pp-azure-functions-admin

What this skill does

<!-- GENERATED FILE — DO NOT EDIT.
     This file is a verbatim mirror of library/cloud/azure-functions-admin/SKILL.md,
     regenerated post-merge by tools/generate-skills/. Hand-edits here are
     silently overwritten on the next regen. Edit the library/ source instead.
     See the repository agent guide, section "Generated artifacts: registry.json, cli-skills/". -->

# Azure Functions — Printing Press CLI

## Prerequisites: Install the CLI

This skill drives the `azure-functions-admin-pp-cli` binary. **You must verify the CLI is installed before invoking any command from this skill.** If it is missing, install it first:

1. Install via the Printing Press installer. It defaults binaries to `$HOME/.local/bin` on macOS/Linux and `%LOCALAPPDATA%\Programs\PrintingPress\bin` on Windows:
   ```bash
   npx -y @mvanhorn/printing-press-library install azure-functions-admin --cli-only
   ```
2. Verify: `azure-functions-admin-pp-cli --version`
3. Ensure the reported install directory is on `$PATH` for the agent/runtime that will invoke this skill.

If the `npx` install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.3 or newer):

```bash
go install github.com/mvanhorn/printing-press-library/library/cloud/azure-functions-admin/cmd/azure-functions-admin-pp-cli@latest
```

If `--version` reports "command not found" after install, the runtime cannot see the binary directory on `$PATH`. Do not proceed with skill commands until verification succeeds.

## When to Use This CLI

Use this CLI when you need to understand or audit Azure Functions you already run: take inventory across a subscription, decide whether to move an app off the Consumption plan to kill cold starts, audit app settings for leaked secrets or dev/prod drift, or triage which function is failing. It is the right tool for read-only inspection and analysis, especially for agents and scripts that want JSON output and a local cache.

## Anti-triggers

Do not use this CLI for:
- Deploying or publishing function code — use `func azure functionapp publish` or `az functionapp deployment`.
- Creating, restarting, scaling, or deleting function apps — this CLI is read-only by design.
- Changing app settings or rotating keys — use `az functionapp config appsettings set` / `az functionapp keys set`.
- Building a new Functions project — use the Azure Functions Core Tools (`func init`).

## Unique Capabilities

These capabilities aren't available in any other tool for this API.

### Cold-start & plan-fit observatory
- **`coldstart`** — See how often your functions cold-start and how slow those starts are, with the projected cost of moving to a Premium always-ready plan.

  _Reach for this to answer 'are cold starts hurting us, and is Premium worth it' instead of guessing from anecdotes._

  ```bash
  azure-functions-admin coldstart --app my-function-app --agent
  ```
- **`scaling`** — Track instance scale-out and execution-time drift for an app over a time window, flagging when p95 duration creeps above baseline.

  _Reach for this to catch a slow-degrading function before it pages you._

  ```bash
  azure-functions-admin scaling --app my-function-app --window 7d --agent
  ```
- **`plan-fit`** — Per-app recommendation of Consumption vs Premium vs Dedicated across a resource group, based on invocation density, cold-start sensitivity, and duration.

  _Reach for this when deciding how to host a fleet of functions cost-effectively._

  ```bash
  azure-functions-admin plan-fit --resource-group my-resource-group --agent
  ```

### Config hygiene & secret hygiene
- **`drift`** — Diff app settings across function apps and their deployment slots, flagging settings present in one environment but not another and plaintext values that should be Key Vault references.

  _Reach for this before a release to catch dev/prod config divergence._

  ```bash
  azure-functions-admin drift --resource-group my-resource-group --agent
  ```
- **`secrets-audit`** — Flag app settings holding raw secret values instead of @Microsoft.KeyVault references, plus stale or unused function keys.

  _Reach for this to find leaked secrets and tighten config hygiene._

  ```bash
  azure-functions-admin secrets-audit --app my-function-app --agent
  ```

### Operational triage
- **`failures`** — Cluster recent invocation failures by function and exception type from Application Insights over a time window.

  _Reach for this to triage which function and which exception is failing most._

  ```bash
  azure-functions-admin failures --app my-function-app --since 24h --agent
  ```
- **`stale`** — Find functions with zero invocations in the last N days as cleanup candidates.

  _Reach for this to prune dead functions and shrink your attack surface._

  ```bash
  azure-functions-admin stale --days 90 --agent
  ```

## Command Reference

**apps** — Inspect Azure Function Apps (Microsoft.Web/sites where kind~functionapp)

- `azure-functions-admin-pp-cli apps get` — Get a single Function App
- `azure-functions-admin-pp-cli apps list` — List Function Apps in a subscription (filter kind~functionapp)

**functions** — List functions within a Function App

- `azure-functions-admin-pp-cli functions <subscriptionId> <resourceGroup> <name>` — List functions in a Function App

**plans** — List App Service / hosting plans (serverfarms)

- `azure-functions-admin-pp-cli plans <subscriptionId>` — List hosting plans (tier decode: Y1=Consumption, EP*=Premium, P*=Dedicated)

**settings** — Read Function App application settings

- `azure-functions-admin-pp-cli settings <subscriptionId> <resourceGroup> <name>` — List application settings (values are masked by the analysis layer)

**slots** — List deployment slots for a Function App

- `azure-functions-admin-pp-cli slots <subscriptionId> <resourceGroup> <name>` — List deployment slots

**subscriptions** — List Azure subscriptions reachable by the current credential

- `azure-functions-admin-pp-cli subscriptions` — List accessible subscriptions


### Finding the right command

When you know what you want to do but not which command does it, ask the CLI directly:

```bash
azure-functions-admin-pp-cli which "<capability in your own words>"
```

`which` resolves a natural-language capability query to the best matching command from this CLI's curated feature index. Exit code `0` means at least one match; exit code `2` means no confident match — fall back to `--help` or use a narrower query.

## Recipes

### Cold-start check before a plan decision

```bash
azure-functions-admin coldstart --app <app> --agent
```

Returns cold-start frequency, p50/p95 cold-start latency, and the projected always-ready cost so you can decide on Premium with numbers, not vibes.

### Audit a whole resource group for plan fit

```bash
azure-functions-admin plan-fit --resource-group <rg> --agent
```

One call ranks every app's ideal plan from its real invocation density and cold-start sensitivity.

### Find leaked secrets in app settings

```bash
azure-functions-admin secrets-audit --app <app> --agent
```

Flags settings holding raw secret values that should be @Microsoft.KeyVault references, plus unused keys.

### Trim a verbose response for an agent

```bash
azure-functions-admin apps list --agent --select value.name,value.location,value.kind,value.properties.state
```

App-list responses are large and deeply nested; --select with dotted paths returns only the fields an agent needs, saving context.

### Triage today's failures

```bash
azure-functions-admin failures --app <app> --since 24h --agent
```

Clusters the last day of invocation failures by function and exception type so you fix the biggest one first.

## Auth Setup

This CLI talks to Azure Resource Manager using a standard Azure credential, the same way the official tools do. The simplest setup for a newcomer:

1. Have an Azure subscription with at least one Function App.
2. Create a read-only service principal (run once, in the Azure Cloud Shell or after `az lo