Merge branch 'main' into feat/publish-filtering

Author: Chris Dayne

.copilot/skills/release-apiops-version/SKILL.md

@@ -1,7 +1,7 @@
 # Skill: Release apiops-cli Version
 
 **Confidence:** high
-**Scope:** Any agent (or human) cutting a new release of `@peterhauge/apiops-cli`
+**Scope:** Any agent (or human) cutting a new release of `@azure-tools/apiops-cli`
 
 ## What
 

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -31,7 +31,7 @@ body:
     id: version
     attributes:
       label: apiops CLI version
-      description: "Run `apiops --version` (or `npm list -g @peterhauge/apiops-cli`) to find the installed version."
+      description: "Run `apiops --version` (or `npm list -g @azure-tools/apiops-cli`) to find the installed version."
     validations:
       required: true
 

.gitignore

@@ -35,6 +35,9 @@ Desktop.ini
 *~
 .idea/
 
+# VS Code local debug config (may contain local subscription IDs / paths)
+.vscode/launch.json
+
 # Local testing output (use --output .local-extract for local runs)
 .local-extract*/
 
@@ -61,3 +64,4 @@ tests/integration/**/bicep/source-apim-post-activation.bicep
 # Temporary files created by build process
 src/templates/generated/
 .squad/.cache/
+/.vs

.squad/agents/nodejsdev/charter.md

@@ -41,7 +41,7 @@ These are the concrete conventions I enforce in this project.
 - CLI commands wire Commander options to service functions — thin layer, no business logic in commands
 
 #### Dual-Mode Package Consumption (Decision: 2026-04-29)
-- **Public npm mode** (default): `--cli-package` omitted → generates `package.json` referencing `"@peterhauge/apiops-cli": "latest"` from npm
+- **Public npm mode** (default): `--cli-package` omitted → generates `package.json` referencing `"@azure-tools/apiops-cli": "latest"` from npm
 - **Local tarball mode**: `--cli-package <path>` → copies tarball to `.apiops/` directory, generates `package.json` with `"apiops": "file:.apiops/{tarball}"`
 - Both modes must work — backward compatibility is non-negotiable
 

.squad/agents/nodejsdev/history.md

@@ -122,7 +122,7 @@ program.version(packageJson.version);
 
 ### 2026-04-29: Dual-Mode Init — Public npm vs Local Tarball
 
-**Problem:** After publishing `@peterhauge/apiops-cli` to npm, `apiops init` still required `--cli-package <path>` pointing to a local .tgz tarball, making the workflow cumbersome for users who just want to use the public package.
+**Problem:** After publishing `@azure-tools/apiops-cli` to npm, `apiops init` still required `--cli-package <path>` pointing to a local .tgz tarball, making the workflow cumbersome for users who just want to use the public package.
 
 **Solution:** Made `--cli-package` optional and implemented two modes:
 
@@ -133,7 +133,7 @@ program.version(packageJson.version);
 
 2. **Public npm mode** (when `--cli-package` NOT provided):
    - No tarball copy, no `.apiops/` directory
-   - Generates package.json with `"@peterhauge/apiops-cli": "latest"`
+   - Generates package.json with `"@azure-tools/apiops-cli": "latest"`
    - Use case: Standard consumption after publishing to npm
 
 **Implementation Details:**

.squad/agents/testengineer/history.md

@@ -130,7 +130,7 @@
    - Updated local mode tests to use `{ mode: 'local', tarballRelPath: '...' }`
    - Added 6 new tests for npm mode covering:
      - Valid JSON generation
-     - `@peterhauge/apiops-cli` dependency with `latest` version
+     - `@azure-tools/apiops-cli` dependency with `latest` version
      - No `apiops` dependency (should be undefined)
      - Standard package.json properties (private, name, version)
      - Newline termination

.squad/config.json

@@ -1,8 +1,4 @@
 {
   "version": 1,
-  "defaultModel": "claude-opus-4.6",
-  "agentModelOverrides": {
-    "ralph": "claude-haiku-4.5",
-    "scribe": "claude-haiku-4.5"
-  }
+  "defaultModel": "gpt-5.6-sol"
 }

.squad/decisions.md

@@ -128,8 +128,8 @@
 ### 2026-04-29T14:30:00Z: apiops init Dual-Mode Package Consumption
 **By:** NodeJsDev  
 **Status:** Implemented  
-**What:** Made `--cli-package` optional in `apiops init`. The command now supports two package consumption modes: (1) **Public npm mode** (default, when `--cli-package` NOT provided): generates package.json with `"@peterhauge/apiops-cli": "latest"`, no local tarball copy, no `.apiops/` directory created, standard consumption pattern after npm publish. (2) **Local tarball mode** (when `--cli-package <path>` provided): copies tarball to `.apiops/` directory, generates package.json with `"apiops": "file:.apiops/{tarball}"`, preserves existing behavior for local development/testing.
-**Why:** After publishing to npm as `@peterhauge/apiops-cli`, requiring users to download the package and run `apiops init --cli-package ./tarball.tgz` added unnecessary friction. Most users want to reference the public package directly. The change is backward compatible — existing workflows with `--cli-package` continue to work unchanged. Improves user experience with simpler onboarding.
+**What:** Made `--cli-package` optional in `apiops init`. The command now supports two package consumption modes: (1) **Public npm mode** (default, when `--cli-package` NOT provided): generates package.json with `"@azure-tools/apiops-cli": "latest"`, no local tarball copy, no `.apiops/` directory created, standard consumption pattern after npm publish. (2) **Local tarball mode** (when `--cli-package <path>` provided): copies tarball to `.apiops/` directory, generates package.json with `"apiops": "file:.apiops/{tarball}"`, preserves existing behavior for local development/testing.
+**Why:** After publishing to npm as `@azure-tools/apiops-cli`, requiring users to download the package and run `apiops init --cli-package ./tarball.tgz` added unnecessary friction. Most users want to reference the public package directly. The change is backward compatible — existing workflows with `--cli-package` continue to work unchanged. Improves user experience with simpler onboarding.
 
 ### 2026-04-21T19:35:00Z: SOAP/WADL spec extraction prefers link format with inline XML fallback
 **By:** ApimExpert (via Squad session with a user)

CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to the APIOps CLI are documented in this file.
 The format is inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project uses [Semantic Versioning](https://semver.org/) with alpha pre-release tags.
 
+## [1.0.0] — 2026-08-27
+
+### Breaking Changes
+
+- **npm package moved to the Microsoft-owned scope** — install `@azure-tools/apiops-cli` instead of `@peterhauge/apiops-cli`; generated repositories, pipelines, documentation, and tarball names now use the new package name ([#239](https://github.com/Azure/apiops-cli/pull/239))
+
+### Features
+
+- **Azure API Center backup and restore** — new `apiops apic extract` and `apiops apic publish` commands round-trip API Center resources and API definition specifications ([#232](https://github.com/Azure/apiops-cli/pull/232))
+- **Filter exclusions** — filter entries can use a leading `!` to exclude exact names or wildcard patterns, including inside API and workspace sub-filters ([#222](https://github.com/Azure/apiops-cli/pull/222))
+- **Stale artifact cleanup** — `apiops extract --remove-stale` safely reconciles managed artifacts after a fully successful extraction, with generated pipelines opting into cleanup ([#246](https://github.com/Azure/apiops-cli/pull/246))
+
+### Bug Fixes
+
+- **Service-level policy filtering** — extraction now honors the `policies` filter for the service policy and documents the supported nested filter syntax ([#221](https://github.com/Azure/apiops-cli/pull/221))
+- **Operation schema links and dynamic authorization policies** — publishing preserves schema-bound OpenAPI request and response representations, while extraction no longer redacts dynamic `Authorization` policy expressions as secrets ([#239](https://github.com/Azure/apiops-cli/pull/239))
+- **HTTP 200 asynchronous updates** — trusted ARM async-operation responses are polled to completion even when the initial APIM response is HTTP 200 ([#243](https://github.com/Azure/apiops-cli/pull/243))
+- **GitHub secret preservation** — identity setup inventories existing repository and environment secrets and requires an explicit reuse, rename, or overwrite decision ([#244](https://github.com/Azure/apiops-cli/pull/244))
+
+### Docs & Testing
+
+- **Azure DevOps pipeline samples** — pipeline examples now live under `samples/pipelines/azure-devops` ([#241](https://github.com/Azure/apiops-cli/pull/241))
+- **Filter documentation alignment** — README and filter guides now cover wildcard exclusions, the singleton policy key, and supported nested API filter syntax ([#242](https://github.com/Azure/apiops-cli/pull/242))
+- **API Center command reference** — README and command documentation now describe `apiops apic` discovery, flags, defaults, examples, authentication, and output behavior ([#247](https://github.com/Azure/apiops-cli/pull/247))
+
 ## [0.4.0-alpha.2] — 2026-07-02
 
 ### Bug Fixes
@@ -140,7 +165,7 @@ This project uses [Semantic Versioning](https://semver.org/) with alpha pre-rele
 ### Features
 
 - **Azure DevOps `init`** — interactive Copilot prompt with managed identity / WIF support ([#31](https://github.com/Azure/apiops-cli/pull/31))
-- **Public npm registry support** — install directly from `@peterhauge/apiops-cli` on npmjs.com ([#28](https://github.com/Azure/apiops-cli/pull/28))
+- **Public npm registry support** — install directly from `@azure-tools/apiops-cli` on npmjs.com ([#28](https://github.com/Azure/apiops-cli/pull/28))
 
 ### Bug Fixes
 
@@ -166,6 +191,7 @@ This project uses [Semantic Versioning](https://semver.org/) with alpha pre-rele
 - **Initial release** — core extract, publish, and init commands for Azure API Management ([#15](https://github.com/Azure/apiops-cli/pull/15))
 - **CodeQL analysis** — automated security scanning workflow ([#19](https://github.com/Azure/apiops-cli/pull/19))
 
+[1.0.0]: https://github.com/Azure/apiops-cli/compare/v0.4.0-alpha.2...v1.0.0
 [0.4.0-alpha.2]: https://github.com/Azure/apiops-cli/compare/v0.4.0-alpha.0...v0.4.0-alpha.2
 [0.4.0-alpha.0]: https://github.com/Azure/apiops-cli/compare/v0.3.0-alpha.0...v0.4.0-alpha.0
 [0.3.0-alpha.0]: https://github.com/Azure/apiops-cli/compare/v0.2.1-alpha.0...v0.3.0-alpha.0

README.md

@@ -13,7 +13,7 @@
 **Prerequisites:** An Azure subscription with an existing APIM resource, and Node.js ≥ 22.
 
 ```bash
-npm install -g @peterhauge/apiops-cli
+npm install -g @azure-tools/apiops-cli
 ```
 
 ## Authentication
@@ -45,9 +45,11 @@ Extract APIM service configuration to local artifact files.
 | `--resource-group <rg>` | *(required)* | Azure resource group |
 | `--service-name <name>` | *(required)* | APIM service name |
 | `--output <dir>` | `./apim-artifacts` | Output directory |
-| `--filter <path>` | | Extract only matching resources |
+| `--filter <path>` | | Extract matching resources; supports wildcards and `!` exclusions |
 | `--no-transitive` | | Skip transitive dependencies |
 
+Filter files support exact names, wildcards, quoted `!`-prefixed exclusions, and the singleton `policies` key. See the [extract command filter reference](docs/commands/extract.md#filter-configuration) for all 17 filter keys and the [filtering guide](docs/guides/filtering-resources.md) for detailed examples.
+
 ```bash
 apiops extract --help
 
@@ -143,6 +145,30 @@ apiops init \
   --environments dev,prod
 ```
 
+### `apiops apic`
+
+Back up and restore Azure API Center (`Microsoft.ApiCenter`) services. This command group is separate from the Azure API Management `extract` and `publish` commands.
+
+| Command | Description |
+|---------|-------------|
+| `apiops apic extract` | Extract API Center configuration and API definition specifications to `./apic-artifacts` |
+| `apiops apic publish` | Publish API Center artifacts and specifications to an API Center service |
+
+```bash
+# Back up an API Center service
+apiops apic extract \
+  --resource-group <rg> \
+  --service-name <name>
+
+# Preview a restore without applying changes
+apiops apic publish \
+  --resource-group <rg> \
+  --service-name <name> \
+  --dry-run
+```
+
+See the [`apiops apic` command reference](docs/commands/apic.md) for flags, workspace extraction, and specification options.
+
 ## Global options
 
 | Option | Default | Description |