Modules/businessdev.ALbuild.Apps/Private/Get-BcAzureSignToolArguments.ps1

function Get-BcAzureSignToolArguments {
    <#
    .SYNOPSIS
        Builds the AzureSignTool argument list for signing an .app file.
    .DESCRIPTION
        Internal, pure helper (no I/O) so the command construction is unit-testable. Produces the
        AzureSignTool 'sign' arguments for Key Vault certificate signing.
    #>

    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseSingularNouns', '',
        Justification = 'Returns a list of arguments; plural is intentional and the function is private.')]
    [CmdletBinding()]
    [OutputType([string[]])]
    param(
        [Parameter(Mandatory)] [string] $FilePath,
        [Parameter(Mandatory)] [string] $KeyVaultUrl,
        [Parameter(Mandatory)] [string] $TenantId,
        [Parameter(Mandatory)] [string] $ClientId,
        [Parameter(Mandatory)] [string] $ClientSecret,
        [Parameter(Mandatory)] [string] $CertificateName,
        [string] $TimestampUrl = 'http://timestamp.digicert.com',
        [string] $DigestAlgorithm = 'sha256'
    )

    return @(
        'sign'
        '-kvu', $KeyVaultUrl
        '-kvt', $TenantId
        '-kvi', $ClientId
        '-kvs', $ClientSecret
        '-kvc', $CertificateName
        '-tr', $TimestampUrl
        '-td', $DigestAlgorithm
        '-v'
        $FilePath
    )
}