@microsoft/managed-apps-cli 0.9.2 → 0.11.0

package/dist/Utils/EnvVars.js.map

@@ -1 +1 @@
-{"version":3,"file":"EnvVars.js","sourceRoot":"","sources":["../../src/Utils/EnvVars.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,MAAM,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC;AAmFvD,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,OAAO,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;AACvC,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB,EAAE,KAAa;IAC7D,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAmB;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAA4B;IACrD,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"EnvVars.js","sourceRoot":"","sources":["../../src/Utils/EnvVars.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,MAAM,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC;AAoFvD,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,OAAO,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;AACvC,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB,EAAE,KAAa;IAC7D,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAmB;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAA4B;IACrD,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/dist/Utils/EnvironmentRoutingUtils.d.ts

@@ -31,6 +31,22 @@ export declare function resolveRoutingEnvironmentIdAsync(resultPromise: Promise<
 export declare function startPdeRoutingAsync(argumentProvider: ArgumentProvider, tenantId: string, logger: ILogger, telemetryNamespace: string, options?: {
     trackBackgroundFailure?: boolean;
 }): Promise<string>;
+/**
+ * Awaits a PDE routing promise that was started in the background by
+ * {@link startPdeRoutingAsync}. If the environment was already resolved
+ * (e.g. via `--environment-id` flag or config), returns it immediately
+ * without awaiting the promise.
+ *
+ * On failure, prints a user-friendly error with a `--environment-id` hint
+ * so the user knows how to bypass automatic resolution, then re-throws
+ * the original error for the caller's top-level handler.
+ *
+ * Both `app create` and `app init` share this pattern; extracting it here
+ * keeps the hint message consistent and ensures that *all* error types —
+ * HTTP error codes, `operationSuccess: false` (200-level failures), and
+ * unexpected exceptions — surface the same recovery guidance.
+ */
+export declare function awaitRoutingEnvironmentAsync(preResolvedEnvironmentId: string | undefined, routingEnvPromise: Promise<string> | undefined): Promise<string>;
 /**
  * Resolves an environment ID for read-only browse verbs (`ms connector list`,
  * `ms connector list-actions`, etc.) without ever prompting the user.
@@ -54,7 +70,10 @@ export declare function startPdeRoutingAsync(argumentProvider: ArgumentProvider,
  * target the right tenant cluster.
  *
  * Throws `UsageError` when the tenant ID can't be resolved (auth issue) or
- * when the routing service returns an actionable failure.
+ * when the routing service returns an actionable failure. When PDE routing
+ * fails (including a provisioning timeout), prints the shared
+ * `--environment-id` recovery hint before re-throwing, matching `app init` /
+ * `app create`.
  */
 export declare function resolveEnvironmentIdOrPdeAsync(argumentProvider: ArgumentProvider, logger: ILogger, options?: {
     jsonMode?: boolean;

package/dist/Utils/EnvironmentRoutingUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EnvironmentRoutingUtils.d.ts","sourceRoot":"","sources":["../../src/Utils/EnvironmentRoutingUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAO/F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0CAA0C,CAAC;AAExE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAK5D,wBAAsB,gCAAgC,CACpD,aAAa,EAAE,OAAO,CAAC,+BAA+B,CAAC,EACvD,UAAU,EAAE,WAAW,EACvB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAiBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,kBAAkB,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE;IAAE,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAClD,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D,OAAO,CAAC,MAAM,CAAC,CA8BjB"}
+{"version":3,"file":"EnvironmentRoutingUtils.d.ts","sourceRoot":"","sources":["../../src/Utils/EnvironmentRoutingUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAO/F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0CAA0C,CAAC;AAExE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAK5D,wBAAsB,gCAAgC,CACpD,aAAa,EAAE,OAAO,CAAC,+BAA+B,CAAC,EACvD,UAAU,EAAE,WAAW,EACvB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAiBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,kBAAkB,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE;IAAE,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAqBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,wBAAwB,EAAE,MAAM,GAAG,SAAS,EAC5C,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,GAC7C,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,8BAA8B,CAClD,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D,OAAO,CAAC,MAAM,CAAC,CA6BjB"}

package/dist/Utils/EnvironmentRoutingUtils.js

@@ -6,7 +6,7 @@ import { NotFoundError, UsageError } from '@microsoft/managed-apps-common/errors
 import { getUserRoutingEnvironmentAsync, ManagedGovernanceError, ManagedGovernanceTimeoutError, pollRoutingEnvironmentAsync, } from '@microsoft/managed-apps-common/services';
 import { resolveEnvironmentId } from '../CliUtils.js';
 import { CLI_CLIENT_ID } from '../Constants.js';
-import { printInfo } from './ConsoleOutput.js';
+import { printError, printInfo } from './ConsoleOutput.js';
 export async function resolveRoutingEnvironmentIdAsync(resultPromise, httpClient, logger) {
     // Translate routing-service errors into a UsageError so the user sees an actionable message
     // rather than the raw "ManagedGovernance request failed with status 403" implementation detail.
@@ -15,6 +15,15 @@ export async function resolveRoutingEnvironmentIdAsync(resultPromise, httpClient
     try {
         const result = await resultPromise;
         if (result.status === 200) {
+            // Mirror the checks in `pollRoutingEnvironmentAsync`: treat a 200 with
+            // `operationSuccess: false`, `environmentFound: false`, or a non-null
+            // `errorCode` as a governance failure so it flows through
+            // `toRoutingUsageError` and surfaces an actionable CLI message.
+            if (result.data.operationSuccess === false ||
+                result.data.environmentFound === false ||
+                !!result.data.errorCode) {
+                throw new ManagedGovernanceError(200, result.data.message, result.data.errorCode);
+            }
             const name = result.data.environment?.name;
             if (!name) {
                 throw new NotFoundError('Routing service returned 200 with no environment name.');
@@ -82,6 +91,53 @@ export function startPdeRoutingAsync(argumentProvider, tenantId, logger, telemet
     }
     return promise;
 }
+/**
+ * Prints a consistent, actionable error for a failed developer-environment
+ * resolution — HTTP failure, governance failure, or routing timeout — and
+ * points the user at the `--environment-id` escape hatch. Shared by `app init`,
+ * `app create`, and the read-only browse verbs (`connector list` /
+ * `connector list-actions`) so every command that auto-resolves a developer
+ * environment surfaces the same recovery guidance. Writes to stderr, so it is
+ * safe to call in JSON mode.
+ */
+function printRoutingResolutionError(error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    printError(`Failed to resolve a developer environment.\n\n` +
+        `  ${detail}\n\n` +
+        `To retry, run the same command again. ` +
+        `Alternatively, pass --environment-id <id> to use a known environment.`);
+}
+/**
+ * Awaits a PDE routing promise that was started in the background by
+ * {@link startPdeRoutingAsync}. If the environment was already resolved
+ * (e.g. via `--environment-id` flag or config), returns it immediately
+ * without awaiting the promise.
+ *
+ * On failure, prints a user-friendly error with a `--environment-id` hint
+ * so the user knows how to bypass automatic resolution, then re-throws
+ * the original error for the caller's top-level handler.
+ *
+ * Both `app create` and `app init` share this pattern; extracting it here
+ * keeps the hint message consistent and ensures that *all* error types —
+ * HTTP error codes, `operationSuccess: false` (200-level failures), and
+ * unexpected exceptions — surface the same recovery guidance.
+ */
+export async function awaitRoutingEnvironmentAsync(preResolvedEnvironmentId, routingEnvPromise) {
+    if (preResolvedEnvironmentId) {
+        return preResolvedEnvironmentId;
+    }
+    if (!routingEnvPromise) {
+        throw new UsageError('Unable to resolve a developer environment. ' +
+            'Pass --environment-id <id> to specify one explicitly.');
+    }
+    try {
+        return await routingEnvPromise;
+    }
+    catch (error) {
+        printRoutingResolutionError(error);
+        throw error;
+    }
+}
 /**
  * Resolves an environment ID for read-only browse verbs (`ms connector list`,
  * `ms connector list-actions`, etc.) without ever prompting the user.
@@ -105,7 +161,10 @@ export function startPdeRoutingAsync(argumentProvider, tenantId, logger, telemet
  * target the right tenant cluster.
  *
  * Throws `UsageError` when the tenant ID can't be resolved (auth issue) or
- * when the routing service returns an actionable failure.
+ * when the routing service returns an actionable failure. When PDE routing
+ * fails (including a provisioning timeout), prints the shared
+ * `--environment-id` recovery hint before re-throwing, matching `app init` /
+ * `app create`.
  */
 export async function resolveEnvironmentIdOrPdeAsync(argumentProvider, logger, options) {
     const fromConfig = await resolveEnvironmentId(argumentProvider, { failIfMissing: false });
@@ -119,11 +178,27 @@ export async function resolveEnvironmentIdOrPdeAsync(argumentProvider, logger, o
     if (!options?.jsonMode) {
         printInfo('No environment specified — resolving your developer environment…');
     }
-    const environmentId = await startPdeRoutingAsync(argumentProvider, tenantId, logger, options?.telemetryNamespace ?? 'BrowseVerb', { trackBackgroundFailure: false });
+    const environmentId = await resolvePdeWithHintAsync(argumentProvider, tenantId, logger, options?.telemetryNamespace ?? 'BrowseVerb');
     updateEnvironmentName(environmentId);
     if (!options?.jsonMode) {
         printInfo(`Using developer environment ${environmentId}.`);
     }
     return environmentId;
 }
+/**
+ * Runs PDE routing for a browse verb and, on failure, prints the shared
+ * `--environment-id` recovery hint before re-throwing — mirroring the guidance
+ * `app init` / `app create` give via {@link awaitRoutingEnvironmentAsync}.
+ */
+async function resolvePdeWithHintAsync(argumentProvider, tenantId, logger, telemetryNamespace) {
+    try {
+        return await startPdeRoutingAsync(argumentProvider, tenantId, logger, telemetryNamespace, {
+            trackBackgroundFailure: false,
+        });
+    }
+    catch (error) {
+        printRoutingResolutionError(error);
+        throw error;
+    }
+}
 //# sourceMappingURL=EnvironmentRoutingUtils.js.map

package/dist/Utils/EnvironmentRoutingUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"EnvironmentRoutingUtils.js","sourceRoot":"","sources":["../../src/Utils/EnvironmentRoutingUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AAElF,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,yCAAyC,CAAC;AAIjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,aAAuD,EACvD,UAAuB,EACvB,MAAe;IAEf,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,0CAA0C;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QAEnC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,aAAa,CAAC,wDAAwD,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,8DAA8D;QAC9D,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,eAAe,GAAG,MAAM,2BAA2B,CACvD,UAAU,EACV,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,YAAY,EACnB,MAAM,CACP,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,aAAa,CACrB,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU;YAC3B,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE;YACtB,CAAC,CAAC,sFAAsF,CAAC;QAC3F,OAAO,IAAI,UAAU,CACnB,uEAAuE,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;QACjD,OAAO,IAAI,UAAU,CAAC,wEAAwE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAClC,gBAAkC,EAClC,QAAgB,EAChB,MAAe,EACf,kBAA0B,EAC1B,OAA8C;IAE9C,MAAM,EAAE,sBAAsB,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,gCAAgC,CAC9C,8BAA8B,CAC5B,UAAU,EACV,QAAQ,EACR,aAAa,EACb,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAC7B,MAAM,EACN,MAAM,CACP,EACD,UAAU,EACV,MAAM,CACP,CAAC;IACF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/B,MAAM,CAAC,eAAe,CAAC,GAAG,kBAAkB,sCAAsC,EAAE;gBAClF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,gBAAkC,EAClC,MAAe,EACf,OAA6D;IAE7D,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACvB,SAAS,CAAC,kEAAkE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,gBAAgB,EAChB,QAAQ,EACR,MAAM,EACN,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAC3C,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAClC,CAAC;IAEF,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAErC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACvB,SAAS,CAAC,+BAA+B,aAAa,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"EnvironmentRoutingUtils.js","sourceRoot":"","sources":["../../src/Utils/EnvironmentRoutingUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AAElF,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,yCAAyC,CAAC;AAIjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,aAAuD,EACvD,UAAuB,EACvB,MAAe;IAEf,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,0CAA0C;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QAEnC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,uEAAuE;YACvE,sEAAsE;YACtE,0DAA0D;YAC1D,gEAAgE;YAChE,IACE,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,KAAK;gBACtC,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,KAAK;gBACtC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EACvB,CAAC;gBACD,MAAM,IAAI,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,aAAa,CAAC,wDAAwD,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,8DAA8D;QAC9D,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,eAAe,GAAG,MAAM,2BAA2B,CACvD,UAAU,EACV,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,YAAY,EACnB,MAAM,CACP,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,aAAa,CACrB,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU;YAC3B,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE;YACtB,CAAC,CAAC,sFAAsF,CAAC;QAC3F,OAAO,IAAI,UAAU,CACnB,uEAAuE,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;QACjD,OAAO,IAAI,UAAU,CAAC,wEAAwE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAClC,gBAAkC,EAClC,QAAgB,EAChB,MAAe,EACf,kBAA0B,EAC1B,OAA8C;IAE9C,MAAM,EAAE,sBAAsB,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,gCAAgC,CAC9C,8BAA8B,CAC5B,UAAU,EACV,QAAQ,EACR,aAAa,EACb,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAC7B,MAAM,EACN,MAAM,CACP,EACD,UAAU,EACV,MAAM,CACP,CAAC;IACF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/B,MAAM,CAAC,eAAe,CAAC,GAAG,kBAAkB,sCAAsC,EAAE;gBAClF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAAC,KAAc;IACjD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,UAAU,CACR,gDAAgD;QAC9C,KAAK,MAAM,MAAM;QACjB,wCAAwC;QACxC,uEAAuE,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,wBAA4C,EAC5C,iBAA8C;IAE9C,IAAI,wBAAwB,EAAE,CAAC;QAC7B,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAClB,6CAA6C;YAC3C,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,iBAAiB,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2BAA2B,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,gBAAkC,EAClC,MAAe,EACf,OAA6D;IAE7D,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACvB,SAAS,CAAC,kEAAkE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,gBAAgB,EAChB,QAAQ,EACR,MAAM,EACN,OAAO,EAAE,kBAAkB,IAAI,YAAY,CAC5C,CAAC;IAEF,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAErC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACvB,SAAS,CAAC,+BAA+B,aAAa,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CACpC,gBAAkC,EAClC,QAAgB,EAChB,MAAe,EACf,kBAA0B;IAE1B,IAAI,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACxF,sBAAsB,EAAE,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2BAA2B,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/Utils/GitErrorClassifier.d.ts

@@ -0,0 +1,40 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import type { AppError } from '../Errors/CliError.js';
+/**
+ * Context handed to {@link classifyLocalGitError} so the resulting message can
+ * name what the CLI was doing when git failed (e.g. "fetching from
+ * contoso.ghe.com"). The caller owns this string because the chokepoint only
+ * sees argv (`['fetch', 'origin']`) and can't reconstruct the remote host.
+ */
+export interface GitClassifyContext {
+    /**
+     * Human phrase completing "... while {action}", e.g.
+     * `fetching from contoso.ghe.com`.
+     */
+    action: string;
+}
+/**
+ * Maps raw git failure output to a CLI-facing {@link AppError} subclass so a
+ * native (platform-managed) git operation that fails on auth or network reports
+ * the right exit code and a cause-specific, actionable message instead of an
+ * opaque `fatal: Authentication failed`.
+ *
+ * Auth failures are split into distinct buckets (credential rejected / no
+ * promptable credential / invalid-or-expired credential) so the user gets the
+ * fix that matches their situation rather than one generic "sign in again".
+ * Each returned error also carries a stable `errorData.classifierBucket` (plus
+ * the `action`) for telemetry without re-parsing the message text.
+ *
+ * The returned message embeds the original git output verbatim (callers and
+ * tests substring-match on git's own wording). Returns `null` for any output
+ * that doesn't clearly match a known category, signalling the caller to
+ * re-throw the original error unchanged.
+ *
+ * Note: this is deliberately scoped to the platform-managed (GRS) git flow,
+ * whose credentials come from Git Credential Manager's browser OAuth — NOT the
+ * external GitHub-repo flow (which has its own `git auth refresh` recovery).
+ */
+export declare function classifyLocalGitError(rawOutput: string, context: GitClassifyContext): AppError | null;
+//# sourceMappingURL=GitErrorClassifier.d.ts.map

package/dist/Utils/GitErrorClassifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitErrorClassifier.d.ts","sourceRoot":"","sources":["../../src/Utils/GitErrorClassifier.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGnD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAqGD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,kBAAkB,GAC1B,QAAQ,GAAG,IAAI,CAsBjB"}

package/dist/Utils/GitErrorClassifier.js

@@ -0,0 +1,120 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { AuthenticationError, NetworkError } from '../Errors/CliError.js';
+// A single "authentication failed" message is too vague to act on. Git's stderr
+// carries enough signal to separate the three auth failure modes the GRS flow
+// hits, each with a different fix. Order matters: the credential-rejected (403)
+// and prompt-unavailable rules are checked before the generic catch-all because
+// their stderr often also contains the word "authentication".
+const AUTH_RULES = [
+    // A credential was sent but the remote rejected it. For the GRS flow this is
+    // an authorization problem, not a bad password: either the signed-in account
+    // is wrong/under-permissioned, or GCM silently returned a cached credential
+    // for a different identity than the current `ms auth` profile.
+    {
+        patterns: [/403 forbidden/i, /returned error: 403/i, /access denied/i],
+        bucket: 'auth-403',
+        build: (action) => `Git reached the remote but access was denied while ${action} (HTTP 403). This usually ` +
+            `means one of:\n` +
+            `  - the signed-in account is in the wrong tenant, or lacks permission to this app's repo; or\n` +
+            `  - Git Credential Manager returned a cached credential for a different account than your ` +
+            `current 'ms auth' sign-in (a stale or mismatched credential).\n` +
+            `Confirm 'ms auth status' shows the account and tenant for this environment. If it doesn't ` +
+            `match, clear the cached git credential for the host ('git credential-manager erase', or ` +
+            `remove it from your OS credential store) so Git re-prompts, then re-run.`,
+    },
+    // No usable credential and git cannot prompt for one: either Git Credential
+    // Manager isn't configured, or the session is non-interactive (no TTY /
+    // GIT_TERMINAL_PROMPT=0) so the browser sign-in never opens.
+    {
+        patterns: [
+            /terminal prompts disabled/i,
+            /could not read username/i,
+            /could not read password/i,
+        ],
+        bucket: 'auth-prompt-unavailable',
+        build: (action) => `Git could not obtain a credential while ${action}: there is no cached credential and the ` +
+            `session can't prompt for one. Make sure Git Credential Manager is installed, then re-run ` +
+            `in an interactive terminal so the browser sign-in can complete.`,
+    },
+    // A credential was tried but is invalid or expired — the recoverable case is a
+    // fresh browser sign-in (or clearing a stale cached credential).
+    {
+        patterns: [/authentication failed/i, /invalid username or password/i],
+        bucket: 'auth-invalid-credential',
+        build: (action) => `Git authentication failed while ${action}: the credential was missing, invalid, or expired. ` +
+            `When the browser opens, sign in with the account for this environment's tenant; if a stale ` +
+            `credential is cached, clear it in Git Credential Manager and re-run.`,
+    },
+];
+// Network patterns are intentionally conservative: only stderr we are confident
+// maps to connectivity is classified. Anything ambiguous (e.g. "repository not
+// found", "permission denied to a path", TLS/cert errors) is left unrecognized
+// so the original error bubbles up untouched rather than being mislabeled.
+const NETWORK_PATTERNS = [
+    /could not resolve host/i,
+    /could not resolve proxy/i,
+    /failed to connect/i,
+    /connection timed out/i,
+    /connection refused/i,
+    /network is unreachable/i,
+    /temporary failure in name resolution/i,
+];
+/**
+ * Redacts credential-bearing userinfo from any URL in git's output before that
+ * output is embedded verbatim in a user-facing error message. The classified
+ * message can reach the `--json` envelope, which CI pipelines and agent
+ * orchestrators capture — so a credential must never ride along.
+ *
+ * The GRS flow's GCM browser-OAuth keeps tokens out of stderr, so this is
+ * defense-in-depth: a no-op in the normal case, but a guard against a
+ * PAT-in-URL helper or a GCM fallback that prints a credential-bearing remote
+ * like `https://oauth2:TOKEN@host/` or `git://TOKEN@host/`. We match any
+ * `scheme://` authority (http, https, ssh, git, …) and strip the entire
+ * userinfo (covering both `user:secret@` and bare `token@` forms) up to the
+ * `@`, without crossing a `/` or whitespace so only the authority is touched.
+ */
+function redactUrlCredentials(text) {
+    return text.replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^/\s@]+@/gi, '$1[REDACTED]@');
+}
+/**
+ * Maps raw git failure output to a CLI-facing {@link AppError} subclass so a
+ * native (platform-managed) git operation that fails on auth or network reports
+ * the right exit code and a cause-specific, actionable message instead of an
+ * opaque `fatal: Authentication failed`.
+ *
+ * Auth failures are split into distinct buckets (credential rejected / no
+ * promptable credential / invalid-or-expired credential) so the user gets the
+ * fix that matches their situation rather than one generic "sign in again".
+ * Each returned error also carries a stable `errorData.classifierBucket` (plus
+ * the `action`) for telemetry without re-parsing the message text.
+ *
+ * The returned message embeds the original git output verbatim (callers and
+ * tests substring-match on git's own wording). Returns `null` for any output
+ * that doesn't clearly match a known category, signalling the caller to
+ * re-throw the original error unchanged.
+ *
+ * Note: this is deliberately scoped to the platform-managed (GRS) git flow,
+ * whose credentials come from Git Credential Manager's browser OAuth — NOT the
+ * external GitHub-repo flow (which has its own `git auth refresh` recovery).
+ */
+export function classifyLocalGitError(rawOutput, context) {
+    const detail = redactUrlCredentials(rawOutput.trimEnd());
+    if (!detail)
+        return null;
+    for (const rule of AUTH_RULES) {
+        if (rule.patterns.some((p) => p.test(detail))) {
+            return new AuthenticationError(`${rule.build(context.action)}\n\nGit output:\n${detail}`, {
+                classifierBucket: rule.bucket,
+                action: context.action,
+            });
+        }
+    }
+    if (NETWORK_PATTERNS.some((p) => p.test(detail))) {
+        return new NetworkError(`Git could not reach the remote while ${context.action}. Check your network ` +
+            `connection (and proxy settings, if any) and try again.\n\nGit output:\n${detail}`, { classifierBucket: 'network', action: context.action });
+    }
+    return null;
+}
+//# sourceMappingURL=GitErrorClassifier.js.map

package/dist/Utils/GitErrorClassifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitErrorClassifier.js","sourceRoot":"","sources":["../../src/Utils/GitErrorClassifier.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAiCvE,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,8DAA8D;AAC9D,MAAM,UAAU,GAAe;IAC7B,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,+DAA+D;IAC/D;QACE,QAAQ,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,gBAAgB,CAAC;QACtE,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAChB,sDAAsD,MAAM,4BAA4B;YACxF,iBAAiB;YACjB,gGAAgG;YAChG,4FAA4F;YAC5F,iEAAiE;YACjE,4FAA4F;YAC5F,0FAA0F;YAC1F,0EAA0E;KAC7E;IACD,4EAA4E;IAC5E,wEAAwE;IACxE,6DAA6D;IAC7D;QACE,QAAQ,EAAE;YACR,4BAA4B;YAC5B,0BAA0B;YAC1B,0BAA0B;SAC3B;QACD,MAAM,EAAE,yBAAyB;QACjC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAChB,2CAA2C,MAAM,0CAA0C;YAC3F,2FAA2F;YAC3F,iEAAiE;KACpE;IACD,+EAA+E;IAC/E,iEAAiE;IACjE;QACE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;QACrE,MAAM,EAAE,yBAAyB;QACjC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAChB,mCAAmC,MAAM,qDAAqD;YAC9F,6FAA6F;YAC7F,sEAAsE;KACzE;CACF,CAAC;AAEF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,gBAAgB,GAAa;IACjC,yBAAyB;IACzB,0BAA0B;IAC1B,oBAAoB;IACpB,uBAAuB;IACvB,qBAAqB;IACrB,yBAAyB;IACzB,uCAAuC;CACxC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,uCAAuC,EAAE,eAAe,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,OAA2B;IAE3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,mBAAmB,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,MAAM,EAAE,EAAE;gBACxF,gBAAgB,EAAE,IAAI,CAAC,MAAM;gBAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,YAAY,CACrB,wCAAwC,OAAO,CAAC,MAAM,uBAAuB;YAC3E,0EAA0E,MAAM,EAAE,EACpF,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/Utils/GitRunner.d.ts

@@ -0,0 +1,107 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { type GitClassifyContext } from './GitErrorClassifier.js';
+/**
+ * Options for {@link runGit}.
+ */
+export interface RunGitOptions {
+    /** Working directory the git command runs in. Defaults to `process.cwd()`. */
+    cwd?: string;
+    /**
+     * Marks a remote-touching op (fetch / push / clone). For a network op that is
+     * neither classified nor a silent probe, stderr is *inherited* so git's live
+     * progress and any interactive credential prompts reach the user's terminal in
+     * real time instead of being buffered and only re-emitted after the process
+     * exits (these call sites own their own messaging and don't need the captured
+     * text).
+     *
+     * Setting `classify` *overrides* this live-streaming behavior: a classified
+     * network op keeps stderr piped so the failure output is available to
+     * {@link classifyLocalGitError} (the user sees no live progress — only the
+     * classified message once the op finishes). `allowFailure` probes likewise
+     * keep stderr piped so the caller can inspect {@link GitResult.stderr}.
+     */
+    network?: boolean;
+    /**
+     * When true, a non-zero exit (or a spawn failure such as `git` missing from
+     * PATH) returns a {@link GitResult} with `success: false` instead of
+     * throwing. Use for probes whose failure is an expected, recoverable signal
+     * (e.g. `rev-parse --verify origin/main` on an empty repo, or `remote add`
+     * when origin already exists).
+     */
+    allowFailure?: boolean;
+    /**
+     * Capture the command's stdout and return it on {@link GitResult.stdout}.
+     * Defaults to false (stdout is discarded) since most git mutations write
+     * nothing useful to stdout.
+     */
+    captureStdout?: boolean;
+    /**
+     * Re-emit captured stderr to the parent process's stderr so the user still
+     * sees git's own message. Defaults to true. Set false for silent probes
+     * where a non-zero exit is an expected control-flow signal, not an error to
+     * surface.
+     */
+    emitStderr?: boolean;
+    /**
+     * Opt-in error classification for the throwing path (ignored when
+     * `allowFailure` is true). When set and the command fails, the captured
+     * output is run through {@link classifyLocalGitError}; a recognized
+     * auth/network failure is re-thrown as a typed {@link AppError} (carrying the
+     * right exit code) whose message embeds git's original output. Unrecognized
+     * output falls through to the normal emit-and-rethrow of the original error.
+     *
+     * Scoped to the platform-managed (GRS) git flow — do NOT set it for the
+     * external GitHub-repo clone or the template clone, which own their own
+     * messaging and use different credentials.
+     */
+    classify?: GitClassifyContext;
+}
+/**
+ * Structured outcome of a git invocation, modeled as a discriminated union on
+ * `success` so the type system encodes the failure invariant: a failed op
+ * always carries its caught {@link Error}, a successful one never does. `stderr`
+ * is populated only on the failure path (and for `allowFailure` probes):
+ * `execFileSync` exposes a command's stderr just on the thrown error, so a
+ * *successful* piped op's stderr is not captured here (it's discarded). On
+ * failure, the captured text is what enables downstream classification — e.g. a
+ * failed network op's `fatal: Authentication failed…` is available to the
+ * caller instead of vanishing into an inherited terminal stream.
+ */
+export type GitResult = {
+    success: true;
+    /** Always 0 on the success path. */
+    status: 0;
+    stdout: string;
+    stderr: string;
+} | {
+    success: false;
+    /** Process exit code, or null when the process could not be spawned. */
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    /** The caught error (non-zero exit or spawn failure); always present. */
+    error: Error;
+};
+/**
+ * Single chokepoint for every `git` invocation in the CLI.
+ *
+ * Centralizing git here gives one stdio policy (stdin ignored so a child can
+ * never block waiting for input; stderr piped so a *failure's* output is
+ * captured rather than lost to an inherited stream) and one place to hang
+ * pre/post checks on. Because `execFileSync` only surfaces stderr via the
+ * thrown error, capture applies to the failure path: on failure the captured
+ * stderr is re-emitted by default so users still see git's own message, and is
+ * also returned (on `allowFailure`) or attached to the thrown error
+ * (`error.stderr`) for classification. A *successful* piped op's stderr is not
+ * captured (it is discarded). The one exception to piping is an un-classified,
+ * non-probe {@link RunGitOptions.network} op, whose stderr is inherited so live
+ * progress and credential prompts stream straight through on success too.
+ *
+ * On failure with `allowFailure: false` (the default), the *original* error is
+ * re-thrown so existing message-based handling keeps working — the caught error
+ * now additionally carries a populated `stderr` because we pipe it.
+ */
+export declare function runGit(args: string[], options?: RunGitOptions): GitResult;
+//# sourceMappingURL=GitRunner.d.ts.map

package/dist/Utils/GitRunner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitRunner.d.ts","sourceRoot":"","sources":["../../src/Utils/GitRunner.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEtF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,OAAO,EAAE,IAAI,CAAC;IACd,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,OAAO,EAAE,KAAK,CAAC;IACf,wEAAwE;IACxE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,KAAK,EAAE,KAAK,CAAC;CACd,CAAC;AAkBN;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,aAAkB,GAAG,SAAS,CAgE7E"}

package/dist/Utils/GitRunner.js

@@ -0,0 +1,89 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { execFileSync } from 'child_process';
+import { classifyLocalGitError } from './GitErrorClassifier.js';
+function toStr(value) {
+    if (value == null)
+        return '';
+    return Buffer.isBuffer(value) ? value.toString() : value;
+}
+/**
+ * Explicit stdout/stderr capture ceiling for every git invocation. Node's
+ * `execFileSync` defaults to a 1 MB `maxBuffer`; exceeding it throws `ENOBUFS`
+ * (treated by callers as a generic failure). `ls-tree -r HEAD` on a large repo,
+ * or verbose clone/fetch progress, can blow past 1 MB — and an `allowFailure`
+ * probe would silently misread that `ENOBUFS` as its expected control-flow
+ * signal (e.g. "repo is empty"). A generous ceiling avoids those spurious
+ * failures while still guarding against runaway memory.
+ */
+const GIT_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
+/**
+ * Single chokepoint for every `git` invocation in the CLI.
+ *
+ * Centralizing git here gives one stdio policy (stdin ignored so a child can
+ * never block waiting for input; stderr piped so a *failure's* output is
+ * captured rather than lost to an inherited stream) and one place to hang
+ * pre/post checks on. Because `execFileSync` only surfaces stderr via the
+ * thrown error, capture applies to the failure path: on failure the captured
+ * stderr is re-emitted by default so users still see git's own message, and is
+ * also returned (on `allowFailure`) or attached to the thrown error
+ * (`error.stderr`) for classification. A *successful* piped op's stderr is not
+ * captured (it is discarded). The one exception to piping is an un-classified,
+ * non-probe {@link RunGitOptions.network} op, whose stderr is inherited so live
+ * progress and credential prompts stream straight through on success too.
+ *
+ * On failure with `allowFailure: false` (the default), the *original* error is
+ * re-thrown so existing message-based handling keeps working — the caught error
+ * now additionally carries a populated `stderr` because we pipe it.
+ */
+export function runGit(args, options = {}) {
+    const { cwd, allowFailure = false, captureStdout = false, emitStderr = true, classify, network = false, } = options;
+    // A network op that is neither classified nor a silent probe streams git's
+    // stderr live (progress + interactive credential prompts) instead of
+    // buffering it; every other case pipes stderr so it can be captured for
+    // classification or returned to the caller.
+    const inheritStderr = network && !classify && !allowFailure;
+    try {
+        const stdout = execFileSync('git', args, {
+            cwd,
+            stdio: ['ignore', captureStdout ? 'pipe' : 'ignore', inheritStderr ? 'inherit' : 'pipe'],
+            maxBuffer: GIT_MAX_BUFFER_BYTES,
+        });
+        return {
+            success: true,
+            status: 0,
+            stdout: captureStdout ? toStr(stdout) : '',
+            stderr: '',
+        };
+    }
+    catch (err) {
+        const e = err;
+        const stderr = toStr(e.stderr);
+        // Classification runs on the throwing path only, and BEFORE we re-emit
+        // stderr: a recognized failure is re-thrown as a typed AppError whose
+        // message already embeds git's output, so emitting stderr here too would
+        // double-print it (the top-level catch prints the thrown message).
+        if (classify && !allowFailure) {
+            const text = stderr || toStr(e.stdout) || (err instanceof Error ? err.message : String(err));
+            const classified = classifyLocalGitError(text, classify);
+            if (classified) {
+                throw classified;
+            }
+        }
+        if (emitStderr && stderr) {
+            process.stderr.write(stderr);
+        }
+        if (!allowFailure) {
+            throw err;
+        }
+        return {
+            success: false,
+            status: typeof e.status === 'number' ? e.status : null,
+            stdout: toStr(e.stdout),
+            stderr,
+            error: err instanceof Error ? err : new Error(String(err)),
+        };
+    }
+}
+//# sourceMappingURL=GitRunner.js.map

package/dist/Utils/GitRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitRunner.js","sourceRoot":"","sources":["../../src/Utils/GitRunner.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAA2B,MAAM,sBAAsB,CAAC;AAwFtF,SAAS,KAAK,CAAC,KAAyC;IACtD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,MAAM,CAAC,IAAc,EAAE,UAAyB,EAAE;IAChE,MAAM,EACJ,GAAG,EACH,YAAY,GAAG,KAAK,EACpB,aAAa,GAAG,KAAK,EACrB,UAAU,GAAG,IAAI,EACjB,QAAQ,EACR,OAAO,GAAG,KAAK,GAChB,GAAG,OAAO,CAAC;IAEZ,2EAA2E;IAC3E,qEAAqE;IACrE,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACvC,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YACxF,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;YAC1C,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAIT,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAE/B,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7F,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,UAAU,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YACtD,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACvB,MAAM;YACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SAC3D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/Utils/GitUtils.d.ts

@@ -6,6 +6,10 @@ export interface GitDefaults {
     commitSha: string;
     detached: boolean;
 }
+export interface InitializeLocalGitRepoResult {
+    success: boolean;
+    error?: string;
+}
 /**
  * Reads the current branch and commit SHA from the working directory's git repo.
  * Returns null when git is unavailable or the directory is not a git repo.
@@ -18,6 +22,14 @@ export declare function resolveGitDefaults(): GitDefaults | null;
  * Returns null when git is unavailable or the directory is not a git repo
  */
 export declare function getCurrentGitRemoteUrl(): string | undefined;
+/**
+ * Initializes a local git repository in the current working directory and
+ * optionally configures the origin remote in the supplied working directory.
+ * Returns true when `git init` succeeds, false when git is unavailable or the
+ * command fails for any reason (e.g. permissions). Callers should treat false as
+ * a soft failure — the app was already created; git can be initialized manually.
+ */
+export declare function initializeLocalGitRepo(remoteUrl?: string, cwd?: string): InitializeLocalGitRepoResult;
 /**
  * Returns true when the working tree has uncommitted changes (staged, unstaged, or untracked).
  * Returns null when git is unavailable or the directory is not a git repo, so callers can skip

package/dist/Utils/GitUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GitUtils.d.ts","sourceRoot":"","sources":["../../src/Utils/GitUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,WAAW,GAAG,IAAI,CAQvD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAS3D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,GAAG,IAAI,CAOtD"}
+{"version":3,"file":"GitUtils.d.ts","sourceRoot":"","sources":["../../src/Utils/GitUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,WAAW,GAAG,IAAI,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAQ3D;AA0BD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,SAAgB,GAClB,4BAA4B,CA0B9B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,GAAG,IAAI,CAQtD"}