Install
$ agentstack add skill-microsoft-power-platform-skills-export-solution ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
> Plugin check: Run node "${PLUGIN_ROOT}/scripts/check-version.js" — if it outputs a message, show it to the user before proceeding.
export-solution
Triggers an async Dataverse solution export, polls until complete, downloads the solution zip, and verifies it. Reads .solution-manifest.json to identify the solution; falls back to asking the user.
Prerequisites
- PAC CLI installed and authenticated
- Azure CLI installed and logged in
- Solution exists in the environment (run
setup-solutionfirst if needed)
Phases
Phase 0 — ALM plan gate
> plan-alm is the front door. When the user expresses an ALM intent (promote / ship / deploy / set up CI-CD / move to staging / push to prod), the orchestrator (/power-pages:plan-alm) should run first. This Phase 0 enforces that and is meant to fail closed when there's no plan, not to be a one-time check the user can dismiss forever.
Skip rule. If this skill was invoked as part of an active plan-alm orchestration, skip Phase 0 entirely and proceed to Phase 1. The gate helper exposes this via its inExecution block — pass through silently to Phase 1 when:
inExecution.status === "active"
The helper computes this from docs/.alm-plan-data.json — PLAN_STATUS === "In Execution" AND LAST_INVOCATION_AT within the last 60 minutes. check-alm-plan.js refreshes LAST_INVOCATION_AT automatically on every invocation that finds the plan in execution, so each in-chain skill keeps the chain alive for the next one — even multi-hour deploys (deploy-pipeline alone can take 60 min per stage) survive the window without the chain incorrectly de-classifying. Stalled chains (no heartbeat for > 60 min) reclassify as stale-heartbeat and Phase 0 gates fire normally so an abandoned plan doesn't silently bypass user confirmation.
When inExecution.status is anything other than "active" ("not-running", "stale-heartbeat", "no-plan"), run the Phase 0 gate flow below. Branch on the remaining helper fields:
Step 1 — Run the gate helper.
node "${PLUGIN_ROOT}/scripts/lib/check-alm-plan.js" \
--projectRoot "." \
--envUrl "{envUrl from .solution-manifest.json or pac env who, if available}" \
--token "{token, if Phase 1 already acquired one}" \
--solutionId "{solutionId from .solution-manifest.json, if available}"
The helper returns JSON with { exists, deferred, stale, staleness: { reason, detail }, generatedAt, planStatus, ... }. The freshness check requires env credentials + solutionId; without those the helper does an existence-only check.
Step 2 — Branch on the result.
| Result | Behavior | |---|---| | deferred: true | The user has explicitly deferred ALM for this project (.alm-deferred marker present). Pass through silently to Phase 1 — do not nag. | | exists: false | The user hasn't run plan-alm yet. See Step 3. | | exists: true, stale: false | Plan is current. Pass through silently to Phase 1. | | exists: true, stale: true (reason: solution-modified) | The solution changed after the plan was generated. See Step 4. |
Step 3 — No plan. Tell the user:
> "No ALM plan exists for this project. /power-pages:plan-alm builds one — it detects the project state, asks about your promotion strategy (PP Pipelines vs Manual export/import), and orchestrates the right skills (including this one) in the right order. Want me to run plan-alm now?"
> 🚦 Gate (intent · export-solution:0.no-plan): Fail-closed entry gate when check-alm-plan.js returns exists:false. Helper-script-backed.
AskUserQuestion:
| Question | Header | Options | |---|---|---| | Run /power-pages:plan-alm first? | ALM plan gate | Yes — run /power-pages:plan-alm now (Recommended), Continue without a plan (advanced — I know what I'm doing), Cancel |
- Yes (Recommended) → invoke
/power-pages:plan-alm. It builds the plan and returns —plan-almis a planner and does not deploy. This skill then re-runs the Phase 0 check (nowexists:true) and proceeds to Phase 1. - Continue without a plan → set
BYPASSED_PLAN_GATE = trueand proceed to Phase 1. - Cancel → exit cleanly.
Step 4 — Stale plan. Tell the user:
> "ALM plan exists from {generatedAt} but the source solution has been modified since (at {solution.modifiedon}). Components may have changed. Re-running plan-alm will refresh the analysis and the rendered HTML."
> 🚦 Gate (intent · export-solution:0.stale-plan): Fail-closed entry gate when check-alm-plan.js returns stale:true. Helper-script-backed.
AskUserQuestion:
| Question | Header | Options | |---|---|---| | Refresh the plan first? | ALM plan freshness | Refresh — re-run /power-pages:plan-alm (Recommended), Continue with the existing plan, Cancel |
- Refresh (Recommended) → invoke
/power-pages:plan-alm. After completion, re-run the Phase 0 helper once to confirm freshness; if still stale, surface the detail and proceed to Phase 1 anyway (don't infinite-loop). - Continue → set
STALE_PLAN_ACK = trueand proceed to Phase 1. - Cancel → exit cleanly.
Why this gate exists. Direct invocation of export-solution produces a zip without the orchestrator's pre-export completeness check. Users running this skill standalone often miss components that should have been added to the solution (cloud flows, env var values referenced by site settings, sample data references) and ship a zip that imports cleanly into staging but produces a broken site post-deploy. The pre-plan completeness check surfaces those gaps before any zip is built. The gate ensures plan-alm either ran (so completeness was verified and the export was scoped to the right solution lineage) or the user explicitly chose to bypass it.
Phase 1 — Verify Prerequisites
Create all tasks upfront at the start of this phase.
Tasks to create:
- "Verify prerequisites"
- "Identify solution"
- "Configure export"
- "Trigger async export"
- "Download solution zip"
- "Verify export"
- "Present summary"
Steps:
- Run
verify-alm-prerequisites.jswith--require-manifestto confirm PAC CLI auth, acquire a token, verify API access, and validate that.solution-manifest.jsonexists:
``bash node "${PLUGIN_ROOT}/scripts/lib/verify-alm-prerequisites.js" --require-manifest ` Capture output as JSON; extract .envUrl (store as envUrl) and .token (store as token). If the script exits non-zero, stop and explain what is missing (reference ${PLUGIN_ROOT}/references/dataverse-prerequisites.md`).
Phase 1.5 — Ground in current ALM documentation
> Reference: ${PLUGIN_ROOT}/references/alm-docs-grounding.md
Cap this step at ~30 seconds. If MCP search / fetch errors out, log a one-line note and continue — this skill must remain runnable offline.
- Run
microsoft_docs_searchwith the query:Power Pages solution export managed unmanaged ExportSolutionAsync ALM. - Fetch
https://learn.microsoft.com/en-us/power-platform/alm/solution-concepts-alm(and at most one sister page on managed vs unmanaged or solution layering) in parallel viamicrosoft_docs_fetch. - Extract a one-paragraph summary of what Microsoft Learn currently says about export semantics, managed vs unmanaged implications, and async export polling. Compare against
${PLUGIN_ROOT}/references/solution-api-patterns.mdand flag any divergence inExportSolutionAsync/DownloadSolutionExportDatasignatures. - Use the summary to inform Phase 2+ decisions. Do not silently change skill behavior — surface any divergence to the user as a soft warning before Phase 3.
Phase 2 — Identify Solution
> 🚦 Gate (plan · export-solution:2.identify): No .solution-manifest.json in project root — user must pick or paste a solution unique name before export proceeds. Fires only on the "not found" branch (step 3 below). > > Trigger: Phase 2 step 1 didn't find a manifest. > Why we ask: Auto-picking the wrong solution exports a managed zip that ships the wrong table/site/flow set to staging. > Cancel leaves: Nothing — no ExportSolutionAsync call yet.
- Look for
.solution-manifest.jsonin project root (usefindProjectRootorglob('**/.solution-manifest.json')) - If found: read
solution.uniqueName,solution.solutionId,environmentUrl
- Verify environment URLs match (warn if different — may be cross-environment export)
- If not found, use
AskUserQuestionto pick the solution:
- Query Dataverse for available unmanaged solutions and present them as options
- Free-text fallback ("Other") for pasting the unique name directly
- Confirm solution exists in environment:
`` GET {envUrl}/api/data/v9.2/solutions?$filter=uniquename eq '{solutionName}'&$select=solutionid,uniquename,friendlyname,version,ismanaged ``
- Present solution details and confirm with user.
Phase 2.5 — Pre-export Completeness Check
Before exporting, run the shared site-inventory helper to detect any components that exist on the site but are not in the solution. Catching this here avoids shipping an incomplete package to staging/prod.
node "${PLUGIN_ROOT}/scripts/lib/discover-site-components.js" \
--envUrl "{envUrl}" --token "{token}" \
--siteId "{websiteRecordId}" \
--publisherPrefix "{publisherPrefix from .solution-manifest.json}" \
--solutionId "{solutionId}" \
--projectRoot "."
Parse stdout and evaluate missing. Before doing anything else, capture the pre-sync state so a post-sync re-confirmation gate can show what changed:
PRE_SYNC_VERSION = solutionManifest.solution.version // from .solution-manifest.json read in Phase 2
PRE_SYNC_MISSING = { siteComponents, siteLanguages, cloudFlows, envVarDefinitions, customTables, ... } // from the discovery stdout above
Then:
- All
missing.*arrays empty → report "Solution contents match the site — no gaps detected." Proceed to Phase 3. - Any non-empty
missing.*array → present a concise summary:
> "The solution is missing {N} component(s) that exist on the site: > > - {X} site components (e.g. {first 3 names}, …) > - {Y} cloud flows > - {Z} environment variable definitions with your publisher prefix > - {W} custom tables"
> 🚦 Gate (progress · export-solution:2.5.completeness): Source solution incomplete vs live site. Sync first, export as-is (gap recorded), or abort.
Then ask via AskUserQuestion: > "How would you like to proceed? > 1. Run /power-pages:setup-solution in sync mode now — adopts missing components, bumps the solution version, then re-confirms with you before exporting (Recommended) > 2. Export as-is — ship what's currently in the solution; missing components won't travel > 3. Abort — I want to investigate before exporting"
- Option 1 — Sync first, then re-confirm before export:
- Invoke
/power-pages:setup-solution(auto-detects the existing manifest, enters sync mode, adopts missing components, bumps the version). Wait for completion. setup-solution's final refresh step writesLAST_SYNC_ATintodocs/.alm-plan-data.jsonso subsequentcheck-alm-plan.jscalls do NOT falsely flag the plan as stale just because the sync bumpedsolutions.modifiedonpastGENERATED_AT— the freshness reference becomesmax(GENERATED_AT, LAST_SYNC_AT). - Re-read
.solution-manifest.jsonand capturePOST_SYNC_VERSION = solutionManifest.solution.version. - Re-run the discovery helper. If any
missing.*remain non-empty, repeat the Phase 2.5 prompt above. - Otherwise compute
NEWLY_ADOPTEDas a per-category set difference betweenPRE_SYNC_MISSINGand the second discovery run'smissing.*(the items that disappeared are what setup-solution just adopted into the solution). Total count = sum of all category lengths.
> 🚦 Gate (progress · export-solution:2.5.post-sync): Post-sync re-confirm. Solution version bumped + components adopted — user inspects delta before export proceeds.
- Re-confirm with the user before proceeding to Phase 3 — the solution about to be exported is now different from what the user originally saw when they started the export. Use
AskUserQuestion:
> "Sync complete. > > {solutionUniqueName} is now v{POSTSYNCVERSION} (was v{PRESYNCVERSION}) with {NEWLY_ADOPTED.total} newly-adopted components: > - {first 3-5 names by category — prefer high-signal categories: cloud flows, server logic, env var definitions, then site components} > - {if more remain: + {N} more across {category list}} > > About to export this updated solution to a zip file. > > Continue with the export?"
| Question | Header | Options | |---|---|---| | Continue with the export? | Post-sync approval | Yes — export v{POSTSYNCVERSION} (Recommended), Pause — I want to review the new solution contents first, Cancel — abort the export |
- Yes → proceed to Phase 3 with the post-sync solution.
- Pause → exit export-solution cleanly with a short note ("Paused after sync. Re-run
/power-pages:export-solutionwhen you're ready to export v{POSTSYNCVERSION}.") so the user can inspect the synced manifest / Dataverse state and resume manually. Do not write any export artifacts — no export happened. Skip the skill-tracking call too. - Cancel → stop the skill. Same no-artifact / no-tracking rule applies.
- Option 2 — record the gap in the export manifest (see Phase 7 summary) so the user has an audit trail of what was intentionally left out.
- Option 3 — stop the skill.
> Why the post-sync gate exists: when sync mode runs mid-export, it produces a different solution version than the one the user had in mind when they invoked the skill. Re-confirming after sync gives the user an explicit chance to inspect the version bump and the list of newly-adopted components before the zip is produced and (typically) shipped onward via import-solution. The Phase 2.5 trigger is intentional; the post-sync re-confirmation is the safety on top of it. This mirrors the same gate in deploy-pipeline Phase 3.5 — same shape, same options, same audit-trail rules — so users see consistent behavior whether they take the PP Pipelines path or the Manual export/import path.
> Why Phase 2.5 exists in the first place: historically, components created after setup-solution (server logic from add-server-logic, flows from add-cloud-flow, env vars from configure-env-variables / setup-auth) were silently left out of the export zip and didn't travel to target environments. The ALM-aware-by-default principle in AGENTS.md requires this check at every gate where a solution leaves its source environment.
Phase 3 — Configure Export
> 🚦 Gate (consent · export-solution:3.export-type): Managed vs Unmanaged — irreversible for the produced zip. Managed cannot be edited in target; Unmanaged can. Mismatch with stage strategy ships the wrong artifact downstream.
Invoke AskUserQuestion immediately — do NOT describe this choice as chat text. The user must answer live before export proceeds.
| Question | Header | Options | |---|---|---| | How would you like to export this solution? Managed solutions cannot be edited in the target environment and support clean upgrade/delete cycles — recommended for staging and production. Unmanaged solutions can be edited in the target environment — use for dev-to-dev deployments. | Export Type | Managed — for staging/production (Recommended), Unmanaged — for development environments |
Use the answer to set "Managed": true or "Managed": false in the ExportSolutionAsync request body.
> 🚦 Gate (plan · export-solution:3.overwrite): Output directory and overwrite-vs-new-name decision for the produced zip. If an existing zip is detected at the target path, the prompt offers Overwrite / pick new name / cancel. >
…
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: microsoft
- Source: microsoft/power-platform-skills
- License: MIT
- Homepage: https://aka.ms/ppskills
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.