@microsoft/managed-apps-cli 0.5.0 → 0.7.0

package/dist/HttpClient/CliHttpClient.js

@@ -1,20 +1,26 @@
 /*!
  * Copyright (C) Microsoft Corporation. All rights reserved.
  */
-import { encodeBody, HttpClientError, parseServerErrorCode } from '@microsoft/managed-apps-common/services';
+import { encodeBody, HttpClientError, parseServerErrorCode, } from '@microsoft/managed-apps-common/services';
 import { randomUUID } from 'crypto';
 import { getSettings } from '../CliSettings.js';
-import { MS_CLIENT_REQUESTID } from '../Constants.js';
+import { MS_AUTH_RESOURCE, MS_CLIENT_REQUESTID, MS_TARGET_URL } from '../Constants.js';
 import { enhanceNetworkError } from '../Utils/EnhanceNetworkError.js';
 import { CliSpinner } from '../Utils/Spinner.js';
 export class CliHttpClient {
     _authenticationProvider;
-    _urlProxies;
+    _forwardUrl;
     _inflight = 0;
     _spinner = new CliSpinner();
-    constructor(_authenticationProvider, _urlProxies = []) {
+    /**
+     * @param _authenticationProvider — provides bearer tokens for `authResource`-tagged requests.
+     * @param _forwardUrl — when set, every request is forwarded to this URL with the original
+     *   URL surfaced via the `x-ms-target-url` header and the resource audience (if any) via
+     *   `x-ms-auth-resource`. Used for proxy / dev-tunnel scenarios.
+     */
+    constructor(_authenticationProvider, _forwardUrl) {
         this._authenticationProvider = _authenticationProvider;
-        this._urlProxies = _urlProxies;
+        this._forwardUrl = _forwardUrl;
     }
     async get(url, config) {
         return this._sendRequestAsync(url, 'GET', config);
@@ -37,7 +43,10 @@ export class CliHttpClient {
             const headers = config?.headers || {};
             if (config?.authResource) {
                 const token = await this._authenticationProvider.getAccessTokenForResource(config.authResource);
-                headers.Authorization = `Bearer ${token}`;
+                // Forward mode supplies an optional static token; omit Authorization when blank.
+                if (token) {
+                    headers.Authorization = `Bearer ${token}`;
+                }
             }
             if (config?.contentType) {
                 headers['Content-Type'] = config.contentType;
@@ -46,26 +55,36 @@ export class CliHttpClient {
                 headers['Content-Type'] = 'application/json';
             }
             headers[MS_CLIENT_REQUESTID] = randomUUID();
+            let targetUrl = url;
+            if (this._forwardUrl) {
+                headers[MS_TARGET_URL] = url;
+                if (config?.authResource) {
+                    headers[MS_AUTH_RESOURCE] = config.authResource;
+                }
+                targetUrl = this._forwardUrl;
+            }
             const bodyContent = encodeBody(config?.body, headers['Content-Type']);
             const requestOptions = {
                 method,
                 headers,
                 body: bodyContent,
             };
-            for (const proxy of this._urlProxies) {
-                url = await proxy.proxy(url);
-            }
-            const response = await fetch(url, requestOptions);
-            if (!response.ok) {
+            const response = await fetch(targetUrl, requestOptions);
+            if (!response.ok && !config?.allowErrorResponse) {
                 const correlationId = response.headers.get('x-ms-correlation-id');
                 const correlationSuffix = correlationId ? ` (correlation ID: ${correlationId})` : '';
                 const errorBody = await response.text();
-                throw new HttpClientError(`HTTP error status: ${response.status} for ${method} ${url}${correlationSuffix}: ${errorBody}`, {
+                // In forward mode the response came from the forwarder, not the
+                // original target — surface both so it's clear which hop failed.
+                const urlSuffix = this._forwardUrl ? `${url} via ${this._forwardUrl}` : url;
+                throw new HttpClientError(`HTTP error status: ${response.status} for ${method} ${urlSuffix}${correlationSuffix}: ${errorBody}`, {
                     status: response.status,
                     code: parseServerErrorCode(errorBody),
                     body: errorBody,
                 });
             }
+            // When allowErrorResponse is true and we got a non-2xx, fall through to parse the body
+            // so callers can inspect the structured error envelope (e.g. { error: { code, message } }).
             const data = await this._parseResponse(response);
             return {
                 data,
@@ -74,7 +93,8 @@ export class CliHttpClient {
             };
         }
         catch (error) {
-            throw enhanceNetworkError(error, method, url);
+            const errorUrl = this._forwardUrl ? `${url} via ${this._forwardUrl}` : url;
+            throw enhanceNetworkError(error, method, errorUrl);
         }
         finally {
             this._stopSpinner();

package/dist/HttpClient/CliHttpClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"CliHttpClient.js","sourceRoot":"","sources":["../../src/HttpClient/CliHttpClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC5G,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,MAAM,OAAO,aAAa;IAKd;IACA;IALF,SAAS,GAAG,CAAC,CAAC;IACd,QAAQ,GAAG,IAAI,UAAU,EAAE,CAAC;IAEpC,YACU,uBAAgD,EAChD,cAA2B,EAAE;QAD7B,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,gBAAW,GAAX,WAAW,CAAkB;IACpC,CAAC;IAEG,KAAK,CAAC,GAAG,CACd,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACM,KAAK,CAAC,IAAI,CACf,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACM,KAAK,CAAC,KAAK,CAChB,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IACM,KAAK,CAAC,GAAG,CACd,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACM,KAAK,CAAC,MAAM,CACjB,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,GAAW,EACX,MAAc,EACd,MAAsB;QAEtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;YAEtC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,yBAAyB,CACxE,MAAM,CAAC,YAAY,CACpB,CAAC;gBACF,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YAC5C,CAAC;YAED,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;gBACxB,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;YAC/C,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC/C,CAAC;YAED,OAAO,CAAC,mBAAmB,CAAC,GAAG,UAAU,EAAE,CAAC;YAE5C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;YAEtE,MAAM,cAAc,GAIhB;gBACF,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,WAAW;aAClB,CAAC;YAEF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrC,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,cAA6B,CAAC,CAAC;YAEjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBAClE,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,qBAAqB,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,IAAI,eAAe,CACvB,sBAAsB,QAAQ,CAAC,MAAM,QAAQ,MAAM,IAAI,GAAG,GAAG,iBAAiB,KAAK,SAAS,EAAE,EAC9F;oBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC;oBACrC,IAAI,EAAE,SAAS;iBAChB,CACF,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAI,QAAQ,CAAC,CAAC;YAEpD,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC;aACxD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAI,QAAkB;QAChD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE3C,6CAA6C;QAC7C,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,IAAS,CAAC;QACnB,CAAC;aAAM,IAAI,WAAW,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,YAAiB,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,OAAgB;QAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"CliHttpClient.js","sourceRoot":"","sources":["../../src/HttpClient/CliHttpClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,EACL,UAAU,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,OAAO,aAAa;IAWd;IACA;IAXF,SAAS,GAAG,CAAC,CAAC;IACd,QAAQ,GAAG,IAAI,UAAU,EAAE,CAAC;IAEpC;;;;;OAKG;IACH,YACU,uBAAgD,EAChD,WAAoB;QADpB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,gBAAW,GAAX,WAAW,CAAS;IAC3B,CAAC;IAEG,KAAK,CAAC,GAAG,CACd,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACM,KAAK,CAAC,IAAI,CACf,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACM,KAAK,CAAC,KAAK,CAChB,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IACM,KAAK,CAAC,GAAG,CACd,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACM,KAAK,CAAC,MAAM,CACjB,GAAW,EACX,MAAsB;QAEtB,OAAO,IAAI,CAAC,iBAAiB,CAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,GAAW,EACX,MAAc,EACd,MAAsB;QAEtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;YAEtC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,yBAAyB,CACxE,MAAM,CAAC,YAAY,CACpB,CAAC;gBACF,iFAAiF;gBACjF,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;gBACxB,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;YAC/C,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC/C,CAAC;YAED,OAAO,CAAC,mBAAmB,CAAC,GAAG,UAAU,EAAE,CAAC;YAE5C,IAAI,SAAS,GAAG,GAAG,CAAC;YACpB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBAC7B,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;oBACzB,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;gBAClD,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;YAC/B,CAAC;YAED,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;YAEtE,MAAM,cAAc,GAIhB;gBACF,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,WAAW;aAClB,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,cAA6B,CAAC,CAAC;YAEvE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBAChD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBAClE,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,qBAAqB,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5E,MAAM,IAAI,eAAe,CACvB,sBAAsB,QAAQ,CAAC,MAAM,QAAQ,MAAM,IAAI,SAAS,GAAG,iBAAiB,KAAK,SAAS,EAAE,EACpG;oBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC;oBACrC,IAAI,EAAE,SAAS;iBAChB,CACF,CAAC;YACJ,CAAC;YAED,uFAAuF;YACvF,4FAA4F;YAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAI,QAAQ,CAAC,CAAC;YAEpD,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC;aACxD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3E,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAI,QAAkB;QAChD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE3C,6CAA6C;QAC7C,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,IAAS,CAAC;QACnB,CAAC;aAAM,IAAI,WAAW,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,YAAiB,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,OAAgB;QAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/Logger/ConsoleWriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConsoleWriter.d.ts","sourceRoot":"","sources":["../../src/Logger/ConsoleWriter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAoBnE,qBAAa,aAAc,YAAW,gBAAgB;IAC7C,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI/D,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI5D,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7D,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI;IAInE,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAIhE,0BAA0B,CAAC,YAAY,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI;IAItF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;CAG9D"}
+{"version":3,"file":"ConsoleWriter.d.ts","sourceRoot":"","sources":["../../src/Logger/ConsoleWriter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAsBnE,qBAAa,aAAc,YAAW,gBAAgB;IAC7C,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI/D,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI5D,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7D,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI;IAInE,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAIhE,0BAA0B,CAAC,YAAY,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI;IAItF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;CAG9D"}

package/dist/Logger/ConsoleWriter.js

@@ -1,20 +1,20 @@
 /*!
  * Copyright (C) Microsoft Corporation. All rights reserved.
  */
-import chalk from 'chalk';
+import { styleText } from 'node:util';
 /* eslint-disable @typescript-eslint/no-explicit-any */
 // Logger function factory
-function loggerFn(color, log = console.log.bind(console)) {
+function loggerFn(format, log = console.log.bind(console)) {
     return (scenarioName, ...data) => {
         const time = new Date().toISOString().split('T')[1];
-        const prefix = `${chalk.gray(time)}: [${color(scenarioName)}]: `;
+        const prefix = `${styleText('gray', time)}: [${styleText(format, scenarioName)}]: `;
         log(prefix, ...data);
     };
 }
-const activity = loggerFn(chalk.white.bold);
-const scenario = loggerFn(chalk.cyan.bold);
-const error = loggerFn(chalk.red.bold, console.error.bind(console));
-const warn = loggerFn(chalk.yellow.bold);
+const activity = loggerFn(['white', 'bold']);
+const scenario = loggerFn(['cyan', 'bold']);
+const error = loggerFn(['red', 'bold'], console.error.bind(console));
+const warn = loggerFn(['yellow', 'bold']);
 export class ConsoleWriter {
     trackActivityEvent(eventName, eventData) {
         activity(eventName, eventData || {});

package/dist/Logger/ConsoleWriter.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConsoleWriter.js","sourceRoot":"","sources":["../../src/Logger/ConsoleWriter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,uDAAuD;AACvD,0BAA0B;AAC1B,SAAS,QAAQ,CACf,KAAkB,EAClB,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;IAE/B,OAAO,CAAC,YAAoB,EAAE,GAAG,IAAW,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC;QACjE,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAEzC,MAAM,OAAO,aAAa;IACjB,kBAAkB,CAAC,SAAiB,EAAE,SAAkB;QAC7D,QAAQ,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAEM,eAAe,CAAC,SAAiB,EAAE,SAAkB;QAC1D,KAAK,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAEM,aAAa,CAAC,YAAoB,EAAE,SAAkB;QAC3D,QAAQ,CAAC,oBAAoB,YAAY,EAAE,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAEM,gBAAgB,CAAC,YAAoB,EAAE,YAAqB;QACjE,QAAQ,CAAC,uBAAuB,YAAY,EAAE,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAEM,cAAc,CAAC,YAAoB,EAAE,WAAoB;QAC9D,KAAK,CAAC,sBAAsB,YAAY,EAAE,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAEM,0BAA0B,CAAC,YAAoB,EAAE,qBAA8B;QACpF,IAAI,CAAC,gCAAgC,YAAY,EAAE,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAEM,KAAK;QACV,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEM,kBAAkB,CAAC,IAAY,EAAE,MAAc;QACpD,2BAA2B;IAC7B,CAAC;CACF;AACD,sDAAsD"}
+{"version":3,"file":"ConsoleWriter.js","sourceRoot":"","sources":["../../src/Logger/ConsoleWriter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAMtC,uDAAuD;AACvD,0BAA0B;AAC1B,SAAS,QAAQ,CACf,MAAmB,EACnB,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;IAE/B,OAAO,CAAC,YAAoB,EAAE,GAAG,IAAW,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC;QACpF,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1C,MAAM,OAAO,aAAa;IACjB,kBAAkB,CAAC,SAAiB,EAAE,SAAkB;QAC7D,QAAQ,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAEM,eAAe,CAAC,SAAiB,EAAE,SAAkB;QAC1D,KAAK,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAEM,aAAa,CAAC,YAAoB,EAAE,SAAkB;QAC3D,QAAQ,CAAC,oBAAoB,YAAY,EAAE,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAEM,gBAAgB,CAAC,YAAoB,EAAE,YAAqB;QACjE,QAAQ,CAAC,uBAAuB,YAAY,EAAE,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAEM,cAAc,CAAC,YAAoB,EAAE,WAAoB;QAC9D,KAAK,CAAC,sBAAsB,YAAY,EAAE,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAEM,0BAA0B,CAAC,YAAoB,EAAE,qBAA8B;QACpF,IAAI,CAAC,gCAAgC,YAAY,EAAE,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAEM,KAAK;QACV,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEM,kBAAkB,CAAC,IAAY,EAAE,MAAc;QACpD,2BAA2B;IAC7B,CAAC;CACF;AACD,sDAAsD"}

package/dist/Middletier/FunctionsBundler.d.ts

@@ -0,0 +1,17 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import type { DiscoveredFunction } from './PackFunctions.js';
+/**
+ * Bundles each discovered function entry point to ESM JavaScript using esbuild.
+ * Returns a Map keyed by the function's `relPath` (same key as
+ * {@link DiscoveredFunction.relPath}) with the bundled JS source as the value.
+ *
+ * esbuild is imported dynamically (`await import('esbuild')`) so the CLI can be
+ * shipped into environments that mark esbuild `--external` and supply their own.
+ */
+export declare function bundleFunctionsAsync(args: {
+    projectRoot: string;
+    functions: readonly DiscoveredFunction[];
+}): Promise<Map<string, string>>;
+//# sourceMappingURL=FunctionsBundler.d.ts.map

package/dist/Middletier/FunctionsBundler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FunctionsBundler.d.ts","sourceRoot":"","sources":["../../src/Middletier/FunctionsBundler.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AA2B1D;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC1C,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2C/B"}

package/dist/Middletier/FunctionsBundler.js

@@ -0,0 +1,165 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import * as path from 'node:path';
+import { AppError } from '../Errors/CliError.js';
+/**
+ * Maps the browser-SDK specifiers that generated/customer code imports to the
+ * workerd-SDK specifiers that survive into the bundled output. esbuild uses
+ * this map for two things:
+ *   - `alias`: rewrites every key to its value during resolution.
+ *   - `external`: marks every value as external so the import statement is
+ *     left intact in the bundle and resolved at workerd instantiation time.
+ *
+ * The allowlist plugin also derives from this map (see {@link ALLOWED_PACKAGES}),
+ * so this is the single source of truth — the three derived uses stay in sync
+ * automatically.
+ */
+const MIDDLETIER_PACKAGE_ALIAS_MAP = {
+    '@microsoft/managed-apps/data': '@microsoft/managed-apps-functions/data',
+};
+/**
+ * Specifier the externalized `generated/dataSources` import gets rewritten to.
+ * The functions-runtime registers a workerd `json` module under this name with
+ * the pack's `dataSources.json` as its content, so every customer bundle reads
+ * the data sources from a single shared file instead of inlining a per-bundle
+ * copy of the ~16KB config blob.
+ */
+const DATA_SOURCES_MODULE = '@config/dataSources';
+/**
+ * Bundles each discovered function entry point to ESM JavaScript using esbuild.
+ * Returns a Map keyed by the function's `relPath` (same key as
+ * {@link DiscoveredFunction.relPath}) with the bundled JS source as the value.
+ *
+ * esbuild is imported dynamically (`await import('esbuild')`) so the CLI can be
+ * shipped into environments that mark esbuild `--external` and supply their own.
+ */
+export async function bundleFunctionsAsync(args) {
+    const { projectRoot, functions } = args;
+    if (functions.length === 0)
+        return new Map();
+    // `.catch` so a missing-esbuild error gets a clear, actionable message
+    // instead of the raw module-resolution failure surfacing to the user.
+    const esbuild = await import('esbuild').catch((err) => {
+        throw new AppError(`esbuild is required to pack functions but could not be loaded: ${err.message}`);
+    });
+    // esbuild's Go worker pool parallelises within a single `build()`, but
+    // running per-file builds in parallel still lets us overlap plugin
+    // callbacks and JS-side work. esbuild self-bounds concurrency internally,
+    // so we don't need our own semaphore.
+    const entries = await Promise.all(functions.map(async (fn) => {
+        const result = await esbuild.build({
+            entryPoints: [fn.absPath],
+            bundle: true,
+            write: false,
+            format: 'esm',
+            platform: 'neutral',
+            target: 'es2022',
+            external: [...Object.values(MIDDLETIER_PACKAGE_ALIAS_MAP), DATA_SOURCES_MODULE],
+            alias: MIDDLETIER_PACKAGE_ALIAS_MAP,
+            // Plugin order matters — `dataSourcesPlugin` returns first so the
+            // allowlist never sees the externalised `@config/dataSources` rewrite
+            // and the resolved-path lookup for `generated/dataSources.ts` short-
+            // circuits before the allowlist would have admitted it via the
+            // `generated/` rule.
+            plugins: [dataSourcesPlugin(projectRoot), allowlistPlugin(projectRoot)],
+            logLevel: 'silent',
+        });
+        const output = result.outputFiles?.[0];
+        if (!output) {
+            throw new AppError(`Failed to bundle function ${fn.relPath}: esbuild produced no output`);
+        }
+        return [fn.relPath, output.text];
+    }));
+    return new Map(entries);
+}
+/**
+ * esbuild `onResolve` plugin that intercepts the codegen-emitted
+ * `import dataSources from '../dataSources'` (or any path resolving to
+ * `<projectRoot>/generated/dataSources.<ext>`) and rewrites it to the
+ * canonical {@link DATA_SOURCES_MODULE} specifier, marked external. The
+ * functions-runtime supplies the resolved value at workerd config time as a
+ * `json` module embedded from the pack's `dataSources.json`, so a single
+ * shared copy is read by every function instead of the ~16KB config map
+ * being inlined into each bundle.
+ *
+ * Matching is by resolved file path (not import-specifier string) so codegen
+ * layout changes that move the file or alter the relative-path shape don't
+ * break the substitution.
+ */
+function dataSourcesPlugin(projectRoot) {
+    // Codegen always emits `generated/dataSources.ts`; specifier is extensionless
+    // (`../dataSources`), so we resolve the relative path and tack on `.ts` to
+    // get the candidate filesystem location, then compare.
+    const target = path.resolve(projectRoot, 'generated/dataSources.ts');
+    return {
+        name: 'external-data-sources',
+        setup(build) {
+            build.onResolve({ filter: /(^|\/)dataSources$/ }, (args) => {
+                if (!args.path.startsWith('.'))
+                    return null;
+                const resolved = path.resolve(path.dirname(args.importer), args.path) + '.ts';
+                if (resolved !== target)
+                    return null;
+                return { path: DATA_SOURCES_MODULE, external: true };
+            });
+        },
+    };
+}
+/**
+ * esbuild `onResolve` plugin that fails the build when customer code imports
+ * anything outside the allowlist. Two categories pass:
+ *
+ * - Relative imports that resolve inside the project's `generated/` folder.
+ * - Bare specifiers exactly matching an entry in {@link ALLOWED_PACKAGES}.
+ *
+ * esbuild applies `alias` substitution *after* `onResolve` plugins run, so the
+ * incoming `args.path` is always the pre-alias specifier.
+ */
+function allowlistPlugin(projectRoot) {
+    const generatedDir = path.resolve(projectRoot, 'generated');
+    return {
+        name: 'allowlist-imports',
+        setup(build) {
+            build.onResolve({ filter: /.*/ }, (args) => {
+                if (args.kind === 'entry-point')
+                    return null;
+                if (args.path.startsWith('.')) {
+                    const resolved = path.resolve(path.dirname(args.importer), args.path);
+                    if (resolved.startsWith(generatedDir + path.sep)) {
+                        return null;
+                    }
+                    return {
+                        errors: [
+                            {
+                                text: `Relative import '${args.path}' is outside the allowed 'generated/' folder`,
+                            },
+                        ],
+                    };
+                }
+                /**
+                 * The exact module specifiers customer/generated code is allowed to import
+                 * from outside the project's `generated/` folder. Anything else — arbitrary
+                 * npm packages, `node:*` built-ins, other scopes, deeper subpaths — is a
+                 * build error.
+                 *
+                 * esbuild applies `alias` substitution *after* `onResolve` plugins run, so the
+                 * allowlist matches the pre-alias specifier (the map key), not the post-alias
+                 * target.
+                 */
+                if (MIDDLETIER_PACKAGE_ALIAS_MAP[args.path])
+                    return null;
+                return {
+                    errors: [
+                        {
+                            text: `Import '${args.path}' is not on the allowlist. Allowed: relative imports into 'generated/' and ${Object.keys(MIDDLETIER_PACKAGE_ALIAS_MAP)
+                                .map((p) => `'${p}'`)
+                                .join(', ')}.`,
+                        },
+                    ],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=FunctionsBundler.js.map

package/dist/Middletier/FunctionsBundler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FunctionsBundler.js","sourceRoot":"","sources":["../../src/Middletier/FunctionsBundler.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C;;;;;;;;;;;GAWG;AACH,MAAM,4BAA4B,GAA2B;IAC3D,8BAA8B,EAAE,wCAAwC;CACzE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAG1C;IACC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACxC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAE7C,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;QAC3D,MAAM,IAAI,QAAQ,CAChB,kEAAkE,GAAG,CAAC,OAAO,EAAE,CAChF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,mEAAmE;IACnE,0EAA0E;IAC1E,sCAAsC;IACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;YACjC,WAAW,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC;YACzB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,EAAE,mBAAmB,CAAC;YAC/E,KAAK,EAAE,4BAA4B;YACnC,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,+DAA+D;YAC/D,qBAAqB;YACrB,OAAO,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,WAAW,CAAC,CAAC;YACvE,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,6BAA6B,EAAE,CAAC,OAAO,8BAA8B,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAU,CAAC;IAC5C,CAAC,CAAC,CACH,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,8EAA8E;IAC9E,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;IAErE,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,KAAkB;YACtB,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBAC9E,IAAI,QAAQ,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC;gBACrC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAE5D,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,KAAK,CAAC,KAAkB;YACtB,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzC,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;oBAAE,OAAO,IAAI,CAAC;gBAE7C,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBACtE,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBACjD,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,OAAO;wBACL,MAAM,EAAE;4BACN;gCACE,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,8CAA8C;6BAClF;yBACF;qBACF,CAAC;gBACJ,CAAC;gBAED;;;;;;;;;mBASG;gBACH,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAEzD,OAAO;oBACL,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,WACJ,IAAI,CAAC,IACP,8EAA8E,MAAM,CAAC,IAAI,CACvF,4BAA4B,CAC7B;iCACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;iCACpB,IAAI,CAAC,IAAI,CAAC,GAAG;yBACjB;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/Middletier/PackFunctions.d.ts

@@ -0,0 +1,52 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import type { FunctionRoute, FunctionsPackage } from '@microsoft/managed-apps-common/types';
+/** Filename of the functions archive written next to manifest.json. */
+export declare const FUNCTIONS_ARCHIVE_NAME = "functions.zip";
+/** Archive format/compression embedded in the manifest. Standard zip uses DEFLATE. */
+export declare const FUNCTIONS_ARCHIVE_DESCRIPTOR: Omit<FunctionsPackage, 'path'>;
+/** A single `.ts` function discovered under `functions.baseDirectory`. */
+export interface DiscoveredFunction {
+    /** Path relative to `functions.baseDirectory`, with forward slashes. Includes `.ts` suffix. */
+    relPath: string;
+    /** Absolute path to the source file on disk. */
+    absPath: string;
+}
+/**
+ * Recursively walks `baseDirectory` and returns every `.ts` file beneath it.
+ *
+ * The directory must exist; callers are expected to have validated this via
+ * {@link assertFunctionsDirectoryExists}. An existing directory containing no
+ * `.ts` files returns an empty array — that case maps to "skip packing" per the
+ * pack spec, not an error.
+ */
+export declare function discoverFunctionsAsync(baseDirectory: string): Promise<DiscoveredFunction[]>;
+export declare function assertFunctionsDirectoryExists(baseDirectory: string): Promise<void>;
+/**
+ * Builds the `routes` entries for compiled functions. The key is the basename
+ * of `functions.baseDirectory` joined with the function's path relative to
+ * that directory (`.ts` stripped); `path` is the same string with `.js`. Both
+ * mirror the entry's location inside the archive.
+ */
+export declare function buildFunctionRoutes(functions: readonly DiscoveredFunction[], baseDirName: string): Record<string, FunctionRoute>;
+/**
+ * Builds a zip Buffer containing one bundled `.js` per discovered `.ts` source
+ * (mirroring the source layout under `<baseDirName>/`), plus the generated
+ * `manifest.json` and — when present — `dataSources.json`.
+ *
+ * `bundles` is a Map keyed by `DiscoveredFunction.relPath` whose value is the
+ * bundled JS source from {@link bundleFunctionsAsync}. Every discovered function
+ * must have a corresponding bundle; missing entries throw.
+ *
+ * Returning a `Buffer` (vs. streaming to disk) lets callers use `fsp.writeFile`,
+ * which keeps the implementation testable under memfs.
+ */
+export declare function buildFunctionsArchiveAsync(args: {
+    baseDirName: string;
+    functions: readonly DiscoveredFunction[];
+    bundles: ReadonlyMap<string, string>;
+    manifestContent: string;
+    dataSourcesJson: string | undefined;
+}): Promise<Buffer>;
+//# sourceMappingURL=PackFunctions.d.ts.map

package/dist/Middletier/PackFunctions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackFunctions.d.ts","sourceRoot":"","sources":["../../src/Middletier/PackFunctions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAK5F,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD,sFAAsF;AACtF,eAAO,MAAM,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAGvE,CAAC;AAEF,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,+FAA+F;IAC/F,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAKjG;AA6BD,wBAAsB,8BAA8B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,kBAAkB,EAAE,EACxC,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAU/B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BlB"}

package/dist/Middletier/PackFunctions.js

@@ -0,0 +1,122 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import * as fsp from 'node:fs/promises';
+import * as path from 'node:path';
+import archiver from 'archiver';
+import { ConfigurationError } from '../Errors/CliError.js';
+/** Filename of the functions archive written next to manifest.json. */
+export const FUNCTIONS_ARCHIVE_NAME = 'functions.zip';
+/** Archive format/compression embedded in the manifest. Standard zip uses DEFLATE. */
+export const FUNCTIONS_ARCHIVE_DESCRIPTOR = {
+    archive: 'zip',
+    compression: 'deflate',
+};
+/**
+ * Recursively walks `baseDirectory` and returns every `.ts` file beneath it.
+ *
+ * The directory must exist; callers are expected to have validated this via
+ * {@link assertFunctionsDirectoryExists}. An existing directory containing no
+ * `.ts` files returns an empty array — that case maps to "skip packing" per the
+ * pack spec, not an error.
+ */
+export async function discoverFunctionsAsync(baseDirectory) {
+    const results = [];
+    await walkAsync(baseDirectory, '', results);
+    results.sort((a, b) => a.relPath.localeCompare(b.relPath));
+    return results;
+}
+async function walkAsync(absDir, relDir, out) {
+    const entries = await fsp.readdir(absDir, { withFileTypes: true });
+    for (const entry of entries) {
+        const entryRel = relDir ? `${relDir}/${entry.name}` : entry.name;
+        const entryAbs = path.join(absDir, entry.name);
+        if (entry.isDirectory()) {
+            await walkAsync(entryAbs, entryRel, out);
+        }
+        else if (entry.isFile() && isFunctionSourceFile(entry.name)) {
+            out.push({ relPath: entryRel, absPath: entryAbs });
+        }
+    }
+}
+/**
+ * `.ts` files that are part of the function surface. Skips type declarations
+ * (`.d.ts` — no runtime) and unit-test files (`.test.ts` / `.spec.ts` — not
+ * functions, and the common JS ecosystem convention is to co-locate them).
+ */
+function isFunctionSourceFile(name) {
+    return (name.endsWith('.ts') &&
+        !name.endsWith('.d.ts') &&
+        !name.endsWith('.test.ts') &&
+        !name.endsWith('.spec.ts'));
+}
+export async function assertFunctionsDirectoryExists(baseDirectory) {
+    let stat;
+    try {
+        stat = await fsp.stat(baseDirectory);
+    }
+    catch {
+        throw new ConfigurationError(`functions.baseDirectory does not exist: ${baseDirectory}`);
+    }
+    if (!stat.isDirectory()) {
+        throw new ConfigurationError(`functions.baseDirectory is not a directory: ${baseDirectory}`);
+    }
+}
+/**
+ * Builds the `routes` entries for compiled functions. The key is the basename
+ * of `functions.baseDirectory` joined with the function's path relative to
+ * that directory (`.ts` stripped); `path` is the same string with `.js`. Both
+ * mirror the entry's location inside the archive.
+ */
+export function buildFunctionRoutes(functions, baseDirName) {
+    const routes = {};
+    for (const fn of functions) {
+        const routeKey = `${baseDirName}/${stripTsExtension(fn.relPath)}`;
+        routes[routeKey] = {
+            type: 'function',
+            path: `${routeKey}.js`,
+        };
+    }
+    return routes;
+}
+function stripTsExtension(relPath) {
+    return relPath.slice(0, -'.ts'.length);
+}
+/**
+ * Builds a zip Buffer containing one bundled `.js` per discovered `.ts` source
+ * (mirroring the source layout under `<baseDirName>/`), plus the generated
+ * `manifest.json` and — when present — `dataSources.json`.
+ *
+ * `bundles` is a Map keyed by `DiscoveredFunction.relPath` whose value is the
+ * bundled JS source from {@link bundleFunctionsAsync}. Every discovered function
+ * must have a corresponding bundle; missing entries throw.
+ *
+ * Returning a `Buffer` (vs. streaming to disk) lets callers use `fsp.writeFile`,
+ * which keeps the implementation testable under memfs.
+ */
+export async function buildFunctionsArchiveAsync(args) {
+    const { baseDirName, functions, bundles, manifestContent, dataSourcesJson } = args;
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        const archive = archiver('zip', { zlib: { level: 9 } });
+        archive.on('data', (chunk) => chunks.push(chunk));
+        archive.on('warning', reject);
+        archive.on('error', reject);
+        archive.on('end', () => resolve(Buffer.concat(chunks)));
+        for (const fn of functions) {
+            const bundled = bundles.get(fn.relPath);
+            if (bundled === undefined) {
+                reject(new Error(`Missing bundled output for function ${fn.relPath}`));
+                return;
+            }
+            const routeKey = stripTsExtension(fn.relPath);
+            archive.append(bundled, { name: `${baseDirName}/${routeKey}.js` });
+        }
+        archive.append(manifestContent, { name: 'manifest.json' });
+        if (dataSourcesJson !== undefined) {
+            archive.append(dataSourcesJson, { name: 'dataSources.json' });
+        }
+        void archive.finalize();
+    });
+}
+//# sourceMappingURL=PackFunctions.js.map

package/dist/Middletier/PackFunctions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackFunctions.js","sourceRoot":"","sources":["../../src/Middletier/PackFunctions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAEtD,sFAAsF;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAmC;IAC1E,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,SAAS;CACvB,CAAC;AAUF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAChE,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,GAAyB;IAChF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC1B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,aAAqB;IACxE,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,2CAA2C,aAAa,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,+CAA+C,aAAa,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAwC,EACxC,WAAmB;IAEnB,MAAM,MAAM,GAAkC,EAAE,CAAC;IACjD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,gBAAgB,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,QAAQ,CAAC,GAAG;YACjB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,QAAQ,KAAK;SACvB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAMhD;IACC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAEnF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAExD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,WAAW,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAE3D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/Types/Cli.types.d.ts

@@ -4,13 +4,54 @@
 import type { AppConfig } from '@microsoft/managed-apps-common/config';
 import type { Region } from '@microsoft/managed-apps-common/services';
 import type { CliFS } from '../FS/CliFs.js';
+export interface CachedAccount {
+    /** MSAL home account ID (`<oid>.<tid>`). Stable across email changes; the canonical key. */
+    homeAccountId: string;
+    /** UPN / email — what we show to the user. */
+    username: string;
+    /** True if this is the account currently used by silent token acquisition. */
+    isActive: boolean;
+}
+/**
+ * Acquires access tokens for authenticated CLI calls. Every auth mode (interactive MSAL,
+ * service principal, HTTP forward) implements this — it's the lowest common denominator.
+ */
 export interface IAuthenticationProvider {
     initAsync(region: Region): Promise<void>;
     getAccessTokenForResource(resource: string, loginHint?: string): Promise<string>;
     getUserTenantId(): string | undefined;
-    /** Returns the cached account email without triggering interactive login. */
+    /** Returns the active cached account email without triggering interactive login. */
     getCachedAccountAsync(): Promise<string | undefined>;
 }
+/**
+ * Manages the local cache of signed-in accounts: list, switch, remove, add. Only the
+ * interactive MSAL provider supports this. Service principal and HTTP forward modes don't
+ * have a "cached account" concept, so they don't implement this interface and the
+ * `auth login`/`logout`/`status`/`switch` verbs refuse to run in those modes.
+ */
+export interface IAccountManager {
+    /** Returns every cached account, marking which one is currently active. */
+    listCachedAccountsAsync(): Promise<CachedAccount[]>;
+    /**
+     * Marks `accountKey` (a username or homeAccountId) as the active account.
+     * Throws if no cached account matches. Returns the resolved account.
+     */
+    setActiveAccountAsync(accountKey: string): Promise<CachedAccount>;
+    /**
+     * Forces an interactive browser sign-in for `resource`. Used by `auth login` so users
+     * can add a new account even when one is already cached. Writes the signed-in account
+     * as the active one.
+     */
+    loginInteractiveAsync(resource: string, loginHint?: string): Promise<CachedAccount>;
+    /**
+     * Removes every cached account and the active-account pointer. Backs `auth logout`.
+     * Routing through the account manager (rather than `fs.rmSync` directly in the verb)
+     * lets non-interactive auth modes refuse the call uniformly via the standard
+     * `getAccountManager()` UsageError. Returns `true` when something was cleared and
+     * `false` when no cached state existed.
+     */
+    clearCacheAsync(): Promise<boolean>;
+}
 export type CliSettings = {
     source: 'pac-cli' | 'standalone';
     interactive: boolean;

package/dist/Types/Cli.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Cli.types.d.ts","sourceRoot":"","sources":["../../src/Types/Cli.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yCAAyC,CAAC;AAEtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,eAAe,IAAI,MAAM,GAAG,SAAS,CAAC;IACtC,6EAA6E;IAC7E,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACtD;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,SAAS,GAAG,YAAY,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAC;IAChB,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC"}
+{"version":3,"file":"Cli.types.d.ts","sourceRoot":"","sources":["../../src/Types/Cli.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yCAAyC,CAAC;AAEtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,aAAa,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,eAAe,IAAI,MAAM,GAAG,SAAS,CAAC;IACtC,oFAAoF;IACpF,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,uBAAuB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACpD;;;OAGG;IACH,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAClE;;;;OAIG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpF;;;;;;OAMG;IACH,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,SAAS,GAAG,YAAY,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAC;IAChB,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC"}

package/dist/Types/Command.types.d.ts

@@ -33,7 +33,7 @@ export interface NounDef {
  * - Index access with an unvalidated string is a compile-time error
  * Update this union whenever a noun is added to or removed from COMMAND_TREE.
  */
-export type NounKey = 'auth' | 'app' | 'connector' | 'telemetry';
+export type NounKey = 'auth' | 'app' | 'connector' | 'git' | 'telemetry';
 /**
  * The full command tree (noun → verb → [type →] command).
  *

package/dist/Types/Command.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Command.types.d.ts","sourceRoot":"","sources":["../../src/Types/Command.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,yEAAyE;AACzE,MAAM,MAAM,cAAc,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnF,uEAAuE;AACvE,MAAM,MAAM,WAAW,GAAG,SAAS,MAAM,EAAE,CAAC;AAI5C,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,IAAI,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC1C;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,GAAG,KAAK,IAAI,YAAY,CAE1F;AAED,yDAAyD;AACzD,MAAM,WAAW,OAAO;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;CACzD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,WAAW,CAAC;AAEjE;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,IAAI,EAAE,WAAW,CAAC;IAClB,qCAAqC;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"Command.types.d.ts","sourceRoot":"","sources":["../../src/Types/Command.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,yEAAyE;AACzE,MAAM,MAAM,cAAc,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnF,uEAAuE;AACvE,MAAM,MAAM,WAAW,GAAG,SAAS,MAAM,EAAE,CAAC;AAI5C,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,IAAI,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC1C;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,GAAG,KAAK,IAAI,YAAY,CAE1F;AAED,yDAAyD;AACzD,MAAM,WAAW,OAAO;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;CACzD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,GAAG,WAAW,CAAC;AAEzE;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,IAAI,EAAE,WAAW,CAAC;IAClB,qCAAqC;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;CACxB"}