@m8t-stack/cli 0.2.125 → 0.2.127

package/dist/cli.js

@@ -128,18 +128,18 @@ function parseBrainLink(metadata) {
   if (!raw)
     return void 0;
   try {
-    const obj = JSON.parse(raw);
-    if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0)
+    const obj2 = JSON.parse(raw);
+    if (!obj2 || typeof obj2.repo !== "string" || obj2.repo.length === 0)
       return void 0;
     return {
-      repo: obj.repo,
-      branch: typeof obj.branch === "string" && obj.branch ? obj.branch : "main",
-      topology: obj.topology === "shared" ? "shared" : "per-worker",
-      schemaVersion: typeof obj.schemaVersion === "string" && obj.schemaVersion ? obj.schemaVersion : "1",
-      credentialRef: typeof obj.credentialRef === "string" ? obj.credentialRef : "",
-      ...typeof obj.installationId === "string" ? { installationId: obj.installationId } : {},
-      ...typeof obj.instanceFolder === "string" ? { instanceFolder: obj.instanceFolder } : {},
-      ...obj.transport === "gateway-mcp-v1" || obj.transport === "github-mcp" ? { transport: obj.transport } : {}
+      repo: obj2.repo,
+      branch: typeof obj2.branch === "string" && obj2.branch ? obj2.branch : "main",
+      topology: obj2.topology === "shared" ? "shared" : "per-worker",
+      schemaVersion: typeof obj2.schemaVersion === "string" && obj2.schemaVersion ? obj2.schemaVersion : "1",
+      credentialRef: typeof obj2.credentialRef === "string" ? obj2.credentialRef : "",
+      ...typeof obj2.installationId === "string" ? { installationId: obj2.installationId } : {},
+      ...typeof obj2.instanceFolder === "string" ? { instanceFolder: obj2.instanceFolder } : {},
+      ...obj2.transport === "gateway-mcp-v1" || obj2.transport === "github-mcp" ? { transport: obj2.transport } : {}
     };
   } catch {
     return void 0;
@@ -342,7 +342,7 @@ function signAppJwt(args) {
   const now = Math.floor(Date.now() / 1e3);
   const header = { alg: "RS256", typ: "JWT" };
   const payload = { iat: now - 30, exp: now - 30 + 600, iss: appIdNum };
-  const b64url = (obj) => Buffer.from(JSON.stringify(obj)).toString("base64url");
+  const b64url = (obj2) => Buffer.from(JSON.stringify(obj2)).toString("base64url");
   const unsigned = `${b64url(header)}.${b64url(payload)}`;
   const sign = createSign("RSA-SHA256");
   sign.update(unsigned);
@@ -605,8 +605,8 @@ async function runChecksOnce(args) {
       checks.installationsListable = { ok: false, error: `HTTP ${String(res.status)}` };
       return { ok: false, transient: isTransientHttpStatus(res.status), checks };
     }
-    const arr = await res.json();
-    checks.installationsListable = { ok: true, count: arr.length };
+    const arr2 = await res.json();
+    checks.installationsListable = { ok: true, count: arr2.length };
   } catch (e) {
     checks.installationsListable = { ok: false, error: e.message };
     return { ok: false, transient: isTransientErr(e), checks };
@@ -1454,7 +1454,7 @@ function installFoundryDnsShim() {
 }
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.125";
+var CLI_VERSION = "0.2.127";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1972,18 +1972,18 @@ function maybeObj(x) {
   }
   return x ?? {};
 }
-function isEmptyObj(obj) {
-  if (!obj)
+function isEmptyObj(obj2) {
+  if (!obj2)
     return true;
-  for (const _k in obj)
+  for (const _k in obj2)
     return false;
   return true;
 }
-function hasOwn(obj, key2) {
-  return Object.prototype.hasOwnProperty.call(obj, key2);
+function hasOwn(obj2, key2) {
+  return Object.prototype.hasOwnProperty.call(obj2, key2);
 }
-function isObj(obj) {
-  return obj != null && typeof obj === "object" && !Array.isArray(obj);
+function isObj(obj2) {
+  return obj2 != null && typeof obj2 === "object" && !Array.isArray(obj2);
 }
 var validatePositiveInteger = (name, n) => {
   if (typeof n !== "number" || !Number.isInteger(n)) {
@@ -2234,7 +2234,7 @@ var formatters = {
 var RFC1738 = "RFC1738";
 
 // ../../node_modules/.pnpm/openai@6.49.0_ws@8.21.1_zod@4.4.3/node_modules/openai/internal/qs/utils.mjs
-var has = (obj, key2) => (has = Object.hasOwn ?? Function.prototype.call.bind(Object.prototype.hasOwnProperty), has(obj, key2));
+var has = (obj2, key2) => (has = Object.hasOwn ?? Function.prototype.call.bind(Object.prototype.hasOwnProperty), has(obj2, key2));
 var hex_table = /* @__PURE__ */ (() => {
   const array = [];
   for (let i = 0; i < 256; ++i) {
@@ -2243,15 +2243,15 @@ var hex_table = /* @__PURE__ */ (() => {
   return array;
 })();
 var limit = 1024;
-var encode = (str4, _defaultEncoder, charset, _kind, format) => {
-  if (str4.length === 0) {
-    return str4;
+var encode = (str5, _defaultEncoder, charset, _kind, format) => {
+  if (str5.length === 0) {
+    return str5;
   }
-  let string = str4;
-  if (typeof str4 === "symbol") {
-    string = Symbol.prototype.toString.call(str4);
-  } else if (typeof str4 !== "string") {
-    string = String(str4);
+  let string = str5;
+  if (typeof str5 === "symbol") {
+    string = Symbol.prototype.toString.call(str5);
+  } else if (typeof str5 !== "string") {
+    string = String(str5);
   }
   if (charset === "iso-8859-1") {
     return escape(string).replace(/%u[0-9a-f]{4}/gi, function($0) {
@@ -2261,7 +2261,7 @@ var encode = (str4, _defaultEncoder, charset, _kind, format) => {
   let out = "";
   for (let j = 0; j < string.length; j += limit) {
     const segment = string.length >= limit ? string.slice(j, j + limit) : string;
-    const arr = [];
+    const arr2 = [];
     for (let i = 0; i < segment.length; ++i) {
       let c = segment.charCodeAt(i);
       if (c === 45 || // -
@@ -2272,34 +2272,34 @@ var encode = (str4, _defaultEncoder, charset, _kind, format) => {
       c >= 65 && c <= 90 || // a-z
       c >= 97 && c <= 122 || // A-Z
       format === RFC1738 && (c === 40 || c === 41)) {
-        arr[arr.length] = segment.charAt(i);
+        arr2[arr2.length] = segment.charAt(i);
         continue;
       }
       if (c < 128) {
-        arr[arr.length] = hex_table[c];
+        arr2[arr2.length] = hex_table[c];
         continue;
       }
       if (c < 2048) {
-        arr[arr.length] = hex_table[192 | c >> 6] + hex_table[128 | c & 63];
+        arr2[arr2.length] = hex_table[192 | c >> 6] + hex_table[128 | c & 63];
         continue;
       }
       if (c < 55296 || c >= 57344) {
-        arr[arr.length] = hex_table[224 | c >> 12] + hex_table[128 | c >> 6 & 63] + hex_table[128 | c & 63];
+        arr2[arr2.length] = hex_table[224 | c >> 12] + hex_table[128 | c >> 6 & 63] + hex_table[128 | c & 63];
         continue;
       }
       i += 1;
       c = 65536 + ((c & 1023) << 10 | segment.charCodeAt(i) & 1023);
-      arr[arr.length] = hex_table[240 | c >> 18] + hex_table[128 | c >> 12 & 63] + hex_table[128 | c >> 6 & 63] + hex_table[128 | c & 63];
+      arr2[arr2.length] = hex_table[240 | c >> 18] + hex_table[128 | c >> 12 & 63] + hex_table[128 | c >> 6 & 63] + hex_table[128 | c & 63];
     }
-    out += arr.join("");
+    out += arr2.join("");
   }
   return out;
 };
-function is_buffer(obj) {
-  if (!obj || typeof obj !== "object") {
+function is_buffer(obj2) {
+  if (!obj2 || typeof obj2 !== "object") {
     return false;
   }
-  return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));
+  return !!(obj2.constructor && obj2.constructor.isBuffer && obj2.constructor.isBuffer(obj2));
 }
 function maybe_map(val, fn) {
   if (isArray(val)) {
@@ -2325,8 +2325,8 @@ var array_prefix_generators = {
     return String(prefix);
   }
 };
-var push_to_array = function(arr, value_or_array) {
-  Array.prototype.push.apply(arr, isArray(value_or_array) ? value_or_array : [value_or_array]);
+var push_to_array = function(arr2, value_or_array) {
+  Array.prototype.push.apply(arr2, isArray(value_or_array) ? value_or_array : [value_or_array]);
 };
 var toISOString;
 var defaults = {
@@ -2356,7 +2356,7 @@ function is_non_nullish_primitive(v) {
 }
 var sentinel = {};
 function inner_stringify(object, prefix, generateArrayPrefix, commaRoundTrip, allowEmptyArrays, strictNullHandling, skipNulls, encodeDotInKeys, encoder, filter, sort, allowDots, serializeDate, format, formatter, encodeValuesOnly, charset, sideChannel) {
-  let obj = object;
+  let obj2 = object;
   let tmp_sc = sideChannel;
   let step = 0;
   let find_flag = false;
@@ -2375,68 +2375,68 @@ function inner_stringify(object, prefix, generateArrayPrefix, commaRoundTrip, al
     }
   }
   if (typeof filter === "function") {
-    obj = filter(prefix, obj);
-  } else if (obj instanceof Date) {
-    obj = serializeDate?.(obj);
-  } else if (generateArrayPrefix === "comma" && isArray(obj)) {
-    obj = maybe_map(obj, function(value) {
+    obj2 = filter(prefix, obj2);
+  } else if (obj2 instanceof Date) {
+    obj2 = serializeDate?.(obj2);
+  } else if (generateArrayPrefix === "comma" && isArray(obj2)) {
+    obj2 = maybe_map(obj2, function(value) {
       if (value instanceof Date) {
         return serializeDate?.(value);
       }
       return value;
     });
   }
-  if (obj === null) {
+  if (obj2 === null) {
     if (strictNullHandling) {
       return encoder && !encodeValuesOnly ? (
         // @ts-expect-error
         encoder(prefix, defaults.encoder, charset, "key", format)
       ) : prefix;
     }
-    obj = "";
+    obj2 = "";
   }
-  if (is_non_nullish_primitive(obj) || is_buffer(obj)) {
+  if (is_non_nullish_primitive(obj2) || is_buffer(obj2)) {
     if (encoder) {
       const key_value = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset, "key", format);
       return [
         formatter?.(key_value) + "=" + // @ts-expect-error
-        formatter?.(encoder(obj, defaults.encoder, charset, "value", format))
+        formatter?.(encoder(obj2, defaults.encoder, charset, "value", format))
       ];
     }
-    return [formatter?.(prefix) + "=" + formatter?.(String(obj))];
+    return [formatter?.(prefix) + "=" + formatter?.(String(obj2))];
   }
   const values = [];
-  if (typeof obj === "undefined") {
+  if (typeof obj2 === "undefined") {
     return values;
   }
   let obj_keys;
-  if (generateArrayPrefix === "comma" && isArray(obj)) {
+  if (generateArrayPrefix === "comma" && isArray(obj2)) {
     if (encodeValuesOnly && encoder) {
-      obj = maybe_map(obj, encoder);
+      obj2 = maybe_map(obj2, encoder);
     }
-    obj_keys = [{ value: obj.length > 0 ? obj.join(",") || null : void 0 }];
+    obj_keys = [{ value: obj2.length > 0 ? obj2.join(",") || null : void 0 }];
   } else if (isArray(filter)) {
     obj_keys = filter;
   } else {
-    const keys = Object.keys(obj);
+    const keys = Object.keys(obj2);
     obj_keys = sort ? keys.sort(sort) : keys;
   }
   const encoded_prefix = encodeDotInKeys ? String(prefix).replace(/\./g, "%2E") : String(prefix);
-  const adjusted_prefix = commaRoundTrip && isArray(obj) && obj.length === 1 ? encoded_prefix + "[]" : encoded_prefix;
-  if (allowEmptyArrays && isArray(obj) && obj.length === 0) {
+  const adjusted_prefix = commaRoundTrip && isArray(obj2) && obj2.length === 1 ? encoded_prefix + "[]" : encoded_prefix;
+  if (allowEmptyArrays && isArray(obj2) && obj2.length === 0) {
     return adjusted_prefix + "[]";
   }
   for (let j = 0; j < obj_keys.length; ++j) {
     const key2 = obj_keys[j];
     const value = (
       // @ts-ignore
-      typeof key2 === "object" && typeof key2.value !== "undefined" ? key2.value : obj[key2]
+      typeof key2 === "object" && typeof key2.value !== "undefined" ? key2.value : obj2[key2]
     );
     if (skipNulls && value === null) {
       continue;
     }
     const encoded_key = allowDots && encodeDotInKeys ? key2.replace(/\./g, "%2E") : key2;
-    const key_prefix = isArray(obj) ? typeof generateArrayPrefix === "function" ? generateArrayPrefix(adjusted_prefix, encoded_key) : adjusted_prefix : adjusted_prefix + (allowDots ? "." + encoded_key : "[" + encoded_key + "]");
+    const key_prefix = isArray(obj2) ? typeof generateArrayPrefix === "function" ? generateArrayPrefix(adjusted_prefix, encoded_key) : adjusted_prefix : adjusted_prefix + (allowDots ? "." + encoded_key : "[" + encoded_key + "]");
     sideChannel.set(object, step);
     const valueSideChannel = /* @__PURE__ */ new WeakMap();
     valueSideChannel.set(sentinel, sideChannel);
@@ -2450,7 +2450,7 @@ function inner_stringify(object, prefix, generateArrayPrefix, commaRoundTrip, al
       skipNulls,
       encodeDotInKeys,
       // @ts-ignore
-      generateArrayPrefix === "comma" && encodeValuesOnly && isArray(obj) ? null : encoder,
+      generateArrayPrefix === "comma" && encodeValuesOnly && isArray(obj2) ? null : encoder,
       filter,
       sort,
       allowDots,
@@ -2527,25 +2527,25 @@ function normalize_stringify_options(opts = defaults) {
   };
 }
 function stringify(object, opts = {}) {
-  let obj = object;
+  let obj2 = object;
   const options = normalize_stringify_options(opts);
   let obj_keys;
   let filter;
   if (typeof options.filter === "function") {
     filter = options.filter;
-    obj = filter("", obj);
+    obj2 = filter("", obj2);
   } else if (isArray(options.filter)) {
     filter = options.filter;
     obj_keys = filter;
   }
   const keys = [];
-  if (typeof obj !== "object" || obj === null) {
+  if (typeof obj2 !== "object" || obj2 === null) {
     return "";
   }
   const generateArrayPrefix = array_prefix_generators[options.arrayFormat];
   const commaRoundTrip = generateArrayPrefix === "comma" && options.commaRoundTrip;
   if (!obj_keys) {
-    obj_keys = Object.keys(obj);
+    obj_keys = Object.keys(obj2);
   }
   if (options.sort) {
     obj_keys.sort(options.sort);
@@ -2553,11 +2553,11 @@ function stringify(object, opts = {}) {
   const sideChannel = /* @__PURE__ */ new WeakMap();
   for (let i = 0; i < obj_keys.length; ++i) {
     const key2 = obj_keys[i];
-    if (options.skipNulls && obj[key2] === null) {
+    if (options.skipNulls && obj2[key2] === null) {
       continue;
     }
     push_to_array(keys, inner_stringify(
-      obj[key2],
+      obj2[key2],
       key2,
       // @ts-expect-error
       generateArrayPrefix,
@@ -2610,9 +2610,9 @@ function concatBytes(buffers) {
   return output;
 }
 var encodeUTF8_;
-function encodeUTF8(str4) {
+function encodeUTF8(str5) {
   let encoder;
-  return (encodeUTF8_ ?? (encoder = new globalThis.TextEncoder(), encodeUTF8_ = encoder.encode.bind(encoder)))(str4);
+  return (encodeUTF8_ ?? (encoder = new globalThis.TextEncoder(), encodeUTF8_ = encoder.encode.bind(encoder)))(str5);
 }
 var decodeUTF8_;
 function decodeUTF8(bytes) {
@@ -3052,12 +3052,12 @@ var SSEDecoder = class {
     return null;
   }
 };
-function partition(str4, delimiter) {
-  const index = str4.indexOf(delimiter);
+function partition(str5, delimiter) {
+  const index = str5.indexOf(delimiter);
   if (index !== -1) {
-    return [str4.substring(0, index), delimiter, str4.substring(index + delimiter.length)];
+    return [str5.substring(0, index), delimiter, str5.substring(index + delimiter.length)];
   }
-  return [str4, "", ""];
+  return [str5, "", ""];
 }
 
 // ../../node_modules/.pnpm/openai@6.49.0_ws@8.21.1_zod@4.4.3/node_modules/openai/internal/parse.mjs
@@ -3786,8 +3786,8 @@ var APIResource = class {
 };
 
 // ../../node_modules/.pnpm/openai@6.49.0_ws@8.21.1_zod@4.4.3/node_modules/openai/internal/utils/path.mjs
-function encodeURIPath(str4) {
-  return str4.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
+function encodeURIPath(str5) {
+  return str5.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
 var createPathTagFunction = (pathEncoder = encodeURIPath) => function path47(statics, ...params) {
@@ -4767,21 +4767,21 @@ var _parseJSON = (jsonString, allow) => {
   const parseObj = () => {
     index++;
     skipBlank();
-    const obj = {};
+    const obj2 = {};
     try {
       while (jsonString[index] !== "}") {
         skipBlank();
         if (index >= length && Allow.OBJ & allow)
-          return obj;
+          return obj2;
         const key2 = parseStr();
         skipBlank();
         index++;
         try {
           const value = parseAny();
-          Object.defineProperty(obj, key2, { value, writable: true, enumerable: true, configurable: true });
+          Object.defineProperty(obj2, key2, { value, writable: true, enumerable: true, configurable: true });
         } catch (e) {
           if (Allow.OBJ & allow)
-            return obj;
+            return obj2;
           else
             throw e;
         }
@@ -4791,19 +4791,19 @@ var _parseJSON = (jsonString, allow) => {
       }
     } catch (e) {
       if (Allow.OBJ & allow)
-        return obj;
+        return obj2;
       else
         markPartialJSON("Expected '}' at end of object");
     }
     index++;
-    return obj;
+    return obj2;
   };
   const parseArr = () => {
     index++;
-    const arr = [];
+    const arr2 = [];
     try {
       while (jsonString[index] !== "]") {
-        arr.push(parseAny());
+        arr2.push(parseAny());
         skipBlank();
         if (jsonString[index] === ",") {
           index++;
@@ -4811,12 +4811,12 @@ var _parseJSON = (jsonString, allow) => {
       }
     } catch (e) {
       if (Allow.ARR & allow) {
-        return arr;
+        return arr2;
       }
       markPartialJSON("Expected ']' at end of array");
     }
     index++;
-    return arr;
+    return arr2;
   };
   const parseNum = () => {
     if (index === 0) {
@@ -5408,7 +5408,7 @@ function isCompleteAudio(audio) {
 function str(x) {
   return JSON.stringify(x);
 }
-function assertIsEmpty(obj) {
+function assertIsEmpty(obj2) {
   return;
 }
 function assertNever(_x) {
@@ -12349,12 +12349,12 @@ var OpenAI = class {
       retriesRemaining = maxRetries;
     }
     await this.prepareOptions(options);
-    const { req: req2, url, timeout } = await this.buildRequest(options, {
+    const { req: req3, url, timeout } = await this.buildRequest(options, {
       retryCount: maxRetries - retriesRemaining
     });
     const hasStreamingBody = options.__metadata?.["hasStreamingBody"] === true;
-    await this.prepareRequest(req2, { url, options });
-    await this._provider?.prepareRequest?.(req2, { url, options });
+    await this.prepareRequest(req3, { url, options });
+    await this._provider?.prepareRequest?.(req3, { url, options });
     const requestLogID = "log_" + (Math.random() * (1 << 24) | 0).toString(16).padStart(6, "0");
     const retryLogStr = retryOfRequestLogID === void 0 ? "" : `, retryOf: ${retryOfRequestLogID}`;
     const startTime = Date.now();
@@ -12363,14 +12363,14 @@ var OpenAI = class {
       method: options.method,
       url,
       options,
-      headers: req2.headers
+      headers: req3.headers
     }));
     if (options.signal?.aborted) {
       throw new APIUserAbortError();
     }
     const security = options.__security ?? { bearerAuth: true };
     const controller = new AbortController();
-    const response = await this.fetchWithAuth(url, req2, timeout, controller, security).catch(castToError);
+    const response = await this.fetchWithAuth(url, req3, timeout, controller, security).catch(castToError);
     const headersTime = Date.now();
     if (response instanceof globalThis.Error) {
       const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
@@ -12408,7 +12408,7 @@ var OpenAI = class {
       });
     }
     const specialHeaders = [...response.headers.entries()].filter(([name]) => name === "x-request-id").map(([name, value]) => ", " + name + ": " + JSON.stringify(value)).join("");
-    const responseInfo = `[${requestLogID}${retryLogStr}${specialHeaders}] ${req2.method} ${url} ${response.ok ? "succeeded" : "failed"} with status ${response.status} in ${headersTime - startTime}ms`;
+    const responseInfo = `[${requestLogID}${retryLogStr}${specialHeaders}] ${req3.method} ${url} ${response.ok ? "succeeded" : "failed"} with status ${response.status} in ${headersTime - startTime}ms`;
     if (!response.ok) {
       if (response.status === 401 && this._workloadIdentityAuth && security.bearerAuth && !options.__metadata?.["hasStreamingBody"] && !options.__metadata?.["workloadIdentityTokenRefreshed"]) {
         await CancelReadableStream(response.body);
@@ -12569,7 +12569,7 @@ var OpenAI = class {
       };
     }
     const reqHeaders = await this.buildHeaders({ options: inputOptions, method, bodyHeaders, retryCount });
-    const req2 = {
+    const req3 = {
       method,
       headers: reqHeaders,
       ...options.signal && { signal: options.signal },
@@ -12578,7 +12578,7 @@ var OpenAI = class {
       ...this.fetchOptions ?? {},
       ...options.fetchOptions ?? {}
     };
-    return { req: req2, url, timeout: options.timeout };
+    return { req: req3, url, timeout: options.timeout };
   }
   async buildHeaders({ options, method, bodyHeaders, retryCount }) {
     let idempotencyHeaders = {};
@@ -13096,18 +13096,18 @@ function translateAzureIdentityError(e) {
 // src/lib/api-client.ts
 var COLD_START_RETRY_DELAY_MS = 1e3;
 var COLD_START_RETRY_STATUS_CODES = /* @__PURE__ */ new Set([502, 503, 504]);
-async function apiCall(opts, req2, notify) {
+async function apiCall(opts, req3, notify) {
   const token = await getBearerToken(opts.gatewayClientId);
-  const url = `${opts.gatewayUrl}${req2.path}`;
+  const url = `${opts.gatewayUrl}${req3.path}`;
   const headers = {
     authorization: `Bearer ${token}`,
     accept: "application/json"
   };
-  if (req2.body !== void 0) headers["content-type"] = "application/json";
+  if (req3.body !== void 0) headers["content-type"] = "application/json";
   const init = {
-    method: req2.method,
+    method: req3.method,
     headers,
-    body: req2.body !== void 0 ? JSON.stringify(req2.body) : void 0
+    body: req3.body !== void 0 ? JSON.stringify(req3.body) : void 0
   };
   let res;
   try {
@@ -14550,9 +14550,9 @@ async function createGitHubApp(args) {
         server.close();
       }, 2500);
     };
-    server = createServer((req2, res) => {
+    server = createServer((req3, res) => {
       void (async () => {
-        const u = new URL(req2.url ?? "/", base);
+        const u = new URL(req3.url ?? "/", base);
         if (u.pathname === "/") {
           res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
           res.end(renderManifestForm({ org: args.org, state, redirectUrl, setupUrl, nameSuffix: args.nameSuffix }));
@@ -16651,11 +16651,11 @@ var REQUIRED_INSTALLATION_PERMISSIONS = [
 ];
 var LEVEL_RANK = { read: 1, write: 2, admin: 3 };
 function findPermissionGaps(granted) {
-  return REQUIRED_INSTALLATION_PERMISSIONS.flatMap((req2) => {
-    const have = granted[req2.key];
+  return REQUIRED_INSTALLATION_PERMISSIONS.flatMap((req3) => {
+    const have = granted[req3.key];
     const haveRank = have ? LEVEL_RANK[have] ?? 0 : 0;
-    const needRank = LEVEL_RANK[req2.level] ?? 0;
-    return haveRank >= needRank ? [] : [{ key: req2.key, required: req2.level, granted: have ?? null, why: req2.why }];
+    const needRank = LEVEL_RANK[req3.level] ?? 0;
+    return haveRank >= needRank ? [] : [{ key: req3.key, required: req3.level, granted: have ?? null, why: req3.why }];
   });
 }
 function buildPermissionRefusal(args) {
@@ -19536,11 +19536,11 @@ function fromBuild(raw, fallbackRef) {
   };
 }
 var DEV_TAG = "v0.0.0-dev";
-var PINNED_INSTALLER = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-installer:v0.1.87","registry":"ghcr.io/m8t-labs","image":"m8t-installer","tag":"v0.1.87"}', "ghcr.io/m8t-labs/m8t-installer");
+var PINNED_INSTALLER = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-installer:v0.1.92","registry":"ghcr.io/m8t-labs","image":"m8t-installer","tag":"v0.1.92"}', "ghcr.io/m8t-labs/m8t-installer");
 var PINNED_CODING_AGENT = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-coding-agent:v0.1.5","registry":"ghcr.io/m8t-labs","image":"m8t-coding-agent","tag":"v0.1.5"}', "ghcr.io/m8t-labs/m8t-coding-agent");
 var PINNED_AZURE_EXECUTOR = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-azure-executor:v0.1.5","registry":"ghcr.io/m8t-labs","image":"m8t-azure-executor","tag":"v0.1.5"}', "ghcr.io/m8t-labs/m8t-azure-executor");
 var PINNED_PLATFORM_VERSION = (() => {
-  const raw = "0.7.8";
+  const raw = "0.8.0";
   return /^\d+\.\d+\.\d+$/.test(raw) ? raw : "";
 })();
 
@@ -21164,9 +21164,9 @@ That repository is private, so this command is maintainer-side for now.
 Your installation still updates itself: the auto-update rail applies published releases from the channel without reading this repository.`;
 }
 function parseTreeResponse(body) {
-  const map = /* @__PURE__ */ new Map();
-  for (const e of body.tree ?? []) if (e.type === "tree") map.set(e.path, e.sha);
-  return { treeShaOf: (p) => map.get(p.replace(/\/$/, "")) };
+  const map2 = /* @__PURE__ */ new Map();
+  for (const e of body.tree ?? []) if (e.type === "tree") map2.set(e.path, e.sha);
+  return { treeShaOf: (p) => map2.get(p.replace(/\/$/, "")) };
 }
 async function fetchRepoTree(commit, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
@@ -28995,9 +28995,9 @@ function groupIntoConversations(rows, members = []) {
   const groups = /* @__PURE__ */ new Map();
   for (const r of rows) {
     const key2 = r.source === "a2a" ? `a2a:${r.delegationId ?? r.eventId}` : r.foundryConversationId ?? `__single__:${r.responseId ?? r.eventId}`;
-    const arr = groups.get(key2);
-    if (arr)
-      arr.push(r);
+    const arr2 = groups.get(key2);
+    if (arr2)
+      arr2.push(r);
     else
       groups.set(key2, [r]);
   }
@@ -29813,9 +29813,9 @@ function groupRows(rows) {
   const by = /* @__PURE__ */ new Map();
   for (const r of rows) {
     const k = rowGroupKey(r);
-    const arr = by.get(k);
-    if (arr)
-      arr.push(r);
+    const arr2 = by.get(k);
+    if (arr2)
+      arr2.push(r);
     else
       by.set(k, [r]);
   }
@@ -29844,9 +29844,9 @@ async function enrichGroup(trace, g, window2) {
   if (!respIds.length)
     return void 0;
   try {
-    const map = await trace.enrich(respIds, { from: window2.from ?? "", to: window2.to });
+    const map2 = await trace.enrich(respIds, { from: window2.from ?? "", to: window2.to });
     for (const r of respIds) {
-      const hit = map.get(r);
+      const hit = map2.get(r);
       if (hit)
         return hit;
     }
@@ -32753,9 +32753,175 @@ import { createHash as createHash7, randomUUID as randomUUID3 } from "crypto";
 import * as fs32 from "fs/promises";
 import * as os13 from "os";
 import * as path35 from "path";
-init_errors();
+
+// ../../packages/install-contract/src/spec.ts
+var lit = (value) => ({ kind: "literal", value });
+var num2 = () => ({ kind: "number" });
+var str4 = () => ({ kind: "string" });
+var bool = () => ({ kind: "boolean" });
+var enom = (...values) => ({ kind: "enum", values });
+var arr = (items) => ({ kind: "array", items });
+var map = (values) => ({ kind: "map", values });
+var obj = (fields) => ({ kind: "object", fields });
+var nullable = (inner) => ({ kind: "nullable", inner });
+var req2 = (node, doc) => ({ node, required: true, ...doc ? { doc } : {} });
+var opt = (node, doc) => ({ node, required: false, ...doc ? { doc } : {} });
+function validateNode(node, value, path47 = "", opts = {}) {
+  const at = path47 === "" ? "(root)" : path47;
+  switch (node.kind) {
+    case "literal":
+      return value === node.value ? [] : [{ path: at, message: `expected the literal ${String(node.value)}, got ${describe(value)}` }];
+    case "number":
+      return typeof value === "number" && Number.isFinite(value) ? [] : [{ path: at, message: `expected a finite number, got ${describe(value)}` }];
+    case "string":
+      return typeof value === "string" ? [] : [{ path: at, message: `expected a string, got ${describe(value)}` }];
+    case "boolean":
+      return typeof value === "boolean" ? [] : [{ path: at, message: `expected a boolean, got ${describe(value)}` }];
+    case "enum":
+      return typeof value === "string" && node.values.includes(value) ? [] : [{ path: at, message: `expected one of ${node.values.join(" | ")}, got ${describe(value)}` }];
+    case "nullable":
+      return value === null ? [] : validateNode(node.inner, value, path47, opts);
+    case "array": {
+      if (!Array.isArray(value)) return [{ path: at, message: `expected an array, got ${describe(value)}` }];
+      return value.flatMap((v, i) => validateNode(node.items, v, `${path47}[${String(i)}]`, opts));
+    }
+    case "map": {
+      if (!isPlainObject(value)) return [{ path: at, message: `expected an object, got ${describe(value)}` }];
+      return Object.entries(value).flatMap(([k, v]) => validateNode(node.values, v, `${path47}.${k}`, opts));
+    }
+    case "object": {
+      if (!isPlainObject(value)) return [{ path: at, message: `expected an object, got ${describe(value)}` }];
+      const out = [];
+      for (const [name, field] of Object.entries(node.fields)) {
+        const present = Object.prototype.hasOwnProperty.call(value, name);
+        if (!present) {
+          if (field.required) out.push({ path: `${path47}.${name}`, message: "is required but missing" });
+          continue;
+        }
+        out.push(...validateNode(field.node, value[name], `${path47}.${name}`, opts));
+      }
+      if ((opts.unknownFields ?? "reject") === "reject") {
+        for (const name of Object.keys(value)) {
+          if (!Object.prototype.hasOwnProperty.call(node.fields, name)) {
+            out.push({
+              path: `${path47}.${name}`,
+              message: "is not declared by the contract. If the installer legitimately writes it, declare it here and regenerate the schema \u2014 do not widen the object."
+            });
+          }
+        }
+      }
+      return out;
+    }
+  }
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function describe(v) {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return "an array";
+  return typeof v;
+}
+
+// ../../packages/install-contract/src/status-doc.ts
+var STATUS_SCHEMA_VERSION = 1;
 var STATUS_CONTAINER = "status";
 var STATUS_BLOB = "status.json";
+var STATUS_DOC_SPEC = obj({
+  schemaVersion: req2(lit(STATUS_SCHEMA_VERSION), "Always 1 in this version of the contract. A reader that does not recognise the value must refuse the document rather than guess at it."),
+  status: req2(enom("running", "done", "failed"), "The run's state. `done` and `failed` are terminal; nothing writes the document afterwards."),
+  phase: req2(str4(), "The phase name the installer is in. See the phase registry \u2014 the set is open by type but closed in practice, and includes `converge` on the update path."),
+  phaseIndex: req2(num2(), "1-based index of the current phase. NOT monotonic: a restarted container re-runs from phase 1, so this can go backwards mid-install."),
+  phaseTotal: req2(num2(), "Total phases the writer counts, including the terminal `done` emit. Read it from the document, never from a constant \u2014 a container built at another commit may report a different total."),
+  startedAt: opt(str4(), "ISO-8601 UTC. Preserved across a container restart when the prior document was recovered (`hydrate_status`)."),
+  updatedAt: opt(str4(), "ISO-8601 UTC of this write."),
+  detail: opt(str4(), "Human-facing one-liner for the current phase. Installer-authored; safe to show, never parse."),
+  result: opt(
+    obj({
+      gatewayFqdn: opt(str4()),
+      gatewayUrl: opt(str4()),
+      foundryEndpoint: opt(str4()),
+      // `entrypoint.sh` fills this with `jq -c '.created'` from `m8t foundry
+      // create`'s JSON and passes it through `--argjson`. If that command ever
+      // stops carrying `.created`, jq yields the literal `null` and the field
+      // lands as null rather than absent — a cross-binary coupling with no
+      // guard on either side. Tolerated here so one missing key upstream cannot
+      // make an otherwise-good `done` document unreadable.
+      freshVsReused: opt(nullable(map(bool())), "Per-resource: true when this run created it, false when it reused an existing one. Null if the installer could not determine it."),
+      brains: opt(arr(str4())),
+      workers: opt(arr(str4())),
+      stampSeed: opt(str4()),
+      updaterProvision: opt(str4()),
+      platformVersion: opt(str4(), "The release the engine stamped, e.g. `platform-v0.7.8`. Absent when the engine could not resolve one."),
+      telemetryIdentity: opt(str4())
+    }),
+    "Present only on a `done` document."
+  ),
+  error: opt(
+    obj({
+      // BOTH optional, and this is not defensive vagueness — the installer's
+      // EXIT trap composes this object with jq and falls back to a literal `{}`
+      // if that jq fails (`... 2>/dev/null || printf '{}'`). That fallback is
+      // the last-resort safety net which guarantees a dead install still
+      // publishes a `failed` document instead of freezing on `running`.
+      // Requiring these fields would make the reader refuse exactly the
+      // document the safety net exists to produce, so a founder whose install
+      // died would see a read error instead of which phase died.
+      phase: opt(str4()),
+      message: opt(str4(), "Free-form, may carry raw az stderr. LOCAL ONLY \u2014 never forward it outward; the wire composes `errorDetail` separately.")
+    }),
+    "Present only on a `failed` document. May be an EMPTY object when the installer's exit trap could not compose it."
+  ),
+  history: opt(
+    arr(obj({ phase: req2(str4()), at: req2(str4()), status: req2(str4()) })),
+    "Append-only, one entry per emit. Survives a restart via `hydrate_status`, so a resumed run's history contains the earlier attempt's entries too."
+  ),
+  warnings: opt(
+    arr(obj({ phase: req2(str4()), at: req2(str4()), text: req2(str4()) })),
+    "Advisories raised by any phase, accumulated across the run. Written only when at least one exists \u2014 an absent key means none were raised, not that the field is unsupported."
+  )
+});
+function parseStatusDoc(raw, opts = {}) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw.trim());
+  } catch (e) {
+    return { ok: false, rejection: { reason: "not-json", message: e.message } };
+  }
+  const hasVersion = typeof parsed === "object" && parsed !== null && Object.prototype.hasOwnProperty.call(parsed, "schemaVersion");
+  if (!hasVersion) {
+    return { ok: false, rejection: { reason: "missing-schema-version" } };
+  }
+  const version = parsed.schemaVersion;
+  if (version !== STATUS_SCHEMA_VERSION) {
+    return { ok: false, rejection: { reason: "unknown-schema-version", found: version, supported: STATUS_SCHEMA_VERSION } };
+  }
+  const violations = validateNode(STATUS_DOC_SPEC, parsed, "", opts);
+  if (violations.length > 0) return { ok: false, rejection: { reason: "invalid", violations } };
+  return { ok: true, doc: parsed };
+}
+function parseStatusDocForReader(raw) {
+  return parseStatusDoc(raw, { unknownFields: "ignore" });
+}
+var MAX_EXPLAINED_VIOLATIONS = 3;
+function explainRejection(r) {
+  switch (r.reason) {
+    case "not-json":
+      return `the installer status document is not valid JSON (${r.message})`;
+    case "missing-schema-version":
+      return "the installer status document has no schemaVersion, so it is truncated or corrupt rather than simply newer";
+    case "unknown-schema-version":
+      return `the installer status document declares schemaVersion ${JSON.stringify(r.found)}, but this build only understands version ${String(r.supported)}. Update the tool that is reading it.`;
+    case "invalid": {
+      const shown = r.violations.slice(0, MAX_EXPLAINED_VIOLATIONS).map((v) => `${v.path} ${v.message}`);
+      const rest = r.violations.length - shown.length;
+      return `the installer status document does not match the contract: ` + shown.join("; ") + (rest > 0 ? ` (and ${String(rest)} more)` : "");
+    }
+  }
+}
+
+// src/lib/bootstrap-status.ts
+init_errors();
 function deriveStatusSaName(resourceGroup, subscriptionId) {
   const hex = createHash7("sha256").update(resourceGroup + subscriptionId).digest("hex").slice(0, 12);
   return `m8tinst${hex}`;
@@ -32765,6 +32931,7 @@ function statusBlobUrl(saName) {
 }
 async function readStatusBlob(opts) {
   let key2;
+  let raw;
   try {
     key2 = (await runAz([
       "storage",
@@ -32810,8 +32977,7 @@ async function readStatusBlob(opts) {
       "--no-progress",
       "--only-show-errors"
     ]);
-    const raw = await fs32.readFile(tmpFile, "utf8");
-    return JSON.parse(raw.trim());
+    raw = await fs32.readFile(tmpFile, "utf8");
   } catch (e) {
     throw new LocalCliError({
       code: "BOOTSTRAP_STATUS_UNREADABLE",
@@ -32822,6 +32988,26 @@ async function readStatusBlob(opts) {
   } finally {
     await fs32.rm(tmpFile, { force: true });
   }
+  const parsed = parseStatusDocForReader(raw);
+  if (!parsed.ok) {
+    throw new LocalCliError({
+      code: "BOOTSTRAP_STATUS_INVALID",
+      message: `The installer status document could not be read: ${explainRejection(parsed.rejection)}`,
+      hint: hintFor(parsed.rejection.reason)
+    });
+  }
+  return parsed.doc;
+}
+function hintFor(reason) {
+  switch (reason) {
+    case "unknown-schema-version":
+      return "The installer wrote a newer status format than this CLI understands. Update the CLI: npm i -g @m8t-stack/cli";
+    case "missing-schema-version":
+    case "not-json":
+      return "The status blob looks truncated or corrupt. Check the installer directly: az container logs -n <aci> -g <rg>.";
+    case "invalid":
+      return "Your CLI may be older than the installer that wrote this. Update it (npm i -g @m8t-stack/cli); if that does not help, check: az container logs -n <aci> -g <rg>.";
+  }
 }
 
 // src/lib/bootstrap-state.ts
@@ -36002,7 +36188,9 @@ function formatStatus(d) {
 `;
   }
   if (d.status === "failed" && d.error) {
-    return colors.error("\u2717 ") + head + `  ${colors.error(`error in ${d.error.phase}: ${d.error.message}`)}
+    const where = d.error.phase ?? d.phase;
+    const why = d.error.message ?? "the installer did not record why \u2014 check the container logs";
+    return colors.error("\u2717 ") + head + `  ${colors.error(`error in ${where}: ${why}`)}
   ${colors.hint("inspect:")} az container logs
 `;
   }