Add interactive hydration TUI

[jorgeasaurus]

Summary

• Add the zero-argument interactive TUI for hydration setup, including environment, operation, workload, platform, consent, verbose, and review prompts.
• Wire TUI selections into execution settings, scoped Graph permissions, browser auth, tenant discovery, and workload pre-flight checks.
• Refresh docs, generated help, release notes, and VHS demo media for the new flow.

Validation

• Focused TUI tests: 44 passed
• Explicit tmux TUI tests with IHK_RUN_TMUX_TESTS=1: 2 passed
• Full test suite: 986 passed, 2 skipped
• PSScriptAnalyzer: passed with 0 errors
• Build: passed
• git diff --check: passed
• vhs validate vhs/intune-hydration-tui.tape: passed
• vhs -q vhs/intune-hydration-tui.tape: passed and regenerated media/demo.gif

[Copilot]

Pull request overview

Introduces a zero-argument interactive TUI as the new default entry point for Invoke-IntuneHydration, wiring its selections into the existing execution engine via a centralized settings factory, tenantless interactive auth with tenant ID discovery from the access token, and import-scoped Graph permissions.

Changes:

• Adds a TUI workflow (32 new Private/Tui/ helpers) and orchestrator routing for InteractiveTui parameter set, including review/confirmation screens.
• Implements tenantless interactive browser auth (organizations + JWT tid extraction), scope-by-import resolution, and per-workload platform filtering propagated into pre-flight probes and app protection / OpenIntuneBaseline routing.
• Refreshes docs, generated PlatyPS help, changelog, module manifest (1.0.0), wrapper parameter parity, and VHS demo media.

Reviewed changes

Copilot reviewed 73 out of 76 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Public/Orchestration/Invoke-IntuneHydration.ps1	Adds InteractiveTui default set, TUI host check, review prompt, scope/tenant wiring
Public/Authentication/Connect-IntuneHydration.ps1	Optional TenantId, Scopes/ForceConsent params, tenantless interactive auth
Public/Authentication/Test-IntunePrerequisites.ps1	Adds AppProtectionPlatforms, BaselinePlatforms, RequiredScopes
Public/Baselines/Import-IntuneBaseline.ps1	Filters BYOD app protection templates and cache endpoints by platform
Public/Imports/Import-IntuneAppProtectionPolicy.ps1	Uses centralized Get-AppProtectionEndpointInfo per platform
Private/Configuration/New-HydrationExecutionSetting.ps1	New centralized execution settings factory
Private/Configuration/Resolve-HydrationExecutionSettings.ps1	TUI branch + delegation to factory; .Contains for force
Private/Configuration/Write-HydrationExecutionSettingsSummary.ps1	Uses Get-HydrationTenantDisplay
Private/Auth/* (new + modified)	OAuth authorize URI helper, JWT tenant extraction, scope/probe additions, browser flow returns tenant
Private/Imports/Get-AppProtectionEndpointInfo.ps1	New centralized app protection endpoint metadata
Private/Hydration/Get-HydrationTenantDisplay.ps1	New tenant display helper
Private/Tui/* (30+ new files)	TUI palette, gradient, header, panels, prompts, selection conversion, workflow
Invoke-IntuneHydration.ps1 (wrapper)	Default InteractiveTui + adds StaticGroups, MobileApps, CISBaselines, Platform
IntuneHydrationKit.psd1, CHANGELOG.md, README.md, docs/platyps/*.md	1.0.0 release notes, TUI docs
vhs/intune-hydration-tui.tape, vhs/README.md	New VHS demo source and rendering instructions
.vscode/tasks.json	macOS PATH override for pwsh tasks
Tests/**	New TUI/tmux tests + expanded coverage for scopes, prerequisites, browser auth, baseline filtering, app protection

[Copilot]

Pull request overview

Copilot reviewed 73 out of 77 changed files in this pull request and generated 1 comment.