@microsoft/managed-apps-cli 0.8.0 → 0.9.0

package/dist/Verbs/Init.js

@@ -5,7 +5,7 @@ import { createAsync, getEnvironmentByName, getPlayerServiceConfig, resolveAppSe
 import { AppConfigFileName, VERSION } from '@microsoft/managed-apps-common/config';
 import { getUserRoutingEnvironmentAsync } from '@microsoft/managed-apps-common/services';
 import { getCliLogger, getSettings } from '../CliSettings.js';
-import { createDefaultStringOption } from '../CliUtils.js';
+import { createDefaultStringOption, resolveEnvironmentId } from '../CliUtils.js';
 import { CLI_CLIENT_ID } from '../Constants.js';
 import { CLI_BINARY_NAME } from '../Constants/CliConstants.js';
 import { HelpStrings } from '../Constants/HelpStrings.js';
@@ -14,7 +14,6 @@ import { printInfo, printSuccess } from '../Utils/ConsoleOutput.js';
 import { withGitHubDcfRecoveryAsync } from '../Utils/DcfRecovery.js';
 import { resolveRoutingEnvironmentIdAsync } from '../Utils/EnvironmentRoutingUtils.js';
 import { getCurrentGitRemoteUrl } from '../Utils/GitUtils.js';
-import { parseGitHubRepoUrl } from '../Utils/RepoUrl.js';
 import { InitArguments } from './VerbConstants.js';
 export async function initAsync(argumentProvider) {
     const settings = getSettings();
@@ -31,8 +30,9 @@ export async function initAsync(argumentProvider) {
         throw new UsageError('Unable to determine tenant ID. Ensure you are logged in.');
     }
     // Validate required options.
-    const preResolvedEnvironmentId = normalizeOptionalString(argumentProvider.getEnvironmentId()) ??
-        normalizeOptionalString(await argumentProvider.getOption('environmentId', true));
+    const preResolvedEnvironmentId = await resolveEnvironmentId(argumentProvider, {
+        failIfMissing: false,
+    });
     if (preResolvedEnvironmentId && !(await validateEnvironmentExists(preResolvedEnvironmentId))) {
         throw new NotFoundError(`Environment '${preResolvedEnvironmentId}' not found. Please verify the environment ID and ensure you have access to it.`);
     }
@@ -47,41 +47,24 @@ export async function initAsync(argumentProvider) {
         });
     });
     // determine the repoType to use for this app.
-    // if there is a .git in the current project, read the remote URL.
-    // if GHE - ask user if they want to use this, or provision a platform managed repo.
-    // if not GHE - offer to provision a platform managed repo or continue without source control integration & user will have to upload build artifacts manually when they want to publish.
-    // if there is no .git, provision a platform managed repo and link it to the app
+    // if there is a .git in the current project, read the remote URL. If
+    // `--use-existing-git-repo` is set, link it to the app. Otherwise (or if
+    // there is no .git), a platform-managed repo will be provisioned and linked
+    // to the app instead. URL shape is no longer validated here — the server is
+    // the authority and will reject anything it can't bind.
     const remoteUrl = getCurrentGitRemoteUrl();
     let selectedRemoteUrl;
     let repoType = 'native';
     if (remoteUrl) {
-        try {
-            parseGitHubRepoUrl(remoteUrl);
-            printInfo(`Detected git remote URL: ${remoteUrl}`);
-            const useExistingGitRepo = await argumentProvider.getOption('useExistingGitRepo', false);
-            if (useExistingGitRepo) {
-                printInfo(`Will use the existing git repo and link it to the app.`);
-                repoType = 'github';
-                selectedRemoteUrl = remoteUrl;
-            }
-            else {
-                printInfo(`Will not use the existing git repo. A new platform-managed git repo will be provisioned and linked to the app instead.`);
-            }
+        printInfo(`Detected git remote URL: ${remoteUrl}`);
+        const useExistingGitRepo = await argumentProvider.getOption('useExistingGitRepo', false);
+        if (useExistingGitRepo) {
+            printInfo(`Will use the existing git repo and link it to the app.`);
+            repoType = 'github';
+            selectedRemoteUrl = remoteUrl;
         }
-        catch (error) {
-            logger.trackErrorEvent('Init.GitRemoteUrlParseFailure', {
-                error: error instanceof Error ? error.message : String(error),
-                gitRemoteUrl: remoteUrl,
-            });
-            printInfo(`Detected git remote URL '${remoteUrl}' is not a valid GitHub Enterprise URL.`);
-            const provisionGitRepo = await argumentProvider.getOption('provisionGitRepo', false);
-            if (provisionGitRepo) {
-                printInfo(`A new platform-managed git repo will be provisioned and linked to the app. The existing git repo will not be used.`);
-            }
-            else {
-                printInfo(`No git repo will be linked to the app. You will be able to upload build artifacts manually when you want to publish the app.`);
-                repoType = 'none';
-            }
+        else {
+            printInfo(`Will not use the existing git repo. A new platform-managed git repo will be provisioned and linked to the app instead.`);
         }
     }
     // not ignoring prompts for these options
@@ -109,6 +92,7 @@ export async function initAsync(argumentProvider) {
         repositoryId: undefined,
         remoteUrl: selectedRemoteUrl,
         repoType,
+        origin: settings.origin,
     };
     // On `repoType: 'github'`, wrap createAsync with the DCF catch-and-retry:
     // a missing/expired GitHub identity mapping is recovered in-band by running
@@ -152,14 +136,15 @@ export async function initAsync(argumentProvider) {
     await writeRepoConfig(settings.fileConfig.appConfigPath, appConfig);
     printSuccess(`Created ${AppConfigFileName} for ${displayName}.`);
     printInfo(`Hint: Run 'npx ${CLI_BINARY_NAME} app add connection' to connect data, or 'npx ${CLI_BINARY_NAME} dev' to start the app locally.`);
-    if (repoType !== 'none') {
-        // Use `git push -u origin HEAD` (not bare `git push`) so the hint works
-        // even when no upstream is configured for the current branch — common in
-        // freshly-cloned or freshly-init'd projects. Mirrors what `ms app create`
-        // runs automatically.
-        printInfo(`Hint: Commit and push to wire your app to the remote repository: ` +
-            `git add . && git commit -m '<message>' && git push -u origin HEAD.`);
-    }
+    // Use `git push -u origin HEAD` (not bare `git push`) so the hint works
+    // even when no upstream is configured for the current branch — common in
+    // freshly-cloned or freshly-init'd projects. Mirrors what `ms app create`
+    // runs automatically. Always printed: `repoType` here is `'native' | 'github'`
+    // (Init's local `'none'` branch was removed when CLI-side URL validation was
+    // dropped — `repoType: 'none'` still exists for `ms app create --repo none`.)
+    // and both flows benefit from the commit-and-push reminder.
+    printInfo(`Hint: Commit and push to wire your app to the remote repository: ` +
+        `git add . && git commit -m '<message>' && git push -u origin HEAD.`);
 }
 function createOptionSchema(argumentProvider) {
     argumentProvider.setDescription(HelpStrings.app.init.description);
@@ -244,12 +229,6 @@ function createOptionSchema(argumentProvider) {
             },
             description: HelpStrings.app.init.options.useExistingGitRepo,
         },
-        {
-            flags: {
-                key: InitArguments.ProvisionGitRepo.name,
-            },
-            description: HelpStrings.app.init.options.provisionGitRepo,
-        },
     ]);
     argumentProvider.addSwitch({
         flags: { key: InitArguments.OpenBrowser.name },
@@ -274,8 +253,4 @@ async function validateEnvironmentExists(environmentId) {
         return false;
     }
 }
-function normalizeOptionalString(value) {
-    const normalized = value?.trim();
-    return normalized ? normalized : undefined;
-}
 //# sourceMappingURL=Init.js.map

package/dist/Verbs/Init.js.map

@@ -1 +1 @@
-{"version":3,"file":"Init.js","sourceRoot":"","sources":["../../src/Verbs/Init.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,GAChB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAGzF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,gBAAkC;IAChE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAClB,GAAG,iBAAiB,uFAAuF,CAC5G,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACrC,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC;IAEjC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAE5C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IAED,6BAA6B;IAC7B,MAAM,wBAAwB,GAC5B,uBAAuB,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;QAC5D,uBAAuB,CAAC,MAAM,gBAAgB,CAAC,SAAS,CAAS,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC;IAE3F,IAAI,wBAAwB,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,aAAa,CACrB,gBAAgB,wBAAwB,iFAAiF,CAC1H,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GACrB,wBAAwB,KAAK,SAAS;QACpC,CAAC,CAAC,8BAA8B,CAC5B,UAAU,EACV,QAAQ,EACR,aAAa,EACb,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAC7B,MAAM,EACN,MAAM,CACP;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,yFAAyF;IACzF,6FAA6F;IAC7F,iBAAiB,EAAE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1C,MAAM,CAAC,eAAe,CAAC,mDAAmD,EAAE;YAC1E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,kEAAkE;IAClE,oFAAoF;IACpF,wLAAwL;IACxL,gFAAgF;IAChF,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,IAAI,iBAAqC,CAAC;IAC1C,IAAI,QAAQ,GAAa,QAAQ,CAAC;IAClC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9B,SAAS,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;YACnD,MAAM,kBAAkB,GAAG,MAAM,gBAAgB,CAAC,SAAS,CACzD,oBAAoB,EACpB,KAAK,CACN,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,SAAS,CAAC,wDAAwD,CAAC,CAAC;gBACpE,QAAQ,GAAG,QAAQ,CAAC;gBACpB,iBAAiB,GAAG,SAAS,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,SAAS,CACP,wHAAwH,CACzH,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,eAAe,CAAC,+BAA+B,EAAE;gBACtD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,YAAY,EAAE,SAAS;aACxB,CAAC,CAAC;YACH,SAAS,CAAC,4BAA4B,SAAS,yCAAyC,CAAC,CAAC;YAC1F,MAAM,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAU,kBAAkB,EAAE,KAAK,CAAC,CAAC;YAC9F,IAAI,gBAAgB,EAAE,CAAC;gBACrB,SAAS,CACP,oHAAoH,CACrH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,SAAS,CACP,8HAA8H,CAC/H,CAAC;gBACF,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,aAAa,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,aAAa,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,WAAW,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,cAAc,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,iBAAiB,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,UAAU,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,yEAAyE;IACzE,+CAA+C;IAC/C,MAAM,WAAW,GACf,CAAC,MAAM,gBAAgB,CAAC,SAAS,CAC/B,aAAa,CAAC,WAAW,CAAC,SAAS;IACnC,kBAAkB,CAAC,IAAI,CACxB,CAAC,IAAI,KAAK,CAAC;IACd,iEAAiE;IACjE,MAAM,WAAW,GACf,CAAC,MAAM,gBAAgB,CAAC,SAAS,CAC/B,aAAa,CAAC,WAAW,CAAC,SAAS;IACnC,kBAAkB,CAAC,IAAI,CACxB,CAAC,IAAI,KAAK,CAAC;IAEd,MAAM,aAAa,GACjB,wBAAwB;QACxB,CAAC,MAAM,gCAAgC,CAAC,iBAAkB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnF,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAErC,6FAA6F;IAC7F,MAAM,aAAa,GAAG;QACpB,WAAW;QACX,WAAW;QACX,YAAY,EAAE,SAAS;QACvB,SAAS,EAAE,iBAAiB;QAC5B,QAAQ;KACT,CAAC;IAEF,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,EAAE,OAAO,EAAwB,EAAkC,EAAE,CACtF,WAAW,CAAC;QACV,QAAQ;QACR,aAAa;QACb,MAAM;QACN,aAAa,EAAE;YACb,GAAG,aAAa;YAChB,GAAG,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;SAC/E;KACF,CAAC,CAAC;IAEL,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,SAAS,EAAE;QAC/D,QAAQ;QACR,eAAe,EAAE,iBAAiB;QAClC,QAAQ;QACR,QAAQ,EAAE,gBAAgB,CAAC,UAAU,EAAE;QACvC,WAAW;QACX,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAc;QAC3B,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;QAC1B,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW;QAC5C,aAAa;QACb,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW;QACzC,QAAQ;QACR,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QAClC,SAAS;QACT,YAAY;QACZ,eAAe;QACf,QAAQ;QACR,oBAAoB,EAAE,EAAE;QACxB,kBAAkB,EAAE,EAAE;QACtB,WAAW,EAAE,kBAAkB,CAAC,SAAS,CAAC;KAC3C,CAAC;IACF,MAAM,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACpE,YAAY,CAAC,WAAW,iBAAiB,QAAQ,WAAW,GAAG,CAAC,CAAC;IACjE,SAAS,CACP,kBAAkB,eAAe,iDAAiD,eAAe,iCAAiC,CACnI,CAAC;IACF,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,sBAAsB;QACtB,SAAS,CACP,mEAAmE;YACjE,oEAAoE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,gBAAkC;IAC5D,gBAAgB,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,gBAAgB,CAAC,UAAU,CAAC;QAC1B,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,IAAI;gBACrC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,KAAK;aACzC;YACD,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM;YACvC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,aAAa;YAClD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa;SACxD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI;gBACnC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,KAAK;aACvC;YACD,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,MAAM;YACrC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,aAAa;YAChD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;SACtD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI;gBACnC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,KAAK;aACvC;YACD,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,MAAM;YACrC,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,aAAa;YAChD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;SACtD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI;gBACjC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,KAAK;aACrC;YACD,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM;YACnC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,aAAa;YAC9C,YAAY,EAAE,aAAa,CAAC,SAAS,CAAC,YAAY;YAClD,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;SACpD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,YAAY,CAAC,IAAI;gBACpC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK;aACxC;YACD,GAAG,EAAE,aAAa,CAAC,YAAY,CAAC,MAAM;YACtC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,aAAa;YACjD,YAAY,EAAE,aAAa,CAAC,YAAY,CAAC,YAAY;YACrD,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY;SACvD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,eAAe,CAAC,IAAI;aACxC;YACD,GAAG,EAAE,aAAa,CAAC,eAAe,CAAC,MAAM;YACzC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,aAAa;YACpD,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,YAAY;YACxD,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe;SAC1D,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI;gBAChC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK;aACpC;YACD,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM;YAClC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa;YAC7C,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY;YACjD,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ;SACnD,CAAC;KACH,CAAC,CAAC;IAEH,gBAAgB,CAAC,WAAW,CAAC;QAC3B;YACE,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,kBAAkB,CAAC,IAAI;aAC3C;YACD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB;SAC7D;QACD;YACE,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,gBAAgB,CAAC,IAAI;aACzC;YACD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB;SAC3D;KACF,CAAC,CAAC;IACH,gBAAgB,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE;QAC9C,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;KACtD,CAAC,CAAC;IACH,gBAAgB,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE;QAC9C,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;KACtD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CAAC,aAAqB;IAC5D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACxD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"Init.js","sourceRoot":"","sources":["../../src/Verbs/Init.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,GAChB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAGzF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,gBAAkC;IAChE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAClB,GAAG,iBAAiB,uFAAuF,CAC5G,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACrC,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC;IAEjC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAE5C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IAED,6BAA6B;IAC7B,MAAM,wBAAwB,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,EAAE;QAC5E,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;IAEH,IAAI,wBAAwB,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,aAAa,CACrB,gBAAgB,wBAAwB,iFAAiF,CAC1H,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GACrB,wBAAwB,KAAK,SAAS;QACpC,CAAC,CAAC,8BAA8B,CAC5B,UAAU,EACV,QAAQ,EACR,aAAa,EACb,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAC7B,MAAM,EACN,MAAM,CACP;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,yFAAyF;IACzF,6FAA6F;IAC7F,iBAAiB,EAAE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1C,MAAM,CAAC,eAAe,CAAC,mDAAmD,EAAE;YAC1E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,qEAAqE;IACrE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,IAAI,iBAAqC,CAAC;IAC1C,IAAI,QAAQ,GAAa,QAAQ,CAAC;IAClC,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;QACnD,MAAM,kBAAkB,GAAG,MAAM,gBAAgB,CAAC,SAAS,CACzD,oBAAoB,EACpB,KAAK,CACN,CAAC;QACF,IAAI,kBAAkB,EAAE,CAAC;YACvB,SAAS,CAAC,wDAAwD,CAAC,CAAC;YACpE,QAAQ,GAAG,QAAQ,CAAC;YACpB,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,SAAS,CACP,wHAAwH,CACzH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,aAAa,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,aAAa,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,WAAW,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,cAAc,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,iBAAiB,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAS,UAAU,CAAC,CAAC;IAEtE,4EAA4E;IAC5E,yEAAyE;IACzE,+CAA+C;IAC/C,MAAM,WAAW,GACf,CAAC,MAAM,gBAAgB,CAAC,SAAS,CAC/B,aAAa,CAAC,WAAW,CAAC,SAAS;IACnC,kBAAkB,CAAC,IAAI,CACxB,CAAC,IAAI,KAAK,CAAC;IACd,iEAAiE;IACjE,MAAM,WAAW,GACf,CAAC,MAAM,gBAAgB,CAAC,SAAS,CAC/B,aAAa,CAAC,WAAW,CAAC,SAAS;IACnC,kBAAkB,CAAC,IAAI,CACxB,CAAC,IAAI,KAAK,CAAC;IAEd,MAAM,aAAa,GACjB,wBAAwB;QACxB,CAAC,MAAM,gCAAgC,CAAC,iBAAkB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAEnF,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAErC,6FAA6F;IAC7F,MAAM,aAAa,GAAG;QACpB,WAAW;QACX,WAAW;QACX,YAAY,EAAE,SAAS;QACvB,SAAS,EAAE,iBAAiB;QAC5B,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC;IAEF,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,EAAE,OAAO,EAAwB,EAAkC,EAAE,CACtF,WAAW,CAAC;QACV,QAAQ;QACR,aAAa;QACb,MAAM;QACN,aAAa,EAAE;YACb,GAAG,aAAa;YAChB,GAAG,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;SAC/E;KACF,CAAC,CAAC;IAEL,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,SAAS,EAAE;QAC/D,QAAQ;QACR,eAAe,EAAE,iBAAiB;QAClC,QAAQ;QACR,QAAQ,EAAE,gBAAgB,CAAC,UAAU,EAAE;QACvC,WAAW;QACX,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAc;QAC3B,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;QAC1B,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW;QAC5C,aAAa;QACb,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW;QACzC,QAAQ;QACR,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QAClC,SAAS;QACT,YAAY;QACZ,eAAe;QACf,QAAQ;QACR,oBAAoB,EAAE,EAAE;QACxB,kBAAkB,EAAE,EAAE;QACtB,WAAW,EAAE,kBAAkB,CAAC,SAAS,CAAC;KAC3C,CAAC;IACF,MAAM,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACpE,YAAY,CAAC,WAAW,iBAAiB,QAAQ,WAAW,GAAG,CAAC,CAAC;IACjE,SAAS,CACP,kBAAkB,eAAe,iDAAiD,eAAe,iCAAiC,CACnI,CAAC;IACF,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,4DAA4D;IAC5D,SAAS,CACP,mEAAmE;QACjE,oEAAoE,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,gBAAkC;IAC5D,gBAAgB,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClE,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,gBAAgB,CAAC,UAAU,CAAC;QAC1B,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,IAAI;gBACrC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,KAAK;aACzC;YACD,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM;YACvC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,aAAa;YAClD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa;SACxD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI;gBACnC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,KAAK;aACvC;YACD,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,MAAM;YACrC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,aAAa;YAChD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;SACtD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI;gBACnC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,KAAK;aACvC;YACD,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,MAAM;YACrC,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,aAAa;YAChD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;SACtD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI;gBACjC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,KAAK;aACrC;YACD,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM;YACnC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,aAAa;YAC9C,YAAY,EAAE,aAAa,CAAC,SAAS,CAAC,YAAY;YAClD,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;SACpD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,YAAY,CAAC,IAAI;gBACpC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK;aACxC;YACD,GAAG,EAAE,aAAa,CAAC,YAAY,CAAC,MAAM;YACtC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,aAAa;YACjD,YAAY,EAAE,aAAa,CAAC,YAAY,CAAC,YAAY;YACrD,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY;SACvD,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,eAAe,CAAC,IAAI;aACxC;YACD,GAAG,EAAE,aAAa,CAAC,eAAe,CAAC,MAAM;YACzC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,aAAa;YACpD,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,YAAY;YACxD,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe;SAC1D,CAAC;QACF,yBAAyB,CAAC;YACxB,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI;gBAChC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK;aACpC;YACD,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM;YAClC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,aAAa;YAC7C,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY;YACjD,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ;SACnD,CAAC;KACH,CAAC,CAAC;IAEH,gBAAgB,CAAC,WAAW,CAAC;QAC3B;YACE,KAAK,EAAE;gBACL,GAAG,EAAE,aAAa,CAAC,kBAAkB,CAAC,IAAI;aAC3C;YACD,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB;SAC7D;KACF,CAAC,CAAC;IACH,gBAAgB,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE;QAC9C,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;KACtD,CAAC,CAAC;IACH,gBAAgB,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE;QAC9C,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;KACtD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CAAC,aAAqB;IAC5D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/Verbs/MaafAppPermissions.d.ts

@@ -7,10 +7,13 @@ export type MaafAppPermissionsMode = 'share' | 'unshare';
 /**
  * Selects which access level the caller wants to grant/revoke:
  *
- * - `play` — read-only access to the MAAF app itself (the `MicrosoftAppReader`
- *   role granted at the app scope via PowerApps RP).
- * - `edit` — read + write access to the underlying git repository (the
- *   `RepositoryContributor` role granted at the repo scope via GRS).
+ * - `play` — read-only access to the MAAF app itself, granted at the app scope
+ *   via PowerApps RP (`MicrosoftAppReader` role).
+ * - `edit` — read + write access to the app's code. The concrete scope depends
+ *   on `repoType`: for `native` repositories the `RepositoryContributor` role
+ *   is granted at the GRS repo scope; for `none` / `github` repositories the
+ *   `MicrosoftAppContributor` role is granted at the MAAF app scope instead
+ *   (since there is no platform-managed repository to attach a role to).
  *
  * Each invocation targets exactly one access level; the two scopes are
  * independent.
@@ -32,8 +35,11 @@ export type MaafAppAccessLevel = 'play' | 'edit';
  *    to AAD object ids via Graph, pass GUID-shaped inputs through unchanged.
  * 5. Dispatch to the matching share/unshare path:
  *    - `play` → MAAF `modifyRoleAssignments` (`MicrosoftAppReader` at app scope).
- *    - `edit` → fetch the app's `repositoryId` then GRS `modifyRoleAssignments`
- *      (`RepositoryContributor` at repo scope).
+ *    - `edit` + `repoType === 'native'` → fetch the app's `repositoryId` then
+ *      GRS `modifyRoleAssignments` (`RepositoryContributor` at repo scope).
+ *    - `edit` + `repoType === 'none' | 'github'` → MAAF `modifyRoleAssignments`
+ *      (`MicrosoftAppContributor` at app scope); GRS is skipped because the
+ *      platform does not manage the repository.
  *    For unshare, paginate the matching list endpoint and pass through the
  *    full `RoleAssignment[]` records on `delete` (the strict wire contract
  *    requires `roleAssignmentId`, which only the list endpoint provides).

package/dist/Verbs/MaafAppPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MaafAppPermissions.d.ts","sourceRoot":"","sources":["../../src/Verbs/MaafAppPermissions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAwBH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAS5D,4EAA4E;AAC5E,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;AAuBjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,8BAA8B,CAClD,gBAAgB,EAAE,gBAAgB,EAClC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAsFf"}
+{"version":3,"file":"MaafAppPermissions.d.ts","sourceRoot":"","sources":["../../src/Verbs/MaafAppPermissions.ts"],"names":[],"mappings":"AAAA;;GAEG;AA2BH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAS5D,4EAA4E;AAC5E,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;AAuBjD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,8BAA8B,CAClD,gBAAgB,EAAE,gBAAgB,EAClC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA+If"}

package/dist/Verbs/MaafAppPermissions.js

@@ -1,7 +1,7 @@
 /*!
  * Copyright (C) Microsoft Corporation. All rights reserved.
  */
-import { GrsRepositoryContributorRoleName, infoAsync, MaafAppReaderRoleName, modifyGrsRoleAssignmentsAsync, modifyMaafRoleAssignmentsAsync, resolvePrincipalByEmailAsync, unshareGrsRepoByPrincipalsAsync, unshareMaafAppByPrincipalsAsync, } from '@microsoft/managed-apps-actions';
+import { GrsRepositoryContributorRoleName, infoAsync, MaafAppContributorRoleName, MaafAppReaderRoleName, modifyGrsRoleAssignmentsAsync, modifyMaafRoleAssignmentsAsync, resolvePrincipalByEmailAsync, unshareGrsRepoByPrincipalsAsync, unshareMaafAppByPrincipalsAsync, } from '@microsoft/managed-apps-actions';
 import { AppConfigFileName } from '@microsoft/managed-apps-common/config';
 import { HttpClientError } from '@microsoft/managed-apps-common/services';
 import { getCliLogger, getSettings } from '../CliSettings.js';
@@ -27,8 +27,11 @@ import { ShareMaafAppArguments, UnshareMaafAppArguments } from './VerbConstants.
  *    to AAD object ids via Graph, pass GUID-shaped inputs through unchanged.
  * 5. Dispatch to the matching share/unshare path:
  *    - `play` → MAAF `modifyRoleAssignments` (`MicrosoftAppReader` at app scope).
- *    - `edit` → fetch the app's `repositoryId` then GRS `modifyRoleAssignments`
- *      (`RepositoryContributor` at repo scope).
+ *    - `edit` + `repoType === 'native'` → fetch the app's `repositoryId` then
+ *      GRS `modifyRoleAssignments` (`RepositoryContributor` at repo scope).
+ *    - `edit` + `repoType === 'none' | 'github'` → MAAF `modifyRoleAssignments`
+ *      (`MicrosoftAppContributor` at app scope); GRS is skipped because the
+ *      platform does not manage the repository.
  *    For unshare, paginate the matching list endpoint and pass through the
  *    full `RoleAssignment[]` records on `delete` (the strict wire contract
  *    requires `roleAssignmentId`, which only the list endpoint provides).
@@ -50,72 +53,144 @@ export async function executeMaafAppPermissionsAsync(argumentProvider, mode) {
     }
     const appName = await resolveAppNameAsync(argumentProvider);
     const access = parseAccessLevel(await argumentProvider.getOption('access'));
-    const repoType = cliSettings.appConfig.repoType ?? 'native';
-    if (access === 'edit' && repoType === 'none') {
-        throw new UsageError(`App '${appName}' has no associated repository in the platform, so edit access cannot be modified.`);
-    }
+    // `repoType` only affects edit routing. For play we should never fail on the
+    // strict migration check for legacy config shape.
+    const repoType = access === 'edit'
+        ? resolveRepoType(cliSettings.appConfig)
+        : (cliSettings.appConfig.repoType ?? 'none');
     const inputs = parseInputs(argumentProvider.getPositionalArg(0));
     if (inputs.length === 0) {
         throw new UsageError('Provide at least one principal as a comma-separated list (AAD object IDs or email addresses).');
     }
-    // Failures (bad shape, no Graph match, transport error) are collected here so
-    // we can warn the user but still proceed with the entries that resolved.
-    const failures = [];
-    const refs = await resolveAllAsync(inputs, failures);
-    // If nothing resolved, the operation has no inputs to apply — abort with a
-    // single error listing every failure rather than calling the RP with an empty
-    // array.
-    if (refs.length === 0) {
-        throw new UsageError(formatFailures(failures));
-    }
-    // Otherwise warn about the unresolved entries up front (so they're visible
-    // before the success line), then proceed with the resolved subset.
-    if (failures.length > 0) {
-        printWarning(formatFailures(failures));
-    }
-    const dispatch = mode === 'share' ? shareDispatchAsync : unshareDispatchAsync;
-    const outcome = await dispatch({ tenantId, environmentId, appName, access, refs });
-    if (argumentProvider.isJsonMode()) {
-        // Envelope semantics for this verb: `success: true` means the modify call
-        // reached the RP and returned. When some inputs failed to resolve before
-        // the modify, `partialFailure` is `true` and `warnings` lists the
-        // unresolved entries. Consumers requiring full success must check both
-        // `success === true && partialFailure === false`. `warnings` is always
-        // present (empty array on full success) so consumers can treat its
-        // length uniformly. The server response is spread flat into the envelope
-        // (matching every other verb that emits JSON) instead of nested under a
-        // `result` key. For unshare we also include the action-layer bookkeeping
-        // (`revokedCount`, `revokedPrincipalCount`, `notFound`, `skipped`) that
-        // would otherwise only appear in the human summary — so automation gets
-        // the same fidelity as text mode.
-        printJsonSuccess({
+    // Top-level scenario that ties together every server call the verb makes:
+    // Graph principal resolution (`ResolvePrincipalByEmail` per email), optional
+    // app-info fetch (`GetMaafApp`) when the edit path needs the `repositoryId`,
+    // and the final modify call (one of `ModifyMaafRoleAssignments`,
+    // `ModifyGrsRepositoryRoleAssignments`, `UnshareMaafAppByPrincipals`, or
+    // `UnshareGrsRepoByPrincipals`). Each of those actions already emits its own
+    // wire-scoped scenario; this scenario captures the verb-level outcome plus
+    // the routing decision (scope/role) so we can correlate. All properties are
+    // PII-safe — counts and routing flags only, no emails / GUIDs / app names.
+    const logger = getCliLogger();
+    const scenario = logger.trackScenario('MaafApp.SharePermissions', {
+        mode,
+        access,
+        repoType,
+        inputCount: inputs.length,
+    });
+    try {
+        // Failures (bad shape, no Graph match, transport error) are collected here so
+        // we can warn the user but still proceed with the entries that resolved.
+        const failures = [];
+        const refs = await resolveAllAsync(inputs, failures);
+        // Verb-level summary of the Graph fan-out. Each underlying lookup also
+        // emits a `ResolvePrincipalByEmail` scenario; this event makes the
+        // aggregate result queryable per share/unshare invocation.
+        logger.trackActivityEvent('MaafApp.SharePermissions.PrincipalResolution', {
+            mode,
+            inputCount: inputs.length,
+            resolvedCount: refs.length,
+            failedCount: failures.length,
+        });
+        // If nothing resolved, the operation has no inputs to apply — abort with a
+        // single error listing every failure rather than calling the RP with an empty
+        // array.
+        if (refs.length === 0) {
+            throw new UsageError(formatFailures(failures));
+        }
+        // Otherwise warn about the unresolved entries up front (so they're visible
+        // before the success line), then proceed with the resolved subset.
+        if (failures.length > 0) {
+            printWarning(formatFailures(failures));
+        }
+        const dispatch = mode === 'share' ? shareDispatchAsync : unshareDispatchAsync;
+        const outcome = await dispatch({
+            tenantId,
+            environmentId,
+            appName,
             access,
-            partialFailure: failures.length > 0,
-            ...outcome.result,
+            refs,
+            repoType,
+            jsonMode: argumentProvider.isJsonMode(),
+        });
+        scenario.complete({
+            resolvedCount: refs.length,
+            failedResolutionCount: failures.length,
+            scope: outcome.scope,
+            role: outcome.role,
+            // App-scope contributor fallback for `edit` is the noteworthy routing
+            // case introduced for non-native `repoType`. Tagged here so it's a
+            // simple boolean filter on the success event.
+            appScopeContributorFallback: access === 'edit' && outcome.scope === 'app',
             ...(mode === 'unshare' && {
                 revokedCount: outcome.revokedCount ?? 0,
                 revokedPrincipalCount: outcome.revokedPrincipalCount ?? 0,
-                notFound: (outcome.notFound ?? []).map(toJsonRef),
-                skipped: (outcome.skipped ?? []).map(toJsonRef),
+                notFoundCount: outcome.notFound?.length ?? 0,
+                skippedCount: outcome.skipped?.length ?? 0,
             }),
-            warnings: failures,
         });
+        if (argumentProvider.isJsonMode()) {
+            // Envelope semantics for this verb: `success: true` means the modify call
+            // reached the RP and returned. When some inputs failed to resolve before
+            // the modify, `partialFailure` is `true` and `warnings` lists the
+            // unresolved entries. Consumers requiring full success must check both
+            // `success === true && partialFailure === false`. `warnings` is always
+            // present (empty array on full success) so consumers can treat its
+            // length uniformly. The server response is spread flat into the envelope
+            // (matching every other verb that emits JSON) instead of nested under a
+            // `result` key. For unshare we also include the action-layer bookkeeping
+            // (`revokedCount`, `revokedPrincipalCount`, `notFound`, `skipped`) that
+            // would otherwise only appear in the human summary — so automation gets
+            // the same fidelity as text mode.
+            printJsonSuccess({
+                access,
+                partialFailure: failures.length > 0,
+                ...outcome.result,
+                ...(mode === 'unshare' && {
+                    revokedCount: outcome.revokedCount ?? 0,
+                    revokedPrincipalCount: outcome.revokedPrincipalCount ?? 0,
+                    notFound: (outcome.notFound ?? []).map(toJsonRef),
+                    skipped: (outcome.skipped ?? []).map(toJsonRef),
+                }),
+                warnings: failures,
+            });
+        }
+        else {
+            printSummary({ appName, mode, access, inputCount: refs.length, outcome });
+        }
     }
-    else {
-        printSummary({ appName, mode, access, inputCount: refs.length, outcome });
+    catch (error) {
+        scenario.failure(error);
+        throw error;
     }
 }
 async function shareDispatchAsync(inputs) {
-    const { tenantId, environmentId, appName, access, refs } = inputs;
+    const { tenantId, environmentId, appName, access, refs, repoType, jsonMode } = inputs;
     if (access === 'play') {
-        const entries = refs.map(toMaafPermissionEntry);
+        const entries = refs.map((r) => toMaafPermissionEntry(r, MaafAppReaderRoleName));
+        const result = await modifyMaafRoleAssignmentsAsync({
+            tenantId,
+            environmentId,
+            logger: getCliLogger(),
+            actionsParams: { appName, put: entries, delete: [] },
+        });
+        return { result, scope: 'app', role: MaafAppReaderRoleName };
+    }
+    // access === 'edit': route by repoType.
+    if (repoType !== 'native') {
+        // The app has no platform-managed repository, so grant contributor access
+        // at the app scope instead of going through GRS.
+        if (!jsonMode) {
+            printInfo(`App '${appName}' has no platform-managed repository, so granting contributor access at the app scope instead of repository scope.`);
+        }
+        const entries = refs.map((r) => toMaafPermissionEntry(r, MaafAppContributorRoleName));
         const result = await modifyMaafRoleAssignmentsAsync({
             tenantId,
             environmentId,
             logger: getCliLogger(),
             actionsParams: { appName, put: entries, delete: [] },
         });
-        return { result };
+        return { result, scope: 'app', role: MaafAppContributorRoleName };
     }
     const repoId = await resolveRepositoryIdAsync({ tenantId, environmentId, appName });
     const entries = refs.map(toGrsPermissionEntry);
@@ -125,30 +200,49 @@ async function shareDispatchAsync(inputs) {
         logger: getCliLogger(),
         actionsParams: { repoId, put: entries, delete: [] },
     });
-    return { result };
+    return { result, scope: 'repo', role: GrsRepositoryContributorRoleName };
 }
 async function unshareDispatchAsync(inputs) {
-    const { tenantId, environmentId, appName, access, refs } = inputs;
+    const { tenantId, environmentId, appName, access, refs, repoType, jsonMode } = inputs;
     const principalIds = refs.map((r) => r.id);
     const refsByPrincipalId = new Map(refs.map((r) => [r.id, r]));
-    const actionResult = access === 'play'
-        ? await unshareMaafAppByPrincipalsAsync({
+    const useAppScope = access === 'play' || repoType !== 'native';
+    const role = useAppScope
+        ? access === 'play'
+            ? MaafAppReaderRoleName
+            : MaafAppContributorRoleName
+        : GrsRepositoryContributorRoleName;
+    let actionResult;
+    if (useAppScope) {
+        if (access === 'edit') {
+            if (!jsonMode) {
+                printInfo(`App '${appName}' has no platform-managed repository, so revoking contributor access at the app scope instead of repository scope.`);
+            }
+        }
+        actionResult = await unshareMaafAppByPrincipalsAsync({
             tenantId,
             environmentId,
             logger: getCliLogger(),
-            actionsParams: { appName, principalIds },
-        })
-        : await (async () => {
-            const repoId = await resolveRepositoryIdAsync({ tenantId, environmentId, appName });
-            return unshareGrsRepoByPrincipalsAsync({
-                tenantId,
-                environmentId,
-                logger: getCliLogger(),
-                actionsParams: { repoId, principalIds },
-            });
-        })();
+            actionsParams: {
+                appName,
+                principalIds,
+                roleDefinitionName: role,
+            },
+        });
+    }
+    else {
+        const repoId = await resolveRepositoryIdAsync({ tenantId, environmentId, appName });
+        actionResult = await unshareGrsRepoByPrincipalsAsync({
+            tenantId,
+            environmentId,
+            logger: getCliLogger(),
+            actionsParams: { repoId, principalIds },
+        });
+    }
     return {
         result: actionResult.result,
+        scope: useAppScope ? 'app' : 'repo',
+        role,
         revokedCount: actionResult.revokedCount,
         revokedPrincipalCount: actionResult.revokedPrincipalCount,
         notFound: actionResult.notFoundPrincipalIds.map((id) => refsByPrincipalId.get(id) ?? { id, input: id }),
@@ -156,6 +250,27 @@ async function unshareDispatchAsync(inputs) {
             { id: s.principalObjectId, input: s.principalObjectId }),
     };
 }
+/**
+ * Resolves the effective {@link RepoType} from an `AppConfig`.
+ *
+ * Hard rule: if `repoType` is missing AND the config carries a (non-empty,
+ * non-zero-GUID) `repositoryId`, refuse to guess - the user must re-run
+ * `app init` to migrate the config. When both are missing we treat it as
+ * `'none'`: there is no repo-scope to act on, and the app-scope fallback in
+ * the share/unshare dispatchers handles edit correctly.
+ */
+function resolveRepoType(appConfig) {
+    if (appConfig.repoType) {
+        return appConfig.repoType;
+    }
+    const hasRepoId = !!appConfig.repositoryId && appConfig.repositoryId !== '00000000-0000-0000-0000-000000000000';
+    if (hasRepoId) {
+        throw new UsageError(`${AppConfigFileName} is missing the 'repoType' field but has a 'repositoryId' set. ` +
+            `This usually means the file was written by an older CLI. ` +
+            `Re-run "npx ${CLI_BINARY_NAME} app init" to migrate the config, then retry.`);
+    }
+    return 'none';
+}
 /**
  * Fetches the app's `repositoryId` via the info action. Used by the `edit`
  * access paths to drive the GRS repo-scope share/unshare endpoints.
@@ -177,13 +292,16 @@ async function resolveRepositoryIdAsync(args) {
  * verb keeps its pre-flag behaviour for callers that haven't migrated. Throws
  * a `UsageError` on any other value — Commander.js doesn't enforce enum
  * membership by default and we want a precise error message.
+ *
+ * `play` and `edit` are the only externally visible levels. The role and scope
+ * the level resolves to are decided downstream (see {@link MaafAppAccessLevel}).
  */
 function parseAccessLevel(raw) {
     const value = (raw ?? 'play').trim().toLowerCase();
     if (value === 'play' || value === 'edit') {
         return value;
     }
-    throw new UsageError(`Unknown --access value '${raw}'. Use 'play' (default — app access) or 'edit' (repository access).`);
+    throw new UsageError(`Unknown --access value '${raw}'. Use 'play' (default — app access) or 'edit' (edit access).`);
 }
 /**
  * Splits a comma-separated string into a deduplicated, trimmed list of inputs.
@@ -289,6 +407,15 @@ function formatFailures(failures) {
  */
 function extractGraphErrorMessage(error) {
     if (error instanceof HttpClientError) {
+        // A 403 from Graph is a consent/permission problem with the caller's
+        // sign-in, not a bad principal. Echoing Graph's opaque "Insufficient
+        // privileges to complete the operation" under the "Could not resolve
+        // <email>" heading misleads users into thinking the email is wrong, so we
+        // replace it with an actionable message naming the real cause and the
+        // ways forward. See {@link formatGraphPermissionError}.
+        if (error.status === 403) {
+            return formatGraphPermissionError(error.status);
+        }
         const message = extractGraphMessageFromBody(error.body);
         if (message !== undefined) {
             return `Graph ${error.status}: ${message}`;
@@ -297,6 +424,21 @@ function extractGraphErrorMessage(error) {
     }
     return error instanceof Error ? error.message : String(error);
 }
+/**
+ * Builds the actionable reason for a Graph 403 hit during principal resolution.
+ * The email→object-id lookup needs the `User.ReadBasic.All` and
+ * `Group.Read.All` delegated Graph permissions; a 403 means the active
+ * account's token doesn't carry them in this tenant (consent was never
+ * granted). Rather than surface Graph's opaque "Insufficient privileges", we
+ * name the cause and the two ways forward: get those permissions consented, or
+ * skip the lookup entirely by passing the AAD object ID (GUID) instead of an
+ * email.
+ */
+function formatGraphPermissionError(status) {
+    return (`Graph ${status}: your sign-in lacks permission to look up accounts by email. ` +
+        `Pass the AAD object ID (GUID) instead, or have an admin grant the ` +
+        `User.ReadBasic.All and Group.Read.All Graph permissions.`);
+}
 /**
  * Parses a Graph error body string and returns the inner `error.message`. Returns
  * `undefined` if the body is missing, not valid JSON, or doesn't carry the
@@ -331,11 +473,11 @@ function looksLikeEmail(input) {
  * (when the user supplied one) keeps the wire payload self-describing for server
  * logs even though the response strips it.
  */
-function toMaafPermissionEntry(ref) {
+function toMaafPermissionEntry(ref, role) {
     return {
         name: ref.displayName ?? ref.input,
         properties: {
-            roleName: MaafAppReaderRoleName,
+            roleName: role,
             principal: ref.email ? { id: ref.id, email: ref.email } : { id: ref.id },
         },
     };