@m8t-stack/cli 0.2.15 → 0.2.17

package/dist/cli.js

@@ -197,6 +197,13 @@ var init_brain_eval = __esm({
   }
 });
 
+// ../../packages/api-contract/dist/esm/founder-benchmark.js
+var init_founder_benchmark = __esm({
+  "../../packages/api-contract/dist/esm/founder-benchmark.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/api-contract/dist/esm/index.js
 var init_esm = __esm({
   "../../packages/api-contract/dist/esm/index.js"() {
@@ -212,6 +219,7 @@ var init_esm = __esm({
     init_brain_link();
     init_a2a_card();
     init_brain_eval();
+    init_founder_benchmark();
   }
 });
 
@@ -806,6 +814,7 @@ async function createCoderVersion(args) {
     environment_variables: args.env
   };
   const metadata = {
+    ...Object.fromEntries(Object.entries(args.metadata).filter(([, v2]) => v2 !== null)),
     source: args.metadata.source,
     kind: args.metadata.kind,
     persona: args.metadata.persona
@@ -878,6 +887,7 @@ async function createPromptVersion(args) {
     persona: args.metadata.persona
   };
   if (args.metadata.personaVersion !== null) metadata.personaVersion = args.metadata.personaVersion;
+  if (args.metadata.fillableFieldValues !== void 0) metadata.fillableFieldValues = args.metadata.fillableFieldValues;
   const version = await project.agents.createVersion(args.name, definition, { metadata });
   const v = version.version;
   if (v === void 0) {
@@ -932,6 +942,24 @@ async function grantFoundryUser(args) {
     // RoleAssignmentExists — already granted
   });
 }
+async function grantStorageTableDataContributor(args) {
+  const roleAssignmentId = randomUUID();
+  const url = `${ARM2}${args.scope}/providers/Microsoft.Authorization/roleAssignments/${roleAssignmentId}?api-version=${RA_API}`;
+  await authedJsonResult({
+    credential: args.credential,
+    scope: ARM_SCOPE3,
+    method: "PUT",
+    url,
+    body: {
+      properties: {
+        roleDefinitionId: `/subscriptions/${args.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/${STORAGE_TABLE_DATA_CONTRIBUTOR_ROLE_ID}`,
+        principalId: args.principalId,
+        principalType: args.principalType ?? "User"
+      }
+    },
+    okStatuses: [409]
+  });
+}
 async function listRoleAssignments(credential2, scope, filter) {
   const q = `api-version=${RA_API}${filter ? `&$filter=${encodeURIComponent(filter)}` : ""}`;
   const url = `${ARM2}${scope}/providers/Microsoft.Authorization/roleAssignments?${q}`;
@@ -1049,7 +1077,7 @@ async function resolveKeyVaultResourceId(args) {
   }
   return id;
 }
-var ARM2, ARM_SCOPE3, RA_API, FOUNDRY_USER_ROLE_ID, ACR_PULL_ROLE_ID, OWNER_ROLE_ID, USER_ACCESS_ADMIN_ROLE_ID, RBAC_ADMIN_ROLE_ID, ASSIGNING_ROLE_IDS, KV_SECRETS_USER_ROLE_ID, CONTRIBUTOR_ROLE_ID;
+var ARM2, ARM_SCOPE3, RA_API, FOUNDRY_USER_ROLE_ID, ACR_PULL_ROLE_ID, OWNER_ROLE_ID, USER_ACCESS_ADMIN_ROLE_ID, RBAC_ADMIN_ROLE_ID, STORAGE_TABLE_DATA_CONTRIBUTOR_ROLE_ID, ASSIGNING_ROLE_IDS, KV_SECRETS_USER_ROLE_ID, CONTRIBUTOR_ROLE_ID;
 var init_rbac = __esm({
   "src/lib/rbac.ts"() {
     "use strict";
@@ -1063,6 +1091,7 @@ var init_rbac = __esm({
     OWNER_ROLE_ID = "8e3af657-a8ff-443c-a75c-2fe8c4bcb635";
     USER_ACCESS_ADMIN_ROLE_ID = "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9";
     RBAC_ADMIN_ROLE_ID = "f58310d9-a9f6-439a-9e8d-f62e7b41a168";
+    STORAGE_TABLE_DATA_CONTRIBUTOR_ROLE_ID = "0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3";
     ASSIGNING_ROLE_IDS = [OWNER_ROLE_ID, USER_ACCESS_ADMIN_ROLE_ID, RBAC_ADMIN_ROLE_ID];
     KV_SECRETS_USER_ROLE_ID = "4633458b-17de-408a-b874-0445c86b69e6";
     CONTRIBUTOR_ROLE_ID = "b24988ac-6180-42a0-ab88-20f7382dd24c";
@@ -1198,7 +1227,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.15";
+var CLI_VERSION = "0.2.17";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1512,7 +1541,8 @@ var colors = {
   hint: (s) => pc.dim(s),
   success: (s) => pc.green(s),
   field: (s) => pc.bold(s),
-  dim: (s) => pc.dim(s)
+  dim: (s) => pc.dim(s),
+  warn: (s) => pc.yellow(s)
 };
 
 // ../../node_modules/.pnpm/openai@6.44.0_ws@8.21.0_zod@4.4.3/node_modules/openai/internal/tslib.mjs
@@ -3296,12 +3326,12 @@ function encodeURIPath(str4) {
   return str4.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-var createPathTagFunction = (pathEncoder = encodeURIPath) => function path29(statics, ...params) {
+var createPathTagFunction = (pathEncoder = encodeURIPath) => function path32(statics, ...params) {
   if (statics.length === 1)
     return statics[0];
   let postPath = false;
   const invalidSegments = [];
-  const path30 = statics.reduce((previousValue, currentValue, index) => {
+  const path33 = statics.reduce((previousValue, currentValue, index) => {
     if (/[?#]/.test(currentValue)) {
       postPath = true;
     }
@@ -3318,7 +3348,7 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path29(sta
     }
     return previousValue + currentValue + (index === params.length ? "" : encoded);
   }, "");
-  const pathOnly = path30.split(/[?#]/, 1)[0];
+  const pathOnly = path33.split(/[?#]/, 1)[0];
   const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
   let match;
   while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -3339,10 +3369,10 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path29(sta
     }, "");
     throw new OpenAIError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path30}
+${path33}
 ${underline}`);
   }
-  return path30;
+  return path33;
 };
 var path = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
 
@@ -10859,9 +10889,9 @@ var OpenAI = class {
     this.apiKey = token;
     return true;
   }
-  buildURL(path29, query, defaultBaseURL) {
+  buildURL(path32, query, defaultBaseURL) {
     const baseURL = !__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-    const url = isAbsoluteURL(path29) ? new URL(path29) : new URL(baseURL + (baseURL.endsWith("/") && path29.startsWith("/") ? path29.slice(1) : path29));
+    const url = isAbsoluteURL(path32) ? new URL(path32) : new URL(baseURL + (baseURL.endsWith("/") && path32.startsWith("/") ? path32.slice(1) : path32));
     const defaultQuery = this.defaultQuery();
     const pathQuery = Object.fromEntries(url.searchParams);
     if (!isEmptyObj(defaultQuery) || !isEmptyObj(pathQuery)) {
@@ -10889,24 +10919,24 @@ var OpenAI = class {
    */
   async prepareRequest(request, { url, options }) {
   }
-  get(path29, opts) {
-    return this.methodRequest("get", path29, opts);
+  get(path32, opts) {
+    return this.methodRequest("get", path32, opts);
   }
-  post(path29, opts) {
-    return this.methodRequest("post", path29, opts);
+  post(path32, opts) {
+    return this.methodRequest("post", path32, opts);
   }
-  patch(path29, opts) {
-    return this.methodRequest("patch", path29, opts);
+  patch(path32, opts) {
+    return this.methodRequest("patch", path32, opts);
   }
-  put(path29, opts) {
-    return this.methodRequest("put", path29, opts);
+  put(path32, opts) {
+    return this.methodRequest("put", path32, opts);
   }
-  delete(path29, opts) {
-    return this.methodRequest("delete", path29, opts);
+  delete(path32, opts) {
+    return this.methodRequest("delete", path32, opts);
   }
-  methodRequest(method, path29, opts) {
+  methodRequest(method, path32, opts) {
     return this.request(Promise.resolve(opts).then((opts2) => {
-      return { method, path: path29, ...opts2 };
+      return { method, path: path32, ...opts2 };
     }));
   }
   request(options, remainingRetries = null) {
@@ -11028,8 +11058,8 @@ var OpenAI = class {
     }));
     return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
   }
-  getAPIList(path29, Page2, opts) {
-    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path29, ...opts2 })) : { method: "get", path: path29, ...opts });
+  getAPIList(path32, Page2, opts) {
+    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path32, ...opts2 })) : { method: "get", path: path32, ...opts });
   }
   requestAPIList(Page2, options) {
     const request = this.makeRequest(options, null, void 0);
@@ -11123,8 +11153,8 @@ var OpenAI = class {
   }
   async buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path29, query, defaultBaseURL } = options;
-    const url = this.buildURL(path29, query, defaultBaseURL);
+    const { method, path: path32, query, defaultBaseURL } = options;
+    const url = this.buildURL(path32, query, defaultBaseURL);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -12126,10 +12156,10 @@ var BindListCommand = class extends M8tCommand {
     const qs = new URLSearchParams();
     if (this.channel) qs.set("channel", this.channel);
     if (this.status) qs.set("status", this.status);
-    const path29 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
+    const path32 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
     const data = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
-      { method: "GET", path: path29 },
+      { method: "GET", path: path32 },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
@@ -13330,8 +13360,8 @@ ${r.stderr}`;
         message: `gh api /repos/${slug} failed (exit ${r.exitCode.toString()}): ${(r.stderr || r.stdout).slice(0, 200)}`
       });
     },
-    getFile: async (path29) => {
-      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path29}`]);
+    getFile: async (path32) => {
+      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path32}`]);
       return r.exitCode === 0 ? r.stdout : null;
     },
     isEmpty: async () => {
@@ -13780,12 +13810,12 @@ function stripBrainLoader(instructions) {
   if (h !== -1) return instructions.slice(0, h).replace(/\s+$/, "");
   return instructions.replace(/\s+$/, "");
 }
-function appendBrainLoader(base, loaderText) {
+function appendBrainLoader(base, loaderText2) {
   const clean2 = stripBrainLoader(base);
   return `${clean2}
 
 ${LOADER_START}
-${loaderText.replace(/\s+$/, "")}
+${loaderText2.replace(/\s+$/, "")}
 ${LOADER_END}
 `;
 }
@@ -13826,9 +13856,32 @@ function hasA2aSnippet(instructions) {
 
 // src/lib/brain-link.ts
 init_foundry_agent_get();
+
+// src/lib/foundry-agent-version.ts
+init_errors();
+var FOUNDRY_DATA_SCOPE = "https://ai.azure.com/.default";
+async function createAgentVersion(args, fetchImpl = fetch) {
+  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
+  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
+  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
+  const res = await fetchImpl(url, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
+    body: JSON.stringify({ definition: args.definition, metadata: args.metadata })
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new LocalCliError({ code: "AGENT_CREATE_VERSION_FAILED", message: `POST ${url}: HTTP ${res.status.toString()}
+${text.slice(0, 500)}` });
+  }
+  const data = await res.json();
+  if (!data.version) throw new LocalCliError({ code: "AGENT_CREATE_VERSION_NO_VERSION", message: "createVersion returned no version" });
+  return data.version;
+}
+
+// src/lib/brain-link.ts
 init_brain_yaml_mirror();
 var FOUNDRY_ARM_API = "2025-04-01-preview";
-var FOUNDRY_DATA_SCOPE = "https://ai.azure.com/.default";
 var ARM_SCOPE4 = "https://management.azure.com/.default";
 var MCP_TOOL_NAMES = [
   "get_file_contents",
@@ -14035,10 +14088,6 @@ ${text.slice(0, 300)}`
   }
 }
 async function createBrainEnabledVersion(args) {
-  const fndToken = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
-  if (!fndToken?.token) {
-    throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
-  }
   const otherTools = (args.currentDefinition.tools ?? []).filter(
     (t) => !(t.type === "mcp" && t.server_label === "brain")
   );
@@ -14059,25 +14108,13 @@ async function createBrainEnabledVersion(args) {
     ...args.currentMetadata,
     brain: args.brainLinkJson
   };
-  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${fndToken.token}`, "Content-Type": "application/json" },
-    body: JSON.stringify({ definition, metadata })
+  return createAgentVersion({
+    credential: args.credential,
+    projectEndpoint: args.projectEndpoint,
+    agentName: args.agentName,
+    definition,
+    metadata
   });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new LocalCliError({
-      code: "AGENT_CREATE_VERSION_FAILED",
-      message: `POST ${url}: HTTP ${res.status.toString()}
-${text.slice(0, 500)}`
-    });
-  }
-  const data = await res.json();
-  if (!data.version) {
-    throw new LocalCliError({ code: "AGENT_CREATE_VERSION_NO_VERSION", message: `createVersion returned no version` });
-  }
-  return data.version;
 }
 
 // src/lib/brain-seed.ts
@@ -14117,8 +14154,8 @@ function isM8tBrainMarker(yamlText) {
   }
   if (!parsed || typeof parsed !== "object") return false;
   const root = parsed;
-  const isObj2 = (v) => typeof v === "object" && v !== null;
-  return isObj2(root.engine) || isObj2(root.processes) || isObj2(root.link);
+  const isObj3 = (v) => typeof v === "object" && v !== null;
+  return isObj3(root.engine) || isObj3(root.processes) || isObj3(root.link);
 }
 async function createBlankRepo(args) {
   const res = await fetch(`https://api.github.com/orgs/${args.org}/repos`, {
@@ -14272,7 +14309,7 @@ function appRepoProbe(args) {
       const res = await doFetch(`${GH_API}/repos/${args.repo}`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status;
     },
-    getFile: (path29) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path29, fetchImpl: args.fetchImpl }),
+    getFile: (path32) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path32, fetchImpl: args.fetchImpl }),
     isEmpty: async () => {
       const res = await doFetch(`${GH_API}/repos/${args.repo}/contents`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status === 404;
@@ -14591,7 +14628,9 @@ var BrainCreateCommand = class extends M8tCommand {
         repoRoot,
         installationId: resolvedInstallationId,
         skipIfLinked: true,
-        onProgress: progress
+        onProgress: progress,
+        subscriptionId,
+        project
       });
     } finally {
       fs10.rmSync(tmpDir, { recursive: true, force: true });
@@ -15282,7 +15321,7 @@ async function deployPromptAdvisor(args) {
     model,
     instructions,
     reasoningEffort,
-    metadata: { persona: args.persona, personaVersion }
+    metadata: { persona: args.persona, personaVersion, fillableFieldValues: JSON.stringify(valuesMap) }
   });
 }
 
@@ -15408,7 +15447,7 @@ async function awaitDataPlaneReady(opts) {
   const consecutive = opts.consecutive ?? 3;
   const attempts = opts.attempts ?? 60;
   const intervalMs = opts.intervalMs ?? 5e3;
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep3 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   let streak = 0;
   for (let i = 1; i <= attempts; i++) {
     const r = await opts.probe();
@@ -15430,7 +15469,7 @@ async function awaitDataPlaneReady(opts) {
       streak = 0;
       opts.onProgress?.(`data-plane not ready (${forcedRetryable ? `status ${(r.status ?? 0).toString()}` : cls.category}), waiting\u2026`);
     }
-    if (i < attempts) await sleep2(intervalMs);
+    if (i < attempts) await sleep3(intervalMs);
   }
   return { ready: false, attempts };
 }
@@ -15551,7 +15590,6 @@ function str2(v) {
 
 // src/lib/a2a-enable.ts
 var FOUNDRY_ARM_API3 = "2025-04-01-preview";
-var FOUNDRY_DATA_SCOPE3 = "https://ai.azure.com/.default";
 var ARM_SCOPE6 = "https://management.azure.com/.default";
 var A2A_TOOLS = ["discover_workers", "invoke_worker", "check_delegation"];
 async function enableA2a(args) {
@@ -15572,7 +15610,7 @@ async function enableA2a(args) {
   if (current.definition.kind === "hosted") {
     progress("Registering the hosted target (metadata only)\u2026");
     const metadata2 = { ...current.metadata ?? {}, a2a: "true", a2aCard: a2aCardJson };
-    const foundryVersion2 = await createVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, definition: current.definition, metadata: metadata2, extraHeaders: { "Foundry-Features": "HostedAgents=V1Preview" } });
+    const foundryVersion2 = await createAgentVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, definition: current.definition, metadata: metadata2, extraHeaders: { "Foundry-Features": "HostedAgents=V1Preview" } });
     return { mode: "target", foundryVersion: foundryVersion2 };
   }
   if (current.definition.kind !== "prompt") {
@@ -15597,7 +15635,7 @@ async function enableA2a(args) {
     a2aCard: a2aCardJson,
     a2aBearerHash: bearerHash
   };
-  const foundryVersion = await createVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, definition, metadata });
+  const foundryVersion = await createAgentVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, definition, metadata });
   return { mode: "caller", connectionName, foundryVersion };
 }
 async function disableA2a(args) {
@@ -15614,7 +15652,7 @@ async function disableA2a(args) {
   delete metadata.a2a;
   delete metadata.a2aCard;
   delete metadata.a2aBearerHash;
-  const foundryVersion = await createVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, definition, metadata });
+  const foundryVersion = await createAgentVersion({ credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, definition, metadata });
   progress("Deleting the A2A connection\u2026");
   await deleteConnection2({ credential: args.credential, projectArmId: args.projectArmId, connectionName });
   return { connectionName, foundryVersion };
@@ -15656,20 +15694,6 @@ async function deleteConnection2(args) {
   await fetch(url, { method: "DELETE", headers: { Authorization: `Bearer ${token.token}` } }).catch(() => {
   });
 }
-async function createVersion(args) {
-  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE3);
-  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
-  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
-  const res = await fetch(url, { method: "POST", headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} }, body: JSON.stringify({ definition: args.definition, metadata: args.metadata }) });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new LocalCliError({ code: "A2A_CREATE_VERSION_FAILED", message: `POST ${url}: HTTP ${res.status.toString()}
-${text.slice(0, 500)}` });
-  }
-  const data = await res.json();
-  if (!data.version) throw new LocalCliError({ code: "A2A_CREATE_VERSION_NO_VERSION", message: "createVersion returned no version" });
-  return data.version;
-}
 
 // src/lib/agent-remove.ts
 init_foundry_agents();
@@ -16267,6 +16291,7 @@ import * as path16 from "path";
 import { Command as Command28, Option as Option26 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential13 } from "@azure/identity";
 init_errors();
+init_foundry_agent_get();
 
 // src/lib/preconditions.ts
 init_errors();
@@ -16472,7 +16497,7 @@ init_errors();
 async function deployHostedWorker(args) {
   const onProgress = args.onProgress ?? ((_m) => {
   });
-  const sleep2 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep3 = args.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = args.now ?? (() => Date.now());
   const timeout = args.pollTimeoutMs ?? 8 * 60 * 1e3;
   const interval = args.pollIntervalMs ?? 1e4;
@@ -16524,7 +16549,7 @@ async function deployHostedWorker(args) {
         hint: "Provisioning can take 2\u20135 min; re-run with the same name to resume, or check the version status in the Foundry portal."
       });
     }
-    await sleep2(interval);
+    await sleep3(interval);
   }
 }
 
@@ -16718,20 +16743,6 @@ var CoderDeployCommand = class extends M8tCommand {
         hint: "small=0.5/1Gi \xB7 medium=1/2Gi \xB7 large=2/4Gi"
       });
     }
-    const env = {
-      MODEL_DEPLOYMENT_NAME: this.modelDeployment ?? (typeof this.brain === "string" ? "gpt-5-mini" : DEFAULT_MODEL)
-    };
-    for (const pair of this.env ?? []) {
-      const eq = pair.indexOf("=");
-      if (eq <= 0) {
-        throw new LocalCliError({
-          code: "USAGE",
-          message: `Invalid --env '${pair}'. Expected KEY=VALUE.`,
-          hint: "Example: --env M8T_CODER_MAX_ITERATIONS=20"
-        });
-      }
-      env[pair.slice(0, eq)] = pair.slice(eq + 1);
-    }
     const persona = this.persona ?? "coding-agent";
     const imageInput = this.image ?? DEFAULT_IMAGE;
     const repoRef = imageInput.includes("/") ? imageInput : `${DEFAULT_REGISTRY}/${imageInput}`;
@@ -16752,6 +16763,30 @@ var CoderDeployCommand = class extends M8tCommand {
       interactive,
       endpoint: this.endpoint
     });
+    let currentEnv = {};
+    let currentMetadata = {};
+    try {
+      const current = await getAgentVersion({ credential: credential2, projectEndpoint: project.endpoint, agentName: this.name });
+      const def = current.definition;
+      currentEnv = { ...def.environment_variables ?? {} };
+      currentMetadata = { ...current.metadata ?? {} };
+    } catch {
+    }
+    const env = {
+      ...currentEnv,
+      MODEL_DEPLOYMENT_NAME: this.modelDeployment ?? currentEnv.MODEL_DEPLOYMENT_NAME ?? (typeof this.brain === "string" ? "gpt-5-mini" : DEFAULT_MODEL)
+    };
+    for (const pair of this.env ?? []) {
+      const eq = pair.indexOf("=");
+      if (eq <= 0) {
+        throw new LocalCliError({
+          code: "USAGE",
+          message: `Invalid --env '${pair}'. Expected KEY=VALUE.`,
+          hint: "Example: --env M8T_CODER_MAX_ITERATIONS=20"
+        });
+      }
+      env[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
     const staged = await stagePublicImageIfNeeded({ image: requestedImage, project });
     for (const n of staged.notes) {
       this.context.stderr.write(`${colors.hint("note:")} ${n}
@@ -16796,7 +16831,7 @@ var CoderDeployCommand = class extends M8tCommand {
       cpu: preset.cpu,
       memory: preset.memory,
       env,
-      metadata: { source: "m8t-stack-POC", kind: "hosted", persona: personaName, personaVersion },
+      metadata: { ...currentMetadata, source: "m8t-stack-POC", kind: "hosted", persona: personaName, personaVersion },
       onProgress
     });
     if (typeof this.brain === "string") {
@@ -17328,6 +17363,7 @@ var AzureExecDeployCommand = class extends M8tCommand {
 
 // src/commands/platform/status.ts
 import { Command as Command31, Option as Option29 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/identity";
 
 // src/lib/platform-update.ts
 init_errors();
@@ -17403,20 +17439,6 @@ function planUpdate(opts) {
   }
   return { kind: "roll", current: currentTag, available, target: available, repo: opts.imageRepo };
 }
-function summarizePlan(plan) {
-  switch (plan.kind) {
-    case "noop":
-      return { current: plan.current, available: plan.available, verdict: "up to date" };
-    case "roll":
-      return { current: plan.current, available: plan.available, verdict: "update available" };
-    case "no-versions":
-      return { current: plan.current, available: "-", verdict: "no published versions found" };
-    case "refuse-byoc":
-      return { current: plan.current, available: "-", verdict: `private-ACR image (${plan.currentRepo}) \u2014 not tracked` };
-    case "tag-not-found":
-      return { current: plan.current, available: plan.requested, verdict: `tag ${plan.requested} not published` };
-  }
-}
 async function fetchPublicTags(repo, fetchImpl = fetch) {
   if (!repo.startsWith("ghcr.io/")) {
     throw new LocalCliError({
@@ -17425,8 +17447,8 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Pass a ghcr.io/<owner>/<name> repo, or use the BYOC private-ACR deploy flow."
     });
   }
-  const path29 = repo.replace(/^ghcr\.io\//, "");
-  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path29}:pull`);
+  const path32 = repo.replace(/^ghcr\.io\//, "");
+  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path32}:pull`);
   if (!tokenRes.ok) {
     throw new LocalCliError({
       code: "PLATFORM_GHCR_TOKEN_FAILED",
@@ -17442,7 +17464,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Make the package public (deploy/ghcr-package-visibility.md), then retry."
     });
   }
-  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path29}/tags/list`, {
+  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path32}/tags/list`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!tagsRes.ok) {
@@ -17455,205 +17477,1370 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
   return body.tags ?? [];
 }
 
-// src/commands/platform/status.ts
-var PlatformStatusCommand = class extends M8tCommand {
-  static paths = [["platform", "status"]];
-  static usage = Command31.Usage({
-    description: "Show the deployed platform image vs the newest published version.",
-    details: "Discovers the live gateway, reads its current image tag, and compares it to the newest vX.Y.Z published on the public GHCR repo. Read-only \u2014 never rolls a revision."
-  });
-  subscription = Option29.String("--subscription");
-  imageRepo = Option29.String("--image-repo", DEFAULT_IMAGE_REPO);
-  output = Option29.String("--output");
-  resourceGroup = Option29.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
-  });
-  async executeCommand() {
-    const mode = resolveOutputMode(
-      this.output,
-      this.context.stdout
-    );
-    const ctx = await resolveGatewayContext({
-      interactive: mode !== "json",
-      subscriptionId: this.subscription,
-      resourceGroup: this.resourceGroup
-    });
-    const { resourceGroup, name } = parseContainerAppResourceId(ctx.containerAppResourceId);
-    const currentImage = (await runAz([
-      "containerapp",
-      "show",
-      "-g",
-      resourceGroup,
-      "-n",
-      name,
-      "--query",
-      "properties.template.containers[0].image",
-      "-o",
-      "tsv"
-    ])).trim();
-    const tags = await fetchPublicTags(this.imageRepo);
-    const plan = planUpdate({ currentImage, availableTags: tags, imageRepo: this.imageRepo });
-    const s = summarizePlan(plan);
-    if (mode === "json") {
-      this.context.stdout.write(renderJson({ gateway: name, resourceGroup, ...s, kind: plan.kind }) + "\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      renderKeyValueBlock([
-        { key: "gateway", value: name },
-        { key: "current", value: s.current },
-        { key: "available", value: s.available },
-        { key: "status", value: s.verdict }
-      ]) + "\n"
-    );
-    return 0;
-  }
-};
+// src/lib/release-channel.ts
+import * as fs18 from "fs";
 
-// src/commands/platform/update.ts
-import { Command as Command32, Option as Option30 } from "clipanion";
-import { confirm as confirm5 } from "@inquirer/prompts";
-init_errors();
-var PlatformUpdateCommand = class extends M8tCommand {
-  static paths = [["platform", "update"]];
-  static usage = Command32.Usage({
-    description: "Roll the gateway to the newest published platform image.",
-    details: "Discovers the live gateway, compares its image tag to the newest vX.Y.Z on the public GHCR repo, and (if newer) rolls a new Container Apps revision via 'az containerapp update --image'. A fresh tag is required to roll in single-revision mode. Use --check to preview, --to to pin a version, --yes to skip the prompt."
-  });
-  subscription = Option30.String("--subscription");
-  imageRepo = Option30.String("--image-repo", DEFAULT_IMAGE_REPO);
-  to = Option30.String("--to");
-  resourceGroup = Option30.String("--resource-group", {
-    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
-  });
-  check = Option30.Boolean("--check", false);
-  yes = Option30.Boolean("--yes", false);
-  output = Option30.String("--output");
-  async executeCommand() {
-    const mode = resolveOutputMode(
-      this.output,
-      this.context.stdout
-    );
-    const interactive = this.context.stdout.isTTY === true;
-    const log = (msg) => {
-      if (mode !== "json") this.context.stdout.write(msg + "\n");
-    };
-    const ctx = await resolveGatewayContext({
-      interactive: mode !== "json",
-      subscriptionId: this.subscription,
-      resourceGroup: this.resourceGroup
-    });
-    const { resourceGroup, name } = parseContainerAppResourceId(ctx.containerAppResourceId);
-    const currentImage = (await runAz([
-      "containerapp",
-      "show",
-      "-g",
-      resourceGroup,
-      "-n",
-      name,
-      "--query",
-      "properties.template.containers[0].image",
-      "-o",
-      "tsv"
-    ])).trim();
-    const tags = await fetchPublicTags(this.imageRepo);
-    const plan = planUpdate({
-      currentImage,
-      availableTags: tags,
-      imageRepo: this.imageRepo,
-      to: this.to
-    });
-    const s = summarizePlan(plan);
-    if (plan.kind === "refuse-byoc") {
-      throw new LocalCliError({
-        code: "PLATFORM_BYOC_NOT_TRACKED",
-        message: `This gateway runs a private-ACR image (${plan.currentRepo}), not the tracked public repo (${plan.trackedRepo}).`,
-        hint: "BYOC instances update by rebuilding + pushing your own image, then 'm8t deploy --image-ref <your-acr>'. Use --image-repo to track a different public repo."
-      });
+// src/lib/release-manifest.ts
+var SEVERITIES = ["critical", "recommended", "optional"];
+var IMAGE_KEYS = ["gateway", "codingAgent", "azureExecutor", "installer"];
+function isObj2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function validateManifest(m) {
+  const errors = [];
+  if (!isObj2(m)) return ["manifest is not an object"];
+  if (m.schemaVersion !== 1) errors.push("schemaVersion must be the integer 1");
+  const p = m.platform;
+  if (!isObj2(p)) {
+    errors.push("platform is required");
+  } else {
+    for (const f of ["version", "tag", "releasedAt", "commit", "notes", "notesUrl"]) {
+      if (typeof p[f] !== "string" || p[f].length === 0) errors.push(`platform.${f} is required`);
     }
-    if (plan.kind === "tag-not-found") {
-      throw new LocalCliError({
-        code: "PLATFORM_TAG_NOT_FOUND",
-        message: `Tag ${plan.requested} is not published on ${this.imageRepo}.`,
-        hint: "Run 'm8t platform status' to see the newest available version, or omit --to."
-      });
+    if (!SEVERITIES.includes(p.severity)) errors.push(`platform.severity must be one of ${SEVERITIES.join("|")}`);
+    if (!(typeof p.previousVersion === "string" || p.previousVersion === null)) {
+      errors.push("platform.previousVersion must be a string or null");
     }
-    if (plan.kind === "no-versions") {
-      throw new LocalCliError({
-        code: "PLATFORM_NO_VERSIONS",
-        message: `No published vX.Y.Z tags found on ${this.imageRepo}.`,
-        hint: "Publish one via the release-image workflow, or check --image-repo."
-      });
+  }
+  const c = m.components;
+  if (!isObj2(c)) {
+    errors.push("components is required");
+    return errors;
+  }
+  for (const key2 of IMAGE_KEYS) {
+    const img = c[key2];
+    if (!isObj2(img)) {
+      errors.push(`components.${key2} is required`);
+      continue;
     }
-    if (mode !== "json") {
-      this.context.stdout.write(
-        renderKeyValueBlock([
-          { key: "gateway", value: name },
-          { key: "current", value: s.current },
-          { key: "available", value: s.available },
-          { key: "status", value: s.verdict }
-        ]) + "\n"
-      );
+    if (img.kind !== "image") errors.push(`components.${key2}.kind must be "image"`);
+    for (const f of ["ref", "tag", "version"]) {
+      if (typeof img[f] !== "string" || img[f].length === 0) errors.push(`components.${key2}.${f} is required`);
     }
-    if (plan.kind === "noop") {
-      if (mode === "json") this.context.stdout.write(renderJson({ ...s, kind: plan.kind, rolled: false }) + "\n");
-      else log(colors.success("already up to date \u2713"));
-      return 0;
+    if (typeof img.digest !== "string" || !/^sha256:[0-9a-f]+$/.test(img.digest)) {
+      errors.push(`components.${key2}.digest must be a sha256:\u2026 digest`);
     }
-    if (this.check) {
-      if (mode === "json") this.context.stdout.write(renderJson({ ...s, kind: plan.kind, rolled: false, wouldRollTo: plan.target }) + "\n");
-      else log(colors.dim(`(--check) would roll to ${plan.target}`));
-      return 0;
+  }
+  const cli2 = c.cli;
+  if (!isObj2(cli2) || cli2.kind !== "npm") {
+    errors.push("components.cli (kind: npm) is required");
+  } else {
+    for (const f of ["package", "version", "min", "recommended"]) {
+      if (typeof cli2[f] !== "string" || cli2[f].length === 0) errors.push(`components.cli.${f} is required`);
     }
-    if (!this.yes && interactive) {
-      const ok = await confirm5({
-        message: `Roll ${name} from ${plan.current} to ${plan.target}?`,
-        default: true
-      });
-      if (!ok) {
-        log(colors.dim("aborted \u2014 no change."));
-        return 0;
+  }
+  const personas = c.personas;
+  if (!isObj2(personas) || !isObj2(personas.items)) {
+    errors.push("components.personas.items is required");
+  } else {
+    for (const [name, item] of Object.entries(personas.items)) {
+      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
+        errors.push(`components.personas.items.${name}.path is required`);
+      }
+      if (!isObj2(item) || typeof item.treeSha !== "string" || item.treeSha.length < 4) {
+        errors.push(`components.personas.items.${name}.treeSha is required`);
       }
     }
-    log(`rolling to ${plan.target}\u2026`);
-    await runAz([
-      "containerapp",
-      "update",
-      "-n",
-      name,
-      "-g",
-      resourceGroup,
-      "--image",
-      `${plan.repo}:${plan.target}`
-    ]);
-    if (mode === "json") this.context.stdout.write(renderJson({ ...s, kind: plan.kind, rolled: true, rolledTo: plan.target }) + "\n");
-    else log(colors.success(`rolled ${plan.current} \u2192 ${plan.target} \u2713`));
-    return 0;
   }
-};
-
-// src/commands/platform/enable-cost-report.ts
-import { Command as Command33, Option as Option31 } from "clipanion";
-
-// src/lib/wire-gateway-acs.ts
-init_rbac();
-async function wireGatewayForAcs(args) {
-  try {
-    await args.az([
-      "role",
-      "assignment",
-      "create",
-      "--assignee-object-id",
-      args.gatewayPrincipalId,
-      "--assignee-principal-type",
-      "ServicePrincipal",
-      "--role",
-      CONTRIBUTOR_ROLE_ID,
-      "--scope",
-      args.acsResourceId
-    ]);
-  } catch (e) {
-    if (!(e instanceof Error && /RoleAssignmentExists/i.test(e.message))) throw e;
+  const seeds = c.brainSeeds;
+  if (!isObj2(seeds) || !isObj2(seeds.items)) {
+    errors.push("components.brainSeeds.items is required");
+  } else {
+    for (const [name, item] of Object.entries(seeds.items)) {
+      if (!isObj2(item) || typeof item.path !== "string" || item.path.length === 0) {
+        errors.push(`components.brainSeeds.items.${name}.path is required`);
+      }
+      if (!isObj2(item) || !isObj2(item.subtrees)) {
+        errors.push(`components.brainSeeds.items.${name}.subtrees is required`);
+      }
+    }
+  }
+  const infra = c.infra;
+  if (infra !== void 0) {
+    if (!isObj2(infra) || infra.kind !== "infra") {
+      errors.push('components.infra.kind must be "infra"');
+    }
+    if (!isObj2(infra) || typeof infra.treeSha !== "string" || infra.treeSha.length < 4) {
+      errors.push("components.infra.treeSha is required");
+    }
+  }
+  return errors;
+}
+
+// src/lib/release-channel.ts
+init_errors();
+var CHANNEL_LATEST_URL = "https://github.com/m8t-run/m8t/releases/latest/download/manifest.json";
+function channelUrlForVersion(tag) {
+  return `https://github.com/m8t-run/m8t/releases/download/${tag}/manifest.json`;
+}
+async function fetchManifest(source, deps = {}) {
+  const readFile8 = deps.readFile ?? ((p) => fs18.readFileSync(p, "utf8"));
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const ghToken = deps.ghToken ?? getGhToken;
+  let raw;
+  if ("file" in source) {
+    try {
+      raw = readFile8(source.file);
+    } catch (e) {
+      throw new LocalCliError({ code: "PLATFORM_MANIFEST_READ_FAILED", message: `Could not read manifest file '${source.file}': ${e.message}` });
+    }
+  } else {
+    const url = "url" in source ? source.url : source.version ? channelUrlForVersion(source.version) : CHANNEL_LATEST_URL;
+    let token;
+    try {
+      token = await ghToken();
+    } catch {
+      token = void 0;
+    }
+    const res = await fetchImpl(url, { headers: token ? { Authorization: `Bearer ${token}` } : {} });
+    if (!res.ok) {
+      throw new LocalCliError({
+        code: "PLATFORM_MANIFEST_FETCH_FAILED",
+        message: `GET ${url} returned HTTP ${res.status.toString()}.`,
+        hint: "The release channel is auth-gated until the repo is public. Run 'gh auth login', or pass --manifest-file / --manifest-url."
+      });
+    }
+    raw = JSON.stringify(await res.json());
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new LocalCliError({ code: "PLATFORM_MANIFEST_PARSE_FAILED", message: `Manifest is not valid JSON: ${e.message}` });
+  }
+  const errors = validateManifest(parsed);
+  if (errors.length > 0) {
+    throw new LocalCliError({
+      code: "PLATFORM_MANIFEST_INVALID",
+      message: `Fetched manifest failed validation:
+  - ${errors.join("\n  - ")}`
+    });
+  }
+  return parsed;
+}
+
+// src/lib/release-content.ts
+import * as fs19 from "fs";
+import * as os8 from "os";
+import * as path18 from "path";
+import { execFileSync } from "child_process";
+init_errors();
+var OWNER_REPO = "m8t-run/m8t";
+function parseTreeResponse(body) {
+  const map = /* @__PURE__ */ new Map();
+  for (const e of body.tree ?? []) if (e.type === "tree") map.set(e.path, e.sha);
+  return { treeShaOf: (p) => map.get(p.replace(/\/$/, "")) };
+}
+async function fetchRepoTree(commit, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const ghToken = deps.ghToken ?? getGhToken;
+  let token;
+  try {
+    token = await ghToken();
+  } catch {
+    token = void 0;
+  }
+  const url = `https://api.github.com/repos/${OWNER_REPO}/git/trees/${commit}?recursive=1`;
+  const res = await fetchImpl(url, {
+    headers: { Accept: "application/vnd.github+json", ...token ? { Authorization: `Bearer ${token}` } : {} }
+  });
+  if (!res.ok) {
+    throw new LocalCliError({ code: "PLATFORM_TREE_FETCH_FAILED", message: `GET ${url} \u2192 HTTP ${res.status.toString()}.` });
+  }
+  return parseTreeResponse(await res.json());
+}
+function verifyPersonaTrees(manifest, tree) {
+  const out = [];
+  for (const [name, item] of Object.entries(manifest.components.personas.items)) {
+    const actual = tree.treeShaOf(item.path);
+    if (actual !== void 0 && actual !== item.treeSha) {
+      out.push(`persona '${name}' (${item.path}): manifest pins ${item.treeSha} but commit tree has ${actual}`);
+    }
+  }
+  return out;
+}
+async function resolveReleaseContent(manifest, opts = {}) {
+  if (opts.contentDir) {
+    if (!fs19.existsSync(path18.join(opts.contentDir, "personas"))) {
+      throw new LocalCliError({ code: "PLATFORM_CONTENT_DIR_INVALID", message: `--content-dir '${opts.contentDir}' has no personas/ \u2014 not a repo checkout.` });
+    }
+    return opts.contentDir;
+  }
+  const commit = manifest.platform.commit;
+  const cacheRoot = opts.cacheRoot ?? path18.join(os8.homedir(), ".m8t-stack", "cache");
+  const dest = path18.join(cacheRoot, `release-${commit}`);
+  if (fs19.existsSync(path18.join(dest, "personas"))) return dest;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const ghToken = opts.ghToken ?? getGhToken;
+  let token;
+  try {
+    token = await ghToken();
+  } catch {
+    token = void 0;
+  }
+  const url = `https://api.github.com/repos/${OWNER_REPO}/tarball/${commit}`;
+  const res = await fetchImpl(url, { headers: token ? { Authorization: `Bearer ${token}` } : {} });
+  if (!res.ok) {
+    throw new LocalCliError({ code: "PLATFORM_TARBALL_FETCH_FAILED", message: `GET ${url} \u2192 HTTP ${res.status.toString()}.` });
+  }
+  fs19.mkdirSync(cacheRoot, { recursive: true });
+  const tmp = fs19.mkdtempSync(path18.join(cacheRoot, `.dl-${commit.slice(0, 8)}-`));
+  try {
+    const tgz = path18.join(tmp, "src.tar.gz");
+    fs19.writeFileSync(tgz, Buffer.from(await res.arrayBuffer()));
+    const unpacked = path18.join(tmp, "unpacked");
+    fs19.mkdirSync(unpacked);
+    extractTarGz(tgz, unpacked);
+    try {
+      fs19.renameSync(unpacked, dest);
+    } catch (e) {
+      const err = e;
+      const isBenignRace = (err.code === "EEXIST" || err.code === "ENOTEMPTY") && fs19.existsSync(path18.join(dest, "personas"));
+      if (!isBenignRace) {
+        throw new LocalCliError({
+          code: "PLATFORM_CACHE_PUBLISH_FAILED",
+          message: `Could not publish release cache to ${dest}: ${err.message}`
+        });
+      }
+    }
+  } finally {
+    fs19.rmSync(tmp, { recursive: true, force: true });
+  }
+  return dest;
+}
+function extractTarGz(tgz, into) {
+  execFileSync("tar", ["-xzf", tgz, "-C", into, "--strip-components=1"]);
+}
+
+// src/lib/platform-stamp.ts
+import { TableClient, AzureNamedKeyCredential } from "@azure/data-tables";
+init_errors();
+init_rbac();
+
+// src/lib/platform-storage-discovery.ts
+init_http();
+init_errors();
+var ARM3 = "https://management.azure.com";
+var ARM_SCOPE7 = "https://management.azure.com/.default";
+var STORAGE_API = "2023-05-01";
+async function discoverStampStorage(opts) {
+  const list = await authedJson({
+    credential: opts.credential,
+    scope: ARM_SCOPE7,
+    method: "GET",
+    url: `${ARM3}/subscriptions/${opts.subscriptionId}/resourceGroups/${opts.resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API}`
+  }) ?? {};
+  const accounts = (list.value ?? []).filter((a) => a.properties?.primaryEndpoints?.table);
+  const chosen = accounts.find((a) => a.tags?.["m8t-stack"] === "storage") ?? accounts.find((a) => a.tags?.["m8t-stack:role"] === "gateway" || a.tags?.["m8t-stack:role"] === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
+  const tableEndpoint = chosen?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
+  if (!tableEndpoint || !chosen?.id || !chosen.name) {
+    throw new LocalCliError({
+      code: "PLATFORM_STAMP_STORAGE_NOT_FOUND",
+      message: `No table-capable storage account found in resource group ${opts.resourceGroup}.`,
+      hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}.`
+    });
+  }
+  return { tableEndpoint, accountResourceId: chosen.id, accountName: chosen.name };
+}
+
+// src/lib/platform-stamp.ts
+var TABLE = "Metadata";
+var PK = "system";
+var RK = "platform";
+function stampToEntity(s) {
+  return {
+    partitionKey: PK,
+    rowKey: RK,
+    platformVersion: s.platformVersion,
+    updatedAt: s.updatedAt,
+    lastResult: s.lastResult,
+    value: JSON.stringify(s)
+  };
+}
+function entityToStamp(e) {
+  const raw = e.value;
+  if (typeof raw !== "string") return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function makeSharedKeyClient(opts) {
+  const rg = /\/resourceGroups\/([^/]+)\//i.exec(opts.accountResourceId)?.[1];
+  if (!rg) return null;
+  const key2 = (await runAz(["storage", "account", "keys", "list", "--account-name", opts.accountName, "-g", rg, "--query", "[0].value", "-o", "tsv"])).trim();
+  if (!key2) return null;
+  return new TableClient(opts.tableEndpoint, TABLE, new AzureNamedKeyCredential(opts.accountName, key2));
+}
+async function writeStamp(opts) {
+  const { tableEndpoint, accountResourceId, accountName } = await discoverStampStorage(opts);
+  const entity = stampToEntity(opts.stamp);
+  const aad = new TableClient(tableEndpoint, TABLE, opts.credential);
+  await aad.createTable().catch(() => void 0);
+  try {
+    await aad.upsertEntity(entity, "Replace");
+    return;
+  } catch (e) {
+    if (!is403(e)) throw e;
+  }
+  opts.onProgress?.("writing the platform stamp with the account key \u2014 your identity lacks the Storage Table data role.");
+  const shared = await makeSharedKeyClient({ tableEndpoint, accountResourceId, accountName });
+  if (shared) {
+    await shared.createTable().catch(() => void 0);
+    await shared.upsertEntity(entity, "Replace");
+    return;
+  }
+  opts.onProgress?.("shared-key access is disabled \u2014 granting Storage Table Data Contributor to your identity (one-time)\u2026");
+  try {
+    const oid = await getCallerObjectId();
+    await grantStorageTableDataContributor({
+      credential: opts.credential,
+      subscriptionId: opts.subscriptionId,
+      scope: accountResourceId,
+      principalId: oid
+    });
+  } catch (e) {
+    throw new LocalCliError({
+      code: "PLATFORM_STAMP_NO_ACCESS",
+      message: `Cannot write the platform stamp: AAD lacks the Storage Table data role for ${accountName}, shared-key access is disabled, and self-granting the role failed.`,
+      hint: "Grant yourself 'Storage Table Data Contributor' on the storage account and retry.",
+      cause: e
+    });
+  }
+  for (let i = 0; i < 6; i++) {
+    await sleep2(1e4);
+    try {
+      await aad.upsertEntity(entity, "Replace");
+      return;
+    } catch (e) {
+      if (!is403(e)) throw e;
+    }
+  }
+  throw new LocalCliError({
+    code: "PLATFORM_STAMP_NO_ACCESS",
+    message: `Cannot write the platform stamp: granted 'Storage Table Data Contributor' on ${accountName}, but the data-plane role has not propagated yet.`,
+    hint: "The role assignment persists \u2014 retry 'm8t platform update' in a few minutes."
+  });
+}
+async function readStamp(opts) {
+  const { tableEndpoint, accountResourceId, accountName } = await discoverStampStorage(opts);
+  const aad = new TableClient(tableEndpoint, TABLE, opts.credential);
+  try {
+    const row = await aad.getEntity(PK, RK);
+    return entityToStamp(row);
+  } catch (e) {
+    if (is404(e)) return null;
+    if (!is403(e)) return null;
+  }
+  try {
+    const shared = await makeSharedKeyClient({ tableEndpoint, accountResourceId, accountName });
+    if (!shared) return null;
+    const row = await shared.getEntity(PK, RK);
+    return entityToStamp(row);
+  } catch {
+    return null;
+  }
+}
+function is403(e) {
+  return e.statusCode === 403;
+}
+function is404(e) {
+  return e.statusCode === 404;
+}
+function sleep2(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/lib/platform-converge.ts
+import * as fs21 from "fs";
+import * as path20 from "path";
+import { parse as parseYaml10 } from "yaml";
+
+// src/lib/deploy.ts
+import * as fs20 from "fs/promises";
+import * as os9 from "os";
+import * as path19 from "path";
+init_errors();
+var FOUNDRY_TRACING_MODES = ["project", "account", "skip"];
+function parseFoundryTracingMode(v) {
+  if (v === void 0) return void 0;
+  if (!FOUNDRY_TRACING_MODES.includes(v)) {
+    throw new LocalCliError({
+      code: "DEPLOY_INVALID_TRACING_MODE",
+      message: `Invalid --foundry-tracing value: '${v}'.`,
+      hint: `Use one of: ${FOUNDRY_TRACING_MODES.join(", ")}.`
+    });
+  }
+  return v;
+}
+function buildBicepParams(p) {
+  const params = [
+    `location=${p.location}`,
+    `suffix=${p.suffix}`,
+    `imageRef=${p.imageRef}`,
+    `tenantId=${p.tenantId}`,
+    `clientId=${p.clientId}`,
+    `foundryResourceId=${p.foundryResourceId}`,
+    `foundryProjectEndpoint=${p.foundryProjectEndpoint}`,
+    `acrPullIdentityResourceId=${p.acrPullIdentityResourceId}`,
+    `acrResourceId=${p.acrResourceId}`
+  ];
+  if (p.foundryTracingMode) params.push(`foundryTracingMode=${p.foundryTracingMode}`);
+  return params;
+}
+async function resolveRepoRoot2(home = os9.homedir()) {
+  const marker = path19.join(home, ".m8t-stack", "repo-root");
+  try {
+    const root = (await fs20.readFile(marker, "utf8")).trim();
+    if (!root) throw new Error("empty");
+    return root;
+  } catch {
+    throw new LocalCliError({
+      code: "DEPLOY_NO_REPO_ROOT",
+      message: "~/.m8t-stack/repo-root marker is missing or empty.",
+      hint: "Run 'm8t install' from an m8t-stack checkout (it writes the marker), or run 'm8t deploy' from the repo."
+    });
+  }
+}
+async function resolveFoundryResourceId(endpoint, explicit) {
+  if (explicit) return explicit;
+  const m = /^https:\/\/([^.]+)\.services\.ai\.azure\.com/.exec(endpoint);
+  if (!m) {
+    throw new LocalCliError({
+      code: "DEPLOY_FOUNDRY_ENDPOINT_BAD",
+      message: `Cannot parse the Foundry account name from endpoint: ${endpoint}`,
+      hint: "Pass --foundry-resource-id <ARM-id> explicitly."
+    });
+  }
+  const accounts = JSON.parse(
+    await runAz([
+      "cognitiveservices",
+      "account",
+      "list",
+      "--query",
+      `[?name=='${m[1]}'].id`,
+      "--output",
+      "json"
+    ])
+  );
+  if (accounts.length === 0) {
+    throw new LocalCliError({
+      code: "DEPLOY_FOUNDRY_NOT_FOUND",
+      message: `No Foundry account named '${m[1]}' in the active subscription.`,
+      hint: "Check the endpoint, or pass --foundry-resource-id explicitly."
+    });
+  }
+  if (accounts.length > 1) {
+    throw new LocalCliError({
+      code: "DEPLOY_FOUNDRY_AMBIGUOUS",
+      message: `Multiple Foundry accounts named '${m[1]}' \u2014 ambiguous.`,
+      hint: "Pass --foundry-resource-id <ARM-id> to disambiguate."
+    });
+  }
+  return accounts[0];
+}
+async function resolveAcrResourceId(opts) {
+  if (opts.explicit) return opts.explicit;
+  const host = opts.imageRef.split("/")[0];
+  if (!host.endsWith(".azurecr.io")) return "";
+  const acrName = host.split(".")[0];
+  try {
+    const id = (await runAz(["acr", "show", "-n", acrName, "--query", "id", "-o", "tsv"])).trim();
+    if (!id) throw new Error("empty id");
+    return id;
+  } catch (e) {
+    if (e instanceof LocalCliError) throw e;
+    throw new LocalCliError({
+      code: "DEPLOY_ACR_NOT_FOUND",
+      message: `Cannot resolve the ACR '${acrName}' for image ${opts.imageRef}.`,
+      hint: "Create it (az acr create), sign in (az acr login), and push the web image (docker buildx \u2026 --push); or pass --acr-resource-id <ARM-id>."
+    });
+  }
+}
+async function ensureResourceGroup(name, location) {
+  const existing = JSON.parse(
+    await runAz(["group", "show", "--name", name, "--output", "json"]).catch(() => "") || "null"
+  );
+  if (existing) return;
+  await runAz(["group", "create", "--name", name, "--location", location, "--tags", "m8t-stack=deployment"]);
+}
+function resolveAcrPullIdentity(opts) {
+  return opts.explicit ?? "";
+}
+async function runBicepDeployment(opts) {
+  const bicepPath = path19.join(opts.repoRoot, "deploy", "main.bicep");
+  const result = JSON.parse(
+    await runAz([
+      "deployment",
+      "group",
+      "create",
+      "--name",
+      opts.deploymentName,
+      "--resource-group",
+      opts.resourceGroup,
+      "--template-file",
+      bicepPath,
+      "--parameters",
+      ...opts.params,
+      "--output",
+      "json"
+    ])
+  );
+  const outputs = result.properties?.outputs ?? {};
+  const fqdn = outputs.containerAppFqdn?.value;
+  if (typeof fqdn !== "string" || !fqdn) {
+    throw new LocalCliError({
+      code: "DEPLOY_NO_FQDN",
+      message: "Bicep deployment did not return containerAppFqdn.",
+      hint: "Check deploy/main.bicep outputs and the deployment log."
+    });
+  }
+  return {
+    containerAppFqdn: fqdn,
+    resourceNames: outputs.resourceNames?.value ?? {}
+  };
+}
+
+// src/lib/platform-converge.ts
+init_foundry_agent_get();
+init_errors();
+
+// src/lib/persona-compose.ts
+function composeInstructions(args) {
+  const live = args.current.definition.instructions ?? "";
+  let out = args.baseBody;
+  const hadLoader = stripBrainLoader(live) !== live;
+  if (hadLoader && args.loaderText) {
+    const templated = args.brainRepo ? args.loaderText.replaceAll("{{brain_repo}}", args.brainRepo) : args.loaderText;
+    out = appendBrainLoader(out, templated);
+  }
+  if (hasA2aSnippet(live)) out = appendSnippet(out);
+  return out;
+}
+function resolveFillableValues(current, yamlValues) {
+  const raw = current.metadata?.fillableFieldValues;
+  if (typeof raw === "string") {
+    try {
+      return JSON.parse(raw);
+    } catch {
+    }
+  }
+  return yamlValues;
+}
+function isNoop(candidate2, current) {
+  const a = candidate2.definition.instructions ?? "";
+  const b = current.definition.instructions ?? "";
+  if (a !== b) return false;
+  if (JSON.stringify(candidate2.definition.tools ?? []) !== JSON.stringify(current.definition.tools ?? [])) return false;
+  return JSON.stringify(sortObj(candidate2.metadata)) === JSON.stringify(sortObj(current.metadata ?? {}));
+}
+function sortObj(o) {
+  return Object.fromEntries(Object.entries(o).sort(([x], [y]) => x.localeCompare(y)));
+}
+
+// src/lib/platform-converge.ts
+var ORDER = ["infra", "gateway", "codingAgent", "azureExecutor", "personas"];
+function infraTargetSha(manifest, tree) {
+  return manifest.components.infra?.treeSha ?? tree.treeShaOf("deploy") ?? "";
+}
+function diffPlan(manifest, stamp, tree, opts = {}) {
+  const actions = [];
+  const skipped = [];
+  const adopt = stamp === null;
+  const want = (k) => opts.only === void 0 || opts.only === k;
+  for (const component of ORDER) {
+    if (!want(component)) {
+      skipped.push({ component, reason: "only-filter" });
+      continue;
+    }
+    if (component === "infra") {
+      if (opts.skipInfra) {
+        skipped.push({ component, reason: "up-to-date" });
+        continue;
+      }
+      const to = infraTargetSha(manifest, tree);
+      const from2 = stamp?.components.infra.treeSha ?? null;
+      if (opts.forceInfra) actions.push({ component, reason: "forced", from: from2, to });
+      else if (adopt) actions.push({ component, reason: "adopt", from: from2, to });
+      else if (from2 !== to) skipped.push({ component, reason: "deferred" });
+      else skipped.push({ component, reason: "up-to-date" });
+      continue;
+    }
+    if (component === "personas") {
+      for (const [name, item] of Object.entries(manifest.components.personas.items)) {
+        const from2 = stamp?.components.personas[name]?.treeSha ?? null;
+        if (adopt) actions.push({ component, personaName: name, reason: "adopt", from: from2, to: item.treeSha });
+        else if (from2 !== item.treeSha) actions.push({ component, personaName: name, reason: "changed", from: from2, to: item.treeSha });
+        else skipped.push({ component, personaName: name, reason: "up-to-date" });
+      }
+      continue;
+    }
+    const img = manifest.components[component];
+    const cur = stamp?.components[component];
+    if (cur?.state === "external") {
+      skipped.push({ component, reason: "external" });
+      continue;
+    }
+    const from = cur?.tag ?? null;
+    if (adopt) actions.push({ component, reason: "adopt", from, to: img.tag });
+    else if (from !== img.tag) actions.push({ component, reason: "changed", from, to: img.tag });
+    else skipped.push({ component, reason: "up-to-date" });
+  }
+  return { targetVersion: manifest.platform.tag, previousVersion: manifest.platform.previousVersion, actions, skipped };
+}
+function statusRows(manifest, stamp, tree, opts = {}) {
+  const plan = diffPlan(manifest, stamp, tree, opts);
+  const rows = [];
+  for (const a of plan.actions) {
+    rows.push({
+      component: a.component,
+      ...a.personaName ? { personaName: a.personaName } : {},
+      installed: a.from ?? "(none)",
+      target: a.to,
+      status: a.reason === "adopt" ? "needs-adopt" : "drift"
+    });
+  }
+  for (const s of plan.skipped) {
+    rows.push({
+      component: s.component,
+      ...s.personaName ? { personaName: s.personaName } : {},
+      installed: installedValueOf(stamp, s.component, s.personaName),
+      target: targetValueOf(manifest, tree, s.component, s.personaName),
+      status: s.reason
+    });
+  }
+  return rows;
+}
+function installedValueOf(stamp, component, personaName) {
+  if (!stamp) return "-";
+  if (component === "infra") return stamp.components.infra.treeSha || "-";
+  if (component === "personas") {
+    if (!personaName || !Object.hasOwn(stamp.components.personas, personaName)) return "-";
+    return stamp.components.personas[personaName].treeSha;
+  }
+  return stamp.components[component].tag;
+}
+function targetValueOf(manifest, tree, component, personaName) {
+  if (component === "infra") return infraTargetSha(manifest, tree) || "-";
+  if (component === "personas") {
+    if (!personaName || !Object.hasOwn(manifest.components.personas.items, personaName)) return "-";
+    return manifest.components.personas.items[personaName].treeSha;
+  }
+  return manifest.components[component].tag;
+}
+async function applyPlan(plan, deps, ctx) {
+  const prior = await deps.readStamp();
+  const stamp = seedStamp(prior, ctx.manifest, plan);
+  delete stamp.lastError;
+  const applied = [];
+  try {
+    for (const a of plan.actions) {
+      if (a.component === "infra") {
+        stamp.components.infra = await deps.applyInfra(a, ctx);
+      } else if (a.component === "gateway") {
+        stamp.components.gateway = await deps.applyGateway(a, ctx);
+      } else if (a.component === "codingAgent" || a.component === "azureExecutor") {
+        const r = await deps.applyAgent(a, ctx);
+        if (r !== "absent") {
+          stamp.components[a.component] = { ...r, state: "managed" };
+        } else {
+          ctx.onProgress?.(`${a.component}: not deployed on this install \u2014 stamp left unchanged.`);
+        }
+      } else {
+        if (!a.personaName) {
+          throw new LocalCliError({ code: "PLATFORM_PERSONA_NO_NAME", message: "persona action missing personaName" });
+        }
+        const r = await deps.applyPersona(a, ctx);
+        if (r === "absent") {
+          ctx.onProgress?.(`persona '${a.personaName}': not deployed on this install \u2014 stamp left unchanged.`);
+        } else {
+          const prev = Object.hasOwn(stamp.components.personas, a.personaName) ? stamp.components.personas[a.personaName] : void 0;
+          stamp.components.personas[a.personaName] = r === "noop" ? { treeSha: a.to, foundryVersion: prev?.foundryVersion ?? "" } : r;
+        }
+      }
+      applied.push(a);
+      stamp.lastResult = "partial";
+      stamp.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await deps.writeStamp(stamp);
+    }
+    await deps.healthGate(ctx, applied);
+    stamp.lastResult = "success";
+    delete stamp.lastError;
+    const isTargeted = plan.skipped.some((s) => s.reason === "only-filter");
+    if (!isTargeted && plan.targetVersion !== stamp.platformVersion) {
+      stamp.previousPlatformVersion = stamp.platformVersion;
+      stamp.platformVersion = plan.targetVersion;
+    }
+    stamp.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    await deps.writeStamp(stamp);
+    return { stamp, applied };
+  } catch (e) {
+    stamp.lastResult = "failed";
+    stamp.lastError = {
+      component: applied.length < plan.actions.length ? plan.actions[applied.length].component : "healthGate",
+      message: e.message
+    };
+    stamp.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    await deps.writeStamp(stamp).catch(() => {
+    });
+    throw e;
+  }
+}
+function seedStamp(prior, manifest, plan) {
+  const blankImg = () => ({ tag: "", digest: "", state: "managed" });
+  return prior ? { ...prior } : {
+    schemaVersion: 1,
+    platformVersion: plan.targetVersion,
+    previousPlatformVersion: plan.previousVersion,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lastResult: "partial",
+    cli: "",
+    components: { gateway: blankImg(), codingAgent: blankImg(), azureExecutor: blankImg(), personas: {}, infra: { treeSha: "" } }
+  };
+}
+async function applyGatewayImage(a, ctx, gatewayResourceId) {
+  const { resourceGroup, name } = parseContainerAppResourceId(gatewayResourceId);
+  const current = (await runAz(["containerapp", "show", "-g", resourceGroup, "-n", name, "--query", "properties.template.containers[0].image", "-o", "tsv"])).trim();
+  const tags = await fetchPublicTags(DEFAULT_IMAGE_REPO);
+  const plan = planUpdate({ currentImage: current, availableTags: tags, imageRepo: DEFAULT_IMAGE_REPO, to: a.to });
+  const digest = ctx.manifest.components.gateway.digest;
+  switch (plan.kind) {
+    case "refuse-byoc":
+      ctx.onProgress?.(`gateway is BYOC (${plan.currentRepo}) \u2014 marking externally managed.`);
+      return { tag: a.to, digest, state: "external" };
+    case "roll":
+      await runAz(["containerapp", "update", "-n", name, "-g", resourceGroup, "--image", `${plan.repo}:${plan.target}`]);
+      return { tag: a.to, digest, state: "managed" };
+    case "noop":
+      return { tag: a.to, digest, state: "managed" };
+    case "tag-not-found":
+      throw new LocalCliError({
+        code: "PLATFORM_GATEWAY_TAG_UNAVAILABLE",
+        message: `Gateway image tag '${a.to}' is not published on the tracked repo \u2014 cannot converge the gateway.`,
+        hint: "The manifest may be ahead of the registry (propagation lag), or the repo is wrong. Retry shortly or check --image-repo."
+      });
+    case "no-versions":
+      throw new LocalCliError({
+        code: "PLATFORM_GATEWAY_NO_VERSIONS",
+        message: "No published gateway image versions found on the tracked repo."
+      });
+  }
+}
+async function applyInfraDeploy(a, ctx, target, opts = {}) {
+  if (a.reason !== "forced") {
+    ctx.onProgress?.(`infra baseline recorded at ${target} (not re-provisioned; apply with --force-infra or the update job).`);
+    return { treeSha: target };
+  }
+  ctx.onProgress?.("converging infra (idempotent bicep deploy)\u2026");
+  const params = await resolveBicepParamsForConverge(ctx, opts);
+  await runBicepDeployment({
+    resourceGroup: ctx.resourceGroup,
+    repoRoot: ctx.contentDir,
+    params: buildBicepParams(params),
+    deploymentName: `m8t-converge-${target.slice(0, 12)}`
+  });
+  return { treeSha: target };
+}
+async function resolveBicepParamsForConverge(ctx, opts = {}) {
+  if (!opts.suffix) {
+    throw new LocalCliError({
+      code: "PLATFORM_INFRA_SUFFIX_REQUIRED",
+      message: "A --force-infra converge deploy requires an explicit --suffix.",
+      hint: "Pass --suffix <existing-suffix> (from the deployed resource names) to avoid provisioning duplicate resources."
+    });
+  }
+  const location = (await runAz(["resource", "list", "-g", ctx.resourceGroup, "--query", "[0].location", "-o", "tsv"])).trim();
+  const foundryResourceId = await resolveFoundryResourceId(opts.foundryEndpoint ?? "", opts.foundryResourceId);
+  const acrPullIdentityResourceId = resolveAcrPullIdentity({ explicit: opts.acrPullIdentity });
+  const imageRef = `${ctx.manifest.components.gateway.ref}:${ctx.manifest.components.gateway.tag}`;
+  const acrResourceId = await resolveAcrResourceId({ imageRef, explicit: opts.acrResourceId });
+  return {
+    location,
+    suffix: opts.suffix,
+    imageRef,
+    tenantId: opts.tenantId ?? "",
+    clientId: opts.clientId ?? "",
+    foundryResourceId,
+    foundryProjectEndpoint: opts.foundryEndpoint ?? "",
+    acrPullIdentityResourceId,
+    acrResourceId,
+    foundryTracingMode: opts.foundryTracingMode
+  };
+}
+function swapHostedImage(def, newImage) {
+  return { ...def, image: newImage };
+}
+async function applyAgentImage(a, ctx, opts) {
+  const current = await getAgentVersion({ credential: ctx.credential, projectEndpoint: opts.project.endpoint, agentName: opts.agentName });
+  const staged = await stagePublicImageIfNeeded({ image: opts.ghcrImage, project: opts.project, onProgress: ctx.onProgress });
+  const definition = swapHostedImage(current.definition, staged.image);
+  await createAgentVersion({
+    credential: ctx.credential,
+    projectEndpoint: opts.project.endpoint,
+    agentName: opts.agentName,
+    definition,
+    metadata: current.metadata ?? {},
+    extraHeaders: { "Foundry-Features": "HostedAgents=V1Preview" }
+  });
+  const digest = a.component === "codingAgent" ? ctx.manifest.components.codingAgent.digest : ctx.manifest.components.azureExecutor.digest;
+  return { tag: a.to, digest };
+}
+function declaredFillableFields(personaPath) {
+  let raw;
+  try {
+    raw = fs21.readFileSync(personaPath, "utf8");
+  } catch {
+    return [];
+  }
+  const fmMatch = /^---\n([\s\S]*?)\n---/.exec(raw);
+  if (!fmMatch) return [];
+  try {
+    const fm = parseYaml10(fmMatch[1]);
+    return fm["fillable-fields"] ?? [];
+  } catch {
+    return [];
+  }
+}
+function defaultsOf(declared) {
+  const out = {};
+  for (const f of declared) {
+    if (f.default !== void 0) out[f.name] = f.default;
+  }
+  return out;
+}
+function injectAndRender(personaPath, values, agentName) {
+  return renderPersonaBody(personaPath, values, agentName);
+}
+function loaderText(loaderPath) {
+  if (!loaderPath) return null;
+  try {
+    return fs21.readFileSync(loaderPath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function brainRepoOf(current) {
+  const raw = current.metadata?.brain;
+  if (typeof raw !== "string") return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed.repo || null;
+  } catch {
+    return null;
+  }
+}
+async function applyPersona(a, ctx, opts) {
+  const current = await getAgentVersion({ credential: ctx.credential, projectEndpoint: opts.project.endpoint, agentName: opts.agentName });
+  const personaPath = path20.join(opts.personaDir, "persona.md");
+  const yamlValues = readAgentYaml(opts.agentName)?.fillableFieldValues ?? null;
+  const values = resolveFillableValues(current, yamlValues);
+  const declared = declaredFillableFields(personaPath);
+  if (declared.length > 0 && values === null) {
+    const defaultBody = injectAndRender(personaPath, defaultsOf(declared), opts.agentName);
+    const candidateInstructions = composeInstructions({
+      baseBody: defaultBody,
+      current,
+      loaderText: loaderText(opts.loaderPath),
+      brainRepo: brainRepoOf(current)
+    });
+    if (candidateInstructions !== (current.definition.instructions ?? "")) {
+      throw new LocalCliError({
+        code: "PLATFORM_PERSONA_UNRECOVERABLE",
+        message: `Cannot re-version '${opts.agentName}' \u2014 its instance field values are not recoverable (would revert to defaults). Re-deploy the advisor, or pass --content-dir with the correct values.`
+      });
+    }
+  }
+  const missing = declared.filter((f) => !values?.[f.name] && f.default === void 0);
+  if (missing.length > 0) {
+    throw new LocalCliError({
+      code: "PLATFORM_PERSONA_FIELD_MISSING",
+      message: `Persona '${a.personaName ?? opts.agentName}' needs values for: ${missing.map((f) => f.name).join(", ")}.`
+    });
+  }
+  const baseBody = injectAndRender(personaPath, values ?? defaultsOf(declared), opts.agentName);
+  const instructions = composeInstructions({
+    baseBody,
+    current,
+    loaderText: loaderText(opts.loaderPath),
+    brainRepo: brainRepoOf(current)
+  });
+  const metadata = {
+    ...current.metadata ?? {},
+    persona: a.personaName ?? opts.agentName,
+    ...values ? { fillableFieldValues: JSON.stringify(values) } : {}
+  };
+  const candidate2 = { definition: { ...current.definition, instructions }, metadata };
+  if (isNoop(candidate2, current)) return "noop";
+  const foundryVersion = await createAgentVersion({
+    credential: ctx.credential,
+    projectEndpoint: opts.project.endpoint,
+    agentName: opts.agentName,
+    definition: candidate2.definition,
+    metadata
+  });
+  return { treeSha: a.to, foundryVersion };
+}
+
+// src/commands/platform/status.ts
+var PlatformStatusCommand = class extends M8tCommand {
+  static paths = [["platform", "status"]];
+  static usage = Command31.Usage({
+    description: "Show per-component platform drift against a release manifest.",
+    details: "Fetches a release manifest (the current channel by default), reads the installed-state stamp, and reports each component's installed vs target version and drift status. Read-only \u2014 never writes the stamp, never converges anything (use 'm8t platform update' for that). --verify additionally probes the live gateway (image tag + /api/version) best-effort."
+  });
+  subscription = Option29.String("--subscription");
+  resourceGroup = Option29.String("--resource-group", {
+    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+  });
+  to = Option29.String("--to", {
+    description: "Check status against a pinned platform version (defaults to the current release channel)."
+  });
+  contentDir = Option29.String("--content-dir", {
+    description: "Path to a local m8t-stack repo checkout (skips the tarball tree-SHA fetch)."
+  });
+  manifestUrl = Option29.String("--manifest-url", {
+    description: "Fetch the release manifest from this URL instead of the release channel."
+  });
+  manifestFile = Option29.String("--manifest-file", {
+    description: "Read the release manifest from this local file instead of the release channel."
+  });
+  verify = Option29.Boolean("--verify", false, {
+    description: "Additionally probe the live gateway (image tag + /api/version) and report stamp-vs-live."
+  });
+  output = Option29.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(
+      this.output,
+      this.context.stdout
+    );
+    const log = (msg) => {
+      if (mode !== "json") this.context.stdout.write(msg + "\n");
+    };
+    const to = typeof this.to === "string" ? this.to : void 0;
+    const contentDirFlag = typeof this.contentDir === "string" ? this.contentDir : void 0;
+    const manifestUrl = typeof this.manifestUrl === "string" ? this.manifestUrl : void 0;
+    const manifestFile = typeof this.manifestFile === "string" ? this.manifestFile : void 0;
+    const gw = await resolveGatewayContext({
+      interactive: mode !== "json",
+      subscriptionId: this.subscription,
+      resourceGroup: this.resourceGroup
+    });
+    const { resourceGroup } = parseContainerAppResourceId(gw.containerAppResourceId);
+    const credential2 = new DefaultAzureCredential16();
+    const account = await getAzAccount();
+    const subscriptionId = this.subscription ?? account.subscriptionId;
+    const source = manifestFile ? { file: manifestFile } : manifestUrl ? { url: manifestUrl } : { channel: true, version: to };
+    const manifest = await fetchManifest(source);
+    const stamp = await readStamp({ credential: credential2, subscriptionId, resourceGroup });
+    const tree = contentDirFlag ? { treeShaOf: () => void 0 } : await fetchRepoTree(manifest.platform.commit);
+    const rows = statusRows(manifest, stamp, tree);
+    let verify;
+    if (this.verify) {
+      verify = await this.probeLive(gw.containerAppResourceId, gw.gatewayUrl, stamp?.components.gateway.tag);
+    }
+    if (mode === "json") {
+      this.context.stdout.write(
+        renderJson({
+          kind: "platform-status",
+          gateway: resourceGroup,
+          targetVersion: manifest.platform.tag,
+          managed: stamp !== null,
+          rows,
+          ...verify ? { verify } : {}
+        }) + "\n"
+      );
+      return 0;
+    }
+    log(colors.field(`target: ${manifest.platform.tag}${stamp === null ? "  (unmanaged \u2014 no stamp found)" : ""}`));
+    this.context.stdout.write(this.renderRows(rows) + "\n");
+    if (verify) {
+      log("");
+      log(colors.field("live verify:"));
+      log(`  stamp gateway tag:  ${verify.stampGatewayTag}`);
+      log(`  live gateway tag:   ${verify.liveGatewayTag}`);
+      log(
+        `  match:               ${verify.gatewayTagMatch === "unknown" ? colors.warn("unknown") : verify.gatewayTagMatch ? colors.success("yes") : colors.warn("no")}`
+      );
+      log(`  /api/version:        ${verify.apiVersion}`);
+    }
+    return 0;
+  }
+  renderRows(rows) {
+    const tableRows = rows.map((r) => ({
+      component: r.personaName ? `personas:${r.personaName}` : r.component,
+      installed: r.installed,
+      target: r.target,
+      status: r.status
+    }));
+    return renderTable(tableRows, [
+      { key: "component", label: "COMPONENT" },
+      { key: "installed", label: "INSTALLED" },
+      { key: "target", label: "TARGET" },
+      { key: "status", label: "STATUS" }
+    ]);
+  }
+  /**
+   * Best-effort live probe for --verify: the live gateway image tag (az) and
+   * GET /api/version. Any failure (auth-gated endpoint, transient network
+   * error, etc.) degrades the affected field to "unknown" rather than
+   * throwing — a verify probe must never crash the read-only status command.
+   */
+  async probeLive(gatewayResourceId, gatewayUrl, stampGatewayTag) {
+    let liveGatewayTag = "unknown";
+    try {
+      const { resourceGroup, name } = parseContainerAppResourceId(gatewayResourceId);
+      const image = (await runAz([
+        "containerapp",
+        "show",
+        "-g",
+        resourceGroup,
+        "-n",
+        name,
+        "--query",
+        "properties.template.containers[0].image",
+        "-o",
+        "tsv"
+      ])).trim();
+      const tag = image.split(":").pop();
+      if (tag) liveGatewayTag = tag;
+    } catch {
+      liveGatewayTag = "unknown";
+    }
+    let apiVersion = "unknown";
+    try {
+      const res = await fetch(`${gatewayUrl}/api/version`, { method: "GET" });
+      if (res.ok) {
+        const body = await res.json().catch(() => ({}));
+        apiVersion = body.version ?? "unknown";
+      } else if (res.status === 401 || res.status === 403) {
+        apiVersion = "unknown (auth-gated)";
+      }
+    } catch {
+      apiVersion = "unknown";
+    }
+    const stampTag = stampGatewayTag ?? "unknown";
+    const gatewayTagMatch = liveGatewayTag === "unknown" || stampTag === "unknown" ? "unknown" : liveGatewayTag === stampTag;
+    return { liveGatewayTag, stampGatewayTag: stampTag, gatewayTagMatch, apiVersion };
+  }
+};
+
+// src/commands/platform/update.ts
+import { Command as Command32, Option as Option30 } from "clipanion";
+import { confirm as confirm5 } from "@inquirer/prompts";
+import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/identity";
+
+// src/lib/platform-converge-cli.ts
+import * as path21 from "path";
+init_errors();
+var HOSTED_AGENT_PERSONA_DIR = {
+  codingAgent: "coding-agent",
+  azureExecutor: "azure-executor"
+};
+async function buildConvergeDeps(args) {
+  const warn = args.onWarn ?? (() => {
+  });
+  const discoveredAgents = await listM8tAgents({ credential: args.credential, projectEndpoint: args.project.endpoint });
+  const discovered = {};
+  for (const a of discoveredAgents) {
+    const persona = a.metadata.persona;
+    if (persona) discovered[persona] = a.name;
+  }
+  const loaderPath = path21.join(args.contentDir, "targets/foundry/brain-loader.md");
+  return {
+    async applyPersona(a, ctx) {
+      const personaName = a.personaName;
+      if (!personaName) {
+        throw new LocalCliError({ code: "PLATFORM_PERSONA_NO_NAME", message: "persona action missing personaName" });
+      }
+      const agentName = discovered[personaName];
+      if (!agentName) {
+        warn(`persona '${personaName}' is not deployed on this install \u2014 skipping.`);
+        return "absent";
+      }
+      const personaItem = ctx.manifest.components.personas.items[personaName];
+      return applyPersona(a, ctx, {
+        agentName,
+        project: args.project,
+        personaDir: path21.join(ctx.contentDir, personaItem.path),
+        loaderPath
+      });
+    },
+    async applyAgent(a, ctx) {
+      if (a.component !== "codingAgent" && a.component !== "azureExecutor") {
+        throw new LocalCliError({
+          code: "PLATFORM_AGENT_BAD_COMPONENT",
+          message: `applyAgent called with non-hosted component '${a.component}'`
+        });
+      }
+      const dir = HOSTED_AGENT_PERSONA_DIR[a.component];
+      const agentName = dir ? discovered[dir] : void 0;
+      if (!agentName) {
+        warn(`hosted agent for component '${a.component}' is not deployed on this install \u2014 skipping.`);
+        return "absent";
+      }
+      const componentRef = ctx.manifest.components[a.component];
+      return applyAgentImage(a, ctx, {
+        agentName,
+        project: args.project,
+        ghcrImage: `${componentRef.ref}:${a.to}`
+      });
+    },
+    async applyGateway(a, ctx) {
+      return applyGatewayImage(a, ctx, args.gatewayResourceId);
+    },
+    async applyInfra(a, ctx) {
+      const target = infraTargetSha(ctx.manifest, args.tree);
+      return applyInfraDeploy(a, ctx, target, { suffix: args.suffix });
+    },
+    async healthGate(_ctx, applied) {
+      for (const a of applied) {
+        let agentName;
+        if (a.component === "personas" && a.personaName) {
+          agentName = discovered[a.personaName];
+        } else if (a.component === "codingAgent" || a.component === "azureExecutor") {
+          const dir = HOSTED_AGENT_PERSONA_DIR[a.component];
+          agentName = dir ? discovered[dir] : void 0;
+        }
+        if (!agentName) continue;
+        await awaitAgentQueryable({ credential: args.credential, projectEndpoint: args.project.endpoint, agentName, onProgress: args.onProgress });
+      }
+      if (args.gatewayUrl) {
+        try {
+          const res = await fetch(`${args.gatewayUrl}/api/version`, { method: "GET" });
+          if (res.ok) {
+            const body = await res.json().catch(() => ({}));
+            args.onProgress?.(`gateway reachable (version: ${body.version ?? "unknown"}).`);
+          } else if (res.status === 401 || res.status === 403) {
+            args.onProgress?.(`gateway reachable (auth-gated, HTTP ${res.status.toString()}).`);
+          } else {
+            warn(`gateway health probe returned HTTP ${res.status.toString()} \u2014 not treated as fatal.`);
+          }
+        } catch (e) {
+          warn(`gateway health probe failed: ${e.message} \u2014 not treated as fatal.`);
+        }
+      }
+    },
+    async readStamp() {
+      return readStamp({ credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup });
+    },
+    async writeStamp(s) {
+      await writeStamp({
+        credential: args.credential,
+        subscriptionId: args.subscriptionId,
+        resourceGroup: args.resourceGroup,
+        stamp: { ...s, cli: CLI_VERSION },
+        onProgress: args.onProgress
+      });
+    }
+  };
+}
+function toVTag(v) {
+  return v.startsWith("v") ? v : `v${v}`;
+}
+function assertCliVersionOk(manifest, runningVersion, onWarn = () => {
+}) {
+  const cli2 = manifest.components.cli;
+  const running = toVTag(runningVersion);
+  const min = toVTag(cli2.min);
+  const recommended = toVTag(cli2.recommended);
+  if (compareSemver(running, min) < 0) {
+    throw new LocalCliError({
+      code: "PLATFORM_CLI_TOO_OLD",
+      message: `This CLI (${runningVersion}) is older than the minimum supported version (${cli2.min}) for platform ${manifest.platform.tag}.`,
+      hint: "Upgrade: 'npm install -g @m8t-stack/cli@latest' (or your package manager's equivalent)."
+    });
+  }
+  if (compareSemver(running, recommended) < 0) {
+    onWarn(`This CLI (${runningVersion}) is older than the recommended version (${cli2.recommended}) for platform ${manifest.platform.tag}. Consider upgrading.`);
+  }
+}
+
+// src/commands/platform/update.ts
+var PlatformUpdateCommand = class extends M8tCommand {
+  static paths = [["platform", "update"]];
+  static usage = Command32.Usage({
+    description: "Converge the whole platform (gateway, hosted agents, personas, infra) to a release manifest.",
+    details: "Fetches a release manifest (the current channel by default), diffs it against the installed-state stamp, and converges each changed component via its own executor: rolls the gateway/hosted-agent images, re-versions prompt personas (compose-preserving), and records infra state. A deploy/ tree drift is reported but NOT applied unless --force-infra is passed. Use --check to preview, --only to converge a single component, --yes to skip the confirmation prompt."
+  });
+  subscription = Option30.String("--subscription");
+  resourceGroup = Option30.String("--resource-group", {
+    description: "m8t-stack resource group to disambiguate the gateway (multi-deployment subscriptions)."
+  });
+  to = Option30.String("--to", {
+    description: "Pin the platform version to converge to (defaults to the current release channel)."
+  });
+  only = Option30.String("--only", {
+    description: "Converge only one component: infra | gateway | codingAgent | azureExecutor | personas."
+  });
+  check = Option30.Boolean("--check", false);
+  yes = Option30.Boolean("--yes", false);
+  skipInfra = Option30.Boolean("--skip-infra", false);
+  forceInfra = Option30.Boolean("--force-infra", false);
+  suffix = Option30.String("--suffix", {
+    description: "Required with --force-infra \u2014 the existing deployment's resource-name suffix (avoids provisioning duplicates)."
+  });
+  contentDir = Option30.String("--content-dir", {
+    description: "Path to a local m8t-stack repo checkout (skips the tarball fetch + tree-drift check)."
+  });
+  manifestUrl = Option30.String("--manifest-url", {
+    description: "Fetch the release manifest from this URL instead of the release channel."
+  });
+  manifestFile = Option30.String("--manifest-file", {
+    description: "Read the release manifest from this local file instead of the release channel."
+  });
+  endpoint = Option30.String("--endpoint", {
+    description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
+  });
+  output = Option30.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(
+      this.output,
+      this.context.stdout
+    );
+    const interactive = this.context.stdout.isTTY === true;
+    const log = (msg) => {
+      if (mode !== "json") this.context.stdout.write(msg + "\n");
+    };
+    const to = typeof this.to === "string" ? this.to : void 0;
+    const only = typeof this.only === "string" ? this.only : void 0;
+    const suffix = typeof this.suffix === "string" ? this.suffix : void 0;
+    const contentDirFlag = typeof this.contentDir === "string" ? this.contentDir : void 0;
+    const manifestUrl = typeof this.manifestUrl === "string" ? this.manifestUrl : void 0;
+    const manifestFile = typeof this.manifestFile === "string" ? this.manifestFile : void 0;
+    const gw = await resolveGatewayContext({
+      interactive: mode !== "json",
+      subscriptionId: this.subscription,
+      resourceGroup: this.resourceGroup
+    });
+    const { resourceGroup } = parseContainerAppResourceId(gw.containerAppResourceId);
+    const credential2 = new DefaultAzureCredential17();
+    const account = await getAzAccount();
+    const subscriptionId = this.subscription ?? account.subscriptionId;
+    const onProgress = (m) => {
+      log(colors.dim(m));
+    };
+    const onWarn = (w) => {
+      log(colors.warn(w));
+    };
+    onProgress("resolving Foundry project\u2026");
+    const project = await resolveFoundryProject({
+      credential: credential2,
+      subscriptionId,
+      interactive,
+      endpoint: typeof this.endpoint === "string" ? this.endpoint : void 0
+    });
+    const source = manifestFile ? { file: manifestFile } : manifestUrl ? { url: manifestUrl } : { channel: true, version: to };
+    onProgress("fetching release manifest\u2026");
+    const manifest = await fetchManifest(source);
+    assertCliVersionOk(manifest, CLI_VERSION, onWarn);
+    const stamp = await readStamp({ credential: credential2, subscriptionId, resourceGroup });
+    onProgress("resolving release content\u2026");
+    const contentDir = await resolveReleaseContent(manifest, { contentDir: contentDirFlag });
+    const tree = contentDirFlag ? { treeShaOf: () => void 0 } : await fetchRepoTree(manifest.platform.commit);
+    if (!contentDirFlag) {
+      const mismatches = verifyPersonaTrees(manifest, tree);
+      if (mismatches.length > 0) {
+        log(colors.warn(`warning: ${mismatches.length.toString()} persona tree mismatch(es) vs the manifest.`));
+      }
+    }
+    const plan = diffPlan(manifest, stamp, tree, { only, forceInfra: this.forceInfra, skipInfra: this.skipInfra });
+    this.renderPlan(plan, mode);
+    const deferredInfra = plan.skipped.find((s) => s.component === "infra" && s.reason === "deferred");
+    if (deferredInfra) {
+      log(
+        colors.warn(
+          `infra changed in ${plan.targetVersion} (deploy/ tree drift) \u2014 NOT applied by the CLI. Run 'm8t platform update --force-infra --suffix <n>' or let the update job converge it.`
+        )
+      );
+    }
+    if (this.check) {
+      if (mode === "json") this.context.stdout.write(renderJson({ ...plan, checked: true, applied: false }) + "\n");
+      return 0;
+    }
+    if (plan.actions.length === 0) {
+      if (mode === "json") this.context.stdout.write(renderJson({ ...plan, applied: false }) + "\n");
+      else log(colors.success("already up to date \u2713"));
+      return 0;
+    }
+    if (!this.yes && interactive) {
+      const ok = await confirm5({
+        message: `Converge ${plan.actions.length.toString()} component(s) to ${plan.targetVersion}?`,
+        default: true
+      });
+      if (!ok) {
+        log(colors.dim("aborted \u2014 no change."));
+        return 0;
+      }
+    }
+    const deps = await buildConvergeDeps({
+      credential: credential2,
+      subscriptionId,
+      resourceGroup,
+      contentDir,
+      manifest,
+      tree,
+      project,
+      gatewayResourceId: gw.containerAppResourceId,
+      gatewayUrl: gw.gatewayUrl,
+      suffix,
+      onProgress,
+      onWarn
+    });
+    await applyPlan(plan, deps, { credential: credential2, subscriptionId, resourceGroup, contentDir, manifest, onProgress });
+    if (mode === "json") this.context.stdout.write(renderJson({ ...plan, applied: true }) + "\n");
+    else log(colors.success(`converged \u2192 ${plan.targetVersion} \u2713`));
+    return 0;
+  }
+  renderPlan(plan, mode) {
+    if (mode === "json") return;
+    const rows = [
+      ...plan.actions.map((a) => ({
+        component: a.personaName ? `personas:${a.personaName}` : a.component,
+        from: a.from ?? "(none)",
+        to: a.to,
+        reason: a.reason
+      })),
+      ...plan.skipped.map((s) => ({
+        component: s.personaName ? `personas:${s.personaName}` : s.component,
+        from: "-",
+        to: "-",
+        reason: s.reason
+      }))
+    ];
+    this.context.stdout.write(
+      renderTable(rows, [
+        { key: "component", label: "COMPONENT" },
+        { key: "from", label: "FROM" },
+        { key: "to", label: "TO" },
+        { key: "reason", label: "REASON" }
+      ]) + "\n"
+    );
+  }
+};
+
+// src/commands/platform/enable-cost-report.ts
+import { Command as Command33, Option as Option31 } from "clipanion";
+
+// src/lib/wire-gateway-acs.ts
+init_rbac();
+async function wireGatewayForAcs(args) {
+  try {
+    await args.az([
+      "role",
+      "assignment",
+      "create",
+      "--assignee-object-id",
+      args.gatewayPrincipalId,
+      "--assignee-principal-type",
+      "ServicePrincipal",
+      "--role",
+      CONTRIBUTOR_ROLE_ID,
+      "--scope",
+      args.acsResourceId
+    ]);
+  } catch (e) {
+    if (!(e instanceof Error && /RoleAssignmentExists/i.test(e.message))) throw e;
   }
   await args.az([
     "containerapp",
@@ -18015,156 +19202,11 @@ async function patchRedirectUris(appObjectId, fqdn) {
   ]);
 }
 
-// src/lib/deploy.ts
-import * as fs18 from "fs/promises";
-import * as os8 from "os";
-import * as path18 from "path";
-init_errors();
-var FOUNDRY_TRACING_MODES = ["project", "account", "skip"];
-function parseFoundryTracingMode(v) {
-  if (v === void 0) return void 0;
-  if (!FOUNDRY_TRACING_MODES.includes(v)) {
-    throw new LocalCliError({
-      code: "DEPLOY_INVALID_TRACING_MODE",
-      message: `Invalid --foundry-tracing value: '${v}'.`,
-      hint: `Use one of: ${FOUNDRY_TRACING_MODES.join(", ")}.`
-    });
-  }
-  return v;
-}
-function buildBicepParams(p) {
-  const params = [
-    `location=${p.location}`,
-    `suffix=${p.suffix}`,
-    `imageRef=${p.imageRef}`,
-    `tenantId=${p.tenantId}`,
-    `clientId=${p.clientId}`,
-    `foundryResourceId=${p.foundryResourceId}`,
-    `foundryProjectEndpoint=${p.foundryProjectEndpoint}`,
-    `acrPullIdentityResourceId=${p.acrPullIdentityResourceId}`,
-    `acrResourceId=${p.acrResourceId}`
-  ];
-  if (p.foundryTracingMode) params.push(`foundryTracingMode=${p.foundryTracingMode}`);
-  return params;
-}
-async function resolveRepoRoot2(home = os8.homedir()) {
-  const marker = path18.join(home, ".m8t-stack", "repo-root");
-  try {
-    const root = (await fs18.readFile(marker, "utf8")).trim();
-    if (!root) throw new Error("empty");
-    return root;
-  } catch {
-    throw new LocalCliError({
-      code: "DEPLOY_NO_REPO_ROOT",
-      message: "~/.m8t-stack/repo-root marker is missing or empty.",
-      hint: "Run 'm8t install' from an m8t-stack checkout (it writes the marker), or run 'm8t deploy' from the repo."
-    });
-  }
-}
-async function resolveFoundryResourceId(endpoint, explicit) {
-  if (explicit) return explicit;
-  const m = /^https:\/\/([^.]+)\.services\.ai\.azure\.com/.exec(endpoint);
-  if (!m) {
-    throw new LocalCliError({
-      code: "DEPLOY_FOUNDRY_ENDPOINT_BAD",
-      message: `Cannot parse the Foundry account name from endpoint: ${endpoint}`,
-      hint: "Pass --foundry-resource-id <ARM-id> explicitly."
-    });
-  }
-  const accounts = JSON.parse(
-    await runAz([
-      "cognitiveservices",
-      "account",
-      "list",
-      "--query",
-      `[?name=='${m[1]}'].id`,
-      "--output",
-      "json"
-    ])
-  );
-  if (accounts.length === 0) {
-    throw new LocalCliError({
-      code: "DEPLOY_FOUNDRY_NOT_FOUND",
-      message: `No Foundry account named '${m[1]}' in the active subscription.`,
-      hint: "Check the endpoint, or pass --foundry-resource-id explicitly."
-    });
-  }
-  if (accounts.length > 1) {
-    throw new LocalCliError({
-      code: "DEPLOY_FOUNDRY_AMBIGUOUS",
-      message: `Multiple Foundry accounts named '${m[1]}' \u2014 ambiguous.`,
-      hint: "Pass --foundry-resource-id <ARM-id> to disambiguate."
-    });
-  }
-  return accounts[0];
-}
-async function resolveAcrResourceId(opts) {
-  if (opts.explicit) return opts.explicit;
-  const host = opts.imageRef.split("/")[0];
-  if (!host.endsWith(".azurecr.io")) return "";
-  const acrName = host.split(".")[0];
-  try {
-    const id = (await runAz(["acr", "show", "-n", acrName, "--query", "id", "-o", "tsv"])).trim();
-    if (!id) throw new Error("empty id");
-    return id;
-  } catch (e) {
-    if (e instanceof LocalCliError) throw e;
-    throw new LocalCliError({
-      code: "DEPLOY_ACR_NOT_FOUND",
-      message: `Cannot resolve the ACR '${acrName}' for image ${opts.imageRef}.`,
-      hint: "Create it (az acr create), sign in (az acr login), and push the web image (docker buildx \u2026 --push); or pass --acr-resource-id <ARM-id>."
-    });
-  }
-}
-async function ensureResourceGroup(name, location) {
-  const existing = JSON.parse(
-    await runAz(["group", "show", "--name", name, "--output", "json"]).catch(() => "") || "null"
-  );
-  if (existing) return;
-  await runAz(["group", "create", "--name", name, "--location", location, "--tags", "m8t-stack=deployment"]);
-}
-function resolveAcrPullIdentity(opts) {
-  return opts.explicit ?? "";
-}
-async function runBicepDeployment(opts) {
-  const bicepPath = path18.join(opts.repoRoot, "deploy", "main.bicep");
-  const result = JSON.parse(
-    await runAz([
-      "deployment",
-      "group",
-      "create",
-      "--name",
-      opts.deploymentName,
-      "--resource-group",
-      opts.resourceGroup,
-      "--template-file",
-      bicepPath,
-      "--parameters",
-      ...opts.params,
-      "--output",
-      "json"
-    ])
-  );
-  const outputs = result.properties?.outputs ?? {};
-  const fqdn = outputs.containerAppFqdn?.value;
-  if (typeof fqdn !== "string" || !fqdn) {
-    throw new LocalCliError({
-      code: "DEPLOY_NO_FQDN",
-      message: "Bicep deployment did not return containerAppFqdn.",
-      hint: "Check deploy/main.bicep outputs and the deployment log."
-    });
-  }
-  return {
-    containerAppFqdn: fqdn,
-    resourceNames: outputs.resourceNames?.value ?? {}
-  };
-}
-
 // src/commands/deploy.ts
 init_errors();
 
 // src/lib/whatif.ts
-import * as path19 from "path";
+import * as path22 from "path";
 function deriveResourceType(resourceId) {
   if (resourceId.startsWith("[")) return "";
   const afterProviders = resourceId.split("/providers/")[1];
@@ -18175,7 +19217,7 @@ function deriveResourceType(resourceId) {
   return parts.join("/");
 }
 async function runWhatIf(opts) {
-  const bicepPath = path19.join(opts.repoRoot, "deploy", "main.bicep");
+  const bicepPath = path22.join(opts.repoRoot, "deploy", "main.bicep");
   const out = await runAz([
     "deployment",
     "group",
@@ -18240,9 +19282,9 @@ function flattenDelta(delta, prefix = "") {
   const out = [];
   for (const d of delta) {
     const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : prefix ? `.${d.path}` : d.path;
-    const path29 = prefix ? `${prefix}${segment}` : d.path;
-    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path29));
-    else out.push({ ...d, path: path29 });
+    const path32 = prefix ? `${prefix}${segment}` : d.path;
+    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path32));
+    else out.push({ ...d, path: path32 });
   }
   return out;
 }
@@ -18512,8 +19554,8 @@ var EvalSkillCommand = class extends M8tCommand {
 
 // src/commands/eval/exam.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync13, existsSync as existsSync12, readdirSync } from "fs";
-import { join as join19 } from "path";
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync15, existsSync as existsSync13, readdirSync } from "fs";
+import { join as join22 } from "path";
 import { Command as Command36, Option as Option34 } from "clipanion";
 init_errors();
 init_esm();
@@ -18679,10 +19721,10 @@ function resolveRefereeHome(refereeHomeOut, env) {
   return null;
 }
 function resolveTaskSetDir(base, worker, version) {
-  if (existsSync12(join19(base, version))) return version;
+  if (existsSync13(join22(base, version))) return version;
   const prefixed = `${worker}-${version}`;
-  if (existsSync12(join19(base, prefixed))) return prefixed;
-  if (version === "latest" && existsSync12(base)) {
+  if (existsSync13(join22(base, prefixed))) return prefixed;
+  if (version === "latest" && existsSync13(base)) {
     const dirs = readdirSync(base, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.startsWith(`${worker}-`)).map((d) => d.name).sort();
     if (dirs.length > 0) return dirs[dirs.length - 1];
   }
@@ -18697,11 +19739,11 @@ function readSealedTaskIds(taskSetVersion, refereeHomeOut, env = process.env) {
       message: "cannot resolve the referee home to read the sealed-task manifest \u2014 set $REFEREE_HOME (mirroring the Python runner) so the feed can be redacted; refusing to emit a possibly-unredacted feed (Law-1)"
     });
   }
-  const versionDir = resolveTaskSetDir(join19(home, "tasksets", worker), worker, version);
-  const manifestPath = join19(home, "tasksets", worker, versionDir, "manifest.yaml");
+  const versionDir = resolveTaskSetDir(join22(home, "tasksets", worker), worker, version);
+  const manifestPath = join22(home, "tasksets", worker, versionDir, "manifest.yaml");
   let text;
   try {
-    text = readFileSync13(manifestPath, "utf-8");
+    text = readFileSync15(manifestPath, "utf-8");
   } catch (e) {
     throw new LocalCliError({
       code: "EXAM_REDACTION_UNSAFE",
@@ -18819,10 +19861,10 @@ var EvalExamCommand = class extends M8tCommand {
     const verdict = parseExamVerdict(res.stdout);
     if (out !== void 0) {
       const sealedTaskIds = taskSetVersion ? readSealedTaskIds(taskSetVersion, out) : /* @__PURE__ */ new Set();
-      mkdirSync3(out, { recursive: true });
-      writeFileSync3(join19(out, "verdict.json"), JSON.stringify(verdict, null, 2));
+      mkdirSync4(out, { recursive: true });
+      writeFileSync4(join22(out, "verdict.json"), JSON.stringify(verdict, null, 2));
       const feed = redactForFeed(verdict, sealedTaskIds);
-      writeFileSync3(join19(out, "feed.json"), JSON.stringify(feed, null, 2));
+      writeFileSync4(join22(out, "feed.json"), JSON.stringify(feed, null, 2));
     }
     if (mode === "json") {
       this.context.stdout.write(renderJson(verdict) + "\n");
@@ -19084,10 +20126,10 @@ var StatusCommand = class extends M8tCommand {
 
 // src/commands/doctor.ts
 import { Command as Command40, Option as Option38 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/identity";
-import * as fs19 from "fs";
-import * as os9 from "os";
-import * as path20 from "path";
+import { DefaultAzureCredential as DefaultAzureCredential18 } from "@azure/identity";
+import * as fs22 from "fs";
+import * as os10 from "os";
+import * as path23 from "path";
 
 // src/lib/doctor-checks.ts
 function checkAzSignedIn(az) {
@@ -19312,24 +20354,24 @@ async function resolveAccountLocation(accountId) {
   }
 }
 function probeRepoRoot() {
-  const marker = path20.join(os9.homedir(), ".m8t-stack", "repo-root");
-  if (!fs19.existsSync(marker)) {
+  const marker = path23.join(os10.homedir(), ".m8t-stack", "repo-root");
+  if (!fs22.existsSync(marker)) {
     return { markerExists: false, path: null, isDir: false, isGitCheckout: false };
   }
   let repoPath;
   try {
-    repoPath = fs19.readFileSync(marker, "utf8").trim();
+    repoPath = fs22.readFileSync(marker, "utf8").trim();
   } catch {
     return { markerExists: true, path: null, isDir: false, isGitCheckout: false };
   }
   if (!repoPath) return { markerExists: true, path: null, isDir: false, isGitCheckout: false };
   let isDir = false;
   try {
-    isDir = fs19.statSync(repoPath).isDirectory();
+    isDir = fs22.statSync(repoPath).isDirectory();
   } catch {
     isDir = false;
   }
-  const isGitCheckout = isDir && fs19.existsSync(path20.join(repoPath, ".git"));
+  const isGitCheckout = isDir && fs22.existsSync(path23.join(repoPath, ".git"));
   return { markerExists: true, path: repoPath, isDir, isGitCheckout };
 }
 var DoctorCommand = class extends M8tCommand {
@@ -19412,7 +20454,7 @@ var DoctorCommand = class extends M8tCommand {
       if (typeof this.agent === "string" && this.agent) {
         checking(`delivery grant for ${this.agent}`);
         try {
-          const credential2 = new DefaultAzureCredential16();
+          const credential2 = new DefaultAzureCredential18();
           const cur = await getAgentVersion({
             credential: credential2,
             projectEndpoint: foundry.projectEndpoint,
@@ -19458,15 +20500,15 @@ var DoctorCommand = class extends M8tCommand {
 import { Command as Command41, Option as Option39 } from "clipanion";
 
 // src/lib/profiles.ts
-import * as fs20 from "fs/promises";
-import * as path21 from "path";
-import { parse as parseYaml10, stringify as stringifyYaml4 } from "yaml";
+import * as fs23 from "fs/promises";
+import * as path24 from "path";
+import { parse as parseYaml11, stringify as stringifyYaml4 } from "yaml";
 function profilesDir() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path21.join(home, ".m8t-stack", "profiles");
+  return path24.join(home, ".m8t-stack", "profiles");
 }
 function getProfilePath(name) {
-  return path21.join(profilesDir(), `${path21.basename(name)}.yaml`);
+  return path24.join(profilesDir(), `${path24.basename(name)}.yaml`);
 }
 function slugifyTenant(domainOrId) {
   const base = domainOrId.split(".")[0].toLowerCase();
@@ -19475,7 +20517,7 @@ function slugifyTenant(domainOrId) {
 }
 async function listProfiles() {
   try {
-    const entries = await fs20.readdir(profilesDir());
+    const entries = await fs23.readdir(profilesDir());
     return entries.filter((e) => e.endsWith(".yaml")).map((e) => e.replace(/\.yaml$/, "")).sort();
   } catch (e) {
     if (e.code === "ENOENT") return [];
@@ -19484,8 +20526,8 @@ async function listProfiles() {
 }
 async function readProfile(name) {
   try {
-    const raw = await fs20.readFile(getProfilePath(name), "utf8");
-    const parsed = parseYaml10(raw);
+    const raw = await fs23.readFile(getProfilePath(name), "utf8");
+    const parsed = parseYaml11(raw);
     if (!parsed || typeof parsed !== "object") return null;
     return parsed;
   } catch (e) {
@@ -19495,14 +20537,14 @@ async function readProfile(name) {
 }
 async function exists(p) {
   try {
-    await fs20.stat(p);
+    await fs23.stat(p);
     return true;
   } catch {
     return false;
   }
 }
 async function saveProfile(p) {
-  await fs20.mkdir(profilesDir(), { recursive: true });
+  await fs23.mkdir(profilesDir(), { recursive: true });
   let name = p.name;
   let n = 2;
   while (await exists(getProfilePath(name))) {
@@ -19511,8 +20553,8 @@ async function saveProfile(p) {
   }
   const target = getProfilePath(name);
   const tmp = `${target}.tmp`;
-  await fs20.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
-  await fs20.rename(tmp, target);
+  await fs23.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
+  await fs23.rename(tmp, target);
   return name;
 }
 
@@ -19758,7 +20800,7 @@ var OpenCommand = class extends M8tCommand {
 // src/commands/dream/run.ts
 import { Command as Command43, Option as Option41 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
-import { TableClient as TableClient2 } from "@azure/data-tables";
+import { TableClient as TableClient3 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
 import { LogsQueryClient as LogsQueryClient3, LogsQueryResultStatus as LogsQueryResultStatus3 } from "@azure/monitor-query";
 
@@ -20065,7 +21107,7 @@ var ConvFetchError = class extends Error {
 };
 
 // ../../packages/brain/engine/dist/esm/cursor.js
-import { TableClient } from "@azure/data-tables";
+import { TableClient as TableClient2 } from "@azure/data-tables";
 
 // ../../packages/agent-ledger/dist/esm/row-key.js
 var MAX_MS = 864e13;
@@ -20187,7 +21229,7 @@ async function commitCursorAdvance(plan, cursor) {
 }
 var CURSOR_TABLE_NAME = "BrainDreamCursor";
 function makeTableCursor(credential2, tableEndpoint) {
-  const client = new TableClient(tableEndpoint, CURSOR_TABLE_NAME, credential2);
+  const client = new TableClient2(tableEndpoint, CURSOR_TABLE_NAME, credential2);
   return new TableCursor(client);
 }
 function formatCursorPreview(cursor) {
@@ -20264,7 +21306,7 @@ function mapItems(raw) {
   return acc.reverse();
 }
 function makeConversationSource(client, opts = {}) {
-  const sleep2 = opts.sleep ?? defaultSleep;
+  const sleep3 = opts.sleep ?? defaultSleep;
   return {
     async items(conversationId) {
       for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
@@ -20282,7 +21324,7 @@ function makeConversationSource(client, opts = {}) {
             throw new ConvFetchError("auth", `auth failed reading ${conversationId}`);
           const retryable = status === void 0 || status === TRANSIENT;
           if (retryable && attempt < MAX_ATTEMPTS - 1) {
-            await sleep2(attempt);
+            await sleep3(attempt);
             continue;
           }
           throw new ConvFetchError("terminal", `exhausted ${String(MAX_ATTEMPTS)} retries reading ${conversationId}: ${e?.message ?? String(e)}`);
@@ -20681,7 +21723,7 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
-var isAllowedWritePath = (path29) => WRITER_ALLOWED_PREFIX.test(path29) && !path29.split("/").includes("..");
+var isAllowedWritePath = (path32) => WRITER_ALLOWED_PREFIX.test(path32) && !path32.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
   const m = /^---\n([\s\S]*?)\n---/.exec(content);
@@ -20720,8 +21762,8 @@ function parseFrontmatter(content) {
 function makeGitDataWriter(args) {
   const doFetch = args.fetchImpl ?? fetch;
   const repoPath = args.repository;
-  async function gh(token, method, path29, body) {
-    const res = await doFetch(`${API2}/repos/${repoPath}${path29}`, {
+  async function gh(token, method, path32, body) {
+    const res = await doFetch(`${API2}/repos/${repoPath}${path32}`, {
       method,
       headers: {
         Authorization: `Bearer ${token}`,
@@ -20734,8 +21776,8 @@ function makeGitDataWriter(args) {
     const text = await res.text();
     return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
   }
-  async function readFileWith(token, path29) {
-    const encodedPath = path29.split("/").map(encodeURIComponent).join("/");
+  async function readFileWith(token, path32) {
+    const encodedPath = path32.split("/").map(encodeURIComponent).join("/");
     const r = await gh(token, "GET", `/contents/${encodedPath}?ref=${args.branch}`);
     if (r.status === 404)
       return null;
@@ -20751,9 +21793,9 @@ function makeGitDataWriter(args) {
         throw new Error(`fetchTip: HTTP ${String(r.status)}`);
       return r.json.object.sha;
     },
-    async readFile(path29) {
+    async readFile(path32) {
       const token = await args.mintToken();
-      return readFileWith(token, path29);
+      return readFileWith(token, path32);
     },
     async listMemory() {
       const token = await args.mintToken();
@@ -20762,9 +21804,9 @@ function makeGitDataWriter(args) {
         return [];
       const paths = r.json.tree.filter((e) => e.type === "blob" && e.path.startsWith("memory/") && e.path.endsWith(".md")).map((e) => e.path);
       const out = [];
-      for (const path29 of paths) {
-        const content = await readFileWith(token, path29);
-        out.push({ path: path29, frontmatter: content ? parseFrontmatter(content) : {} });
+      for (const path32 of paths) {
+        const content = await readFileWith(token, path32);
+        out.push({ path: path32, frontmatter: content ? parseFrontmatter(content) : {} });
       }
       return out;
     },
@@ -21066,7 +22108,7 @@ function extractJson(text) {
   return JSON.parse(candidate2.slice(start, end + 1));
 }
 async function propose(model, system, user, opts = {}) {
-  const sleep2 = opts.sleep ?? defaultSleep2;
+  const sleep3 = opts.sleep ?? defaultSleep2;
   const modelName = opts.model ?? MODEL_NAME_FALLBACK;
   let inputTokens = 0;
   let outputTokens = 0;
@@ -21082,7 +22124,7 @@ async function propose(model, system, user, opts = {}) {
     } catch (e) {
       lastErr = `parse: ${e.message}`;
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep2(attempt);
+        await sleep3(attempt);
         continue;
       }
       break;
@@ -21091,7 +22133,7 @@ async function propose(model, system, user, opts = {}) {
     if (!Array.isArray(rawDeltas)) {
       lastErr = "schema: top-level { deltas: [] } missing";
       if (attempt < MAX_MODEL_ATTEMPTS - 1) {
-        await sleep2(attempt);
+        await sleep3(attempt);
         continue;
       }
       break;
@@ -21201,7 +22243,7 @@ async function loadMemoryContext(brain) {
   return {
     files,
     indexEntries,
-    originOf: (path29) => originByPath.get(path29) ?? "worker"
+    originOf: (path32) => originByPath.get(path32) ?? "worker"
   };
 }
 
@@ -21222,14 +22264,14 @@ function checkEvidenceMembership(delta, harvested) {
 }
 var BatchAbort = class extends Error {
   path;
-  constructor(path29, message) {
+  constructor(path32, message) {
     super(message);
-    this.path = path29;
+    this.path = path32;
     this.name = "BatchAbort";
   }
 };
-var isIndexFile = (path29) => /(^|\/)[^/]*_index\.md$/.test(path29);
-var isMemoryIndex = (path29) => path29 === "memory/MEMORY.md";
+var isIndexFile = (path32) => /(^|\/)[^/]*_index\.md$/.test(path32);
+var isMemoryIndex = (path32) => path32 === "memory/MEMORY.md";
 function targetPath(delta) {
   switch (delta.verb) {
     case "new":
@@ -21246,29 +22288,29 @@ function targetPath(delta) {
 }
 async function checkOriginTier(delta, lookup) {
   const evidence = evidenceOf(delta) ?? [];
-  const path29 = targetPath(delta);
-  if (path29 === null)
+  const path32 = targetPath(delta);
+  if (path32 === null)
     return { ok: true };
-  if (isIndexFile(path29) && !isMemoryIndex(path29)) {
-    return { ok: false, flagged: { kind: "flagged", path: path29, tension: `refused: ${path29} is an index file (only memory/MEMORY.md is editable)`, evidence } };
+  if (isIndexFile(path32) && !isMemoryIndex(path32)) {
+    return { ok: false, flagged: { kind: "flagged", path: path32, tension: `refused: ${path32} is an index file (only memory/MEMORY.md is editable)`, evidence } };
   }
-  const target = await lookup(path29);
-  const isStructural = path29.startsWith("references/");
+  const target = await lookup(path32);
+  const isStructural = path32.startsWith("references/");
   const origin = target?.frontmatter.origin ?? (isStructural ? "operator" : "worker");
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
-    throw new BatchAbort(path29, `supersede/retract OLD target ${path29} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
+    throw new BatchAbort(path32, `supersede/retract OLD target ${path32} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
   }
-  return { ok: false, flagged: { kind: "flagged", path: path29, tension: `operator-origin (${origin}); flag-only`, evidence } };
+  return { ok: false, flagged: { kind: "flagged", path: path32, tension: `operator-origin (${origin}); flag-only`, evidence } };
 }
 var ALLOWED_MEMORY = /^memory\/.+\.md$/;
 var ALLOWED_INBOX = /^inbox\//;
 var ALLOWED_QUARANTINE = /^quarantine\//;
 var ALLOWED_FLAG = /^memory\//;
-var hasTraversal = (path29) => path29.split("/").includes("..");
+var hasTraversal = (path32) => path32.split("/").includes("..");
 function checkPathAllowed(delta) {
   const evidence = evidenceOf(delta) ?? [];
   const reject = (detail) => ({ ok: false, rejected: { kind: "rejected", detail, evidence } });
@@ -21375,7 +22417,7 @@ ${inject}
 ---
 `);
 }
-var indexLine = (path29, title, date, tags) => `- \`${path29}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
+var indexLine = (path32, title, date, tags) => `- \`${path32}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
   const all = index.split("\n");
   const firstLineIdx = all.findIndex((l) => l.startsWith("- `memory/"));
@@ -21548,16 +22590,16 @@ function defaultDreamSeams(opts = {}) {
       const mem = await memory(deps.brain);
       const harvested = harvestedIds(input);
       const ctx = { readFile: (p) => deps.brain.readFile(p), at: deps.clock() };
-      const lookup = (path29) => Promise.resolve(mem.files.find((f) => f.path === path29) ?? null);
+      const lookup = (path32) => Promise.resolve(mem.files.find((f) => f.path === path32) ?? null);
       const digest = [...pendingRejected];
       let changes = [];
       let indexEdit;
       try {
         for (const raw of deltas) {
           const delta = forcePolicyQuarantine(raw);
-          const path29 = checkPathAllowed(delta);
-          if (!path29.ok) {
-            digest.push(path29.rejected);
+          const path32 = checkPathAllowed(delta);
+          if (!path32.ok) {
+            digest.push(path32.rejected);
             continue;
           }
           const ev = checkEvidenceMembership(delta, harvested);
@@ -21752,7 +22794,7 @@ async function emitDigest(input, deps, digest) {
 }
 
 // ../../packages/brain/engine/dist/esm/dream/config.js
-import { parse as parseYaml11 } from "yaml";
+import { parse as parseYaml12 } from "yaml";
 var DEFAULT_DREAM_MODEL = "gpt-5.4";
 function asCadence(v) {
   return v === "nightly" ? "nightly" : "off";
@@ -21760,7 +22802,7 @@ function asCadence(v) {
 function parseDreamerConfig(rawYaml, env) {
   let parsed;
   try {
-    parsed = parseYaml11(rawYaml);
+    parsed = parseYaml12(rawYaml);
   } catch {
     return { enabled: false, cadence: "off", model: env.M8T_DREAM_MODEL ?? DEFAULT_DREAM_MODEL };
   }
@@ -21774,31 +22816,31 @@ function parseDreamerConfig(rawYaml, env) {
 }
 
 // ../../packages/brain/engine/dist/esm/cost-report/config.js
-import { parse as parseYaml12 } from "yaml";
+import { parse as parseYaml13 } from "yaml";
 
 // ../../packages/brain/engine/dist/esm/librarian/codify/persistence-guard.js
 var ZERO_WIDTH_RE = new RegExp("\u200B|\u200C|\u200D|\uFEFF", "g");
 
 // ../../packages/brain/engine/dist/esm/librarian/janitor/frontmatter.js
-import { parse as parseYaml13, stringify as stringifyYaml5 } from "yaml";
+import { parse as parseYaml14, stringify as stringifyYaml5 } from "yaml";
 
 // ../../packages/brain/engine/dist/esm/librarian/config.js
-import { parse as parseYaml14 } from "yaml";
+import { parse as parseYaml15 } from "yaml";
 
 // src/lib/dream-discovery.ts
 init_http();
 init_errors();
-var ARM3 = "https://management.azure.com";
-var ARM_SCOPE7 = "https://management.azure.com/.default";
-var STORAGE_API = "2023-05-01";
+var ARM4 = "https://management.azure.com";
+var ARM_SCOPE8 = "https://management.azure.com/.default";
+var STORAGE_API2 = "2023-05-01";
 var LA_API = "2023-09-01";
 async function discoverLedgerResources(opts) {
   const { credential: credential2, subscriptionId, resourceGroup } = opts;
   const storage = await authedJson({
     credential: credential2,
-    scope: ARM_SCOPE7,
+    scope: ARM_SCOPE8,
     method: "GET",
-    url: `${ARM3}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API}`
+    url: `${ARM4}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API2}`
   }) ?? {};
   const accounts = (storage.value ?? []).filter((a) => a.properties?.primaryEndpoints?.table);
   const ledgerAcct = accounts.find((a) => (a.tags?.["m8t-stack:role"] ?? a.properties?.tags?.["m8t-stack:role"]) === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
@@ -21812,9 +22854,9 @@ async function discoverLedgerResources(opts) {
   }
   const laList = await authedJson({
     credential: credential2,
-    scope: ARM_SCOPE7,
+    scope: ARM_SCOPE8,
     method: "GET",
-    url: `${ARM3}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.OperationalInsights/workspaces?api-version=${LA_API}`
+    url: `${ARM4}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.OperationalInsights/workspaces?api-version=${LA_API}`
   }) ?? {};
   const ws = laList.value ?? [];
   const workspaceId = (ws.length === 1 ? ws[0] : ws.find((w) => w.properties?.customerId))?.properties?.customerId;
@@ -22108,7 +23150,7 @@ AppDependencies
   };
 }
 function buildLiveSources(context, credential2) {
-  const ledgerClient = new TableClient2(context.ledgerTableEndpoint, LEDGER_TABLE_NAME, credential2);
+  const ledgerClient = new TableClient3(context.ledgerTableEndpoint, LEDGER_TABLE_NAME, credential2);
   const ledger = makeLedgerSource(
     async (pk, sinceTs) => fetchLedgerRows(
       { workers: [pk], source: "all", from: sinceTs, to: "9999-12-31T23:59:59.999Z" },
@@ -22777,9 +23819,9 @@ ${colors.error("  " + why)}
 }
 
 // src/commands/bootstrap/launch.ts
-import * as fs23 from "fs";
-import * as os12 from "os";
-import * as path24 from "path";
+import * as fs26 from "fs";
+import * as os13 from "os";
+import * as path27 from "path";
 import { Command as Command47, Option as Option45 } from "clipanion";
 init_errors();
 
@@ -22925,9 +23967,9 @@ async function kickInstaller(s) {
 
 // src/lib/bootstrap-status.ts
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
-import * as fs21 from "fs/promises";
-import * as os10 from "os";
-import * as path22 from "path";
+import * as fs24 from "fs/promises";
+import * as os11 from "os";
+import * as path25 from "path";
 init_errors();
 var STATUS_CONTAINER = "status";
 var STATUS_BLOB = "status.json";
@@ -22966,7 +24008,7 @@ async function readStatusBlob(opts) {
       cause: e
     });
   }
-  const tmpFile = path22.join(os10.tmpdir(), `m8t-status-${randomUUID2()}.json`);
+  const tmpFile = path25.join(os11.tmpdir(), `m8t-status-${randomUUID2()}.json`);
   try {
     await runAz([
       "storage",
@@ -22985,7 +24027,7 @@ async function readStatusBlob(opts) {
       "--no-progress",
       "--only-show-errors"
     ]);
-    const raw = await fs21.readFile(tmpFile, "utf8");
+    const raw = await fs24.readFile(tmpFile, "utf8");
     return JSON.parse(raw.trim());
   } catch (e) {
     throw new LocalCliError({
@@ -22995,34 +24037,34 @@ async function readStatusBlob(opts) {
       cause: e
     });
   } finally {
-    await fs21.rm(tmpFile, { force: true });
+    await fs24.rm(tmpFile, { force: true });
   }
 }
 
 // src/lib/bootstrap-state.ts
-import * as fs22 from "fs/promises";
-import * as os11 from "os";
-import * as path23 from "path";
+import * as fs25 from "fs/promises";
+import * as os12 from "os";
+import * as path26 from "path";
 function stateDir(home) {
-  return path23.join(home, ".m8t-stack");
+  return path26.join(home, ".m8t-stack");
 }
 function statePath(home) {
-  return path23.join(stateDir(home), "bootstrap.json");
+  return path26.join(stateDir(home), "bootstrap.json");
 }
-async function readBootstrapState(home = os11.homedir()) {
+async function readBootstrapState(home = os12.homedir()) {
   try {
-    const raw = await fs22.readFile(statePath(home), "utf8");
+    const raw = await fs25.readFile(statePath(home), "utf8");
     return JSON.parse(raw);
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
   }
 }
-async function writeBootstrapState(state, home = os11.homedir()) {
-  await fs22.mkdir(stateDir(home), { recursive: true });
+async function writeBootstrapState(state, home = os12.homedir()) {
+  await fs25.mkdir(stateDir(home), { recursive: true });
   const tmp = `${statePath(home)}.tmp`;
-  await fs22.writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
-  await fs22.rename(tmp, statePath(home));
+  await fs25.writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
+  await fs25.rename(tmp, statePath(home));
 }
 
 // src/commands/bootstrap/launch.ts
@@ -23062,12 +24104,12 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const out = (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `);
-    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path24.join(os12.homedir(), ".m8t-stack", "github-app.json");
+    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path27.join(os13.homedir(), ".m8t-stack", "github-app.json");
     let githubApp;
-    if (fs23.existsSync(credsPath)) {
+    if (fs26.existsSync(credsPath)) {
       let parsed;
       try {
-        parsed = JSON.parse(fs23.readFileSync(credsPath, "utf8"));
+        parsed = JSON.parse(fs26.readFileSync(credsPath, "utf8"));
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_CREDS_INVALID",
@@ -23077,7 +24119,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       }
       let pem;
       try {
-        pem = fs23.readFileSync(parsed.pemPath, "utf8");
+        pem = fs26.readFileSync(parsed.pemPath, "utf8");
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_PEM_MISSING",
@@ -23197,7 +24239,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
       typeof this.output === "string" ? this.output : void 0,
       this.context.stdout
     );
-    const sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
     const watch = this.watch === true;
     for (; ; ) {
       let doc;
@@ -23207,7 +24249,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
         if (watch && e instanceof LocalCliError && e.code === "BOOTSTRAP_STATUS_UNREADABLE") {
           if (mode === "pretty") this.context.stderr.write(`  ${colors.dim("waiting for the installer to start\u2026")}
 `);
-          await sleep2(1e4);
+          await sleep3(1e4);
           continue;
         }
         throw e;
@@ -23232,7 +24274,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
         );
         return 1;
       }
-      await sleep2(1e4);
+      await sleep3(1e4);
     }
   }
 };
@@ -23402,17 +24444,17 @@ Found ${String(found.length)} orphaned Owner@sub assignment(s) (dry-run). ${colo
 };
 
 // src/commands/bootstrap/finish.ts
-import * as fs24 from "fs/promises";
-import * as os14 from "os";
-import * as path26 from "path";
+import * as fs27 from "fs/promises";
+import * as os15 from "os";
+import * as path29 from "path";
 import { Command as Command50, Option as Option48 } from "clipanion";
 init_errors();
 
 // src/lib/company-profile-seed.ts
 import { spawn as spawn6 } from "child_process";
-import { closeSync, openSync, readFileSync as readFileSync16 } from "fs";
-import * as os13 from "os";
-import * as path25 from "path";
+import { closeSync, openSync, readFileSync as readFileSync18 } from "fs";
+import * as os14 from "os";
+import * as path28 from "path";
 init_errors();
 
 // src/lib/onboarding-profile.ts
@@ -23593,9 +24635,9 @@ function composeFounderIdentityNote(id) {
 
 // src/lib/company-profile-seed.ts
 function readGithubAppCreds(credsPath) {
-  const p = credsPath ?? path25.join(os13.homedir(), ".m8t-stack", "github-app.json");
+  const p = credsPath ?? path28.join(os14.homedir(), ".m8t-stack", "github-app.json");
   try {
-    return JSON.parse(readFileSync16(p, "utf8"));
+    return JSON.parse(readFileSync18(p, "utf8"));
   } catch {
     return null;
   }
@@ -23623,7 +24665,7 @@ async function resolveSeedContext(opts) {
 async function applyProfileToBrain(args) {
   const token = await mintInstallationTokenFromPem({
     appId: args.appCreds.appId,
-    privateKeyPem: readFileSync16(args.appCreds.pemPath, "utf8"),
+    privateKeyPem: readFileSync18(args.appCreds.pemPath, "utf8"),
     installationId: args.appCreds.installationId,
     fetchImpl: args.fetchImpl
   });
@@ -23658,7 +24700,7 @@ async function applyProfileToBrain(args) {
   });
 }
 function spawnDetachedSeedWatch() {
-  const logPath = path25.join(os13.homedir(), ".m8t-stack", "seed-profile.log");
+  const logPath = path28.join(os14.homedir(), ".m8t-stack", "seed-profile.log");
   const fd = openSync(logPath, "a");
   try {
     const child = spawn6(process.execPath, [process.argv[1] ?? "", "bootstrap", "seed-profile", "--watch"], {
@@ -23757,9 +24799,9 @@ var BootstrapFinishCommand = class extends M8tCommand {
       });
     }
     const repoRoot = (typeof this.repoRoot === "string" ? this.repoRoot : void 0) ?? process.cwd();
-    const markerDir = path26.join(os14.homedir(), ".m8t-stack");
-    await fs24.mkdir(markerDir, { recursive: true });
-    await fs24.writeFile(path26.join(markerDir, "repo-root"), `${repoRoot}
+    const markerDir = path29.join(os15.homedir(), ".m8t-stack");
+    await fs27.mkdir(markerDir, { recursive: true });
+    await fs27.writeFile(path29.join(markerDir, "repo-root"), `${repoRoot}
 `, "utf8");
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? state.subscriptionId;
     const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? state.resourceGroup;
@@ -23795,7 +24837,7 @@ var BootstrapFinishCommand = class extends M8tCommand {
     }
     let brainOrg = null;
     try {
-      const credsRaw = await fs24.readFile(path26.join(markerDir, "github-app.json"), "utf8");
+      const credsRaw = await fs27.readFile(path29.join(markerDir, "github-app.json"), "utf8");
       const creds = JSON.parse(credsRaw);
       brainOrg = typeof creds.org === "string" ? creds.org : null;
     } catch {
@@ -23826,18 +24868,18 @@ ${colors.field("Then open a brand new chat/session")} \u2014 new skills + MCP se
 };
 
 // src/commands/bootstrap/ui.ts
-import * as fs26 from "fs";
-import * as os16 from "os";
-import * as path28 from "path";
+import * as fs29 from "fs";
+import * as os17 from "os";
+import * as path31 from "path";
 import { Command as Command51, Option as Option49 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential19 } from "@azure/identity";
 init_errors();
 
 // src/lib/bootstrap-ui.ts
-import * as fs25 from "fs";
+import * as fs28 from "fs";
 import * as net from "net";
-import * as os15 from "os";
-import * as path27 from "path";
+import * as os16 from "os";
+import * as path30 from "path";
 import { spawn as spawn7 } from "child_process";
 init_errors();
 init_rbac();
@@ -23845,7 +24887,7 @@ async function resolveFoundryEndpointWithWait(args, opts = {}) {
   const pollMs = opts.pollMs ?? 1e4;
   const timeoutMs = opts.timeoutMs ?? 15 * 6e4;
   const deadline = Date.now() + timeoutMs;
-  const sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+  const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
   for (; ; ) {
     try {
       const p = await resolveFoundryProject({
@@ -23879,7 +24921,7 @@ async function resolveFoundryEndpointWithWait(args, opts = {}) {
         });
       }
       opts.onWait?.("waiting for Foundry-create to finish\u2026");
-      await sleep2(pollMs);
+      await sleep3(pollMs);
     }
   }
 }
@@ -23904,9 +24946,9 @@ async function ensureFounderFoundryRole(args) {
   });
 }
 function writeWebEnvLocal(args) {
-  const envPath = path27.join(args.repoRoot, "apps", "web", ".env.local");
-  if (fs25.existsSync(envPath)) {
-    fs25.copyFileSync(envPath, envPath + ".bak");
+  const envPath = path30.join(args.repoRoot, "apps", "web", ".env.local");
+  if (fs28.existsSync(envPath)) {
+    fs28.copyFileSync(envPath, envPath + ".bak");
   }
   const body = [
     "# Written by `m8t bootstrap ui` \u2014 onboarding chat-only run (Simple Stacey).",
@@ -23920,7 +24962,7 @@ function writeWebEnvLocal(args) {
     "NEXT_PUBLIC_M8T_ONBOARDING=1",
     ""
   ].join("\n");
-  fs25.writeFileSync(envPath, body, "utf8");
+  fs28.writeFileSync(envPath, body, "utf8");
   return envPath;
 }
 function assertNodeVersion(versionString = process.version) {
@@ -23961,11 +25003,11 @@ async function installWebDeps(repoRoot) {
   });
   await runInherit("pnpm", ["install"], repoRoot, "BOOTSTRAP_UI_INSTALL_FAILED");
 }
-function onboardingUiPaths(home = os15.homedir()) {
-  const dir = path27.join(home, ".m8t-stack");
+function onboardingUiPaths(home = os16.homedir()) {
+  const dir = path30.join(home, ".m8t-stack");
   return {
-    logPath: path27.join(dir, "onboarding-ui.log"),
-    pidPath: path27.join(dir, "onboarding-ui.pid")
+    logPath: path30.join(dir, "onboarding-ui.log"),
+    pidPath: path30.join(dir, "onboarding-ui.pid")
   };
 }
 async function serveOnboardingUiDetached(args) {
@@ -23989,8 +25031,8 @@ async function serveOnboardingUiDetached(args) {
   if (await isPortOpen()) {
     return { alreadyRunning: true, logPath };
   }
-  fs25.mkdirSync(path27.dirname(logPath), { recursive: true });
-  const fd = fs25.openSync(logPath, "a");
+  fs28.mkdirSync(path30.dirname(logPath), { recursive: true });
+  const fd = fs28.openSync(logPath, "a");
   const child = spawn7("pnpm", ["--filter", "web", "dev"], {
     cwd: args.repoRoot,
     detached: true,
@@ -23998,7 +25040,7 @@ async function serveOnboardingUiDetached(args) {
     env: { ...process.env, PORT: args.port },
     shell: false
   });
-  fs25.closeSync(fd);
+  fs28.closeSync(fd);
   if (child.pid == null) {
     throw new LocalCliError({
       code: "BOOTSTRAP_UI_DEV_SPAWN_FAILED",
@@ -24007,11 +25049,11 @@ async function serveOnboardingUiDetached(args) {
     });
   }
   child.unref();
-  fs25.writeFileSync(pidPath, String(child.pid), "utf8");
+  fs28.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
-  const sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+  const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
-    await sleep2(500);
+    await sleep3(500);
     if (await isPortOpen()) break;
   }
   return { alreadyRunning: false, logPath };
@@ -24026,11 +25068,11 @@ function autoOpenOnboardingUi(url, open = tryOpenUrl) {
   } catch {
   }
 }
-function stopOnboardingUi(home = os15.homedir()) {
+function stopOnboardingUi(home = os16.homedir()) {
   const { pidPath } = onboardingUiPaths(home);
   let pidStr;
   try {
-    pidStr = fs25.readFileSync(pidPath, "utf8").trim();
+    pidStr = fs28.readFileSync(pidPath, "utf8").trim();
   } catch {
     return false;
   }
@@ -24043,7 +25085,7 @@ function stopOnboardingUi(home = os15.homedir()) {
     }
   }
   try {
-    fs25.unlinkSync(pidPath);
+    fs28.unlinkSync(pidPath);
   } catch {
   }
   return true;
@@ -24159,10 +25201,10 @@ var BootstrapUiCommand = class extends M8tCommand {
       this.context.stderr.write(`  ${colors.dim(m)}
 `);
     };
-    if (fs26.existsSync(path28.join(os16.homedir(), ".m8t-stack", "config.yaml"))) {
+    if (fs29.existsSync(path31.join(os17.homedir(), ".m8t-stack", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t-stack/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
-    const credential2 = new DefaultAzureCredential17();
+    const credential2 = new DefaultAzureCredential19();
     const account = await getAzAccount();
     assertNodeVersion();
     out("waiting for Foundry (the installer's foundry-create phase)\u2026");
@@ -24265,7 +25307,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
     const parsedTimeout = Number(rawTimeout);
     const timeoutMin = rawTimeout !== "" && Number.isFinite(parsedTimeout) ? parsedTimeout : 20;
     const deadline = Date.now() + timeoutMin * 6e4;
-    const sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+    const sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
     for (; ; ) {
       const token = await getFoundryToken();
       const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token });
@@ -24288,7 +25330,7 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       }
       this.context.stderr.write(`  ${colors.dim("waiting for the questionnaire to complete\u2026")}
 `);
-      await sleep2(2e4);
+      await sleep3(2e4);
     }
   }
 };