@microsoft/managed-apps-cli 0.19.0 → 0.21.0

package/dist/Authentication/NodeMsalAuthenticationProvider.js

@@ -1,391 +0,0 @@
-/*!
- * Copyright (C) Microsoft Corporation. All rights reserved.
- */
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { InteractionRequiredAuthError, PublicClientApplication } from '@azure/msal-node';
-import open from 'open';
-import { getSettings } from '../CliSettings.js';
-import { getAuthority } from '../CliUtils.js';
-import { AUTH_CACHE_ACCOUNT_NAME, AUTH_CACHE_DIRECTORY, AUTH_CACHE_SERVICE_NAME, CLI_CLIENT_ID, } from '../Constants.js';
-import { CLI_BINARY_NAME } from '../Constants/CliConstants.js';
-import { UsageError } from '../Errors/CliError.js';
-import { printError, printWarning } from '../Utils/ConsoleOutput.js';
-import { CliSpinner } from '../Utils/Spinner.js';
-import { ActiveAccountStore } from './ActiveAccountStore.js';
-/**
- * Interactive MSAL provider. Implements both the token surface (`IAuthenticationProvider`)
- * and the account-management surface (`IAccountManager`). Built on `@azure/msal-node`'s
- * `PublicClientApplication` with the `msal-node-extensions` DPAPI-encrypted persistent
- * cache.
- */
-export class NodeMsalAuthenticationProvider {
-    _msalClient;
-    _tenantId;
-    _region;
-    _persistence;
-    _activeStore;
-    _cacheDirectory;
-    // Resolves whether the CLI is emitting a JSON envelope — used only to suppress the
-    // interactive sign-in spinner so it can't corrupt stdout. Defaults to a conservative argv
-    // peek for direct/test construction; `Cli.ts` wires the authoritative
-    // `ArgumentProvider.isJsonMode()` via `setJsonModeResolver()` once that exists.
-    _isJsonMode = () => process.argv.includes('--json');
-    /**
-     * `cacheDirectory` defaults to the production auth cache (`~/.ms-cli/cache/auth/`).
-     * Tests pass a tmpdir so they can verify cache-write/clear behavior without touching
-     * the user's real cache.
-     */
-    constructor(cacheDirectory = AUTH_CACHE_DIRECTORY) {
-        this._cacheDirectory = cacheDirectory;
-        this._activeStore = new ActiveAccountStore(cacheDirectory);
-    }
-    async initAsync(region) {
-        this._region = region;
-        const { DataProtectionScope, PersistenceCachePlugin, PersistenceCreator } = await import('@azure/msal-node-extensions');
-        const persistenceConfiguration = {
-            cachePath: path.join(this._cacheDirectory, 'msal_cache.json'),
-            dataProtectionScope: DataProtectionScope.CurrentUser,
-            serviceName: AUTH_CACHE_SERVICE_NAME,
-            accountName: AUTH_CACHE_ACCOUNT_NAME,
-            usePlaintextFileOnLinux: false,
-        };
-        const persistence = await PersistenceCreator.createPersistence(persistenceConfiguration);
-        this._persistence = persistence;
-        const authConfig = {
-            auth: {
-                authority: getAuthority(this._region, this._tenantId),
-                clientId: CLI_CLIENT_ID,
-            },
-            cache: {
-                cachePlugin: new PersistenceCachePlugin(persistence),
-            },
-        };
-        this._msalClient = new PublicClientApplication(authConfig);
-    }
-    /**
-     * Injects the CLI's authoritative JSON-mode check (`ArgumentProvider.isJsonMode`), used only
-     * to suppress the interactive sign-in spinner so it never corrupts a `--json` stdout
-     * envelope. Wired from `Cli.ts` once the `ArgumentProvider` exists; until then the
-     * conservative argv-peek default is used (e.g. unit tests that construct the provider directly).
-     */
-    setJsonModeResolver(isJsonMode) {
-        this._isJsonMode = isJsonMode;
-    }
-    // ─── IAuthenticationProvider ─────────────────────────────────────────────────
-    async getAccessTokenForResource(resource, loginHint) {
-        const result = await this._acquireTokenInternal(resource + '/.default', loginHint);
-        this._tenantId = result.tenantId;
-        return result.accessToken;
-    }
-    getUserTenantId() {
-        return this._tenantId;
-    }
-    async getCachedAccountAsync() {
-        const accounts = await this._getAccounts();
-        return this._pickActiveAccount(accounts)?.username;
-    }
-    // ─── IAccountManager ─────────────────────────────────────────────────────────
-    async listCachedAccountsAsync() {
-        const accounts = await this._getAccounts();
-        if (accounts.length === 0)
-            return [];
-        const active = this._pickActiveAccount(accounts);
-        return accounts.map((account) => ({
-            homeAccountId: account.homeAccountId,
-            username: account.username,
-            isActive: account.homeAccountId === active?.homeAccountId,
-        }));
-    }
-    async setActiveAccountAsync(accountKey) {
-        const accounts = await this._getAccounts();
-        const match = this._findAccount(accounts, accountKey);
-        if (!match) {
-            throw new UsageError(`No cached account matches '${accountKey}'. Run \`${CLI_BINARY_NAME} auth status\` to list cached accounts.`);
-        }
-        this._activeStore.write({ homeAccountId: match.homeAccountId, username: match.username });
-        return { homeAccountId: match.homeAccountId, username: match.username, isActive: true };
-    }
-    async loginInteractiveAsync(resource, loginHint, useDeviceCode) {
-        const scope = resource + '/.default';
-        // Device code grant is the explicit no-browser path (headless boxes, SSH sessions): MSAL
-        // surfaces a verification URL + user code and polls until the user completes sign-in on
-        // another device. It doesn't support the `select_account` prompt or a login hint, so those
-        // account-picker semantics apply to the browser flow only.
-        if (useDeviceCode) {
-            const deviceResult = await this._signInWithDeviceCodeAndPersist(scope);
-            return {
-                homeAccountId: deviceResult.account.homeAccountId,
-                username: deviceResult.account.username,
-                isActive: true,
-            };
-        }
-        // Two paths, mutually exclusive:
-        //   1. `--account <email>` was passed → use the value as MSAL `loginHint` and DON'T
-        //      force the picker. Entra honors the hint (SSO if a session matches, otherwise
-        //      pre-fills the sign-in form). The user said "use this one," we use it.
-        //   2. No `--account` → force `prompt: 'select_account'` so the user can pick an
-        //      existing account or add a new one. Without this, the browser's SSO session
-        //      would silently reuse the same account on every `ms auth login` — defeating
-        //      the multi-account scenario the verb exists for.
-        // Mixing `loginHint` with `prompt: 'select_account'` is not what we want: Entra
-        // shows the picker and treats the hint only as a fallback for credential entry,
-        // so passing both gives the picker UI even when the user asked for a specific account.
-        const result = await this._signInInteractiveAndPersist(scope, loginHint, {
-            prompt: loginHint ? undefined : 'select_account',
-        });
-        if (!result.account) {
-            throw new Error('Interactive sign-in did not return an account.');
-        }
-        return {
-            homeAccountId: result.account.homeAccountId,
-            username: result.account.username,
-            isActive: true,
-        };
-    }
-    async clearCacheAsync() {
-        const clearedPersistence = await this._clearPersistenceAsync();
-        const clearedActiveAccount = this._activeStore.clear();
-        // Remove cache scaffolding such as sync markers and temporary files; it does not affect
-        // whether meaningful account state was cleared.
-        fs.rmSync(this._cacheDirectory, { recursive: true, force: true });
-        return clearedPersistence || clearedActiveAccount;
-    }
-    // ─── Internals ───────────────────────────────────────────────────────────────
-    async _clearPersistenceAsync() {
-        if (!this._persistence) {
-            throw new Error('Authentication not initialized yet');
-        }
-        // Windows creates an empty cache file during initialization, so delete() alone cannot
-        // distinguish cached credentials from persistence scaffolding.
-        let hadPersistedState;
-        try {
-            hadPersistedState = (await this._persistence.load()) !== null;
-        }
-        catch {
-            // Unreadable persisted state still counts when deletion succeeds.
-            hadPersistedState = true;
-        }
-        await this._persistence.delete();
-        return hadPersistedState;
-    }
-    async _getAccounts() {
-        if (!this._msalClient) {
-            throw new Error('Authentication not initialized yet');
-        }
-        try {
-            return await this._msalClient.getTokenCache().getAllAccounts();
-        }
-        catch (err) {
-            // Most likely cause is a cache file written by an older CLI version that the current
-            // MSAL major can't parse. Treat as "no cached accounts" so the next command triggers
-            // a fresh interactive sign-in, which rewrites the cache in the current format.
-            printWarning(`Could not read the MSAL token cache (${err.message}). ` +
-                `It may have been written by an older CLI version. Run \`${CLI_BINARY_NAME} auth logout\` and sign in again to reset it.`);
-            return [];
-        }
-    }
-    /**
-     * Case-insensitive lookup against `homeAccountId` first, then `username`. The two-field
-     * search lets callers pass either form without a discriminator. Username has a known
-     * collision shape: the same UPN can appear in multiple tenants for guest accounts; when
-     * the caller might hit that, prefer `homeAccountId`.
-     */
-    _findAccount(accounts, key) {
-        const lower = key.toLowerCase();
-        return (accounts.find((a) => a.homeAccountId.toLowerCase() === lower) ??
-            accounts.find((a) => a.username.toLowerCase() === lower));
-    }
-    /**
-     * Pure. Resolves which cached account should be treated as active:
-     *   0 accounts                          → undefined
-     *   1 account                           → that one (regardless of pointer state)
-     *   2+ + valid active pointer           → the matching account
-     *   2+ + missing or stale active pointer → undefined (caller decides how to handle)
-     */
-    _pickActiveAccount(accounts) {
-        if (accounts.length === 0)
-            return undefined;
-        if (accounts.length === 1)
-            return accounts[0];
-        const active = this._activeStore.read();
-        if (!active)
-            return undefined;
-        return accounts.find((a) => a.homeAccountId === active.homeAccountId);
-    }
-    /**
-     * Idempotent: writes the active-account pointer only when the persisted value doesn't
-     * already match. Called from token-acquisition success paths so that a fresh 3.x → 5.x
-     * upgrade (single account in cache, no pointer file yet) migrates implicitly on first
-     * use, without needing an explicit migration step.
-     */
-    _ensureActivePointer(account) {
-        const existing = this._activeStore.read();
-        if (existing?.homeAccountId === account.homeAccountId)
-            return;
-        this._activeStore.write({
-            homeAccountId: account.homeAccountId,
-            username: account.username,
-        });
-    }
-    async _acquireTokenInternal(resource, loginHint) {
-        if (!this._msalClient) {
-            throw new Error('Authentication not initialized yet');
-        }
-        const accounts = await this._getAccounts();
-        if (accounts.length === 0) {
-            this._ensureInteractiveSignInAllowed('no-account');
-            return this._signInInteractiveAndPersist(resource, loginHint);
-        }
-        const active = this._pickActiveAccount(accounts);
-        if (!active) {
-            // 2+ accounts and no valid active pointer — refuse rather than guess.
-            const names = accounts.map((a) => `  - ${a.username}`).join('\n');
-            const hint = getSettings().interactive
-                ? `Run \`${CLI_BINARY_NAME} auth switch\` to choose one, or \`${CLI_BINARY_NAME} auth logout\` to clear all cached accounts and start over.`
-                : `Run \`${CLI_BINARY_NAME} auth switch --account <email>\` to resolve, then retry.`;
-            throw new UsageError(`Multiple accounts are cached and no active account is selected:\n${names}\n${hint}`);
-        }
-        try {
-            const result = await this._msalClient.acquireTokenSilent({
-                account: active,
-                scopes: [resource],
-            });
-            this._ensureActivePointer(result.account ?? active);
-            return result;
-        }
-        catch (error) {
-            if (error instanceof InteractionRequiredAuthError || isWamIwaError(error)) {
-                this._ensureInteractiveSignInAllowed('expired');
-                return this._signInInteractiveAndPersist(resource, loginHint ?? active.username);
-            }
-            throw error;
-        }
-    }
-    /**
-     * Guards the interactive sign-in entry points. Interactive sign-in opens a browser, which
-     * must never happen in non-interactive mode (CI, piped output, `--non-interactive`) — there
-     * the silent paths (zero cached accounts, or an expired/invalid refresh token that MSAL
-     * reports as `InteractionRequiredAuthError`) must fail fast with an actionable error rather
-     * than hijack the terminal with a browser window that no one is watching.
-     */
-    _ensureInteractiveSignInAllowed(reason) {
-        if (getSettings().interactive)
-            return;
-        const cause = reason === 'no-account'
-            ? 'You are not signed in'
-            : 'Your sign-in session has expired and could not be renewed silently';
-        throw new UsageError(`${cause}. Interactive sign-in is required, but the CLI is running in non-interactive mode. ` +
-            `Run \`${CLI_BINARY_NAME} auth login\` to sign in, then retry.`);
-    }
-    /**
-     * Single code path for every interactive sign-in: `auth login`, the 0-accounts fresh-login
-     * branch, and the `InteractionRequiredAuthError` fallback all route through here. Keeps
-     * the "open browser → record tenant → persist active pointer" sequence in one place so
-     * future changes (telemetry, retry logic, etc.) don't have to be replicated three times.
-     * Uses the idempotent `_ensureActivePointer` so an unchanged-active scenario doesn't
-     * rewrite the pointer file unnecessarily.
-     *
-     * `options.prompt` forwards to MSAL's `prompt` parameter. Callers opt in to it only when
-     * they need to override the IdP's default behavior — `auth login` passes `'select_account'`
-     * so users can add a second account; the silent-fallback paths leave it unset so token
-     * expiry doesn't pop a picker the user didn't ask for.
-     */
-    async _signInInteractiveAndPersist(resource, loginHint, options) {
-        if (!this._msalClient) {
-            throw new Error('Authentication not initialized yet');
-        }
-        const request = this._getInteractiveLoginRequest(resource, loginHint);
-        if (options?.prompt) {
-            request.prompt = options.prompt;
-        }
-        // `acquireTokenInteractive` blocks until the browser round-trip completes, which can take
-        // many seconds while the user signs in. Without an indicator the command looks hung, so
-        // show a spinner that names exactly what we're waiting on. Only animate when stdout is a
-        // real terminal (skip piped/redirected/CI) and not in JSON mode, since the spinner writes
-        // to stdout and would corrupt a `--json` envelope. JSON detection is delegated to the
-        // CLI's authoritative `ArgumentProvider.isJsonMode()` (wired via `setJsonModeResolver`) so
-        // it stays consistent with every other JSON-gated surface instead of re-sniffing argv here.
-        const spinner = process.stdout.isTTY && !this._isJsonMode() ? new CliSpinner() : null;
-        spinner?.start('Opening your browser to sign in — complete the sign-in there to continue...');
-        try {
-            const result = await this._msalClient.acquireTokenInteractive(request);
-            this._tenantId = result.tenantId;
-            if (result.account)
-                this._ensureActivePointer(result.account);
-            return result;
-        }
-        finally {
-            // Always clear the spinner line, even if acquisition throws, so it never leaks.
-            spinner?.stop();
-        }
-    }
-    /**
-     * Device code sign-in: acquires a token via the OAuth 2.0 device authorization grant. Unlike the
-     * browser flow this never launches a browser on the local machine — MSAL returns a verification
-     * URL and a short user code that the person enters on any device with a browser. It's the
-     * headless/SSH path where `acquireTokenInteractive` can't open a window.
-     *
-     * The verification message is written to stderr (not stdout) so it stays visible even under
-     * `--json`, where stdout carries the machine-readable envelope. `acquireTokenByDeviceCode`
-     * long-polls until the user completes sign-in (or the code expires) and can resolve to `null`;
-     * we treat that as an error since the caller needs a signed-in account. The device code grant
-     * supports neither `prompt` nor a login hint, so no account-picker options are forwarded.
-     */
-    async _signInWithDeviceCodeAndPersist(resource) {
-        if (!this._msalClient) {
-            throw new Error('Authentication not initialized yet');
-        }
-        const request = {
-            scopes: [resource],
-            deviceCodeCallback: (response) => process.stderr.write(response.message + '\n'),
-        };
-        const result = await this._msalClient.acquireTokenByDeviceCode(request);
-        if (!result?.account) {
-            throw new Error('Device code sign-in did not return an account.');
-        }
-        this._tenantId = result.tenantId;
-        this._ensureActivePointer(result.account);
-        return { ...result, account: result.account };
-    }
-    _getInteractiveLoginRequest(resource, loginHint) {
-        const openBrowser = async (url) => {
-            try {
-                await open(url, { wait: false });
-            }
-            catch (error) {
-                // Auto-open can fail on headless/remote machines or when no default browser is set.
-                // Surface the URL (on stderr) so the user can finish sign-in manually — the interactive
-                // call keeps waiting for the redirect, so a manual open still completes the flow.
-                printError(`Couldn't open a browser automatically (${String(error)}).\n` +
-                    `Open this URL to finish signing in:\n${url}`);
-            }
-        };
-        return {
-            scopes: [resource],
-            openBrowser,
-            successTemplate: 'You can close this window now.',
-            ...(loginHint && { loginHint }),
-        };
-    }
-}
-/**
- * WAM (Windows Account Manager) throws a non-`InteractionRequiredAuthError` when it attempts
- * Integrated Windows Authentication on a managed (cloud-only) tenant that isn't federated with
- * on-prem AD FS. The error surfaces as a generic MSAL error with a numeric WAM error code rather
- * than the expected `InteractionRequiredAuthError` subclass, so `instanceof` doesn't catch it.
- *
- * We detect it by error code and fall through to interactive sign-in, which bypasses IWA entirely.
- */
-function isWamIwaError(error) {
-    if (!(error instanceof Error))
-        return false;
-    const code = error.errorCode;
-    // WAM error code 3400073247 — "Integrated Windows authentication supported only in federation flow"
-    if (code === 3400073247 || code === '3400073247')
-        return true;
-    // Also match by message substring for resilience against code changes across WAM versions
-    const msg = (error.message ?? '').toLowerCase();
-    return msg.includes('integrated windows auth') && msg.includes('federation');
-}
-//# sourceMappingURL=NodeMsalAuthenticationProvider.js.map

package/dist/Authentication/NodeMsalAuthenticationProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"NodeMsalAuthenticationProvider.js","sourceRoot":"","sources":["../../src/Authentication/NodeMsalAuthenticationProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AASlC,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IACjC,WAAW,CAAsC;IACjD,SAAS,CAAqB;IAC9B,OAAO,CAAqB;IAC5B,YAAY,CAA2B;IAC9B,YAAY,CAAqB;IACjC,eAAe,CAAS;IACzC,mFAAmF;IACnF,0FAA0F;IAC1F,sEAAsE;IACtE,gFAAgF;IACxE,WAAW,GAAkB,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE3E;;;;OAIG;IACH,YAAmB,iBAAyB,oBAAoB;QAC9D,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,MAAc;QACnC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,GACvE,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC9C,MAAM,wBAAwB,GAAG;YAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC;YAC7D,mBAAmB,EAAE,mBAAmB,CAAC,WAAW;YACpD,WAAW,EAAE,uBAAuB;YACpC,WAAW,EAAE,uBAAuB;YACpC,uBAAuB,EAAE,KAAK;SAC/B,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QACzF,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAEhC,MAAM,UAAU,GAAkB;YAChC,IAAI,EAAE;gBACJ,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACrD,QAAQ,EAAE,aAAa;aACxB;YACD,KAAK,EAAE;gBACL,WAAW,EAAE,IAAI,sBAAsB,CAAC,WAAW,CAAC;aACrD;SACF,CAAC;QAEF,IAAI,CAAC,WAAW,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACI,mBAAmB,CAAC,UAAyB;QAClD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,yBAAyB,CAAC,QAAgB,EAAE,SAAkB;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,GAAG,WAAW,EAAE,SAAS,CAAC,CAAC;QACnF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,qBAAqB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACrD,CAAC;IAED,gFAAgF;IAEzE,KAAK,CAAC,uBAAuB;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,aAAa;SAC1D,CAAC,CAAC,CAAC;IACN,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAAC,UAAkB;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAClB,8BAA8B,UAAU,YAAY,eAAe,yCAAyC,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1F,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAChC,QAAgB,EAChB,SAAkB,EAClB,aAAuB;QAEvB,MAAM,KAAK,GAAG,QAAQ,GAAG,WAAW,CAAC;QACrC,yFAAyF;QACzF,wFAAwF;QACxF,2FAA2F;QAC3F,2DAA2D;QAC3D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO;gBACL,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,aAAa;gBACjD,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ;gBACvC,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QACD,iCAAiC;QACjC,oFAAoF;QACpF,oFAAoF;QACpF,6EAA6E;QAC7E,iFAAiF;QACjF,kFAAkF;QAClF,kFAAkF;QAClF,uDAAuD;QACvD,gFAAgF;QAChF,gFAAgF;QAChF,uFAAuF;QACvF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,SAAS,EAAE;YACvE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;YACL,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;YAC3C,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;YACjC,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,eAAe;QAC1B,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/D,MAAM,oBAAoB,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAEvD,wFAAwF;QACxF,gDAAgD;QAChD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAElE,OAAO,kBAAkB,IAAI,oBAAoB,CAAC;IACpD,CAAC;IAED,gFAAgF;IAExE,KAAK,CAAC,sBAAsB;QAClC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,sFAAsF;QACtF,+DAA+D;QAC/D,IAAI,iBAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,cAAc,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qFAAqF;YACrF,qFAAqF;YACrF,+EAA+E;YAC/E,YAAY,CACV,wCAAyC,GAAa,CAAC,OAAO,KAAK;gBACjE,2DAA2D,eAAe,+CAA+C,CAC5H,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAAC,QAAuB,EAAE,GAAW;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,CACL,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CACzD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,QAAuB;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,OAAoB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,QAAQ,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa;YAAE,OAAO;QAC9D,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YACtB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,QAAgB,EAChB,SAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,+BAA+B,CAAC,YAAY,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC,4BAA4B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,sEAAsE;YACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC,WAAW;gBACpC,CAAC,CAAC,SAAS,eAAe,sCAAsC,eAAe,6DAA6D;gBAC5I,CAAC,CAAC,SAAS,eAAe,0DAA0D,CAAC;YACvF,MAAM,IAAI,UAAU,CAClB,oEAAoE,KAAK,KAAK,IAAI,EAAE,CACrF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC;gBACvD,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,CAAC,QAAQ,CAAC;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;YACpD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,+BAA+B,CAAC,SAAS,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,4BAA4B,CAAC,QAAQ,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,+BAA+B,CAAC,MAAgC;QACtE,IAAI,WAAW,EAAE,CAAC,WAAW;YAAE,OAAO;QACtC,MAAM,KAAK,GACT,MAAM,KAAK,YAAY;YACrB,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,oEAAoE,CAAC;QAC3E,MAAM,IAAI,UAAU,CAClB,GAAG,KAAK,qFAAqF;YAC3F,SAAS,eAAe,uCAAuC,CAClE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,4BAA4B,CACxC,QAAgB,EAChB,SAAkB,EAClB,OAAsE;QAEtE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAuB,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1F,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,0FAA0F;QAC1F,wFAAwF;QACxF,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,2FAA2F;QAC3F,4FAA4F;QAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,OAAO,EAAE,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACvE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9D,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,gFAAgF;YAChF,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,+BAA+B,CAC3C,QAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAsB;YACjC,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,kBAAkB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;SAChF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAChD,CAAC;IAEO,2BAA2B,CAAC,QAAgB,EAAE,SAAkB;QACtE,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oFAAoF;gBACpF,wFAAwF;gBACxF,kFAAkF;gBAClF,UAAU,CACR,0CAA0C,MAAM,CAAC,KAAK,CAAC,MAAM;oBAC3D,wCAAwC,GAAG,EAAE,CAChD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,WAAW;YACX,eAAe,EAAE,gCAAgC;YACjD,GAAG,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;SAChC,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAI,KAAyC,CAAC,SAAS,CAAC;IAClE,oGAAoG;IACpG,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9D,0FAA0F;IAC1F,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC"}

package/dist/Authentication/ServicePrincipalAuthenticationProvider.d.ts

@@ -1,23 +0,0 @@
-/*!
- * Copyright (C) Microsoft Corporation. All rights reserved.
- */
-import type { Region } from '@microsoft/managed-apps-common/services';
-import type { IAuthenticationProvider } from '../Types/Cli.types.js';
-/**
- * Authenticates using a service principal (client credentials flow). Requires MS_CLI_SP_CLIENT_ID,
- * MS_CLI_SP_CLIENT_SECRET, and MS_CLI_SP_TENANT_ID environment variables. Activated via
- * MS_CLI_USE_SP_AUTH=true (or CI=true in test runs).
- */
-export declare class ServicePrincipalAuthenticationProvider implements IAuthenticationProvider {
-    private _msalClient;
-    private _clientId;
-    private _clientSecret;
-    private _tenantId;
-    private _region;
-    constructor();
-    initAsync(region: Region): Promise<void>;
-    getAccessTokenForResource(resource: string, _loginHint?: string): Promise<string>;
-    getUserTenantId(): string | undefined;
-    getCachedAccountAsync(): Promise<string | undefined>;
-}
-//# sourceMappingURL=ServicePrincipalAuthenticationProvider.d.ts.map

package/dist/Authentication/ServicePrincipalAuthenticationProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ServicePrincipalAuthenticationProvider.d.ts","sourceRoot":"","sources":["../../src/Authentication/ServicePrincipalAuthenticationProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yCAAyC,CAAC;AAGtE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAGlE;;;;GAIG;AACH,qBAAa,sCAAuC,YAAW,uBAAuB;IACpF,OAAO,CAAC,WAAW,CAA4C;IAC/D,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAAqB;;IAgBvB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBvF,eAAe,IAAI,MAAM,GAAG,SAAS;IAI/B,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAGlE"}

package/dist/Authentication/ServicePrincipalAuthenticationProvider.js

@@ -1,60 +0,0 @@
-/*!
- * Copyright (C) Microsoft Corporation. All rights reserved.
- */
-import { ConfidentialClientApplication } from '@azure/msal-node';
-import { getAuthority } from '../CliUtils.js';
-import { cliEnvVarFullName, getCliEnvVar } from '../Utils/EnvVars.js';
-/**
- * Authenticates using a service principal (client credentials flow). Requires MS_CLI_SP_CLIENT_ID,
- * MS_CLI_SP_CLIENT_SECRET, and MS_CLI_SP_TENANT_ID environment variables. Activated via
- * MS_CLI_USE_SP_AUTH=true (or CI=true in test runs).
- */
-export class ServicePrincipalAuthenticationProvider {
-    _msalClient;
-    _clientId;
-    _clientSecret;
-    _tenantId;
-    _region;
-    constructor() {
-        const clientId = getCliEnvVar('SP_CLIENT_ID');
-        const clientSecret = getCliEnvVar('SP_CLIENT_SECRET');
-        const tenantId = getCliEnvVar('SP_TENANT_ID');
-        if (!clientId || !clientSecret || !tenantId) {
-            throw new Error(`Service principal environment variables ${cliEnvVarFullName('SP_CLIENT_ID')}, ${cliEnvVarFullName('SP_CLIENT_SECRET')}, and ${cliEnvVarFullName('SP_TENANT_ID')} must be set`);
-        }
-        this._clientId = clientId;
-        this._clientSecret = clientSecret;
-        this._tenantId = tenantId;
-    }
-    async initAsync(region) {
-        this._region = region;
-        const authConfig = {
-            auth: {
-                clientId: this._clientId,
-                clientSecret: this._clientSecret,
-                authority: getAuthority(this._region, this._tenantId),
-            },
-        };
-        this._msalClient = new ConfidentialClientApplication(authConfig);
-    }
-    async getAccessTokenForResource(resource, _loginHint) {
-        if (!this._msalClient) {
-            throw new Error('Authentication not initialized yet');
-        }
-        const clientCredentialRequest = {
-            scopes: [resource + '/.default'],
-        };
-        const result = await this._msalClient.acquireTokenByClientCredential(clientCredentialRequest);
-        if (!result?.accessToken) {
-            throw new Error('Failed to acquire token using service principal');
-        }
-        return result.accessToken;
-    }
-    getUserTenantId() {
-        return this._tenantId;
-    }
-    async getCachedAccountAsync() {
-        return `Service Principal:${this._clientId}`;
-    }
-}
-//# sourceMappingURL=ServicePrincipalAuthenticationProvider.js.map

package/dist/Authentication/ServicePrincipalAuthenticationProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ServicePrincipalAuthenticationProvider.js","sourceRoot":"","sources":["../../src/Authentication/ServicePrincipalAuthenticationProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,sCAAsC;IACzC,WAAW,CAA4C;IACvD,SAAS,CAAS;IAClB,aAAa,CAAS;IACtB,SAAS,CAAS;IAClB,OAAO,CAAqB;IAEpC;QACE,MAAM,QAAQ,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,2CAA2C,iBAAiB,CAAC,cAAc,CAAC,KAAK,iBAAiB,CAAC,kBAAkB,CAAC,SAAS,iBAAiB,CAAC,cAAc,CAAC,cAAc,CAC/K,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,MAAc;QACnC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,MAAM,UAAU,GAAkB;YAChC,IAAI,EAAE;gBACJ,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;aACtD;SACF,CAAC;QAEF,IAAI,CAAC,WAAW,GAAG,IAAI,6BAA6B,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IAEM,KAAK,CAAC,yBAAyB,CAAC,QAAgB,EAAE,UAAmB;QAC1E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,uBAAuB,GAAG;YAC9B,MAAM,EAAE,CAAC,QAAQ,GAAG,WAAW,CAAC;SACjC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;QAE9F,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,qBAAqB;QAChC,OAAO,qBAAqB,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;CACF"}

package/dist/Bin.d.ts

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-/*!
- * Copyright (C) Microsoft Corporation. All rights reserved.
- */
-export {};
-//# sourceMappingURL=Bin.d.ts.map

package/dist/Bin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"Bin.d.ts","sourceRoot":"","sources":["../src/Bin.ts"],"names":[],"mappings":";AAEA;;GAEG"}

package/dist/Bin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"Bin.js","sourceRoot":"","sources":["../src/Bin.ts"],"names":[],"mappings":";AAEA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;AAE7B,IAAI,EAAE,CAAC"}

package/dist/Cli.d.ts

@@ -1,2 +0,0 @@
-export declare function boot(): Promise<void>;
-//# sourceMappingURL=Cli.d.ts.map

package/dist/Cli.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"Cli.d.ts","sourceRoot":"","sources":["../src/Cli.ts"],"names":[],"mappings":"AA8CA,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CA+L1C"}