@microsoft/apps-cli 0.0.1 → 0.4.0

package/dist/Verbs/MaafAppPermissions.js

@@ -0,0 +1,278 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { MaafAppReaderRoleName, modifyPermissionsAsync, resolvePrincipalByEmailAsync, } from '@microsoft/apps-actions';
+import { AppConfigFileName } from '@microsoft/apps-common/config';
+import { HttpClientError } from '@microsoft/apps-common/services';
+import { getCliLogger, getSettings } from '../CliSettings.js';
+import { isGuid, resolveAppNameAsync, resolveEnvironmentId } from '../CliUtils.js';
+import { CLI_BINARY_NAME } from '../Constants/CliConstants.js';
+import { HelpStrings } from '../Constants/HelpStrings.js';
+import { UsageError } from '../Errors/CliError.js';
+import { printInfo, printJsonSuccess, printSuccess, printWarning } from '../Utils/ConsoleOutput.js';
+import { ShareMaafAppArguments, UnshareMaafAppArguments } from './VerbConstants.js';
+/**
+ * Implements `ms app share` and `ms app unshare` — adds or removes the
+ * `Microsoft App Reader` role for AAD principals (users or groups) at the app
+ * scope.
+ *
+ * Pipeline:
+ * 1. Register option schema for the chosen mode and run the verb (so `--help`
+ *    works outside an init'd project).
+ * 2. Require a loaded `ms.config.json`.
+ * 3. Resolve `environmentId` (`--environment-id` flag wins; otherwise from config) and tenantId.
+ * 4. Read the comma-separated principals positional; resolve email-shaped inputs
+ *    to AAD object ids via Graph, pass GUID-shaped inputs through unchanged.
+ * 5. Call `modifyPermissionsAsync` with `put` or `delete` populated based on
+ *    `mode`, then emit JSON or a human summary.
+ */
+export async function executeMaafAppPermissionsAsync(argumentProvider, mode) {
+    configureOptionSchema(argumentProvider, mode);
+    await argumentProvider.runVerb();
+    const cliSettings = getSettings();
+    if (!cliSettings.appConfig) {
+        throw new UsageError(`No ${AppConfigFileName} found in the current directory. Run "npx ${CLI_BINARY_NAME} app init" first.`);
+    }
+    // `resolveEnvironmentId` enforces flag-wins precedence and pushes the resolved
+    // id into player services so the URL builder targets the override.
+    const environmentId = await resolveEnvironmentId(argumentProvider);
+    const tenantId = await argumentProvider.getTenantIdAsync();
+    if (!tenantId) {
+        throw new UsageError('Unable to determine tenant ID. Ensure you are logged in.');
+    }
+    const appName = await resolveAppNameAsync(argumentProvider);
+    const inputs = parseInputs(argumentProvider.getPositionalArg(0));
+    if (inputs.length === 0) {
+        throw new UsageError('Provide at least one principal as a comma-separated list (AAD object IDs or email addresses).');
+    }
+    // Failures (bad shape, no Graph match, transport error) are collected here so
+    // we can warn the user but still proceed with the entries that resolved.
+    const failures = [];
+    const refs = await resolveAllAsync(inputs, failures);
+    // If nothing resolved, the operation has no inputs to apply — abort with a
+    // single error listing every failure rather than calling the RP with an empty
+    // array.
+    if (refs.length === 0) {
+        throw new UsageError(formatFailures(failures));
+    }
+    // Otherwise warn about the unresolved entries up front (so they're visible
+    // before the success line), then proceed with the resolved subset.
+    if (failures.length > 0) {
+        printWarning(formatFailures(failures));
+    }
+    const entries = refs.map(toPermissionEntry);
+    const result = await modifyPermissionsAsync({
+        tenantId,
+        environmentId,
+        logger: getCliLogger(),
+        actionsParams: {
+            appName,
+            put: mode === 'share' ? entries : [],
+            delete: mode === 'unshare' ? entries : [],
+        },
+    });
+    if (argumentProvider.isJsonMode()) {
+        const _assertNoCollision = true;
+        void _assertNoCollision;
+        printJsonSuccess({
+            ...result,
+            partialFailure: failures.length > 0,
+            warnings: failures,
+        });
+    }
+    else {
+        printSummary(appName, mode, refs.length, result);
+    }
+}
+/**
+ * Splits a comma-separated string into a deduplicated, trimmed list of inputs.
+ * Each entry is either an AAD object id (GUID) or an email address. Empty
+ * segments (trailing commas, whitespace-only entries) are dropped.
+ */
+function parseInputs(raw) {
+    if (!raw)
+        return [];
+    const seen = new Set();
+    for (const segment of raw.split(',')) {
+        const trimmed = segment.trim();
+        if (trimmed)
+            seen.add(trimmed);
+    }
+    return [...seen];
+}
+/**
+ * Resolves a list of principal inputs to AAD object ids. GUIDs pass through
+ * unchanged; anything containing `@` is treated as an email and resolved via
+ * Microsoft Graph.
+ *
+ * Per-entry failures (malformed input, no Graph match, transport error like
+ * 403 on the group lookup) are pushed to the shared `failures` array rather
+ * than throwing, so one bad email doesn't kill an otherwise-valid batch.
+ *
+ * Resolution runs Graph calls in parallel (`Promise.all`), with an in-flight
+ * map coalescing concurrent requests for the same email. The cache deduplicates
+ * within a single invocation (e.g. the same email listed twice round-trips Graph
+ * once).
+ */
+async function resolveAllAsync(inputs, failures) {
+    const cache = new Map();
+    const inFlight = new Map();
+    const settled = await Promise.all(inputs.map(async (input) => {
+        const cacheKey = input.toLowerCase();
+        const hit = cache.get(cacheKey);
+        if (hit)
+            return hit;
+        if (isGuid(input)) {
+            const ref = { id: input, input };
+            cache.set(cacheKey, ref);
+            return ref;
+        }
+        if (!looksLikeEmail(input)) {
+            failures.push({
+                input,
+                reason: 'not an AAD object ID (GUID) or a valid email address',
+            });
+            return null;
+        }
+        try {
+            let resolution = inFlight.get(cacheKey);
+            if (!resolution) {
+                resolution = resolvePrincipalByEmailAsync(input, getCliLogger());
+                inFlight.set(cacheKey, resolution);
+            }
+            const resolved = await resolution;
+            if (!resolved) {
+                failures.push({
+                    input,
+                    reason: 'no user or group found in this tenant (invite as a guest in Entra ID first if external)',
+                });
+                return null;
+            }
+            const ref = {
+                id: resolved.id,
+                input,
+                email: input,
+                displayName: resolved.displayName,
+            };
+            cache.set(cacheKey, ref);
+            return ref;
+        }
+        catch (error) {
+            failures.push({
+                input,
+                reason: extractGraphErrorMessage(error),
+            });
+            return null;
+        }
+    }));
+    return settled.filter((r) => r !== null);
+}
+/**
+ * Renders the failure list as a single multi-line message. The intro line
+ * leads with the count so users skimming a long warning see the impact first.
+ */
+function formatFailures(failures) {
+    const noun = failures.length === 1 ? 'entry' : 'entries';
+    const lines = failures.map((f) => `  - ${f.input}: ${f.reason}`);
+    return [`Could not resolve ${failures.length} ${noun}:`, ...lines].join('\n');
+}
+/**
+ * Extracts the meaningful piece of a Graph HTTP error and formats it as
+ * `Graph <status>: <message>`.
+ *
+ * Prefers the structured fields on {@link HttpClientError} (`status` + JSON-parsed `body`),
+ * which removes the dependency on `err.message`'s exact format and decouples this code from
+ * which `IHttpClient` implementation produced the error. For anything else (plain `Error`,
+ * non-Graph response shape, body parse failure), falls back to the raw message so we never
+ * lose information.
+ */
+function extractGraphErrorMessage(error) {
+    if (error instanceof HttpClientError) {
+        const message = extractGraphMessageFromBody(error.body);
+        if (message !== undefined) {
+            return `Graph ${error.status}: ${message}`;
+        }
+        return error.message;
+    }
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Parses a Graph error body string and returns the inner `error.message`. Returns
+ * `undefined` if the body is missing, not valid JSON, or doesn't carry the
+ * `{ error: { message } }` shape. Pulled out as a top-level function so the
+ * unit tests can exercise it without constructing an `HttpClientError`.
+ */
+function extractGraphMessageFromBody(body) {
+    if (!body)
+        return undefined;
+    try {
+        const parsed = JSON.parse(body);
+        const message = parsed?.error?.message;
+        return typeof message === 'string' ? message : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Cheap pre-flight check that an input looks like an email address. We do not
+ * try to be RFC-5321 compliant — the goal is to surface obvious typos
+ * (`foo@`, `@bar`, `a@b@c`, `a@b`) as a `UsageError` naming the bad input,
+ * rather than letting Graph reject them with an opaque 400.
+ */
+function looksLikeEmail(input) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input);
+}
+/**
+ * Builds a `MaafAppPermission` from a resolved reference. The `name` field is a
+ * display label echoed back unchanged on the response — we prefer the friendly
+ * displayName from Graph, fall back to the original input. Setting `principal.email`
+ * (when the user supplied one) keeps the wire payload self-describing for server
+ * logs even though the response strips it.
+ */
+function toPermissionEntry(ref) {
+    return {
+        name: ref.displayName ?? ref.input,
+        properties: {
+            roleName: MaafAppReaderRoleName,
+            principal: ref.email ? { id: ref.id, email: ref.email } : { id: ref.id },
+        },
+    };
+}
+/**
+ * For share, the granted count comes from the server echo (the spec lets the
+ * server dedupe or treat 409 "already exists" as success and echo the entry).
+ * For unshare, the count comes from the request because the spec says `delete`
+ * is not populated on the response and may be omitted or null.
+ */
+function printSummary(appName, mode, inputCount, result) {
+    if (mode === 'share') {
+        const grantedCount = result.put?.length ?? 0;
+        if (grantedCount === 0) {
+            printInfo('No changes were applied.');
+            return;
+        }
+        printSuccess(`Shared app '${appName}' with ${grantedCount} ${pluralize('principal', grantedCount)}. They can now play the app.`);
+        return;
+    }
+    printSuccess(`Revoked play permissions for ${inputCount} ${pluralize('principal', inputCount)} on '${appName}'.`);
+}
+function pluralize(noun, count) {
+    return count === 1 ? noun : `${noun}s`;
+}
+function configureOptionSchema(argumentProvider, mode) {
+    const help = mode === 'share' ? HelpStrings.app.share : HelpStrings.app.unshare;
+    const args = mode === 'share' ? ShareMaafAppArguments : UnshareMaafAppArguments;
+    argumentProvider.setDescription(help.description);
+    argumentProvider.addExamples(help.examples);
+    argumentProvider.consumePositionalArg('<principals>');
+    argumentProvider.addOptions([
+        {
+            flags: { key: args.AppName.name, alias: args.AppName.alias },
+            env: args.AppName.envVar,
+            description: help.options.app,
+            optionalInNonInteractive: true,
+        },
+    ]);
+}
+//# sourceMappingURL=MaafAppPermissions.js.map

package/dist/Verbs/MaafAppPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MaafAppPermissions.js","sourceRoot":"","sources":["../../src/Verbs/MaafAppPermissions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AA0BjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,gBAAkC,EAClC,IAA4B;IAE5B,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC;IAEjC,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAClC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAClB,MAAM,iBAAiB,6CAA6C,eAAe,mBAAmB,CACvG,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,mEAAmE;IACnE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAClB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAErD,2EAA2E;IAC3E,8EAA8E;IAC9E,SAAS;IACT,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;QAC1C,QAAQ;QACR,aAAa;QACb,MAAM,EAAE,YAAY,EAAE;QACtB,aAAa,EAAE;YACb,OAAO;YACP,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YACpC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;SAC1C;KACF,CAAC,CAAC;IAEH,IAAI,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC;QAmClC,MAAM,kBAAkB,GAA6D,IAAI,CAAC;QAC1F,KAAK,kBAAkB,CAAC;QAExB,gBAAgB,CAAC;YACf,GAAG,MAAM;YACT,cAAc,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;YACnC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAgB,EAChB,QAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAA+B,EAAE;QACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QAEpB,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,GAAG,GAAgB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC9C,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACzB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK;gBACL,MAAM,EAAE,sDAAsD;aAC/D,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,IAAI,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,UAAU,GAAG,4BAA4B,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACjE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK;oBACL,MAAM,EACJ,yFAAyF;iBAC5F,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,GAAG,GAAgB;gBACvB,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK;gBACL,KAAK,EAAE,KAAK;gBACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACzB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK;gBACL,MAAM,EAAE,wBAAwB,CAAC,KAAK,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,QAA6B;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,qBAAqB,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,IAAwB;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4C,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QACvC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,GAAgB;IACzC,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,KAAK;QAClC,UAAU,EAAE;YACV,QAAQ,EAAE,qBAAqB;YAC/B,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;SACzE;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,OAAe,EACf,IAA4B,EAC5B,UAAkB,EAClB,MAAwC;IAExC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC;QAC7C,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,YAAY,CACV,eAAe,OAAO,UAAU,YAAY,IAAI,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC,8BAA8B,CACnH,CAAC;QACF,OAAO;IACT,CAAC;IACD,YAAY,CACV,gCAAgC,UAAU,IAAI,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,OAAO,IAAI,CACpG,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,qBAAqB,CAC5B,gBAAkC,EAClC,IAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAChF,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,gBAAgB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACtD,gBAAgB,CAAC,UAAU,CAAC;QAC1B;YACE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YAC5D,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YACxB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YAC7B,wBAAwB,EAAE,IAAI;SAC/B;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/Verbs/Pack.d.ts

@@ -0,0 +1,38 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import type { AppConfig } from '@microsoft/apps-common/config';
+import type { ArgumentProvider } from '../ArgumentProvider.js';
+export interface PackResult {
+    /** Root of the packed output: `<projectRoot>/.{CLI_BINARY_NAME}/packed/`. */
+    packedFolder: string;
+    /** Per-app client folder inside `packedFolder` containing the copied build output. */
+    packClientOutputDir: string;
+}
+export interface PackOptions {
+    /**
+     * When true, suppresses all human-oriented stdout produced during pack: the build
+     * command banner, the spinner, and the build script's stdout/stderr (which is
+     * captured and surfaced only on failure). This keeps the parent stdout clean for
+     * JSON-mode callers like `ms app push --json`.
+     */
+    quiet?: boolean;
+}
+/**
+ * Validates the pack-related fields of `ms.config.json` (`buildPath`,
+ * `buildCommand`) without performing any I/O. Call this before any user-facing
+ * confirmation prompt so config errors surface up-front instead of after the
+ * user confirms.
+ *
+ * Typed as a TypeScript assertion predicate so callers can use `appConfig.buildPath` and
+ * `appConfig.buildCommand` as `string` (not `string | undefined`) without casts.
+ */
+export declare function assertPackPreconditions(appConfig: AppConfig): asserts appConfig is AppConfig & Required<Pick<AppConfig, 'buildPath' | 'buildCommand'>>;
+/**
+ * Runs the configured build command and copies its output into the canonical packed
+ * layout `<projectRoot>/.{CLI_BINARY_NAME}/packed/apps/<appId>/client/`. Returns the
+ * paths so callers (the `app pack` verb, `app push`) can consume the artifact.
+ */
+export declare function packAppArtifactAsync(options?: PackOptions): Promise<PackResult>;
+export declare function packAsync(argumentProvider: ArgumentProvider): Promise<void>;
+//# sourceMappingURL=Pack.d.ts.map

package/dist/Verbs/Pack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pack.d.ts","sourceRoot":"","sources":["../../src/Verbs/Pack.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAI/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAS5D,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,SAAS,IAAI,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,cAAc,CAAC,CAAC,CAO1F;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkDzF;AAyCD,wBAAsB,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjF"}

package/dist/Verbs/Pack.js

@@ -0,0 +1,106 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import * as fsp from 'node:fs/promises';
+import * as path from 'node:path';
+import { GENERATED_FOLDERNAME } from '@microsoft/apps-codegen';
+import { AppConfigFileName } from '@microsoft/apps-common/config';
+import JSON5 from 'json5';
+import { getSettings } from '../CliSettings.js';
+import { CLI_BINARY_NAME } from '../Constants/CliConstants.js';
+import { HelpStrings } from '../Constants/HelpStrings.js';
+import { ConfigurationError } from '../Errors/CliError.js';
+import { printInfo, printSuccess } from '../Utils/ConsoleOutput.js';
+import { runCommandAsync } from '../Utils/RunCommand.js';
+import { CliSpinner } from '../Utils/Spinner.js';
+/**
+ * Validates the pack-related fields of `ms.config.json` (`buildPath`,
+ * `buildCommand`) without performing any I/O. Call this before any user-facing
+ * confirmation prompt so config errors surface up-front instead of after the
+ * user confirms.
+ *
+ * Typed as a TypeScript assertion predicate so callers can use `appConfig.buildPath` and
+ * `appConfig.buildCommand` as `string` (not `string | undefined`) without casts.
+ */
+export function assertPackPreconditions(appConfig) {
+    if (!appConfig.buildPath) {
+        throw new ConfigurationError(`buildPath is required in ${AppConfigFileName} to pack an app`);
+    }
+    if (!appConfig.buildCommand) {
+        throw new ConfigurationError(`buildCommand is required in ${AppConfigFileName} to pack an app`);
+    }
+}
+/**
+ * Runs the configured build command and copies its output into the canonical packed
+ * layout `<projectRoot>/.{CLI_BINARY_NAME}/packed/apps/<appId>/client/`. Returns the
+ * paths so callers (the `app pack` verb, `app push`) can consume the artifact.
+ */
+export async function packAppArtifactAsync(options = {}) {
+    const quiet = options.quiet === true;
+    const { appConfig, fileConfig } = getSettings();
+    if (!appConfig) {
+        throw new ConfigurationError(`${AppConfigFileName} is required to pack an app`);
+    }
+    const appId = appConfig.appId;
+    if (!appId) {
+        throw new ConfigurationError(`appId is required in ${AppConfigFileName} to pack an app`);
+    }
+    assertPackPreconditions(appConfig);
+    const { buildPath, buildCommand } = appConfig;
+    const projectRoot = path.dirname(path.resolve(fileConfig.appConfigPath));
+    const packedFolder = path.join(projectRoot, `.${CLI_BINARY_NAME}`, 'packed');
+    const packAppOutputDir = path.join(packedFolder, 'apps', appId);
+    const packClientOutputDir = path.join(packAppOutputDir, 'client');
+    if (!quiet) {
+        printInfo(`Running: ${buildCommand}`);
+    }
+    await runCommandAsync(buildCommand, projectRoot, { quiet });
+    const resolvedBuildPath = path.resolve(projectRoot, buildPath);
+    const spinner = quiet ? null : new CliSpinner();
+    spinner?.start();
+    try {
+        await fsp.rm(packedFolder, { recursive: true, force: true });
+        await fsp.mkdir(packClientOutputDir, { recursive: true });
+        await fsp.cp(resolvedBuildPath, packClientOutputDir, { recursive: true });
+        await fsp.copyFile(path.resolve(fileConfig.appConfigPath), path.join(packAppOutputDir, AppConfigFileName));
+        await extractDataSourcesAsync(projectRoot, packAppOutputDir);
+        await fsp.writeFile(path.join(packAppOutputDir, 'manifest.json'), JSON.stringify({ hasCustomMiddleTier: false }, null, 2));
+    }
+    finally {
+        spinner?.stop();
+    }
+    return { packedFolder, packClientOutputDir };
+}
+const DATA_SOURCES_TS_PATH = path.join(GENERATED_FOLDERNAME, 'dataSources.ts');
+const DATA_SOURCES_EXPORT_REGEX = /export\s+default\s+(\{[\s\S]*\});/;
+async function extractDataSourcesAsync(projectRoot, packAppOutputDir) {
+    const dataSourcesTsPath = path.join(projectRoot, DATA_SOURCES_TS_PATH);
+    try {
+        await fsp.access(dataSourcesTsPath);
+    }
+    catch {
+        printInfo(`${DATA_SOURCES_TS_PATH} not found — dataSources.json will not be included in the pack.`);
+        return;
+    }
+    const fileContent = await fsp.readFile(dataSourcesTsPath, 'utf-8');
+    const match = DATA_SOURCES_EXPORT_REGEX.exec(fileContent);
+    if (!match?.[1]) {
+        throw new ConfigurationError(`Could not extract dataSources from ${DATA_SOURCES_TS_PATH}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON5.parse(match[1]);
+    }
+    catch (err) {
+        throw new ConfigurationError(`${DATA_SOURCES_TS_PATH} has an unexpected format: ${err.message}`);
+    }
+    await fsp.writeFile(path.join(packAppOutputDir, 'dataSources.json'), JSON.stringify(parsed, null, 2));
+}
+export async function packAsync(argumentProvider) {
+    argumentProvider.setDescription(HelpStrings.app.pack.description);
+    argumentProvider.addExamples(HelpStrings.app.pack.examples);
+    await argumentProvider.runVerb();
+    await packAppArtifactAsync();
+    printSuccess('App successfully packed.');
+}
+//# sourceMappingURL=Pack.js.map

package/dist/Verbs/Pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pack.js","sourceRoot":"","sources":["../../src/Verbs/Pack.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAmB9C;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAoB;IAEpB,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,iBAAiB,iBAAiB,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,iBAAiB,iBAAiB,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAuB,EAAE;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACrC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAC;IAEhD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,GAAG,iBAAiB,6BAA6B,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,iBAAiB,iBAAiB,CAAC,CAAC;IAC3F,CAAC;IAED,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IAE9C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,eAAe,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAElE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,SAAS,CAAC,YAAY,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,eAAe,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;IAChD,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1E,MAAM,GAAG,CAAC,QAAQ,CAChB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EACtC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAC/C,CAAC;QAEF,MAAM,uBAAuB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAE7D,MAAM,GAAG,CAAC,SAAS,CACjB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;AAC/E,MAAM,yBAAyB,GAAG,mCAAmC,CAAC;AAEtE,KAAK,UAAU,uBAAuB,CACpC,WAAmB,EACnB,gBAAwB;IAExB,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAEvE,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CACP,GAAG,oBAAoB,iEAAiE,CACzF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAEnE,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,oBAAoB,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAC1B,GAAG,oBAAoB,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,CAAC,SAAS,CACjB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,EAC/C,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,gBAAkC;IAChE,gBAAgB,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE5D,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAC3C,CAAC"}

package/dist/Verbs/PushMaafApp.d.ts

@@ -0,0 +1,6 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import type { ArgumentProvider } from '../ArgumentProvider.js';
+export declare function pushMaafAppAsync(argumentProvider: ArgumentProvider): Promise<void>;
+//# sourceMappingURL=PushMaafApp.d.ts.map

package/dist/Verbs/PushMaafApp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PushMaafApp.d.ts","sourceRoot":"","sources":["../../src/Verbs/PushMaafApp.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA6B5D,wBAAsB,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiHxF"}

package/dist/Verbs/PushMaafApp.js

@@ -0,0 +1,145 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { MAX_BUILD_ARTIFACT_SIZE_BYTES, pushAsync } from '@microsoft/apps-actions';
+import { AppConfigFileName } from '@microsoft/apps-common/config';
+import { BuildArtifactTooLargeError } from '@microsoft/apps-common/errors';
+import { HttpClientError } from '@microsoft/apps-common/services';
+import { getCliLogger, getSettings } from '../CliSettings.js';
+import { promptConfirm } from '../CliUtils.js';
+import { HelpStrings } from '../Constants/HelpStrings.js';
+import { AppError, ConfigurationError, UsageError } from '../Errors/CliError.js';
+import { printInfo, printJsonSuccess, printSuccess } from '../Utils/ConsoleOutput.js';
+import { zipBuildArtifact } from '../Utils/zipBuildArtifact.js';
+import { assertPackPreconditions, packAppArtifactAsync } from './Pack.js';
+import { PushMaafAppArguments } from './VerbConstants.js';
+/**
+ * User-facing message for the "feature not enabled" case (server returns 403 with
+ * `CodeAppOperationNotAllowedInEnvironment`). Indentation preserved verbatim from the spec.
+ */
+const FEATURE_NOT_ENABLED_MESSAGE = `Direct push is not enabled for this app.
+  To enable direct push, contact your administrator to enable the
+  direct push setting for this app.`;
+function formatMb(bytes) {
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function formatBuildTooLargeMessage(bytes, capBytes) {
+    if (bytes !== undefined) {
+        return `Build artifact is ${formatMb(bytes)}, which exceeds the ${formatMb(capBytes)} limit.`;
+    }
+    return `Build artifact exceeds the ${formatMb(capBytes)} limit.`;
+}
+export async function pushMaafAppAsync(argumentProvider) {
+    createOptionSchema(argumentProvider);
+    await argumentProvider.runVerb();
+    const { appConfig, fileConfig } = getSettings();
+    if (!appConfig) {
+        throw new ConfigurationError(`${AppConfigFileName} is required. Run this command from a directory created by \`ms app create\`.`);
+    }
+    if (!fileConfig?.appConfigPath) {
+        throw new ConfigurationError(`${AppConfigFileName} path is unavailable.`);
+    }
+    const tenantId = await argumentProvider.getTenantIdAsync();
+    if (!tenantId) {
+        throw new UsageError('Unable to determine tenant ID. Ensure you are logged in.');
+    }
+    // Resolve environmentId: --environment-id flag wins; otherwise getEnvironmentId() (which
+    // already encapsulates ms.config.json + the debug-only MAAF_DEBUG_ENVIRONMENT_ID env
+    // var). Note: getOption keys are camelCase since Commander auto-converts the kebab-case
+    // flag name. There is intentionally no env-var fallback wired on the flag — env-var
+    // override of environment ID goes through MAAF_DEBUG_ENVIRONMENT_ID only, so the override
+    // is logged and obvious.
+    const envFromFlag = await argumentProvider.getOption('environmentId', 
+    /* ignorePrompt */ true);
+    const environmentId = envFromFlag || argumentProvider.getEnvironmentId();
+    if (!environmentId) {
+        throw new UsageError(`No environment ID. Pass --environment-id or set environmentId in ${AppConfigFileName}.`);
+    }
+    const appName = appConfig.appId;
+    if (!appName) {
+        throw new UsageError(`appId is missing in ${AppConfigFileName}. Run \`ms app create\` first.`);
+    }
+    // Validate pack-related config (buildPath, buildCommand) up-front so the user
+    // doesn't get a config error after confirming the deploy prompt.
+    assertPackPreconditions(appConfig);
+    // Confirmation: skip in JSON mode and non-interactive shells (piped/CI). Gating on
+    // getSettings().interactive (rather than process.stdout.isTTY directly) keeps the
+    // decline path testable — tests can stub interactive: true and a declining promptConfirm.
+    const skipConfirm = argumentProvider.isJsonMode() || !getSettings().interactive;
+    if (!skipConfirm) {
+        const ok = await promptConfirm({
+            message: `This will build and deploy the app to environment ${environmentId}. Continue?`,
+            initialValue: false,
+        });
+        if (!ok) {
+            printInfo('Aborted.');
+            return;
+        }
+    }
+    // Always pack first: build the app and stage the output in the canonical packed layout.
+    // This guarantees push uploads exactly the artifact produced by the configured build
+    // command, instead of trusting whatever happens to be on disk at `buildPath`.
+    //
+    // We pass `packClientOutputDir` (the inner `client/` folder) to the zip helper rather
+    // than `packedFolder` so the `apps/<appId>/client/` prefix is stripped — the zip ends
+    // up with build files at its root. Two reasons:
+    //   (a) the `/uploadBuild` endpoint already addresses a specific app via URL params,
+    //       so the wrapper would be redundant in the zip; and
+    //   (b) the MHRG storage proxy mapping to the served artifact expects `index.html`
+    //       at the zip root.
+    const { packClientOutputDir } = await packAppArtifactAsync({
+        quiet: argumentProvider.isJsonMode(),
+    });
+    let result;
+    try {
+        const zipBuffer = await zipBuildArtifact(packClientOutputDir, fileConfig.appConfigPath, {
+            maxBytes: MAX_BUILD_ARTIFACT_SIZE_BYTES,
+        });
+        if (!argumentProvider.isJsonMode()) {
+            printInfo('Uploading build artifact and deploying...');
+        }
+        result = await pushAsync({
+            logger: getCliLogger(),
+            actionsParams: { appName, zipBuffer },
+        });
+    }
+    catch (err) {
+        // Cap exceeded during zipping: zipBuildArtifact throws BuildArtifactTooLargeError.
+        if (err instanceof BuildArtifactTooLargeError) {
+            throw new UsageError(formatBuildTooLargeMessage(err.bytes, err.capBytes));
+        }
+        // Server "feature not enabled": 403 + CodeAppOperationNotAllowedInEnvironment.
+        if (err instanceof HttpClientError &&
+            err.status === 403 &&
+            err.code === 'CodeAppOperationNotAllowedInEnvironment') {
+            throw new AppError(FEATURE_NOT_ENABLED_MESSAGE);
+        }
+        // Server-side 413 (server-enforced cap, request size unknown to server response).
+        if (err instanceof HttpClientError && err.status === 413) {
+            throw new AppError(formatBuildTooLargeMessage(undefined, MAX_BUILD_ARTIFACT_SIZE_BYTES));
+        }
+        throw err;
+    }
+    if (argumentProvider.isJsonMode()) {
+        printJsonSuccess(result);
+    }
+    else {
+        printSuccess(`Pushed app '${result.name}'.`);
+        printInfo(`Commit:      ${result.commitSha}`);
+    }
+}
+function createOptionSchema(argumentProvider) {
+    argumentProvider.setDescription(HelpStrings.app.push.description);
+    argumentProvider.addExamples(HelpStrings.app.push.examples);
+    argumentProvider.addOptions([
+        {
+            flags: {
+                key: PushMaafAppArguments.EnvironmentId.name,
+                alias: PushMaafAppArguments.EnvironmentId.alias,
+            },
+            description: HelpStrings.app.push.options.environmentId,
+            optionalInNonInteractive: true,
+        },
+    ]);
+}
+//# sourceMappingURL=PushMaafApp.js.map

package/dist/Verbs/PushMaafApp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PushMaafApp.js","sourceRoot":"","sources":["../../src/Verbs/PushMaafApp.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,6BAA6B,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD;;;GAGG;AACH,MAAM,2BAA2B,GAAG;;oCAEA,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAyB,EAAE,QAAgB;IAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,qBAAqB,QAAQ,CAAC,KAAK,CAAC,uBAAuB,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;IAChG,CAAC;IACD,OAAO,8BAA8B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,gBAAkC;IACvE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACrC,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC;IAEjC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAC1B,GAAG,iBAAiB,+EAA+E,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,GAAG,iBAAiB,uBAAuB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IAED,yFAAyF;IACzF,qFAAqF;IACrF,wFAAwF;IACxF,oFAAoF;IACpF,0FAA0F;IAC1F,yBAAyB;IACzB,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAClD,eAAe;IACf,kBAAkB,CAAC,IAAI,CACxB,CAAC;IACF,MAAM,aAAa,GAAG,WAAW,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;IACzE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAClB,oEAAoE,iBAAiB,GAAG,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAAC,uBAAuB,iBAAiB,gCAAgC,CAAC,CAAC;IACjG,CAAC;IAED,8EAA8E;IAC9E,iEAAiE;IACjE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAEnC,mFAAmF;IACnF,kFAAkF;IAClF,0FAA0F;IAC1F,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC;YAC7B,OAAO,EAAE,qDAAqD,aAAa,aAAa;YACxF,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,SAAS,CAAC,UAAU,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,qFAAqF;IACrF,8EAA8E;IAC9E,EAAE;IACF,sFAAsF;IACtF,sFAAsF;IACtF,gDAAgD;IAChD,qFAAqF;IACrF,0DAA0D;IAC1D,mFAAmF;IACnF,yBAAyB;IACzB,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,oBAAoB,CAAC;QACzD,KAAK,EAAE,gBAAgB,CAAC,UAAU,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,mBAAmB,EAAE,UAAU,CAAC,aAAa,EAAE;YACtF,QAAQ,EAAE,6BAA6B;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC;YACnC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,MAAM,SAAS,CAAC;YACvB,MAAM,EAAE,YAAY,EAAE;YACtB,aAAa,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mFAAmF;QACnF,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;YAC9C,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,+EAA+E;QAC/E,IACE,GAAG,YAAY,eAAe;YAC9B,GAAG,CAAC,MAAM,KAAK,GAAG;YAClB,GAAG,CAAC,IAAI,KAAK,yCAAyC,EACtD,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,2BAA2B,CAAC,CAAC;QAClD,CAAC;QACD,kFAAkF;QAClF,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,QAAQ,CAAC,0BAA0B,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC;QAClC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,eAAe,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7C,SAAS,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,gBAAkC;IAC5D,gBAAgB,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,gBAAgB,CAAC,UAAU,CAAC;QAC1B;YACE,KAAK,EAAE;gBACL,GAAG,EAAE,oBAAoB,CAAC,aAAa,CAAC,IAAI;gBAC5C,KAAK,EAAE,oBAAoB,CAAC,aAAa,CAAC,KAAK;aAChD;YACD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa;YACvD,wBAAwB,EAAE,IAAI;SAC/B;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/Verbs/RefreshDataSource.d.ts

@@ -0,0 +1,6 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import type { ArgumentProvider } from '../ArgumentProvider.js';
+export declare function refreshDataSourceAsync(argumentProvider: ArgumentProvider): Promise<void>;
+//# sourceMappingURL=RefreshDataSource.d.ts.map

package/dist/Verbs/RefreshDataSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshDataSource.d.ts","sourceRoot":"","sources":["../../src/Verbs/RefreshDataSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAO5D,wBAAsB,sBAAsB,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4C9F"}