@brunsforge/aarm 0.1.0

package/dist/commands/apps.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerAppsCommand(program: Command): void;

package/dist/commands/apps.js

@@ -0,0 +1,32 @@
+import { createResultEnvelope, envelopeToJson, } from '@brunsforge/azure-app-registration-monitor';
+import { buildContext, handleError } from '../shared/context.js';
+import { printAppsTable } from '../output/formatters.js';
+export function registerAppsCommand(program) {
+    const apps = program
+        .command('apps')
+        .description('Query App Registrations')
+        .action(() => apps.help()); // show help when no subcommand given
+    apps
+        .command('list')
+        .description('List all App Registrations and their secret risk summary')
+        .option('--include-owners', 'Resolve application owners (requires Directory.Read.All)')
+        .action(async (cmdOpts) => {
+        try {
+            const ctx = await buildContext(program.opts());
+            const inventory = await ctx.inventoryService.getInventory({
+                includeOwners: cmdOpts.includeOwners,
+            });
+            if (ctx.isJson) {
+                const envelope = createResultEnvelope(inventory, ctx.tenantId, ctx.environmentName);
+                process.stdout.write(envelopeToJson(envelope) + '\n');
+            }
+            else {
+                printAppsTable(inventory);
+            }
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+}
+//# sourceMappingURL=apps.js.map

package/dist/commands/apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.js","sourceRoot":"","sources":["../../src/commands/apps.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,cAAc,GACf,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAa,MAAM,yBAAyB,CAAC;AAEpE,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yBAAyB,CAAC;SACtC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,qCAAqC;IAEnE,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,kBAAkB,EAAE,0DAA0D,CAAC;SACtF,MAAM,CAAC,KAAK,EAAE,OAAoC,EAAE,EAAE;QACrD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC;gBACxD,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,oBAAoB,CACnC,SAAS,EACT,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,eAAe,CACpB,CAAC;gBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/preflight.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerPreflightCommand(program: Command): void;

package/dist/commands/preflight.js

@@ -0,0 +1,160 @@
+import chalk from 'chalk';
+import Table from 'cli-table3';
+import { createResultEnvelope, envelopeToJson, isDelegatedMode, PERMISSION_DETAILS, } from '@brunsforge/azure-app-registration-monitor';
+import { buildContext, handleError } from '../shared/context.js';
+import { ConfigStore } from '../config/ConfigStore.js';
+import { HistoryStore } from '../config/HistoryStore.js';
+function tick(value) {
+    return value ? chalk.green('[✓]') : chalk.red('[ ]');
+}
+function printPreflightTable(result) {
+    process.stdout.write(`\nPreflight — ${chalk.bold(result.tenantId)}\n`);
+    process.stdout.write(`Checked at  : ${result.checkedAt}\n\n`);
+    const statusTable = new Table({ style: { compact: true } });
+    statusTable.push(['Authentication', result.authValid ? chalk.green('OK') : chalk.red('FAILED')], ['Graph reachable', result.graphReachable ? chalk.green('OK') : chalk.red('FAILED')]);
+    process.stdout.write(statusTable.toString() + '\n\n');
+    process.stdout.write(chalk.bold('Capabilities\n'));
+    const capTable = new Table({
+        head: ['Capability', 'Status'],
+        style: { head: ['cyan'] },
+    });
+    for (const [key, value] of Object.entries(result.capabilities)) {
+        capTable.push([
+            key,
+            `${tick(value)} ${value ? 'Available' : chalk.dim('Unavailable')}`,
+        ]);
+    }
+    process.stdout.write(capTable.toString() + '\n');
+    if (result.missingPermissions.length > 0) {
+        process.stdout.write(chalk.bold('\nMissing permissions\n'));
+        for (const p of result.missingPermissions) {
+            process.stdout.write(`  ${chalk.red('✗')} ${p}\n`);
+        }
+    }
+    if (result.warnings.length > 0) {
+        process.stdout.write(chalk.bold('\nWarnings\n'));
+        for (const w of result.warnings) {
+            process.stdout.write(`  ${chalk.yellow('!')} ${w}\n`);
+        }
+    }
+    if (result.errors.length > 0) {
+        process.stdout.write(chalk.bold('\nErrors\n'));
+        for (const e of result.errors) {
+            process.stdout.write(`  ${chalk.red('✗')} ${e}\n`);
+        }
+    }
+}
+export function registerPreflightCommand(program) {
+    const preflight = program
+        .command('preflight')
+        .description('Run and display tenant capability preflight checks')
+        .action(() => preflight.help());
+    preflight
+        .command('run')
+        .description('Run a full preflight capability check against the tenant')
+        .action(async () => {
+        try {
+            const ctx = await buildContext(program.opts());
+            // Progress goes to stderr so stdout stays clean JSON when --output json
+            if (!ctx.isJson) {
+                process.stderr.write(chalk.dim(`Running preflight for ${ctx.tenantId}...\n`));
+            }
+            const result = await ctx.preflightService.run({
+                tenantId: ctx.tenantId,
+                environmentName: ctx.environmentName,
+                authMode: ctx.authMode,
+                logAnalyticsWorkspaceId: ctx.logAnalyticsWorkspaceId,
+            });
+            // Auto-save preflight result to history
+            const history = new HistoryStore(ctx.configStore.getConfigDir());
+            void history.save('preflight', ctx.tenantId, result);
+            // Update lastPreflightAt on the tenant profile
+            void ctx.configStore.upsertTenant({
+                ...ctx.tenant,
+                lastPreflightAt: new Date().toISOString(),
+                updatedAt: new Date().toISOString(),
+            });
+            if (ctx.isJson) {
+                process.stdout.write(envelopeToJson(createResultEnvelope(result, ctx.tenantId, ctx.environmentName, {
+                    warnings: result.warnings,
+                    errors: result.errors,
+                })) + '\n');
+            }
+            else {
+                printPreflightTable(result);
+            }
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    preflight
+        .command('show')
+        .description('Show the last cached preflight result (no network call)')
+        .action(async () => {
+        const opts = program.opts();
+        if (!opts.tenant) {
+            process.stderr.write('Error: --tenant is required.\n');
+            process.exit(1);
+        }
+        const store = new ConfigStore(opts.configDir);
+        const tenant = await store.getTenant(opts.tenant);
+        if (!tenant) {
+            process.stderr.write(`Error: Tenant "${opts.tenant}" not found.\n`);
+            process.exit(1);
+        }
+        const history = new HistoryStore(store.getConfigDir());
+        const cached = await history.loadLatest('preflight', tenant.tenantId);
+        if (!cached) {
+            process.stderr.write(chalk.dim('No cached preflight result. Run "aarm preflight run --tenant <name>" first.\n'));
+            process.exit(1);
+        }
+        if (opts.output === 'json') {
+            process.stdout.write(envelopeToJson(createResultEnvelope(cached, tenant.tenantId, tenant.defaultEnvironmentName ?? 'default')) + '\n');
+        }
+        else {
+            process.stderr.write(chalk.dim(`Showing cached result from ${cached.checkedAt}\n\n`));
+            printPreflightTable(cached);
+        }
+    });
+    preflight
+        .command('explain')
+        .description('List all permissions required and how to grant them')
+        .action(async () => {
+        const globalOpts = program.opts();
+        // Resolve auth mode from stored tenant profile if --tenant is given
+        let delegated = false;
+        if (globalOpts.tenant) {
+            const { ConfigStore } = await import('../config/ConfigStore.js');
+            const store = new ConfigStore(globalOpts.configDir);
+            const tenant = await store.getTenant(globalOpts.tenant);
+            if (tenant)
+                delegated = isDelegatedMode(tenant.authMode);
+        }
+        const showSection = (sectionDelegated) => {
+            const label = sectionDelegated
+                ? 'Delegated modes  (device-code · username-password · interactive-browser · azure-cli)'
+                : 'Application modes  (client-secret · certificate)';
+            process.stdout.write(chalk.bold(`\n${label}\n`));
+            process.stdout.write(chalk.dim('─'.repeat(72) + '\n\n'));
+            for (const d of PERMISSION_DETAILS) {
+                const hint = sectionDelegated ? d.delegatedHint : d.applicationHint;
+                const phase = d.mvp ? '' : chalk.dim(' [post-MVP]');
+                const consent = d.requiresAdminConsent ? chalk.yellow(' [admin consent]') : '';
+                const role = d.requiresUserRole && sectionDelegated ? chalk.magenta(' [user role]') : '';
+                process.stdout.write(`  ${chalk.cyan(d.capability)}${phase}${consent}${role}\n`);
+                process.stdout.write(`    ${hint}\n\n`);
+            }
+        };
+        if (globalOpts.tenant) {
+            // Show only the relevant mode for the configured tenant
+            showSection(delegated);
+        }
+        else {
+            process.stdout.write(chalk.dim('Tip: pass --tenant <name> to see only the hints relevant to your auth mode.\n'));
+            showSection(false);
+            showSection(true);
+        }
+    });
+}
+//# sourceMappingURL=preflight.js.map

package/dist/commands/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/commands/preflight.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,kBAAkB,GAGnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAsB,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAuB;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,SAAS,MAAM,CAAC,CAAC;IAE9D,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,WAAW,CAAC,IAAI,CACd,CAAC,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAC9E,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CACrF,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;IAEtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC;QACzB,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;KAC1B,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAG1D,EAAE,CAAC;QACJ,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG;YACH,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,SAAS,GAAG,OAAO;SACtB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAElC,SAAS;SACN,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAE/C,wEAAwE;YACxE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC;gBAC5C,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB;aACrD,CAAC,CAAC;YAEH,wCAAwC;YACxC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;YACjE,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAErD,+CAA+C;YAC/C,KAAK,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC;gBAChC,GAAG,GAAG,CAAC,MAAM;gBACb,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACzC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CACZ,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,EAAE;oBAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CACH,GAAG,IAAI,CACT,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,SAAS;SACN,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAiB,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAkB,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAC3F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,sBAAsB,IAAI,SAAS,CAAC,CAAC,GAAG,IAAI,CACjH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC;YACtF,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,SAAS;SACN,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAA2C,CAAC;QAE3E,oEAAoE;QACpE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,MAAM;gBAAE,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,QAAiB,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,gBAAyB,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,gBAAgB;gBAC5B,CAAC,CAAC,sFAAsF;gBACxF,CAAC,CAAC,kDAAkD,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YAEzD,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;gBACpE,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,MAAM,IAAI,GAAG,CAAC,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC;gBACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,wDAAwD;YACxD,WAAW,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC,CAAC;YACjH,WAAW,CAAC,KAAK,CAAC,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/report.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerReportCommand(program: Command): void;

package/dist/commands/report.js

@@ -0,0 +1,166 @@
+import chalk from 'chalk';
+import { createResultEnvelope, envelopeToJson, riskLevelOrder, } from '@brunsforge/azure-app-registration-monitor';
+import { buildContext, handleError } from '../shared/context.js';
+import { printSecretsTable, secretsToMarkdown, secretsToCsv, } from '../output/formatters.js';
+const RISK_LEVELS = ['Info', 'Low', 'Medium', 'High', 'Critical'];
+function parseRiskLevel(raw) {
+    const level = RISK_LEVELS.find((r) => r.toLowerCase() === raw.toLowerCase());
+    if (!level) {
+        process.stderr.write(`Invalid severity "${raw}". Valid values: ${RISK_LEVELS.map((r) => r.toLowerCase()).join(', ')}\n`);
+        process.exit(1);
+    }
+    return level;
+}
+function allSecrets(inventory) {
+    return inventory.flatMap((app) => app.secrets);
+}
+function outputSecrets(secrets, output, tenantId, envName) {
+    if (secrets.length === 0) {
+        process.stdout.write(chalk.dim('No matching secrets found.\n'));
+        return;
+    }
+    switch (output) {
+        case 'json':
+            process.stdout.write(envelopeToJson(createResultEnvelope(secrets, tenantId, envName)) + '\n');
+            break;
+        case 'markdown':
+            process.stdout.write(secretsToMarkdown(secrets, tenantId, envName));
+            break;
+        case 'csv':
+            process.stdout.write(secretsToCsv(secrets));
+            break;
+        default:
+            printSecretsTable(secrets);
+    }
+}
+export function registerReportCommand(program) {
+    const report = program
+        .command('report')
+        .description('Generate formatted reports from the secret inventory')
+        .action(() => report.help());
+    report
+        .command('expiring')
+        .description('Report secrets expiring within a given window')
+        .option('--days <n>', 'Look-ahead window in days')
+        .option('--months <n>', 'Look-ahead window in months (converted to days × 30)')
+        .action(async (cmdOpts) => {
+        try {
+            const ctx = await buildContext(program.opts());
+            const days = cmdOpts.months
+                ? parseInt(cmdOpts.months, 10) * 30
+                : parseInt(cmdOpts.days ?? '30', 10);
+            const inventory = await ctx.inventoryService.getInventory({
+                thresholds: { expiringWithinDays: days },
+            });
+            const expiring = allSecrets(inventory).filter((s) => s.status === 'ExpiringSoon' || s.status === 'Expired');
+            outputSecrets(expiring, program.opts().output, ctx.tenantId, ctx.environmentName);
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    report
+        .command('tenant-summary')
+        .description('Summary of App Registrations and secrets for the tenant')
+        .action(async () => {
+        try {
+            const ctx = await buildContext(program.opts());
+            const inventory = await ctx.inventoryService.getInventory();
+            const allSec = allSecrets(inventory);
+            const summary = {
+                tenantId: ctx.tenantId,
+                environmentName: ctx.environmentName,
+                generatedAt: new Date().toISOString(),
+                appCount: inventory.length,
+                secretCount: allSec.length,
+                expiredCount: allSec.filter((s) => s.status === 'Expired').length,
+                expiringIn30Days: allSec.filter((s) => s.daysUntilExpiry !== null && s.daysUntilExpiry >= 0 && s.daysUntilExpiry <= 30).length,
+                expiringIn90Days: allSec.filter((s) => s.daysUntilExpiry !== null && s.daysUntilExpiry >= 0 && s.daysUntilExpiry <= 90).length,
+                byRisk: Object.fromEntries(RISK_LEVELS.map((r) => [r, allSec.filter((s) => s.riskLevel === r).length])),
+            };
+            if (ctx.isJson) {
+                process.stdout.write(envelopeToJson(createResultEnvelope(summary, ctx.tenantId, ctx.environmentName)) + '\n');
+            }
+            else {
+                process.stdout.write(`\nTenant Summary — ${chalk.bold(ctx.tenantId)}\n`);
+                process.stdout.write(`Generated at : ${summary.generatedAt}\n\n`);
+                process.stdout.write(`App Registrations : ${summary.appCount}\n`);
+                process.stdout.write(`Total secrets     : ${summary.secretCount}\n`);
+                process.stdout.write(`Expired           : ${summary.expiredCount > 0 ? chalk.red(String(summary.expiredCount)) : '0'}\n`);
+                process.stdout.write(`Expiring ≤30 days : ${summary.expiringIn30Days > 0 ? chalk.red(String(summary.expiringIn30Days)) : '0'}\n`);
+                process.stdout.write(`Expiring ≤90 days : ${summary.expiringIn90Days > 0 ? chalk.yellow(String(summary.expiringIn90Days)) : '0'}\n\n`);
+                process.stdout.write('By risk level:\n');
+                for (const r of [...RISK_LEVELS].reverse()) {
+                    const count = summary.byRisk[r];
+                    if (count > 0)
+                        process.stdout.write(`  ${r.padEnd(8)} ${count}\n`);
+                }
+            }
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    report
+        .command('findings')
+        .description('List secrets at or above a given risk level')
+        .option('--severity <level>', 'Minimum risk level: info, low, medium, high, critical', 'medium')
+        .action(async (cmdOpts) => {
+        try {
+            const ctx = await buildContext(program.opts());
+            const threshold = parseRiskLevel(cmdOpts.severity);
+            const thresholdOrder = riskLevelOrder(threshold);
+            const inventory = await ctx.inventoryService.getInventory();
+            const findings = allSecrets(inventory).filter((s) => riskLevelOrder(s.riskLevel) >= thresholdOrder);
+            outputSecrets(findings, program.opts().output, ctx.tenantId, ctx.environmentName);
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    report
+        .command('rotation-guide')
+        .description('Print a guided rotation checklist for a specific secret')
+        .requiredOption('--app-id <client-id>', 'App Registration client ID')
+        .requiredOption('--key-id <secret-key-id>', 'Key ID of the secret to rotate')
+        .action(async (cmdOpts) => {
+        try {
+            const ctx = await buildContext(program.opts());
+            const now = new Date().toISOString().slice(0, 10);
+            const guide = [
+                `# Secret Rotation Guide`,
+                ``,
+                `**Tenant:** ${ctx.tenantId}`,
+                `**App ID:** ${cmdOpts.appId}`,
+                `**Old Key ID:** ${cmdOpts.keyId}`,
+                `**Generated:** ${now}`,
+                ``,
+                `## Checklist`,
+                ``,
+                `- [ ] 1. Create a new client secret in the Entra portal for this App Registration.`,
+                `- [ ] 2. Store the new secret value securely (OS Credential Manager, Key Vault, or secret manager).`,
+                `- [ ] 3. Identify all consumers of this secret (use \`aarm usage analyze --app-id ${cmdOpts.appId}\`).`,
+                `- [ ] 4. Update each consumer with the new secret value.`,
+                `- [ ] 5. Trigger smoke tests or verify each consumer is working.`,
+                `- [ ] 6. Monitor the old key ID for residual usage:`,
+                `         \`aarm usage rotation-check --app-id ${cmdOpts.appId} --old-key-id ${cmdOpts.keyId} --days 14\``,
+                `- [ ] 7. After 7–14 days with zero usage, delete the old secret in Entra.`,
+                ``,
+                `## Notes`,
+                ``,
+                `- Do NOT delete the old secret before step 7 — doing so may break consumers that have not yet been updated.`,
+                `- Use \`aarm usage rotation-check\` repeatedly to confirm zero residual usage.`,
+            ].join('\n');
+            if (ctx.isJson) {
+                process.stdout.write(envelopeToJson(createResultEnvelope({ appId: cmdOpts.appId, keyId: cmdOpts.keyId, guide }, ctx.tenantId, ctx.environmentName)) + '\n');
+            }
+            else {
+                process.stdout.write(guide + '\n');
+            }
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+}
+//# sourceMappingURL=report.js.map

package/dist/commands/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/commands/report.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,cAAc,GAIf,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,GAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAE/E,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qBAAqB,GAAG,oBAAoB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACnG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,SAAmC;IACrD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CACpB,OAAwB,EACxB,MAAc,EACd,QAAgB,EAChB,OAAe;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CACxE,CAAC;YACF,MAAM;QACR,KAAK,UAAU;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACpE,MAAM;QACR,KAAK,KAAK;YACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR;YACE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAE/B,MAAM;SACH,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,+CAA+C,CAAC;SAC5D,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;SACjD,MAAM,CAAC,cAAc,EAAE,sDAAsD,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,OAA2C,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;gBACzB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE;gBACnC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YAEvC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC;gBACxD,UAAU,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;aACzC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAC7D,CAAC;YAEF,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YAErC,MAAM,OAAO,GAAG;gBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrC,QAAQ,EAAE,SAAS,CAAC,MAAM;gBAC1B,WAAW,EAAE,MAAM,CAAC,MAAM;gBAC1B,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;gBACjE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,IAAI,EAAE,CACvF,CAAC,MAAM;gBACR,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,IAAI,EAAE,CACvF,CAAC,MAAM;gBACR,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC5E;aACF,CAAC;YAEF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,IAAI,CACxF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,WAAW,MAAM,CAAC,CAAC;gBAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;gBACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC1H,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAClI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;gBACvI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACzC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAI,OAAO,CAAC,MAAiC,CAAC,CAAC,CAAC,CAAC;oBAC5D,IAAI,KAAK,GAAG,CAAC;wBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,oBAAoB,EAAE,uDAAuD,EAAE,QAAQ,CAAC;SAC/F,MAAM,CAAC,KAAK,EAAE,OAA6B,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,cAAc,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;YAEjD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,cAAc,CACrD,CAAC;YAEF,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,yDAAyD,CAAC;SACtE,cAAc,CAAC,sBAAsB,EAAE,4BAA4B,CAAC;SACpE,cAAc,CAAC,0BAA0B,EAAE,gCAAgC,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAE/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG;gBACZ,yBAAyB;gBACzB,EAAE;gBACF,eAAe,GAAG,CAAC,QAAQ,EAAE;gBAC7B,eAAe,OAAO,CAAC,KAAK,EAAE;gBAC9B,mBAAmB,OAAO,CAAC,KAAK,EAAE;gBAClC,kBAAkB,GAAG,EAAE;gBACvB,EAAE;gBACF,cAAc;gBACd,EAAE;gBACF,oFAAoF;gBACpF,qGAAqG;gBACrG,qFAAqF,OAAO,CAAC,KAAK,MAAM;gBACxG,0DAA0D;gBAC1D,kEAAkE;gBAClE,qDAAqD;gBACrD,iDAAiD,OAAO,CAAC,KAAK,iBAAiB,OAAO,CAAC,KAAK,cAAc;gBAC1G,2EAA2E;gBAC3E,EAAE;gBACF,UAAU;gBACV,EAAE;gBACF,6GAA6G;gBAC7G,gFAAgF;aACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CACZ,oBAAoB,CAClB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EACrD,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,eAAe,CACpB,CACF,GAAG,IAAI,CACT,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/secrets.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerSecretsCommand(program: Command): void;

package/dist/commands/secrets.js

@@ -0,0 +1,88 @@
+import { createResultEnvelope, envelopeToJson, } from '@brunsforge/azure-app-registration-monitor';
+import { buildContext, handleError } from '../shared/context.js';
+import { printSecretsTable } from '../output/formatters.js';
+import { HistoryStore } from '../config/HistoryStore.js';
+function allSecrets(inventory) {
+    return inventory.flatMap((app) => app.secrets);
+}
+export function registerSecretsCommand(program) {
+    const secrets = program
+        .command('secrets')
+        .description('Query client secrets across App Registrations')
+        .action(() => secrets.help());
+    secrets
+        .command('list')
+        .description('List all secrets')
+        .action(async () => {
+        try {
+            const ctx = await buildContext(program.opts());
+            const inventory = await ctx.inventoryService.getInventory();
+            const flat = allSecrets(inventory);
+            const envelope = createResultEnvelope(flat, ctx.tenantId, ctx.environmentName);
+            // Auto-save history — side effect, failures are swallowed inside HistoryStore
+            const history = new HistoryStore(ctx.configStore.getConfigDir());
+            void history.save('secrets', ctx.tenantId, envelope);
+            // Update lastSuccessfulScanAt on the tenant profile
+            void ctx.configStore.upsertTenant({
+                ...ctx.tenant,
+                lastSuccessfulScanAt: new Date().toISOString(),
+                updatedAt: new Date().toISOString(),
+            });
+            if (ctx.isJson) {
+                process.stdout.write(envelopeToJson(envelope) + '\n');
+            }
+            else {
+                printSecretsTable(flat);
+            }
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    secrets
+        .command('expiring')
+        .description('List secrets expiring within a given window')
+        .option('--days <n>', 'Window in days', '30')
+        .option('--months <n>', 'Window in months (converted to days × 30)')
+        .action(async (cmdOpts) => {
+        try {
+            const ctx = await buildContext(program.opts());
+            const days = cmdOpts.months
+                ? parseInt(cmdOpts.months, 10) * 30
+                : parseInt(cmdOpts.days, 10);
+            const inventory = await ctx.inventoryService.getInventory({
+                thresholds: { expiringWithinDays: days },
+            });
+            const flat = allSecrets(inventory).filter((s) => s.status === 'ExpiringSoon');
+            if (ctx.isJson) {
+                process.stdout.write(envelopeToJson(createResultEnvelope(flat, ctx.tenantId, ctx.environmentName)) + '\n');
+            }
+            else {
+                printSecretsTable(flat);
+            }
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    secrets
+        .command('expired')
+        .description('List all expired secrets')
+        .action(async () => {
+        try {
+            const ctx = await buildContext(program.opts());
+            const inventory = await ctx.inventoryService.getInventory();
+            const flat = allSecrets(inventory).filter((s) => s.status === 'Expired');
+            if (ctx.isJson) {
+                process.stdout.write(envelopeToJson(createResultEnvelope(flat, ctx.tenantId, ctx.environmentName)) + '\n');
+            }
+            else {
+                printSecretsTable(flat);
+            }
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+}
+//# sourceMappingURL=secrets.js.map

package/dist/commands/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,cAAc,GAGf,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,SAAS,UAAU,CAAC,SAAmC;IACrD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,+CAA+C,CAAC;SAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAEhC,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;YAE/E,8EAA8E;YAC9E,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;YACjE,KAAK,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAErD,oDAAoD;YACpD,KAAK,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC;gBAChC,GAAG,GAAG,CAAC,MAAM;gBACb,oBAAoB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC9C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,CAAC;SAC5C,MAAM,CAAC,cAAc,EAAE,2CAA2C,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;gBACzB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE;gBACnC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAE/B,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC;gBACxD,UAAU,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;aACzC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CACnC,CAAC;YAEF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,IAAI,CACrF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAEzE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,IAAI,CACrF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/tenants.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerTenantsCommand(program: Command): void;