@peterhauge/apiops-cli 0.2.1-alpha.0 → 0.4.0-alpha.0

package/CHANGELOG.md

@@ -0,0 +1,166 @@
+# Changelog
+
+All notable changes to the APIOps CLI are documented in this file.
+
+The format is inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+This project uses [Semantic Versioning](https://semver.org/) with alpha pre-release tags.
+
+## [0.4.0-alpha.0] — 2026-07-01
+
+### Breaking Changes
+
+- **`apiops init` output filenames renamed** — identity setup guides and Copilot prompts are now emitted as `APIOPS-PIPELINE-IDENTITY-SETUP.md` / `APIOPS-WORKFLOW-IDENTITY-SETUP.md` and `apiops-setup-pipeline-identity.prompt.md` / `apiops-setup-workflow-identity.prompt.md`. Generated pipeline files are now named `run-apiops-extractor.yml` / `run-apiops-publisher.yml`. Users who re-run `apiops init` after upgrading will see the new files alongside any previously generated ones; delete the old files if you no longer want them tracked ([#200](https://github.com/Azure/apiops-cli/pull/200))
+
+### Features
+
+- **Secret redaction in policy XML** — `apiops extract` now redacts inline secrets (including literal bearer tokens in `Authorization` headers) from extracted policy files while preserving named-value references. `apiops publish` performs a pre-flight scan of all artifacts and aborts (including in dry-run mode) if any `*** REDACTED ***` markers remain, preventing accidental secret exposure ([#199](https://github.com/Azure/apiops-cli/pull/199))
+- **JSON schemas and Copilot prompts for filter/override configuration** — new `schemas/extractor-config.schema.json` and `schemas/override-config.schema.json` provide IDE autocompletion for `configuration.extractor.yaml` and `configuration.{env}.yaml` via the `yaml-language-server` `$schema` directive. `apiops init` now also lays down `apiops-configure-filter.prompt.md` and `apiops-configure-overrides.prompt.md` to conversationally guide users through building these files. Schemas are auto-generated from the TypeScript types on every build so they stay in sync ([#183](https://github.com/Azure/apiops-cli/pull/183))
+- **Dry-run validation gate in generated publish pipelines** — GitHub Actions and Azure DevOps publish templates emitted by `apiops init` now run `apiops publish --dry-run` before every real publish step. If the dry-run fails (connectivity, invalid resources, permission errors), the pipeline halts before touching APIM, preventing partial-failure states ([#182](https://github.com/Azure/apiops-cli/pull/182))
+- **Identity setup guides rewritten for UI workflows** — the manual identity setup guides emitted by `apiops init` now walk users through the Azure portal, Azure DevOps, and GitHub web UIs with step-by-step instructions and links to official docs, while the companion `.prompt.md` files remain the CLI/scripted path for Copilot-driven setup ([#200](https://github.com/Azure/apiops-cli/pull/200))
+
+### Bug Fixes
+
+- **Removed stale `mcpServerInformation.json` references** — follow-up to #173, which moved MCP server configuration into `apiInformation.json`. Documentation (`docs/reference/artifact-format.md`, `docs/reference/resource-types.md`) and the `all-resource-types` integration test manifest now match the post-#173 artifact layout ([#205](https://github.com/Azure/apiops-cli/pull/205))
+
+## [0.3.0-alpha.0] — 2026-06-25
+
+### Breaking Changes
+
+- **Removed unimplemented CLI options** — `--spec-format` (extract command) and `--otel` (global) have been removed from the CLI, docs, and specs. Both were documented but never implemented, so no functional behavior changes for users who weren't relying on them ([#165](https://github.com/Azure/apiops-cli/pull/165))
+
+### Features
+
+- **Wildcard pattern matching in filter configuration** — all name-based filter fields (`apis`, `backends`, `namedValues`, etc.) now accept glob-style patterns with `*` and `?`. Exact names still work alongside patterns ([#160](https://github.com/Azure/apiops-cli/pull/160))
+- **Workspace sub-resource filtering** — nested workspace filters are now applied at runtime (previously documented but not implemented). Wildcard patterns in the `workspaces` list trigger discovery-then-filter instead of being used as literal names. Adds `schemas` field on `WorkspaceSubFilter` ([#160](https://github.com/Azure/apiops-cli/pull/160))
+- **Token substitution validation in generated GitHub Actions publish workflow** — `apiops init` now adds a validation step between token substitution and publish that greps for unresolved \`{#[...]#}\` tokens and fails the job with a clear list of unmapped names. Mirrors the existing Azure DevOps behavior ([#158](https://github.com/Azure/apiops-cli/pull/158))
+- **MCP publish from embedded API metadata** — MCP configuration is now read/written exclusively from `apiInformation.json`; the redundant `mcpServerInformation.json` sidecar is no longer produced or consumed. Legacy sidecars are ignored. Tool operation references are rewritten from source to target ARM IDs before override application so overrides still win ([#173](https://github.com/Azure/apiops-cli/pull/173))
+- **Association scope tracking for round-trip correctness** — extract/publish now records and reconstructs whether each linked resource (e.g. workspace product → built-in group) is service-scoped or workspace-scoped, producing correct ARM paths in both directions. Backward-compatible with legacy artifact files that only contain `name`. 409 "link already exists" responses are treated as idempotent successes ([#175](https://github.com/Azure/apiops-cli/pull/175))
+
+### Bug Fixes
+
+- **Resource group log masking preserves meaningful segments** — `Protect-ResourceGroupName` now detects resource group names ending with a long numeric suffix (>=6 digits, typical of GitHub `run_id` values) and preserves the last dash-separated segment before the number. Output goes from `rg-...1553476` to `rg-...src-27781553476`, making source vs target groups distinguishable in logs ([#168](https://github.com/Azure/apiops-cli/pull/168))
+- **Override config template no longer hardcodes a secret** — the generated `configuration.override.yaml` from `apiops init` now uses a \`{#[DB\_Connection\_String]#}\` token placeholder for the connection-string example (aligned with the pipeline substitution format) and drops the confusing "APIOps Toolkit" reference comment ([#164](https://github.com/Azure/apiops-cli/pull/164))
+
+### Docs & Testing
+
+- **Incremental publish behavior documented** — clarified that changes to override files alone don't trigger incremental publish; only API/policy/etc. artifact changes do ([#159](https://github.com/Azure/apiops-cli/pull/159))
+- **Environment overrides guide improvements** — expanded examples and clarifications in `docs/guides/environment-overrides.md` ([#166](https://github.com/Azure/apiops-cli/pull/166))
+- **All-types round-trip test imports Petstore Swagger** — the all-resource-types integration test now imports the canonical Petstore Swagger spec in both V2 and V3 forms, exercising a broader surface ([#171](https://github.com/Azure/apiops-cli/pull/171))
+
+## [0.2.1-alpha.0] — 2026-06-12
+
+### Features
+
+- **Token substitution in publish pipelines** — \`{#[TOKEN\_NAME]#}\` placeholders are now resolved during publish, matching APIOps Toolkit behavior ([#127](https://github.com/Azure/apiops-cli/pull/127))
+
+### Bug Fixes
+
+- **Named value reference resolution** — logger credentials now correctly resolve `{{displayName}}` refs across environments; auto-generated named values are published when an override is provided ([#145](https://github.com/Azure/apiops-cli/pull/145))
+- **Redacted secret guard** — secret named values with `*** REDACTED ***` placeholder are skipped during publish with a clear warning ([#145](https://github.com/Azure/apiops-cli/pull/145))
+- **Schema ref stripping extended** — removes stale `schemaId`/`typeName` from `queryParameters`, `headers`, `templateParameters`, and response headers during operation PATCH ([#145](https://github.com/Azure/apiops-cli/pull/145))
+- **Workspace ARM paths** — use workspace-specific ARM paths for association resources (tag links, product links) ([#136](https://github.com/Azure/apiops-cli/pull/136))
+
+### Docs & Testing
+
+- **Comprehensive environment override documentation** — added examples for all resource types, auto-generated named value walkthrough, and gotchas for secrets and loggers ([#145](https://github.com/Azure/apiops-cli/pull/145))
+- **Override config template** — added logger `credentials.instrumentationKey` example ([#145](https://github.com/Azure/apiops-cli/pull/145))
+
+## [0.2.0-alpha.0] — 2026-06-10
+
+### Features
+
+- **A2A (Agent-to-Agent) API support** — full extract/publish round-trip for A2A protocol APIs ([#89](https://github.com/Azure/apiops-cli/pull/89))
+- **ApiOperation as first-class resource** — operations are persisted individually with PATCH reconciliation for drift-free round-trips ([#104](https://github.com/Azure/apiops-cli/pull/104))
+- **Async LRO polling** — long-running APIM operations are polled to completion; OpenAPI specs are sanitized before import ([#112](https://github.com/Azure/apiops-cli/pull/112))
+- **Workspace support on V2 SKUs** — workspace-scoped resources (APIs, products, backends, named values, tags) are extracted and published with correct ARM paths ([#128](https://github.com/Azure/apiops-cli/pull/128), [#129](https://github.com/Azure/apiops-cli/pull/129))
+- **Integration test split into 7 phases** — deploy, extract, validate, override, publish, compare, teardown — each runnable independently ([#92](https://github.com/Azure/apiops-cli/pull/92))
+
+### Bug Fixes
+
+- **Override & filter config alignment** — fully aligned with APIOps Toolkit array-based format ([#102](https://github.com/Azure/apiops-cli/pull/102), [#115](https://github.com/Azure/apiops-cli/pull/115))
+- **Schema ref stripping** — removes stale `schemaId`/`typeName` from operation representations during post-import PATCH reconciliation ([#111](https://github.com/Azure/apiops-cli/pull/111))
+- **Windows cmd.exe quoting** — fixed stdin and argument quoting issues in `Invoke-MaskedProcess` ([#110](https://github.com/Azure/apiops-cli/pull/110))
+
+### Docs & Testing
+
+- **Extract filter documentation** — documented full filter surface and explicit exclude-all semantics ([#103](https://github.com/Azure/apiops-cli/pull/103))
+- **Hardened teardown** — Phase 7 handles APIM delete/purge races and soft-delete conflicts ([#122](https://github.com/Azure/apiops-cli/pull/122))
+- **Package-build test README** — added single-test run command for quick iteration ([#87](https://github.com/Azure/apiops-cli/pull/87))
+
+## [0.1.7-alpha.0] — 2026-06-01
+
+### Features
+
+- **Workspace-scoped resource refactor** — uses `workspaceSupported` flag to determine which resource types are available in workspace containers ([#84](https://github.com/Azure/apiops-cli/pull/84))
+
+### Bug Fixes
+
+- **Premium SKU round-trip fixes** — resolved test failures specific to Premium tier ([#80](https://github.com/Azure/apiops-cli/pull/80))
+- **Workspace unit test fixes** — corrected test failures introduced by workspace refactor ([#93](https://github.com/Azure/apiops-cli/pull/93))
+
+### Docs & Testing
+
+- **Air-gapped setup walkthroughs** — step-by-step guides for GitHub Actions and Azure DevOps in disconnected environments ([#77](https://github.com/Azure/apiops-cli/pull/77))
+- **APIOps terminology update** — replaced "APIOps v1/v2" with "APIOps Toolkit/CLI" across all docs ([#94](https://github.com/Azure/apiops-cli/pull/94))
+- **API version docs correction** — fixed default API version in documentation ([#81](https://github.com/Azure/apiops-cli/pull/81))
+- **Integration test skill notes** — added AADSTS700016 and UI access troubleshooting ([#83](https://github.com/Azure/apiops-cli/pull/83))
+
+## [0.1.6-alpha.0] — 2026-05-21
+
+### Features
+
+- **MCP server support** — extract and publish MCP server configurations ([#36](https://github.com/Azure/apiops-cli/pull/36), [#51](https://github.com/Azure/apiops-cli/pull/51))
+- **Publish `--commit-id` flag** — CLI-over-env precedence for commit tracking ([#47](https://github.com/Azure/apiops-cli/pull/47))
+- **Reusable integration test workflow** — `workflow_call` support for CI reuse ([#42](https://github.com/Azure/apiops-cli/pull/42))
+
+### Bug Fixes
+
+- **AzDO publish pipeline flag** — corrected `--overrides` (was `--override`) in Azure DevOps template ([#75](https://github.com/Azure/apiops-cli/pull/75))
+- **Empty override file handling** — gracefully handles empty or missing override files ([#33](https://github.com/Azure/apiops-cli/pull/33))
+
+### Docs & Testing
+
+- **User-facing documentation** — added getting started guides, architecture diagram, and agent charters ([#69](https://github.com/Azure/apiops-cli/pull/69), [#56](https://github.com/Azure/apiops-cli/pull/56))
+- **Open-source readiness** — copyright headers, sensitivity audit, accuracy policies ([#78](https://github.com/Azure/apiops-cli/pull/78))
+- **Security hardening** — added SecurityExpert to Squad team ([#70](https://github.com/Azure/apiops-cli/pull/70))
+
+## [0.1.5-alpha.1] — 2026-05-07
+
+### Features
+
+- **Azure DevOps `init`** — interactive Copilot prompt with managed identity / WIF support ([#31](https://github.com/Azure/apiops-cli/pull/31))
+- **Public npm registry support** — install directly from `@peterhauge/apiops-cli` on npmjs.com ([#28](https://github.com/Azure/apiops-cli/pull/28))
+
+### Bug Fixes
+
+- **Empty override file** — fixed crash when override file exists but is empty ([#33](https://github.com/Azure/apiops-cli/pull/33))
+- **Dependency bump** — updated `uuid` and `@azure/msal-node` ([#26](https://github.com/Azure/apiops-cli/pull/26))
+
+### Docs & Testing
+
+- **Auth documentation** — clarified OIDC vs client-secret auth paths ([#27](https://github.com/Azure/apiops-cli/pull/27))
+- **Azure DevOps manual setup** — updated instructions for `apiops init --ci azure-devops` ([#30](https://github.com/Azure/apiops-cli/pull/30))
+
+## [0.1.4-alpha.1] — 2026-04-29
+
+### Features
+
+- **User-Agent header** — all REST API calls now include a `User-Agent` header for tracing ([#21](https://github.com/Azure/apiops-cli/pull/21))
+- **Optional `--cli-package` parameter** — enables using apiops from the public npm registry without specifying a local package path ([#20](https://github.com/Azure/apiops-cli/pull/20))
+
+## [0.1.2-alpha.0] — 2026-04-28
+
+### Features
+
+- **Initial release** — core extract, publish, and init commands for Azure API Management ([#15](https://github.com/Azure/apiops-cli/pull/15))
+- **CodeQL analysis** — automated security scanning workflow ([#19](https://github.com/Azure/apiops-cli/pull/19))
+
+[0.4.0-alpha.0]: https://github.com/Azure/apiops-cli/compare/v0.3.0-alpha.0...v0.4.0-alpha.0
+[0.3.0-alpha.0]: https://github.com/Azure/apiops-cli/compare/v0.2.1-alpha.0...v0.3.0-alpha.0
+[0.2.1-alpha.0]: https://github.com/Azure/apiops-cli/compare/v0.2.0-alpha.0...v0.2.1-alpha.0
+[0.2.0-alpha.0]: https://github.com/Azure/apiops-cli/compare/v0.1.7-alpha.0...v0.2.0-alpha.0
+[0.1.7-alpha.0]: https://github.com/Azure/apiops-cli/compare/v0.1.6-alpha.0...v0.1.7-alpha.0
+[0.1.6-alpha.0]: https://github.com/Azure/apiops-cli/compare/v0.1.5-alpha.1...v0.1.6-alpha.0
+[0.1.5-alpha.1]: https://github.com/Azure/apiops-cli/compare/v0.1.4-alpha.1...v0.1.5-alpha.1
+[0.1.4-alpha.1]: https://github.com/Azure/apiops-cli/compare/v0.1.2-alpha.0...v0.1.4-alpha.1
+[0.1.2-alpha.0]: https://github.com/Azure/apiops-cli/releases/tag/v0.1.2-alpha.0

package/README.md

@@ -1,169 +1,173 @@
-# apiops
-
-`apiops` is a CLI tool for Azure API Management (APIM) configuration-as-code. Extract your APIM service configuration to local artifact files, publish those artifacts back to Azure, and scaffold CI/CD pipelines — all from the command line.
-
-| | |
-|---|---|
-| **Source code** | [github.com/Azure/apiops-cli](https://github.com/Azure/apiops-cli) |
-| **Issues** | [GitHub Issues](https://github.com/Azure/apiops-cli/issues) |
-| **Architecture** | [docs/architecture.md](./docs/architecture.md) |
-
-## Getting started
-
-**Prerequisites:** An Azure subscription with an existing APIM resource, and Node.js ≥ 22.
-
-```bash
-npm install -g @peterhauge/apiops-cli
-```
-
-## Authentication
-
-`apiops` uses [`@azure/identity`](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/identity/identity) `DefaultAzureCredential` for authentication.
-
-### Generated GitHub Actions workflows (`apiops init`)
-
-Workflows scaffolded by `apiops init` authenticate via **OIDC (workload identity federation)** — no client secret is stored or needed. Run `apiops init` and use the generated `identity-setup.prompt.md` to create an Azure AD application with federated credentials for your GitHub repository.
-
-Required repository secrets: `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`
-
-### Local CLI / other CI systems
-
-When running `apiops` outside a GitHub Actions OIDC context you can supply credentials explicitly:
-
-- **Environment variables:** `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`
-- **CLI flags:** `--client-id`, `--client-secret`, `--tenant-id`, `--subscription-id`
-- **Managed Identity / Workload Identity:** Supported automatically via `DefaultAzureCredential` when running on Azure-hosted infrastructure (VMs, App Service, etc.) or in Azure Pipelines with workload identity federation configured.
-
-## Commands
-
-### `apiops extract`
-
-Extract APIM service configuration to local artifact files.
-
-| Flag | Default | Description |
-|------|---------|-------------|
-| `--resource-group <rg>` | *(required)* | Azure resource group |
-| `--service-name <name>` | *(required)* | APIM service name |
-| `--output <dir>` | `./apim-artifacts` | Output directory |
-| `--filter <path>` | | Extract only matching resources |
-| `--no-transitive` | | Skip transitive dependencies |
-| `--spec-format <format>` | | Override API spec format |
-
-```bash
-apiops extract --help
-
-# Basic extraction to the default output directory
-apiops extract \
-  --resource-group <rg> \
-  --service-name <name> \
-  --output ./apim-artifacts
-
-# Extract a filtered subset of resources and override the API spec format
-apiops extract \
-  --resource-group <rg> \
-  --service-name <name> \
-  --filter ./filter.yaml \
-  --spec-format openapi-v3-yaml
-
-# Authenticate explicitly with a service principal
-apiops extract \
-  --resource-group <rg> \
-  --service-name <name> \
-  --client-id $AZURE_CLIENT_ID \
-  --client-secret $AZURE_CLIENT_SECRET \
-  --tenant-id $AZURE_TENANT_ID \
-  --subscription-id $AZURE_SUBSCRIPTION_ID
-```
-
-### `apiops publish`
-
-Publish local artifact files to an Azure APIM service.
-
-| Flag | Default | Description |
-|------|---------|-------------|
-| `--resource-group <rg>` | *(required)* | Azure resource group |
-| `--service-name <name>` | *(required)* | APIM service name |
-| `--source <dir>` | `./apim-artifacts` | Source artifacts directory |
-| `--overrides <path>` | | Path to overrides file |
-| `--commit-id <sha>` | | Git commit SHA for incremental publish |
-| `--dry-run` | | Preview changes without applying |
-| `--delete-unmatched` | | Delete resources not in artifacts (mutually exclusive with `--commit-id`) |
-
-```bash
-apiops publish --help
-
-# Preview changes without applying them
-apiops publish \
-  --resource-group <rg> \
-  --service-name <name> \
-  --dry-run
-
-# Publish and remove resources not present in the local artifacts
-apiops publish \
-  --resource-group <rg> \
-  --service-name <name> \
-  --delete-unmatched
-
-# Incremental publish for a specific commit
-apiops publish \
-  --resource-group <rg> \
-  --service-name <name> \
-  --commit-id <sha>
-```
-
-### `apiops init`
-
-Scaffold a new APIM artifacts repository with CI/CD pipelines.
-
-| Flag | Description |
-|------|-------------|
-| `--cli-package <path>` | Path to a local `.tgz` tarball |
-| `--ci <platform>` | `github-actions` or `azure-devops` |
-| `--environments <list>` | Comma-separated environments (e.g. `dev,prod`) |
-| `--non-interactive` | Skip all prompts |
-| `--force` | Overwrite existing files |
-
-```bash
-apiops init --help
-
-apiops init \
-  --ci github-actions \
-  --environments dev,prod
-```
-
-## Global options
-
-| Option | Default | Description |
-|--------|---------|-------------|
-| `--subscription-id <id>` | `AZURE_SUBSCRIPTION_ID` env var | Azure subscription ID |
-| `--cloud <name>` | `public` | `public`, `china`, `usgov`, `germany` |
-| `--log-level <level>` | `info` | `debug`, `info`, `warn`, `error` |
-| `--format <type>` | `text` | `text` or `json` |
-| `--client-id <id>` | `AZURE_CLIENT_ID` env var | Service principal client ID |
-| `--client-secret <secret>` | `AZURE_CLIENT_SECRET` env var | Service principal secret |
-| `--tenant-id <id>` | `AZURE_TENANT_ID` env var | Azure AD tenant ID |
-
-## Contributing
-
-See [CONTRIBUTING.md](./CONTRIBUTING.md) for how to build, test, debug, and submit changes.
-
-This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
-For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact
-[opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
-
-## Security
-
-Please do not report security vulnerabilities through public GitHub issues. Instead, please follow the instructions in
-our [SECURITY.md](./SECURITY.md).
-
-## Trademarks
-
-This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft
-trademarks or logos is subject to and must follow
-[Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general).
-Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.
-Any use of third-party trademarks or logos are subject to those third-party's policies.
-
-## License
-
-[MIT](./LICENSE.md)
+# apiops
+
+`apiops` is a CLI tool for Azure API Management (APIM) configuration-as-code. Extract your APIM service configuration to local artifact files, publish those artifacts back to Azure, and scaffold CI/CD pipelines — all from the command line.
+
+| | |
+|---|---|
+| **Source code** | [github.com/Azure/apiops-cli](https://github.com/Azure/apiops-cli) |
+| **Issues** | [GitHub Issues](https://github.com/Azure/apiops-cli/issues) |
+| **Architecture** | [docs/architecture.md](./docs/architecture.md) |
+
+## Getting started
+
+**Prerequisites:** An Azure subscription with an existing APIM resource, and Node.js ≥ 22.
+
+```bash
+npm install -g @peterhauge/apiops-cli
+```
+
+## Authentication
+
+`apiops` uses [`@azure/identity`](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/identity/identity) `DefaultAzureCredential` for authentication.
+
+### Generated GitHub Actions workflows (`apiops init`)
+
+Workflows scaffolded by `apiops init` authenticate via **OIDC (workload identity federation)** — no client secret is stored or needed. Run `apiops init` and use the generated `identity-setup.prompt.md` to create an Azure AD application with federated credentials for your GitHub repository.
+
+Required repository secrets: `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`
+
+### Local CLI / other CI systems
+
+When running `apiops` outside a GitHub Actions OIDC context you can supply credentials explicitly:
+
+- **Environment variables:** `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`
+- **CLI flags:** `--client-id`, `--client-secret`, `--tenant-id`, `--subscription-id`
+- **Managed Identity / Workload Identity:** Supported automatically via `DefaultAzureCredential` when running on Azure-hosted infrastructure (VMs, App Service, etc.) or in Azure Pipelines with workload identity federation configured.
+
+## Commands
+
+### `apiops extract`
+
+Extract APIM service configuration to local artifact files.
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--resource-group <rg>` | *(required)* | Azure resource group |
+| `--service-name <name>` | *(required)* | APIM service name |
+| `--output <dir>` | `./apim-artifacts` | Output directory |
+| `--filter <path>` | | Extract only matching resources |
+| `--no-transitive` | | Skip transitive dependencies |
+
+```bash
+apiops extract --help
+
+# Basic extraction to the default output directory
+apiops extract \
+  --resource-group <rg> \
+  --service-name <name> \
+  --output ./apim-artifacts
+
+# Extract a filtered subset of resources
+apiops extract \
+  --resource-group <rg> \
+  --service-name <name> \
+  --filter ./filter.yaml
+
+# Authenticate explicitly with a service principal
+apiops extract \
+  --resource-group <rg> \
+  --service-name <name> \
+  --client-id $AZURE_CLIENT_ID \
+  --client-secret $AZURE_CLIENT_SECRET \
+  --tenant-id $AZURE_TENANT_ID \
+  --subscription-id $AZURE_SUBSCRIPTION_ID
+```
+
+### `apiops publish`
+
+Publish local artifact files to an Azure APIM service.
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--resource-group <rg>` | *(required)* | Azure resource group |
+| `--service-name <name>` | *(required)* | APIM service name |
+| `--source <dir>` | `./apim-artifacts` | Source artifacts directory |
+| `--overrides <path>` | | Path to overrides file |
+| `--commit-id <sha>` | | Git commit SHA for incremental publish |
+| `--dry-run` | | Preview changes without applying |
+| `--delete-unmatched` | | Delete resources not in artifacts (mutually exclusive with `--commit-id`) |
+
+```bash
+apiops publish --help
+
+# Preview changes without applying them
+apiops publish \
+  --resource-group <rg> \
+  --service-name <name> \
+  --dry-run
+
+# Publish and remove resources not present in the local artifacts
+apiops publish \
+  --resource-group <rg> \
+  --service-name <name> \
+  --delete-unmatched
+
+# Incremental publish for a specific commit
+apiops publish \
+  --resource-group <rg> \
+  --service-name <name> \
+  --commit-id <sha>
+```
+
+### `apiops init`
+
+Scaffold a new APIM artifacts repository with CI/CD pipelines.
+
+| Flag | Description |
+|------|-------------|
+| `--cli-package <path>` | Path to a local `.tgz` tarball |
+| `--ci <platform>` | `github-actions` or `azure-devops` |
+| `--environments <list>` | Comma-separated environments (e.g. `dev,prod`) |
+| `--non-interactive` | Skip all prompts |
+| `--force` | Overwrite existing files |
+
+```bash
+apiops init --help
+
+apiops init \
+  --ci github-actions \
+  --environments dev,prod
+```
+
+## Global options
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `--subscription-id <id>` | `AZURE_SUBSCRIPTION_ID` env var | Azure subscription ID |
+| `--cloud <name>` | `public` | `public`, `china`, `usgov`, `germany` |
+| `--log-level <level>` | `info` | `debug`, `info`, `warn`, `error` |
+| `--format <type>` | `text` | `text` or `json` |
+| `--client-id <id>` | `AZURE_CLIENT_ID` env var | Service principal client ID |
+| `--client-secret <secret>` | `AZURE_CLIENT_SECRET` env var | Service principal secret |
+| `--tenant-id <id>` | `AZURE_TENANT_ID` env var | Azure AD tenant ID |
+
+## Changelog
+
+See [CHANGELOG.md](./CHANGELOG.md) for release notes and the list of changes in each version. To see what has changed
+since the version you have installed, compare tags on GitHub
+(e.g. [`v0.2.1-alpha.0...main`](https://github.com/Azure/apiops-cli/compare/v0.2.1-alpha.0...main)).
+
+## Contributing
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md) for how to build, test, debug, and submit changes.
+
+This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact
+[opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
+
+## Security
+
+Please do not report security vulnerabilities through public GitHub issues. Instead, please follow the instructions in
+our [SECURITY.md](./SECURITY.md).
+
+## Trademarks
+
+This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft
+trademarks or logos is subject to and must follow
+[Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general).
+Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.
+Any use of third-party trademarks or logos are subject to those third-party's policies.
+
+## License
+
+[MIT](./LICENSE.md)

package/dist/cli/extract-command.d.ts

@@ -1,7 +1,7 @@
 /**
- * T028 & T029: Extract command CLI registration
+ * Extract command CLI registration
  * Commander subcommand with --resource-group, --service-name, --output,
- * --filter, --no-transitive, --spec-format flags.
+ * --filter, --no-transitive flags.
  * Includes --format json: machine-readable JSON output mode.
  */
 import { Command } from 'commander';

package/dist/cli/extract-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract-command.d.ts","sourceRoot":"","sources":["../../src/cli/extract-command.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsBpC;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAsB9C"}
+{"version":3,"file":"extract-command.d.ts","sourceRoot":"","sources":["../../src/cli/extract-command.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBpC;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAqB9C"}

package/dist/cli/extract-command.js

@@ -1,9 +1,9 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 /**
- * T028 & T029: Extract command CLI registration
+ * Extract command CLI registration
  * Commander subcommand with --resource-group, --service-name, --output,
- * --filter, --no-transitive, --spec-format flags.
+ * --filter, --no-transitive flags.
  * Includes --format json: machine-readable JSON output mode.
  */
 import { Command } from 'commander';
@@ -24,7 +24,6 @@ export function createExtractCommand() {
         .option('--output <dir>', 'Output directory path', './apim-artifacts')
         .option('--filter <path>', 'Filter configuration YAML file')
         .option('--no-transitive', 'Disable transitive dependency inclusion')
-        .option('--spec-format <format>', 'API specification format (openapi-v2-json, openapi-v3-json, openapi-v3-yaml)')
         .action(async (options, command) => {
         const globalOpts = command.optsWithGlobals();
         await executeExtract(options, globalOpts);
@@ -70,7 +69,6 @@ async function executeExtract(options, globalOpts) {
         outputDir: options.output,
         filter: filterConfig,
         includeTransitive: options.transitive,
-        specFormat: options.specFormat,
         logLevel: parseLogLevel(globalOpts.logLevel ?? 'info'),
     };
     // Create client and store
@@ -88,7 +86,7 @@ async function executeExtract(options, globalOpts) {
     process.exit(result.exitCode);
 }
 /**
- * T029: JSON output mode for extract.
+ * JSON output mode for extract.
  * Machine-readable JSON to stdout with resource counts and file paths.
  */
 function outputJson(result) {

package/dist/cli/extract-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-command.js","sourceRoot":"","sources":["../../src/cli/extract-command.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,aAAa,EAAoB,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAczE;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;SACnC,WAAW,CAAC,oDAAoD,CAAC;SACjE,cAAc,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;SACpE,cAAc,CAAC,uBAAuB,EAAE,4BAA4B,CAAC;SACrE,MAAM,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,CAAC;SACrE,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;SAC3D,MAAM,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;SACpE,MAAM,CAAC,wBAAwB,EAAE,8EAA8E,CAAC;SAChH,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,OAAgB,EAAE,EAAE;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,EAMtC,CAAC;QAEL,MAAM,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,UAMC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAEtF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wBAAwB;IACxB,wEAAwE;IACxE,6EAA6E;IAC7E,yCAAyC;IACzC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;IAClG,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEvG,MAAM,OAAO,GAAuB;QAClC,cAAc;QACd,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU;QACV,OAAO;KACR,CAAC;IAEF,kCAAkC;IAClC,IAAI,YAAY,CAAC;IACjB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,0BAA0B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,aAAa,GAAkB;QACnC,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,OAAO,CAAC,MAAM;QACzB,MAAM,EAAE,YAAY;QACpB,iBAAiB,EAAE,OAAO,CAAC,UAAU;QACrC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,QAAQ,IAAI,MAAM,CAAC;KACvD,CAAC;IAEF,0BAA0B;IAC1B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,aAAa,EAAE,CAAC;IAElC,iBAAiB;IACjB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAEjE,iBAAiB;IACjB,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAwB;IAC1C,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACvF,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC7C,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;gBACpE,MAAM,EAAE,EAAE,CAAC,UAAU;aACtB,CAAC,CAAC;SACJ;QACD,SAAS,EAAE,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,EAAE,CAAC,OAAO;YAChB,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YACpE,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YACtE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;SAC3D,CAAC,CAAC;QACH,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,EAAE,EAAE,CAAC,aAAa;YACtB,SAAS,EAAE,EAAE,CAAC,aAAa;YAC3B,MAAM,EAAE,EAAE,CAAC,UAAU;SACtB,CAAC,CAAC;KACJ,CAAC;IAEF,0CAA0C;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,MAAwB;IAC1C,mBAAmB;IACnB,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC/E,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,YAAY,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,cAAc;IACd,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,aAAa;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,CAAC;QAC1E,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,YAAY,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,aAAa,MAAM,EAAE,CAAC,aAAa,cAAc,CAAC,CAAC;IAC3F,CAAC;IAED,UAAU;IACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,MAAM,CAAC,cAAc,yBAAyB,MAAM,CAAC,WAAW,WAAW,CACxF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"extract-command.js","sourceRoot":"","sources":["../../src/cli/extract-command.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,aAAa,EAAoB,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAazE;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;SACnC,WAAW,CAAC,oDAAoD,CAAC;SACjE,cAAc,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;SACpE,cAAc,CAAC,uBAAuB,EAAE,4BAA4B,CAAC;SACrE,MAAM,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,CAAC;SACrE,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;SAC3D,MAAM,CAAC,iBAAiB,EAAE,yCAAyC,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,OAAgB,EAAE,EAAE;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,EAMtC,CAAC;QAEL,MAAM,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,UAMC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAEtF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wBAAwB;IACxB,wEAAwE;IACxE,6EAA6E;IAC7E,yCAAyC;IACzC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;IAClG,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,IAAI,QAAQ,CAAC;IAC/C,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEvG,MAAM,OAAO,GAAuB;QAClC,cAAc;QACd,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU;QACV,OAAO;KACR,CAAC;IAEF,kCAAkC;IAClC,IAAI,YAAY,CAAC;IACjB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,0BAA0B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,aAAa,GAAkB;QACnC,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,OAAO,CAAC,MAAM;QACzB,MAAM,EAAE,YAAY;QACpB,iBAAiB,EAAE,OAAO,CAAC,UAAU;QACrC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,QAAQ,IAAI,MAAM,CAAC;KACvD,CAAC;IAEF,0BAA0B;IAC1B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,aAAa,EAAE,CAAC;IAElC,iBAAiB;IACjB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAEjE,iBAAiB;IACjB,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAwB;IAC1C,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACvF,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE;YACP,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC7C,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;gBACpE,MAAM,EAAE,EAAE,CAAC,UAAU;aACtB,CAAC,CAAC;SACJ;QACD,SAAS,EAAE,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,EAAE,CAAC,OAAO;YAChB,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YACpE,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YACtE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;SAC3D,CAAC,CAAC;QACH,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,EAAE,EAAE,CAAC,aAAa;YACtB,SAAS,EAAE,EAAE,CAAC,aAAa;YAC3B,MAAM,EAAE,EAAE,CAAC,UAAU;SACtB,CAAC,CAAC;KACJ,CAAC;IAEF,0CAA0C;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,MAAwB;IAC1C,mBAAmB;IACnB,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC/E,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,YAAY,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,cAAc;IACd,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,aAAa;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,CAAC;QAC1E,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,YAAY,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,aAAa,MAAM,EAAE,CAAC,aAAa,cAAc,CAAC,CAAC;IAC3F,CAAC;IAED,UAAU;IACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,MAAM,CAAC,cAAc,yBAAyB,MAAM,CAAC,WAAW,WAAW,CACxF,CAAC;AACJ,CAAC"}

package/dist/cli/index.js

@@ -2,7 +2,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 /**
- * T019: Commander program entry point
+ * Commander program entry point
  * Sets up global options and subcommand registration pattern
  */
 import { Command, Option } from 'commander';
@@ -24,7 +24,6 @@ program
     .addOption(new Option('--log-level <level>', 'Log level: debug, info, warn, or error')
     .choices(['debug', 'info', 'warn', 'error'])
     .default('info'))
-    .option('--otel <path>', 'Path to OpenTelemetry config YAML')
     .option('--format <type>', 'Output format: text or json', 'text')
     .option('--subscription-id <id>', 'Azure subscription ID')
     .option('--cloud <name>', 'Sovereign cloud: public, china, usgov, germany', 'public')
@@ -35,7 +34,7 @@ program
 program.hook('preAction', (thisCommand) => {
     const opts = thisCommand.optsWithGlobals();
     logger.configure({ level: parseLogLevel(opts.logLevel ?? 'info') });
-    // T040: Set DefaultAzureCredential env vars from explicit auth flags.
+    // Set DefaultAzureCredential env vars from explicit auth flags.
     // This ensures the ServicePrincipal credential is tried first,
     // avoiding interactive browser prompts in CI/CD pipelines.
     if (opts.clientId) {