@microsoft/managed-apps-cli 0.7.0 → 0.9.0

package/dist/Verbs/CreateMaafApp.js

@@ -1,25 +1,24 @@
 /*!
  * Copyright (C) Microsoft Corporation. All rights reserved.
  */
-import { authenticateForRepoAsync, createAsync, getPlayerServiceConfig, GrsServerError, updateEnvironmentName, writeRepoConfig, } from '@microsoft/managed-apps-actions';
+import { createAsync, getPlayerServiceConfig, updateEnvironmentName, writeRepoConfig, } from '@microsoft/managed-apps-actions';
 import { AppConfigFileName } from '@microsoft/managed-apps-common/config';
-import { getUserRoutingEnvironmentAsync } from '@microsoft/managed-apps-common/services';
+import { getUserRoutingEnvironmentAsync, regionToCloudSafe, } from '@microsoft/managed-apps-common/services';
 import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import { downloadTemplate } from 'giget';
+import * as os from 'os';
 import * as path from 'path';
-import { getCliLogger } from '../CliSettings.js';
-import { createDefaultStringOption } from '../CliUtils.js';
+import { getCliLogger, getSettings } from '../CliSettings.js';
+import { createDefaultStringOption, resolveEnvironmentId } from '../CliUtils.js';
 import { CLI_CLIENT_ID } from '../Constants.js';
 import { CLI_BINARY_NAME } from '../Constants/CliConstants.js';
 import { HelpStrings } from '../Constants/HelpStrings.js';
 import { AppError, ConfigurationError, UsageError } from '../Errors/CliError.js';
-import { mapGitHubServerErrorToCliError, matchGitHubAuthError } from '../Errors/GitHubErrorMap.js';
 import { printInfo, printJsonLine, printJsonSuccess, printSuccess, printWarning, } from '../Utils/ConsoleOutput.js';
+import { withGitHubDcfRecoveryAsync } from '../Utils/DcfRecovery.js';
 import { resolveRoutingEnvironmentIdAsync } from '../Utils/EnvironmentRoutingUtils.js';
 import { buildGcmConfig } from '../Utils/GitCredentialConfig.js';
-import { ConsoleGitHubDcfDisplay, JsonGitHubDcfDisplay } from '../Utils/GitHubDcfFlow.js';
-import { computeRepoHash, parseGitHubRepoUrl } from '../Utils/RepoUrl.js';
 import { CreateMaafAppArguments } from './VerbConstants.js';
 const DEFAULT_TEMPLATE = 'github:microsoft/Managed-Apps/templates/vite8';
 /**
@@ -34,8 +33,8 @@ const REPO_NONE_SENTINEL = 'none';
  * Maps the raw `--repo` flag value to a `(repoType, remoteUrl)` pair.
  * - omitted / empty → `native` (default GRS-backed flow)
  * - `none` (case-insensitive) → `none` (no GRS, no local setup)
- * - any other non-empty value → `github` (external GHE binding, value flows through as
- *   `remoteUrl` to the action and the eventual git clone)
+ * - any other non-empty value → `github` (external GitHub binding — `*.ghe.com` or `github.com`;
+ *   value flows through as `remoteUrl` to the action and the eventual git clone)
  *
  * Runtime invariant: `remoteUrl` is set iff `repoType === 'github'`. Consumers
  * branch on `repoType` and assert `remoteUrl!` at github use sites — see
@@ -55,7 +54,7 @@ export function parseRepoOption(rawRepoValue) {
  *
  * Three repo flows, selected by `--repo`:
  * - `native` (default): server auto-provisions a GRS repo; local clone happens via GCM.
- * - `github`: external GHE Cloud binding. Clones the user's repo locally. On the first
+ * - `github`: external GitHub binding (`*.ghe.com` or `github.com`). Clones the user's repo locally. On the first
  *   `createAsync` call, a missing/expired server-side GitHub identity mapping is
  *   recoverable in-band: a single inline DCF run + exactly one `createAsync` retry.
  *   Any other error — or a second mapping failure after DCF — is a hard fail.
@@ -96,15 +95,25 @@ export async function createMaafAppAsync(argumentProvider) {
     // stdout free of prose ahead of the envelope. `printError` writes to
     // stderr and is unaffected.
     const jsonMode = argumentProvider.isJsonMode();
-    // Identity confirmation: print the tenant + region we're targeting before
+    // Identity confirmation: print the tenant + cloud we're targeting before
     // anything else — preflight, routing, createAsync — so a user with multiple
     // accounts signed in has the longest possible window to CTRL-C before any
     // local check runs or server call fires. Environment id isn't known yet
     // (routing is what resolves it); included in the success line at the end.
     // Wording is intentionally tentative ("About to create…") so a preflight
     // failure on the next line doesn't read as contradicting a "Creating…" line.
+    //
+    // Surface `cloud` (user-facing, e.g. `public` / `usgov`) instead of `region`
+    // (internal, e.g. `prod` / `gccmoderate`) so the value matches what the user
+    // typed on `--cloud`. Regions without a Cloud equivalent (`preview`, `ex`,
+    // `rx`, or developer modes `local` / `dev`) fall back to the raw region —
+    // these don't reach this print via the current `cloudToRegion(this._cloud)`
+    // chain in ArgumentProvider, so the fallback is defensive against future
+    // code paths (e.g. routing-resolved regions).
     if (!jsonMode) {
-        printInfo(`About to create app '${displayName}' in tenant ${tenantId} (region ${region}).`);
+        const cloud = regionToCloudSafe(region);
+        const target = cloud ? `cloud ${cloud}` : `region ${region}`;
+        printInfo(`About to create app '${displayName}' in tenant ${tenantId} (${target}).`);
     }
     // ─── Preflight ────────────────────────────────────────────────────────────
     // Run all local-only checks before any server call. Once createAsync
@@ -142,23 +151,31 @@ export async function createMaafAppAsync(argumentProvider) {
         // RepoSelection is a flat interface (not a discriminated union), so `remoteUrl`
         // doesn't auto-narrow to `string` here even though the github branch guarantees it.
         ensureRepoTargetDirectoryEmpty(appDir);
-        // Validate --repo as a *.ghe.com URL before any network call. Throws
-        // UsageError ("not a valid GitHub Enterprise Cloud URL") for
-        // `github.com/...` and other non-GHE hosts, malformed URIs, etc. — mirrors
-        // `git auth refresh`'s up-front check.
-        parseGitHubRepoUrl(remoteUrl);
+        // Pre-network: cheap partial clone into a temp dir + ls-tree HEAD to detect
+        // a non-empty remote before createAsync runs. Catches the rejection case
+        // without leaving an orphaned server-side app or scaffolded files in
+        // appDir. Cheapest probe shape: --depth=1 --filter=blob:none --no-checkout
+        // pulls refs + the tip commit + its tree(s) only (no blob bytes, no working
+        // tree). On any probe error (network, auth, server doesn't support partial
+        // clone, etc.) we swallow and let the subsequent cloneRepo emit its
+        // friendlier error — see ensureExternalRepoIsEmpty for the rationale.
+        ensureExternalRepoIsEmpty(remoteUrl);
     }
     else {
         ensureTargetDirectoryEmpty(appDir);
     }
     // ─── End preflight ────────────────────────────────────────────────────────
     // The debug env-var override (MS_CLI_MAAF_DEBUG_ENVIRONMENT_ID) is honored by ArgumentProvider
-    // and surfaced via getEnvironmentId(). When set, skip the routing API call entirely.
-    // For the supported user flow, getEnvironmentId() returns undefined here and routing fires.
-    const preResolvedEnvironmentId = argumentProvider.getEnvironmentId();
+    // and surfaced via getEnvironmentId(). The shared `resolveEnvironmentId` helper checks the
+    // `--environment-id` flag first, then falls back to that. When set, skip the automatic
+    // environment-selection API call entirely. Without an explicit id, getEnvironmentId() returns
+    // undefined and the automatic environment lookup runs.
+    const preResolvedEnvironmentId = await resolveEnvironmentId(argumentProvider, {
+        failIfMissing: false,
+    });
     // Fire off PDE routing in parallel with the remaining option prompts. The result is awaited
     // immediately before createAsync, so prompt latency is hidden behind the network call.
-    // Skipped entirely when the debug override pre-resolved the env id.
+    // Skipped entirely when the env id is pre-resolved (--environment-id flag or debug override).
     const routingEnvPromise = preResolvedEnvironmentId
         ? undefined
         : getUserRoutingEnvironmentAsync(httpClient, tenantId, CLI_CLIENT_ID, { provisionDataverse: false }, region, logger);
@@ -195,11 +212,14 @@ export async function createMaafAppAsync(argumentProvider) {
     else {
         ensureTargetDirectoryEmpty(appDir);
     }
-    // Read --no-browser alongside --json so the recovery DCF helper has both
+    // Read --open-browser alongside --json so the recovery DCF helper has both
     // inputs ready without a second async option read inside the catch block.
     // Commander converts kebab-case flag names to camelCase property keys;
-    // the camelName constant keeps this lookup in sync with NoBrowser.name.
-    const noBrowser = (await argumentProvider.getOption(CreateMaafAppArguments.NoBrowser.camelName, 
+    // the camelName constant keeps this lookup in sync with OpenBrowser.name.
+    const openBrowser = (await argumentProvider.getOption(CreateMaafAppArguments.OpenBrowser.camelName, 
+    /* ignorePrompt */ true)) ?? false;
+    // Forces DCF re-authentication even when a valid mapping exists.
+    const forceReauth = (await argumentProvider.getOption(CreateMaafAppArguments.ForceReauth.camelName, 
     /* ignorePrompt */ true)) ?? false;
     // JSON mode (github flow only): emit a structured `create-validation` event
     // right before the server call so automation parsing NDJSON sees the
@@ -210,95 +230,44 @@ export async function createMaafAppAsync(argumentProvider) {
     if (jsonMode && repoType === 'github') {
         printJsonLine({ phase: 'create-validation' });
     }
-    // Hoisted so the first attempt and the post-DCF retry share the exact same
-    // action payload — no risk of the two calls drifting apart and no per-call
-    // object rebuild.
-    const actionsParams = {
+    // Hoisted so the fixed-shape params are defined once and reused across the
+    // first attempt and the post-DCF retry. `forceReauth` is injected per-call
+    // via `isRetry` so the retry does not re-trigger the server-side mapping
+    // bypass against the just-refreshed mapping.
+    const baseActionsParams = {
         displayName,
         description,
         repositoryId,
         remoteUrl,
         repoType,
+        origin: getSettings().origin,
     };
-    const runCreate = () => createAsync({
+    const runCreate = ({ isRetry, }) => createAsync({
         tenantId,
         environmentId,
         logger,
-        actionsParams,
+        actionsParams: {
+            ...baseActionsParams,
+            ...(forceReauth && !isRetry && { forceReauth: true }),
+        },
+    });
+    // On `repoType: 'github'`, wrap createAsync with the DCF catch-and-retry:
+    // a missing/expired GitHub identity mapping is recovered in-band by running
+    // DCF and retrying once; any other recognized server error is mapped to a
+    // friendly CLI error. Non-github flows pass through untouched. See
+    // `withGitHubDcfRecoveryAsync` for the full contract.
+    const createResult = await withGitHubDcfRecoveryAsync(runCreate, {
+        repoType,
+        externalRepoUrl: remoteUrl,
+        tenantId,
+        jsonMode,
+        openBrowser,
+        verb: 'app create',
     });
-    // Inline catch-and-retry for recoverable GitHub auth errors. On the github
-    // flow, a missing/expired GitHub identity mapping is recoverable in-band by
-    // running the DCF wrapper inline against
-    // the same GRS environment, then retrying createAsync exactly once. Any
-    // other recognized GrsServerError — on either the first attempt or the
-    // post-DCF retry — is mapped via mapGitHubServerErrorToCliError before
-    // being rethrown so the user sees a friendly CLI-typed error rather than
-    // the raw server payload. Any second mapping-missing/expired after DCF —
-    // and anything not recognized at all — escapes as a hard failure (single-retry
-    // contract; we never loop).
-    let createResult;
-    try {
-        createResult = await runCreate();
-    }
-    catch (err) {
-        if (repoType !== 'github')
-            throw err;
-        const matched = matchGitHubAuthError(err);
-        if (!matched) {
-            if (err instanceof GrsServerError) {
-                const mapped = mapGitHubServerErrorToCliError({
-                    code: err.code,
-                    message: err.message,
-                    status: err.status,
-                    details: err.details,
-                }, { repoUrl: remoteUrl, verb: 'app create' });
-                if (mapped)
-                    throw mapped;
-            }
-            throw err;
-        }
-        await runDcfRecoveryAsync({
-            remoteUrl: remoteUrl,
-            tenantId,
-            jsonMode,
-            noBrowser,
-            verb: 'app create',
-        });
-        try {
-            createResult = await runCreate();
-        }
-        catch (retryErr) {
-            const remapped = matchGitHubAuthError(retryErr);
-            if (remapped) {
-                // Single-retry contract: a second mapping-missing/expired surfaces
-                // as a hard AuthenticationError with the standard remediation
-                // pointer. We deliberately do NOT loop DCF — repeated failures
-                // suggest the user can't complete the device-code flow (denied,
-                // wrong account, app uninstalled, etc.) and another loop would
-                // just hang.
-                const mapped = mapGitHubServerErrorToCliError(remapped.payload, {
-                    repoUrl: remoteUrl,
-                    verb: 'app create',
-                });
-                throw mapped ?? retryErr;
-            }
-            if (retryErr instanceof GrsServerError) {
-                const mapped = mapGitHubServerErrorToCliError({
-                    code: retryErr.code,
-                    message: retryErr.message,
-                    status: retryErr.status,
-                    details: retryErr.details,
-                }, { repoUrl: remoteUrl, verb: 'app create' });
-                if (mapped)
-                    throw mapped;
-            }
-            throw retryErr;
-        }
-    }
     const { app, cloneUrl } = createResult;
     // Only the `native` flow expects a GRS clone URL — it's the origin for the first
     // local push to the auto-provisioned platform-managed repo. `github` binds an
-    // external GHE repo (no GRS) and `none` is by-design source-control-free, so neither
+    // external GitHub repo (no GRS) and `none` is by-design source-control-free, so neither
     // produces a `cloneUrl`. Missing on `native` is a server bug — the hoisted check
     // below guards both the pretty-output `(clone URL: undefined)` and JSON-envelope
     // `gitRemoteUrl: undefined` failure modes that would otherwise leak through.
@@ -317,21 +286,30 @@ export async function createMaafAppAsync(argumentProvider) {
     //   - github: clone the user's external repo, sanity-check it's empty,
     //             overlay the template, then write ms.config.json.
     //   - none:   no git, no clone — mkdir -p, overlay the template, write ms.config.json.
+    let pushOutcome = null;
     try {
         if (repoType === 'github') {
-            // External GitHub Enterprise path: clone the developer's repo. Auth flows through
+            // External GitHub path: clone the developer's repo. Auth flows through
             // the user's existing git credential setup (gh, GCM browser OAuth, SSH key, PAT,
             // x509 client cert, etc.); the CLI does not inject any tokens at this layer (the
             // Microsoft GitHub App is server-side only per the MAAF GitHub Integration design
-            // doc Requirement 1).
+            // doc Requirement 1). The post-clone empty-check that used to live here moved
+            // to the preflight (ensureExternalRepoIsEmpty), so by the time we get here the
+            // remote is known to be empty and the clone produces an empty working tree.
             cloneRepo({ directory: appDir, repoUrl: remoteUrl });
-            // Post-clone sanity: --repo at P1 expects an empty GHE repo we can scaffold the
-            // template into. If the cloned working tree already has content (existing project,
-            // README, LICENSE, etc.), `ms app init` is the path that handles binding an existing
-            // project to a new MAAF app — bail with that pointer instead of overwriting files.
+            // Safety net: the pre-network probe (ensureExternalRepoIsEmpty) is fail-OPEN
+            // on errors (e.g. os.tmpdir() inaccessible, server doesn't support partial
+            // clone). When that happens, the actual cloneRepo may have pulled content
+            // we missed. One last readdirSync of appDir guarantees we don't silently
+            // overlay the template onto the user's files.
+            // The repo must be _completely_ empty — including hidden / dotfiles like
+            // .gitignore, .gitattributes, README, LICENSE, .git-credentials, etc.
+            // We only filter `.git` itself (the internal directory created by clone);
+            // any other entry, hidden or not, means the user has prior content here.
             const workingTreeEntries = fs.readdirSync(appDir).filter((entry) => entry !== '.git');
             if (workingTreeEntries.length > 0) {
-                throw new UsageError(`Repository ${remoteUrl} is not empty. Choose a different repository to create an app or run 'ms app init' to update the existing app.`);
+                throw new UsageError(`Repository ${remoteUrl} is not empty (must contain no files of any kind, including hidden files like .gitignore, .gitattributes, README, or LICENSE). Choose a different repository to create an app or run 'ms app init' to update the existing app.\n\n` +
+                    buildOrphanedAppRecoveryHint(app.id, app.environmentId));
             }
         }
         else if (repoType === 'native') {
@@ -364,12 +342,22 @@ export async function createMaafAppAsync(argumentProvider) {
             // key off `repoType` instead of a placeholder value.
             ...(repoType === 'native' && { repositoryId: app.repositoryId }),
             repoType,
+            // externalRepoUrl is persisted only for github-bound apps so that post-create verbs
+            // (build, deploy) know which GitHub host to authenticate against during inline DCF
+            // recovery without re-prompting the user for the URL.
+            ...(repoType === 'github' && { externalRepoUrl: remoteUrl }),
             cloud: argumentProvider.getCloud(),
             buildPath: buildPath ?? './dist',
             buildCommand: buildCommand ?? 'npm run build',
             buildEntryPoint: buildEntryPoint ?? 'index.html',
         };
         await writeRepoConfig(path.join(appDir, AppConfigFileName), config);
+        // Auto commit + push for git-backed flows (native + github). The `none` flow
+        // has no remote, so it's skipped. Push failure is non-fatal — see the warning
+        // path in commitAndPushScaffoldAsync.
+        if (repoType !== 'none') {
+            pushOutcome = await commitAndPushScaffoldAsync(appDir, jsonMode);
+        }
     }
     catch (setupError) {
         // UsageError carries already-actionable messages (e.g. "repo already contains an
@@ -385,15 +373,16 @@ export async function createMaafAppAsync(argumentProvider) {
         // also written to ms.config.json — used by every subsequent CLI command
         // (build, deploy, info, etc.). `gitRemoteUrl` is the GRS clone URL and is only
         // present for the `native` flow (the only flow that auto-provisions a
-        // platform-managed git repo). `externalRepoUrl` is the user-supplied GHE URL and
-        // only appears in the `github` flow. `repoType` is always emitted so automation
-        // can detect which source-control mode the app was created in.
+        // platform-managed git repo). `externalRepoUrl` is the user-supplied external
+        // GitHub URL and only appears in the `github` flow. `repoType` is always emitted so
+        // automation can detect which source-control mode the app was created in.
         printJsonSuccess({
             appId: app.id,
             repoType,
             ...(repoType === 'github' && remoteUrl && { externalRepoUrl: remoteUrl }),
             ...(repoType === 'native' && cloneUrl && { gitRemoteUrl: cloneUrl }),
             appDir,
+            ...(pushOutcome && { push: pushOutcome }),
         });
     }
     else {
@@ -408,7 +397,63 @@ export async function createMaafAppAsync(argumentProvider) {
     }
 }
 /**
- * Clones the developer's external repo (GitHub Enterprise Cloud in v1) into `directory`.
+ * Commits the scaffolded files and pushes to the remote. Called by both `native`
+ * and `github` flows after writeRepoConfig.
+ *
+ * Failure is non-fatal: prints a warning with the retry command and returns
+ * `{ success: false, ... }`. The server-side app and local scaffold are unchanged.
+ *
+ * `stdio: ['ignore', 'ignore', 'inherit']`:
+ *   - stdin ignored: child can't prompt for input (would block forever).
+ *   - stdout ignored: discards git's progress prose so pretty output stays clean.
+ *   - stderr inherited: git's actual error messages reach the user's terminal
+ *     so they see git's own context alongside our warning.
+ *
+ * Commit identity (user.name / user.email) is read by git itself from
+ * local-then-global config — we pass nothing. Missing identity surfaces as
+ * git's own descriptive commit error through the inherited stderr.
+ */
+export async function commitAndPushScaffoldAsync(appDir, jsonMode) {
+    // Full add+commit+push sequence: any of the three commands may have been the
+    // one that failed (e.g. `git commit` errors when user.name/user.email aren't
+    // set), so re-running just `git push` wouldn't recover. The sequence is
+    // idempotent: rerunning `git add .` and `git commit` on an already-committed
+    // state either no-ops or errors with "nothing to commit", in which case
+    // `git push` still pushes the existing commit.
+    const retryCommand = `git add . && git commit -m "Initial scaffold from 'ms app create'" && git push -u origin HEAD`;
+    try {
+        execFileSync('git', ['add', '.'], {
+            cwd: appDir,
+            stdio: ['ignore', 'ignore', 'inherit'],
+        });
+        execFileSync('git', ['commit', '-m', "Initial scaffold from 'ms app create'"], {
+            cwd: appDir,
+            stdio: ['ignore', 'ignore', 'inherit'],
+        });
+        execFileSync('git', ['push', '-u', 'origin', 'HEAD'], {
+            cwd: appDir,
+            stdio: ['ignore', 'ignore', 'inherit'],
+        });
+        return { success: true };
+    }
+    catch (err) {
+        // Capture the entire error structurally — name + message + stack for
+        // Error instances, spread of own properties otherwise. JSON.stringify
+        // would otherwise drop Error's non-enumerable fields and emit `{}`.
+        const errorPayload = err instanceof Error
+            ? { name: err.name, message: err.message, stack: err.stack }
+            : typeof err === 'object' && err !== null
+                ? { ...err }
+                : { message: String(err) };
+        if (!jsonMode) {
+            printWarning(`Could not commit and push the initial scaffold. Your app and local scaffold are ready. ` +
+                `To finish wiring it up, run:\n    ${retryCommand}`);
+        }
+        return { success: false, error: errorPayload, retryCommand };
+    }
+}
+/**
+ * Clones the developer's external GitHub repo (`*.ghe.com` tenant or `github.com`) into `directory`.
  * Auth flows through the user's existing git credential setup — the CLI does not inject
  * tokens here. On failure, surfaces a CLI-friendly error pointing the user at the
  * GitHub App install prerequisite; git's own stderr is preserved (stdio: inherit) so
@@ -639,6 +684,73 @@ export function ensureRepoTargetDirectoryEmpty(appDir) {
         throw new UsageError(`'${appDir}' is not empty. --repo requires an empty target directory; specify an empty directory as the first argument or move to one before running.`);
     }
 }
+/**
+ * Cheap pre-network probe to detect a non-empty remote BEFORE createAsync runs.
+ *
+ * Implementation: partial clone (`--depth=1 --filter=blob:none --no-checkout`)
+ * into an OS temp dir, then `git ls-tree -r HEAD`. The clone pulls refs + the
+ * tip commit + its tree objects only — no blob bytes, no working tree — so the
+ * bandwidth on the rejection path is tens of KB even for a multi-GB repo. The
+ * temp dir is removed in `finally`.
+ *
+ * Failure semantics — fail-OPEN:
+ *   - Non-empty tree at HEAD → throws `UsageError` with the "is not empty" /
+ *     "ms app init" actionable lead, BEFORE createAsync. No orphan, no leak.
+ *   - Empty tree (incl. the cleaned-up-repo edge case: commit1 add, commit2
+ *     delete all) → ls-tree returns no lines → returns without throwing.
+ *   - Any error from git itself (auth, network blip, server doesn't support
+ *     --filter, repo doesn't exist, etc.) → swallow and return. The subsequent
+ *     cloneRepo will surface a friendlier message for the user-facing failure;
+ *     we don't want this probe to become a parallel error-message surface.
+ */
+export function ensureExternalRepoIsEmpty(repoUrl) {
+    let probeDir;
+    try {
+        probeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ms-app-create-probe-'));
+    }
+    catch {
+        // Can't make a temp dir → punt. Real cloneRepo will surface any actionable
+        // issue (writable-fs, etc.) on the subsequent attempt.
+        return;
+    }
+    try {
+        try {
+            execFileSync('git', ['clone', '--depth=1', '--filter=blob:none', '--no-checkout', repoUrl, probeDir], { stdio: ['ignore', 'ignore', 'ignore'] });
+        }
+        catch {
+            // Clone itself failed (auth, network, repo not found, server doesn't
+            // support partial clone, etc.). Fail open: the user-facing error will
+            // come from the later cloneRepo which has the friendlier messaging.
+            return;
+        }
+        let lsTreeOutput;
+        try {
+            lsTreeOutput = execFileSync('git', ['-C', probeDir, 'ls-tree', '-r', 'HEAD'], {
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).toString();
+        }
+        catch {
+            // Truly empty repo (no commits, no HEAD): ls-tree errors. Treat as empty
+            // so create proceeds; cloneRepo of a no-commits remote produces an empty
+            // working tree, which is the happy path.
+            return;
+        }
+        if (lsTreeOutput.trim().length > 0) {
+            // `ls-tree -r HEAD` enumerates every tracked path — including hidden
+            // ones (.gitignore, .gitattributes, etc.). Any tracked file at all
+            // means the repo isn't a valid binding target for a fresh app.
+            throw new UsageError(`Repository ${repoUrl} is not empty (must contain no tracked files of any kind, including hidden files like .gitignore, .gitattributes, README, or LICENSE). Choose a different repository to create an app or run 'ms app init' to update the existing app.`);
+        }
+    }
+    finally {
+        try {
+            fs.rmSync(probeDir, { recursive: true, force: true });
+        }
+        catch {
+            // Best-effort cleanup; a leftover temp dir is acceptable.
+        }
+    }
+}
 export function ensureTargetDirectoryWritable(appDir) {
     // Probe write permission on the target dir (or its nearest existing
     // ancestor, where mkdirSync will need to write). Catches read-only mounts
@@ -670,136 +782,20 @@ export function ensureTargetDirectoryWritable(appDir) {
         throw new ConfigurationError(`'${appDir}' is not writable. Choose a different directory or fix the permissions and retry.`);
     }
 }
-/**
- * Inline DCF recovery branch for the github catch-and-retry: only the
- * `github` flow ever calls this — `native` and `none` have no GitHub identity
- * mapping to refresh. SIGINT handling is scoped to this helper (registered
- * and removed inside the `try/finally`) so Ctrl+C during the device-code
- * polling loop doesn't leak a listener back to the verb's outer body. Server
- * errors thrown by `authenticateForRepoAsync` are mapped through
- * {@link mapGitHubServerErrorToCliError} before being rethrown so the verb's
- * outer catch (and the single-retry contract) sees CLI-typed errors.
- */
-async function runDcfRecoveryAsync(options) {
-    const { remoteUrl, tenantId, jsonMode, noBrowser, verb } = options;
-    // Re-parse here rather than threading the parsed components through every
-    // catch-and-retry call: preflight already validated the URL shape, so this
-    // is a cheap string-split on a rare path.
-    const { host, owner, repo } = parseGitHubRepoUrl(remoteUrl);
-    const repoHash = computeRepoHash(owner, repo);
-    const logger = getCliLogger();
-    // Telemetry: PII-safe — host is the parsed string, repoHash is a truncated
-    // SHA256. Emit Start at the top so a recovery that never reaches the retry
-    // (e.g. user denied auth) is still observable.
-    logger.trackActivityEvent('Maaf.Create.GitHubDcfRecovery', {
-        repoHost: host,
-        repoHash,
-    });
-    if (!jsonMode) {
-        printInfo('GitHub authentication is required to bind this repository.');
-    }
-    const display = composeRecoveryDisplay({ isJson: jsonMode, noBrowser });
-    // SIGINT plumbing: a Ctrl+C during the (potentially 15-minute) polling
-    // loop drops us out cleanly rather than leaving a dangling promise.
-    // Scoped to the recovery block only — createAsync itself doesn't take a
-    // signal yet.
-    const controller = new AbortController();
-    const onSigint = () => {
-        controller.abort();
-    };
-    process.once('SIGINT', onSigint);
-    try {
-        // The resolved auth result (githubLogin, mappingExpiresAt, etc.) is
-        // intentionally discarded: the retry path below doesn't need it — it
-        // just needs the server-side identity mapping to now exist so the next
-        // `createAsync` call clears the 401.
-        await authenticateForRepoAsync({
-            remoteUrl: `https://${host}/${owner}/${repo}`,
-            tenantId,
-            logger,
-            display,
-            // Browser launch is gated by the `display` object selected above:
-            // `composeRecoveryDisplay` returns a display whose `openVerificationUri`
-            // is undefined when `noBrowser` is true. `skipBrowser` here is the
-            // legacy lower-level kill-switch the action exposes; we hardcode it
-            // to false so the display contract is the single source of truth.
-            skipBrowser: false,
-            signal: controller.signal,
-        });
-    }
-    catch (error) {
-        // Telemetry: pair the Start event with a Failed event on every error path
-        // so a recovery that throws (DCF declined, server error, abort) still
-        // shows up as a closed pair in the activity stream rather than an
-        // orphaned Start. Pattern A (emit Failed in the catch) — chosen over a
-        // success-flag-in-finally to keep the existing throw flow untouched and
-        // avoid restructuring the GrsServerError mapping branch below.
-        logger.trackActivityEvent('Maaf.Create.GitHubDcfRecovery.Failed', {
-            repoHost: host,
-            repoHash,
-        });
-        // Only GrsServerError carries a structured `code` we can translate to a
-        // CLI-typed AppError. Anything else (plain Error, network error, etc.)
-        // propagates as-is — the verb's outer flow treats it as a hard failure
-        // (no retry, no second "Resuming create...").
-        if (error instanceof GrsServerError) {
-            const mapped = mapGitHubServerErrorToCliError({
-                code: error.code,
-                message: error.message,
-                status: error.status,
-                details: error.details,
-            }, { repoUrl: remoteUrl, verb });
-            if (mapped)
-                throw mapped;
-        }
-        throw error;
-    }
-    finally {
-        // Safe in both branches: if SIGINT already fired, `process.once` has
-        // already auto-removed the listener and `removeListener` is a no-op.
-        process.removeListener('SIGINT', onSigint);
-    }
-    logger.trackActivityEvent('Maaf.Create.GitHubDcfRecovery.Complete', {
-        repoHost: host,
-        repoHash,
-    });
-    if (!jsonMode) {
-        // Printed here (before the helper returns) rather than at the retry
-        // call site so it's adjacent to the DCF-completed telemetry event. If
-        // the subsequent createAsync retry hard-fails, the user sees
-        // "Resuming create..." followed by the failure message — still accurate:
-        // we DID resume; the resumed call is what failed.
-        printInfo('Resuming create...');
-    }
-}
-/**
- * Build the right {@link GitHubDcfDisplay} for the create recovery path:
- * - JSON mode → NDJSON events, never opens a browser.
- * - `--no-browser` → console output, browser launch suppressed.
- * - Default → console output + best-effort browser launch (TTY-gated).
- *
- * Note the inverted default vs `git auth refresh`: in recovery the user has
- * already started a destructive operation (create), so we lean toward
- * launching a browser by default and require explicit opt-out, instead of
- * the refresh verb's explicit opt-in.
- */
-function composeRecoveryDisplay(opts) {
-    if (opts.isJson) {
-        return new JsonGitHubDcfDisplay();
-    }
-    if (opts.noBrowser) {
-        return {
-            ...ConsoleGitHubDcfDisplay,
-            openVerificationUri: undefined,
-        };
-    }
-    return ConsoleGitHubDcfDisplay;
-}
 function createOptionSchema(argumentProvider) {
     argumentProvider.setDescription(HelpStrings.app.create.description);
     argumentProvider.addExamples(HelpStrings.app.create.examples);
     argumentProvider.consumePositionalArg('[directory]');
     argumentProvider.addOptions([
+        {
+            flags: {
+                key: CreateMaafAppArguments.EnvironmentId.name,
+                alias: CreateMaafAppArguments.EnvironmentId.alias,
+            },
+            env: CreateMaafAppArguments.EnvironmentId.envVar,
+            description: HelpStrings.app.create.options.environmentId,
+            optionalInNonInteractive: true,
+        },
         createDefaultStringOption({
             flags: {
                 key: CreateMaafAppArguments.DisplayName.name,
@@ -880,8 +876,12 @@ function createOptionSchema(argumentProvider) {
         }),
     ]);
     argumentProvider.addSwitch({
-        flags: { key: CreateMaafAppArguments.NoBrowser.name },
-        description: HelpStrings.app.create.options.noBrowser,
+        flags: { key: CreateMaafAppArguments.OpenBrowser.name },
+        description: HelpStrings.app.create.options.openBrowser,
+    });
+    argumentProvider.addSwitch({
+        flags: { key: CreateMaafAppArguments.ForceReauth.name },
+        description: HelpStrings.app.create.options.forceReauth,
     });
 }
 //# sourceMappingURL=CreateMaafApp.js.map