@microsoft/managed-apps-cli 0.19.0 → 0.21.0

package/dist/Verbs/CreateMaafApp.js

@@ -1,1081 +0,0 @@
-/*!
- * Copyright (C) Microsoft Corporation. All rights reserved.
- */
-import { createAsync, getPlayerServiceConfig, writeRepoConfig, } from '@microsoft/managed-apps-actions';
-import { AppConfigFileName } from '@microsoft/managed-apps-common/config';
-import { HttpClientError, regionToCloudSafe } from '@microsoft/managed-apps-common/services';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { getCliLogger, getSettings } from '../CliSettings.js';
-import { createDefaultStringOption, resolveEnvironmentId } from '../CliUtils.js';
-import { CLI_BINARY_NAME } from '../Constants/CliConstants.js';
-import { HelpStrings } from '../Constants/HelpStrings.js';
-import { AppError, AuthenticationError, ConfigurationError, NetworkError, UsageError, } from '../Errors/CliError.js';
-import { printInfo, printJsonLine, printJsonSuccess, printSuccess, printWarning, } from '../Utils/ConsoleOutput.js';
-import { withGitHubDcfRecoveryAsync } from '../Utils/DcfRecovery.js';
-import { downloadTemplate, parseGithubTemplate } from '../Utils/DownloadTemplate.js';
-import { awaitRoutingEnvironmentAsync, startPdeRoutingAsync, } from '../Utils/EnvironmentRoutingUtils.js';
-import { buildGcmConfig } from '../Utils/GitCredentialConfig.js';
-import { runGit } from '../Utils/GitRunner.js';
-import { ensureGitInstalled } from '../Utils/GitVersionChecker.js';
-import { buildMaafAppConfig } from '../Utils/MaafAppConfig.js';
-import { pinCliIntoAppPackageJson } from '../Utils/PinCli.js';
-import { parseRepoOption } from '../Utils/RepoOption.js';
-import { CliSpinner } from '../Utils/Spinner.js';
-import { CreateMaafAppArguments } from './VerbConstants.js';
-const DEFAULT_TEMPLATE = 'github:microsoft/Managed-Apps/templates/vite8';
-/** Commit message for the initial scaffold, shared by the auto-push and every
- * manual-recovery hint */
-const SCAFFOLD_COMMIT_MESSAGE = "Initial scaffold from 'ms app create'";
-/**
- * Creates a new MAAF app and (where applicable) sets up local source control.
- *
- * Three repo flows, selected by `--repo`:
- * - `native` (default): server auto-provisions a GRS repo; local clone happens via GCM.
- * - `github`: external GitHub binding (`*.ghe.com` or `github.com`). Clones the user's repo locally. On the first
- *   `createAsync` call, a missing/expired server-side GitHub identity mapping is
- *   recoverable in-band: a single inline DCF run + exactly one `createAsync` retry.
- *   Any other error — or a second mapping failure after DCF — is a hard fail.
- * - `none`: no git binding at all (just the server record + template + ms.config.json).
- */
-export async function createMaafAppAsync(argumentProvider) {
-    createOptionSchema(argumentProvider);
-    await argumentProvider.runVerb();
-    const tenantId = await argumentProvider.getTenantIdAsync();
-    if (!tenantId) {
-        throw new UsageError('Unable to determine tenant ID. Ensure you are logged in.');
-    }
-    const logger = getCliLogger();
-    const { region } = getPlayerServiceConfig();
-    const displayName = await argumentProvider.getOption('displayName');
-    if (!displayName) {
-        throw new UsageError('Argument displayName is required. Use --display-name or -n to specify it.');
-    }
-    // The positional arg (or cwd) is both the git repo root and the app dir.
-    const appDir = argumentProvider.getPositionalArg(0) ?? process.cwd();
-    const template = await argumentProvider.getOption('template', /* ignorePrompt */ true);
-    // CLI surface is --repo. Three flows, decided up front so the rest of the verb can
-    // branch on `repoType` instead of inspecting `remoteUrl` everywhere. RepoSelection
-    // is a flat interface (not a discriminated union), so we branch on `repoType` and
-    // assert `remoteUrl!` at github use sites where `string` is required.
-    const rawRepoValue = await argumentProvider.getOption('repo', 
-    /* ignorePrompt */ true);
-    const { repoType, remoteUrl } = parseRepoOption(rawRepoValue);
-    // Read --repository-id up front (instead of after preflight, like the other prompts)
-    // so the `--repo none` conflict check below has it. It is `optionalInNonInteractive`
-    // and registered with `ignorePrompt: true`, so reading early never triggers an
-    // interactive prompt.
-    const repositoryId = await argumentProvider.getOption('repositoryId', 
-    /* ignorePrompt */ true);
-    // --json emits a single machine-parseable envelope on stdout, so every
-    // informational `printInfo` below is gated behind `!jsonMode` to keep
-    // stdout free of prose ahead of the envelope. `printError` writes to
-    // stderr and is unaffected.
-    const jsonMode = argumentProvider.isJsonMode();
-    // Identity confirmation: print the tenant + cloud we're targeting before
-    // anything else — preflight, routing, createAsync — so a user with multiple
-    // accounts signed in has the longest possible window to CTRL-C before any
-    // local check runs or server call fires. Environment id isn't known yet
-    // (routing is what resolves it); included in the success line at the end.
-    // Wording is intentionally tentative ("About to create…") so a preflight
-    // failure on the next line doesn't read as contradicting a "Creating…" line.
-    //
-    // Surface `cloud` (user-facing, e.g. `public` / `usgov`) instead of `region`
-    // (internal, e.g. `prod` / `gccmoderate`) so the value matches what the user
-    // typed on `--cloud`. Regions without a Cloud equivalent (`preview`, `ex`,
-    // `rx`, or developer modes `local` / `dev`) fall back to the raw region —
-    // these don't reach this print via the current `cloudToRegion(this._cloud)`
-    // chain in ArgumentProvider, so the fallback is defensive against future
-    // code paths (e.g. routing-resolved regions).
-    if (!jsonMode) {
-        const cloud = regionToCloudSafe(region);
-        const target = cloud ? `cloud ${cloud}` : `region ${region}`;
-        printInfo(`About to create app '${displayName}' in tenant ${tenantId} (${target}).`);
-    }
-    // ─── Preflight ────────────────────────────────────────────────────────────
-    // Run all local-only checks before any server call. Once createAsync
-    // succeeds the user has a MAAF app + GRS repo on the server; a later
-    // local-setup failure leaves them with created resources that need recovery.
-    // Anything we can validate without hitting the server belongs here.
-    //
-    // --repo path: requires git installed, writable target, and an empty target
-    // (since `git clone` refuses non-empty destinations and we don't destructively
-    // wipe local files). To bind a non-empty directory to a MAAF app, use `ms app
-    // init` instead.
-    //
-    // --repo none path: no source-control git (no `git init`, no `git clone` of a
-    // user-supplied remote). Git itself is still required, because the template
-    // download is a sparse `git clone` of the github-hosted template repo —
-    // hence `ensureGitInstalled` runs unconditionally below.
-    // ──────────────────────────────────────────────────────────────────────────
-    const usePreflightSpinner = !jsonMode && process.stdout.isTTY;
-    if (!jsonMode && !usePreflightSpinner) {
-        printInfo('Running preflight checks...');
-    }
-    // Spinner runs only in TTY interactive mode; --json keeps stdout clean and
-    // non-TTY (CI, piped output) uses plain prose so log files stay readable.
-    // Most preflight checks are sync, so the spinner frame can pause while a
-    // check runs; we still update the status label before each check so users
-    // always see the current step. The try/finally guarantees we restore the
-    // cursor even if a preflight check throws.
-    const preflightSpinner = usePreflightSpinner ? new CliSpinner() : null;
-    preflightSpinner?.start('Running preflight checks...');
-    try {
-        // --repo none is incompatible with --repository-id: the former opts out of any
-        // platform-managed git binding, the latter forces one. Fail fast before any
-        // server call so we don't half-bind the app.
-        if (repoType === 'none' && repositoryId) {
-            throw new UsageError("'--repo none' is incompatible with '--repository-id'. " +
-                "Use '--repo none' for an app with no git binding, or omit '--repo' (or pass a repo URL) to use a backing repository.");
-        }
-        preflightSpinner?.update('Validating template source...');
-        ensureTemplateSourceValid(template);
-        preflightSpinner?.update('Checking git installation...');
-        ensureGitInstalled();
-        preflightSpinner?.update('Verifying target directory is writable...');
-        ensureTargetDirectoryWritable(appDir);
-        if (repoType === 'github') {
-            // RepoSelection is a flat interface (not a discriminated union), so `remoteUrl`
-            // doesn't auto-narrow to `string` here even though the github branch guarantees it.
-            preflightSpinner?.update('Verifying target directory is empty...');
-            ensureRepoTargetDirectoryEmpty(appDir);
-            // Pre-network: cheap partial clone into a temp dir + ls-tree HEAD to detect
-            // a non-empty remote before createAsync runs. Catches the rejection case
-            // without leaving a server-side app or scaffolded files in
-            // appDir. Cheapest probe shape: --depth=1 --filter=blob:none --no-checkout
-            // pulls refs + the tip commit + its tree(s) only (no blob bytes, no working
-            // tree). On any probe error (network, auth, server doesn't support partial
-            // clone, etc.) we swallow and let the subsequent cloneRepo emit its
-            // friendlier error — see ensureExternalRepoIsEmpty for the rationale.
-            preflightSpinner?.update(`Verifying ${remoteUrl} is empty...`);
-            ensureExternalRepoIsEmpty(remoteUrl);
-        }
-        else {
-            preflightSpinner?.update('Verifying target directory is empty...');
-            ensureTargetDirectoryEmpty(appDir);
-        }
-    }
-    finally {
-        preflightSpinner?.stop();
-    }
-    // ─── End preflight ────────────────────────────────────────────────────────
-    // The debug env-var override (MS_CLI_MAAF_DEBUG_ENVIRONMENT_ID) is honored by ArgumentProvider
-    // and surfaced via getEnvironmentId(), which also owns explicit option resolution. When set,
-    // skip the automatic environment-selection API call entirely. Without an explicit id,
-    // getEnvironmentId() returns undefined and the automatic environment lookup runs.
-    const preResolvedEnvironmentId = await resolveEnvironmentId(argumentProvider, {
-        failIfMissing: false,
-    });
-    // Fire off PDE routing in parallel with the remaining option prompts. The result is awaited
-    // immediately before createAsync, so prompt latency is hidden behind the network call.
-    // Skipped entirely when the env id is pre-resolved (--environment-id flag or debug override).
-    const routingEnvPromise = preResolvedEnvironmentId
-        ? undefined
-        : startPdeRoutingAsync(argumentProvider, tenantId, logger, 'CreateMaafApp');
-    const description = await argumentProvider.getOption('description', 
-    /* ignorePrompt */ true);
-    const buildPath = await argumentProvider.getOption('buildPath', /* ignorePrompt */ true);
-    const buildCommand = await argumentProvider.getOption('buildCommand', 
-    /* ignorePrompt */ true);
-    const buildEntryPoint = await argumentProvider.getOption('buildEntryPoint', 
-    /* ignorePrompt */ true);
-    // Shared environment-routing logic between CreateMaafApp and Init.
-    // `awaitRoutingEnvironmentAsync` prints a `--environment-id` hint on any
-    // failure — HTTP error codes, `operationSuccess: false`, and exceptions.
-    const environmentId = await awaitRoutingEnvironmentAsync(preResolvedEnvironmentId, routingEnvPromise);
-    argumentProvider.updateEnvironmentId(environmentId);
-    // Re-check the directory invariant right before the server call. The same
-    // check ran in preflight, but the routing-env resolution between then and
-    // now is async and may take seconds — long enough for the user (or another
-    // tool) to drop a file (or ms.config.json) into appDir. Repeating the check
-    // here keeps the TOCTOU window between "directory looks fine" and
-    // "createAsync succeeded" as small as possible without creating a server-side
-    // app before local invariants are verified.
-    if (repoType === 'github') {
-        ensureRepoTargetDirectoryEmpty(appDir);
-    }
-    else {
-        ensureTargetDirectoryEmpty(appDir);
-    }
-    // Read --open-browser alongside --json so the recovery DCF helper has both
-    // inputs ready without a second async option read inside the catch block.
-    // Commander converts kebab-case flag names to camelCase property keys;
-    // the camelName constant keeps this lookup in sync with OpenBrowser.name.
-    const openBrowser = (await argumentProvider.getOption(CreateMaafAppArguments.OpenBrowser.camelName, 
-    /* ignorePrompt */ true)) ?? false;
-    // Forces DCF re-authentication even when a valid mapping exists.
-    const forceReauth = (await argumentProvider.getOption(CreateMaafAppArguments.ForceReauth.camelName, 
-    /* ignorePrompt */ true)) ?? false;
-    // JSON mode (github flow only): emit a structured `create-validation` event
-    // right before the server call so automation parsing NDJSON sees the
-    // validation→createAsync boundary — needed because the github flow has a
-    // catch-and-retry branch where validation precedes a recoverable DCF.
-    // Gated to `github` so we don't change the NDJSON wire contract for
-    // existing `native` / `none` `--json` consumers.
-    if (jsonMode && repoType === 'github') {
-        printJsonLine({ phase: 'create-validation' });
-    }
-    // Hoisted so the fixed-shape params are defined once and reused across the
-    // first attempt and the post-DCF retry. `forceReauth` is injected per-call
-    // via `isRetry` so the retry does not re-trigger the server-side mapping
-    // bypass against the just-refreshed mapping.
-    const baseActionsParams = {
-        displayName,
-        description,
-        repositoryId,
-        remoteUrl,
-        repoType,
-        origin: getSettings().origin,
-    };
-    const runCreate = ({ isRetry, }) => createAsync({
-        tenantId,
-        environmentId,
-        logger,
-        actionsParams: {
-            ...baseActionsParams,
-            ...(forceReauth && !isRetry && { forceReauth: true }),
-        },
-    });
-    // On `repoType: 'github'`, wrap createAsync with the DCF catch-and-retry:
-    // a missing/expired GitHub identity mapping is recovered in-band by running
-    // DCF and retrying once; any other recognized server error is mapped to a
-    // friendly CLI error. Non-github flows pass through untouched. See
-    // `withGitHubDcfRecoveryAsync` for the full contract.
-    //
-    // Any server error that escapes the DCF wrapper (all repo types) is routed
-    // through `translateCreateError`, which keys off the HTTP status code to
-    // surface an actionable message (e.g. a 403 becomes a permission error naming
-    // the environment) instead of the raw `HTTP error status: ...` blob from the RP.
-    let createResult;
-    try {
-        createResult = await withGitHubDcfRecoveryAsync(runCreate, {
-            repoType,
-            externalRepoUrl: remoteUrl,
-            tenantId,
-            jsonMode,
-            openBrowser,
-            verb: 'app create',
-        });
-    }
-    catch (createError) {
-        const translated = translateCreateError(createError, { repoType, environmentId });
-        if (translated)
-            throw translated;
-        throw createError;
-    }
-    const { app, cloneUrl } = createResult;
-    // Only the `native` flow expects a GRS clone URL — it's the origin for the first
-    // local push to the auto-provisioned platform-managed repo, which GRS seeds with
-    // an initial commit on `main`. `github` binds an external GitHub repo (no GRS)
-    // and `none` is by-design source-control-free, so neither produces a `cloneUrl`.
-    // Missing on `native` is a server bug — the hoisted check below guards both the
-    // pretty-output `(clone URL: undefined)` and JSON-envelope `gitRemoteUrl: undefined`
-    // failure modes that would otherwise leak through.
-    if (repoType === 'native' && !cloneUrl) {
-        const recoveryHint = buildOrphanedAppRecoveryHint(app.id, app.environmentId);
-        throw new AppError(`App '${app.displayName}' was created on the server, but creating a git repository failed. ` +
-            `This is a platform-side issue; please report it. ` +
-            `In the meantime, the partial app needs to be cleaned up.\n` +
-            recoveryHint);
-    }
-    // Set up local files. Runs after the API calls succeed; if any step here
-    // fails the server app is already created. The branch per `repoType`:
-    //   - native: init local git repo + GCM config for the auto-provisioned GRS
-    //             repo (seeded with an initial commit on `main`), overlay the
-    //             template, then write ms.config.json. The push phase reconciles
-    //             the scaffold onto that seeded history before pushing.
-    //   - github: clone the user's external repo, sanity-check it's empty,
-    //             overlay the template, then write ms.config.json.
-    //   - none:   no git, no clone — mkdir -p, overlay the template, write ms.config.json.
-    let pushOutcome = null;
-    try {
-        if (repoType === 'github') {
-            // External GitHub path: clone the developer's repo. Auth flows through
-            // the user's existing git credential setup (gh, GCM browser OAuth, SSH key, PAT,
-            // x509 client cert, etc.); the CLI does not inject any tokens at this layer (the
-            // Microsoft GitHub App is server-side only per the MAAF GitHub Integration design
-            // doc Requirement 1). The post-clone empty-check that used to live here moved
-            // to the preflight (ensureExternalRepoIsEmpty), so by the time we get here the
-            // remote is known to be empty and the clone produces an empty working tree.
-            cloneRepo({ directory: appDir, repoUrl: remoteUrl });
-            // Safety net: the pre-network probe (ensureExternalRepoIsEmpty) is fail-OPEN
-            // on errors (e.g. os.tmpdir() inaccessible, server doesn't support partial
-            // clone). When that happens, the actual cloneRepo may have pulled content
-            // we missed. One last readdirSync of appDir guarantees we don't silently
-            // overlay the template onto the user's files.
-            // The repo must be _completely_ empty — including hidden / dotfiles like
-            // .gitignore, .gitattributes, README, LICENSE, .git-credentials, etc.
-            // We only filter `.git` itself (the internal directory created by clone);
-            // any other entry, hidden or not, means the user has prior content here.
-            const workingTreeEntries = fs.readdirSync(appDir).filter((entry) => entry !== '.git');
-            if (workingTreeEntries.length > 0) {
-                throw new UsageError(`Repository ${remoteUrl} is not empty (must contain no files of any kind, including hidden files like .gitignore, .gitattributes, README, or LICENSE). Choose a different repository to create an app or run 'ms app init' to update the existing app.\n\n` +
-                    buildOrphanedAppRecoveryHint(app.id, app.environmentId));
-            }
-        }
-        else if (repoType === 'native') {
-            initLocalRepo({
-                directory: appDir,
-                gitUrl: cloneUrl,
-                loginAuthority: argumentProvider.getLoginAuthority(tenantId),
-                authResource: argumentProvider.getAuthResourceUrl(),
-            });
-        }
-        else {
-            // --repo none: no git setup. Ensure the target dir exists so the
-            // subsequent downloadTemplate and writeRepoConfig calls can land their
-            // files. The preflight already verified the dir is empty.
-            fs.mkdirSync(appDir, { recursive: true });
-        }
-        if (!jsonMode) {
-            printInfo(`Fetching template '${template}' into ${appDir}...`);
-        }
-        downloadTemplate(template, { dir: appDir });
-        // Pin the CLI into the app so a later package install provides a project-local
-        // `ms` — resolved by `npx ms` / `pnpm exec` / `bun x` ahead of any globally-
-        // installed CLI — at the version it was created with (or the latest published
-        // version for a prerelease build). Runs for every repo flow (the template, and
-        // therefore its package.json, lands via downloadTemplate above regardless of
-        // `--repo`).
-        await pinCliIntoAppPackageJson(appDir, jsonMode, argumentProvider.getHttpClient());
-        const config = buildMaafAppConfig({
-            appId: app.id,
-            appDisplayName: app.displayName,
-            description: app.description,
-            environmentId: app.environmentId,
-            repoType,
-            cloud: argumentProvider.getCloud(),
-            buildPath,
-            buildCommand,
-            buildEntryPoint,
-            // Only the `native` flow has a platform-managed git binding. `github` tracks
-            // external binding server-side via `externalRepo`, and `none` intentionally has
-            // no platform-managed binding. Omit `repositoryId` for both so downstream verbs
-            // key off `repoType` instead of a placeholder value.
-            repositoryId: repoType === 'native' ? app.repositoryId : undefined,
-            // externalRepoUrl is persisted only for github-bound apps so that post-create verbs
-            // (build, deploy) know which GitHub host to authenticate against during inline DCF
-            // recovery without re-prompting the user for the URL.
-            externalRepoUrl: repoType === 'github' ? remoteUrl : undefined,
-        });
-        await writeRepoConfig(path.join(appDir, AppConfigFileName), config);
-        // Auto commit + push for git-backed flows (native + github). The `none` flow
-        // has no remote, so it's skipped. Push failure is non-fatal — see the warning
-        // path in commitAndPushScaffoldAsync.
-        if (repoType !== 'none') {
-            pushOutcome = await commitAndPushScaffoldAsync(appDir, jsonMode, repoType === 'native' ? cloneUrl : undefined);
-        }
-    }
-    catch (setupError) {
-        // UsageError carries already-actionable messages (e.g. "repo already contains an
-        // app — try ms app init") and, for the non-native flows that raise it, its own
-        // recovery hint. Let those through unwrapped. The native flow has already created
-        // the server app + repo by the time any setup step throws, so it always routes
-        // through the generic re-messaging below to surface the cleanup hint.
-        if (setupError instanceof UsageError && repoType !== 'native') {
-            throw setupError;
-        }
-        const detail = setupError instanceof Error ? setupError.message : String(setupError);
-        const message = `App '${app.displayName}' was created, but local setup failed: ${detail}\n` +
-            `The local directory ${appDir} may contain partial files; remove them or choose a new directory before retrying.\n` +
-            buildOrphanedAppRecoveryHint(app.id, app.environmentId);
-        // Re-message a typed AppError in place rather than re-wrapping it, so the
-        // failure category survives the setup-recovery prefix intact: a classified
-        // AuthenticationError keeps its exit code (3), name, errorData, AND its
-        // subclass identity (`instanceof AuthenticationError` still holds for any
-        // future handler that branches on the class). Constructing a fresh AppError
-        // would downgrade everything to exit 1 and erase the subclass. The original
-        // message is preserved as `detail` inside the new message, so nothing is lost.
-        if (setupError instanceof AppError) {
-            setupError.message = message;
-            throw setupError;
-        }
-        throw new AppError(message);
-    }
-    if (jsonMode) {
-        // `appId` is the bare GUID returned by the server (`MaafAppDefinition.id`) and
-        // also written to ms.config.json — used by every subsequent CLI command
-        // (build, deploy, info, etc.). `gitRemoteUrl` is the GRS clone URL and is only
-        // present for the `native` flow (the only flow that auto-provisions a
-        // platform-managed git repo). `externalRepoUrl` is the user-supplied external
-        // GitHub URL and only appears in the `github` flow. `repoType` is always emitted so
-        // automation can detect which source-control mode the app was created in.
-        printJsonSuccess({
-            appId: app.id,
-            repoType,
-            ...(repoType === 'github' && remoteUrl && { externalRepoUrl: remoteUrl }),
-            ...(repoType === 'native' && cloneUrl && { gitRemoteUrl: cloneUrl }),
-            appDir,
-            ...(pushOutcome && { push: pushOutcome }),
-        });
-    }
-    else {
-        printSuccess(`Created app '${app.displayName}' in ${appDir}.`);
-        if (repoType === 'github') {
-            printInfo(`Bound to external repository: ${remoteUrl}.`);
-        }
-        else if (repoType === 'none') {
-            printInfo('Your app has been created. Run `git init` (or your VCS of choice) when ready; ' +
-                'subsequent `ms app deploy` calls do not require a git remote.');
-        }
-    }
-}
-/**
- * Commits the scaffolded files and pushes to the remote. Called by both `native`
- * and `github` flows after writeRepoConfig.
- *
- * Failure is non-fatal: prints a warning with the retry command and returns
- * `{ success: false, ... }`. The server-side app and local scaffold are unchanged.
- *
- * All three git commands go through {@link runGit}, so stdin is ignored (the
- * child can never block waiting for input) and stdout is discarded (git's
- * progress prose stays out of our pretty output). Stderr handling follows the
- * runGit policy: the un-classified `add`/`commit` steps re-emit git's stderr on
- * failure, and the `push` step either streams stderr live (un-classified github
- * flow, `network: true`) or pipes it for classification (native flow) — either
- * way git's own error context reaches the user alongside our warning. A
- * classified push error is caught here, so its exit code never propagates;
- * classification only shapes the warning text and the `--json` error payload.
- *
- * Commit identity (user.name / user.email) is read by git itself from
- * local-then-global config — we pass nothing. Missing identity surfaces as
- * git's own descriptive commit error via runGit's stderr handling.
- */
-export async function commitAndPushScaffoldAsync(appDir, jsonMode, nativeGitUrl) {
-    // Full add+commit+push sequence: any of the three commands may have been the
-    // one that failed (e.g. `git commit` errors when user.name/user.email aren't
-    // set), so re-running just `git push` wouldn't recover. The sequence is
-    // idempotent: rerunning `git add .` and `git commit` on an already-committed
-    // state either no-ops or errors with "nothing to commit", in which case
-    // `git push` still pushes the existing commit.
-    //
-    // Native (GRS) has no safe one-line recovery: the failure could be at the
-    // fetch/reconcile step (scaffold not yet re-parented onto the seeded main) or
-    // at the final push (already re-parented), and a single copy-paste command
-    // can't be correct for both. So we surface no command for native and instead
-    // point the user at the local scaffold below.
-    const retryCommand = nativeGitUrl
-        ? undefined
-        : `git add . && git commit -m "${SCAFFOLD_COMMIT_MESSAGE}" && git push -u origin HEAD`;
-    try {
-        runGit(['add', '.'], { cwd: appDir });
-        runGit(['commit', '-m', SCAFFOLD_COMMIT_MESSAGE], { cwd: appDir });
-        if (nativeGitUrl) {
-            reconcileNativeScaffoldWithSeededMain(appDir, nativeGitUrl, jsonMode);
-        }
-        runGit(['push', '-u', 'origin', 'HEAD'], {
-            cwd: appDir,
-            network: true,
-            classify: nativeGitUrl ? { action: `pushing to ${gitHostLabel(nativeGitUrl)}` } : undefined,
-        });
-        return { success: true };
-    }
-    catch (err) {
-        // Capture the entire error structurally — name + message + stack for
-        // Error instances, spread of own properties otherwise. JSON.stringify
-        // would otherwise drop Error's non-enumerable fields and emit `{}`.
-        const errorPayload = err instanceof Error
-            ? { name: err.name, message: err.message, stack: err.stack }
-            : typeof err === 'object' && err !== null
-                ? { ...err }
-                : { message: String(err) };
-        if (!jsonMode) {
-            // A classified native push failure (AuthenticationError / NetworkError)
-            // carries the actionable, cause-specific guidance — plus git's own output —
-            // in its message, but runGit's classify path throws *before* re-emitting
-            // stderr, so without this the human-readable terminal would only see the
-            // generic hint. (Unclassified add/commit failures and the live-stderr
-            // github push already surfaced git's output, so only re-print for the
-            // classified case to avoid duplicate noise.)
-            if (err instanceof AppError) {
-                printWarning(err.message);
-            }
-            const finishHint = retryCommand
-                ? `To finish wiring it up, run:\n    ${retryCommand}`
-                : `Resolve the git issue above, then finish the initial push from ${appDir}.`;
-            printWarning(`Could not commit and push the initial scaffold. Your app and local scaffold are ready. ` +
-                finishHint);
-        }
-        return { success: false, error: errorPayload, retryCommand };
-    }
-}
-/**
- * Reconciles the freshly committed local scaffold with the platform-seeded
- * `main` branch just before the native (GRS) push. GRS provisions the repo
- * with an initial commit on `main` (a README).
- *
- *   1. `git fetch origin`            — bring the seed commit into origin/main
- *                                       (retried once on a transient auth miss).
- *   2. `git reset --soft origin/main` — move HEAD onto the seed while keeping the
- *                                       scaffold tree fully staged.
- *   3. `git commit`                  — record the scaffold as a child of the seed.
- */
-function reconcileNativeScaffoldWithSeededMain(appDir, gitUrl, jsonMode) {
-    announceGitAuthentication(gitUrl, jsonMode, 'the initial git fetch and push');
-    fetchOriginWithRetry(appDir, gitUrl);
-    const seededMain = runGit(['rev-parse', '--verify', 'origin/main'], {
-        cwd: appDir,
-        allowFailure: true,
-        emitStderr: false,
-    });
-    if (!seededMain.success) {
-        return;
-    }
-    runGit(['reset', '--soft', 'origin/main'], { cwd: appDir });
-    runGit(['commit', '-m', SCAFFOLD_COMMIT_MESSAGE], { cwd: appDir });
-}
-/**
- * Fetches `origin`, retrying exactly once if the first attempt fails.
- *
- * The first attempt is silent (`allowFailure`, stderr piped-not-emitted) so a
- * recoverable miss produces no scary output.
- */
-function fetchOriginWithRetry(appDir, gitUrl) {
-    const firstAttempt = runGit(['fetch', 'origin'], {
-        cwd: appDir,
-        network: true,
-        allowFailure: true,
-        emitStderr: false,
-    });
-    if (firstAttempt.success) {
-        return;
-    }
-    runGit(['fetch', 'origin'], {
-        cwd: appDir,
-        network: true,
-        classify: { action: `fetching from ${gitHostLabel(gitUrl)}` },
-    });
-}
-const GIT_CLONE_ACCESS_FAILURE_SIGNATURES = [
-    'repository not found',
-    'fatal: repository',
-    'could not read username',
-    'terminal prompts disabled',
-    'authentication failed',
-    'permission denied',
-    '403',
-    'remote: not found',
-];
-function getCapturedStderr(err) {
-    const stderr = err.stderr;
-    if (typeof stderr === 'string') {
-        return stderr;
-    }
-    if (Buffer.isBuffer(stderr)) {
-        return stderr.toString();
-    }
-    if (stderr instanceof Uint8Array) {
-        return Buffer.from(stderr).toString();
-    }
-    return '';
-}
-function getUnderlyingCloneError(err, stderr) {
-    const message = err instanceof Error ? err.message : String(err);
-    const trimmedStderr = stderr.trim();
-    if (!trimmedStderr || message.includes(trimmedStderr)) {
-        return message;
-    }
-    return `${message}\n${trimmedStderr}`;
-}
-function isGitCloneAccessFailure(stderr) {
-    const normalizedStderr = stderr.toLowerCase();
-    return GIT_CLONE_ACCESS_FAILURE_SIGNATURES.some((signature) => normalizedStderr.includes(signature));
-}
-// Shared remediation body for the two access-failure surfaces (the pre-create
-// probe and the post-create clone). Both are LOCAL `git clone` failures. The
-// external-repo clone injects no credentials/config — it relies entirely on the
-// user's own git setup — so the CLI can't meaningfully point at a specific
-// credential mechanism (GCM, gh, SSH, PAT, …); the guidance stays generic.
-// It also deliberately does NOT mention the Microsoft GitHub App or
-// `git auth refresh`, which only affect the server-side Entra↔GitHub mapping.
-// Carries no raw git output either; the raw detail is preserved on the thrown
-// error's `errorData` for telemetry/debug — see the throw sites below.
-function gitHubAccessFailureGuidance() {
-    return `Make sure the repository exists and that you have access to it.`;
-}
-function buildGitHubCloneAccessErrorMessage({ directory, repoUrl }) {
-    return `Failed to clone '${repoUrl}' into '${directory}'. ` + gitHubAccessFailureGuidance();
-}
-// Pre-create variant: the probe runs BEFORE the server app is created, so the
-// lead makes explicit that nothing was created (no cleanup / no recovery hint).
-function buildGitHubAccessPreflightErrorMessage(repoUrl) {
-    return (`Cannot access repository '${repoUrl}', so no app was created. ` + gitHubAccessFailureGuidance());
-}
-function buildGenericCloneFailureMessage({ directory, repoUrl }) {
-    return `Failed to clone '${repoUrl}' into '${directory}'. See the git output above for details.`;
-}
-/**
- * Clones the developer's external GitHub repo (`*.ghe.com` tenant or `github.com`) into `directory`.
- * Auth flows through the user's existing git credential setup — the CLI does not inject
- * tokens here. On failure, surfaces a CLI-friendly error pointing the user at the
- * GitHub App install prerequisite. Git's stderr is captured (via `runGit`, with
- * `emitStderr: false`) so it can be run through the access-failure classification,
- * and is re-emitted on failure so the underlying message still appears inline
- * above the wrapper.
- *
- * Targeting rules (mirrors `git clone` semantics):
- *   - directory non-existent → clone creates it
- *   - directory exists and is empty → clone fills it
- *   - directory exists and is non-empty → clone fails (caller's pre-network guard
- *     should reject this case earlier with a clearer message)
- */
-export function cloneRepo({ directory, repoUrl }) {
-    try {
-        // Pipe + capture stderr (no `network`, so it is not inherited) so the catch
-        // can run it through `isGitCloneAccessFailure`; `emitStderr: false` lets the
-        // catch own the single re-emission below instead of runGit double-printing.
-        runGit(['clone', repoUrl, directory], { emitStderr: false });
-    }
-    catch (err) {
-        const stderr = getCapturedStderr(err);
-        if (stderr) {
-            // Re-emit git's own output live so the raw detail is still visible to the
-            // user (and in logs) without polluting the thrown error's message.
-            process.stderr.write(stderr);
-        }
-        const message = isGitCloneAccessFailure(stderr)
-            ? buildGitHubCloneAccessErrorMessage({ directory, repoUrl })
-            : buildGenericCloneFailureMessage({ directory, repoUrl });
-        // Keep the user-facing message clean; preserve the raw git detail on
-        // errorData for telemetry/debug rather than embedding it in the message.
-        // Clone failures span remote access and local git credential configuration.
-        throw new ConfigurationError(message, {
-            underlyingError: getUnderlyingCloneError(err, stderr),
-        });
-    }
-}
-export function initLocalRepo({ directory, gitUrl, loginAuthority, authResource, }) {
-    const gcmConfig = buildGcmConfigOrThrow({ gitUrl, loginAuthority, authResource });
-    gitInit(directory);
-    writeGcmConfig(directory, gcmConfig);
-    addOrUpdateRemote(directory, gitUrl);
-}
-/**
- * Builds the per-host GCM OAuth config, re-wrapping any URL/protocol validation
- * failure from {@link buildGcmConfig} as a `ConfigurationError` so the verb's
- * error handling treats an invalid clone URL as a user-actionable setup problem.
- */
-function buildGcmConfigOrThrow({ gitUrl, loginAuthority, authResource, }) {
-    try {
-        return buildGcmConfig({ gitUrl, loginAuthority, authResource });
-    }
-    catch (err) {
-        throw new ConfigurationError(`Git credential helper setup failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-/**
- * Creates the target directory (idempotent) and initializes an empty git repo
- * whose initial branch is `main`.
- */
-function gitInit(directory) {
-    fs.mkdirSync(directory, { recursive: true });
-    runGit(['init'], { cwd: directory });
-    // use `git symbolic-ref HEAD refs/heads/main` to set the initial branch to `main` instead of `master`. This is
-    // used instead of `git init -b main` / `-c init.defaultBranch=main` because both
-    // of those landed in git 2.28, one minor above this package's enforced 2.27 floor
-    runGit(['symbolic-ref', 'HEAD', 'refs/heads/main'], { cwd: directory });
-}
-/** Writes GCM config before pushing so the first network call is already authenticated. */
-function writeGcmConfig(directory, gcmConfig) {
-    for (const [key, value] of gcmConfig) {
-        runGit(['config', '--local', key, value], { cwd: directory });
-    }
-}
-/**
- * Adds `origin`, tolerating the already-exists case by falling back to
- * `set-url`. `git remote add` fails if origin already exists. Capture stderr
- * (allowFailure) so we can inspect the message and only fall back to `set-url`
- * for that specific case — other failures (permissions, corrupt repo) must
- * propagate rather than produce a misleading set-url error.
- */
-function addOrUpdateRemote(directory, gitUrl) {
-    const addRemote = runGit(['remote', 'add', 'origin', gitUrl], {
-        cwd: directory,
-        allowFailure: true,
-        emitStderr: false,
-    });
-    if (!addRemote.success) {
-        if (!addRemote.stderr.includes('already exists')) {
-            process.stderr.write(addRemote.stderr);
-            // `runGit` always populates `error` on the failure variant, so no fallback
-            // is needed (the GitResult union guarantees it here).
-            throw addRemote.error;
-        }
-        runGit(['remote', 'set-url', 'origin', gitUrl], { cwd: directory });
-    }
-}
-/**
- * Best-effort host label for a git remote URL. Returns the URL's host, or — when
- * the string isn't a parseable URL — the original string. Used for human-facing
- * action labels (auth/push messages) where a malformed URL must not turn a
- * cosmetic label into a thrown `Invalid URL` that masquerades as the real
- * failure. The platform issues these URLs, so the fallback is effectively
- * unreachable, but the guard keeps the label site from becoming a crash site.
- */
-function gitHostLabel(gitUrl) {
-    try {
-        return new URL(gitUrl).host;
-    }
-    catch {
-        return gitUrl;
-    }
-}
-/**
- * Prints the pre-network authentication notice. The first git network call triggers
- * GCM's OAuth flow if the user has no cached credentials, which can pop a
- * browser without warning. Tell the user up front so they don't see the browser
- * as a surprise (and know which host / account to authenticate against). Skipped
- * under `--json` so the prose doesn't end up interleaved with the JSON envelope
- * on stdout.
- */
-function announceGitAuthentication(gitUrl, jsonMode, action) {
-    if (!jsonMode) {
-        printInfo(`Authenticating to ${gitHostLabel(gitUrl)} for ${action}. ` +
-            'A browser window may open. Sign in with the account associated with this tenant.');
-    }
-}
-// ─── Recovery hint for post-create failures ─────────────────────────────────
-// Once createAsync returns, the MAAF app + GRS repo exist on the server; any
-// later failure (no gitUrl, initLocalRepo, downloadTemplate, writeRepoConfig)
-// strands them. Append this hint to the error message so the user can copy a
-// working `app delete --force` line straight from their terminal and retry.
-// ────────────────────────────────────────────────────────────────────────────
-export function buildOrphanedAppRecoveryHint(serverAppId, environmentId) {
-    return (`The server app is still in environment ${environmentId} (id: ${serverAppId}).\n` +
-        `If you want to clean it up before retrying, run the following command:\n` +
-        `  ${CLI_BINARY_NAME} app delete --app ${serverAppId} --environment-id ${environmentId} --force`);
-}
-/** Extracts `error.message` from a JSON `{ error: { message } }` envelope; `undefined` otherwise. */
-function extractServerMessage(err) {
-    if (!err.body)
-        return undefined;
-    try {
-        const parsed = JSON.parse(err.body);
-        if (typeof parsed?.error?.message === 'string' && parsed.error.message.trim()) {
-            return parsed.error.message;
-        }
-    }
-    catch {
-        // not JSON; fall through
-    }
-    return undefined;
-}
-/**
- * Translates a server error thrown while creating the app (the `createAsync`
- * RP/GRS calls) into a user-facing {@link AppError}, or returns `null` to signal
- * "not handled — propagate the original". For the handled status codes below we
- * key off the HTTP status to pick the error category (which drives the exit code)
- * and surface an actionable message rather than the raw HTTP error blob
- * (`HTTP error status: 403 for POST ...: {...}`). Unrecognized statuses (e.g. 500)
- * return `null` and propagate unchanged, so the raw error can still surface for
- * those — we only suppress the blob for the statuses we explicitly handle.
- *
- * The RP returns a structured `{ error: { code, message } }` envelope whose
- * `message` is the source of truth — it names the offending principal and
- * environment (e.g. "User '<oid>' does not have permission to create
- * repositories in environment '<id>'."). We prefer that server message and fall
- * back to CLI-generated text only when the body carries no usable message.
- *
- * Only translates {@link HttpClientError}. Errors already mapped to a typed
- * {@link AppError} by the GitHub DCF recovery path (see `withGitHubDcfRecoveryAsync`)
- * are passed through untouched.
- */
-function translateCreateError(err, ctx) {
-    if (!(err instanceof HttpClientError))
-        return null;
-    const { environmentId } = ctx;
-    // Prefer the RP's own `error.message` — it's the source of truth and carries
-    // specifics (principal object id, environment id) the CLI can't reconstruct.
-    const serverMessage = extractServerMessage(err);
-    // The `native` (default) flow auto-provisions a platform-managed GRS repository,
-    // so a permission failure there is specifically about repository creation. The
-    // `github` / `none` flows don't provision a repo, so the denial is about creating
-    // the app itself. Used only for the fallback wording when the RP sends no message.
-    const creatingRepo = ctx.repoType === 'native';
-    // Operation-agnostic so it reads correctly whether it's appended to the RP's
-    // "...create repositories..." message, the "...create an app..." fallback, or
-    // the native/github variants — avoids a "repositories" vs "apps" mismatch.
-    const grantHint = 'Ask an admin to grant you the required permission in this environment.';
-    if (err.status === 401) {
-        return new AuthenticationError(serverMessage ??
-            'Your sign-in session has expired or is invalid. Run `ms auth login` and try again.');
-    }
-    if (err.status === 403) {
-        const base = serverMessage ??
-            (creatingRepo
-                ? `You do not have permission to create repositories in environment ${environmentId}.`
-                : `You do not have permission to create an app in environment ${environmentId}.`);
-        return new AuthenticationError(`${base} ${grantHint}`);
-    }
-    if (err.status === 404) {
-        return new UsageError(serverMessage ??
-            `Environment ${environmentId} was not found. Verify the environment id and that you have access to it.`);
-    }
-    if (err.status === 409) {
-        return new UsageError(serverMessage ??
-            `An app with the same name already exists in environment ${environmentId}. Choose a different name.`);
-    }
-    if (err.status === 429 || err.status === 503) {
-        return new NetworkError(serverMessage ??
-            'The service is temporarily unavailable or rate-limited. Wait a moment and try again.');
-    }
-    return null;
-}
-// ─── Preflight helpers ──────────────────────────────────────────────────────
-// All checks below run before any server call so a local misconfiguration
-// (bad template source, unwritable directory, …) fails fast before it creates
-// a MAAF app + GRS repo on the server. The git presence + version
-// check lives in `Utils/GitVersionChecker.ts`.
-// ────────────────────────────────────────────────────────────────────────────
-export function ensureTemplateSourceValid(source) {
-    // Delegates to the github-only parser in DownloadTemplate. The parser throws
-    // `UsageError` for any unsupported shape (non-`github:` prefix, malformed
-    // URL, missing owner/repo) — which is what preflight wants: surface the
-    // problem before any server call. We discard the parsed result; the real
-    // download path re-parses at call time.
-    parseGithubTemplate(source);
-}
-export function ensureTargetDirectoryEmpty(appDir) {
-    // Scaffolding into a non-empty directory would mix the template with the
-    // user's files, and initLocalRepo's `git remote set-url` fallback would
-    // silently replace an existing `origin` remote. Called twice: once in
-    // preflight (fail fast before any network) and once right before
-    // createAsync (catch a TOCTOU race where the dir gets populated during
-    // routing/option resolution).
-    if (!fs.existsSync(appDir))
-        return;
-    const entries = fs.readdirSync(appDir);
-    if (entries.length > 0) {
-        throw new UsageError(`'${appDir}' is not empty. Specify an empty directory as the first argument, or run 'ms app init' to bind an existing project to a new app.`);
-    }
-}
-export function ensureRepoTargetDirectoryEmpty(appDir) {
-    // --repo variant: empty-dir is mandatory. `git clone` refuses non-empty
-    // destinations and we don't destructively wipe local files. To bind an
-    // existing local project to a new MAAF app, use `ms app init` instead.
-    // Called twice (preflight + just-before-createAsync) for the same TOCTOU
-    // reasons as ensureTargetDirectoryEmpty.
-    if (!fs.existsSync(appDir))
-        return;
-    const entries = fs.readdirSync(appDir);
-    if (entries.length > 0) {
-        throw new UsageError(`'${appDir}' is not empty. --repo requires an empty target directory; specify an empty directory as the first argument, move to one before running, or run 'ms app init' to bind an existing project to a new app.`);
-    }
-}
-/**
- * Cheap pre-network probe to detect a non-empty remote BEFORE createAsync runs.
- *
- * Implementation: partial clone (`--depth=1 --filter=blob:none --no-checkout`)
- * into an OS temp dir, then `git ls-tree -r HEAD`. The clone pulls refs + the
- * tip commit + its tree objects only — no blob bytes, no working tree — so the
- * bandwidth on the rejection path is tens of KB even for a multi-GB repo. The
- * temp dir is removed in `finally`.
- *
- * Failure semantics:
- *   - Non-empty tree at HEAD → throws `UsageError` with the "is not empty" /
- *     "ms app init" actionable lead, BEFORE createAsync. Nothing created.
- *   - Empty tree (incl. the cleaned-up-repo edge case: commit1 add, commit2
- *     delete all) → ls-tree returns no lines → returns without throwing.
- *   - Clone fails with a recognizable access/auth signature (private repo
- *     hidden as "not found", missing local credentials, 403, …) → throws
- *     `ConfigurationError` BEFORE createAsync so we never create a server-side
- *     app the user can't clone.
- *   - Any other git error (network blip, server doesn't support --filter,
- *     temp-fs hiccup, …) → swallow and return (fail OPEN). The subsequent
- *     cloneRepo surfaces the friendlier message for the user-facing failure;
- *     we don't want this probe to become a parallel error-message surface.
- */
-export function ensureExternalRepoIsEmpty(repoUrl) {
-    let probeDir;
-    try {
-        probeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ms-app-create-probe-'));
-    }
-    catch {
-        // Can't make a temp dir → punt. Real cloneRepo will surface any actionable
-        // issue (writable-fs, etc.) on the subsequent attempt.
-        return;
-    }
-    try {
-        const probeClone = runGit(['clone', '--depth=1', '--filter=blob:none', '--no-checkout', repoUrl, probeDir], { allowFailure: true, emitStderr: false });
-        if (!probeClone.success) {
-            // Clone failed. When git reports a recognizable access/auth failure
-            // (a private repo hidden as "not found", missing local credentials, a
-            // 403, etc.) fail FAST here — before createAsync — so we never create a
-            // server-side app the user can't clone. For ambiguous or
-            // transient errors (server doesn't support --filter, network blip, a
-            // temp-fs hiccup, …) stay fail-OPEN and let the later cloneRepo surface
-            // the friendlier, fuller message.
-            const stderr = probeClone.stderr;
-            if (isGitCloneAccessFailure(stderr)) {
-                // Clean user-facing message; raw git detail kept on errorData for
-                // telemetry/debug. The probe clone is silent (stderr piped, not
-                // inherited), so we don't echo the confusing internal probe command.
-                throw new ConfigurationError(buildGitHubAccessPreflightErrorMessage(repoUrl), {
-                    underlyingError: getUnderlyingCloneError(probeClone.error, stderr),
-                });
-            }
-            return;
-        }
-        const lsTree = runGit(['-C', probeDir, 'ls-tree', '-r', 'HEAD'], {
-            captureStdout: true,
-            allowFailure: true,
-            emitStderr: false,
-        });
-        if (!lsTree.success) {
-            // Truly empty repo (no commits, no HEAD): ls-tree errors. Treat as empty
-            // so create proceeds; cloneRepo of a no-commits remote produces an empty
-            // working tree, which is the happy path.
-            return;
-        }
-        const lsTreeOutput = lsTree.stdout;
-        if (lsTreeOutput.trim().length > 0) {
-            // `ls-tree -r HEAD` enumerates every tracked path — including hidden
-            // ones (.gitignore, .gitattributes, etc.). Any tracked file at all
-            // means the repo isn't a valid binding target for a fresh app.
-            throw new UsageError(`Repository ${repoUrl} is not empty (must contain no tracked files of any kind, including hidden files like .gitignore, .gitattributes, README, or LICENSE). Choose a different repository to create an app or run 'ms app init' to update the existing app.`);
-        }
-    }
-    finally {
-        try {
-            fs.rmSync(probeDir, { recursive: true, force: true });
-        }
-        catch {
-            // Best-effort cleanup; a leftover temp dir is acceptable.
-        }
-    }
-}
-export function ensureTargetDirectoryWritable(appDir) {
-    // Probe write permission on the target dir (or its nearest existing
-    // ancestor, where mkdirSync will need to write). Catches read-only mounts
-    // and permission-denied locations before any server-side resource is
-    // created. The empty-dir check is intentionally NOT here — it runs inline
-    // just before initLocalRepo so the TOCTOU window between check and write
-    // stays as small as possible (a directory can become non-empty while the
-    // routing/createAsync calls are in flight).
-    //
-    // Best-effort caveat: `accessSync(W_OK)` is a syscall-level approximation,
-    // not a real write. On Windows in particular, NTFS ACL inheritance can grant
-    // W_OK on the ancestor while the actual CreateDirectory / CreateFile fails
-    // later (UAC virtualization, parent ACE applies but a deny ACE on the leaf
-    // does not). We accept that: catching every Windows ACL edge case requires
-    // a real mkdir+write+delete probe, which leaves debris on success and has
-    // its own TOCTOU. The recovery hint on post-create failures is the
-    // backstop when the probe is too optimistic.
-    let probe = appDir;
-    while (!fs.existsSync(probe)) {
-        const parent = path.dirname(probe);
-        if (parent === probe)
-            break;
-        probe = parent;
-    }
-    try {
-        fs.accessSync(probe, fs.constants.W_OK);
-    }
-    catch {
-        throw new ConfigurationError(`'${appDir}' is not writable. Choose a different directory or fix the permissions and retry.`);
-    }
-}
-function createOptionSchema(argumentProvider) {
-    argumentProvider.setDescription(HelpStrings.app.create.description);
-    argumentProvider.addExamples(HelpStrings.app.create.examples);
-    argumentProvider.consumePositionalArg('[directory]');
-    argumentProvider.addOptions([
-        {
-            flags: {
-                key: CreateMaafAppArguments.EnvironmentId.name,
-                alias: CreateMaafAppArguments.EnvironmentId.alias,
-            },
-            env: CreateMaafAppArguments.EnvironmentId.envVar,
-            description: HelpStrings.app.create.options.environmentId,
-            optionalInNonInteractive: true,
-        },
-        createDefaultStringOption({
-            flags: {
-                key: CreateMaafAppArguments.DisplayName.name,
-                alias: CreateMaafAppArguments.DisplayName.alias,
-            },
-            env: CreateMaafAppArguments.DisplayName.envVar,
-            message: CreateMaafAppArguments.DisplayName.promptMessage,
-            description: HelpStrings.app.create.options.displayName,
-        }),
-        {
-            flags: {
-                key: CreateMaafAppArguments.Description.name,
-                alias: CreateMaafAppArguments.Description.alias,
-            },
-            env: CreateMaafAppArguments.Description.envVar,
-            description: HelpStrings.app.create.options.description,
-            optionalInNonInteractive: true,
-        },
-        {
-            flags: {
-                key: CreateMaafAppArguments.RepositoryId.name,
-                alias: CreateMaafAppArguments.RepositoryId.alias,
-            },
-            env: CreateMaafAppArguments.RepositoryId.envVar,
-            description: HelpStrings.app.create.options.repositoryId,
-            optionalInNonInteractive: true,
-        },
-        {
-            flags: {
-                key: CreateMaafAppArguments.Template.name,
-                alias: CreateMaafAppArguments.Template.alias,
-            },
-            env: CreateMaafAppArguments.Template.envVar,
-            default: DEFAULT_TEMPLATE,
-            description: HelpStrings.app.create.options.template,
-            optionalInNonInteractive: true,
-        },
-        {
-            // No short alias for --repo yet; see VerbConstants.CreateMaafAppArguments.Repo.
-            flags: {
-                key: CreateMaafAppArguments.Repo.name,
-            },
-            env: CreateMaafAppArguments.Repo.envVar,
-            description: HelpStrings.app.create.options.repo,
-            optionalInNonInteractive: true,
-        },
-        createDefaultStringOption({
-            flags: {
-                key: CreateMaafAppArguments.BuildPath.name,
-                alias: CreateMaafAppArguments.BuildPath.alias,
-            },
-            env: CreateMaafAppArguments.BuildPath.envVar,
-            message: CreateMaafAppArguments.BuildPath.promptMessage,
-            initialValue: CreateMaafAppArguments.BuildPath.initialValue,
-            default: './dist',
-            description: HelpStrings.app.create.options.buildPath,
-        }),
-        createDefaultStringOption({
-            flags: {
-                key: CreateMaafAppArguments.BuildCommand.name,
-                alias: CreateMaafAppArguments.BuildCommand.alias,
-            },
-            env: CreateMaafAppArguments.BuildCommand.envVar,
-            message: CreateMaafAppArguments.BuildCommand.promptMessage,
-            initialValue: CreateMaafAppArguments.BuildCommand.initialValue,
-            default: 'npm run build',
-            description: HelpStrings.app.create.options.buildCommand,
-        }),
-        createDefaultStringOption({
-            flags: {
-                key: CreateMaafAppArguments.BuildEntryPoint.name,
-            },
-            env: CreateMaafAppArguments.BuildEntryPoint.envVar,
-            message: CreateMaafAppArguments.BuildEntryPoint.promptMessage,
-            initialValue: CreateMaafAppArguments.BuildEntryPoint.initialValue,
-            default: 'index.html',
-            description: HelpStrings.app.create.options.buildEntryPoint,
-        }),
-    ]);
-    argumentProvider.addSwitch({
-        flags: { key: CreateMaafAppArguments.OpenBrowser.name },
-        description: HelpStrings.app.create.options.openBrowser,
-    });
-    argumentProvider.addSwitch({
-        flags: { key: CreateMaafAppArguments.ForceReauth.name },
-        description: HelpStrings.app.create.options.forceReauth,
-    });
-}
-//# sourceMappingURL=CreateMaafApp.js.map