@sitecoreai-labs/sitecoreai-cli 0.0.4

package/dist/shared/env.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared environment-resolution helper. Replaces the three near-duplicate
+ * implementations that grew up across `recipe/tasks/shared.ts:resolveTenant`,
+ * `deploy/tasks/shared.ts:getDeployContext`, and the hand-copied
+ * `resolveAuthoringEnvironment` blocks in `deploy/tasks/site.ts` and
+ * `deploy/tasks/site-bind.ts` — all doing the same
+ * readRoot → defaultEnvProfile → environment-or-throw dance with slightly
+ * different error messages and return shapes.
+ *
+ * Domain-specific wrappers (recipe `resolveTenant`, deploy
+ * `getDeployContext`) compose this and add their own decoration
+ * (auth client, deploy token lookup, etc.).
+ */
+import { type EnvironmentConfiguration, type RootConfiguration } from "../config";
+export interface ResolvedEnvironment {
+    envName: string;
+    environment: EnvironmentConfiguration;
+    root: RootConfiguration;
+    /** Tenant API client timeout in ms, derived from
+     *  `settings.apiClientTimeoutInMinutes`. `undefined` when unset/invalid. */
+    timeoutMs: number | undefined;
+}
+export interface ResolveEnvironmentOptions {
+    config?: string;
+    environmentName?: string;
+}
+export declare const resolveEnvironment: (options: ResolveEnvironmentOptions) => ResolvedEnvironment;
+//# sourceMappingURL=env.d.ts.map

package/dist/shared/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/shared/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EAGvB,MAAM,UAAU,CAAC;AAIlB,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;IACtC,IAAI,EAAE,iBAAiB,CAAC;IACxB;gFAC4E;IAC5E,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,kBAAkB,GAAI,SAAS,yBAAyB,KAAG,mBAiBvE,CAAC"}

package/dist/shared/env.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Shared environment-resolution helper. Replaces the three near-duplicate
+ * implementations that grew up across `recipe/tasks/shared.ts:resolveTenant`,
+ * `deploy/tasks/shared.ts:getDeployContext`, and the hand-copied
+ * `resolveAuthoringEnvironment` blocks in `deploy/tasks/site.ts` and
+ * `deploy/tasks/site-bind.ts` — all doing the same
+ * readRoot → defaultEnvProfile → environment-or-throw dance with slightly
+ * different error messages and return shapes.
+ *
+ * Domain-specific wrappers (recipe `resolveTenant`, deploy
+ * `getDeployContext`) compose this and add their own decoration
+ * (auth client, deploy token lookup, etc.).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEnvironment = void 0;
+const config_1 = require("../config");
+const errors_1 = require("../shared/errors");
+const cli_tasks_1 = require("./cli-tasks");
+const resolveEnvironment = (options) => {
+    const configPath = options.config ?? process.cwd();
+    const rootFile = (0, config_1.readRootConfigurationFile)(configPath);
+    const envName = options.environmentName ?? rootFile.config.defaultEnvProfile;
+    if (!envName) {
+        throw (0, errors_1.createCliError)("Environment name is required.", "INPUT_INVALID", {
+            hint: "Pass --environment-name or set defaultEnvProfile in the config.",
+        });
+    }
+    const root = (0, config_1.readRootConfiguration)(configPath, envName);
+    const environment = root.environments[envName];
+    if (!environment) {
+        throw (0, errors_1.createCliError)(`Environment '${envName}' is not configured.`, "ENV_NOT_FOUND", {
+            hint: "Run 'scai init' to configure the environment.",
+        });
+    }
+    return { envName, environment, root, timeoutMs: (0, cli_tasks_1.resolveApiTimeoutMs)(root) };
+};
+exports.resolveEnvironment = resolveEnvironment;

package/dist/shared/errors.d.ts

@@ -0,0 +1,21 @@
+export type CliErrorCode = "CONFIG_NOT_FOUND" | "CONFIG_INVALID" | "INPUT_INVALID" | "AUTH_REQUIRED" | "NETWORK" | "ENV_NOT_FOUND" | "DEPLOY_FAILED" | "SITES_API_FAILED" | "UNKNOWN";
+export declare class CliError extends Error {
+    code: CliErrorCode;
+    exitCode: number;
+    hint?: string;
+    details?: string[];
+    constructor(message: string, options?: {
+        code?: CliErrorCode;
+        exitCode?: number;
+        hint?: string;
+        details?: string[];
+        cause?: unknown;
+    });
+}
+export declare const toCliError: (error: unknown) => CliError;
+export declare const withHint: (error: CliError, hint: string) => CliError;
+export declare const createCliError: (message: string, code: CliErrorCode, options?: {
+    hint?: string;
+    details?: string[];
+}) => CliError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/shared/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/shared/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,SAAS,GACT,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,SAAS,CAAC;AAEd,qBAAa,QAAS,SAAQ,KAAK;IACjC,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;gBAGjB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QACP,IAAI,CAAC,EAAE,YAAY,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,EAAE,OAAO,CAAC;KACZ;CAYT;AAuBD,eAAO,MAAM,UAAU,GAAI,OAAO,OAAO,KAAG,QAM3C,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,OAAO,QAAQ,EAAE,MAAM,MAAM,KAAG,QAMrD,CAAC;AAEL,eAAO,MAAM,cAAc,GACzB,SAAS,MAAM,EACf,MAAM,YAAY,EAClB,UAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,KAClD,QAMC,CAAC"}

package/dist/shared/errors.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCliError = exports.withHint = exports.toCliError = exports.CliError = void 0;
+class CliError extends Error {
+    constructor(message, options = {}) {
+        super(message);
+        this.name = "CliError";
+        this.code = options.code ?? "UNKNOWN";
+        this.exitCode = options.exitCode ?? 1;
+        this.hint = options.hint;
+        this.details = options.details;
+        if (options.cause !== undefined) {
+            this.cause = options.cause;
+        }
+    }
+}
+exports.CliError = CliError;
+const exitCodeFor = (code) => {
+    switch (code) {
+        case "CONFIG_NOT_FOUND":
+        case "CONFIG_INVALID":
+        case "INPUT_INVALID":
+            return 2;
+        case "AUTH_REQUIRED":
+            return 3;
+        case "NETWORK":
+            return 4;
+        case "ENV_NOT_FOUND":
+            return 5;
+        case "DEPLOY_FAILED":
+            return 6;
+        case "SITES_API_FAILED":
+            return 7;
+        default:
+            return 1;
+    }
+};
+const toCliError = (error) => {
+    if (error instanceof CliError) {
+        return error;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return new CliError(message, { code: "UNKNOWN", exitCode: exitCodeFor("UNKNOWN") });
+};
+exports.toCliError = toCliError;
+const withHint = (error, hint) => new CliError(error.message, {
+    code: error.code,
+    exitCode: error.exitCode,
+    hint,
+    details: error.details,
+});
+exports.withHint = withHint;
+const createCliError = (message, code, options = {}) => new CliError(message, {
+    code,
+    exitCode: exitCodeFor(code),
+    hint: options.hint,
+    details: options.details,
+});
+exports.createCliError = createCliError;

package/dist/shared/graphql.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Shared GraphQL transport for Sitecore tenant APIs.
+ *
+ * Two near-identical transports — the Authoring API (used by `recipe`)
+ * and the Management API (used by `serialization`) — used to ship as
+ * separate copies of timeout/abort/error/redaction plumbing. They live
+ * in different modules because they target different Sitecore endpoints
+ * with different auth contracts, but everything *except* the endpoint
+ * URL, the human-readable label, and whether the bearer token is
+ * required vs optional was duplicated.
+ *
+ * This module owns the wire protocol; `recipe/api/graphql.ts` and
+ * `serialization/sitecore-api/graphql.ts` are thin wrappers that supply
+ * the per-API constants.
+ */
+import type { EnvironmentConfiguration } from "../config";
+type GetAccessToken = (environment: EnvironmentConfiguration) => Promise<string | undefined>;
+export interface GraphQLRequestOptions {
+    timeoutMs?: number;
+    /**
+     * Override retry behaviour for transient failures (429 throttling, 502/503/504,
+     * network blips, abort-but-not-timeout). Defaults to 5 attempts with
+     * exponential backoff + jitter, honoring `Retry-After` on 429/503.
+     */
+    retry?: RetryOptions;
+}
+export interface RetryOptions {
+    /** Total attempts including the initial one. Default 5. */
+    maxAttempts?: number;
+    /** Base delay in ms; doubled per retry, jittered ±50%. Default 500ms. */
+    baseDelayMs?: number;
+    /** Cap on a single backoff delay. Default 15s. */
+    maxDelayMs?: number;
+    /**
+     * Which HTTP status codes are retryable. Defaults to the conservative
+     * "definite-throttle / never-reached-origin" set: 408, 425, 429, 503.
+     * Read-only callers can pass a wider set (`READ_RETRYABLE_STATUSES`)
+     * that includes ambiguous 5xx codes like 500/502/504; mutation callers
+     * keep the conservative default so a transient 5xx-after-success
+     * doesn't trigger a duplicate-write retry. Network blips
+     * (`TypeError: fetch failed`) are always retryable regardless of this
+     * set since no request was sent.
+     */
+    retryableStatuses?: ReadonlySet<number>;
+}
+/**
+ * Read-only callers can opt in to a broader retry set that includes
+ * ambiguous 5xx codes. Safe for GETs since reads are idempotent — a
+ * second fetch is harmless. Unsafe for mutations because 500/502/504
+ * may indicate the server processed the request but failed to respond,
+ * and retrying would create a duplicate.
+ */
+export declare const READ_RETRYABLE_STATUSES: Set<number>;
+export interface GraphQLTransportConfig {
+    /** URL path appended to `environment.host`. */
+    servicePath: string;
+    /** Human-readable label used in error messages — e.g. `"Authoring"` or `"Management"`. */
+    label: string;
+    /**
+     * When `true`, the call throws `AUTH_REQUIRED` if no token is available
+     * (Authoring API). When `false`, the request is sent without the
+     * Authorization header (Management API — anonymous access valid for
+     * some queries).
+     */
+    requireToken: boolean;
+    /**
+     * Strategy for fetching a Bearer token for the request. Wrappers pass
+     * this in so the shared module doesn't reach across layer boundaries
+     * to import auth, and so tests can mock auth at the wrapper's seam
+     * without crossing layers.
+     */
+    getAccessToken: GetAccessToken;
+}
+export declare const runSitecoreGraphQL: <T>(environment: EnvironmentConfiguration, query: string, variables: Record<string, unknown> | undefined, transport: GraphQLTransportConfig, options?: GraphQLRequestOptions) => Promise<T>;
+export {};
+//# sourceMappingURL=graphql.d.ts.map

package/dist/shared/graphql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql.d.ts","sourceRoot":"","sources":["../../src/shared/graphql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAIzD,KAAK,cAAc,GAAG,CAAC,WAAW,EAAE,wBAAwB,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAO7F,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACzC;AAiBD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,aAA+C,CAAC;AA6CpF,MAAM,WAAW,sBAAsB;IACrC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,cAAc,EAAE,cAAc,CAAC;CAChC;AAoBD,eAAO,MAAM,kBAAkB,GAAU,CAAC,EACxC,aAAa,wBAAwB,EACrC,OAAO,MAAM,EACb,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC9C,WAAW,sBAAsB,EACjC,UAAU,qBAAqB,KAC9B,OAAO,CAAC,CAAC,CAyJX,CAAC"}

package/dist/shared/graphql.js

@@ -0,0 +1,222 @@
+"use strict";
+/**
+ * Shared GraphQL transport for Sitecore tenant APIs.
+ *
+ * Two near-identical transports — the Authoring API (used by `recipe`)
+ * and the Management API (used by `serialization`) — used to ship as
+ * separate copies of timeout/abort/error/redaction plumbing. They live
+ * in different modules because they target different Sitecore endpoints
+ * with different auth contracts, but everything *except* the endpoint
+ * URL, the human-readable label, and whether the bearer token is
+ * required vs optional was duplicated.
+ *
+ * This module owns the wire protocol; `recipe/api/graphql.ts` and
+ * `serialization/sitecore-api/graphql.ts` are thin wrappers that supply
+ * the per-API constants.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSitecoreGraphQL = exports.READ_RETRYABLE_STATUSES = void 0;
+const errors_1 = require("./errors");
+const redact_1 = require("./redact");
+/**
+ * Default to one attempt — no retry — so existing callers (serialization,
+ * deploy) keep their current "fail fast on first error" semantics. Hot
+ * paths that benefit from retry (the recipe executor's parallel batched
+ * reads + applies) opt in via `retry: { maxAttempts: N }`. This keeps the
+ * shared transport's error-mapping tests stable while letting the recipe
+ * path get throttle-aware behavior for free.
+ */
+const DEFAULT_RETRY = {
+    maxAttempts: 1,
+    baseDelayMs: 500,
+    maxDelayMs: 15000,
+    retryableStatuses: new Set([408, 425, 429, 503]),
+};
+/**
+ * Read-only callers can opt in to a broader retry set that includes
+ * ambiguous 5xx codes. Safe for GETs since reads are idempotent — a
+ * second fetch is harmless. Unsafe for mutations because 500/502/504
+ * may indicate the server processed the request but failed to respond,
+ * and retrying would create a duplicate.
+ */
+exports.READ_RETRYABLE_STATUSES = new Set([408, 425, 429, 500, 502, 503, 504]);
+/** Sleep with abort-on-signal so a Ctrl-C during backoff still exits promptly. */
+const sleep = (ms, signal) => new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+        reject(new Error("aborted"));
+        return;
+    }
+    const timer = setTimeout(() => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+    }, ms);
+    const onAbort = () => {
+        clearTimeout(timer);
+        reject(new Error("aborted"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+});
+const jitter = (n) => n * (0.5 + Math.random());
+const computeBackoff = (attempt, cfg, retryAfterSeconds) => {
+    if (retryAfterSeconds && Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0) {
+        return Math.min(retryAfterSeconds * 1000, cfg.maxDelayMs);
+    }
+    const exp = cfg.baseDelayMs * 2 ** attempt;
+    return Math.min(jitter(exp), cfg.maxDelayMs);
+};
+const parseRetryAfter = (value) => {
+    if (!value)
+        return undefined;
+    const seconds = Number(value);
+    if (Number.isFinite(seconds))
+        return seconds;
+    const httpDate = Date.parse(value);
+    if (!Number.isNaN(httpDate)) {
+        return Math.max(0, (httpDate - Date.now()) / 1000);
+    }
+    return undefined;
+};
+const parseJsonIfPossible = async (response) => {
+    const text = await response.text();
+    if (!text) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+};
+const normalizeHostUrl = (host) => {
+    const withScheme = host.startsWith("http://") || host.startsWith("https://") ? host : `https://${host}`;
+    return withScheme.endsWith("/") ? withScheme.slice(0, -1) : withScheme;
+};
+const runSitecoreGraphQL = async (environment, query, variables, transport, options) => {
+    if (!environment.host) {
+        throw (0, errors_1.createCliError)("Environment host is not configured.", "INPUT_INVALID", {
+            hint: "Set a CM host with 'scai init' or pass --host.",
+        });
+    }
+    const hostUrl = normalizeHostUrl(environment.host);
+    const url = `${hostUrl}${transport.servicePath}`;
+    const token = await transport.getAccessToken(environment);
+    if (transport.requireToken && !token) {
+        throw (0, errors_1.createCliError)(`Sitecore ${transport.label} API requires an access token.`, "AUTH_REQUIRED", { hint: "Run 'scai login' to authenticate." });
+    }
+    const retryCfg = {
+        ...DEFAULT_RETRY,
+        ...(options?.retry ?? {}),
+    };
+    const sendOnce = async () => {
+        const controller = options?.timeoutMs ? new AbortController() : undefined;
+        const timeout = controller
+            ? setTimeout(() => controller.abort(), Math.max(options?.timeoutMs ?? 0, 0))
+            : undefined;
+        try {
+            const response = await fetch(url, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+                },
+                body: JSON.stringify({ query, variables }),
+                signal: controller?.signal,
+            });
+            if (!response.ok) {
+                const body = await parseJsonIfPossible(response);
+                const message = typeof body === "string"
+                    ? body
+                    : body && typeof body === "object"
+                        ? JSON.stringify(body)
+                        : undefined;
+                const httpError = new HttpError(response.status, 
+                // Test mocks of `Response` may omit `headers`; defensive access
+                // avoids `Cannot read properties of undefined`. Production
+                // `fetch` always populates a `Headers` object.
+                parseRetryAfter(response.headers?.get?.("retry-after") ?? null), (0, redact_1.redactSecrets)(`Sitecore ${transport.label} API request failed (${response.status}).${message ? ` ${message}` : ""}`));
+                throw httpError;
+            }
+            const parsed = await parseJsonIfPossible(response);
+            if (!parsed || typeof parsed !== "object") {
+                throw (0, errors_1.createCliError)(`${transport.label} GraphQL response did not contain JSON data.`, "NETWORK");
+            }
+            const result = parsed;
+            if (result.errors?.length) {
+                const message = result.errors.map((error) => error.message).join("; ");
+                throw (0, errors_1.createCliError)((0, redact_1.redactSecrets)(`${transport.label} GraphQL errors: ${message}`), "NETWORK");
+            }
+            if (!result.data) {
+                throw (0, errors_1.createCliError)(`${transport.label} GraphQL response did not contain data.`, "NETWORK");
+            }
+            return result.data;
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+        }
+    };
+    let lastError;
+    for (let attempt = 0; attempt < retryCfg.maxAttempts; attempt += 1) {
+        try {
+            return await sendOnce();
+        }
+        catch (error) {
+            lastError = error;
+            if (error instanceof HttpError && retryCfg.retryableStatuses.has(error.status)) {
+                if (attempt < retryCfg.maxAttempts - 1) {
+                    await sleep(computeBackoff(attempt, retryCfg, error.retryAfterSeconds));
+                    continue;
+                }
+            }
+            else if (error instanceof Error &&
+                error.name === "AbortError" &&
+                attempt < retryCfg.maxAttempts - 1 &&
+                // Honor explicit per-call timeoutMs as a hard cap — if the caller
+                // set one, an abort means "took longer than the budget", and
+                // silently retrying behind their back violates their intent.
+                // Without timeoutMs, an abort is most likely a transient
+                // upstream cancellation (proxy hiccup) — safe to retry.
+                options?.timeoutMs === undefined) {
+                await sleep(computeBackoff(attempt, retryCfg));
+                continue;
+            }
+            else if (
+            // `fetch` failures from network blips (DNS, ECONNRESET, EAI_AGAIN, etc.)
+            // surface as `TypeError: fetch failed` in Node's undici. Retry these.
+            error instanceof TypeError &&
+                attempt < retryCfg.maxAttempts - 1) {
+                await sleep(computeBackoff(attempt, retryCfg));
+                continue;
+            }
+            break;
+        }
+    }
+    // Final mapping to CliError. HttpError → NETWORK; AbortError → timeout hint;
+    // everything else → generic NETWORK with the original message.
+    if (lastError instanceof HttpError) {
+        throw (0, errors_1.createCliError)(lastError.message, "NETWORK");
+    }
+    if (lastError instanceof Error && lastError.name === "AbortError") {
+        throw (0, errors_1.createCliError)(`Sitecore ${transport.label} API request timed out.`, "NETWORK", {
+            hint: "Increase settings.apiClientTimeoutInMinutes if needed.",
+        });
+    }
+    if (lastError instanceof Error) {
+        if ("code" in lastError && lastError.code) {
+            // Already a CliError-shaped object — re-throw as-is.
+            throw lastError;
+        }
+        throw (0, errors_1.createCliError)((0, redact_1.redactSecrets)(`Sitecore ${transport.label} API request failed: ${lastError.message}`), "NETWORK");
+    }
+    throw (0, errors_1.createCliError)((0, redact_1.redactSecrets)(`Sitecore ${transport.label} API request failed: ${String(lastError)}`), "NETWORK");
+};
+exports.runSitecoreGraphQL = runSitecoreGraphQL;
+class HttpError extends Error {
+    constructor(status, retryAfterSeconds, message) {
+        super(message);
+        this.status = status;
+        this.retryAfterSeconds = retryAfterSeconds;
+        this.name = "HttpError";
+    }
+}

package/dist/shared/history.d.ts

@@ -0,0 +1,12 @@
+export type HistoryEntry = {
+    event: "start" | "success" | "error";
+    command: string;
+    args: string[];
+    cwd: string;
+    error?: string;
+    timestamp?: string;
+};
+export declare const recordHistory: (entry: HistoryEntry) => Promise<void>;
+export declare const getHistoryPath: () => string;
+export declare const ensureHistoryFile: () => Promise<void>;
+//# sourceMappingURL=history.d.ts.map

package/dist/shared/history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.d.ts","sourceRoot":"","sources":["../../src/shared/history.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAyBF,eAAO,MAAM,aAAa,GAAU,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAkBrE,CAAC;AAEF,eAAO,MAAM,cAAc,QAAO,MAA8B,CAAC;AAEjE,eAAO,MAAM,iBAAiB,QAAa,OAAO,CAAC,IAAI,CAUtD,CAAC"}

package/dist/shared/history.js

@@ -0,0 +1,62 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureHistoryFile = exports.getHistoryPath = exports.recordHistory = void 0;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const consola_1 = require("consola");
+const redact_1 = require("./redact");
+const resolveHistoryPath = () => process.env.SITECOREAI_HISTORY_PATH ?? node_path_1.default.join(node_os_1.default.homedir(), ".sitecoreai", "cli-history.log");
+const resolveMaxHistoryBytes = () => Math.max(0, Number(process.env.SITECOREAI_HISTORY_MAX_BYTES ?? 10 * 1024 * 1024));
+const rotateIfNeeded = async (filePath) => {
+    const maxBytes = resolveMaxHistoryBytes();
+    if (maxBytes === 0) {
+        return;
+    }
+    try {
+        const stats = await promises_1.default.stat(filePath);
+        if (stats.size < maxBytes) {
+            return;
+        }
+        const rotated = `${filePath}.${Date.now()}`;
+        await promises_1.default.rename(filePath, rotated);
+    }
+    catch {
+        // ignore rotation failures
+    }
+};
+const recordHistory = async (entry) => {
+    const filePath = resolveHistoryPath();
+    const sanitizedArgs = (0, redact_1.redactArgs)(entry.args ?? []);
+    const payload = {
+        ...entry,
+        args: sanitizedArgs,
+        error: entry.error ? (0, redact_1.redactSecrets)(entry.error) : undefined,
+        timestamp: entry.timestamp ?? new Date().toISOString(),
+    };
+    try {
+        await promises_1.default.mkdir(node_path_1.default.dirname(filePath), { recursive: true });
+        await rotateIfNeeded(filePath);
+        await promises_1.default.appendFile(filePath, `${JSON.stringify(payload)}\n`, "utf8");
+    }
+    catch (error) {
+        consola_1.consola.debug(`Unable to write history log: ${error instanceof Error ? error.message : String(error)}`);
+    }
+};
+exports.recordHistory = recordHistory;
+const getHistoryPath = () => resolveHistoryPath();
+exports.getHistoryPath = getHistoryPath;
+const ensureHistoryFile = async () => {
+    const filePath = resolveHistoryPath();
+    try {
+        await promises_1.default.mkdir(node_path_1.default.dirname(filePath), { recursive: true });
+        await promises_1.default.appendFile(filePath, "", "utf8");
+    }
+    catch (error) {
+        consola_1.consola.debug(`Unable to create history log: ${error instanceof Error ? error.message : String(error)}`);
+    }
+};
+exports.ensureHistoryFile = ensureHistoryFile;

package/dist/shared/keychain.d.ts

@@ -0,0 +1,15 @@
+type CmTokenBundle = {
+    accessToken?: string;
+    refreshToken?: string;
+    refreshTokenParameters?: Record<string, string>;
+    expiresIn?: number | null;
+    lastUpdated?: string | null;
+};
+export declare const getDeployToken: (envName: string) => Promise<string | undefined>;
+export declare const setDeployToken: (envName: string, token: string) => Promise<boolean>;
+export declare const clearDeployToken: (envName: string) => Promise<boolean>;
+export declare const getCmTokens: (envName: string) => Promise<CmTokenBundle | undefined>;
+export declare const setCmTokens: (envName: string, tokens: CmTokenBundle) => Promise<boolean>;
+export declare const clearCmTokens: (envName: string) => Promise<boolean>;
+export {};
+//# sourceMappingURL=keychain.d.ts.map

package/dist/shared/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../src/shared/keychain.ts"],"names":[],"mappings":"AAUA,KAAK,aAAa,GAAG;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AA6DF,eAAO,MAAM,cAAc,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAchF,CAAC;AAEF,eAAO,MAAM,cAAc,GAAU,SAAS,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,OAAO,CAYpF,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAWvE,CAAC;AAEF,eAAO,MAAM,WAAW,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAepF,CAAC;AAEF,eAAO,MAAM,WAAW,GAAU,SAAS,MAAM,EAAE,QAAQ,aAAa,KAAG,OAAO,CAAC,OAAO,CAgBzF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAWpE,CAAC"}