup login -n ${envName}\` first.` });
+    }
+    const deployClient = { accessToken: deployToken };
+    const environmentClients = (await (0, api_1.listEnvironmentClients)(deployClient, organizationId)).items ?? [];
+    const organizationClients = (await (0, api_1.listOrganizationClients)(deployClient, organizationId)).items ?? [];
+    // --- delete mode -------------------------------------------------------
+    if (options.delete) {
+        const targetId = options.delete;
+        const match = [...environmentClients, ...organizationClients].find((c) => c.id === targetId);
+        if (!match) {
+            throw (0, cli_tasks_1.inputError)(`No client with id '${targetId}' in organization ${organizationId}.`, "Run `scai setup clients` to see the available client ids.");
+        }
+        const scaiManaged = (0, api_1.isScaiManagedClient)(match.name);
+        const caveat = scaiManaged
+            ? ""
+            : " This client was NOT created by scai — deleting it may break another integration.";
+        const proceed = await (0, cli_tasks_1.confirmDestructive)(`Delete client '${match.name ?? "(unnamed)"}' (${targetId})?${caveat}`, options.force);
+        if (!proceed) {
+            logger.info("Aborted.");
+            return;
+        }
+        await (0, api_1.deleteClient)(deployClient, targetId, organizationId);
+        // If we just deleted a scai-minted automation client, drop the now-
+        // dead credential — the keychain secret AND the config-resident
+        // non-secret metadata — so `setup status` stays honest.
+        if (match.name === (0, api_1.buildScaiClientName)("cm", envName)) {
+            await (0, keychain_1.clearCmClientSecret)(envName);
+            const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+            const envProfiles = rootConfigFile.config.envProfiles ?? {};
+            if (envProfiles[envName]?.automationClient) {
+                const { automationClient: _removed, ...rest } = envProfiles[envName];
+                envProfiles[envName] = rest;
+                rootConfigFile.config.envProfiles = envProfiles;
+                (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+            }
+        }
+        else if (match.name === (0, api_1.buildScaiClientName)("deploy")) {
+            await (0, keychain_1.clearOrgClientSecret)(organizationId);
+            const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+            const orgClients = rootConfigFile.config.orgClients ?? {};
+            if (orgClients[organizationId]) {
+                delete orgClients[organizationId];
+                rootConfigFile.config.orgClients = orgClients;
+                (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+            }
+        }
+        if (logger.isJson()) {
+            logger.json({ deleted: targetId, name: match.name ?? null, organizationId });
+            return;
+        }
+        logger.info(`Deleted client '${match.name ?? targetId}' (${targetId}).`, "green");
+        return;
+    }
+    // --- list mode ---------------------------------------------------------
+    if (logger.isJson()) {
+        logger.json({ environment: envName, organizationId, environmentClients, organizationClients });
+        return;
+    }
+    logger.info(`Automation clients in organization ${organizationId} (via env '${envName}')`, "cyan");
+    logger.info(`\nEnvironment-scoped (${environmentClients.length}):`);
+    if (environmentClients.length === 0) {
+        logger.info("  (none)");
+    }
+    for (const client of environmentClients) {
+        const scope = client.environmentName
+            ? `  → ${client.projectName ?? "?"} / ${client.environmentName}`
+            : "";
+        renderRow(logger, client.name, client.id, client.clientId, scope);
+    }
+    logger.info(`\nOrganization-scoped (${organizationClients.length}):`);
+    if (organizationClients.length === 0) {
+        logger.info("  (none)");
+    }
+    for (const client of organizationClients) {
+        renderRow(logger, client.name, client.id, client.clientId, "");
+    }
+    logger.info("\n[scai] = minted by scai (scai setup env). Others were created elsewhere.");
+};
+exports.runSetupClients = runSetupClients;

package/dist/serialization/tasks/env/setup-env.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `scai setup env <name>` — provision the environment-scoped CM
+ * automation client for one environment.
+ *
+ * The flow is list-or-mint, keyed on the stable `scai-cm-<env>` client
+ * name so re-runs are idempotent:
+ *
+ *   1. Resolve the env profile — needs organizationId + projectId +
+ *      environmentId.
+ *   2. Use the env's deploy token (it carries `xmclouddeploy.clients:manage`,
+ *      requested at `scai setup login`) as the clients-API credential.
+ *   3. List the org's environment clients; look for `scai-cm-<env>`.
+ *   4. Reconcile:
+ *        - keychain has the secret AND the server lists it  → done.
+ *        - server lists it but the keychain has no secret    → orphan
+ *          (lost secret — unrecoverable); delete it, then mint fresh.
+ *        - `--rotate`                                        → delete +
+ *          re-mint regardless.
+ *        - neither                                           → mint.
+ *   5. Persist the minted client: its non-secret metadata (clientId,
+ *      name, mintedAt) into the env profile's `automationClient` block in
+ *      the config file, and only the secret into the OS keychain.
+ */
+import type { SitecoreApiClientOptions } from "../../../serialization/api/types";
+import type { CommonOptions } from "../../../shared/cli-options";
+import type { Logger } from "../../../shared/logger";
+/** Timing knobs for {@link waitForClientActivation} — overridable for tests. */
+export interface ClientActivationOptions {
+    /** Give up after this long (default 120_000 ms). */
+    timeoutMs?: number;
+    /** First backoff delay (default 2_000 ms). */
+    initialDelayMs?: number;
+    /** Backoff ceiling (default 15_000 ms). */
+    maxDelayMs?: number;
+}
+/**
+ * Poll a client-credentials grant until a freshly-minted automation
+ * client activates.
+ *
+ * A just-created Sitecore automation client is not immediately usable —
+ * the identity provider takes up to ~2 min to propagate it, and the
+ * grant fails until it has. Returns `true` once a token is obtained,
+ * `false` if the window elapses first (the client is minted regardless
+ * and usually becomes usable shortly after).
+ */
+export declare const waitForClientActivation: (credential: SitecoreApiClientOptions, logger: Logger, options?: ClientActivationOptions) => Promise<boolean>;
+export type SetupEnvOptions = CommonOptions & {
+    environmentName?: string;
+    /** Preview the action without minting or deleting anything. */
+    whatIf?: boolean;
+    /** Delete and re-mint the client even if one is already provisioned. */
+    rotate?: boolean;
+};
+export declare const runSetupEnv: (options: SetupEnvOptions) => Promise<void>;

package/dist/serialization/tasks/env/setup-env.js

@@ -0,0 +1,216 @@
+"use strict";
+/**
+ * `scai setup env <name>` — provision the environment-scoped CM
+ * automation client for one environment.
+ *
+ * The flow is list-or-mint, keyed on the stable `scai-cm-<env>` client
+ * name so re-runs are idempotent:
+ *
+ *   1. Resolve the env profile — needs organizationId + projectId +
+ *      environmentId.
+ *   2. Use the env's deploy token (it carries `xmclouddeploy.clients:manage`,
+ *      requested at `scai setup login`) as the clients-API credential.
+ *   3. List the org's environment clients; look for `scai-cm-<env>`.
+ *   4. Reconcile:
+ *        - keychain has the secret AND the server lists it  → done.
+ *        - server lists it but the keychain has no secret    → orphan
+ *          (lost secret — unrecoverable); delete it, then mint fresh.
+ *        - `--rotate`                                        → delete +
+ *          re-mint regardless.
+ *        - neither                                           → mint.
+ *   5. Persist the minted client: its non-secret metadata (clientId,
+ *      name, mintedAt) into the env profile's `automationClient` block in
+ *      the config file, and only the secret into the OS keychain.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSetupEnv = exports.waitForClientActivation = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+const root_config_1 = require("../../../config/root-config");
+const keychain_1 = require("../../../shared/keychain");
+const api_1 = require("../../../deploy/api");
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const errors_1 = require("../../../shared/errors");
+const policy_1 = require("../../../policy");
+const auth_1 = require("../../../serialization/api/auth");
+const package_json_1 = __importDefault(require("../../../../package.json"));
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Poll a client-credentials grant until a freshly-minted automation
+ * client activates.
+ *
+ * A just-created Sitecore automation client is not immediately usable —
+ * the identity provider takes up to ~2 min to propagate it, and the
+ * grant fails until it has. Returns `true` once a token is obtained,
+ * `false` if the window elapses first (the client is minted regardless
+ * and usually becomes usable shortly after).
+ */
+const waitForClientActivation = async (credential, logger, options = {}) => {
+    const timeoutMs = options.timeoutMs ?? 120000;
+    const maxDelayMs = options.maxDelayMs ?? 15000;
+    let delayMs = options.initialDelayMs ?? 2000;
+    const deadline = Date.now() + timeoutMs;
+    let attempt = 0;
+    for (;;) {
+        attempt += 1;
+        try {
+            await (0, auth_1.requestClientCredentialsToken)(credential);
+            if (attempt > 1) {
+                logger.info("  Client is active.", "green");
+            }
+            return true;
+        }
+        catch (error) {
+            if (Date.now() + delayMs >= deadline) {
+                logger.warn(`The minted client did not activate within ${Math.round(timeoutMs / 1000)}s. ` +
+                    "It usually becomes usable within a minute or two — retry your command then.");
+                return false;
+            }
+            if (attempt === 1) {
+                logger.info("  Waiting for the new client to activate…");
+            }
+            logger.verbose(`Client not active yet (attempt ${attempt}): ${(0, errors_1.toScaiError)(error).message}. ` +
+                `Retrying in ${Math.round(delayMs / 1000)}s.`);
+            await sleep(delayMs);
+            delayMs = Math.min(Math.round(delayMs * 1.5), maxDelayMs);
+        }
+    }
+};
+exports.waitForClientActivation = waitForClientActivation;
+const runSetupEnv = async (options) => {
+    const logger = (0, cli_tasks_1.toLogger)(options);
+    const configPath = options.config ?? process.cwd();
+    const { envName, env, root } = (0, root_config_1.resolveActiveEnvironment)(configPath, options.environmentName);
+    // Phase 2 mint gate — minting an automation client requires an
+    // interactive human operator on a mint-eligible environment. A no-op
+    // in unmanaged mode. See docs/policy-and-guardrails.md.
+    (0, policy_1.authorizeOperation)({
+        envName,
+        configRootDir: root.physicalPath ? node_path_1.default.dirname(root.physicalPath) : undefined,
+        tier: "mint",
+    });
+    const { organizationId, projectId, environmentId } = env;
+    if (!organizationId || !projectId || !environmentId) {
+        throw (0, cli_tasks_1.inputError)(`Environment '${envName}' is missing organizationId, projectId, or environmentId.`, "All three are required to mint an environment-scoped CM client. Run `scai setup init`.");
+    }
+    const deployToken = (await (0, keychain_1.getDeployToken)(envName)) ?? env.deployToken ?? process.env.SITECOREAI_DEPLOY_TOKEN;
+    if (!deployToken) {
+        throw (0, errors_1.createScaiError)(`No deploy token is available for environment '${envName}'.`, "AUTH_REQUIRED", {
+            hint: `Run \`scai setup login -n ${envName}\` first — minting a CM client needs a token with the xmclouddeploy.clients:manage scope.`,
+        });
+    }
+    const deployClient = { accessToken: deployToken };
+    const clientName = (0, api_1.buildScaiClientName)("cm", envName);
+    // Read-side reconciliation — safe to run even under --what-if. A
+    // provisioned client means both halves are present: the non-secret
+    // metadata in the config (`automationClient`) AND the secret in the
+    // keychain. Either alone is incomplete.
+    const storedSecret = await (0, keychain_1.getCmClientSecret)(envName);
+    const stored = Boolean(env.automationClient?.clientId) && Boolean(storedSecret);
+    let existingId;
+    try {
+        const listed = await (0, api_1.listEnvironmentClients)(deployClient, organizationId);
+        existingId = (listed.items ?? []).find((client) => client.name === clientName)?.id;
+    }
+    catch (error) {
+        const scaiError = (0, errors_1.toScaiError)(error);
+        throw (0, errors_1.createScaiError)(`Could not list environment clients for organization '${organizationId}'.`, "DEPLOY_FAILED", {
+            hint: `The deploy token may lack the xmclouddeploy.clients:manage scope. Re-run \`scai setup login -n ${envName}\`. Underlying error: ${scaiError.message}`,
+        });
+    }
+    const alreadyProvisioned = Boolean(stored) && Boolean(existingId);
+    if (alreadyProvisioned && !options.rotate) {
+        if (logger.isJson()) {
+            logger.json({ environment: envName, client: clientName, action: "none", provisioned: true });
+            return;
+        }
+        logger.info(`Environment '${envName}' already has its CM client (${clientName}).`, "green");
+        logger.info("  Nothing to do. Pass --rotate to delete and re-mint.");
+        return;
+    }
+    // An existing server-side client with no keychain secret is an
+    // orphan — the secret is unrecoverable, so it must be replaced.
+    const replaceExisting = Boolean(existingId) && (!stored || Boolean(options.rotate));
+    if (options.whatIf) {
+        const verb = replaceExisting ? "delete the existing client and re-mint" : "mint";
+        if (logger.isJson()) {
+            logger.json({
+                environment: envName,
+                client: clientName,
+                action: replaceExisting ? "replace" : "mint",
+                whatIf: true,
+            });
+            return;
+        }
+        logger.info(`[what-if] Would ${verb} CM client '${clientName}' for '${envName}'.`);
+        return;
+    }
+    if (replaceExisting && existingId) {
+        const reason = options.rotate ? "rotating" : "orphaned — secret not in keychain";
+        logger.info(`Removing the existing '${clientName}' client (${reason})…`);
+        await (0, api_1.deleteClient)(deployClient, existingId, organizationId);
+    }
+    const minted = await (0, api_1.mintCmClient)(deployClient, {
+        name: clientName,
+        description: (0, api_1.buildScaiClientDescription)("cm", {
+            surface: "CLI",
+            version: package_json_1.default.version,
+            envName,
+        }),
+        projectId,
+        environmentId,
+    }, organizationId);
+    if (!minted.clientId || !minted.clientSecret) {
+        throw (0, errors_1.createScaiError)("The clients API did not return a clientId/clientSecret.", "DEPLOY_FAILED", { hint: "Re-run the command; if it persists, mint the client in the Cloud Portal." });
+    }
+    // The keychain holds only the secret; the non-secret metadata
+    // (clientId, name, mintedAt) goes into the env profile's
+    // `automationClient` block in the config file — a readable inventory
+    // of what's configured. See docs/credentials.md.
+    const persisted = await (0, keychain_1.setCmClientSecret)(envName, minted.clientSecret);
+    const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+    const envProfiles = rootConfigFile.config.envProfiles ?? {};
+    envProfiles[envName] = {
+        ...(envProfiles[envName] ?? {}),
+        automationClient: {
+            clientId: minted.clientId,
+            name: clientName,
+            mintedAt: new Date().toISOString(),
+        },
+    };
+    rootConfigFile.config.envProfiles = envProfiles;
+    (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+    if (!logger.isJson()) {
+        logger.info(`Minted CM client '${clientName}' for '${envName}'.`, "green");
+        logger.info(`  clientId: ${minted.clientId}`);
+        if (!persisted) {
+            logger.warn("Keychain unavailable — the client secret was NOT persisted. The minted client is unusable; re-run when the keychain is available.");
+        }
+    }
+    // A freshly-minted client is not usable until the identity provider
+    // activates it (~1-2 min), during which a client-credentials grant
+    // still fails. Poll so the command does not report success on a client
+    // an immediate follow-up call would be rejected by — the race an agent
+    // hits when it uses the credential right after the mint.
+    const active = env.authority
+        ? await (0, exports.waitForClientActivation)({
+            authority: env.authority,
+            clientId: minted.clientId,
+            clientSecret: minted.clientSecret,
+            audience: env.audience,
+        }, logger)
+        : true;
+    if (logger.isJson()) {
+        logger.json({
+            environment: envName,
+            client: clientName,
+            action: replaceExisting ? "replace" : "mint",
+            clientId: minted.clientId,
+            persisted,
+            active,
+        });
+    }
+};
+exports.runSetupEnv = runSetupEnv;

package/dist/serialization/tasks/env/setup-org-client.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `scai setup client create --org <env>` — provision the organization-
+ * scoped automation client for the org behind one environment.
+ *
+ * Mirrors `runSetupEnv` (the env-scoped CM client) but mints the
+ * org-scoped `deploy` client type: it carries only a name (no project /
+ * environment binding) and is stored in the keychain keyed by
+ * `organizationId` — one per org, shared by every env profile in it.
+ *
+ * The flow is list-or-mint, keyed on the stable `scai-deploy` client
+ * name so re-runs are idempotent.
+ */
+import type { CommonOptions } from "../../../shared/cli-options";
+export type SetupOrgClientOptions = CommonOptions & {
+    environmentName?: string;
+    /** Preview the action without minting or deleting anything. */
+    whatIf?: boolean;
+    /** Delete and re-mint the client even if one is already provisioned. */
+    rotate?: boolean;
+};
+export declare const runSetupOrgClient: (options: SetupOrgClientOptions) => Promise<void>;

package/dist/serialization/tasks/env/setup-org-client.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * `scai setup client create --org <env>` — provision the organization-
+ * scoped automation client for the org behind one environment.
+ *
+ * Mirrors `runSetupEnv` (the env-scoped CM client) but mints the
+ * org-scoped `deploy` client type: it carries only a name (no project /
+ * environment binding) and is stored in the keychain keyed by
+ * `organizationId` — one per org, shared by every env profile in it.
+ *
+ * The flow is list-or-mint, keyed on the stable `scai-deploy` client
+ * name so re-runs are idempotent.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSetupOrgClient = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+const root_config_1 = require("../../../config/root-config");
+const keychain_1 = require("../../../shared/keychain");
+const api_1 = require("../../../deploy/api");
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const errors_1 = require("../../../shared/errors");
+const policy_1 = require("../../../policy");
+const package_json_1 = __importDefault(require("../../../../package.json"));
+const runSetupOrgClient = async (options) => {
+    const logger = (0, cli_tasks_1.toLogger)(options);
+    const configPath = options.config ?? process.cwd();
+    const { envName, env, root } = (0, root_config_1.resolveActiveEnvironment)(configPath, options.environmentName);
+    // Phase 2 mint gate — minting an automation client requires an
+    // interactive human operator on a mint-eligible environment. A no-op
+    // in unmanaged mode. See docs/policy-and-guardrails.md.
+    (0, policy_1.authorizeOperation)({
+        envName,
+        configRootDir: root.physicalPath ? node_path_1.default.dirname(root.physicalPath) : undefined,
+        tier: "mint",
+    });
+    const { organizationId } = env;
+    if (!organizationId) {
+        throw (0, cli_tasks_1.inputError)(`Environment '${envName}' has no organizationId.`, "Set organizationId on the env profile, or run `scai setup init`.");
+    }
+    const deployToken = (await (0, keychain_1.getDeployToken)(envName)) ?? env.deployToken ?? process.env.SITECOREAI_DEPLOY_TOKEN;
+    if (!deployToken) {
+        throw (0, errors_1.createScaiError)(`No deploy token is available for environment '${envName}'.`, "AUTH_REQUIRED", {
+            hint: `Run \`scai setup login -n ${envName}\` first — minting a client needs a token with the xmclouddeploy.clients:manage scope.`,
+        });
+    }
+    const deployClient = { accessToken: deployToken };
+    const clientName = (0, api_1.buildScaiClientName)("deploy");
+    // Read-side reconciliation — safe to run even under --what-if. A
+    // provisioned client means both halves are present: the non-secret
+    // metadata in the config (`orgClients[orgId]`) AND the secret in the
+    // keychain. Either alone is incomplete.
+    const rootFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+    const storedSecret = await (0, keychain_1.getOrgClientSecret)(organizationId);
+    const stored = Boolean(rootFile.config.orgClients?.[organizationId]?.clientId) && Boolean(storedSecret);
+    let existingId;
+    try {
+        const listed = await (0, api_1.listOrganizationClients)(deployClient, organizationId);
+        existingId = (listed.items ?? []).find((client) => client.name === clientName)?.id;
+    }
+    catch (error) {
+        const scaiError = (0, errors_1.toScaiError)(error);
+        throw (0, errors_1.createScaiError)(`Could not list organization clients for organization '${organizationId}'.`, "DEPLOY_FAILED", {
+            hint: `The deploy token may lack the xmclouddeploy.clients:manage scope. Re-run \`scai setup login -n ${envName}\`. Underlying error: ${scaiError.message}`,
+        });
+    }
+    const alreadyProvisioned = Boolean(stored) && Boolean(existingId);
+    if (alreadyProvisioned && !options.rotate) {
+        if (logger.isJson()) {
+            logger.json({
+                organization: organizationId,
+                client: clientName,
+                action: "none",
+                provisioned: true,
+            });
+            return;
+        }
+        logger.info(`Organization '${organizationId}' already has its automation client (${clientName}).`, "green");
+        logger.info("  Nothing to do. Pass --rotate to delete and re-mint.");
+        return;
+    }
+    // An existing server-side client with no keychain secret is an orphan —
+    // the secret is unrecoverable, so it must be replaced.
+    const replaceExisting = Boolean(existingId) && (!stored || Boolean(options.rotate));
+    if (options.whatIf) {
+        const verb = replaceExisting ? "delete the existing client and re-mint" : "mint";
+        if (logger.isJson()) {
+            logger.json({
+                organization: organizationId,
+                client: clientName,
+                action: replaceExisting ? "replace" : "mint",
+                whatIf: true,
+            });
+            return;
+        }
+        logger.info(`[what-if] Would ${verb} org client '${clientName}' for organization '${organizationId}'.`);
+        return;
+    }
+    if (replaceExisting && existingId) {
+        const reason = options.rotate ? "rotating" : "orphaned — secret not in keychain";
+        logger.info(`Removing the existing '${clientName}' client (${reason})…`);
+        await (0, api_1.deleteClient)(deployClient, existingId, organizationId);
+    }
+    const minted = await (0, api_1.mintDeployClient)(deployClient, {
+        name: clientName,
+        description: (0, api_1.buildScaiClientDescription)("deploy", {
+            surface: "CLI",
+            version: package_json_1.default.version,
+        }),
+    }, organizationId);
+    if (!minted.clientId || !minted.clientSecret) {
+        throw (0, errors_1.createScaiError)("The clients API did not return a clientId/clientSecret.", "DEPLOY_FAILED", { hint: "Re-run the command; if it persists, mint the client in the Cloud Portal." });
+    }
+    // The keychain holds only the secret; the non-secret metadata
+    // (clientId, name, mintedAt) goes into the `orgClients[orgId]` block
+    // in the config file — a readable inventory of what's configured. See
+    // docs/credentials.md.
+    const persisted = await (0, keychain_1.setOrgClientSecret)(organizationId, minted.clientSecret);
+    const rootConfigFile = (0, root_config_1.readRootConfigurationFile)(configPath);
+    const orgClients = rootConfigFile.config.orgClients ?? {};
+    orgClients[organizationId] = {
+        clientId: minted.clientId,
+        name: clientName,
+        mintedAt: new Date().toISOString(),
+    };
+    rootConfigFile.config.orgClients = orgClients;
+    (0, root_config_1.writeRootConfigurationFile)(configPath, rootConfigFile.config);
+    if (logger.isJson()) {
+        logger.json({
+            organization: organizationId,
+            client: clientName,
+            action: replaceExisting ? "replace" : "mint",
+            clientId: minted.clientId,
+            persisted,
+        });
+        return;
+    }
+    logger.info(`Minted org automation client '${clientName}' for organization '${organizationId}'.`, "green");
+    logger.info(`  clientId: ${minted.clientId}`);
+    if (!persisted) {
+        logger.warn("Keychain unavailable — the client secret was NOT persisted. The minted client is unusable; re-run when the keychain is available.");
+    }
+};
+exports.runSetupOrgClient = runSetupOrgClient;

package/dist/serialization/tasks/env/status.d.ts

@@ -1,3 +1,2 @@
 import type { CommonOptions } from "../types";
 export declare const runStatus: (options: CommonOptions) => Promise<void>;
-//# sourceMappingURL=status.d.ts.map