@m8t-stack/cli 0.2.1 → 0.2.3

package/dist/cli.js

@@ -1109,7 +1109,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.1";
+var CLI_VERSION = "0.2.3";
 
 // src/lib/render-error.ts
 init_errors();
@@ -3135,7 +3135,7 @@ async function resolveFoundryProject(opts) {
     throw new LocalCliError({
       code: "FOUNDRY_PROJECT_ZERO",
       message: `No AIServices Foundry project found in subscription ${opts.subscriptionId}.`,
-      hint: "Switch subscription with 'az account set --subscription <id>' or pass --endpoint."
+      hint: "Create one with 'm8t foundry create --resource-group <rg> --location <region>', switch subscription with 'az account set --subscription <id>', or pass --endpoint."
     });
   }
   if (candidates.length === 1) return candidates[0];
@@ -3367,7 +3367,7 @@ import * as fs6 from "fs";
 // src/lib/persona-render.ts
 init_errors();
 import * as fs5 from "fs";
-function renderPersonaBody(personaPath, fillableFieldValues) {
+function renderPersonaBody(personaPath, fillableFieldValues, instanceName) {
   let raw;
   try {
     raw = fs5.readFileSync(personaPath, "utf8");
@@ -3392,7 +3392,18 @@ function renderPersonaBody(personaPath, fillableFieldValues) {
       hint: `Add these to fillableFieldValues in ~/.m8t-stack/foundry/<agent>.yaml, or re-deploy the agent via the architect to repopulate.`
     });
   }
-  return rendered.replace(/\s+$/, "");
+  const out = rendered.replace(/\s+$/, "");
+  return instanceName ? injectInstanceIdentity(out, instanceName) : out;
+}
+function injectInstanceIdentity(body, instanceName) {
+  const display = instanceName.charAt(0).toUpperCase() + instanceName.slice(1);
+  const line = `**You are ${display}.** Introduce yourself as ${display} on first contact.`;
+  const title = /^(#[^\n]*\n)/.exec(body);
+  return title ? `${title[0]}
+${line}
+${body.slice(title[0].length)}` : `${line}
+
+${body}`;
 }
 
 // src/lib/brain-loader-block.ts
@@ -3508,7 +3519,7 @@ async function linkBrain(args) {
     if (personaPath) {
       progress("Re-rendering persona body with brain loader\u2026");
       const resolved = personaPath.startsWith("/") ? personaPath : path5.join(args.repoRoot, personaPath);
-      base = renderPersonaBody(resolved, yaml?.fillableFieldValues ?? {});
+      base = renderPersonaBody(resolved, yaml?.fillableFieldValues ?? {}, args.agentName);
     } else {
       progress("No local persona yaml \u2014 basing instructions on the deployed agent\u2026");
       base = current.definition.instructions ?? "";
@@ -4230,7 +4241,7 @@ async function unlinkBrain(args) {
       }
       personaPath = path8.join(fs9.readFileSync(marker, "utf8").trim(), personaPath);
     }
-    strippedInstructions = renderPersonaBody(personaPath, yaml.fillableFieldValues ?? {});
+    strippedInstructions = renderPersonaBody(personaPath, yaml.fillableFieldValues ?? {}, args.agentName);
   } else {
     progress("No persona yaml \u2014 stripping the loader from the deployed instructions\u2026");
     strippedInstructions = stripBrainLoader(current.definition.instructions ?? "");
@@ -5319,7 +5330,10 @@ function parseImageRef(image) {
   const host = hostAndPath.slice(0, slash);
   const repo = hostAndPath.slice(slash + 1);
   const acrName = host.replace(/\.azurecr\.io$/i, "");
-  return { acrName, repo, tag: tag || "" };
+  return { host, acrName, repo, tag: tag || "" };
+}
+function isAcrHost(host) {
+  return /\.azurecr\.io$/i.test(host);
 }
 function acrScope(subscriptionId, projectAccountScope, acrName) {
   const rg = /\/resourceGroups\/([^/]+)\//.exec(projectAccountScope)?.[1] ?? "";
@@ -5334,36 +5348,40 @@ async function checkPreconditions(args) {
       hint: `Hosted agents need one of: ${HOSTED_AGENT_REGIONS.join(", ")}. Deploy against a project in a supported region.`
     });
   }
-  const { acrName, repo, tag } = parseImageRef(args.image);
-  const tagCheck = await imageTagExists(acrName, repo, tag);
-  if (tagCheck === "absent") {
-    throw new LocalCliError({
-      code: "IMAGE_TAG_NOT_FOUND",
-      message: `Image '${repo}:${tag}' was not found in ACR '${acrName}'.`,
-      hint: `Build + push it first: cd agents/coding-agent && docker buildx build --platform linux/amd64 -t ${acrName}.azurecr.io/${repo}:${tag} --push . (see workers.md).`
-    });
-  }
-  if (tagCheck === "unknown") {
-    warnings.push(`could not verify image '${repo}:${tag}' in ACR '${acrName}' (az acr check failed) \u2014 proceeding; a bad image surfaces as a failed version.`);
-  }
-  if (args.project.projectPrincipalId) {
-    const scope = acrScope(args.subscriptionId, args.project.accountScope, acrName);
-    const hasPull = await principalHasAcrPull({
-      credential: args.credential,
-      acrScope: scope,
-      principalId: args.project.projectPrincipalId
-    });
-    if (!hasPull) {
-      await grantAcrPull({
+  const { host, acrName, repo, tag } = parseImageRef(args.image);
+  if (isAcrHost(host)) {
+    const tagCheck = await imageTagExists(acrName, repo, tag);
+    if (tagCheck === "absent") {
+      throw new LocalCliError({
+        code: "IMAGE_TAG_NOT_FOUND",
+        message: `Image '${repo}:${tag}' was not found in ACR '${acrName}'.`,
+        hint: `Build + push it first: cd agents/coding-agent && docker buildx build --platform linux/amd64 -t ${acrName}.azurecr.io/${repo}:${tag} --push . (see workers.md).`
+      });
+    }
+    if (tagCheck === "unknown") {
+      warnings.push(`could not verify image '${repo}:${tag}' in ACR '${acrName}' (az acr check failed) \u2014 proceeding; a bad image surfaces as a failed version.`);
+    }
+    if (args.project.projectPrincipalId) {
+      const scope = acrScope(args.subscriptionId, args.project.accountScope, acrName);
+      const hasPull = await principalHasAcrPull({
         credential: args.credential,
-        subscriptionId: args.subscriptionId,
         acrScope: scope,
         principalId: args.project.projectPrincipalId
       });
-      warnings.push(`granted AcrPull to the project managed identity on '${acrName}' (was missing).`);
+      if (!hasPull) {
+        await grantAcrPull({
+          credential: args.credential,
+          subscriptionId: args.subscriptionId,
+          acrScope: scope,
+          principalId: args.project.projectPrincipalId
+        });
+        warnings.push(`granted AcrPull to the project managed identity on '${acrName}' (was missing).`);
+      }
+    } else {
+      warnings.push("could not resolve the project managed identity to verify AcrPull \u2014 ensure it can pull from the ACR.");
     }
   } else {
-    warnings.push("could not resolve the project managed identity to verify AcrPull \u2014 ensure it can pull from the ACR.");
+    warnings.push(`public image host '${host}' \u2014 skipping the ACR tag check and AcrPull grant (anonymous pull, no registry credentials needed).`);
   }
   const canAssign = await callerCanAssignRoles({
     credential: args.credential,
@@ -5522,6 +5540,9 @@ function usageModelName(usageName) {
   return usageName.split(".").slice(2).join(".");
 }
 var REASONING_USAGE_RE = /gpt-5|o[1-9]/i;
+function isReasoningModel(modelDeployment) {
+  return REASONING_USAGE_RE.test(modelDeployment);
+}
 function modelQuotaVerdict(usages, modelDeployment) {
   const token = modelDeployment.trim().toLowerCase();
   const matches = usages.filter((u) => usageModelName(u.name).toLowerCase() === token);
@@ -5539,16 +5560,16 @@ var SIZE_PRESETS = {
   medium: { cpu: "1", memory: "2Gi" },
   large: { cpu: "2", memory: "4Gi" }
 };
-var DEFAULT_ACR = "m8tacrxn42jrnx.azurecr.io";
+var DEFAULT_REGISTRY = "ghcr.io/m8t-run";
 var DEFAULT_IMAGE = "m8t-coding-agent";
-var DEFAULT_TAG = "v20260604-996b7ac";
+var DEFAULT_TAG = "v0.1.0";
 var DEFAULT_MODEL = "gpt-4.1-mini";
 var NAME_RE = /^[a-z0-9-]+$/;
 var CoderDeployCommand = class extends M8tCommand {
   static paths = [["coder", "deploy"]];
   static usage = Command26.Usage({
     description: "Deploy the curated coding agent as a hosted Foundry worker.",
-    details: "Creates a hosted agent version from the ACR image, tags it as an m8t worker (kind: hosted + persona), grants its identity the Foundry User role, and polls to active. The image must already be pushed (see workers.md). Re-running creates a new version (idempotent).",
+    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-run/m8t-coding-agent, pulled anonymously \u2014 no local build needed), tags it as an m8t worker (kind: hosted + persona), grants its identity the Foundry User role, and polls to active. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Re-running creates a new version (idempotent).",
     examples: [
       ["Deploy a coder with defaults", "$0 coder deploy my-coder"],
       ["Larger sandbox + a custom model", "$0 coder deploy my-coder --size large --model-deployment gpt-4.1"],
@@ -5603,7 +5624,7 @@ var CoderDeployCommand = class extends M8tCommand {
     }
     const persona = this.persona ?? "coding-agent";
     const imageInput = this.image ?? DEFAULT_IMAGE;
-    const repoRef = imageInput.includes("/") ? imageInput : `${DEFAULT_ACR}/${imageInput}`;
+    const repoRef = imageInput.includes("/") ? imageInput : `${DEFAULT_REGISTRY}/${imageInput}`;
     const image = `${repoRef}:${this.imageTag ?? DEFAULT_TAG}`;
     const mode = resolveOutputMode(
       this.output,
@@ -5843,21 +5864,66 @@ import { Command as Command28, Option as Option26 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential14 } from "@azure/identity";
 init_errors();
 init_rbac();
+
+// src/lib/acs-provision.ts
+var MANAGED_DOMAIN = "AzureManagedDomain";
+async function provisionAcsEmail(args) {
+  const { client, subscriptionId, resourceGroup, name, dataLocation, onProgress } = args;
+  const acsName = `acs-${name}`;
+  const emailName = `${name}-email`;
+  onProgress?.(`creating ACS resource ${acsName}\u2026`);
+  const acs = await client.communicationServices.beginCreateOrUpdateAndWait(
+    resourceGroup,
+    acsName,
+    { location: "global", dataLocation }
+  );
+  onProgress?.(`creating Email Communication Service ${emailName}\u2026`);
+  await client.emailServices.beginCreateOrUpdateAndWait(resourceGroup, emailName, {
+    location: "global",
+    dataLocation
+  });
+  onProgress?.("provisioning the Azure-managed domain\u2026");
+  const domain = await client.domains.beginCreateOrUpdateAndWait(
+    resourceGroup,
+    emailName,
+    MANAGED_DOMAIN,
+    { location: "global", domainManagement: "AzureManaged" }
+  );
+  const domainResourceId = `/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.Communication/emailServices/${emailName}/domains/${MANAGED_DOMAIN}`;
+  onProgress?.("linking the domain to the ACS resource\u2026");
+  await client.communicationServices.beginCreateOrUpdateAndWait(resourceGroup, acsName, {
+    location: "global",
+    dataLocation,
+    linkedDomains: [domainResourceId]
+  });
+  const hostName = acs.hostName ?? `${acsName}.communication.azure.com`;
+  const fromSenderDomain = domain.fromSenderDomain;
+  if (!fromSenderDomain) {
+    throw new Error("ACS managed domain did not report a fromSenderDomain");
+  }
+  return {
+    endpoint: `https://${hostName}/`,
+    sender: `DoNotReply@${fromSenderDomain}`
+  };
+}
+
+// src/commands/azure-exec/deploy.ts
+import { CommunicationServiceManagementClient } from "@azure/arm-communication";
 var SIZE_PRESETS2 = {
   small: { cpu: "0.5", memory: "1Gi" },
   medium: { cpu: "1", memory: "2Gi" },
   large: { cpu: "2", memory: "4Gi" }
 };
-var DEFAULT_ACR2 = "m8tacrxn42jrnx.azurecr.io";
+var DEFAULT_REGISTRY2 = "ghcr.io/m8t-run";
 var DEFAULT_IMAGE2 = "m8t-azure-executor";
-var DEFAULT_TAG2 = "dev";
+var DEFAULT_TAG2 = "v0.1.0";
 var DEFAULT_MODEL2 = "gpt-5-mini";
 var NAME_RE2 = /^[a-z0-9-]+$/;
 var AzureExecDeployCommand = class extends M8tCommand {
   static paths = [["azure-exec", "deploy"]];
   static usage = Command28.Usage({
     description: "Deploy the Azure executor as a hosted Foundry worker (az CLI + tiered ops).",
-    details: "Creates a hosted agent version from the executor image, grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. The image must already be pushed. Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops).",
+    details: "Creates a hosted agent version from a container image (defaults to the public GHCR image ghcr.io/m8t-run/m8t-azure-executor, pulled anonymously \u2014 no local build needed), grants its identity Foundry User + Contributor (at --scope) + Key Vault Secrets User (brain KV), polls to active, and a2a-enables it as a target. Override with --image/--image-tag for a bring-your-own-registry image (e.g. a private ACR ref, which must be pushed first). Contributor scope is REQUIRED \u2014 pass --scope or --resource-group. Pass --grant-access-admin to additionally grant User Access Administrator (enables human-approved Tier-2 role/delete ops).",
     examples: [
       [
         "Deploy scoped to a resource group",
@@ -5881,6 +5947,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
   output = Option26.String("--output");
   skipQuotaCheck = Option26.Boolean("--skip-quota-check", false);
   grantAccessAdmin = Option26.Boolean("--grant-access-admin", false);
+  enableEmail = Option26.Boolean("--enable-email", false);
   async executeCommand() {
     if (!NAME_RE2.test(this.name)) {
       throw new LocalCliError({
@@ -5925,8 +5992,15 @@ var AzureExecDeployCommand = class extends M8tCommand {
         });
       }
     }
+    if (this.enableEmail === true && (typeof this.resourceGroup !== "string" || this.resourceGroup.length === 0)) {
+      throw new LocalCliError({
+        code: "USAGE",
+        message: "--enable-email requires --resource-group (the ACS resource lands in the Contributor-granted RG so the executor's identity can send).",
+        hint: "Pass --resource-group <rg> (the same scope the executor is granted Contributor on)."
+      });
+    }
     const imageInput = this.image ?? DEFAULT_IMAGE2;
-    const repoRef = imageInput.includes("/") ? imageInput : `${DEFAULT_ACR2}/${imageInput}`;
+    const repoRef = imageInput.includes("/") ? imageInput : `${DEFAULT_REGISTRY2}/${imageInput}`;
     const image = `${repoRef}:${this.imageTag ?? DEFAULT_TAG2}`;
     const project = await resolveFoundryProject({
       credential: credential2,
@@ -5955,11 +6029,27 @@ var AzureExecDeployCommand = class extends M8tCommand {
       privateKeyPem,
       write: (s) => this.context.stdout.write(s)
     });
+    let acsEnv = {};
+    if (this.enableEmail === true && typeof this.resourceGroup === "string") {
+      const resourceGroup = this.resourceGroup;
+      onProgress?.("provisioning ACS Email (managed domain)\u2026");
+      const acsClient = new CommunicationServiceManagementClient(credential2, subscriptionId);
+      const acs = await provisionAcsEmail({
+        client: acsClient,
+        subscriptionId,
+        resourceGroup,
+        name: this.name,
+        dataLocation: "United States",
+        onProgress
+      });
+      acsEnv = { M8T_ACS_ENDPOINT: acs.endpoint, M8T_ACS_SENDER: acs.sender };
+    }
     const env = {
       MODEL_DEPLOYMENT_NAME: this.modelDeployment ?? DEFAULT_MODEL2,
       REASONING_EFFORT: "low",
       GITHUB_APP_INSTALLATION_ID: installationId,
-      AZURE_KEYVAULT_URI: kvUri
+      AZURE_KEYVAULT_URI: kvUri,
+      ...acsEnv
     };
     for (const pair of this.env ?? []) {
       const eq = pair.indexOf("=");
@@ -9570,6 +9660,13 @@ function renderDigestMarkdown(digest, opts) {
       case "codified":
         push("## Codified", `- \`${e.slug}\`${e.pr ? ` \u2014 PR ${e.pr}` : ""}${e.rejected ? ` \u2014 rejected: ${e.rejected}` : ""}`);
         break;
+      case "promotion": {
+        const icon = e.outcome === "auto-merged" ? "\u2705" : e.outcome === "rejected" ? "\u274C" : "\u{1F6D1}";
+        const scoreStr = typeof e.score === "number" ? `, score ${String(e.score)}` : "";
+        const tags = e.defaulted ? ` [SAFETY explicit: ${e.defaulted.safety ? "no" : "yes"}, COLLISION explicit: ${e.defaulted.collision ? "no" : "yes"}]` : "";
+        push("## Promotion", `- ${icon} \`${e.slug}\` \u2014 **${e.outcome.toUpperCase()}** (${e.decision}/${e.judgeStatus}${scoreStr}, origin: ${e.origin})${tags}${e.pr ? ` \u2014 PR ${e.pr}` : ""} \u2014 ${e.reason}`);
+        break;
+      }
       default: {
         const unknown = e;
         const detail = unknown.detail ?? unknown.path ?? "";
@@ -9591,6 +9688,7 @@ function renderDigestMarkdown(digest, opts) {
     "## Health",
     "## Archived",
     "## Codified",
+    "## Promotion",
     "## Other"
   ];
   for (const header of order) {
@@ -10389,6 +10487,9 @@ var ZERO_WIDTH_RE = new RegExp("\u200B|\u200C|\u200D|\uFEFF", "g");
 // ../../packages/brain/engine/dist/esm/librarian/janitor/frontmatter.js
 import { parse as parseYaml9, stringify as stringifyYaml5 } from "yaml";
 
+// ../../packages/brain/engine/dist/esm/librarian/config.js
+import { parse as parseYaml10 } from "yaml";
+
 // src/lib/dream-discovery.ts
 init_http();
 init_errors();
@@ -10864,6 +10965,324 @@ function defaultDeps(overrides) {
   return deps;
 }
 
+// src/commands/foundry/create.ts
+import { Command as Command41, Option as Option39 } from "clipanion";
+
+// src/lib/foundry-create.ts
+init_errors();
+import { createHash as createHash3 } from "crypto";
+function rethrowIfAzUnavailable(e) {
+  if (e instanceof LocalCliError && (e.code === "AUTH_NOT_SIGNED_IN" || e.code === "AZ_NOT_INSTALLED")) {
+    throw e;
+  }
+}
+function deriveAccountName(subscriptionId) {
+  const h = createHash3("sha256").update(subscriptionId).digest("hex").slice(0, 12);
+  return `m8t${h}`;
+}
+function assertHostedRegion(location) {
+  if (isHostedRegionSupported(location)) return;
+  throw new LocalCliError({
+    code: "FOUNDRY_REGION_NOT_ELIGIBLE",
+    message: `Region '${location}' is not eligible for hosted Foundry agents.`,
+    hint: `Use a hosted-eligible region, e.g. ${HOSTED_AGENT_REGIONS.slice(0, 4).join(", ")}.`
+  });
+}
+async function checkModelQuota2(region, model) {
+  const usages = await listModelQuota(region);
+  const { verdict, quotad } = modelQuotaVerdict(usages, model);
+  if (verdict === "no_quota") {
+    throw new LocalCliError({
+      code: "FOUNDRY_MODEL_NO_QUOTA",
+      message: `Model '${model}' has 0 quota in ${region}.`,
+      hint: `Pick a quota'd model (--model ${quotad[0] ?? "gpt-4.1-mini"}) or request quota in ${region}.`
+    });
+  }
+  return verdict === "ok" ? "ok" : "unknown";
+}
+async function ensureAccount(args) {
+  let existing = null;
+  try {
+    existing = JSON.parse(
+      await runAz(["cognitiveservices", "account", "show", "--name", args.account, "--resource-group", args.resourceGroup, "--output", "json"])
+    );
+  } catch (e) {
+    rethrowIfAzUnavailable(e);
+    existing = null;
+  }
+  if (existing?.properties?.customSubDomainName && existing.properties.allowProjectManagement) {
+    return { created: false, accountScope: existing.id ?? "", subdomain: existing.properties.customSubDomainName };
+  }
+  let createdOut;
+  try {
+    createdOut = JSON.parse(
+      await runAz([
+        "cognitiveservices",
+        "account",
+        "create",
+        "--name",
+        args.account,
+        "--resource-group",
+        args.resourceGroup,
+        "--location",
+        args.location,
+        "--kind",
+        "AIServices",
+        "--sku",
+        "S0",
+        "--custom-domain",
+        args.account,
+        "--allow-project-management",
+        "--yes",
+        "--output",
+        "json"
+      ])
+    );
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (/subdomain|custom.?domain|already in use|already exists/i.test(msg)) {
+      throw new LocalCliError({
+        code: "FOUNDRY_ACCOUNT_SUBDOMAIN_CONFLICT",
+        message: `The custom subdomain '${args.account}' is unavailable (globally taken).`,
+        hint: "Pass --account <globally-unique-name>."
+      });
+    }
+    throw e;
+  }
+  if (!createdOut.properties?.customSubDomainName || !createdOut.properties.allowProjectManagement) {
+    throw new LocalCliError({
+      code: "FOUNDRY_ACCOUNT_NOT_CONFORMING",
+      message: `Account '${args.account}' exists but lacks a custom subdomain or project management, and could not be converged.`,
+      hint: "Use a fresh --account name or resource group."
+    });
+  }
+  return { created: !existing, accountScope: createdOut.id ?? "", subdomain: createdOut.properties.customSubDomainName };
+}
+function readProjectEndpoint(show) {
+  const ep = show.properties?.endpoints?.["AI Foundry API"];
+  if (!ep) {
+    throw new LocalCliError({
+      code: "FOUNDRY_PROJECT_NO_ENDPOINT",
+      message: "Project created but no 'AI Foundry API' endpoint was returned.",
+      hint: "Re-run after a moment, or check 'az cognitiveservices account project show'."
+    });
+  }
+  return ep;
+}
+var projectShowArgs = (a) => [
+  "cognitiveservices",
+  "account",
+  "project",
+  "show",
+  "--name",
+  a.account,
+  "--resource-group",
+  a.resourceGroup,
+  "--project-name",
+  a.project,
+  "--output",
+  "json"
+];
+async function ensureProject(args) {
+  let show = null;
+  try {
+    show = JSON.parse(await runAz(projectShowArgs(args)));
+  } catch (e) {
+    rethrowIfAzUnavailable(e);
+    show = null;
+  }
+  if (show) {
+    return { created: false, endpoint: readProjectEndpoint(show), projectPrincipalId: show.identity?.principalId ?? null };
+  }
+  await runAz([
+    "cognitiveservices",
+    "account",
+    "project",
+    "create",
+    "--name",
+    args.account,
+    "--resource-group",
+    args.resourceGroup,
+    "--project-name",
+    args.project,
+    "--location",
+    args.location,
+    "--output",
+    "json"
+  ]);
+  const created = JSON.parse(await runAz(projectShowArgs(args)));
+  return { created: true, endpoint: readProjectEndpoint(created), projectPrincipalId: created.identity?.principalId ?? null };
+}
+async function ensureDeployment(args) {
+  let current = null;
+  try {
+    const show = JSON.parse(
+      await runAz(["cognitiveservices", "account", "deployment", "show", "--name", args.account, "--resource-group", args.resourceGroup, "--deployment-name", args.model, "--output", "json"])
+    );
+    current = show.sku?.capacity ?? null;
+  } catch (e) {
+    rethrowIfAzUnavailable(e);
+    current = null;
+  }
+  if (current !== null && current >= args.capacity) return { created: false };
+  if (current !== null && current < args.capacity) args.onProgress?.(`scaling ${args.model} ${String(current)}\u2192${String(args.capacity)}`);
+  await runAz([
+    "cognitiveservices",
+    "account",
+    "deployment",
+    "create",
+    "--name",
+    args.account,
+    "--resource-group",
+    args.resourceGroup,
+    "--deployment-name",
+    args.model,
+    "--model-name",
+    args.model,
+    "--model-version",
+    args.modelVersion,
+    "--model-format",
+    "OpenAI",
+    "--sku-name",
+    "GlobalStandard",
+    "--sku-capacity",
+    String(args.capacity),
+    "--output",
+    "json"
+  ]);
+  return { created: current === null };
+}
+var REASONING_MIN_CAPACITY = 250;
+async function createFoundryProject(args) {
+  assertHostedRegion(args.location);
+  if (!args.skipQuotaCheck) {
+    const verdict = await checkModelQuota2(args.location, args.model);
+    if (verdict === "unknown") {
+      args.onProgress?.(`could not confirm quota for '${args.model}' in ${args.location}; proceeding`);
+    }
+  }
+  if (isReasoningModel(args.model) && args.capacity < REASONING_MIN_CAPACITY) {
+    args.onProgress?.(`note: reasoning model '${args.model}' at capacity ${String(args.capacity)} may 429; consider --capacity ${String(REASONING_MIN_CAPACITY)}`);
+  }
+  args.onProgress?.(`ensuring Foundry account ${args.account}\u2026`);
+  const acct = await ensureAccount({ account: args.account, resourceGroup: args.resourceGroup, location: args.location });
+  args.onProgress?.(`ensuring project ${args.project}\u2026`);
+  const proj = await ensureProject({ account: args.account, resourceGroup: args.resourceGroup, project: args.project, location: args.location });
+  args.onProgress?.(`ensuring model deployment ${args.model} (capacity ${String(args.capacity)})\u2026`);
+  const dep = await ensureDeployment({
+    account: args.account,
+    resourceGroup: args.resourceGroup,
+    model: args.model,
+    modelVersion: args.modelVersion,
+    capacity: args.capacity,
+    onProgress: args.onProgress
+  });
+  return {
+    endpoint: proj.endpoint,
+    accountName: args.account,
+    accountScope: acct.accountScope,
+    projectName: args.project,
+    region: args.location,
+    projectPrincipalId: proj.projectPrincipalId,
+    model: args.model,
+    capacity: args.capacity,
+    created: { account: acct.created, project: proj.created, deployment: dep.created }
+  };
+}
+
+// src/commands/foundry/create.ts
+init_errors();
+var FoundryCreateCommand = class extends M8tCommand {
+  static paths = [["foundry", "create"]];
+  static usage = Command41.Usage({
+    description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
+    details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
+    examples: [
+      ["Create from zero in a resource group", "$0 foundry create --resource-group rg-m8t-stack --location eastus2"],
+      ["Pick names + model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --account myfoundry --project m8t --model gpt-4.1-mini"],
+      ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
+    ]
+  });
+  resourceGroup = Option39.String("--resource-group");
+  location = Option39.String("--location");
+  account = Option39.String("--account");
+  project = Option39.String("--project", "m8t");
+  model = Option39.String("--model", "gpt-4.1-mini");
+  modelVersion = Option39.String("--model-version", "2025-04-14");
+  capacity = Option39.String("--capacity", "50");
+  subscription = Option39.String("--subscription");
+  skipQuotaCheck = Option39.Boolean("--skip-quota-check", false);
+  output = Option39.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(
+      this.output,
+      this.context.stdout
+    );
+    const resourceGroup = typeof this.resourceGroup === "string" ? this.resourceGroup : void 0;
+    const location = typeof this.location === "string" ? this.location : void 0;
+    if (!resourceGroup) {
+      throw new LocalCliError({ code: "USAGE", message: "--resource-group is required.", hint: "Example: m8t foundry create --resource-group rg-m8t-stack --location eastus2" });
+    }
+    if (!location) {
+      throw new LocalCliError({ code: "USAGE", message: "--location is required.", hint: "Example: m8t foundry create --resource-group rg-m8t-stack --location eastus2" });
+    }
+    const subscriptionOpt = typeof this.subscription === "string" ? this.subscription : void 0;
+    if (subscriptionOpt) await runAz(["account", "set", "--subscription", subscriptionOpt]);
+    const account = await getAzAccount();
+    const subscriptionId = subscriptionOpt ?? account.subscriptionId;
+    const accountName = typeof this.account === "string" ? this.account : deriveAccountName(subscriptionId);
+    const project = typeof this.project === "string" ? this.project : "m8t";
+    const model = typeof this.model === "string" ? this.model : "gpt-4.1-mini";
+    const modelVersion = typeof this.modelVersion === "string" ? this.modelVersion : "2025-04-14";
+    const capacity = typeof this.capacity === "string" ? Number(this.capacity) : 50;
+    const onProgress = mode === "pretty" ? (m) => this.context.stderr.write(`  ${colors.dim(m)}
+`) : void 0;
+    const result = await createFoundryProject({
+      resourceGroup,
+      location,
+      account: accountName,
+      project,
+      model,
+      modelVersion,
+      capacity,
+      // `=== true`: clipanion's Option descriptor is truthy until argv parse, so a
+      // bare check would force skipQuotaCheck on under test construction.
+      skipQuotaCheck: this.skipQuotaCheck === true,
+      onProgress
+    });
+    if (mode === "json") {
+      this.context.stdout.write(
+        renderJson({
+          endpoint: result.endpoint,
+          accountName: result.accountName,
+          accountResourceId: result.accountScope,
+          projectName: result.projectName,
+          region: result.region,
+          model: result.model,
+          capacity: result.capacity,
+          created: result.created
+        }) + "\n"
+      );
+      return 0;
+    }
+    this.context.stdout.write(
+      renderKeyValueBlock([
+        { key: "endpoint", value: result.endpoint },
+        { key: "account", value: result.accountName },
+        { key: "project", value: result.projectName },
+        { key: "region", value: result.region },
+        { key: "model", value: `${result.model} (capacity ${String(result.capacity)})` }
+      ]) + "\n"
+    );
+    const made = Object.entries(result.created).filter(([, v]) => v).map(([k]) => k);
+    this.context.stdout.write(colors.dim(`created: ${made.length ? made.join(", ") : "nothing (all present)"}
+`));
+    this.context.stdout.write(colors.dim(`next: 'm8t deploy --foundry-endpoint ${result.endpoint}' to deploy the gateway.
+`));
+    return 0;
+  }
+};
+
 // src/cli.ts
 var cli = new Cli({
   binaryName: "m8t",
@@ -10910,6 +11329,7 @@ cli.register(A2aDisableCommand);
 cli.register(EvalSkillCommand);
 cli.register(EvalExamCommand);
 cli.register(DreamRunCommand);
+cli.register(FoundryCreateCommand);
 async function main() {
   try {
     return await cli.run(process.argv.slice(2));