@m8t-stack/cli 0.2.135 → 0.2.137

package/dist/cli.js

@@ -310,6 +310,13 @@ var init_ui_directive = __esm({
   }
 });
 
+// ../../packages/api-contract/dist/esm/teaching.js
+var init_teaching = __esm({
+  "../../packages/api-contract/dist/esm/teaching.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/api-contract/dist/esm/index.js
 var init_esm = __esm({
   "../../packages/api-contract/dist/esm/index.js"() {
@@ -329,6 +336,7 @@ var init_esm = __esm({
     init_founder_benchmark();
     init_agent_roster();
     init_ui_directive();
+    init_teaching();
   }
 });
 
@@ -955,7 +963,9 @@ var init_brain_yaml_mirror = __esm({
       `    digestRetention: 90d`,
       `  costReport:`,
       `    enabled: true`,
-      `    cadenceDays: 14`
+      `    cadenceDays: 14`,
+      `  teaching:`,
+      `    enabled: false              # operator opt-in; gateway flag and teacher capability are also required`
     ].join("\n");
     MIRROR_BANNER = [
       `# \u2500\u2500 MIRROR \u2014 link record convenience copy. NOT the source of truth \u2014`,
@@ -1454,7 +1464,7 @@ function installFoundryDnsShim() {
 }
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.135";
+var CLI_VERSION = "0.2.137";
 
 // src/lib/render-error.ts
 init_errors();
@@ -2355,13 +2365,13 @@ function is_non_nullish_primitive(v) {
   return typeof v === "string" || typeof v === "number" || typeof v === "boolean" || typeof v === "symbol" || typeof v === "bigint";
 }
 var sentinel = {};
-function inner_stringify(object, prefix, generateArrayPrefix, commaRoundTrip, allowEmptyArrays, strictNullHandling, skipNulls, encodeDotInKeys, encoder, filter, sort, allowDots, serializeDate, format, formatter, encodeValuesOnly, charset, sideChannel) {
-  let obj2 = object;
+function inner_stringify(object2, prefix, generateArrayPrefix, commaRoundTrip, allowEmptyArrays, strictNullHandling, skipNulls, encodeDotInKeys, encoder, filter, sort, allowDots, serializeDate, format, formatter, encodeValuesOnly, charset, sideChannel) {
+  let obj2 = object2;
   let tmp_sc = sideChannel;
   let step = 0;
   let find_flag = false;
   while ((tmp_sc = tmp_sc.get(sentinel)) !== void 0 && !find_flag) {
-    const pos = tmp_sc.get(object);
+    const pos = tmp_sc.get(object2);
     step += 1;
     if (typeof pos !== "undefined") {
       if (pos === step) {
@@ -2437,7 +2447,7 @@ function inner_stringify(object, prefix, generateArrayPrefix, commaRoundTrip, al
     }
     const encoded_key = allowDots && encodeDotInKeys ? key2.replace(/\./g, "%2E") : key2;
     const key_prefix = isArray(obj2) ? typeof generateArrayPrefix === "function" ? generateArrayPrefix(adjusted_prefix, encoded_key) : adjusted_prefix : adjusted_prefix + (allowDots ? "." + encoded_key : "[" + encoded_key + "]");
-    sideChannel.set(object, step);
+    sideChannel.set(object2, step);
     const valueSideChannel = /* @__PURE__ */ new WeakMap();
     valueSideChannel.set(sentinel, sideChannel);
     push_to_array(values, inner_stringify(
@@ -2526,8 +2536,8 @@ function normalize_stringify_options(opts = defaults) {
     strictNullHandling: typeof opts.strictNullHandling === "boolean" ? opts.strictNullHandling : defaults.strictNullHandling
   };
 }
-function stringify(object, opts = {}) {
-  let obj2 = object;
+function stringify(object2, opts = {}) {
+  let obj2 = object2;
   const options = normalize_stringify_options(opts);
   let obj_keys;
   let filter;
@@ -19540,7 +19550,7 @@ var PINNED_INSTALLER = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-installer:v0.1.10
 var PINNED_CODING_AGENT = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-coding-agent:v0.1.5","registry":"ghcr.io/m8t-labs","image":"m8t-coding-agent","tag":"v0.1.5"}', "ghcr.io/m8t-labs/m8t-coding-agent");
 var PINNED_AZURE_EXECUTOR = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-azure-executor:v0.1.5","registry":"ghcr.io/m8t-labs","image":"m8t-azure-executor","tag":"v0.1.5"}', "ghcr.io/m8t-labs/m8t-azure-executor");
 var PINNED_PLATFORM_VERSION = (() => {
-  const raw = "0.8.3";
+  const raw = "0.8.4";
   return /^\d+\.\d+\.\d+$/.test(raw) ? raw : "";
 })();
 
@@ -29625,7 +29635,12 @@ function mapItems(raw) {
       continue;
     const text = Array.isArray(item.content) ? maskSecrets(stripVoiceEnvelope(item.content.map((c) => typeof c.text === "string" && c.text.length > 0 ? c.text : typeof c.transcript === "string" && c.transcript.length > 0 ? c.transcript : "").filter(Boolean).join("\n\n"))) : "";
     const at = typeof item.created_at === "number" ? new Date(item.created_at * 1e3).toISOString() : void 0;
-    acc.push(at ? { role: item.role, text, at } : { role: item.role, text });
+    acc.push({
+      ...typeof item.id === "string" && item.id.length > 0 ? { id: item.id } : {},
+      role: item.role,
+      text,
+      ...at ? { at } : {}
+    });
   }
   return acc.reverse();
 }
@@ -29796,6 +29811,31 @@ function normalize(group, items, enrichment) {
   return conv;
 }
 
+// ../../packages/brain/engine/dist/esm/teaching-exclusion.js
+var TeachingExclusionUnavailableError = class extends Error {
+  constructor() {
+    super("Authoritative teaching exclusion is unavailable");
+    this.name = "TeachingExclusionUnavailableError";
+  }
+};
+async function excludeTeachingItems(source, conversationId, items) {
+  if (!source)
+    return items;
+  let coverage;
+  try {
+    coverage = await source.coverage(conversationId);
+  } catch {
+    throw new TeachingExclusionUnavailableError();
+  }
+  if (!coverage.hasTeachingEpisodes)
+    return items;
+  if (items.some((item) => typeof item.id !== "string" || !/^msg_[A-Za-z0-9_-]+$/.test(item.id))) {
+    return [];
+  }
+  const withheld = new Set(coverage.teachingItemIds);
+  return items.filter((item) => !withheld.has(item.id ?? ""));
+}
+
 // ../../packages/brain/engine/dist/esm/pipeline.js
 var isKnownSource = (s) => SOURCES.includes(s);
 var MAX_CONV_FETCH_ATTEMPTS = 3;
@@ -29906,10 +29946,28 @@ async function runPipeline(args) {
         recoveredVia: didRecover ? "trace" : void 0
       };
       const grpRows = rowsByGroupKey.get(groupKeyOf(g)) ?? [];
-      (consumedRowsByPk[pk] ??= []).push(...grpRows);
       const provRows = grpRows.map((r) => ({ rowKey: rowStorageKey(r), eventTimestamp: r.eventTimestamp }));
+      let teachingFilteredItems;
+      try {
+        teachingFilteredItems = await excludeTeachingItems(sources.teaching, conversationId ?? "", items);
+      } catch (error) {
+        if (!(error instanceof TeachingExclusionUnavailableError))
+          throw error;
+        const id = conversationId ?? "";
+        const next = (cursor.fetchFailures?.[id] ?? 0) + 1;
+        newFailures[id] = next;
+        skips.addSkip("teaching-exclusion-unavailable", sampleId(g), next >= MAX_CONV_FETCH_ATTEMPTS ? `terminal after ${String(next)} cycles \u2014 conversation withheld; watermark released` : error.message);
+        if (next < MAX_CONV_FETCH_ATTEMPTS) {
+          const currentFailure = failedTsByPk[pk];
+          if (!currentFailure || g.startedAt < currentFailure) {
+            failedTsByPk[pk] = g.startedAt;
+          }
+        }
+        continue;
+      }
+      (consumedRowsByPk[pk] ??= []).push(...grpRows);
       const trustedOwner = g.source !== "a2a" && g.user.ref !== "unknown" && !g.user.ref.startsWith("svc:");
-      const dreamItems = trustedOwner ? items : items.map((i) => ({ ...i, text: maskContactStrict(i.text) }));
+      const dreamItems = trustedOwner ? teachingFilteredItems : teachingFilteredItems.map((i) => ({ ...i, text: maskContactStrict(i.text) }));
       const conv = normalize(ng, dreamItems, enrichment);
       conv.provenance = { pk, rows: provRows };
       conversations.push(conv);
@@ -30058,6 +30116,184 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
   };
 }
 
+// ../../packages/brain/engine/dist/esm/teaching-table-source.js
+var CONVERSATION_ID = /^conv_[A-Za-z0-9_-]+$/;
+var MESSAGE_ID = /^msg_[A-Za-z0-9_-]+$/;
+var SURFACE_ID = /^surface_[A-Za-z0-9_-]+$/;
+var EPISODE_ID = /^teach_[A-Za-z0-9_-]+$/;
+var EPISODE_STATES = /* @__PURE__ */ new Set([
+  "active",
+  "summarizing",
+  "awaiting_confirmation",
+  "queued",
+  "processing",
+  "pr_open",
+  "merged",
+  "declined",
+  "needs_attention",
+  "cancelled",
+  "expired"
+]);
+function object(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function optionalMessageId(value) {
+  return value === void 0 || typeof value === "string" && MESSAGE_ID.test(value);
+}
+function parseSpan(value, expectedOrdinal) {
+  if (!object(value))
+    throw new Error("Invalid TeachingEpisodes row: malformed span");
+  const { ordinal, conversationId, startAfterItemId, endAtItemId, empty } = value;
+  if (ordinal !== expectedOrdinal || typeof conversationId !== "string" || !CONVERSATION_ID.test(conversationId) || !optionalMessageId(startAfterItemId) || !optionalMessageId(endAtItemId) || empty !== void 0 && empty !== true) {
+    throw new Error("Invalid TeachingEpisodes row: malformed span");
+  }
+  return value;
+}
+function parseEpisode(entity) {
+  if (entity.kind !== "episode" || typeof entity.payload !== "string") {
+    throw new Error("Invalid TeachingEpisodes row: expected episode payload");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(entity.payload);
+  } catch {
+    throw new Error("Invalid TeachingEpisodes row: payload is not JSON");
+  }
+  if (!object(parsed))
+    throw new Error("Invalid TeachingEpisodes row: payload is not an object");
+  if (parsed.schemaVersion !== 1 || typeof parsed.surfaceId !== "string" || !SURFACE_ID.test(parsed.surfaceId) || typeof parsed.episodeId !== "string" || !EPISODE_ID.test(parsed.episodeId) || typeof parsed.state !== "string" || !EPISODE_STATES.has(parsed.state) || parsed.surfaceId !== entity.partitionKey || parsed.episodeId !== entity.rowKey || parsed.state !== entity.state || !Array.isArray(parsed.spans) || parsed.spans.length === 0) {
+    throw new Error("Invalid TeachingEpisodes row: identity, state, or spans are malformed");
+  }
+  const spans = parsed.spans.map(parseSpan);
+  if (entity.sourceConversationIds !== void 0) {
+    let indexed;
+    try {
+      indexed = typeof entity.sourceConversationIds === "string" ? JSON.parse(entity.sourceConversationIds) : void 0;
+    } catch {
+      indexed = void 0;
+    }
+    const payloadIds = [...new Set(spans.map((span) => span.conversationId))];
+    if (!Array.isArray(indexed) || indexed.length === 0 || indexed.some((value) => typeof value !== "string" || !CONVERSATION_ID.test(value)) || JSON.stringify(indexed) !== JSON.stringify(payloadIds)) {
+      throw new Error("Invalid TeachingEpisodes row: source conversation index does not match payload");
+    }
+  }
+  const emptyIndex = spans.findIndex((span) => span.empty === true);
+  if (emptyIndex >= 0 && (emptyIndex !== spans.length - 1 || parsed.state !== "cancelled" && parsed.state !== "expired")) {
+    throw new Error("Invalid TeachingEpisodes row: empty span is not a terminal tombstone");
+  }
+  return { spans };
+}
+function claimsConversation(entity, conversationId) {
+  if (typeof entity.sourceConversationIds === "string") {
+    try {
+      const indexed = JSON.parse(entity.sourceConversationIds);
+      if (Array.isArray(indexed) && indexed.includes(conversationId))
+        return true;
+    } catch {
+    }
+  }
+  if (typeof entity.payload !== "string")
+    return false;
+  let parsed;
+  try {
+    parsed = JSON.parse(entity.payload);
+  } catch {
+    return false;
+  }
+  if (!object(parsed) || !Array.isArray(parsed.spans))
+    return false;
+  return parsed.spans.some((span) => object(span) && span.conversationId === conversationId);
+}
+function isInfrastructureRow(entity) {
+  if (entity.kind === "open_guard") {
+    return entity.rowKey === "__open__" && SURFACE_ID.test(entity.partitionKey) && typeof entity.episodeId === "string" && EPISODE_ID.test(entity.episodeId);
+  }
+  if (entity.kind === "proposal_job") {
+    return SURFACE_ID.test(entity.partitionKey) && entity.rowKey.startsWith("job:") && EPISODE_ID.test(entity.rowKey.slice("job:".length));
+  }
+  return false;
+}
+function uniqueItemIndex(items) {
+  const positions = /* @__PURE__ */ new Map();
+  for (const [index, item] of items.entries()) {
+    if (typeof item.id !== "string" || !MESSAGE_ID.test(item.id) || positions.has(item.id)) {
+      throw new Error("Teaching exclusion requires unique stable message ids");
+    }
+    positions.set(item.id, index);
+  }
+  return positions;
+}
+function addSpanItems(owned, span, items, positions) {
+  if (span.empty === true)
+    return;
+  let start = 0;
+  if (span.startAfterItemId !== void 0) {
+    const boundary = positions.get(span.startAfterItemId);
+    if (boundary === void 0)
+      throw new Error("Teaching exclusion start boundary is absent");
+    start = boundary + 1;
+  }
+  let end = items.length - 1;
+  if (span.endAtItemId !== void 0) {
+    const boundary = positions.get(span.endAtItemId);
+    if (boundary === void 0)
+      throw new Error("Teaching exclusion end boundary is absent");
+    end = boundary;
+  }
+  if (start > items.length || span.endAtItemId !== void 0 && start > end) {
+    throw new Error("Teaching exclusion span boundary is absent or out of order");
+  }
+  for (let index = start; index <= end; index += 1) {
+    const id = items[index]?.id;
+    if (!id)
+      throw new Error("Teaching exclusion span resolved to an id-less item");
+    owned.add(id);
+  }
+}
+function createTeachingExclusionSource(table, transcriptSnapshot) {
+  return {
+    async coverage(conversationId) {
+      if (!CONVERSATION_ID.test(conversationId)) {
+        throw new Error("Teaching exclusion requires a stable conversation id");
+      }
+      const matchingSpans = [];
+      let yielded = false;
+      try {
+        for await (const entity of table.listEntities()) {
+          yielded = true;
+          if (isInfrastructureRow(entity))
+            continue;
+          if (!claimsConversation(entity, conversationId))
+            continue;
+          const episode = parseEpisode(entity);
+          matchingSpans.push(...episode.spans.filter((span) => span.conversationId === conversationId));
+        }
+      } catch (error) {
+        const status = error?.statusCode;
+        const code = error?.code;
+        if (yielded || status !== 404 && code !== "TableNotFound")
+          throw error;
+      }
+      if (matchingSpans.length === 0)
+        return { hasTeachingEpisodes: false, teachingItemIds: [] };
+      if (matchingSpans.every((span) => span.empty === true)) {
+        return { hasTeachingEpisodes: true, teachingItemIds: [] };
+      }
+      const items = transcriptSnapshot(conversationId);
+      if (!items)
+        throw new Error("Teaching transcript snapshot is unavailable");
+      const positions = uniqueItemIndex(items);
+      const owned = /* @__PURE__ */ new Set();
+      for (const span of matchingSpans)
+        addSpanItems(owned, span, items, positions);
+      return {
+        hasTeachingEpisodes: true,
+        teachingItemIds: items.flatMap((item) => item.id && owned.has(item.id) ? [item.id] : [])
+      };
+    }
+  };
+}
+
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
@@ -30318,7 +30554,7 @@ function renderDigestMarkdown(digest, opts) {
         push("## Changed", `- \`${e.path}\` \u2014 **${e.verb.toUpperCase()}**${fmtEvidence(e.evidence)}`);
         break;
       case "flagged":
-        push("## Flagged (operator-origin \u2014 not edited)", `- \`${e.path}\` \u2014 ${e.tension}${fmtEvidence(e.evidence)}`);
+        push("## Flagged (protected origin \u2014 not edited)", `- \`${e.path}\` \u2014 ${e.tension}${fmtEvidence(e.evidence)}`);
         break;
       case "quarantined":
         push("## Quarantined", `- \`${e.path}\` \u2014 ${e.reason}${fmtEvidence(e.evidence)}`);
@@ -30369,7 +30605,7 @@ function renderDigestMarkdown(digest, opts) {
   }
   const order = [
     "## Changed",
-    "## Flagged (operator-origin \u2014 not edited)",
+    "## Flagged (protected origin \u2014 not edited)",
     "## Quarantined",
     "## Capture gaps (dreamer-judged proxy, not outcome-grounded)",
     "## Skipped (ledger reconcile)",
@@ -30610,7 +30846,7 @@ function buildSystemPrompt() {
     "## Do-not-capture (memory write discipline)",
     DO_NOT_CAPTURE,
     "## What you may capture",
-    "Durable, recurring business facts and decisions that serve the worker's standing function; contradictions of standing memory (propose supersede/retract for worker/dream-origin targets, flag for operator-origin); skill-worthy repeated plays (as skill-seed).",
+    "Durable, recurring business facts and decisions that serve the worker's standing function; contradictions of standing memory (propose supersede/retract for worker/dream-origin targets, flag for protected operator/taught-origin targets); skill-worthy repeated plays (as skill-seed).",
     "## Output",
     PROPOSAL_SCHEMA
   ].join("\n\n");
@@ -30755,6 +30991,9 @@ async function checkOriginTier(delta, lookup) {
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
+  if (origin === "taught") {
+    return { ok: false, flagged: { kind: "flagged", path: path47, tension: `taught-origin; flag-only`, evidence } };
+  }
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
     throw new BatchAbort(path47, `supersede/retract OLD target ${path47} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
@@ -31344,15 +31583,18 @@ function parseDreamerConfig(rawYaml, env) {
   };
 }
 
+// ../../packages/brain/engine/dist/esm/teach/gates.js
+import { createHash as createHash5 } from "crypto";
+
+// ../../packages/brain/engine/dist/esm/librarian/janitor/frontmatter.js
+import { parse as parseYaml14, stringify as stringifyYaml5 } from "yaml";
+
 // ../../packages/brain/engine/dist/esm/cost-report/config.js
-import { parse as parseYaml14 } from "yaml";
+import { parse as parseYaml15 } from "yaml";
 
 // ../../packages/brain/engine/dist/esm/librarian/codify/persistence-guard.js
 var ZERO_WIDTH_RE = new RegExp("\u200B|\u200C|\u200D|\uFEFF", "g");
 
-// ../../packages/brain/engine/dist/esm/librarian/janitor/frontmatter.js
-import { parse as parseYaml15, stringify as stringifyYaml5 } from "yaml";
-
 // ../../packages/brain/engine/dist/esm/librarian/config.js
 import { parse as parseYaml16 } from "yaml";
 
@@ -31761,13 +32003,32 @@ function buildLiveSources(context, credential2) {
     )
   );
   const openai = new AIProjectClient3(context.projectEndpoint, credential2).getOpenAIClient();
-  const conversations = makeConversationSource(openai);
+  const baseConversations = makeConversationSource(openai);
+  const snapshots = /* @__PURE__ */ new Map();
+  const retrieveApp = baseConversations.retrieveApp?.bind(baseConversations);
+  const conversations = {
+    async items(conversationId) {
+      const items = await baseConversations.items(conversationId);
+      snapshots.set(conversationId, items);
+      return items;
+    },
+    ...retrieveApp ? { retrieveApp: (conversationId) => retrieveApp(conversationId) } : {}
+  };
+  const teachingTable = new TableClient8(
+    context.ledgerTableEndpoint,
+    "TeachingEpisodes",
+    credential2
+  );
+  const teaching = createTeachingExclusionSource(
+    teachingTable,
+    (conversationId) => snapshots.get(conversationId)
+  );
   const traces = makeTraceSource({
     enrichFn: (respIds, from, to) => fetchEnrichment(credential2, context.workspaceId, respIds, from, to),
     convIdFn: makeConvIdFn(credential2, context.workspaceId)
   });
   const cursor = makeTableCursor(credential2, context.ledgerTableEndpoint);
-  return { ledger, conversations, traces, cursor };
+  return { ledger, conversations, traces, cursor, teaching };
 }
 async function buildWriteDeps(context, credential2, cursor) {
   const agent = await getAgentVersion({
@@ -31864,7 +32125,8 @@ function defaultDeps(overrides) {
           ledger: opts.ledger,
           conversations: opts.conversations,
           trace: opts.traces,
-          cursor: opts.cursor
+          cursor: opts.cursor,
+          teaching: opts.teaching
         }
       });
     },
@@ -31917,7 +32179,8 @@ function defaultDeps(overrides) {
           ledger: opts.ledger,
           conversations: opts.conversations,
           trace: opts.traces,
-          cursor: opts.cursor
+          cursor: opts.cursor,
+          teaching: opts.teaching
         }
       });
       const writeDeps = await buildWriteDeps(cached.context, credential2, opts.cursor);
@@ -31929,7 +32192,7 @@ function defaultDeps(overrides) {
 }
 
 // src/commands/conversations/sweep.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { Command as Command57, Option as Option54 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 import { TableClient as TableClient9 } from "@azure/data-tables";
@@ -31939,7 +32202,7 @@ var LEDGER_TABLE_NAME2 = "AgentLedger";
 var KEY_LIFETIME_DAYS = 30;
 var DAY_MS = 24 * 60 * 60 * 1e3;
 function ownerDigest(nativeUserKey) {
-  return createHash5("sha256").update(nativeUserKey).digest("base64url");
+  return createHash6("sha256").update(nativeUserKey).digest("base64url");
 }
 function svcPrincipal(svcRef) {
   return svcRef.split(":")[1] ?? "";
@@ -32219,9 +32482,9 @@ import { Command as Command58, Option as Option55 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 function deriveAccountName(subscriptionId) {
-  const h = createHash6("sha256").update(subscriptionId).digest("hex").slice(0, 12);
+  const h = createHash7("sha256").update(subscriptionId).digest("hex").slice(0, 12);
   return `m8t${h}`;
 }
 function assertHostedRegion(location) {
@@ -33160,13 +33423,13 @@ async function kickInstaller(s) {
 import { randomUUID as randomUUID4 } from "crypto";
 
 // src/lib/bootstrap-status.ts
-import { createHash as createHash7, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash8, randomUUID as randomUUID3 } from "crypto";
 import * as fs32 from "fs/promises";
 import * as os13 from "os";
 import * as path35 from "path";
 init_errors();
 function deriveStatusSaName(resourceGroup, subscriptionId) {
-  const hex = createHash7("sha256").update(resourceGroup + subscriptionId).digest("hex").slice(0, 12);
+  const hex = createHash8("sha256").update(resourceGroup + subscriptionId).digest("hex").slice(0, 12);
   return `m8tinst${hex}`;
 }
 function statusBlobUrl(saName) {
@@ -33565,10 +33828,10 @@ function assertManifestSelfConsistent(sealedManifest, expected) {
 
 // src/lib/manifest-seal.ts
 import * as fs34 from "fs";
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 init_errors();
 function manifestDigestOf(raw) {
-  return `sha256:${createHash8("sha256").update(raw, "utf8").digest("hex")}`;
+  return `sha256:${createHash9("sha256").update(raw, "utf8").digest("hex")}`;
 }
 async function fetchSealedManifest(source, deps = {}) {
   const readFile10 = deps.readFile ?? ((p) => fs34.readFileSync(p, "utf8"));
@@ -34881,7 +35144,7 @@ import { randomUUID as randomUUID5 } from "crypto";
 import { execFile as execFile2, spawn as spawn7 } from "child_process";
 
 // src/lib/companion-artifact.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { constants } from "fs";
 import * as fs37 from "fs/promises";
 import * as path40 from "path";
@@ -34919,7 +35182,7 @@ function canonicalEntry(entry) {
 `;
 }
 function artifactTreeSha256(entries) {
-  const hash = createHash9("sha256");
+  const hash = createHash10("sha256");
   const ordered = [...entries].sort(
     (left, right) => left.path.localeCompare(right.path)
   );
@@ -34989,7 +35252,7 @@ function parseArtifactManifest(value) {
   };
 }
 async function sha256File2(filePath) {
-  return createHash9("sha256").update(await fs37.readFile(filePath)).digest("hex");
+  return createHash10("sha256").update(await fs37.readFile(filePath)).digest("hex");
 }
 async function walk2(root, relative4 = "") {
   const directory = path40.join(root, ...relative4.split("/").filter(Boolean));
@@ -35157,7 +35420,7 @@ async function copyArtifactPayload(sourceRoot, targetRoot, manifest) {
 }
 
 // src/lib/companion-download.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { execFile } from "child_process";
 import { createReadStream } from "fs";
 import * as fs38 from "fs/promises";
@@ -35231,7 +35494,7 @@ async function sweepForeignPartials(directory, keep) {
 }
 function sha256File3(filePath) {
   return new Promise((resolve6, reject) => {
-    const hash = createHash10("sha256");
+    const hash = createHash11("sha256");
     const stream = createReadStream(filePath);
     stream.on("error", reject);
     stream.on("data", (chunk) => hash.update(chunk));