@peterhauge/apiops-cli 0.1.3-alpha.0

package/dist/services/init-service.js

@@ -0,0 +1,304 @@
+/**
+ * T042 & T051: Init orchestrator service
+ * Coordinates interactive prompts or flag-based config, generates scaffold files,
+ * and detects existing file conflicts
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { logger } from '../lib/logger.js';
+import { promptService } from './prompt-service.js';
+import { identityGuideService } from './identity-guide-service.js';
+import { generateExtractWorkflow, } from '../templates/github-actions/extract-workflow.js';
+import { generatePublishWorkflow, } from '../templates/github-actions/publish-workflow.js';
+import { generateExtractPipeline, } from '../templates/azure-devops/extract-pipeline.js';
+import { generatePublishPipeline, } from '../templates/azure-devops/publish-pipeline.js';
+import { generateFilterConfig } from '../templates/configs/filter-config.js';
+import { generateOverrideConfig } from '../templates/configs/override-config.js';
+import { generatePackageJson } from '../templates/configs/package-json.js';
+import { generateIdentitySetupPrompt } from '../templates/copilot/identity-setup-prompt.js';
+/** Placeholder values used in generated identity setup guides */
+const PLACEHOLDER_SUBSCRIPTION_ID = '<your-subscription-id>';
+const PLACEHOLDER_RESOURCE_GROUP = '<your-resource-group>';
+class InitServiceImpl {
+    async run(config) {
+        logger.info('Starting APIM repository initialization...');
+        // Validate that the CLI package tarball exists
+        await this.validateCliPackage(config.cliPackage);
+        // Gather configuration (interactive or from flags)
+        const finalConfig = await this.gatherConfiguration(config);
+        logger.debug('Final configuration:', finalConfig);
+        // Detect conflicts
+        await this.detectConflicts(finalConfig);
+        // Generate files
+        const generatedFiles = await this.generateFiles(finalConfig);
+        // Output identity setup guide
+        await this.outputIdentityGuide(finalConfig, generatedFiles);
+        return generatedFiles;
+    }
+    /**
+     * Validate that the CLI package tarball exists and looks like a .tgz
+     */
+    async validateCliPackage(cliPackagePath) {
+        const resolvedPath = path.resolve(cliPackagePath);
+        if (!await this.fileExists(resolvedPath)) {
+            throw new Error(`CLI package not found: ${resolvedPath}`);
+        }
+        if (!resolvedPath.endsWith('.tgz')) {
+            throw new Error(`CLI package must be a .tgz tarball (got: ${path.basename(resolvedPath)})`);
+        }
+    }
+    /**
+     * Gather configuration from interactive prompts or flags
+     */
+    async gatherConfiguration(config) {
+        let ciProvider = config.ciProvider;
+        let artifactDir = config.artifactDir;
+        let environments = config.environments;
+        // Interactive mode
+        if (!config.nonInteractive && promptService.isTTY()) {
+            logger.info('Running in interactive mode. Press Ctrl+C to cancel.\n');
+            if (!ciProvider) {
+                ciProvider = await promptService.askCIProvider();
+            }
+            artifactDir = await promptService.askArtifactDir(artifactDir);
+            environments = await promptService.askEnvironments(environments);
+        }
+        else {
+            // Non-interactive mode
+            if (!ciProvider) {
+                throw new Error('Non-interactive mode requires --ci flag (github-actions or azure-devops)');
+            }
+            logger.info('Running in non-interactive mode');
+        }
+        return {
+            ciProvider,
+            nonInteractive: config.nonInteractive,
+            artifactDir,
+            environments,
+            outputDir: config.outputDir,
+            cliPackage: config.cliPackage,
+            force: config.force,
+        };
+    }
+    /**
+     * Detect existing pipeline/config files and block unless --force is set
+     */
+    async detectConflicts(config) {
+        const conflictingFiles = [];
+        // Check for pipeline files based on CI provider
+        if (config.ciProvider === 'github-actions') {
+            const extractWorkflow = path.join(config.outputDir, '.github/workflows/run-apim-extractor.yml');
+            const publishWorkflow = path.join(config.outputDir, '.github/workflows/run-apim-publisher.yml');
+            const promptFile = path.join(config.outputDir, '.github/prompts/apiops-setup-identity.prompt.md');
+            const identityGuide = path.join(config.outputDir, 'IDENTITY-SETUP-GITHUB.md');
+            if (await this.fileExists(extractWorkflow)) {
+                conflictingFiles.push(extractWorkflow);
+            }
+            if (await this.fileExists(publishWorkflow)) {
+                conflictingFiles.push(publishWorkflow);
+            }
+            if (await this.fileExists(promptFile)) {
+                conflictingFiles.push(promptFile);
+            }
+            if (await this.fileExists(identityGuide)) {
+                conflictingFiles.push(identityGuide);
+            }
+        }
+        else if (config.ciProvider === 'azure-devops') {
+            const extractPipeline = path.join(config.outputDir, '.azdo/pipelines/run-apim-extractor.yml');
+            const publishPipeline = path.join(config.outputDir, '.azdo/pipelines/run-apim-publisher.yml');
+            const identityGuide = path.join(config.outputDir, 'IDENTITY-SETUP-AZDO.md');
+            if (await this.fileExists(extractPipeline)) {
+                conflictingFiles.push(extractPipeline);
+            }
+            if (await this.fileExists(publishPipeline)) {
+                conflictingFiles.push(publishPipeline);
+            }
+            if (await this.fileExists(identityGuide)) {
+                conflictingFiles.push(identityGuide);
+            }
+        }
+        // Check for package.json
+        const packageJsonPath = path.join(config.outputDir, 'package.json');
+        if (await this.fileExists(packageJsonPath)) {
+            conflictingFiles.push(packageJsonPath);
+        }
+        // Check for config files
+        const filterConfig = path.join(config.outputDir, 'configuration.extract.yaml');
+        if (await this.fileExists(filterConfig)) {
+            conflictingFiles.push(filterConfig);
+        }
+        for (const env of config.environments) {
+            const overrideConfig = path.join(config.outputDir, `configuration.${env}.yaml`);
+            if (await this.fileExists(overrideConfig)) {
+                conflictingFiles.push(overrideConfig);
+            }
+        }
+        // Block or warn based on --force flag
+        if (conflictingFiles.length > 0) {
+            if (config.force) {
+                logger.warn('⚠ The following files already exist and will be overwritten:');
+                conflictingFiles.forEach((file) => {
+                    logger.warn(`  - ${path.relative(config.outputDir, file)}`);
+                });
+                logger.warn('');
+            }
+            else {
+                const fileList = conflictingFiles
+                    .map((file) => `  - ${path.relative(config.outputDir, file)}`)
+                    .join('\n');
+                throw new Error(`The following files already exist:\n${fileList}\n\nUse --force to overwrite existing files.`);
+            }
+        }
+    }
+    /**
+     * Generate all scaffold files
+     */
+    async generateFiles(config) {
+        const generatedFiles = {
+            pipelines: [],
+            configs: [],
+            directories: [],
+        };
+        // Create artifact directory
+        const artifactPath = path.join(config.outputDir, config.artifactDir);
+        await fs.mkdir(artifactPath, { recursive: true });
+        // Create .gitkeep to ensure directory is tracked
+        const gitkeepPath = path.join(artifactPath, '.gitkeep');
+        await fs.writeFile(gitkeepPath, '');
+        generatedFiles.directories.push(config.artifactDir);
+        // Copy CLI tarball into .apiops/ directory
+        const apiopsDir = path.join(config.outputDir, '.apiops');
+        await fs.mkdir(apiopsDir, { recursive: true });
+        const tarballFilename = path.basename(config.cliPackage);
+        const tarballDest = path.join(apiopsDir, tarballFilename);
+        await fs.copyFile(path.resolve(config.cliPackage), tarballDest);
+        generatedFiles.directories.push('.apiops');
+        // Generate package.json with local tarball dependency
+        const tarballRelPath = path.join('.apiops', tarballFilename);
+        const packageJsonContent = generatePackageJson({ tarballRelPath });
+        const packageJsonPath = path.join(config.outputDir, 'package.json');
+        await fs.writeFile(packageJsonPath, packageJsonContent);
+        generatedFiles.configs.push('package.json');
+        // Generate pipeline files
+        if (config.ciProvider === 'github-actions') {
+            await this.generateGitHubActionsWorkflows(config, generatedFiles);
+        }
+        else if (config.ciProvider === 'azure-devops') {
+            await this.generateAzureDevOpsPipelines(config, generatedFiles);
+        }
+        // Generate config files
+        await this.generateConfigFiles(config, generatedFiles);
+        return generatedFiles;
+    }
+    /**
+     * Generate GitHub Actions workflow files
+     */
+    async generateGitHubActionsWorkflows(config, generatedFiles) {
+        const workflowsDir = path.join(config.outputDir, '.github/workflows');
+        await fs.mkdir(workflowsDir, { recursive: true });
+        // Extract workflow
+        const extractWorkflowConfig = {
+            artifactDir: config.artifactDir,
+        };
+        const extractContent = generateExtractWorkflow(extractWorkflowConfig);
+        const extractPath = path.join(workflowsDir, 'run-apim-extractor.yml');
+        await fs.writeFile(extractPath, extractContent);
+        generatedFiles.pipelines.push('.github/workflows/run-apim-extractor.yml');
+        // Publish workflow
+        const publishWorkflowConfig = {
+            artifactDir: config.artifactDir,
+            environments: config.environments,
+        };
+        const publishContent = generatePublishWorkflow(publishWorkflowConfig);
+        const publishPath = path.join(workflowsDir, 'run-apim-publisher.yml');
+        await fs.writeFile(publishPath, publishContent);
+        generatedFiles.pipelines.push('.github/workflows/run-apim-publisher.yml');
+        // Copilot identity setup prompt — goes in .github/prompts/
+        const promptContent = generateIdentitySetupPrompt({
+            environments: config.environments,
+        });
+        const promptsDir = path.join(config.outputDir, '.github/prompts');
+        await fs.mkdir(promptsDir, { recursive: true });
+        const promptPath = path.join(promptsDir, 'apiops-setup-identity.prompt.md');
+        await fs.writeFile(promptPath, promptContent);
+        generatedFiles.configs.push('.github/prompts/apiops-setup-identity.prompt.md');
+    }
+    /**
+     * Generate Azure DevOps pipeline files
+     */
+    async generateAzureDevOpsPipelines(config, generatedFiles) {
+        const pipelinesDir = path.join(config.outputDir, '.azdo/pipelines');
+        await fs.mkdir(pipelinesDir, { recursive: true });
+        // Extract pipeline
+        const extractPipelineConfig = {
+            artifactDir: config.artifactDir,
+        };
+        const extractContent = generateExtractPipeline(extractPipelineConfig);
+        const extractPath = path.join(pipelinesDir, 'run-apim-extractor.yml');
+        await fs.writeFile(extractPath, extractContent);
+        generatedFiles.pipelines.push('.azdo/pipelines/run-apim-extractor.yml');
+        // Publish pipeline
+        const publishPipelineConfig = {
+            artifactDir: config.artifactDir,
+            environments: config.environments,
+        };
+        const publishContent = generatePublishPipeline(publishPipelineConfig);
+        const publishPath = path.join(pipelinesDir, 'run-apim-publisher.yml');
+        await fs.writeFile(publishPath, publishContent);
+        generatedFiles.pipelines.push('.azdo/pipelines/run-apim-publisher.yml');
+    }
+    /**
+     * Generate configuration files
+     */
+    async generateConfigFiles(config, generatedFiles) {
+        // Filter config
+        const filterContent = generateFilterConfig();
+        const filterPath = path.join(config.outputDir, 'configuration.extract.yaml');
+        await fs.writeFile(filterPath, filterContent);
+        generatedFiles.configs.push('configuration.extract.yaml');
+        // Override configs for each environment
+        for (const env of config.environments) {
+            const overrideContent = generateOverrideConfig(env);
+            const overridePath = path.join(config.outputDir, `configuration.${env}.yaml`);
+            await fs.writeFile(overridePath, overrideContent);
+            generatedFiles.configs.push(`configuration.${env}.yaml`);
+        }
+    }
+    /**
+     * Save identity setup guide to file and tell user where to find it
+     */
+    async outputIdentityGuide(config, generatedFiles) {
+        // Use placeholder values for the guide — users replace these with their actual Azure details
+        const subscriptionId = PLACEHOLDER_SUBSCRIPTION_ID;
+        const resourceGroup = PLACEHOLDER_RESOURCE_GROUP;
+        let guide;
+        if (config.ciProvider === 'github-actions') {
+            guide = identityGuideService.generateGitHubActionsGuide(subscriptionId, resourceGroup, config.environments);
+        }
+        else {
+            guide = identityGuideService.generateAzureDevOpsGuide(subscriptionId, resourceGroup, config.environments);
+        }
+        // Save guide to file
+        const guideFileName = config.ciProvider === 'github-actions'
+            ? 'IDENTITY-SETUP-GITHUB.md'
+            : 'IDENTITY-SETUP-AZDO.md';
+        const guidePath = path.join(config.outputDir, guideFileName);
+        await fs.writeFile(guidePath, guide);
+        generatedFiles.configs.push(guideFileName);
+    }
+    /**
+     * Check if a file exists
+     */
+    async fileExists(filePath) {
+        try {
+            await fs.access(filePath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+export const initService = new InitServiceImpl();
+//# sourceMappingURL=init-service.js.map

package/dist/services/init-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-service.js","sourceRoot":"","sources":["../../src/services/init-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,uBAAuB,GAExB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,uBAAuB,GAExB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,uBAAuB,GAExB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,uBAAuB,GAExB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAE5F,iEAAiE;AACjE,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAC7D,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAY3D,MAAM,eAAe;IACnB,KAAK,CAAC,GAAG,CAAC,MAAkB;QAC1B,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAE1D,+CAA+C;QAC/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEjD,mDAAmD;QACnD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;QAElD,mBAAmB;QACnB,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAExC,iBAAiB;QACjB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAE7D,8BAA8B;QAC9B,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAE5D,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,cAAsB;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,4CAA4C,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAAC,MAAkB;QAClD,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACnC,IAAI,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACrC,IAAI,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAEvC,mBAAmB;QACnB,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAEtE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,CAAC;YACnD,CAAC;YAED,WAAW,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAC9D,YAAY,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,uBAAuB;YACvB,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACjD,CAAC;QAED,OAAO;YACL,UAAU;YACV,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe,CAAC,MAAkB;QAC9C,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,gDAAgD;QAChD,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,MAAM,CAAC,SAAS,EAChB,0CAA0C,CAC3C,CAAC;YACF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,MAAM,CAAC,SAAS,EAChB,0CAA0C,CAC3C,CAAC;YACF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,MAAM,CAAC,SAAS,EAChB,iDAAiD,CAClD,CAAC;YACF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAC7B,MAAM,CAAC,SAAS,EAChB,0BAA0B,CAC3B,CAAC;YAEF,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC3C,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC3C,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;YAChD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,MAAM,CAAC,SAAS,EAChB,wCAAwC,CACzC,CAAC;YACF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,MAAM,CAAC,SAAS,EAChB,wCAAwC,CACzC,CAAC;YACF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAC7B,MAAM,CAAC,SAAS,EAChB,wBAAwB,CACzB,CAAC;YAEF,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC3C,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC3C,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACpE,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzC,CAAC;QAED,yBAAyB;QACzB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,MAAM,CAAC,SAAS,EAChB,4BAA4B,CAC7B,CAAC;QACF,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAC9B,MAAM,CAAC,SAAS,EAChB,iBAAiB,GAAG,OAAO,CAC5B,CAAC;YACF,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC1C,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;gBAC5E,gBAAgB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;oBAChC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,gBAAgB;qBAC9B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;qBAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,uCAAuC,QAAQ,8CAA8C,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,MAAkB;QAC5C,MAAM,cAAc,GAAmB;YACrC,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,EAAE;SAChB,CAAC;QAEF,4BAA4B;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAElD,iDAAiD;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACpC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEpD,2CAA2C;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;QAChE,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE3C,sDAAsD;QACtD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;QACxD,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5C,0BAA0B;QAC1B,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAClE,CAAC;QAED,wBAAwB;QACxB,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAEvD,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,8BAA8B,CAC1C,MAAkB,EAClB,cAA8B;QAE9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAElD,mBAAmB;QACnB,MAAM,qBAAqB,GAA0B;YACnD,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QACF,MAAM,cAAc,GAAG,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAChD,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAE1E,mBAAmB;QACnB,MAAM,qBAAqB,GAA0B;YACnD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,MAAM,cAAc,GAAG,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAChD,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAE1E,2DAA2D;QAC3D,MAAM,aAAa,GAAG,2BAA2B,CAAC;YAChD,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;QAC5E,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC9C,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjF,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,4BAA4B,CACxC,MAAkB,EAClB,cAA8B;QAE9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAElD,mBAAmB;QACnB,MAAM,qBAAqB,GAA0B;YACnD,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QACF,MAAM,cAAc,GAAG,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAChD,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QAExE,mBAAmB;QACnB,MAAM,qBAAqB,GAA0B;YACnD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,MAAM,cAAc,GAAG,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAChD,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAkB,EAClB,cAA8B;QAE9B,gBAAgB;QAChB,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;QAC7E,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC9C,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAE1D,wCAAwC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,eAAe,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,MAAM,CAAC,SAAS,EAChB,iBAAiB,GAAG,OAAO,CAC5B,CAAC;YACF,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YAClD,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAAC,MAAkB,EAAE,cAA8B;QAClF,6FAA6F;QAC7F,MAAM,cAAc,GAAG,2BAA2B,CAAC;QACnD,MAAM,aAAa,GAAG,0BAA0B,CAAC;QAEjD,IAAI,KAAa,CAAC;QAClB,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAC3C,KAAK,GAAG,oBAAoB,CAAC,0BAA0B,CACrD,cAAc,EACd,aAAa,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,oBAAoB,CAAC,wBAAwB,CACnD,cAAc,EACd,aAAa,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,GACjB,MAAM,CAAC,UAAU,KAAK,gBAAgB;YACpC,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,wBAAwB,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CAAC,QAAgB;QACvC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,WAAW,GAAgB,IAAI,eAAe,EAAE,CAAC"}

package/dist/services/keyvault-checker.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Key Vault access pre-flight check for KeyVault-backed NamedValues.
+ *
+ * Validates that the APIM service's managed identity has been granted access
+ * to the Key Vault secret. Uses Azure ARM APIs to:
+ *   1. Retrieve the APIM service identity (system- or user-assigned)
+ *   2. Locate the Key Vault resource in the subscription
+ *   3. Check RBAC role assignments or access policies
+ *
+ * This check is best-effort when infrastructure queries fail (ARM token,
+ * vault in another subscription, etc.) — a warning is logged and the check
+ * is skipped. Hard errors are raised only for definitive misconfigurations
+ * such as "APIM has no managed identity" or "no matching RBAC / access policy".
+ */
+/**
+ * Error thrown when the APIM managed identity clearly lacks access to
+ * Key Vault, or the APIM service is missing the required identity
+ * configuration. Signals that the publish should fail immediately.
+ */
+export declare class KeyVaultAccessError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+/** APIM service context needed by the ARM-based check. */
+export interface KeyVaultCheckContext {
+    subscriptionId: string;
+    resourceGroup: string;
+    serviceName: string;
+}
+/** Minimal response shape from an ARM HTTP call. */
+export interface ArmResponse {
+    status: number;
+    json(): Promise<unknown>;
+}
+/** Injectable ARM HTTP call — production uses `fetch`, tests supply a stub. */
+export type ArmRequestFn = (url: string, token: string) => Promise<ArmResponse>;
+/** Provides ARM bearer tokens. */
+export interface TokenProvider {
+    getToken(scopes: string | string[]): Promise<{
+        token: string;
+    }>;
+}
+/** Factory for creating token providers (injectable for testing). */
+export type TokenProviderFactory = () => TokenProvider;
+/**
+ * Verify that the APIM service's managed identity has access to the
+ * specified Key Vault secret via ARM RBAC or access policies.
+ *
+ * @param secretIdentifier  Full Key Vault secret URI, e.g.
+ *   `https://myvault.vault.azure.net/secrets/my-secret[/version]`
+ * @param identityClientId  Client ID of the user-assigned managed identity
+ *   that APIM will use. Omit for system-assigned identity.
+ * @param apimContext  Subscription / resource-group / service-name of the
+ *   APIM instance.
+ * @param tokenProviderFactory  (testing) Override the ARM credential.
+ * @param armRequest  (testing) Override the HTTP call.
+ */
+export declare function checkKeyVaultSecretAccess(secretIdentifier: string, identityClientId: string | undefined, apimContext: KeyVaultCheckContext, tokenProviderFactory?: TokenProviderFactory, armRequest?: ArmRequestFn): Promise<void>;
+//# sourceMappingURL=keyvault-checker.d.ts.map

package/dist/services/keyvault-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyvault-checker.d.ts","sourceRoot":"","sources":["../../src/services/keyvault-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAiCH;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAEhF,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE;AAED,qEAAqE;AACrE,MAAM,MAAM,oBAAoB,GAAG,MAAM,aAAa,CAAC;AA0BvD;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,gBAAgB,EAAE,MAAM,EACxB,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,WAAW,EAAE,oBAAoB,EACjC,oBAAoB,GAAE,oBAAkD,EACxE,UAAU,GAAE,YAAgC,GAC3C,OAAO,CAAC,IAAI,CAAC,CAkFf"}