@m8t-stack/cli 0.2.105 → 0.2.106

package/dist/cli.js

@@ -1454,7 +1454,7 @@ function installFoundryDnsShim() {
 }
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.105";
+var CLI_VERSION = "0.2.106";
 
 // src/lib/render-error.ts
 init_errors();
@@ -20286,6 +20286,59 @@ async function makeSharedKeyClient(opts) {
   if (!key2) return null;
   return new TableClient(opts.tableEndpoint, TABLE, new AzureNamedKeyCredential(opts.accountName, key2));
 }
+async function makeSharedKeyTransactionClient(opts) {
+  return await makeSharedKeyClient(opts);
+}
+async function openMetadataTransactionClient(opts) {
+  const discover = opts.discoverImpl ?? discoverStampStorage;
+  const makeAad = opts.aadClientImpl ?? ((endpoint, credential2) => new TableClient(endpoint, TABLE, credential2));
+  const makeShared = opts.sharedClientImpl ?? makeSharedKeyTransactionClient;
+  const nap = opts.sleepImpl ?? sleep2;
+  const storage = await discover({ credential: opts.credential, subscriptionId: opts.subscriptionId, resourceGroup: opts.resourceGroup });
+  const probe = async (client) => {
+    try {
+      await client.getEntity("system", "platform");
+      return "ok";
+    } catch (e) {
+      if (is404(e)) return "ok";
+      if (is403(e)) return "forbidden";
+      throw e;
+    }
+  };
+  const aad = makeAad(storage.tableEndpoint, opts.credential);
+  if (await probe(aad) === "ok") return aad;
+  opts.onProgress?.(`opening the ${opts.label} with the account key \u2014 your identity lacks the Storage Table data role.`);
+  const shared = await makeShared(storage);
+  if (shared) {
+    if (await probe(shared) === "ok") return shared;
+  }
+  opts.onProgress?.("shared-key access is disabled \u2014 granting Storage Table Data Contributor to your identity (one-time)\u2026");
+  try {
+    const oid = await getCallerObjectId();
+    await grantStorageTableDataContributor({
+      credential: opts.credential,
+      subscriptionId: opts.subscriptionId,
+      scope: storage.accountResourceId,
+      principalId: oid
+    });
+  } catch (e) {
+    throw new LocalCliError({
+      code: opts.errorCode,
+      message: `Cannot open the ${opts.label}: AAD lacks the Storage Table data role, shared-key access is disabled, and self-granting the role failed.`,
+      hint: "Grant yourself 'Storage Table Data Contributor' on the storage account and retry.",
+      cause: e
+    });
+  }
+  for (let i = 0; i < 6; i += 1) {
+    await nap(1e4);
+    if (await probe(aad) === "ok") return aad;
+  }
+  throw new LocalCliError({
+    code: opts.errorCode,
+    message: `Cannot open the ${opts.label}: the granted Storage Table data role has not propagated yet.`,
+    hint: opts.retryHint
+  });
+}
 async function upsertMetadataEntity(opts) {
   const discover = opts.discoverImpl ?? discoverStampStorage;
   const makeAad = opts.aadClientImpl ?? ((endpoint, credential2) => new TableClient(endpoint, TABLE, credential2));
@@ -21421,6 +21474,414 @@ function voiceSecretParam(read, gatewayName) {
   };
 }
 
+// src/lib/gateway-adoption.ts
+init_errors();
+
+// src/lib/apply-request-store.ts
+import { TableClient as TableClient3 } from "@azure/data-tables";
+async function openApplyTable(opts) {
+  const { tableEndpoint } = await discoverStampStorage(opts);
+  return new TableClient3(tableEndpoint, "Metadata", opts.credential);
+}
+function hasStatus(e, n) {
+  return e.statusCode === n;
+}
+async function readApplyRequest(client) {
+  try {
+    const row = await client.getEntity(APPLY_REQUEST_PK, APPLY_REQUEST_RK);
+    return { ...entityToApplyRequest(row), etag: row.etag };
+  } catch (e) {
+    if (hasStatus(e, 404)) return null;
+    throw e;
+  }
+}
+async function claimApplyRequest(client, executionId, nowIso, leaseMs) {
+  const cur = await readApplyRequest(client);
+  if (!cur) return null;
+  const leaseExpired = isInFlight(cur.status) && cur.leaseUntil !== null && Date.parse(cur.leaseUntil) < Date.parse(nowIso);
+  const claimable = cur.status === "pending" || cur.status === "awaiting-engine-update" || leaseExpired;
+  if (!claimable) return null;
+  const nowMs = Date.parse(nowIso);
+  const leaseUntil = new Date((Number.isNaN(nowMs) ? Date.now() : nowMs) + leaseMs).toISOString();
+  if (leaseExpired && cur.attempt >= MAX_LEASE_TAKEOVERS) {
+    const held = {
+      ...cur,
+      status: "held",
+      breaker: "held",
+      result: {
+        appliedVersion: cur.result?.appliedVersion ?? null,
+        error: `the converge was abandoned mid-apply ${(cur.attempt + 1).toString()} times (last owner ${cur.claimedBy ?? "(unknown)"}, phase "${cur.phase ?? "(none)"}"); the updater stopped retrying to avoid re-rolling infra behind a converge that cannot finish`
+      },
+      updatedAt: nowIso
+    };
+    try {
+      await client.updateEntity({ ...applyRequestToEntity(held), etag: cur.etag }, "Merge", { etag: cur.etag });
+    } catch (e) {
+      if (!hasStatus(e, 412)) throw e;
+    }
+    return null;
+  }
+  const claimed = {
+    ...cur,
+    status: "claimed",
+    claimedBy: executionId,
+    leaseUntil,
+    ...leaseExpired ? { attempt: cur.attempt + 1 } : {},
+    updatedAt: nowIso
+  };
+  try {
+    await client.updateEntity({ ...applyRequestToEntity(claimed), etag: cur.etag }, "Merge", { etag: cur.etag });
+    return claimed;
+  } catch (e) {
+    if (hasStatus(e, 412)) return null;
+    throw e;
+  }
+}
+async function patchApplyRequest(client, mutate) {
+  const cur = await readApplyRequest(client);
+  if (!cur) return;
+  const next = mutate(cur);
+  await client.updateEntity({ ...applyRequestToEntity(next), etag: cur.etag }, "Merge", { etag: cur.etag });
+}
+
+// src/lib/gateway-adoption.ts
+function lowerId(v) {
+  return v.replace(/\/$/, "").toLowerCase();
+}
+function recordOfStrings(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return {};
+  const out = {};
+  for (const [k, value] of Object.entries(v)) if (typeof value === "string") out[k] = value;
+  return out;
+}
+function parseLiveGatewayDeployment(raw) {
+  const w = raw ?? {};
+  const containersRaw = w.properties?.template?.containers;
+  const containers = Array.isArray(containersRaw) ? containersRaw : [];
+  const gateway = containers.find((c) => c.name === "gateway");
+  const uas = w.identity?.userAssignedIdentities;
+  const userAssignedIdentityIds = uas && typeof uas === "object" && !Array.isArray(uas) ? Object.keys(uas) : [];
+  const registriesRaw = w.properties?.configuration?.registries;
+  const regs = Array.isArray(registriesRaw) ? registriesRaw : [];
+  return {
+    name: typeof w.name === "string" ? w.name : "",
+    tags: recordOfStrings(w.tags),
+    image: typeof gateway?.image === "string" ? gateway.image : "",
+    userAssignedIdentityIds,
+    registries: regs.map((r) => {
+      const x = r ?? {};
+      return {
+        server: typeof x.server === "string" ? x.server : "",
+        identity: typeof x.identity === "string" ? x.identity : "",
+        username: typeof x.username === "string" ? x.username : "",
+        passwordSecretRef: typeof x.passwordSecretRef === "string" ? x.passwordSecretRef : ""
+      };
+    }),
+    provisioningState: typeof w.properties?.provisioningState === "string" ? w.properties.provisioningState : "",
+    latestRevisionName: typeof w.properties?.latestRevisionName === "string" ? w.properties.latestRevisionName : "",
+    latestReadyRevisionName: typeof w.properties?.latestReadyRevisionName === "string" ? w.properties.latestReadyRevisionName : ""
+  };
+}
+function legacyGatewayTopologyError(live, gatewayResourceId, expectedSubscriptionId) {
+  const { subscriptionId, resourceGroup, name } = parseContainerAppResourceId(gatewayResourceId);
+  if (expectedSubscriptionId && subscriptionId.toLowerCase() !== expectedSubscriptionId.toLowerCase()) return "gateway subscription does not match";
+  const prefix = "m8t-gateway-";
+  if (!name.startsWith(prefix) || name.length === prefix.length || live.name !== name) return "gateway name is not the generated m8t name";
+  const suffix = name.slice(prefix.length);
+  if (live.tags.managedBy !== "m8t" || live.tags.m8t !== "gateway") return "gateway ownership tags do not match";
+  const parsed = parseImageRef2(live.image);
+  const parts = parsed.repo.split("/");
+  const host = parts.shift() ?? "";
+  const repo = parts.join("/");
+  if (!host.endsWith(".azurecr.io") || repo !== "m8t-web" || !parsed.tag || !/^v\d{8}-[0-9a-f]{7,40}$/.test(parsed.tag)) {
+    return "image is not the legacy m8t ACR image shape";
+  }
+  const expectedIdentity = `/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/m8t-acrpull-${suffix}`;
+  if (live.userAssignedIdentityIds.length !== 1 || lowerId(live.userAssignedIdentityIds[0]) !== lowerId(expectedIdentity)) {
+    return "gateway does not have exactly the generated ACR pull identity";
+  }
+  if (live.registries.length !== 1) return "gateway does not have exactly one registry credential";
+  const registry = live.registries[0];
+  if (registry.server.toLowerCase() !== host.toLowerCase() || lowerId(registry.identity) !== lowerId(live.userAssignedIdentityIds[0]) || registry.username !== "" || registry.passwordSecretRef !== "") {
+    return "registry credential does not match the generated identity and image host";
+  }
+  return null;
+}
+async function readLiveGatewayDeployment(gatewayResourceId) {
+  const { subscriptionId, resourceGroup, name } = parseContainerAppResourceId(gatewayResourceId);
+  let raw;
+  try {
+    raw = await runAz(["containerapp", "show", "--subscription", subscriptionId, "-g", resourceGroup, "-n", name, "-o", "json"]);
+  } catch (e) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_UNREADABLE", message: `Could not read gateway '${name}'.`, cause: e });
+  }
+  try {
+    return parseLiveGatewayDeployment(JSON.parse(raw));
+  } catch (e) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_UNREADABLE", message: `Gateway '${name}' returned invalid JSON.`, cause: e });
+  }
+}
+async function resolveLegacyAcrDigest(live, subscriptionId) {
+  const parsed = parseImageRef2(live.image);
+  const [host, ...repoParts] = parsed.repo.split("/");
+  const acrName = host.split(".")[0];
+  const repo = repoParts.join("/");
+  if (!acrName || !repo || !parsed.tag) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_INVALID", message: "The live gateway image is not a tagged ACR image." });
+  }
+  const command = ["acr", "repository", "show"];
+  if (subscriptionId) command.push("--subscription", subscriptionId);
+  command.push("-n", acrName, "--image", `${repo}:${parsed.tag}`, "--query", "digest", "-o", "tsv");
+  const digest = (await runAz(command)).trim();
+  if (!/^sha256:[0-9a-f]{64}$/.test(digest)) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_INVALID", message: "The live ACR image did not resolve to a sha256 digest." });
+  }
+  return digest;
+}
+function adoptedAcrTopologyError(live, adoption) {
+  const source = parseImageRef2(adoption.expectedSourceRef);
+  const current = parseImageRef2(live.image);
+  const sourceParts = source.repo.split("/");
+  const currentParts = current.repo.split("/");
+  if (sourceParts[0]?.toLowerCase() !== currentParts[0]?.toLowerCase() || currentParts.slice(1).join("/") !== "m8t-web") {
+    return "live image left the explicitly adopted ACR repository";
+  }
+  if (live.userAssignedIdentityIds.length !== 1 || lowerId(live.userAssignedIdentityIds[0]) !== lowerId(adoption.expectedAcrPullIdentityResourceId)) {
+    return "live pull identity differs from the adopted identity";
+  }
+  if (live.registries.length !== 1) return "live registry credential count differs from the adopted topology";
+  const reg = live.registries[0];
+  if (reg.server.toLowerCase() !== sourceParts[0]?.toLowerCase() || lowerId(reg.identity) !== lowerId(adoption.expectedAcrPullIdentityResourceId)) {
+    return "live registry credential differs from the adopted topology";
+  }
+  return null;
+}
+async function readAcrDigest(subscriptionId, acrName, image) {
+  try {
+    const value = (await runAz(["acr", "repository", "show", "--subscription", subscriptionId, "-n", acrName, "--image", image, "--query", "digest", "-o", "tsv"])).trim();
+    return /^sha256:[0-9a-f]{64}$/.test(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function rollAdoptedGateway(args) {
+  if (!/^sha256:[0-9a-f]{64}$/.test(args.targetDigest)) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_DIGEST_INVALID", message: "The manifest gateway digest is not a lowercase sha256 digest." });
+  }
+  const { subscriptionId, resourceGroup, name } = parseContainerAppResourceId(args.gatewayResourceId);
+  let live = await readLiveGatewayDeployment(args.gatewayResourceId);
+  const topologyError = adoptedAcrTopologyError(live, args.adoption);
+  if (topologyError) throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_DRIFT", message: `Adopted gateway held: ${topologyError}.` });
+  const acrName = args.adoption.expectedAcrResourceId.split("/").filter(Boolean).at(-1) ?? "";
+  const host = parseImageRef2(args.adoption.expectedSourceRef).repo.split("/")[0];
+  if (!acrName || !host) throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_INVALID", message: "The adoption record lacks a usable ACR identity." });
+  if (args.adoption.status === "pending") {
+    if (args.targetDigest !== args.adoption.expectedForwardDigest && args.targetDigest !== args.adoption.expectedRollbackDigest && args.targetDigest !== args.adoption.expectedSourceDigest) {
+      throw new LocalCliError({
+        code: "PLATFORM_GATEWAY_ADOPTION_TARGET_CHANGED",
+        message: "The pending adoption may move only to its recorded forward digest or back to its recorded source digest."
+      });
+    }
+    const current = parseImageRef2(live.image);
+    const currentDigest = current.digest ?? (current.tag ? await readAcrDigest(subscriptionId, acrName, `m8t-web:${current.tag}`) : null);
+    const atSource = current.repo === `${host}/m8t-web` && currentDigest === args.adoption.expectedSourceDigest;
+    const atAuthorizedForward = current.repo === `${host}/m8t-web` && currentDigest === args.adoption.expectedForwardDigest;
+    const atTarget = current.repo === `${host}/m8t-web` && currentDigest === args.targetDigest;
+    if (!atSource && !atAuthorizedForward && !atTarget) {
+      throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_CHANGED", message: "The adopted gateway changed after authorization; refusing to overwrite it." });
+    }
+  }
+  const targetImage = `m8t-web:${args.targetTag}`;
+  const existing = await readAcrDigest(subscriptionId, acrName, targetImage);
+  if (existing && existing !== args.targetDigest) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_TAG_CONFLICT", message: `ACR tag ${targetImage} already exists with a different digest; refusing to overwrite it.` });
+  }
+  if (!existing) {
+    await runAz([
+      "acr",
+      "import",
+      "--subscription",
+      subscriptionId,
+      "-n",
+      acrName,
+      "--source",
+      `${DEFAULT_IMAGE_REPO}@${args.targetDigest}`,
+      "--image",
+      targetImage
+    ]);
+  }
+  const imported = await readAcrDigest(subscriptionId, acrName, targetImage);
+  if (imported !== args.targetDigest) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_IMPORT_MISMATCH", message: "The mirrored ACR tag does not match the official manifest digest." });
+  }
+  const attempts = args.pollAttempts ?? 12;
+  const delayMs = args.pollDelayMs ?? 5e3;
+  const waitReady = async (digest) => {
+    for (let n = 0; n < attempts; n += 1) {
+      live = await readLiveGatewayDeployment(args.gatewayResourceId);
+      const actual = parseImageRef2(live.image);
+      if (actual.repo === `${host}/m8t-web` && actual.digest === digest && live.provisioningState === "Succeeded" && live.latestRevisionName !== "" && live.latestRevisionName === live.latestReadyRevisionName) return true;
+      if (n + 1 < attempts) await new Promise((resolve6) => setTimeout(resolve6, delayMs));
+    }
+    return false;
+  };
+  const updateTo = async (digest) => {
+    const desired = `${host}/m8t-web@${digest}`;
+    const actual = parseImageRef2(live.image);
+    if (actual.repo !== `${host}/m8t-web` || actual.digest !== digest) {
+      await runAz(["containerapp", "update", "--subscription", subscriptionId, "-g", resourceGroup, "-n", name, "--image", desired]);
+    }
+  };
+  try {
+    await updateTo(args.targetDigest);
+    if (!await waitReady(args.targetDigest)) {
+      throw new LocalCliError({ code: "PLATFORM_GATEWAY_NOT_READY", message: `Gateway '${name}' did not become ready on the manifest digest.` });
+    }
+  } catch (e) {
+    if (args.adoption.status === "pending") {
+      try {
+        live = await readLiveGatewayDeployment(args.gatewayResourceId);
+        await updateTo(args.adoption.expectedSourceDigest);
+        if (!await waitReady(args.adoption.expectedSourceDigest)) throw new Error("source revision did not become ready");
+      } catch (restoreError) {
+        throw new LocalCliError({
+          code: "PLATFORM_GATEWAY_ADOPTION_RESTORE_FAILED",
+          message: `Gateway adoption failed and restoring the authorized source also failed: ${restoreError.message}`,
+          cause: e
+        });
+      }
+    }
+    throw e;
+  }
+  args.onProgress?.(`gateway ready at ${args.targetTag} (${args.targetDigest}).`);
+  return { ...args.adoption, status: "complete", completedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function isSamePendingAdoption(existing, liveImage, digest, acrResourceId, gatewayState, forwardTag, forwardDigest, rollbackTag, rollbackDigest) {
+  if (!existing) return false;
+  return existing.expectedSourceRef === liveImage && existing.expectedSourceDigest === digest && existing.expectedAcrResourceId.toLowerCase() === acrResourceId.toLowerCase() && existing.expectedForwardTag === forwardTag && existing.expectedForwardDigest === forwardDigest && existing.expectedRollbackTag === rollbackTag && existing.expectedRollbackDigest === rollbackDigest && gatewayState === "managed" && existing.status === "pending";
+}
+async function adoptLegacyGateway(args) {
+  if (!/^sha256:[0-9a-f]{64}$/.test(args.expectedDigest)) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_INVALID", message: "--expected-digest must be a lowercase sha256 digest." });
+  }
+  const parsedResource = parseContainerAppResourceId(args.gatewayResourceId);
+  if (parsedResource.subscriptionId.toLowerCase() !== args.subscriptionId.toLowerCase() || parsedResource.resourceGroup.toLowerCase() !== args.resourceGroup.toLowerCase()) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_SCOPE", message: "The discovered gateway does not belong to the requested subscription and resource group." });
+  }
+  if (!/^sha256:[0-9a-f]{64}$/.test(args.targetGatewayDigest) || args.targetGatewayTag.trim() === "" || !/^sha256:[0-9a-f]{64}$/.test(args.rollbackGatewayDigest) || args.rollbackGatewayTag.trim() === "") {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_INVALID", message: "The selected target lacks a valid gateway tag and digest." });
+  }
+  const client = await openMetadataTransactionClient({
+    credential: args.credential,
+    subscriptionId: args.subscriptionId,
+    resourceGroup: args.resourceGroup,
+    label: "gateway adoption transaction",
+    errorCode: "PLATFORM_GATEWAY_ADOPTION_NO_ACCESS",
+    retryHint: "The role assignment persists \u2014 retry the gateway adoption command in a few minutes.",
+    onProgress: args.onProgress
+  });
+  const stampRow = await client.getEntity("system", "platform").catch((e) => {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_NO_STAMP", message: "The installed platform stamp is absent or unreadable; refusing to record gateway ownership.", cause: e });
+  });
+  const stamp = entityToStamp(stampRow);
+  const stampEtag = stampRow.etag;
+  if (!stamp || typeof stampEtag !== "string" || !stampEtag) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_NO_STAMP", message: "The installed platform stamp is malformed or lacks an ETag." });
+  }
+  const existingRequest = await readApplyRequest(client);
+  const live = await readLiveGatewayDeployment(args.gatewayResourceId);
+  const topologyError = legacyGatewayTopologyError(live, args.gatewayResourceId, args.subscriptionId);
+  if (topologyError) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_REFUSED", message: `Gateway adoption refused: ${topologyError}.` });
+  }
+  if (live.image !== args.expectedImage) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_CHANGED", message: `The live gateway image changed; expected '${args.expectedImage}', found '${live.image}'.` });
+  }
+  const digest = await resolveLegacyAcrDigest(live, args.subscriptionId);
+  if (digest !== args.expectedDigest) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_CHANGED", message: `The live gateway digest changed; expected '${args.expectedDigest}', found '${digest}'.` });
+  }
+  const expectedIdentity = live.userAssignedIdentityIds[0];
+  if (args.expectedAcrResourceId.trim() === "" || typeof expectedIdentity !== "string") {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_INVALID", message: "--expected-acr-resource-id and the generated pull identity are required." });
+  }
+  const imageHost = parseImageRef2(live.image).repo.split("/")[0].split(".")[0];
+  const acrName = args.expectedAcrResourceId.split("/").filter(Boolean).at(-1) ?? "";
+  const expectedAcrId = `/subscriptions/${args.subscriptionId}/resourceGroups/${args.resourceGroup}/providers/Microsoft.ContainerRegistry/registries/${imageHost}`;
+  if (imageHost.toLowerCase() !== acrName.toLowerCase() || lowerId(args.expectedAcrResourceId) !== lowerId(expectedAcrId)) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_INVALID", message: "--expected-acr-resource-id does not match the live image registry." });
+  }
+  const existing = stamp.components.gateway.adoption;
+  const samePending = isSamePendingAdoption(
+    existing,
+    live.image,
+    digest,
+    args.expectedAcrResourceId,
+    stamp.components.gateway.state,
+    args.targetGatewayTag,
+    args.targetGatewayDigest,
+    args.rollbackGatewayTag,
+    args.rollbackGatewayDigest
+  );
+  if (existing && !samePending) {
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_CONFLICT", message: "The gateway already carries a different adoption record." });
+  }
+  if (existingRequest && blocksNewIntent(existingRequest.status)) {
+    if (samePending && existingRequest.status === "pending" && existingRequest.target === args.target) {
+      return { outcome: "already-adopted", image: live.image, digest };
+    }
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_IN_PROGRESS", message: `An update request for ${existingRequest.target} is already ${existingRequest.status}.` });
+  }
+  const now = args.nowIso ?? (/* @__PURE__ */ new Date()).toISOString();
+  const nextStamp = {
+    ...stamp,
+    updatedAt: now,
+    components: {
+      ...stamp.components,
+      gateway: {
+        ...stamp.components.gateway,
+        tag: parseImageRef2(live.image).tag ?? stamp.components.gateway.tag,
+        digest,
+        state: "managed",
+        adoption: existing ?? {
+          version: 1,
+          status: "pending",
+          expectedSourceRef: live.image,
+          expectedSourceDigest: digest,
+          expectedForwardDigest: args.targetGatewayDigest,
+          expectedForwardTag: args.targetGatewayTag,
+          expectedRollbackDigest: args.rollbackGatewayDigest,
+          expectedRollbackTag: args.rollbackGatewayTag,
+          expectedAcrResourceId: args.expectedAcrResourceId,
+          expectedAcrPullIdentityResourceId: expectedIdentity,
+          authorizedAt: now
+        }
+      }
+    }
+  };
+  const intent = newIntent(args.target, { source: "policy", identity: args.operatorIdentity, at: now }, now);
+  const stampWire = stampToEntity(nextStamp);
+  const stampEntity = {
+    ...stampWire,
+    partitionKey: String(stampWire.partitionKey),
+    rowKey: String(stampWire.rowKey)
+  };
+  const applyEntity = applyRequestToEntity(intent);
+  const stampAction = ["update", stampEntity, "Replace", { etag: stampEtag }];
+  const requestAction = existingRequest ? ["update", applyEntity, "Replace", { etag: existingRequest.etag }] : ["create", applyEntity];
+  try {
+    await client.submitTransaction([stampAction, requestAction]);
+  } catch (e) {
+    const status = e.statusCode;
+    if (status === 409 || status === 412) {
+      throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_RACE", message: "Gateway adoption lost a concurrent metadata update; no adoption was recorded.", hint: "Re-read the live image and digest, then retry the command.", cause: e });
+    }
+    throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_WRITE_FAILED", message: "Could not atomically record gateway adoption and its update request.", cause: e });
+  }
+  args.onProgress?.(`recorded digest-bound gateway adoption and queued update to ${args.target}.`);
+  return { outcome: samePending ? "already-adopted" : "adopted", image: live.image, digest };
+}
+
 // src/lib/platform-converge.ts
 var ORDER = ["infra", "gateway", "codingAgent", "azureExecutor", "personas", "brainSeeds"];
 function seedSetRev(manifest) {
@@ -21484,8 +21945,10 @@ function diffPlan(manifest, stamp, tree, opts = {}) {
       continue;
     }
     const from = cur?.tag ?? null;
-    if (adopt) actions.push({ component, reason: "adopt", from, to: img.tag });
-    else if (from !== img.tag) actions.push({ component, reason: "changed", from, to: img.tag });
+    const adoption = component === "gateway" ? cur?.adoption : void 0;
+    const withAdoption = adoption ? { gatewayAdoption: adoption } : {};
+    if (adopt) actions.push({ component, reason: "adopt", from, to: img.tag, ...withAdoption });
+    else if (from !== img.tag || adoption?.status === "pending") actions.push({ component, reason: "changed", from, to: img.tag, ...withAdoption });
     else skipped.push({ component, reason: "up-to-date" });
   }
   return { targetVersion: manifest.platform.tag, previousVersion: manifest.platform.previousVersion, actions, skipped };
@@ -21628,10 +22091,20 @@ function seedStamp(prior, manifest, plan) {
   };
 }
 async function applyGatewayImage(a, ctx, gatewayResourceId) {
+  const digest = ctx.manifest.components.gateway.digest;
+  if (a.gatewayAdoption) {
+    const adoption = await rollAdoptedGateway({
+      gatewayResourceId,
+      adoption: a.gatewayAdoption,
+      targetTag: a.to,
+      targetDigest: assertGatewayDigest(ctx.manifest.components.gateway),
+      onProgress: ctx.onProgress
+    });
+    return { tag: a.to, digest, state: "managed", adoption };
+  }
   const { resourceGroup, name } = parseContainerAppResourceId(gatewayResourceId);
   const current = (await runAz(["containerapp", "show", "-g", resourceGroup, "-n", name, "--query", "properties.template.containers[0].image", "-o", "tsv"])).trim();
   const tags = await fetchPublicTags(DEFAULT_IMAGE_REPO);
-  const digest = ctx.manifest.components.gateway.digest;
   const plan = planUpdate({ currentImage: current, availableTags: tags, imageRepo: DEFAULT_IMAGE_REPO, to: a.to, toDigest: digest });
   switch (plan.kind) {
     case "refuse-byoc":
@@ -22130,10 +22603,10 @@ async function resolveExecutorAgentName(args) {
 }
 
 // src/lib/platform-infra-params.ts
-import { TableClient as TableClient3 } from "@azure/data-tables";
+import { TableClient as TableClient4 } from "@azure/data-tables";
 async function openInfraParamsTable(opts) {
   const { tableEndpoint } = await discoverStampStorage(opts);
-  return new TableClient3(tableEndpoint, "Metadata", opts.credential);
+  return new TableClient4(tableEndpoint, "Metadata", opts.credential);
 }
 async function readInfraParams(client) {
   try {
@@ -23006,73 +23479,6 @@ function resolveHeadlessContextFromEnv(env) {
   };
 }
 
-// src/lib/apply-request-store.ts
-import { TableClient as TableClient4 } from "@azure/data-tables";
-async function openApplyTable(opts) {
-  const { tableEndpoint } = await discoverStampStorage(opts);
-  return new TableClient4(tableEndpoint, "Metadata", opts.credential);
-}
-function hasStatus(e, n) {
-  return e.statusCode === n;
-}
-async function readApplyRequest(client) {
-  try {
-    const row = await client.getEntity(APPLY_REQUEST_PK, APPLY_REQUEST_RK);
-    return { ...entityToApplyRequest(row), etag: row.etag };
-  } catch (e) {
-    if (hasStatus(e, 404)) return null;
-    throw e;
-  }
-}
-async function claimApplyRequest(client, executionId, nowIso, leaseMs) {
-  const cur = await readApplyRequest(client);
-  if (!cur) return null;
-  const leaseExpired = isInFlight(cur.status) && cur.leaseUntil !== null && Date.parse(cur.leaseUntil) < Date.parse(nowIso);
-  const claimable = cur.status === "pending" || cur.status === "awaiting-engine-update" || leaseExpired;
-  if (!claimable) return null;
-  const nowMs = Date.parse(nowIso);
-  const leaseUntil = new Date((Number.isNaN(nowMs) ? Date.now() : nowMs) + leaseMs).toISOString();
-  if (leaseExpired && cur.attempt >= MAX_LEASE_TAKEOVERS) {
-    const held = {
-      ...cur,
-      status: "held",
-      breaker: "held",
-      result: {
-        appliedVersion: cur.result?.appliedVersion ?? null,
-        error: `the converge was abandoned mid-apply ${(cur.attempt + 1).toString()} times (last owner ${cur.claimedBy ?? "(unknown)"}, phase "${cur.phase ?? "(none)"}"); the updater stopped retrying to avoid re-rolling infra behind a converge that cannot finish`
-      },
-      updatedAt: nowIso
-    };
-    try {
-      await client.updateEntity({ ...applyRequestToEntity(held), etag: cur.etag }, "Merge", { etag: cur.etag });
-    } catch (e) {
-      if (!hasStatus(e, 412)) throw e;
-    }
-    return null;
-  }
-  const claimed = {
-    ...cur,
-    status: "claimed",
-    claimedBy: executionId,
-    leaseUntil,
-    ...leaseExpired ? { attempt: cur.attempt + 1 } : {},
-    updatedAt: nowIso
-  };
-  try {
-    await client.updateEntity({ ...applyRequestToEntity(claimed), etag: cur.etag }, "Merge", { etag: cur.etag });
-    return claimed;
-  } catch (e) {
-    if (hasStatus(e, 412)) return null;
-    throw e;
-  }
-}
-async function patchApplyRequest(client, mutate) {
-  const cur = await readApplyRequest(client);
-  if (!cur) return;
-  const next = mutate(cur);
-  await client.updateEntity({ ...applyRequestToEntity(next), etag: cur.etag }, "Merge", { etag: cur.etag });
-}
-
 // src/lib/rail-preconditions.ts
 init_errors();
 function assertBakedContentPresent(repoRoot) {
@@ -23233,7 +23639,7 @@ async function runGate(args, applied, budgetMs) {
 }
 async function rollbackOrHold(args, notify, error) {
   const target = args.plan.targetVersion;
-  const rollbackTarget = args.stamp.previousPlatformVersion;
+  const rollbackTarget = args.preApplyVersion;
   const current = await readBreaker(args.client);
   const next = nextBreaker(current);
   if (next === "held") {
@@ -23497,6 +23903,7 @@ var PlatformConvergeCommand = class extends M8tCommand {
       plan,
       ctx: applyCtx,
       stamp: stamp ?? seedStampFor(plan),
+      preApplyVersion: stamp?.platformVersion ?? null,
       manifest,
       credential: ctx.credential,
       endpoint: ctx.endpoint,
@@ -23722,8 +24129,8 @@ var PlatformRequestUpdateCommand = class extends M8tCommand {
     description: "Ask this installation's updater to converge to a version, exactly as the in-app button does.",
     details: "Writes the update request the updater job claims on its next tick. This is the ONLY privilege the requester holds \u2014 it does not deploy anything itself; the install's own updater fetches the release, applies it, health-gates it and rolls back on failure. With --wait, follows the request to a terminal state and exits non-zero if it did not succeed.",
     examples: [
-      ["Request an update", "m8t platform request-update --version 0.7.3 --resource-group rg-m8t --subscription <id>"],
-      ["Request it and wait", "m8t platform request-update --version 0.7.3 --wait --resource-group rg-m8t --subscription <id>"]
+      ["Request an update", "m8t platform request-update --version 0.7.4 --resource-group rg-m8t --subscription <id>"],
+      ["Request it and wait", "m8t platform request-update --version 0.7.4 --wait --resource-group rg-m8t --subscription <id>"]
     ]
   });
   version = Option35.String("--version", { description: "The platform version to converge to." });
@@ -24021,9 +24428,87 @@ var PlatformSeedStampCommand = class extends M8tCommand {
   }
 };
 
-// src/commands/platform/policy.ts
+// src/commands/platform/gateway-adopt.ts
 import { Command as Command40, Option as Option37 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential21, ManagedIdentityCredential as ManagedIdentityCredential5 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential21 } from "@azure/identity";
+init_errors();
+var PlatformGatewayAdoptCommand = class extends M8tCommand {
+  static paths = [["platform", "gateway", "adopt"]];
+  static usage = Command40.Usage({
+    description: "Explicitly authorize one legacy m8t ACR gateway for managed, digest-pinned updates.",
+    details: "Fail-closed ownership transition. Reads the live gateway and ACR digest, requires the operator to repeat both exactly, verifies the generated legacy topology, and atomically writes the adoption marker with a pending platform update. Unadopted BYOC remains external."
+  });
+  subscription = Option37.String("--subscription");
+  resourceGroup = Option37.String("--resource-group");
+  target = Option37.String("--target", { description: "Published platform target whose installer contains adoption support." });
+  expectedImage = Option37.String("--expected-image", { description: "Exact live legacy ACR image ref." });
+  expectedDigest = Option37.String("--expected-digest", { description: "Exact sha256 digest resolved from that ACR image." });
+  expectedAcrResourceId = Option37.String("--expected-acr-resource-id", { description: "Exact ARM id of the legacy ACR." });
+  output = Option37.String("--output");
+  async executeCommand() {
+    const need = (v, flag) => {
+      if (typeof v !== "string" || v.trim() === "") throw new LocalCliError({ code: "PLATFORM_GATEWAY_ADOPTION_ARG_MISSING", message: `${flag} is required.` });
+      return v.trim();
+    };
+    const mode = resolveOutputMode(this.output, this.context.stdout);
+    const account = await getAzAccount();
+    const subscriptionId = need(this.subscription ?? account.subscriptionId, "--subscription");
+    const gw = await resolveGatewayContext({ subscriptionId, resourceGroup: this.resourceGroup, interactive: mode !== "json" });
+    const parsed = parseContainerAppResourceId(gw.containerAppResourceId);
+    const resourceGroup = need(this.resourceGroup ?? parsed.resourceGroup, "--resource-group");
+    const target = need(this.target, "--target");
+    const manifest = await fetchManifest({ channel: true, version: target });
+    const assertTarget = (requested, actual) => {
+      const normalized = requested.replace(/^platform-v/, "");
+      if (actual.platform.version.replace(/^platform-v/, "") !== normalized || actual.platform.tag !== platformTag(normalized)) {
+        throw new LocalCliError({
+          code: "PLATFORM_GATEWAY_ADOPTION_TARGET_MISMATCH",
+          message: `Requested target ${requested}, but the release service returned ${actual.platform.version}.`
+        });
+      }
+    };
+    assertTarget(target, manifest);
+    if (compareSemver(`v${manifest.components.installer.version}`, "v0.1.74") < 0 || compareSemver(`v${manifest.components.cli.recommended}`, "v0.2.106") < 0) {
+      throw new LocalCliError({
+        code: "PLATFORM_GATEWAY_ADOPTION_TARGET_TOO_OLD",
+        message: `Platform target ${target} predates digest-bound legacy gateway adoption support.`,
+        hint: "Choose a published platform target whose installer is at least 0.1.74 and recommended CLI is at least 0.2.106."
+      });
+    }
+    if (!manifest.platform.previousVersion) {
+      throw new LocalCliError({
+        code: "PLATFORM_GATEWAY_ADOPTION_NO_ROLLBACK",
+        message: `Platform target ${target} has no recorded previous release; refusing a gateway ownership transition without a rollback target.`
+      });
+    }
+    const rollbackManifest = await fetchManifest({ channel: true, version: manifest.platform.previousVersion });
+    assertTarget(manifest.platform.previousVersion, rollbackManifest);
+    const result2 = await adoptLegacyGateway({
+      credential: new DefaultAzureCredential21(),
+      subscriptionId,
+      resourceGroup,
+      gatewayResourceId: gw.containerAppResourceId,
+      target,
+      expectedImage: need(this.expectedImage, "--expected-image"),
+      expectedDigest: need(this.expectedDigest, "--expected-digest"),
+      expectedAcrResourceId: need(this.expectedAcrResourceId, "--expected-acr-resource-id"),
+      targetGatewayTag: manifest.components.gateway.tag,
+      targetGatewayDigest: manifest.components.gateway.digest,
+      rollbackGatewayTag: rollbackManifest.components.gateway.tag,
+      rollbackGatewayDigest: rollbackManifest.components.gateway.digest,
+      operatorIdentity: await getCallerObjectId(),
+      onProgress: (m) => this.context.stderr.write(`${m}
+`)
+    });
+    this.context.stdout.write(mode === "json" ? renderJson(result2) + "\n" : `${result2.outcome}: ${result2.image}@${result2.digest}
+`);
+    return 0;
+  }
+};
+
+// src/commands/platform/policy.ts
+import { Command as Command41, Option as Option38 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential22, ManagedIdentityCredential as ManagedIdentityCredential5 } from "@azure/identity";
 init_errors();
 
 // src/lib/platform-policy.ts
@@ -24078,16 +24563,16 @@ async function readPolicy(opts) {
 // src/commands/platform/policy.ts
 var PlatformPolicyCommand = class extends M8tCommand {
   static paths = [["platform", "policy"]];
-  static usage = Command40.Usage({
+  static usage = Command41.Usage({
     description: "Show or set how this install handles available platform updates.",
     details: "Modes: 'notify-only' shows updates but never applies them; 'auto-critical' (the default when unset) applies critical releases without asking; 'auto-all' applies every release. Use 'notify-only' where something else already controls what is deployed.",
     examples: [["Show the current mode", "m8t platform policy"], ["Never apply automatically", "m8t platform policy --set notify-only"]]
   });
-  set = Option37.String("--set", { description: "notify-only | auto-critical | auto-all" });
-  subscription = Option37.String("--subscription");
-  resourceGroup = Option37.String("--resource-group");
-  miClientId = Option37.String("--mi-client-id");
-  output = Option37.String("--output");
+  set = Option38.String("--set", { description: "notify-only | auto-critical | auto-all" });
+  subscription = Option38.String("--subscription");
+  resourceGroup = Option38.String("--resource-group");
+  miClientId = Option38.String("--mi-client-id");
+  output = Option38.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -24100,7 +24585,7 @@ var PlatformPolicyCommand = class extends M8tCommand {
       this.context.stderr.write(`${m}
 `);
     };
-    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential5({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential21();
+    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential5({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential22();
     const ctx = {
       credential: credential2,
       subscriptionId: need(this.subscription, "--subscription"),
@@ -24133,7 +24618,7 @@ var PlatformPolicyCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-cost-report.ts
-import { Command as Command41, Option as Option38 } from "clipanion";
+import { Command as Command42, Option as Option39 } from "clipanion";
 
 // src/lib/wire-gateway-acs.ts
 init_rbac();
@@ -24173,18 +24658,18 @@ async function wireGatewayForAcs(args) {
 init_errors();
 var PlatformEnableCostReportCommand = class extends M8tCommand {
   static paths = [["platform", "enable-cost-report"]];
-  static usage = Command41.Usage({
+  static usage = Command42.Usage({
     description: "Wire the deployed gateway to send the bi-weekly cost report via ACS Email.",
     details: "Discovers the live gateway Container App, grants its managed identity Contributor at the ACS resource scope (authorising the ACS Email send), and sets M8T_ACS_ENDPOINT / M8T_ACS_SENDER / M8T_ENABLE_COST_REPORTER=1 on the gateway. Idempotent \u2014 safely re-runnable. ACS is created during the executor deploy; pass its endpoint, sender, and resource id (from that deploy or 'az communication list')."
   });
-  subscription = Option38.String("--subscription");
-  resourceGroup = Option38.String("--resource-group", {
+  subscription = Option39.String("--subscription");
+  resourceGroup = Option39.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  acsEndpoint = Option38.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
-  acsSender = Option38.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
-  acsResourceId = Option38.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
-  output = Option38.String("--output");
+  acsEndpoint = Option39.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
+  acsSender = Option39.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
+  acsResourceId = Option39.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
+  output = Option39.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -24258,13 +24743,13 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/email.ts
-import { Command as Command42, Option as Option39 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential22 } from "@azure/identity";
+import { Command as Command43, Option as Option40 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
 import { CommunicationServiceManagementClient as CommunicationServiceManagementClient2 } from "@azure/arm-communication";
 init_errors();
 var PlatformEmailCommand = class extends M8tCommand {
   static paths = [["platform", "email"]];
-  static usage = Command42.Usage({
+  static usage = Command43.Usage({
     description: "Turn outbound email (advisor handoffs) on or off for this install.",
     details: "`on` resolves the ACS sender (reusing an existing one, provisioning only if there is none), records the decision in the platform stamp, and reconciles the executor's environment. `off` records the decision and strips the executor's email wiring, leaving the ACS resource in place so turning it back on is a flag flip. Idempotent \u2014 re-running either direction is safe, and no new agent version is posted when nothing changes.",
     examples: [
@@ -24272,19 +24757,19 @@ var PlatformEmailCommand = class extends M8tCommand {
       ["Turn it off (a shared, public-facing deployment should stay off)", "m8t platform email off"]
     ]
   });
-  state = Option39.String({ required: true, name: "on|off" });
-  subscription = Option39.String("--subscription");
-  resourceGroup = Option39.String("--resource-group", {
+  state = Option40.String({ required: true, name: "on|off" });
+  subscription = Option40.String("--subscription");
+  resourceGroup = Option40.String("--resource-group", {
     description: "m8t resource group, to disambiguate in a multi-deployment subscription."
   });
-  agent = Option39.String("--agent", { description: `Executor agent name. Resolved by persona when omitted (usually ${EXECUTOR_AGENT_FALLBACK}).` });
-  kvUri = Option39.String("--kv-uri", {
+  agent = Option40.String("--agent", { description: `Executor agent name. Resolved by persona when omitted (usually ${EXECUTOR_AGENT_FALLBACK}).` });
+  kvUri = Option40.String("--kv-uri", {
     description: "Install's Key Vault URI. Only needed if no ACS is on record yet and one must be provisioned."
   });
-  endpoint = Option39.String("--endpoint", {
+  endpoint = Option40.String("--endpoint", {
     description: "Foundry project endpoint, to disambiguate a subscription holding several."
   });
-  output = Option39.String("--output");
+  output = Option40.String("--output");
   async executeCommand() {
     const wanted = this.state.trim().toLowerCase();
     if (wanted !== "on" && wanted !== "off") {
@@ -24308,7 +24793,7 @@ var PlatformEmailCommand = class extends M8tCommand {
     });
     const { resourceGroup } = parseContainerAppResourceId(ctx.containerAppResourceId);
     const subscriptionId = ctx.subscriptionId;
-    const credential2 = new DefaultAzureCredential22();
+    const credential2 = new DefaultAzureCredential23();
     const stamp = await readStamp({ credential: credential2, subscriptionId, resourceGroup });
     if (stamp === null) {
       throw new LocalCliError({
@@ -24434,45 +24919,45 @@ var PlatformEmailCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-auto-update.ts
-import { Command as Command43, Option as Option40 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 import { confirm as confirm6 } from "@inquirer/prompts";
-import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command43.Usage({
+  static usage = Command44.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option40.String("--subscription");
-  resourceGroup = Option40.String("--resource-group", {
+  subscription = Option41.String("--subscription");
+  resourceGroup = Option41.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option40.String("--suffix", {
+  suffix = Option41.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option40.String("--installer-image", {
+  installerImage = Option41.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option40.String("--update-cron", {
+  updateCron = Option41.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option40.String("--channel-url", {
+  channelUrl = Option41.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  location = Option40.String("--location", {
+  location = Option41.String("--location", {
     description: "Region for the updater identity + job. Defaults to this install's stamped region, then to the resource group's existing resources."
   });
-  foundryTracing = Option40.String("--foundry-tracing", {
+  foundryTracing = Option41.String("--foundry-tracing", {
     description: "project | account | skip. Omitting it keeps the value already stamped on this install; only an install with nothing stamped falls through to the default (project)."
   });
-  endpoint = Option40.String("--endpoint", {
+  endpoint = Option41.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option40.Boolean("--yes", false);
-  output = Option40.String("--output");
+  yes = Option41.Boolean("--yes", false);
+  output = Option41.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -24491,7 +24976,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       resourceGroup: this.resourceGroup
     });
     const { resourceGroup, name: gatewayName } = parseContainerAppResourceId(gw.containerAppResourceId);
-    const credential2 = new DefaultAzureCredential23();
+    const credential2 = new DefaultAzureCredential24();
     const account = await getAzAccount();
     const subscriptionId = this.subscription ?? account.subscriptionId;
     const explicitSuffix = typeof this.suffix === "string" && this.suffix.length > 0 ? this.suffix : void 0;
@@ -24653,7 +25138,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { Command as Command45, Option as Option42 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_esm();
@@ -25217,15 +25702,15 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command44.Usage({
+  static usage = Command45.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option41.String("--subscription");
-  resourceGroup = Option41.String("--resource-group", "rg-m8t-stack");
-  location = Option41.String("--location", "eastus");
-  suffix = Option41.String("--suffix", "");
-  imageRef = Option41.String("--image-ref", DEFAULT_IMAGE_REF);
+  subscription = Option42.String("--subscription");
+  resourceGroup = Option42.String("--resource-group", "rg-m8t-stack");
+  location = Option42.String("--location", "eastus");
+  suffix = Option42.String("--suffix", "");
+  imageRef = Option42.String("--image-ref", DEFAULT_IMAGE_REF);
   // Gateway-only override. Empty ⇒ the gateway uses --image-ref, which is the
   // from-zero case. It exists because the gateway and the voice relay do NOT
   // always run the same image: a converge preserves a BYOC gateway on its own
@@ -25233,28 +25718,28 @@ var DeployCommand = class extends M8tCommand {
   // (`--what-if`) that can only express one image therefore reports the other
   // app as drift on every single run, forever — which is exactly what the
   // infra-drift gate did from 2026-08-11.
-  gatewayImageRef = Option41.String("--gateway-image-ref", "");
-  acrPullIdentity = Option41.String("--acrpull-identity");
-  acrResourceId = Option41.String("--acr-resource-id");
-  foundryEndpoint = Option41.String("--foundry-endpoint");
-  foundryResourceId = Option41.String("--foundry-resource-id");
-  foundryTracing = Option41.String("--foundry-tracing");
+  gatewayImageRef = Option42.String("--gateway-image-ref", "");
+  acrPullIdentity = Option42.String("--acrpull-identity");
+  acrResourceId = Option42.String("--acr-resource-id");
+  foundryEndpoint = Option42.String("--foundry-endpoint");
+  foundryResourceId = Option42.String("--foundry-resource-id");
+  foundryTracing = Option42.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option41.String("--client-id");
-  whatIf = Option41.Boolean("--what-if", false);
+  clientId = Option42.String("--client-id");
+  whatIf = Option42.Boolean("--what-if", false);
   // Only meaningful with --what-if. Routes the comparison through the
   // value-free renderers (see ./lib/whatif-redact.js) instead of the default
   // before/after renderer. Defaults false so a local, interactive run keeps
   // showing values — that is the whole diagnostic point of --what-if.
   // Automation that forwards this output anywhere non-private (a CI log, an
   // issue) MUST pass --redact.
-  redact = Option41.Boolean("--redact", false);
-  output = Option41.String("--output");
+  redact = Option42.Boolean("--redact", false);
+  output = Option42.String("--output");
   // Subscription-scoped role assignments. Omitted ⇒ the template default (true).
   // Pass false when deploying as a principal scoped to the resource group only:
   // it cannot deploy at subscription scope, and those assignments persist
   // idempotently from the initial deployment anyway.
-  assignSubscriptionRoles = Option41.String("--assign-subscription-roles");
+  assignSubscriptionRoles = Option42.String("--assign-subscription-roles");
   /**
    * The installer image the updater Container-Apps Job runs.
    *
@@ -25265,23 +25750,23 @@ var DeployCommand = class extends M8tCommand {
    * than that — the comparison proposes REMOVING an updater job that exists and
    * should, and reports it as drift on every single run.
    */
-  installerImage = Option41.String("--installer-image");
+  installerImage = Option42.String("--installer-image");
   // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option41.String("--gateway-cpu");
-  gatewayMemory = Option41.String("--gateway-memory");
-  refereeEnabled = Option41.String("--referee-enabled");
-  refereeBrainRepos = Option41.String("--referee-brain-repos");
-  refereeFeedRepo = Option41.String("--referee-feed-repo");
-  refereeInstallationId = Option41.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option41.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option41.String("--exam-kv-uri");
-  examLaWorkspaceId = Option41.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option41.String("--brain-eval-deployment");
-  brainAppLogin = Option41.String("--brain-app-login");
-  refereeCheckpointDir = Option41.String("--referee-checkpoint-dir");
-  examApiBase = Option41.String("--exam-api-base");
+  gatewayCpu = Option42.String("--gateway-cpu");
+  gatewayMemory = Option42.String("--gateway-memory");
+  refereeEnabled = Option42.String("--referee-enabled");
+  refereeBrainRepos = Option42.String("--referee-brain-repos");
+  refereeFeedRepo = Option42.String("--referee-feed-repo");
+  refereeInstallationId = Option42.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option42.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option42.String("--exam-kv-uri");
+  examLaWorkspaceId = Option42.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option42.String("--brain-eval-deployment");
+  brainAppLogin = Option42.String("--brain-app-login");
+  refereeCheckpointDir = Option42.String("--referee-checkpoint-dir");
+  examApiBase = Option42.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -25465,7 +25950,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -25490,14 +25975,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command45.Usage({
+  static usage = Command46.Usage({
     description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option42.String();
-  skillsDir = Option42.String("--skills-dir");
-  noJudge = Option42.Boolean("--no-judge", false);
-  deployment = Option42.String("--deployment");
-  output = Option42.String("--output");
+  candidate = Option43.String();
+  skillsDir = Option43.String("--skills-dir");
+  noJudge = Option43.Boolean("--no-judge", false);
+  deployment = Option43.String("--deployment");
+  output = Option43.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -25556,7 +26041,7 @@ var EvalSkillCommand = class extends M8tCommand {
 import { spawnSync as spawnSync5 } from "child_process";
 import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync21, existsSync as existsSync20, readdirSync as readdirSync3 } from "fs";
 import { join as join30 } from "path";
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -25786,24 +26271,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command46.Usage({
+  static usage = Command47.Usage({
     description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option43.String();
-  arms = Option43.String("--arms");
-  taskSet = Option43.String("--task-set");
-  examType = Option43.String("--exam-type");
-  skill = Option43.String("--skill");
-  reps = Option43.String("-n,--reps");
-  probes = Option43.String("--probes");
-  pool = Option43.String("--pool");
-  out = Option43.String("--out");
-  dryRun = Option43.Boolean("--dry-run", false);
-  keepArms = Option43.Boolean("--keep-arms", false);
-  allowStub = Option43.Boolean("--allow-stub", false);
-  deployment = Option43.String("--deployment");
-  output = Option43.String("--output");
-  observeWaitS = Option43.String("--observe-wait-s");
+  worker = Option44.String();
+  arms = Option44.String("--arms");
+  taskSet = Option44.String("--task-set");
+  examType = Option44.String("--exam-type");
+  skill = Option44.String("--skill");
+  reps = Option44.String("-n,--reps");
+  probes = Option44.String("--probes");
+  pool = Option44.String("--pool");
+  out = Option44.String("--out");
+  dryRun = Option44.Boolean("--dry-run", false);
+  keepArms = Option44.Boolean("--keep-arms", false);
+  allowStub = Option44.Boolean("--allow-stub", false);
+  deployment = Option44.String("--deployment");
+  output = Option44.String("--output");
+  observeWaitS = Option44.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -25918,10 +26403,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command47.Usage({
+  static usage = Command48.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -25929,8 +26414,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option44.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option44.Boolean("--verbose", false);
+  output = Option45.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option45.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -25961,18 +26446,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
+import { Command as Command49, Option as Option46 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command48.Usage({
+  static usage = Command49.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option45.String("--output");
-  verbose = Option45.Boolean("--verbose", false);
-  subscription = Option45.String("--subscription", {
+  output = Option46.String("--output");
+  verbose = Option46.Boolean("--verbose", false);
+  subscription = Option46.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option45.String("--resource-group", {
+  resourceGroup = Option46.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -26037,7 +26522,7 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command49, Option as Option46 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
@@ -26102,10 +26587,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command49.Usage({
+  static usage = Command50.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option46.String("--output");
+  output = Option47.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -26143,8 +26628,8 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
+import { Command as Command51, Option as Option48 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential25 } from "@azure/identity";
 import * as fs30 from "fs";
 import * as os12 from "os";
 import * as path33 from "path";
@@ -26691,12 +27176,12 @@ function probeLegacyStateDir() {
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command50.Usage({
+  static usage = Command51.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option47.String("--output");
-  agent = Option47.String("--agent");
-  resourceGroup = Option47.String("--resource-group", {
+  output = Option48.String("--output");
+  agent = Option48.String("--agent");
+  resourceGroup = Option48.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -26769,7 +27254,7 @@ var DoctorCommand = class extends M8tCommand {
       let kvStatus = 0;
       if (kv) {
         try {
-          const token = await new DefaultAzureCredential24().getToken("https://vault.azure.net/.default");
+          const token = await new DefaultAzureCredential25().getToken("https://vault.azure.net/.default");
           const res = await fetch(`${kv.uri.replace(/\/$/, "")}/secrets?api-version=7.4&maxresults=1`, {
             headers: { Authorization: `Bearer ${token.token}` }
           });
@@ -26788,7 +27273,7 @@ var DoctorCommand = class extends M8tCommand {
       emit(checkModelQuota(deployments, usages));
       checking("outbound email");
       try {
-        const credential2 = new DefaultAzureCredential24();
+        const credential2 = new DefaultAzureCredential25();
         const outcome = platformRg && platformSub ? await readStampOutcome({ credential: credential2, subscriptionId: platformSub, resourceGroup: platformRg }).catch(
           () => ({ source: "unreadable" })
         ) : { source: "unreadable" };
@@ -26843,7 +27328,7 @@ var DoctorCommand = class extends M8tCommand {
       if (typeof this.agent === "string" && this.agent) {
         checking(`delivery grant for ${this.agent}`);
         try {
-          const credential2 = new DefaultAzureCredential24();
+          const credential2 = new DefaultAzureCredential25();
           const cur = await getAgentVersion({
             credential: credential2,
             projectEndpoint: foundry.projectEndpoint,
@@ -26886,11 +27371,11 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/prereqs.ts
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 init_errors();
 
 // src/lib/prereq-deps.ts
-import { DefaultAzureCredential as DefaultAzureCredential25 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential26 } from "@azure/identity";
 
 // src/lib/bootstrap-preflight.ts
 var ADMIN_DIRECTORY_ROLES = ["Global Administrator", "Application Administrator", "Cloud Application Administrator"];
@@ -27002,7 +27487,7 @@ function buildPrereqDeps(opts = {}) {
     probeRedirectUri,
     fixFoundryAccess,
     fixKeyVaultAccess,
-    credential: () => credentialSingleton2 ??= new DefaultAzureCredential25()
+    credential: () => credentialSingleton2 ??= new DefaultAzureCredential26()
   };
 }
 
@@ -27592,7 +28077,7 @@ function renderVerdict(v) {
 }
 var PrereqsCommand = class extends M8tCommand {
   static paths = [["prereqs"]];
-  static usage = Command51.Usage({
+  static usage = Command52.Usage({
     description: "Check (and optionally fix) everything m8t needs \u2014 to install, or for you to use it.",
     details: "Runs one of two phases. With no platform discoverable it checks INSTALL prerequisites: your Azure sign-in, subscription and directory rights, resource-provider registrations, soft-deleted Cognitive Services accounts (they hold their model quota until purged), and model quota. With a platform live it checks USAGE prerequisites for the signed-in account: the sign-in redirect URI, Foundry data-plane access, and Key Vault secrets access. Pass --fix to repair what is repairable, and --fix --for <upn> to set a teammate up (usage phase only). Read-only without --fix.",
     examples: [
@@ -27603,15 +28088,15 @@ var PrereqsCommand = class extends M8tCommand {
       ["Set a teammate up (needs role-assignment rights)", "$0 prereqs --fix --for alice@contoso.com"]
     ]
   });
-  fix = Option48.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
-  for_ = Option48.String("--for", { description: "UPN or object id of another person. Usage phase only." });
-  phase = Option48.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
-  region = Option48.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
-  model = Option48.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
-  clientId = Option48.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
-  subscription = Option48.String("--subscription");
-  resourceGroup = Option48.String("--resource-group");
-  output = Option48.String("--output");
+  fix = Option49.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
+  for_ = Option49.String("--for", { description: "UPN or object id of another person. Usage phase only." });
+  phase = Option49.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
+  region = Option49.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
+  model = Option49.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
+  clientId = Option49.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
+  subscription = Option49.String("--subscription");
+  resourceGroup = Option49.String("--resource-group");
+  output = Option49.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const json = mode === "json";
@@ -27667,7 +28152,7 @@ var PrereqsCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 
 // src/lib/profiles.ts
 import * as fs31 from "fs/promises";
@@ -27807,14 +28292,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command52.Usage({
+  static usage = Command53.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option49.String({ required: false });
-  subscription = Option49.String("--subscription");
-  list = Option49.Boolean("--list", false);
-  as = Option49.String("--as");
-  output = Option49.String("--output");
+  profile = Option50.String({ required: false });
+  subscription = Option50.String("--subscription");
+  list = Option50.Boolean("--list", false);
+  as = Option50.String("--as");
+  output = Option50.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -27871,7 +28356,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command53, Option as Option50 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -27917,14 +28402,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command53.Usage({
+  static usage = Command54.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option50.String({ required: false });
-  print = Option50.Boolean("--print", false);
-  output = Option50.String("--output");
-  resourceGroup = Option50.String("--resource-group", {
+  target = Option51.String({ required: false });
+  print = Option51.Boolean("--print", false);
+  output = Option51.String("--output");
+  resourceGroup = Option51.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -27968,7 +28453,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command54, Option as Option51 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient7 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -30368,28 +30853,28 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command54.Usage({
+  static usage = Command55.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes). Pass --live to actually run it.",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed.\n\nThe bare command is READ-ONLY. --live takes the other branch: a real model call and a commit to the worker's brain repo through a minted GitHub App token."
   });
-  worker = Option51.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  worker = Option52.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
   // Opting IN to the side effects, rather than opting out of them. This command's
   // own help has always described a dry run, but the bare invocation used to take
   // the live branch — a real model call and a commit to the brain repo — so anyone
   // acting on `--help` got the opposite of what they read.
-  live = Option51.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
-  dryRun = Option51.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
-  since = Option51.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option51.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option51.Boolean("--show-transcripts", false, {
+  live = Option52.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
+  dryRun = Option52.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
+  since = Option52.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option52.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option52.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option51.String("--subscription");
-  endpoint = Option51.String("--endpoint");
-  storageAccount = Option51.String("--storage-account", {
+  subscription = Option52.String("--subscription");
+  endpoint = Option52.String("--endpoint");
+  storageAccount = Option52.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
-  output = Option51.String("--output");
+  output = Option52.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -30740,7 +31225,7 @@ function defaultDeps(overrides) {
 
 // src/commands/conversations/sweep.ts
 import { createHash as createHash5 } from "crypto";
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command56, Option as Option53 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 import { TableClient as TableClient8 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient4 } from "@azure/ai-projects";
@@ -30866,7 +31351,7 @@ function defaultDeps2() {
 }
 var ConversationsSweepCommand = class extends M8tCommand {
   static paths = [["conversations", "sweep"]];
-  static usage = Command55.Usage({
+  static usage = Command56.Usage({
     category: "Conversations",
     description: "Delete expired public-visitor conversations (dry run by default)",
     details: `
@@ -30882,22 +31367,22 @@ var ConversationsSweepCommand = class extends M8tCommand {
       ["Delete, capped at 50", "m8t conversations sweep --delete --max 50"]
     ]
   });
-  doDelete = Option52.Boolean("--delete", false, {
+  doDelete = Option53.Boolean("--delete", false, {
     description: "Perform deletions (without this flag the command only reports)"
   });
-  principal = Option52.String("--principal", {
+  principal = Option53.String("--principal", {
     description: "Service-principal oid whose end-user keys are known-ephemeral (required with --delete; a dry run without it reports candidates grouped by principal)"
   });
-  max = Option52.String("--max", "200", { description: "Maximum deletions per run" });
-  graceDays = Option52.String("--grace-days", "14", {
+  max = Option53.String("--max", "200", { description: "Maximum deletions per run" });
+  graceDays = Option53.String("--grace-days", "14", {
     description: "Days past the 30-day key life before a conversation is eligible"
   });
-  lookbackDays = Option52.String("--lookback-days", "180", {
+  lookbackDays = Option53.String("--lookback-days", "180", {
     description: "How far back to scan ledger activity for candidates"
   });
-  subscription = Option52.String("--subscription", { description: "Azure subscription id override" });
-  endpoint = Option52.String("--endpoint", { description: "Foundry project endpoint override" });
-  storageAccount = Option52.String("--storage-account", {
+  subscription = Option53.String("--subscription", { description: "Azure subscription id override" });
+  endpoint = Option53.String("--endpoint", { description: "Foundry project endpoint override" });
+  storageAccount = Option53.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
   deps = defaultDeps2();
@@ -31025,7 +31510,7 @@ var ConversationsSweepCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/create.ts
-import { Command as Command56, Option as Option53 } from "clipanion";
+import { Command as Command57, Option as Option54 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -31263,7 +31748,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command56.Usage({
+  static usage = Command57.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -31272,16 +31757,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option53.String("--resource-group");
-  location = Option53.String("--location");
-  account = Option53.String("--account");
-  project = Option53.String("--project", "m8t");
-  model = Option53.String("--model", "gpt-4.1-mini");
-  modelVersion = Option53.String("--model-version", "2025-04-14");
-  capacity = Option53.String("--capacity", "50");
-  subscription = Option53.String("--subscription");
-  skipQuotaCheck = Option53.Boolean("--skip-quota-check", false);
-  output = Option53.String("--output");
+  resourceGroup = Option54.String("--resource-group");
+  location = Option54.String("--location");
+  account = Option54.String("--account");
+  project = Option54.String("--project", "m8t");
+  model = Option54.String("--model", "gpt-4.1-mini");
+  modelVersion = Option54.String("--model-version", "2025-04-14");
+  capacity = Option54.String("--capacity", "50");
+  subscription = Option54.String("--subscription");
+  skipQuotaCheck = Option54.Boolean("--skip-quota-check", false);
+  output = Option54.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -31353,22 +31838,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command57, Option as Option54 } from "clipanion";
+import { Command as Command58, Option as Option55 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential3 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command57.Usage({
+  static usage = Command58.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option54.String("--endpoint");
-  consecutive = Option54.String("--consecutive", "3");
-  attempts = Option54.String("--attempts", "60");
-  interval = Option54.String("--interval", "5");
-  subscription = Option54.String("--subscription");
-  output = Option54.String("--output");
+  endpoint = Option55.String("--endpoint");
+  consecutive = Option55.String("--consecutive", "3");
+  attempts = Option55.String("--attempts", "60");
+  interval = Option55.String("--interval", "5");
+  subscription = Option55.String("--subscription");
+  output = Option55.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -31402,7 +31887,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command58, Option as Option55 } from "clipanion";
+import { Command as Command59, Option as Option56 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -31454,7 +31939,7 @@ function preflightRenderable(results) {
 }
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command58.Usage({
+  static usage = Command59.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), every Azure resource provider the install uses (registering any that are missing), soft-deleted Cognitive Services accounts (they keep their model quota until purged, so quota can read free and the model deployment still fail), and \u2014 with --location \u2014 model quota in the target region. Exits non-zero with the exact failing check + remedy. `m8t prereqs` runs the same substrate checks on their own.",
     examples: [
@@ -31463,9 +31948,9 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option55.String("--client-id");
-  subscription = Option55.String("--subscription");
-  location = Option55.String("--location", {
+  clientId = Option56.String("--client-id");
+  subscription = Option56.String("--subscription");
+  location = Option56.String("--location", {
     description: "Target region. Enables the model-quota check \u2014 without it, quota is not verified."
   });
   async executeCommand() {
@@ -31565,7 +32050,7 @@ ${colors.error("  " + why)}
 import * as fs34 from "fs";
 import * as os15 from "os";
 import * as path37 from "path";
-import { Command as Command59, Option as Option56 } from "clipanion";
+import { Command as Command60, Option as Option57 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -31930,12 +32415,12 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.73";
+var DEFAULT_INSTALLER_TAG = "v0.1.74";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command59.Usage({
+  static usage = Command60.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status` and `reap`, and threads your Azure object id so the installer can grant you the platform's data-plane roles itself.",
     examples: [
@@ -31946,31 +32431,31 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  location = Option56.String("--location");
-  resourceGroup = Option56.String("--resource-group");
-  clientId = Option56.String("--client-id");
-  subscription = Option56.String("--subscription");
-  installerTag = Option56.String("--installer-tag");
+  location = Option57.String("--location");
+  resourceGroup = Option57.String("--resource-group");
+  clientId = Option57.String("--client-id");
+  subscription = Option57.String("--subscription");
+  installerTag = Option57.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option56.String("--installer-image");
-  gatewayImageRef = Option56.String("--gateway-image-ref");
-  githubAppCreds = Option56.String("--github-app-creds");
-  contactEmail = Option56.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  company = Option56.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  installerImage = Option57.String("--installer-image");
+  gatewayImageRef = Option57.String("--gateway-image-ref");
+  githubAppCreds = Option57.String("--github-app-creds");
+  contactEmail = Option57.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option57.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   // Value-carrying on purpose: a bare --force would be cargo-culted into
   // runbooks and harness prompts and erode the protection, whereas a faithful
   // paste can never accidentally carry the victim group's name. It AUTHORIZES
   // the target; --resource-group is what CHOOSES it.
-  reinstallInto = Option56.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
-  org = Option56.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
-  noBrains = Option56.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
+  reinstallInto = Option57.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  org = Option57.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
+  noBrains = Option57.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
   // The opt-out TELEMETRY.md names. Without it there is no way to decline at
   // install time — the ACI env is built entirely from these options, so a
   // founder setting FOUNDRY_TRACING in their own shell reaches nothing. A
   // privacy notice that documents a control has to be a control that exists.
-  foundryTracing = Option56.String("--foundry-tracing", { description: "Where agent traces go: project (default, your own App Insights) | account (legacy shared) | skip (no tracing \u2014 you lose the record of what your agents did)." });
+  foundryTracing = Option57.String("--foundry-tracing", { description: "Where agent traces go: project (default, your own App Insights) | account (legacy shared) | skip (no tracing \u2014 you lose the record of what your agents did)." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -32132,7 +32617,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command61, Option as Option58 } from "clipanion";
+import { Command as Command62, Option as Option59 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -34309,7 +34794,7 @@ async function uninstallCompanion(options) {
 // src/commands/companion/install.ts
 import * as os19 from "os";
 import * as path43 from "path";
-import { Command as Command60, Option as Option57 } from "clipanion";
+import { Command as Command61, Option as Option58 } from "clipanion";
 
 // src/lib/companion-channel.ts
 async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps = {}) {
@@ -34440,7 +34925,7 @@ Version: ${state.version}
 }
 var CompanionInstallCommand = class extends M8tCommand {
   static paths = [["companion", "install"]];
-  static usage = Command60.Usage({
+  static usage = Command61.Usage({
     description: "Install the desktop companions for this user from the release channel.",
     examples: [
       ["Install the released build", "$0 companion install"],
@@ -34450,10 +34935,10 @@ var CompanionInstallCommand = class extends M8tCommand {
       ]
     ]
   });
-  from = Option57.String("--from", {
+  from = Option58.String("--from", {
     description: "A locally staged build directory instead of the released one."
   });
-  resourceGroup = Option57.String("--resource-group", {
+  resourceGroup = Option58.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -34668,7 +35153,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
   // runbooks and shakedown recipes that a founder may already be part-way
   // through — it prints a deprecation notice and does the right thing.
   static paths = [["bootstrap", "status"], ["bootstrap", "finish"]];
-  static usage = Command61.Usage({
+  static usage = Command62.Usage({
     description: "Show the cloud installer's live status (phase, progress, result) \u2014 and finish the local setup when it lands.",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.\n\nOn reaching done under --watch this also completes the local half of the install, which nothing else in the bootstrap path can do: it registers the webapp's sign-in redirect URI (the installer runs as a managed identity with no directory role, and at launch time the gateway FQDN did not exist yet), writes ~/.m8t/repo-root and the gateway discovery cache, and seeds your advisors' brains from the onboarding intake. Re-runnable \u2014 `m8t bootstrap finish` is a deprecated alias that does exactly this on an already-done install.",
     examples: [
@@ -34677,12 +35162,12 @@ var BootstrapStatusCommand = class extends M8tCommand {
       ["Redo the local setup on a finished install", "$0 bootstrap status --finalize --repo-root /path/to/m8t"]
     ]
   });
-  watch = Option58.Boolean("--watch", false);
-  output = Option58.String("--output");
-  repoRoot = Option58.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
-  finalize = Option58.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
-  subscription = Option58.String("--subscription");
-  resourceGroup = Option58.String("--resource-group");
+  watch = Option59.Boolean("--watch", false);
+  output = Option59.String("--output");
+  repoRoot = Option59.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
+  finalize = Option59.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
+  subscription = Option59.String("--subscription");
+  resourceGroup = Option59.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -34815,7 +35300,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command62, Option as Option59 } from "clipanion";
+import { Command as Command63, Option as Option60 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -34909,7 +35394,7 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command62.Usage({
+  static usage = Command63.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.\n\n--sweep-orphans is a DIFFERENT and much broader mode: instead of reaping this install, it scans the WHOLE SUBSCRIPTION for m8t role assignments left behind by installs whose resources are gone \u2014 orphaned installer Owner-at-subscription-scope grants and orphaned gateway subscription-scope roles. It is a dry run that only lists what it found unless you also pass --yes, which deletes them.",
     examples: [
@@ -34919,9 +35404,9 @@ var BootstrapReapCommand = class extends M8tCommand {
       ["\u2026and delete them", "$0 bootstrap reap --sweep-orphans --yes"]
     ]
   });
-  force = Option59.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
-  sweepOrphans = Option59.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
-  yes = Option59.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
+  force = Option60.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
+  sweepOrphans = Option60.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
+  yes = Option60.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -35015,7 +35500,7 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 };
 
 // src/commands/bootstrap/ui.ts
-import { Command as Command63, Option as Option60 } from "clipanion";
+import { Command as Command64, Option as Option61 } from "clipanion";
 
 // src/lib/bootstrap-ui.ts
 import * as fs40 from "fs";
@@ -35090,7 +35575,7 @@ function renderDeprecationNotice() {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command63.Usage({
+  static usage = Command64.Usage({
     description: "DEPRECATED \u2014 does nothing. Use `m8t bootstrap profile` instead.",
     details: [
       "The local onboarding chat has been retired. Your details are collected by",
@@ -35110,14 +35595,14 @@ var BootstrapUiCommand = class extends M8tCommand {
   // Accepted and ignored, deliberately: removing them would turn an old script's
   // harmless no-op into an "unknown option" failure mid-install. CLI-rewrite: drop
   // the whole surface when the rewrite lands.
-  repoRoot = Option60.String("--repo-root", { description: "Ignored (deprecated)." });
-  port = Option60.String("--port", "3000", { description: "Ignored (deprecated)." });
-  endpoint = Option60.String("--endpoint", { description: "Ignored (deprecated)." });
-  prepOnly = Option60.Boolean("--prep-only", false, { description: "Ignored (deprecated)." });
-  skipInstall = Option60.Boolean("--skip-install", false, { description: "Ignored (deprecated)." });
-  foreground = Option60.Boolean("--foreground", false, { description: "Ignored (deprecated)." });
-  voice = Option60.Boolean("--voice", false, { description: "Ignored (deprecated)." });
-  stop = Option60.Boolean("--stop", false, {
+  repoRoot = Option61.String("--repo-root", { description: "Ignored (deprecated)." });
+  port = Option61.String("--port", "3000", { description: "Ignored (deprecated)." });
+  endpoint = Option61.String("--endpoint", { description: "Ignored (deprecated)." });
+  prepOnly = Option61.Boolean("--prep-only", false, { description: "Ignored (deprecated)." });
+  skipInstall = Option61.Boolean("--skip-install", false, { description: "Ignored (deprecated)." });
+  foreground = Option61.Boolean("--foreground", false, { description: "Ignored (deprecated)." });
+  voice = Option61.Boolean("--voice", false, { description: "Ignored (deprecated)." });
+  stop = Option61.Boolean("--stop", false, {
     description: "Shut down a local chat UI left running by an earlier version of this command."
   });
   // Not `async`: there is nothing left to await. Everything this command used to
@@ -35139,7 +35624,7 @@ var BootstrapUiCommand = class extends M8tCommand {
 
 // src/commands/bootstrap/profile.ts
 import * as readline3 from "readline/promises";
-import { Command as Command64, Option as Option61 } from "clipanion";
+import { Command as Command65, Option as Option62 } from "clipanion";
 
 // src/lib/profile-collect.ts
 init_errors();
@@ -35308,7 +35793,7 @@ async function openChatInvite(deps = {}) {
 // src/commands/bootstrap/profile.ts
 var BootstrapProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "profile"]];
-  static usage = Command64.Usage({
+  static usage = Command65.Usage({
     description: "Confirm your email + your Microsoft startup advisor, and open Ezra to talk to while the install runs.",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Records the two",
@@ -35328,12 +35813,12 @@ var BootstrapProfileCommand = class extends M8tCommand {
       ["Skip the browser hand-off", "$0 bootstrap profile --founder-email you@example.com --print"]
     ]
   });
-  founderEmail = Option61.String("--founder-email", { description: "The founder's contact address \u2014 Ezra copies them on its outbound mail." });
-  advisorName = Option61.String("--advisor-name", { description: "Their Microsoft startup advisor's name." });
-  advisorEmail = Option61.String("--advisor-email", { description: "Their Microsoft startup advisor's email." });
-  noAdvisor = Option61.Boolean("--no-advisor", false, { description: "Record that they have no startup advisor to add (or don't know it yet)." });
-  noChat = Option61.Boolean("--no-chat", false, { description: "Record the answers without opening the hosted Ezra." });
-  print = Option61.Boolean("--print", false, { description: "Print the chat link instead of opening a browser (headless / SSH)." });
+  founderEmail = Option62.String("--founder-email", { description: "The founder's contact address \u2014 Ezra copies them on its outbound mail." });
+  advisorName = Option62.String("--advisor-name", { description: "Their Microsoft startup advisor's name." });
+  advisorEmail = Option62.String("--advisor-email", { description: "Their Microsoft startup advisor's email." });
+  noAdvisor = Option62.Boolean("--no-advisor", false, { description: "Record that they have no startup advisor to add (or don't know it yet)." });
+  noChat = Option62.Boolean("--no-chat", false, { description: "Record the answers without opening the hosted Ezra." });
+  print = Option62.Boolean("--print", false, { description: "Print the chat link instead of opening a browser (headless / SSH)." });
   async executeCommand() {
     const stdin = this.context.stdin;
     const stdout = this.context.stdout;
@@ -35426,10 +35911,10 @@ var BootstrapProfileCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command65, Option as Option62 } from "clipanion";
+import { Command as Command66, Option as Option63 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command65.Usage({
+  static usage = Command66.Usage({
     description: "Seed your advisors' brains with how to reach you, from what you confirmed at `m8t bootstrap profile`.",
     details: [
       "Renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines)",
@@ -35446,11 +35931,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Seed now (idempotent)", "$0 bootstrap seed-profile"]
     ]
   });
-  endpoint = Option62.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option62.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
-  watch = Option62.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option62.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option62.String("--github-app-creds");
+  endpoint = Option63.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option63.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
+  watch = Option63.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option63.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option63.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -35538,7 +36023,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 import * as fs41 from "fs";
 import * as os22 from "os";
 import * as path46 from "path";
-import { Command as Command66, Option as Option63 } from "clipanion";
+import { Command as Command67, Option as Option64 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -35620,7 +36105,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command66.Usage({
+  static usage = Command67.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -35628,11 +36113,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option63.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option63.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option63.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option63.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option63.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option64.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option64.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option64.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option64.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option64.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -35682,7 +36167,7 @@ var TelemetryEnrollCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/bridge.ts
-import { Command as Command67, Option as Option64 } from "clipanion";
+import { Command as Command68, Option as Option65 } from "clipanion";
 
 // ../../packages/companion-bridge-contract/src/index.ts
 var COMPANION_MESSAGE_MAX_CODE_POINTS = 32768;
@@ -37149,14 +37634,14 @@ async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps3) {
     return 3;
   }
 }
-var CompanionBridgeCommand = class extends Command67 {
+var CompanionBridgeCommand = class extends Command68 {
   static paths = [["companion", "_bridge"]];
   /**
    * One process serving many requests instead of one per request, so the
    * session keeps its authenticated context between them. A CLI predating the
    * flag rejects it outright, which is how the app knows to fall back.
    */
-  serve = Option64.Boolean("--serve", false);
+  serve = Option65.Boolean("--serve", false);
   async execute() {
     if (this.serve) {
       return runCompanionBridgeServe(
@@ -37174,7 +37659,7 @@ var CompanionBridgeCommand = class extends Command67 {
 };
 
 // src/commands/companion/status.ts
-import { Command as Command68 } from "clipanion";
+import { Command as Command69 } from "clipanion";
 async function withTimeout(work, ms) {
   let timer;
   try {
@@ -37246,7 +37731,7 @@ Run: m8t companion install
 }
 var CompanionStatusCommand = class extends M8tCommand {
   static paths = [["companion", "status"]];
-  static usage = Command68.Usage({
+  static usage = Command69.Usage({
     description: "Verify the installed desktop companion without launching it."
   });
   async executeCommand() {
@@ -37260,7 +37745,7 @@ var CompanionStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/repair.ts
-import { Command as Command69, Option as Option65 } from "clipanion";
+import { Command as Command70, Option as Option66 } from "clipanion";
 async function runCompanionRepairCommand(stdout, repair) {
   const state = await repair();
   if (state.state === "not-released") {
@@ -37279,10 +37764,10 @@ async function runCompanionRepairCommand(stdout, repair) {
 }
 var CompanionRepairCommand = class extends M8tCommand {
   static paths = [["companion", "repair"]];
-  static usage = Command69.Usage({
+  static usage = Command70.Usage({
     description: "Restore the desktop companions and start-at-login state."
   });
-  resourceGroup = Option65.String("--resource-group", {
+  resourceGroup = Option66.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -37300,7 +37785,7 @@ var CompanionRepairCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/uninstall.ts
-import { Command as Command70 } from "clipanion";
+import { Command as Command71 } from "clipanion";
 async function runCompanionUninstallCommand(stdout, uninstall) {
   const state = await uninstall();
   if (state.state !== "not-installed") {
@@ -37312,7 +37797,7 @@ async function runCompanionUninstallCommand(stdout, uninstall) {
 }
 var CompanionUninstallCommand = class extends M8tCommand {
   static paths = [["companion", "uninstall"]];
-  static usage = Command70.Usage({
+  static usage = Command71.Usage({
     description: "Remove only this user's desktop companion installation."
   });
   async executeCommand() {
@@ -37373,6 +37858,7 @@ cli.register(PlatformConvergeCommand);
 cli.register(PlatformClearIntentCommand);
 cli.register(PlatformRequestUpdateCommand);
 cli.register(PlatformSeedStampCommand);
+cli.register(PlatformGatewayAdoptCommand);
 cli.register(PlatformPolicyCommand);
 cli.register(PlatformEnableCostReportCommand);
 cli.register(PlatformEmailCommand);