@peterhauge/apiops-cli 0.1.3-alpha.0

package/dist/services/resource-extractor.js

@@ -0,0 +1,168 @@
+/**
+ * T021: Resource type extractor
+ * Generic extract logic: list resources via IApimClient, write each to IArtifactStore.
+ * Handles all 33 types using ResourceType metadata. Preserves opaque JSON per FR-009.
+ */
+import { RESOURCE_TYPE_METADATA } from '../models/resource-types.js';
+import { redactSecrets } from './secret-redactor.js';
+import { shouldIncludeResource } from './filter-service.js';
+import { logger } from '../lib/logger.js';
+import { buildResourceLabel } from '../lib/resource-uri.js';
+/**
+ * Check if a resource type's LIST endpoint returns shallow data that omits
+ * fields required for round-trip publish. When true, extraction must issue
+ * an individual GET per item to fetch the complete resource.
+ */
+function typeNeedsFullFetch(type) {
+    return RESOURCE_TYPE_METADATA[type].listOmitsFields === true;
+}
+/**
+ * Extract the ARM resource name from a raw JSON object.
+ * ARM resources have a 'name' field at the top level.
+ */
+export function extractResourceName(json) {
+    const name = json.name;
+    if (!name) {
+        throw new Error('Resource JSON missing required "name" field');
+    }
+    return name;
+}
+/**
+ * Extract all resources of a given type from APIM and write to artifact store.
+ *
+ * @param client - APIM REST client
+ * @param store - Artifact file store
+ * @param context - APIM service context
+ * @param type - Resource type to extract
+ * @param outputDir - Output directory
+ * @param filter - Optional filter config
+ * @param parent - Parent descriptor for child resources
+ * @param workspace - Optional workspace name
+ * @returns Extraction result
+ */
+export async function extractResourceType(client, store, context, type, outputDir, filter, parent, workspace) {
+    const result = {
+        type,
+        extracted: [],
+        totalCount: 0,
+        errorCount: 0,
+    };
+    try {
+        const resources = client.listResources(context, type, parent);
+        for await (const listJson of resources) {
+            result.totalCount++;
+            let descriptor;
+            try {
+                const name = extractResourceName(listJson);
+                descriptor = buildDescriptor(type, name, parent, workspace);
+                // Apply filter
+                if (!shouldIncludeResource(descriptor, filter)) {
+                    logger.debug(`Filtered out ${buildResourceLabel(descriptor)}`);
+                    continue;
+                }
+                // Some APIM list endpoints return a shallow response that omits the
+                // heavyweight payload we need for round-trip publish. ApiSchema list
+                // omits `properties.document` (the GraphQL SDL / XSD / JSON-schema
+                // body); an individual GET returns it. Fetch the full resource so the
+                // extract captures what publish requires. Falls back to the list
+                // payload if the GET returns undefined (shouldn't normally happen —
+                // we just listed it).
+                let json = listJson;
+                if (typeNeedsFullFetch(type)) {
+                    const full = await client.getResource(context, descriptor);
+                    if (full) {
+                        json = full;
+                    }
+                }
+                // Apply secret redaction
+                const safeJson = redactSecrets(descriptor, json);
+                // Write to artifact store (preserves opaque JSON per FR-009)
+                await store.writeResource(outputDir, descriptor, safeJson);
+                result.extracted.push({
+                    descriptor,
+                    json: safeJson,
+                    status: 'success',
+                });
+                logger.info(`Extracted ${buildResourceLabel(descriptor)}`);
+            }
+            catch (error) {
+                result.errorCount++;
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                if (descriptor) {
+                    logger.error(`Failed to extract ${buildResourceLabel(descriptor)}: ${errorMessage}`);
+                    result.extracted.push({
+                        descriptor,
+                        json: {},
+                        status: 'error',
+                        error: errorMessage,
+                    });
+                }
+                else {
+                    logger.error(`Failed to extract ${type} resource: ${errorMessage}`);
+                }
+            }
+        }
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        logger.error(`Failed to list ${type}: ${errorMessage}`);
+        result.errorCount++;
+    }
+    return result;
+}
+/**
+ * Extract a single resource by descriptor and write to artifact store.
+ */
+export async function extractSingleResource(client, store, context, descriptor, outputDir) {
+    try {
+        const json = await client.getResource(context, descriptor);
+        if (!json) {
+            return {
+                descriptor,
+                json: {},
+                status: 'error',
+                error: `Resource not found: ${buildResourceLabel(descriptor)}`,
+            };
+        }
+        // Apply secret redaction
+        const safeJson = redactSecrets(descriptor, json);
+        // Write to artifact store
+        await store.writeResource(outputDir, descriptor, safeJson);
+        logger.info(`Extracted ${buildResourceLabel(descriptor)}`);
+        return { descriptor, json: safeJson, status: 'success' };
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        logger.error(`Failed to extract ${buildResourceLabel(descriptor)}: ${errorMessage}`);
+        return { descriptor, json: {}, status: 'error', error: errorMessage };
+    }
+}
+/**
+ * Build a ResourceDescriptor for a given type, name, optional parent, and workspace.
+ *
+ * The nameParts array is derived generically using the count of positional
+ * placeholders in armPathSuffix:
+ *   - placeholderCount === parent.nameParts.length → singleton child (policy, wiki):
+ *       nameParts = parent.nameParts  (own fixed name not encoded in path)
+ *   - placeholderCount > parent.nameParts.length → named child:
+ *       nameParts = [...parent.nameParts, name]
+ *   - no parent → top-level: nameParts = [name]  (or [] for zero-placeholder types)
+ */
+function buildDescriptor(type, name, parent, workspace) {
+    const metadata = RESOURCE_TYPE_METADATA[type];
+    const placeholderCount = (metadata.armPathSuffix.match(/\{\d+\}/g) ?? []).length;
+    let nameParts;
+    if (!parent) {
+        nameParts = placeholderCount === 0 ? [] : [name];
+    }
+    else if (parent.nameParts.length >= placeholderCount) {
+        // Singleton child (policy, wiki): identified solely by parent's name-parts
+        nameParts = [...parent.nameParts];
+    }
+    else {
+        // Named child: has its own distinct position in the ARM path
+        nameParts = [...parent.nameParts, name];
+    }
+    return { type, nameParts, workspace };
+}
+//# sourceMappingURL=resource-extractor.js.map

package/dist/services/resource-extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-extractor.js","sourceRoot":"","sources":["../../src/services/resource-extractor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAgB,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAkB;IAC5C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC;AAC/D,CAAC;AAsBD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0B,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAmB,EACnB,KAAqB,EACrB,OAA2B,EAC3B,IAAkB,EAClB,SAAiB,EACjB,MAAqB,EACrB,MAA2B,EAC3B,SAAkB;IAElB,MAAM,MAAM,GAAyB;QACnC,IAAI;QACJ,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,CAAC;QACb,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAE9D,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACvC,MAAM,CAAC,UAAU,EAAE,CAAC;YAEpB,IAAI,UAA0C,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;gBAC3C,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;gBAE5D,eAAe;gBACf,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;oBAC/C,MAAM,CAAC,KAAK,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBAC/D,SAAS;gBACX,CAAC;gBAED,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,sEAAsE;gBACtE,iEAAiE;gBACjE,oEAAoE;gBACpE,sBAAsB;gBACtB,IAAI,IAAI,GAA4B,QAAQ,CAAC;gBAC7C,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;oBAC3D,IAAI,IAAI,EAAE,CAAC;wBACT,IAAI,GAAG,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAED,yBAAyB;gBACzB,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAEjD,6DAA6D;gBAC7D,MAAM,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAE3D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;oBACpB,UAAU;oBACV,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5E,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,qBAAqB,kBAAkB,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC,CAAC;oBACrF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;wBACpB,UAAU;wBACV,IAAI,EAAE,EAAE;wBACR,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,YAAY;qBACpB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,cAAc,YAAY,EAAE,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,KAAK,YAAY,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAmB,EACnB,KAAqB,EACrB,OAA2B,EAC3B,UAA8B,EAC9B,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,UAAU;gBACV,IAAI,EAAE,EAAE;gBACR,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,uBAAuB,kBAAkB,CAAC,UAAU,CAAC,EAAE;aAC/D,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAEjD,0BAA0B;QAC1B,MAAM,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE3D,MAAM,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,qBAAqB,kBAAkB,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC,CAAC;QACrF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CACtB,IAAkB,EAClB,IAAY,EACZ,MAA2B,EAC3B,SAAkB;IAElB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAEjF,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,SAAS,GAAG,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACvD,2EAA2E;QAC3E,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,6DAA6D;QAC7D,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC"}

package/dist/services/resource-publisher.d.ts

@@ -0,0 +1,23 @@
+/**
+ * T031: Generic resource publisher
+ * Read resource from IArtifactStore, apply overrides, PUT via IApimClient.
+ * Handles all 33 resource types using ResourceType metadata.
+ * MUST preserve opaque JSON per FR-009.
+ */
+import type { IApimClient } from '../clients/iapim-client.js';
+import type { IArtifactStore } from '../clients/iartifact-store.js';
+import type { ApimServiceContext, ResourceDescriptor } from '../models/types.js';
+import type { PublishConfig } from '../models/config.js';
+export interface ResourcePublishResult {
+    descriptor: ResourceDescriptor;
+    status: 'success' | 'failed' | 'skipped';
+    action: 'put' | 'delete' | 'noop';
+    error?: Error;
+}
+/**
+ * Publish a single resource: read from store, apply overrides, PUT to APIM.
+ * Preserves opaque JSON (FR-009). Uses applyOverrides for env-specific values.
+ * Returns 'skipped' if resource file doesn't exist in store.
+ */
+export declare function publishResource(client: IApimClient, store: IArtifactStore, context: ApimServiceContext, descriptor: ResourceDescriptor, config: PublishConfig): Promise<ResourcePublishResult>;
+//# sourceMappingURL=resource-publisher.d.ts.map

package/dist/services/resource-publisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-publisher.d.ts","sourceRoot":"","sources":["../../src/services/resource-publisher.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAClC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAyCD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,qBAAqB,CAAC,CAoIhC"}

package/dist/services/resource-publisher.js

@@ -0,0 +1,349 @@
+/**
+ * T031: Generic resource publisher
+ * Read resource from IArtifactStore, apply overrides, PUT via IApimClient.
+ * Handles all 33 resource types using ResourceType metadata.
+ * MUST preserve opaque JSON per FR-009.
+ */
+import { ResourceType } from '../models/resource-types.js';
+import { applyOverrides } from './override-merger.js';
+import { checkKeyVaultSecretAccess } from './keyvault-checker.js';
+import { getNamePart } from '../lib/resource-path.js';
+/**
+ * Policy resource types that have external XML content
+ */
+const POLICY_TYPES = new Set([
+    ResourceType.ServicePolicy,
+    ResourceType.ProductPolicy,
+    ResourceType.ApiPolicy,
+    ResourceType.ApiOperationPolicy,
+    ResourceType.GraphQLResolverPolicy,
+]);
+/**
+ * Association resource types that read from association files
+ */
+const ASSOCIATION_TYPES = new Map([
+    [ResourceType.ProductApi, 'apis'],
+    [ResourceType.ProductGroup, 'groups'],
+    [ResourceType.GatewayApi, 'apis'],
+]);
+/**
+ * Maps association resource types to their parent resource types.
+ * readAssociation / buildAssociationFilePath expect a Product or Gateway
+ * descriptor, not the association child type itself.
+ */
+const ASSOCIATION_PARENT_TYPES = new Map([
+    [ResourceType.ProductApi, ResourceType.Product],
+    [ResourceType.ProductGroup, ResourceType.Product],
+    [ResourceType.GatewayApi, ResourceType.Gateway],
+]);
+/**
+ * Wiki resource types that read markdown content
+ */
+const WIKI_TYPES = new Set([
+    ResourceType.ApiWiki,
+    ResourceType.ProductWiki,
+]);
+/**
+ * Publish a single resource: read from store, apply overrides, PUT to APIM.
+ * Preserves opaque JSON (FR-009). Uses applyOverrides for env-specific values.
+ * Returns 'skipped' if resource file doesn't exist in store.
+ */
+export async function publishResource(client, store, context, descriptor, config) {
+    try {
+        // Handle association types (ProductApi, ProductGroup, GatewayApi)
+        const associationType = ASSOCIATION_TYPES.get(descriptor.type);
+        if (associationType) {
+            return await publishAssociation(client, store, context, descriptor, config, associationType);
+        }
+        // Handle wiki types
+        if (WIKI_TYPES.has(descriptor.type)) {
+            return await publishWiki(client, store, context, descriptor, config);
+        }
+        // Handle policy types — artifact is policy.xml (raw XML), not a JSON info file
+        if (POLICY_TYPES.has(descriptor.type)) {
+            return await publishPolicy(client, store, context, descriptor, config);
+        }
+        // Read resource JSON from store
+        let json = await store.readResource(config.sourceDir, descriptor);
+        if (!json) {
+            return {
+                descriptor,
+                status: 'skipped',
+                action: 'noop',
+            };
+        }
+        // Apply overrides (deep merge, preserves opaque structure)
+        json = applyOverrides(descriptor, json, config.overrides);
+        // For KeyVault-backed NamedValues:
+        //   1. Strip properties.value — APIM must not receive both keyVault and value
+        //      in the same PUT body, as it causes indefinite provisioning or rejection.
+        //   2. Pre-flight access check — verify the managed identity has GET access
+        //      to the secret before attempting the PUT. Surfaces permission errors
+        //      early and fails fast instead of polling until timeout.
+        if (descriptor.type === ResourceType.NamedValue) {
+            const props = json.properties;
+            const kvBlock = props?.keyVault;
+            if (kvBlock != null) {
+                const { value: _omit, ...propsWithoutValue } = props;
+                json = { ...json, properties: propsWithoutValue };
+                const secretIdentifier = kvBlock.secretIdentifier;
+                const identityClientId = kvBlock.identityClientId;
+                if (secretIdentifier) {
+                    await checkKeyVaultSecretAccess(secretIdentifier, identityClientId, {
+                        subscriptionId: context.subscriptionId,
+                        resourceGroup: context.resourceGroup,
+                        serviceName: context.serviceName,
+                    });
+                }
+            }
+        }
+        // Normalize Subscription scope.
+        // APIM stores scope as a full ARM resource path (e.g.
+        // "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ApiManagement/service/{svc}/apis")
+        // but the PUT endpoint requires a relative APIM path (e.g. "/apis" or
+        // "/apis/{apiId}" or "/products/{productId}").  Strip the service base path
+        // prefix when it is present so that the publish round-trip works correctly.
+        // HOWEVER: Skip publishing subscriptions with root-level scope (e.g. the built-in
+        // "master" subscription), as APIM treats these as read-only system resources
+        // and returns ValidationError when attempting to update them.
+        if (descriptor.type === ResourceType.Subscription) {
+            const props = json.properties;
+            const scope = props?.scope;
+            // Built-in master subscription has scope ending with the service path (no /apis or /products suffix)
+            // Skip it since APIM doesn't allow updates to built-in subscriptions
+            if (scope && (scope.endsWith('/') || (!scope.includes('/apis') && !scope.includes('/products')))) {
+                return {
+                    descriptor,
+                    status: 'skipped',
+                    action: 'noop',
+                };
+            }
+            json = normalizeSubscriptionScope(json, context);
+        }
+        // ApiRelease: normalize properties.apiId from source ARM path to target ARM path.
+        // APIM stores apiId as the full source ARM resource path, e.g.:
+        //   /subscriptions/{src-sub}/resourceGroups/{src-rg}/providers/
+        //   Microsoft.ApiManagement/service/{src-svc}/apis/my-api;rev=2
+        // The PUT to the target service must reference the target service path,
+        // otherwise APIM rejects the request with a validation error.
+        if (descriptor.type === ResourceType.ApiRelease) {
+            json = normalizeApiReleaseApiId(json, context);
+        }
+        // API Revisions (e.g., "my-api;rev=2") need sourceApiId so APIM knows which
+        // base API to copy structure from. Also strip null properties that cause
+        // validation errors in APIM's revision creation.
+        if (descriptor.type === ResourceType.Api) {
+            const apiName = getNamePart(descriptor.nameParts, 0);
+            if (apiName.includes(';rev=')) {
+                const baseApiName = apiName.split(';rev=')[0];
+                const props = json.properties;
+                const cleanProps = {};
+                for (const [key, val] of Object.entries(props ?? {})) {
+                    if (val !== null)
+                        cleanProps[key] = val;
+                }
+                cleanProps.sourceApiId = `/subscriptions/${context.subscriptionId}/resourceGroups/${context.resourceGroup}/providers/Microsoft.ApiManagement/service/${context.serviceName}/apis/${baseApiName}`;
+                json = { ...json, properties: cleanProps };
+            }
+        }
+        // PUT to APIM
+        await client.putResource(context, descriptor, json);
+        return {
+            descriptor,
+            status: 'success',
+            action: 'put',
+        };
+    }
+    catch (error) {
+        return {
+            descriptor,
+            status: 'failed',
+            action: 'noop',
+            error: error instanceof Error ? error : new Error(String(error)),
+        };
+    }
+}
+/**
+ * Publish association resource (ProductApi, ProductGroup, GatewayApi)
+ */
+async function publishAssociation(client, store, context, descriptor, config, associationType) {
+    try {
+        // buildAssociationFilePath (called inside readAssociation) only accepts
+        // Product or Gateway descriptors — not the association child types
+        // (ProductApi, ProductGroup, GatewayApi).  Derive the parent descriptor.
+        const parentType = ASSOCIATION_PARENT_TYPES.get(descriptor.type);
+        const parentDescriptor = {
+            type: parentType,
+            nameParts: [getNamePart(descriptor.nameParts, 0)],
+            workspace: descriptor.workspace,
+        };
+        const names = await store.readAssociation(config.sourceDir, parentDescriptor, associationType);
+        // Create association for each name
+        for (const name of names) {
+            const assocDescriptor = {
+                type: descriptor.type,
+                nameParts: [getNamePart(descriptor.nameParts, 0), name],
+            };
+            // PUT empty body for association (APIM uses PUT to create association)
+            await client.putResource(context, assocDescriptor, {});
+        }
+        return {
+            descriptor,
+            status: 'success',
+            action: 'put',
+        };
+    }
+    catch (error) {
+        return {
+            descriptor,
+            status: 'failed',
+            action: 'noop',
+            error: error instanceof Error ? error : new Error(String(error)),
+        };
+    }
+}
+/**
+ * Publish wiki resource (ApiWiki, ProductWiki)
+ */
+async function publishWiki(client, store, context, descriptor, config) {
+    try {
+        const wikiContent = await store.readContent(config.sourceDir, descriptor, 'specification');
+        if (!wikiContent) {
+            return {
+                descriptor,
+                status: 'skipped',
+                action: 'noop',
+            };
+        }
+        // Build wiki payload
+        const payload = {
+            properties: {
+                documents: [
+                    {
+                        documentId: 'default',
+                        content: wikiContent.content,
+                    },
+                ],
+            },
+        };
+        await client.putResource(context, descriptor, payload);
+        return {
+            descriptor,
+            status: 'success',
+            action: 'put',
+        };
+    }
+    catch (error) {
+        return {
+            descriptor,
+            status: 'failed',
+            action: 'noop',
+            error: error instanceof Error ? error : new Error(String(error)),
+        };
+    }
+}
+/**
+ * Publish policy resource (ServicePolicy, ApiPolicy, ProductPolicy, ApiOperationPolicy,
+ * GraphQLResolverPolicy). The artifact on disk is a raw policy.xml file; there is no
+ * separate JSON info file for these types. Reads the XML and PUTs it with format=rawxml.
+ */
+async function publishPolicy(client, store, context, descriptor, config) {
+    try {
+        const policyContent = await store.readContent(config.sourceDir, descriptor, 'policy');
+        if (!policyContent) {
+            return {
+                descriptor,
+                status: 'skipped',
+                action: 'noop',
+            };
+        }
+        const payload = {
+            properties: {
+                value: policyContent.content,
+                format: 'rawxml',
+            },
+        };
+        await client.putResource(context, descriptor, payload);
+        return {
+            descriptor,
+            status: 'success',
+            action: 'put',
+        };
+    }
+    catch (error) {
+        return {
+            descriptor,
+            status: 'failed',
+            action: 'noop',
+            error: error instanceof Error ? error : new Error(String(error)),
+        };
+    }
+}
+/**
+ * Normalise the `properties.scope` field of a Subscription resource.
+ *
+ * APIM returns scope as a full ARM resource path on GET, e.g.:
+ *   /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ApiManagement/service/{svc}/apis
+ *
+ * The PUT endpoint requires a relative APIM path, e.g.:
+ *   /apis
+ *   /apis/{apiId}
+ *   /products/{productId}
+ *
+ * Strip the service base ARM path prefix when it is present so that the
+ * extract → publish round-trip works without manual edits.
+ */
+function normalizeSubscriptionScope(json, context) {
+    const props = json.properties;
+    if (!props)
+        return json;
+    const scope = props.scope;
+    if (!scope)
+        return json;
+    // The ARM path prefix lives between "management.azure.com" and the first
+    // APIM-relative segment.  Derive it from baseUrl by stripping the protocol+host.
+    const armPathPrefix = context.baseUrl.replace(/^https?:\/\/[^/]+/, '');
+    if (scope.startsWith(armPathPrefix)) {
+        const relativeScope = scope.slice(armPathPrefix.length) || '/';
+        return {
+            ...json,
+            properties: { ...props, scope: relativeScope },
+        };
+    }
+    return json;
+}
+/**
+ * Normalise the `properties.apiId` field of an ApiRelease resource.
+ *
+ * APIM returns apiId as a full ARM resource path that includes the source
+ * service coordinates, e.g.:
+ *   /subscriptions/{src-sub}/resourceGroups/{src-rg}/providers/
+ *   Microsoft.ApiManagement/service/{src-svc}/apis/my-api;rev=2
+ *
+ * The PUT to the target service must reference the TARGET service path;
+ * otherwise APIM rejects the request because the apiId does not match the
+ * service being written to. Rebuild the apiId using the target ARM prefix
+ * derived from the publish context.
+ */
+function normalizeApiReleaseApiId(json, context) {
+    const props = json.properties;
+    if (!props)
+        return json;
+    const apiId = props.apiId;
+    if (!apiId)
+        return json;
+    // The target ARM prefix for this service (no https:// host, no trailing slash)
+    const targetArmPrefix = context.baseUrl.replace(/^https?:\/\/[^/]+/, '');
+    // Extract the /apis/... suffix and rebuild with the target ARM prefix.
+    // The suffix includes the full API name, e.g. "/apis/my-api;rev=2".
+    const apisIndex = apiId.indexOf('/apis/');
+    if (apisIndex !== -1) {
+        const apisSuffix = apiId.slice(apisIndex);
+        return {
+            ...json,
+            properties: { ...props, apiId: targetArmPrefix + apisSuffix },
+        };
+    }
+    return json;
+}
+//# sourceMappingURL=resource-publisher.js.map

package/dist/services/resource-publisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-publisher.js","sourceRoot":"","sources":["../../src/services/resource-publisher.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAStD;;GAEG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAe;IACzC,YAAY,CAAC,aAAa;IAC1B,YAAY,CAAC,aAAa;IAC1B,YAAY,CAAC,SAAS;IACtB,YAAY,CAAC,kBAAkB;IAC/B,YAAY,CAAC,qBAAqB;CACnC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAkC;IACjE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;IACjC,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC;IACrC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;CAClC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAA6B;IACnE,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;IAC/C,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC;IACjD,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;CAChD,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAe;IACvC,YAAY,CAAC,OAAO;IACpB,YAAY,CAAC,WAAW;CACzB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAmB,EACnB,KAAqB,EACrB,OAA2B,EAC3B,UAA8B,EAC9B,MAAqB;IAErB,IAAI,CAAC;QACH,kEAAkE;QAClE,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,MAAM,kBAAkB,CAC7B,MAAM,EACN,KAAK,EACL,OAAO,EACP,UAAU,EACV,MAAM,EACN,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QAED,+EAA+E;QAC/E,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACzE,CAAC;QAED,gCAAgC;QAChC,IAAI,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,MAAM;aACf,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,IAAI,GAAG,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAE1D,mCAAmC;QACnC,8EAA8E;QAC9E,gFAAgF;QAChF,4EAA4E;QAC5E,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAiD,CAAC;YACrE,MAAM,OAAO,GAAG,KAAK,EAAE,QAA+C,CAAC;YACvE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,iBAAiB,EAAE,GAAG,KAAM,CAAC;gBACtD,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;gBAElD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAsC,CAAC;gBACxE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAsC,CAAC;gBACxE,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,yBAAyB,CAAC,gBAAgB,EAAE,gBAAgB,EAAE;wBAClE,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,aAAa,EAAE,OAAO,CAAC,aAAa;wBACpC,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,sDAAsD;QACtD,mGAAmG;QACnG,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,kFAAkF;QAClF,6EAA6E;QAC7E,8DAA8D;QAC9D,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,YAAY,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAiD,CAAC;YACrE,MAAM,KAAK,GAAG,KAAK,EAAE,KAA2B,CAAC;YAEjD,qGAAqG;YACrG,qEAAqE;YACrE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjG,OAAO;oBACL,UAAU;oBACV,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,MAAM;iBACf,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,kFAAkF;QAClF,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,IAAI,GAAG,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,iDAAiD;QACjD,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAiD,CAAC;gBACrE,MAAM,UAAU,GAA4B,EAAE,CAAC;gBAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;oBACrD,IAAI,GAAG,KAAK,IAAI;wBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;gBAC1C,CAAC;gBACD,UAAU,CAAC,WAAW,GAAG,kBAAkB,OAAO,CAAC,cAAc,mBAAmB,OAAO,CAAC,aAAa,8CAA8C,OAAO,CAAC,WAAW,SAAS,WAAW,EAAE,CAAC;gBACjM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,cAAc;QACd,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAEpD,OAAO;YACL,UAAU;YACV,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,UAAU;YACV,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,MAAmB,EACnB,KAAqB,EACrB,OAA2B,EAC3B,UAA8B,EAC9B,MAAqB,EACrB,eAAkC;IAElC,IAAI,CAAC;QACH,wEAAwE;QACxE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAE,CAAC;QAClE,MAAM,gBAAgB,GAAuB;YAC3C,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,eAAe,CACvC,MAAM,CAAC,SAAS,EAChB,gBAAgB,EAChB,eAAe,CAChB,CAAC;QAEF,mCAAmC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,eAAe,GAAuB;gBAC1C,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,SAAS,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC;aACxD,CAAC;YACF,uEAAuE;YACvE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO;YACL,UAAU;YACV,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,UAAU;YACV,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CACxB,MAAmB,EACnB,KAAqB,EACrB,OAA2B,EAC3B,UAA8B,EAC9B,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,CACzC,MAAM,CAAC,SAAS,EAChB,UAAU,EACV,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,MAAM;aACf,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,OAAO,GAA4B;YACvC,UAAU,EAAE;gBACV,SAAS,EAAE;oBACT;wBACE,UAAU,EAAE,SAAS;wBACrB,OAAO,EAAE,WAAW,CAAC,OAAO;qBAC7B;iBACF;aACF;SACF,CAAC;QAEF,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAEvD,OAAO;YACL,UAAU;YACV,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,UAAU;YACV,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,MAAmB,EACnB,KAAqB,EACrB,OAA2B,EAC3B,UAA8B,EAC9B,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,WAAW,CAC3C,MAAM,CAAC,SAAS,EAChB,UAAU,EACV,QAAQ,CACT,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,MAAM;aACf,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA4B;YACvC,UAAU,EAAE;gBACV,KAAK,EAAE,aAAa,CAAC,OAAO;gBAC5B,MAAM,EAAE,QAAQ;aACjB;SACF,CAAC;QAEF,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAEvD,OAAO;YACL,UAAU;YACV,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,UAAU;YACV,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,0BAA0B,CACjC,IAA6B,EAC7B,OAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAiD,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,KAAK,GAAG,KAAK,CAAC,KAA2B,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,yEAAyE;IACzE,iFAAiF;IACjF,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEvE,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QAC/D,OAAO;YACL,GAAG,IAAI;YACP,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAC/B,IAA6B,EAC7B,OAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAiD,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,KAAK,GAAG,KAAK,CAAC,KAA2B,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,+EAA+E;IAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEzE,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO;YACL,GAAG,IAAI;YACP,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,eAAe,GAAG,UAAU,EAAE;SAC9D,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/secret-redactor.d.ts

@@ -0,0 +1,20 @@
+/**
+ * T026: Secret redaction service
+ * Detect properties.secret === true on named values,
+ * replace properties.value with redaction marker.
+ */
+import { ResourceDescriptor } from '../models/types.js';
+/** Marker used to replace secret values in extracted artifacts */
+export declare const REDACTION_MARKER = "*** REDACTED ***";
+/**
+ * Redact secret values from a resource's JSON payload.
+ *
+ * Only applies to NamedValue resources with properties.secret === true.
+ * KeyVault references are preserved as-is (the URL is not itself secret).
+ *
+ * @param descriptor - Resource descriptor
+ * @param json - Raw resource JSON (will be cloned, not mutated)
+ * @returns JSON with secrets redacted
+ */
+export declare function redactSecrets(descriptor: ResourceDescriptor, json: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=secret-redactor.d.ts.map

package/dist/services/secret-redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redactor.d.ts","sourceRoot":"","sources":["../../src/services/secret-redactor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxD,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4BzB"}

package/dist/services/secret-redactor.js

@@ -0,0 +1,45 @@
+/**
+ * T026: Secret redaction service
+ * Detect properties.secret === true on named values,
+ * replace properties.value with redaction marker.
+ */
+import { ResourceType } from '../models/resource-types.js';
+import { logger } from '../lib/logger.js';
+import { getNamePart } from '../lib/resource-path.js';
+/** Marker used to replace secret values in extracted artifacts */
+export const REDACTION_MARKER = '*** REDACTED ***';
+/**
+ * Redact secret values from a resource's JSON payload.
+ *
+ * Only applies to NamedValue resources with properties.secret === true.
+ * KeyVault references are preserved as-is (the URL is not itself secret).
+ *
+ * @param descriptor - Resource descriptor
+ * @param json - Raw resource JSON (will be cloned, not mutated)
+ * @returns JSON with secrets redacted
+ */
+export function redactSecrets(descriptor, json) {
+    if (descriptor.type !== ResourceType.NamedValue) {
+        return json;
+    }
+    const properties = json.properties;
+    if (!properties) {
+        return json;
+    }
+    // Only redact if explicitly marked as secret
+    if (properties.secret !== true) {
+        return json;
+    }
+    // Skip KeyVault-backed named values — the keyVault block is not secret
+    if (properties.keyVault !== undefined && properties.keyVault !== null) {
+        logger.debug(`Named value "${getNamePart(descriptor.nameParts, 0)}" is KeyVault-backed, preserving reference`);
+        return json;
+    }
+    // Deep clone to avoid mutating the original
+    const redacted = JSON.parse(JSON.stringify(json));
+    const redactedProps = redacted.properties;
+    redactedProps.value = REDACTION_MARKER;
+    logger.debug(`Redacted secret value for named value "${getNamePart(descriptor.nameParts, 0)}"`);
+    return redacted;
+}
+//# sourceMappingURL=secret-redactor.js.map

package/dist/services/secret-redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redactor.js","sourceRoot":"","sources":["../../src/services/secret-redactor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,UAA8B,EAC9B,IAA6B;IAE7B,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAiD,CAAC;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6CAA6C;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,gBAAgB,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,4CAA4C,CAAC,CAAC;QAC/G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAA4B,CAAC;IAC7E,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAqC,CAAC;IACrE,aAAa,CAAC,KAAK,GAAG,gBAAgB,CAAC;IAEvC,MAAM,CAAC,KAAK,CAAC,0CAA0C,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC;AAClB,CAAC"}