c8y-nitro 0.7.1 → 0.7.2

package/dist/autoBootstrap-Drk7ltXK.mjs

@@ -0,0 +1,212 @@
+import { a as findMicroserviceByName, d as updateMicroservice, l as subscribeToApplication, n as createBasicAuthHeader, o as getBootstrapCredentials, p as createC8yManifest, r as createMicroservice } from "./c8y-api-DscUs-Kd.mjs";
+import { t as writeBootstrapCredentials } from "./env-file-BrOTmVjA.mjs";
+import { join } from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import process from "node:process";
+//#region src/module/manifestCache.ts
+/**
+* Directory (inside the project's `node_modules`) where c8y-nitro persists
+* local dev state such as the last-synced manifest hash. Lives in
+* `node_modules` so it is naturally gitignored and scoped per-checkout.
+*/
+const CACHE_DIR_SEGMENTS = ["node_modules", ".c8y-nitro"];
+const CACHE_FILE_NAME = "bootstrap-state.json";
+const CACHE_SCHEMA_VERSION = 1;
+function getCacheDir(rootDir) {
+	return join(rootDir, ...CACHE_DIR_SEGMENTS);
+}
+function getCacheFile(rootDir) {
+	return join(getCacheDir(rootDir), CACHE_FILE_NAME);
+}
+/**
+* Compute a hash over the manifest and the deployment target it will be synced
+* to. Folding the target in means switching tenant/baseURL invalidates the
+* cached hash even if the manifest itself is unchanged.
+*
+* @param manifest - The generated Cumulocity manifest
+* @param target - The deployment target identity
+*/
+function hashManifest(manifest, target) {
+	const payload = JSON.stringify({
+		manifest,
+		target
+	});
+	return createHash("sha256").update(payload).digest("hex");
+}
+/**
+* Read the persisted bootstrap state, or `null` when absent, unreadable, or
+* from an incompatible schema version.
+* @param rootDir - Project root directory (containing `node_modules`)
+*/
+async function readManifestCache(rootDir) {
+	try {
+		const content = await readFile(getCacheFile(rootDir), "utf-8");
+		const state = JSON.parse(content);
+		if (state.schemaVersion !== CACHE_SCHEMA_VERSION) return null;
+		return state;
+	} catch {
+		return null;
+	}
+}
+/**
+* Persist the bootstrap state for future dev restarts.
+* @param rootDir - Project root directory (containing `node_modules`)
+* @param state - The state to persist (schema version is filled in automatically)
+*/
+async function writeManifestCache(rootDir, state) {
+	await mkdir(getCacheDir(rootDir), { recursive: true });
+	const payload = {
+		schemaVersion: CACHE_SCHEMA_VERSION,
+		...state
+	};
+	await writeFile(getCacheFile(rootDir), JSON.stringify(payload, null, 2), "utf-8");
+}
+//#endregion
+//#region src/module/autoBootstrap.ts
+const BOOTSTRAP_ENV_VARS = [
+	"C8Y_BOOTSTRAP_TENANT",
+	"C8Y_BOOTSTRAP_USER",
+	"C8Y_BOOTSTRAP_PASSWORD"
+];
+const DEV_ENV_VARS = [
+	"C8Y_BASEURL",
+	"C8Y_DEVELOPMENT_TENANT",
+	"C8Y_DEVELOPMENT_USER",
+	"C8Y_DEVELOPMENT_PASSWORD"
+];
+/**
+* Reads bootstrap credentials from an env object (e.g. a loaded `.env` file or
+* `process.env`). Returns `undefined` unless all three variables are present.
+* @param env - Environment variables object
+*/
+function readBootstrapCredentialsFromEnv(env) {
+	const tenant = env.C8Y_BOOTSTRAP_TENANT;
+	const name = env.C8Y_BOOTSTRAP_USER;
+	const password = env.C8Y_BOOTSTRAP_PASSWORD;
+	if (!tenant || !name || !password) return;
+	return {
+		tenant,
+		name,
+		password
+	};
+}
+/**
+* Verifies the microservice on the development tenant and keeps it in sync with
+* the local manifest, bootstrapping (or re-bootstrapping) when needed.
+*
+* Unlike a purely env-var-based check, this always verifies against the tenant,
+* so it also handles:
+* - the manifest changing between runs (auto-updates a placeholder), and
+* - the application being deleted on the tenant while stale bootstrap env vars
+*   still linger locally (re-creates it).
+*
+* A previously *deployed* microservice (one with an active version) is never
+* overwritten automatically - we only warn about the drift.
+*
+* @param options - See {@link SyncBootstrappedMicroserviceOptions}
+* @returns The bootstrap credentials for the microservice (freshly fetched when
+* they were refreshed, otherwise the ones already present in `env`)
+*/
+async function syncBootstrappedMicroservice(options) {
+	const { rootDir, baseUrl, developmentTenant, authHeader, manifest, logger } = options;
+	const env = options.env ?? process.env;
+	const target = {
+		baseUrl,
+		developmentTenant,
+		name: manifest.name
+	};
+	const currentHash = hashManifest(manifest, target);
+	const existingApp = await findMicroserviceByName(baseUrl, manifest.name, authHeader);
+	if (!existingApp) {
+		const createdApp = await createMicroservice(baseUrl, manifest, authHeader);
+		logger.debug(`Microservice "${manifest.name}" created (ID: ${createdApp.id})`);
+		const credentials = await finalizeBootstrap({
+			rootDir,
+			logger,
+			baseUrl,
+			developmentTenant,
+			appId: createdApp.id,
+			authHeader,
+			target,
+			manifestHash: currentHash,
+			forceCredentials: true
+		});
+		logger.success(`Microservice "${manifest.name}" created on the development tenant.`);
+		return credentials;
+	}
+	const appId = existingApp.id;
+	const isRealService = Boolean(existingApp.activeVersionId);
+	const cache = await readManifestCache(rootDir);
+	if (!cache || cache.manifestHash !== currentHash || cache.appId !== appId) if (isRealService) logger.warn(`Local manifest for "${manifest.name}" differs from the deployed microservice on the development tenant. The running service was left untouched. Redeploy or run \`npx c8y-nitro bootstrap\` to update it explicitly.`);
+	else {
+		await updateMicroservice(baseUrl, appId, manifest, authHeader);
+		logger.success(`Updated microservice "${manifest.name}" with changed manifest.`);
+	}
+	const hasBootstrapCreds = BOOTSTRAP_ENV_VARS.every((v) => env[v]);
+	const appChanged = cache?.appId !== appId;
+	return await finalizeBootstrap({
+		rootDir,
+		logger,
+		baseUrl,
+		developmentTenant,
+		appId,
+		authHeader,
+		target,
+		manifestHash: currentHash,
+		forceCredentials: !hasBootstrapCreds || appChanged
+	}) ?? readBootstrapCredentialsFromEnv(env);
+}
+/**
+* Verifies the microservice on the development tenant during dev startup.
+* Runs silently unless a bootstrap/sync was performed or an error occurs.
+* @param nitro - Nitro instance
+*/
+async function autoBootstrap(nitro) {
+	try {
+		if (DEV_ENV_VARS.filter((v) => !process.env[v]).length > 0) return;
+		const baseUrl = process.env.C8Y_BASEURL.endsWith("/") ? process.env.C8Y_BASEURL.slice(0, -1) : process.env.C8Y_BASEURL;
+		const authHeader = createBasicAuthHeader(process.env.C8Y_DEVELOPMENT_TENANT, process.env.C8Y_DEVELOPMENT_USER, process.env.C8Y_DEVELOPMENT_PASSWORD);
+		const manifest = await createC8yManifest(nitro.options.rootDir, nitro.options, nitro.logger);
+		await syncBootstrappedMicroservice({
+			rootDir: nitro.options.rootDir,
+			baseUrl,
+			developmentTenant: process.env.C8Y_DEVELOPMENT_TENANT,
+			authHeader,
+			manifest,
+			logger: nitro.logger
+		});
+	} catch (error) {
+		nitro.logger.warn("Auto-bootstrap failed:", error instanceof Error ? error.message : String(error));
+	}
+}
+/**
+* Subscribe the tenant, optionally (re)write bootstrap credentials, and persist
+* the synced state to the local cache.
+* @param opts - Bootstrap finalization inputs
+* @returns The freshly fetched credentials when `forceCredentials` was set
+*/
+async function finalizeBootstrap(opts) {
+	await subscribeToApplication(opts.baseUrl, opts.developmentTenant, opts.appId, opts.authHeader);
+	let credentials;
+	if (opts.forceCredentials) {
+		credentials = await getBootstrapCredentials(opts.baseUrl, opts.appId, opts.authHeader);
+		const envFileName = await writeBootstrapCredentials(opts.rootDir, {
+			C8Y_BOOTSTRAP_TENANT: credentials.tenant,
+			C8Y_BOOTSTRAP_USER: credentials.name,
+			C8Y_BOOTSTRAP_PASSWORD: credentials.password
+		});
+		process.env.C8Y_BOOTSTRAP_TENANT = credentials.tenant;
+		process.env.C8Y_BOOTSTRAP_USER = credentials.name;
+		process.env.C8Y_BOOTSTRAP_PASSWORD = credentials.password;
+		opts.logger.debug(`Bootstrap credentials written to ${envFileName}`);
+	}
+	await writeManifestCache(opts.rootDir, {
+		manifestHash: opts.manifestHash,
+		target: opts.target,
+		appId: opts.appId
+	});
+	return credentials;
+}
+//#endregion
+export { readBootstrapCredentialsFromEnv as n, syncBootstrappedMicroservice as r, autoBootstrap as t };

package/dist/{bootstrap-ObaEF7rN.mjs → bootstrap-C1Qly0J_.mjs}

@@ -1,4 +1,4 @@
-import { a as findMicroserviceByName, d as updateMicroservice, l as subscribeToApplication, n as createBasicAuthHeader, o as getBootstrapCredentials, p as createC8yManifest, r as createMicroservice } from "./c8y-api-BFjK6AYb.mjs";
+import { a as findMicroserviceByName, d as updateMicroservice, l as subscribeToApplication, n as createBasicAuthHeader, o as getBootstrapCredentials, p as createC8yManifest, r as createMicroservice } from "./c8y-api-DscUs-Kd.mjs";
 import { t as writeBootstrapCredentials } from "./env-file-BrOTmVjA.mjs";
 import { n as validateBootstrapEnv, t as loadC8yConfig } from "./config-BVQHqlgV.mjs";
 import { defineCommand, runCommand } from "citty";
@@ -52,7 +52,7 @@ var bootstrap_default = defineCommand({
 		});
 		consola.success(`Bootstrap credentials written to ${envFileName}`);
 		if (manifest.roles && manifest.roles.length > 0) {
-			if (await consola.prompt("Do you want to manage microservice roles for your development user?", { type: "confirm" })) await runCommand(await import("./roles-B58Fguop.mjs").then((r) => r.default), { rawArgs: [] });
+			if (await consola.prompt("Do you want to manage microservice roles for your development user?", { type: "confirm" })) await runCommand(await import("./roles-B-DNuScZ.mjs").then((r) => r.default), { rawArgs: [] });
 		}
 		consola.success("Bootstrap complete!");
 	}

package/dist/{c8y-api-BFjK6AYb.mjs → c8y-api-DscUs-Kd.mjs}

@@ -283,14 +283,20 @@ async function unassignUserRole(baseUrl, tenantId, userId, roleId, authHeader) {
 	}
 }
 /**
-* Gets all tenant options for a specific category.
+* Fetches the current application's settings (the tenant options of the
+* microservice's own settings category) via
+* `GET /application/currentApplication/settings`.
+*
+* Must be called with microservice credentials (bootstrap or service user).
+* Unlike the Options API — which returns `credentials.*` values encrypted for
+* regular users and rejects the bootstrap user with `403` — this endpoint
+* returns encrypted `credentials.*` options **decrypted**.
 * @param baseUrl - The Cumulocity base URL
-* @param category - The category to fetch options for
-* @param authHeader - The Basic Auth header
-* @returns Record of key-value pairs for the category
+* @param authHeader - Basic Auth header of the bootstrap (or service) user
+* @returns Flat key-value map of the microservice's settings
 */
-async function getTenantOptionsByCategory(baseUrl, category, authHeader) {
-	const url = `${baseUrl}/tenant/options/${encodeURIComponent(category)}`;
+async function getCurrentApplicationSettings(baseUrl, authHeader) {
+	const url = `${baseUrl}/application/currentApplication/settings`;
 	const response = await fetch(url, {
 		method: "GET",
 		headers: {
@@ -298,23 +304,21 @@ async function getTenantOptionsByCategory(baseUrl, category, authHeader) {
 			Accept: "application/json"
 		}
 	});
-	if (response.status === 404) return {};
 	if (!response.ok) {
 		const errorText = await response.text();
-		throw new Error(`Failed to get tenant options for category ${category}: ${response.status} ${response.statusText}\n${errorText}`, { cause: response });
+		throw new Error(`Failed to get current application settings: ${response.status} ${response.statusText}\n${errorText}`, { cause: response });
 	}
 	return await response.json();
 }
 /**
-* Gets a specific tenant option value.
+* Gets all tenant options for a specific category.
 * @param baseUrl - The Cumulocity base URL
-* @param category - The category of the option
-* @param key - The option key
+* @param category - The category to fetch options for
 * @param authHeader - The Basic Auth header
-* @returns The option value, or undefined if not set
+* @returns Record of key-value pairs for the category
 */
-async function getTenantOption(baseUrl, category, key, authHeader) {
-	const url = `${baseUrl}/tenant/options/${encodeURIComponent(category)}/${encodeURIComponent(key)}`;
+async function getTenantOptionsByCategory(baseUrl, category, authHeader) {
+	const url = `${baseUrl}/tenant/options/${encodeURIComponent(category)}`;
 	const response = await fetch(url, {
 		method: "GET",
 		headers: {
@@ -322,12 +326,12 @@ async function getTenantOption(baseUrl, category, key, authHeader) {
 			Accept: "application/json"
 		}
 	});
-	if (response.status === 404) return;
+	if (response.status === 404) return {};
 	if (!response.ok) {
 		const errorText = await response.text();
-		throw new Error(`Failed to get tenant option ${category}/${key}: ${response.status} ${response.statusText}\n${errorText}`, { cause: response });
+		throw new Error(`Failed to get tenant options for category ${category}: ${response.status} ${response.statusText}\n${errorText}`, { cause: response });
 	}
-	return (await response.json()).value;
+	return await response.json();
 }
 /**
 * Creates a tenant option.
@@ -420,4 +424,4 @@ async function deleteTenantOption(baseUrl, category, key, authHeader) {
 	}
 }
 //#endregion
-export { GENERATED_READINESS_ROUTE as _, findMicroserviceByName as a, getTenantOptionsByCategory as c, updateMicroservice as d, upsertTenantOption as f, GENERATED_LIVENESS_ROUTE as g, GENERATED_INVALIDATE_TENANT_OPTIONS_ROUTE as h, deleteTenantOption as i, subscribeToApplication as l, createC8yManifestFromNitro as m, createBasicAuthHeader as n, getBootstrapCredentials as o, createC8yManifest as p, createMicroservice as r, getTenantOption as s, assignUserRole as t, unassignUserRole as u };
+export { GENERATED_READINESS_ROUTE as _, findMicroserviceByName as a, getTenantOptionsByCategory as c, updateMicroservice as d, upsertTenantOption as f, GENERATED_LIVENESS_ROUTE as g, GENERATED_INVALIDATE_TENANT_OPTIONS_ROUTE as h, deleteTenantOption as i, subscribeToApplication as l, createC8yManifestFromNitro as m, createBasicAuthHeader as n, getBootstrapCredentials as o, createC8yManifest as p, createMicroservice as r, getCurrentApplicationSettings as s, assignUserRole as t, unassignUserRole as u };

package/dist/cli/index.mjs

@@ -1,4 +1,4 @@
-import { n as name, r as version, t as description } from "../package-D5xRshsx.mjs";
+import { n as name, r as version, t as description } from "../package-BHOzdhHp.mjs";
 import { defineCommand, runMain } from "citty";
 //#region src/cli/index.ts
 runMain(defineCommand({
@@ -8,9 +8,9 @@ runMain(defineCommand({
 		description
 	},
 	subCommands: {
-		bootstrap: () => import("../bootstrap-ObaEF7rN.mjs").then((r) => r.default),
-		roles: () => import("../roles-B58Fguop.mjs").then((r) => r.default),
-		options: () => import("../options-B7_yb_wr.mjs").then((r) => r.default)
+		bootstrap: () => import("../bootstrap-C1Qly0J_.mjs").then((r) => r.default),
+		roles: () => import("../roles-B-DNuScZ.mjs").then((r) => r.default),
+		options: () => import("../options-CmLpZ3Qf.mjs").then((r) => r.default)
 	}
 }));
 //#endregion

package/dist/{client-DxmbyZju.mjs → client-D0Tdq7H1.mjs}

@@ -96,6 +96,50 @@ async function getUserTenantDomain(requestOrEvent) {
 	const tenantId = await getCurrentUserTenantId(requestOrEvent);
 	return cachedTenantDomain(requestOrEvent, tenantId);
 }
+const FAST_DOMAIN_SUCCESS_TTL = 6e4;
+const FAST_DOMAIN_FAILURE_TTL = 1e4;
+const FAST_DOMAIN_MAX_ENTRIES = 1e3;
+const fastDomainCache = /* @__PURE__ */ new Map();
+/**
+* Best-effort variant of {@link getUserTenantDomain} for per-request hot paths:
+* never throws (returns `undefined` for unauthenticated requests or failed
+* lookups) and memoizes results in-process per auth material. Failures are
+* cached briefly so requests with unresolvable credentials don't trigger a
+* platform call each time.
+* @param requestOrEvent - The H3Event or ServerRequest from the current request
+* @param resolveDomain - Domain resolver, only overridden in tests
+*/
+async function tryGetUserTenantDomainFast(requestOrEvent, resolveDomain = getUserTenantDomain) {
+	if (!getCurrentUserTenantCacheKeyMaterial(requestOrEvent)) return;
+	const key = createCurrentUserTenantCacheKey(requestOrEvent);
+	const now = Date.now();
+	const cached = fastDomainCache.get(key);
+	if (cached && cached.expiresAt > now) return cached.domain;
+	let domain;
+	try {
+		domain = await resolveDomain(requestOrEvent);
+	} catch {
+		domain = void 0;
+	}
+	if (!fastDomainCache.has(key) && fastDomainCache.size >= FAST_DOMAIN_MAX_ENTRIES) fastDomainCache.delete(fastDomainCache.keys().next().value);
+	fastDomainCache.set(key, {
+		domain,
+		expiresAt: now + (domain ? FAST_DOMAIN_SUCCESS_TTL : FAST_DOMAIN_FAILURE_TTL)
+	});
+	return domain;
+}
+/**
+* Builds the public URL a request is reachable at through the platform proxy:
+* `https://<tenant domain>/service/<contextPath><pathname><search>`.
+* The proxy strips the `/service/<contextPath>` prefix before the request
+* reaches the microservice, so it is re-added here.
+* @param tenantDomain - Public domain of the tenant (e.g. `tenant.cumulocity.com`)
+* @param contextPath - Context path of the microservice
+* @param url - URL the request was received with (only pathname and search are used)
+*/
+function buildPublicRequestUrl(tenantDomain, contextPath, url) {
+	return new URL(`https://${tenantDomain}/service/${contextPath}${url.pathname}${url.search}`);
+}
 //#endregion
 //#region src/utils/credentials.ts
 let prevCredentials = null;
@@ -233,4 +277,4 @@ async function useDeployedTenantClient() {
 	return client;
 }
 //#endregion
-export { getUserTenantDomain as n, useDeployedTenantClient as t };
+export { buildPublicRequestUrl as n, tryGetUserTenantDomainFast as r, useDeployedTenantClient as t };

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { _ as GENERATED_READINESS_ROUTE, a as findMicroserviceByName, d as updateMicroservice, g as GENERATED_LIVENESS_ROUTE, h as GENERATED_INVALIDATE_TENANT_OPTIONS_ROUTE, l as subscribeToApplication, m as createC8yManifestFromNitro, n as createBasicAuthHeader, o as getBootstrapCredentials, p as createC8yManifest, r as createMicroservice } from "./c8y-api-BFjK6AYb.mjs";
-import { t as writeBootstrapCredentials } from "./env-file-BrOTmVjA.mjs";
-import { n as name } from "./package-D5xRshsx.mjs";
+import { _ as GENERATED_READINESS_ROUTE, g as GENERATED_LIVENESS_ROUTE, h as GENERATED_INVALIDATE_TENANT_OPTIONS_ROUTE, m as createC8yManifestFromNitro, p as createC8yManifest } from "./c8y-api-DscUs-Kd.mjs";
+import { t as autoBootstrap } from "./autoBootstrap-Drk7ltXK.mjs";
+import { n as name } from "./package-BHOzdhHp.mjs";
 import { basename, dirname, join, relative } from "node:path";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, writeFile } from "node:fs/promises";
 import { x } from "tinyexec";
 import { join as join$1 } from "pathe";
 import { mkdir as mkdir$1, readFile as readFile$1, stat, writeFile as writeFile$1 } from "fs/promises";
@@ -11,8 +11,6 @@ import Spinnies from "spinnies";
 import { colors } from "consola/utils";
 import { mkdirSync, writeFileSync } from "fs";
 import { fileURLToPath } from "node:url";
-import { createHash } from "node:crypto";
-import process from "node:process";
 import evlog from "evlog/nitro/v3";
 //#region src/module/apiClient.ts
 /**
@@ -465,6 +463,22 @@ function registerRuntime(nitro, options = {}) {
 		handler,
 		middleware: true
 	})));
+	/**
+	* Request URL rewrite middleware (always on in production builds).
+	* Rewrites `event.url` to the public tenant endpoint so handlers that build
+	* absolute URLs from the request don't leak internal cluster URLs.
+	* Registered after the scanned middlewares (which observe the original
+	* cluster-local URL) and before the OpenAPI transform, which reuses the
+	* resolved tenant domain from its cache.
+	*/
+	if (!isNitroDev) {
+		nitro.options.handlers.push({
+			route: "/**",
+			handler: join$1(thisFilePath, "./runtime/handlers/rewriteRequestUrl"),
+			middleware: true
+		});
+		nitro.logger.debug("Registered public request URL rewrite middleware");
+	}
 	if (Boolean(nitro.options.experimental?.openAPI && (isNitroDev || nitro.options.openAPI?.production))) if (!isNitroDev && nitro.options.openAPI?.production === "prerender") nitro.logger.warn("c8y-nitro cannot transform a prerendered OpenAPI document (internal routes stay listed and the server URL is baked in at build time). Use `openAPI: { production: true }` to serve the document at runtime instead.");
 	else {
 		nitro.options.handlers.push({
@@ -535,173 +549,6 @@ function checkProbeEndpoint(nitro, probe, probeType) {
 	}
 }
 //#endregion
-//#region src/module/manifestCache.ts
-/**
-* Directory (inside the project's `node_modules`) where c8y-nitro persists
-* local dev state such as the last-synced manifest hash. Lives in
-* `node_modules` so it is naturally gitignored and scoped per-checkout.
-*/
-const CACHE_DIR_SEGMENTS = ["node_modules", ".c8y-nitro"];
-const CACHE_FILE_NAME = "bootstrap-state.json";
-const CACHE_SCHEMA_VERSION = 1;
-function getCacheDir(rootDir) {
-	return join(rootDir, ...CACHE_DIR_SEGMENTS);
-}
-function getCacheFile(rootDir) {
-	return join(getCacheDir(rootDir), CACHE_FILE_NAME);
-}
-/**
-* Compute a hash over the manifest and the deployment target it will be synced
-* to. Folding the target in means switching tenant/baseURL invalidates the
-* cached hash even if the manifest itself is unchanged.
-*
-* @param manifest - The generated Cumulocity manifest
-* @param target - The deployment target identity
-*/
-function hashManifest(manifest, target) {
-	const payload = JSON.stringify({
-		manifest,
-		target
-	});
-	return createHash("sha256").update(payload).digest("hex");
-}
-/**
-* Read the persisted bootstrap state, or `null` when absent, unreadable, or
-* from an incompatible schema version.
-* @param rootDir - Project root directory (containing `node_modules`)
-*/
-async function readManifestCache(rootDir) {
-	try {
-		const content = await readFile(getCacheFile(rootDir), "utf-8");
-		const state = JSON.parse(content);
-		if (state.schemaVersion !== CACHE_SCHEMA_VERSION) return null;
-		return state;
-	} catch {
-		return null;
-	}
-}
-/**
-* Persist the bootstrap state for future dev restarts.
-* @param rootDir - Project root directory (containing `node_modules`)
-* @param state - The state to persist (schema version is filled in automatically)
-*/
-async function writeManifestCache(rootDir, state) {
-	await mkdir(getCacheDir(rootDir), { recursive: true });
-	const payload = {
-		schemaVersion: CACHE_SCHEMA_VERSION,
-		...state
-	};
-	await writeFile(getCacheFile(rootDir), JSON.stringify(payload, null, 2), "utf-8");
-}
-//#endregion
-//#region src/module/autoBootstrap.ts
-const BOOTSTRAP_ENV_VARS = [
-	"C8Y_BOOTSTRAP_TENANT",
-	"C8Y_BOOTSTRAP_USER",
-	"C8Y_BOOTSTRAP_PASSWORD"
-];
-const DEV_ENV_VARS = [
-	"C8Y_BASEURL",
-	"C8Y_DEVELOPMENT_TENANT",
-	"C8Y_DEVELOPMENT_USER",
-	"C8Y_DEVELOPMENT_PASSWORD"
-];
-/**
-* Verifies the microservice on the development tenant and keeps it in sync with
-* the local manifest, bootstrapping (or re-bootstrapping) when needed.
-*
-* Unlike a purely env-var-based check, this always verifies against the tenant
-* when development credentials are available, so it also handles:
-* - the manifest changing between dev restarts (auto-updates a placeholder), and
-* - the application being deleted on the tenant while stale bootstrap env vars
-*   still linger locally (re-creates it).
-*
-* A previously *deployed* microservice (one with an active version) is never
-* overwritten automatically - we only warn about the drift.
-*
-* Runs silently unless a bootstrap/sync was performed or an error occurs.
-* @param nitro - Nitro instance
-*/
-async function autoBootstrap(nitro) {
-	try {
-		const rootDir = nitro.options.rootDir;
-		if (DEV_ENV_VARS.filter((v) => !process.env[v]).length > 0) return;
-		const baseUrl = process.env.C8Y_BASEURL.endsWith("/") ? process.env.C8Y_BASEURL.slice(0, -1) : process.env.C8Y_BASEURL;
-		const developmentTenant = process.env.C8Y_DEVELOPMENT_TENANT;
-		const authHeader = createBasicAuthHeader(developmentTenant, process.env.C8Y_DEVELOPMENT_USER, process.env.C8Y_DEVELOPMENT_PASSWORD);
-		const manifest = await createC8yManifest(rootDir, nitro.options, nitro.logger);
-		const target = {
-			baseUrl,
-			developmentTenant,
-			name: manifest.name
-		};
-		const currentHash = hashManifest(manifest, target);
-		const existingApp = await findMicroserviceByName(baseUrl, manifest.name, authHeader);
-		if (!existingApp) {
-			const createdApp = await createMicroservice(baseUrl, manifest, authHeader);
-			nitro.logger.debug(`Microservice "${manifest.name}" created (ID: ${createdApp.id})`);
-			await finalizeBootstrap(nitro, {
-				baseUrl,
-				developmentTenant,
-				appId: createdApp.id,
-				authHeader,
-				target,
-				manifestHash: currentHash,
-				forceCredentials: true
-			});
-			nitro.logger.success(`Auto-bootstrap complete! Microservice "${manifest.name}" created on tenant.`);
-			return;
-		}
-		const appId = existingApp.id;
-		const isRealService = Boolean(existingApp.activeVersionId);
-		const cache = await readManifestCache(rootDir);
-		if (!cache || cache.manifestHash !== currentHash || cache.appId !== appId) if (isRealService) nitro.logger.warn(`Local manifest for "${manifest.name}" differs from the deployed microservice on the development tenant. The running service was left untouched. Redeploy or run \`npx c8y-nitro bootstrap\` to update it explicitly.`);
-		else {
-			await updateMicroservice(baseUrl, appId, manifest, authHeader);
-			nitro.logger.success(`Auto-bootstrap: updated microservice "${manifest.name}" with changed manifest.`);
-		}
-		const hasBootstrapCreds = BOOTSTRAP_ENV_VARS.every((v) => process.env[v]);
-		const appChanged = cache?.appId !== appId;
-		await finalizeBootstrap(nitro, {
-			baseUrl,
-			developmentTenant,
-			appId,
-			authHeader,
-			target,
-			manifestHash: currentHash,
-			forceCredentials: !hasBootstrapCreds || appChanged
-		});
-	} catch (error) {
-		nitro.logger.warn("Auto-bootstrap failed:", error instanceof Error ? error.message : String(error));
-	}
-}
-/**
-* Subscribe the tenant, optionally (re)write bootstrap credentials, and persist
-* the synced state to the local cache.
-* @param nitro
-* @param opts
-*/
-async function finalizeBootstrap(nitro, opts) {
-	await subscribeToApplication(opts.baseUrl, opts.developmentTenant, opts.appId, opts.authHeader);
-	if (opts.forceCredentials) {
-		const credentials = await getBootstrapCredentials(opts.baseUrl, opts.appId, opts.authHeader);
-		const envFileName = await writeBootstrapCredentials(nitro.options.rootDir, {
-			C8Y_BOOTSTRAP_TENANT: credentials.tenant,
-			C8Y_BOOTSTRAP_USER: credentials.name,
-			C8Y_BOOTSTRAP_PASSWORD: credentials.password
-		});
-		process.env.C8Y_BOOTSTRAP_TENANT = credentials.tenant;
-		process.env.C8Y_BOOTSTRAP_USER = credentials.name;
-		process.env.C8Y_BOOTSTRAP_PASSWORD = credentials.password;
-		nitro.logger.debug(`Bootstrap credentials written to ${envFileName}`);
-	}
-	await writeManifestCache(nitro.options.rootDir, {
-		manifestHash: opts.manifestHash,
-		target: opts.target,
-		appId: opts.appId
-	});
-}
-//#endregion
 //#region src/index.ts
 function c8y() {
 	return {

package/dist/options-CmLpZ3Qf.mjs

@@ -0,0 +1,179 @@
+import { c as getTenantOptionsByCategory, f as upsertTenantOption, i as deleteTenantOption, n as createBasicAuthHeader, p as createC8yManifest, s as getCurrentApplicationSettings } from "./c8y-api-DscUs-Kd.mjs";
+import { n as readBootstrapCredentialsFromEnv, r as syncBootstrappedMicroservice } from "./autoBootstrap-Drk7ltXK.mjs";
+import { n as validateBootstrapEnv, t as loadC8yConfig } from "./config-BVQHqlgV.mjs";
+import process from "node:process";
+import { defineCommand } from "citty";
+import { consola } from "consola";
+import { createInterface } from "node:readline/promises";
+//#region src/cli/commands/options.ts
+var options_default = defineCommand({
+	meta: {
+		name: "options",
+		description: "Manage tenant options on the development tenant"
+	},
+	args: {},
+	async run() {
+		consola.info("Loading configuration...");
+		const { env, nitroConfig, configDir } = await loadC8yConfig();
+		consola.info("Validating environment variables...");
+		const envVars = validateBootstrapEnv(env);
+		consola.info("Loading manifest...");
+		const manifest = await createC8yManifest(configDir, nitroConfig);
+		const category = manifest.settingsCategory || manifest.contextPath || manifest.name;
+		if (!manifest.settings || manifest.settings.length === 0) throw new Error("No settings defined in manifest. Add settings to your c8y.manifest configuration.");
+		consola.success(`Using category: ${category}`);
+		const devAuthHeader = createBasicAuthHeader(envVars.C8Y_DEVELOPMENT_TENANT, envVars.C8Y_DEVELOPMENT_USER, envVars.C8Y_DEVELOPMENT_PASSWORD);
+		let bootstrapCredentials;
+		try {
+			consola.info("Checking microservice on development tenant...");
+			bootstrapCredentials = await syncBootstrappedMicroservice({
+				rootDir: configDir,
+				baseUrl: envVars.C8Y_BASEURL,
+				developmentTenant: envVars.C8Y_DEVELOPMENT_TENANT,
+				authHeader: devAuthHeader,
+				manifest,
+				logger: consola,
+				env
+			});
+		} catch (error) {
+			consola.warn(`Could not sync microservice with the development tenant: ${error instanceof Error ? error.message : String(error)}`);
+			bootstrapCredentials = readBootstrapCredentialsFromEnv(env);
+		}
+		const bootstrapAuthHeader = bootstrapCredentials ? createBasicAuthHeader(bootstrapCredentials.tenant, bootstrapCredentials.name, bootstrapCredentials.password) : void 0;
+		if (!bootstrapAuthHeader) consola.warn("No bootstrap credentials available - reading with the development user. Encrypted credentials.* options cannot be decrypted.");
+		consola.info("Fetching current tenant options...");
+		const currentOptions = await getTenantOptionsByCategory(envVars.C8Y_BASEURL, category, devAuthHeader);
+		if (bootstrapAuthHeader) try {
+			const decryptedSettings = await getCurrentApplicationSettings(envVars.C8Y_BASEURL, bootstrapAuthHeader);
+			for (const [key, value] of Object.entries(decryptedSettings)) if (currentOptions[key] !== void 0 || key.startsWith("credentials.")) currentOptions[key] = value;
+		} catch (error) {
+			consola.warn(`Could not read decrypted settings with the bootstrap user: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		const availableKeys = manifest.settings.map((s) => s.key);
+		const setManifestKeys = availableKeys.filter((k) => currentOptions[k] !== void 0);
+		consola.success(`Found ${Object.keys(currentOptions).length} options set on tenant (${setManifestKeys.length} of ${availableKeys.length} manifest settings)`);
+		const ctx = {
+			baseUrl: envVars.C8Y_BASEURL,
+			category,
+			devAuthHeader,
+			bootstrapAuthHeader,
+			availableKeys,
+			currentOptions
+		};
+		const action = await consola.prompt("What do you want to do?", {
+			type: "select",
+			options: [
+				{
+					label: "Read option value",
+					value: "read"
+				},
+				{
+					label: "Update/Create option",
+					value: "update"
+				},
+				{
+					label: "Delete option(s)",
+					value: "delete"
+				}
+			]
+		});
+		if (action === "read") await handleRead(ctx);
+		else if (action === "update") await handleUpdate(ctx);
+		else if (action === "delete") await handleDelete(ctx);
+	}
+});
+/**
+* Handle reading options: prints all options at once (decrypted where
+* possible), then - after the user confirms with Enter - rewrites the output
+* in place with `credentials.*` values masked, so secrets don't linger in the
+* terminal scrollback.
+* @param ctx - The shared options context
+*/
+async function handleRead(ctx) {
+	const { bootstrapAuthHeader, availableKeys, currentOptions } = ctx;
+	if (!bootstrapAuthHeader && availableKeys.some((k) => k.startsWith("credentials."))) consola.warn("Encrypted credentials.* options cannot be read in decrypted form without bootstrap credentials. Run `npx c8y-nitro bootstrap` first.");
+	const keys = [.../* @__PURE__ */ new Set([...availableKeys, ...Object.keys(currentOptions)])];
+	const padWidth = Math.max(...keys.map((k) => k.length));
+	const renderLine = (key, maskCredentials) => {
+		const value = currentOptions[key];
+		const shownValue = value === void 0 ? "(not set)" : maskCredentials && key.startsWith("credentials.") ? "****" : value;
+		const suffix = availableKeys.includes(key) ? "" : " (not in manifest)";
+		return `  ${key.padEnd(padWidth)} = ${shownValue}${suffix}`;
+	};
+	const revealedLines = keys.map((key) => renderLine(key, false));
+	process.stdout.write(`${revealedLines.join("\n")}\n`);
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	await rl.question("Press <Enter> to hide credential values...");
+	rl.close();
+	if (process.stdout.isTTY) {
+		const columns = process.stdout.columns || 80;
+		const rowsFor = (line) => Math.max(1, Math.ceil(line.length / columns));
+		const rowsToErase = revealedLines.reduce((rows, line) => rows + rowsFor(line), 1);
+		process.stdout.write(`\x1B[${rowsToErase}A\x1B[0J`);
+		process.stdout.write(`${keys.map((key) => renderLine(key, true)).join("\n")}\n`);
+	}
+}
+/**
+* Handle updating options (with loop for multiple updates)
+* @param ctx - The shared options context
+*/
+async function handleUpdate(ctx) {
+	const { baseUrl, category, devAuthHeader, bootstrapAuthHeader, availableKeys, currentOptions } = ctx;
+	let continueUpdating = true;
+	while (continueUpdating) {
+		const key = await consola.prompt("Select option to update:", {
+			type: "select",
+			options: availableKeys.map((k) => ({
+				label: currentOptions[k] !== void 0 ? `${k} (current: ${currentOptions[k]})` : k.startsWith("credentials.") && !bootstrapAuthHeader ? `${k} (current: unknown)` : `${k} (not set)`,
+				value: k
+			})),
+			cancel: "reject"
+		});
+		const currentValue = currentOptions[key];
+		const newValue = await consola.prompt("Enter new value:", {
+			type: "text",
+			default: currentValue,
+			cancel: "reject"
+		});
+		consola.info(`Updating option: ${key}`);
+		await upsertTenantOption(baseUrl, category, key, newValue, devAuthHeader);
+		currentOptions[key] = newValue;
+		consola.success(`Option '${key}' updated successfully`);
+		if (!await consola.prompt("Update another option?", {
+			type: "confirm",
+			initial: false,
+			cancel: "reject"
+		})) continueUpdating = false;
+	}
+}
+/**
+* Handle deleting multiple options
+* @param ctx - The shared options context
+*/
+async function handleDelete(ctx) {
+	const { baseUrl, category, devAuthHeader, bootstrapAuthHeader, availableKeys, currentOptions } = ctx;
+	const allKeys = bootstrapAuthHeader ? availableKeys.filter((k) => currentOptions[k] !== void 0) : [...availableKeys.filter((k) => !k.startsWith("credentials.") && currentOptions[k] !== void 0), ...availableKeys.filter((k) => k.startsWith("credentials."))];
+	if (allKeys.length === 0) {
+		consola.warn("No options are currently set");
+		return;
+	}
+	const keysToDelete = await consola.prompt("Select option(s) to delete:", {
+		type: "multiselect",
+		options: allKeys,
+		required: true,
+		cancel: "reject"
+	});
+	consola.info(`Deleting ${keysToDelete.length} option(s)...`);
+	for (const key of keysToDelete) {
+		consola.info(`Deleting option: ${key}`);
+		await deleteTenantOption(baseUrl, category, key, devAuthHeader);
+		delete currentOptions[key];
+		consola.success(`✓ Deleted: ${key}`);
+	}
+	consola.success("Delete operation completed");
+}
+//#endregion
+export { options_default as default };

package/dist/{package-D5xRshsx.mjs → package-BHOzdhHp.mjs}

@@ -1,6 +1,6 @@
 //#region package.json
 var name = "c8y-nitro";
-var version = "0.7.1";
+var version = "0.7.2";
 var description = "Lightning fast Cumulocity IoT microservice development powered by Nitro";
 //#endregion
 export { name as n, version as r, description as t };

package/dist/{roles-B58Fguop.mjs → roles-B-DNuScZ.mjs}

@@ -1,4 +1,4 @@
-import { n as createBasicAuthHeader, p as createC8yManifest, t as assignUserRole, u as unassignUserRole } from "./c8y-api-BFjK6AYb.mjs";
+import { n as createBasicAuthHeader, p as createC8yManifest, t as assignUserRole, u as unassignUserRole } from "./c8y-api-DscUs-Kd.mjs";
 import { n as validateBootstrapEnv, t as loadC8yConfig } from "./config-BVQHqlgV.mjs";
 import { defineCommand } from "citty";
 import { consola } from "consola";

package/dist/runtime/handlers/invalidateTenantOptions.mjs

@@ -1,5 +1,5 @@
 import { t as createError } from "../../logging-BUYT8Z2V.mjs";
-import { t as useDeployedTenantClient } from "../../client-DxmbyZju.mjs";
+import { t as useDeployedTenantClient } from "../../client-D0Tdq7H1.mjs";
 import { c8yTenantOptionKeys } from "c8y-nitro/runtime";
 import { defineCachedFunction } from "nitro/cache";
 import { useRuntimeConfig } from "nitro/runtime-config";

package/dist/runtime/handlers/openapi.mjs

@@ -1,4 +1,4 @@
-import { n as getUserTenantDomain } from "../../client-DxmbyZju.mjs";
+import { r as tryGetUserTenantDomainFast } from "../../client-D0Tdq7H1.mjs";
 import { c8yManifest } from "c8y-nitro/runtime";
 import { useRuntimeConfig } from "nitro/runtime-config";
 import { getRequestURL } from "nitro/h3";
@@ -14,13 +14,13 @@ function joinURLSegments(origin, ...segments) {
 async function resolveServer(event) {
 	const baseURL = useRuntimeConfig().app?.baseURL;
 	const contextPath = c8yManifest.contextPath ?? c8yManifest.name;
-	if (!import.meta.dev) try {
-		const domain = await getUserTenantDomain(event);
+	if (!import.meta.dev) {
+		const domain = await tryGetUserTenantDomainFast(event);
 		if (domain) return {
 			url: joinURLSegments(`https://${domain}`, "service", contextPath, baseURL),
 			description: "Cumulocity microservice endpoint"
 		};
-	} catch {}
+	}
 	const requestUrl = getRequestURL(event, {
 		xForwardedHost: true,
 		xForwardedProto: true
@@ -43,8 +43,9 @@ async function resolveServer(event) {
 var openapi_default = defineMiddleware(async (event, next) => {
 	const runtimeConfig = useRuntimeConfig();
 	const specRoute = runtimeConfig.nitro?.openAPI?.route || "/_openapi.json";
-	const baseURL = (runtimeConfig.app?.baseURL ?? "/").replace(/\/+$/, "");
-	if (event.url.pathname !== `${baseURL}${specRoute}`) return next();
+	const specPath = `${(runtimeConfig.app?.baseURL ?? "/").replace(/\/+$/, "")}${specRoute}`;
+	const rewrittenSpecPath = `/service/${c8yManifest.contextPath ?? c8yManifest.name}${specPath}`;
+	if (event.url.pathname !== specPath && event.url.pathname !== rewrittenSpecPath) return next();
 	const body = await next();
 	if (!isOpenAPIDocument(body)) return body;
 	const excludedPrefixes = runtimeConfig.c8yOpenApiExcludeRoutes ?? [];

package/dist/runtime/handlers/rewriteRequestUrl.mjs

@@ -0,0 +1,38 @@
+import { n as buildPublicRequestUrl, r as tryGetUserTenantDomainFast } from "../../client-D0Tdq7H1.mjs";
+import { c8yManifest } from "c8y-nitro/runtime";
+import { defineMiddleware } from "nitro";
+//#region src/module/runtime/handlers/rewriteRequestUrl.ts
+/**
+* Rewrites the incoming request URL to the public tenant endpoint.
+*
+* When deployed, the platform proxy forwards requests with the internal
+* cluster host (e.g. `service-scope-t123.<cluster>.svc.cluster.local`) and the
+* `/service/<contextPath>` prefix stripped. Any handler that derives absolute
+* URLs from the request (`event.url`, `getRequestURL(event)`) therefore leaks
+* internal cluster URLs into responses. This middleware swaps `event.url` for
+* the public one (`https://<tenant domain>/service/<contextPath>/...`) before
+* route handlers run, so request-derived URLs come out publicly reachable.
+*
+* The tenant domain is resolved from the requesting user's credentials and
+* memoized in-process, so the per-request overhead after the first resolution
+* is a hash and a Map lookup. Unauthenticated requests (probes, preflights)
+* are passed through untouched.
+*
+* Registered after the scanned runtime middlewares (see registerRuntime) so
+* they still observe the original URL, and before the OpenAPI transform,
+* which reuses the tenant domain resolved here from its cache.
+*/
+var rewriteRequestUrl_default = defineMiddleware(async (event, next) => {
+	if (import.meta.dev) return next();
+	const domain = await tryGetUserTenantDomainFast(event);
+	if (domain && event.url.host !== domain) {
+		event.url = buildPublicRequestUrl(domain, c8yManifest.contextPath ?? c8yManifest.name, event.url);
+		try {
+			event.req.headers.set("x-forwarded-host", domain);
+			event.req.headers.set("x-forwarded-proto", "https");
+		} catch {}
+	}
+	return next();
+});
+//#endregion
+export { rewriteRequestUrl_default as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8y-nitro",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "description": "Lightning fast Cumulocity IoT microservice development powered by Nitro",
   "keywords": [

package/dist/options-B7_yb_wr.mjs

@@ -1,147 +0,0 @@
-import { c as getTenantOptionsByCategory, f as upsertTenantOption, i as deleteTenantOption, n as createBasicAuthHeader, p as createC8yManifest, s as getTenantOption } from "./c8y-api-BFjK6AYb.mjs";
-import { n as validateBootstrapEnv, t as loadC8yConfig } from "./config-BVQHqlgV.mjs";
-import { defineCommand } from "citty";
-import { consola } from "consola";
-//#region src/cli/commands/options.ts
-var options_default = defineCommand({
-	meta: {
-		name: "options",
-		description: "Manage tenant options on the development tenant"
-	},
-	args: {},
-	async run() {
-		consola.info("Loading configuration...");
-		const { env, nitroConfig, configDir } = await loadC8yConfig();
-		consola.info("Validating environment variables...");
-		const envVars = validateBootstrapEnv(env);
-		consola.info("Loading manifest...");
-		const manifest = await createC8yManifest(configDir, nitroConfig);
-		const category = manifest.settingsCategory || manifest.contextPath || manifest.name;
-		if (!manifest.settings || manifest.settings.length === 0) throw new Error("No settings defined in manifest. Add settings to your c8y.manifest configuration.");
-		consola.success(`Using category: ${category}`);
-		const authHeader = createBasicAuthHeader(envVars.C8Y_DEVELOPMENT_TENANT, envVars.C8Y_DEVELOPMENT_USER, envVars.C8Y_DEVELOPMENT_PASSWORD);
-		consola.info("Fetching current tenant options...");
-		const currentOptions = await getTenantOptionsByCategory(envVars.C8Y_BASEURL, category, authHeader);
-		const availableKeys = manifest.settings.map((s) => s.key);
-		consola.success(`Found ${Object.keys(currentOptions).length} options set on tenant`);
-		const action = await consola.prompt("What do you want to do?", {
-			type: "select",
-			options: [
-				{
-					label: "Read option value",
-					value: "read"
-				},
-				{
-					label: "Update/Create option",
-					value: "update"
-				},
-				{
-					label: "Delete option(s)",
-					value: "delete"
-				}
-			]
-		});
-		if (action === "read") await handleRead(envVars.C8Y_BASEURL, category, authHeader, availableKeys, currentOptions);
-		else if (action === "update") await handleUpdate(envVars.C8Y_BASEURL, category, authHeader, availableKeys, currentOptions);
-		else if (action === "delete") await handleDelete(envVars.C8Y_BASEURL, category, authHeader, availableKeys, currentOptions);
-	}
-});
-/**
-* Handle reading a single option
-* @param baseUrl - The Cumulocity base URL
-* @param category - The tenant option category
-* @param authHeader - The Basic Auth header
-* @param availableKeys - List of available option keys
-* @param currentOptions - Current option values from tenant
-*/
-async function handleRead(baseUrl, category, authHeader, availableKeys, currentOptions) {
-	const setKeys = availableKeys.filter((k) => !k.startsWith("credentials.") && currentOptions[k] !== void 0);
-	const credentialsKeys = availableKeys.filter((k) => k.startsWith("credentials."));
-	const allKeys = [...setKeys, ...credentialsKeys];
-	if (allKeys.length === 0) {
-		consola.warn("No options are currently set");
-		return;
-	}
-	if (credentialsKeys.length > 0) consola.warn("Encrypted credentials.* options cannot be read in decrypted form with the development user in this CLI.");
-	const key = await consola.prompt("Select option to read:", {
-		type: "select",
-		options: allKeys.map((k) => ({
-			label: k.startsWith("credentials.") ? `${k} (unknown)` : k,
-			value: k
-		})),
-		cancel: "reject"
-	});
-	consola.info(`Reading option: ${key}`);
-	const value = await getTenantOption(baseUrl, category, key, authHeader);
-	if (value === void 0) consola.warn(`Option '${key}' is not set`);
-	else consola.success(`Value: ${value}`);
-}
-/**
-* Handle updating options (with loop for multiple updates)
-* @param baseUrl - The Cumulocity base URL
-* @param category - The tenant option category
-* @param authHeader - The Basic Auth header
-* @param availableKeys - List of available option keys
-* @param currentOptions - Current option values from tenant
-*/
-async function handleUpdate(baseUrl, category, authHeader, availableKeys, currentOptions) {
-	let continueUpdating = true;
-	while (continueUpdating) {
-		const key = await consola.prompt("Select option to update:", {
-			type: "select",
-			options: availableKeys.map((k) => ({
-				label: currentOptions[k] !== void 0 ? `${k} (current: ${currentOptions[k]})` : k.startsWith("credentials.") ? `${k} (current: unknown)` : `${k} (not set)`,
-				value: k
-			})),
-			cancel: "reject"
-		});
-		const currentValue = currentOptions[key];
-		const newValue = await consola.prompt("Enter new value:", {
-			type: "text",
-			default: currentValue,
-			cancel: "reject"
-		});
-		consola.info(`Updating option: ${key}`);
-		await upsertTenantOption(baseUrl, category, key, newValue, authHeader);
-		currentOptions[key] = newValue;
-		consola.success(`Option '${key}' updated successfully`);
-		if (!await consola.prompt("Update another option?", {
-			type: "confirm",
-			initial: false,
-			cancel: "reject"
-		})) continueUpdating = false;
-	}
-}
-/**
-* Handle deleting multiple options
-* @param baseUrl - The Cumulocity base URL
-* @param category - The tenant option category
-* @param authHeader - The Basic Auth header
-* @param availableKeys - List of available option keys
-* @param currentOptions - Current option values from tenant
-*/
-async function handleDelete(baseUrl, category, authHeader, availableKeys, currentOptions) {
-	const setKeys = availableKeys.filter((k) => !k.startsWith("credentials.") && currentOptions[k] !== void 0);
-	const credentialsKeys = availableKeys.filter((k) => k.startsWith("credentials."));
-	const allKeys = [...setKeys, ...credentialsKeys];
-	if (allKeys.length === 0) {
-		consola.warn("No options are currently set");
-		return;
-	}
-	const keysToDelete = await consola.prompt("Select option(s) to delete:", {
-		type: "multiselect",
-		options: allKeys,
-		required: true,
-		cancel: "reject"
-	});
-	consola.info(`Deleting ${keysToDelete.length} option(s)...`);
-	for (const key of keysToDelete) {
-		consola.info(`Deleting option: ${key}`);
-		await deleteTenantOption(baseUrl, category, key, authHeader);
-		delete currentOptions[key];
-		consola.success(`✓ Deleted: ${key}`);
-	}
-	consola.success("Delete operation completed");
-}
-//#endregion
-export { options_default as default };